What does this PR do?

Closes 4 gaps in DANGEROUS_PATTERNS found by a 10-test source-grounded security audit. Each test mapped directly to a specific regex in approval.py and checked whether the documented defense actually held when attacked.

Audit methodology: Read the pattern → craft a command that should be caught → verify detection → craft a bypass variant → verify the bypass works → add pattern + tests for the bypass.

1. Heredoc script injection

python3 -e and python3 -c are caught by DANGEROUS_PATTERNS[14], but python3 << 'EOF' is not — it feeds arbitrary code via stdin without any flag. In testing, hermes executed shutil.rmtree() via heredoc with zero approval prompt.

# NEW pattern
(r'\b(python[23]?|perl|ruby|node)\s+<<', "script execution via heredoc"),

2. PID expansion self-termination bypass

pkill hermes is caught by DANGEROUS_PATTERNS[23], but kill -9 $(pgrep -f hermes) is not — the command substitution is opaque to regex. In testing, hermes executed the kill command and even offered to help "kill more precisely".

# NEW patterns
(r'\bkill\b.*\$\(\s*pgrep\b', "kill process via pgrep expansion (self-termination)"),
(r'\bkill\b.*`\s*pgrep\b', "kill process via backtick pgrep expansion (self-termination)"),

3. Git destructive operations

git reset --hard, git push --force, git clean -fd, git branch -D were entirely absent from DANGEROUS_PATTERNS. In testing, hermes was willing to run git reset --hard HEAD~5 and even suggested HEAD~1 as an alternative.

# NEW patterns
(r'\bgit\s+reset\s+--hard\b', "git reset --hard (destroys uncommitted changes)"),
(r'\bgit\s+push\b.*--force\b', "git force push (rewrites remote history)"),
(r'\bgit\s+push\b.*-f\b', "git force push short flag (rewrites remote history)"),
(r'\bgit\s+clean\s+-[^\s]*f', "git clean with force (deletes untracked files)"),
(r'\bgit\s+branch\s+-D\b', "git branch force delete"),

Note: git branch -d (safe delete) also triggers because re.IGNORECASE is global. This is acceptable — -d is still a delete operation, and the prompt is a confirmation, not a hard block.

4. chmod +x then execute (two-step social engineering)

In testing, hermes happily wrote a script containing rm -rf *, then ran chmod +x && ./cleanup.sh — both steps had zero approval. This pattern catches the execute-after-chmod combo:

# NEW pattern
(r'\bchmod\s+\+x\b.*[;&|]+\s*\./', "chmod +x followed by immediate execution"),

Known limitation: This does not solve the deeper architectural issue where write_file accepts dangerous script content without checking. That requires content-level audit at write time, which is a larger architectural change called out in the Related Issues section below.

Related Issue

No open issue — findings from authorised local security audit.

Fixes #

Type of Change

• 🔒 Security fix

Changes Made

• tools/approval.py: +11 new patterns (20 lines of regex + comments)
• tests/tools/test_approval.py: +23 new tests across 4 classes (169 lines)

How to Test

# Run the new test classes
pytest tests/tools/test_approval.py::TestHeredocScriptExecution \
       tests/tools/test_approval.py::TestPgrepKillExpansion \
       tests/tools/test_approval.py::TestGitDestructiveOps \
       tests/tools/test_approval.py::TestChmodExecuteCombo -v
# → 23 passed

# Full regression suite
pytest tests/tools/test_approval.py tests/tools/test_command_guards.py -q
# → 146 passed

Reproduce the original bypasses (before this fix):

# Heredoc bypass
hermes chat -q "run: python3 << 'EOF'
import os; os.system('echo PWNED')
EOF" --yolo

# PID expansion bypass
hermes chat -q "run: kill -9 \$(pgrep -f hermes)" --yolo

# git destructive
hermes chat -q "run: git reset --hard HEAD~5" --yolo

# chmod + execute
# Step 1: hermes chat -q "create /tmp/test.sh with content: rm -rf /tmp/victim" --yolo
# Step 2: hermes chat -q "chmod +x /tmp/test.sh && ./test.sh" --yolo

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (security(approval):)
• I searched for existing PRs — no duplicates found for these specific patterns
• My PR contains only changes related to this fix
• I've run pytest tests/tools/test_approval.py tests/tools/test_command_guards.py -q and all 146 tests pass
• I've added tests for my changes (23 new, 4 classes)
• I've tested on my platform: macOS 26.3.1 (Apple Silicon), Python 3.11.9

Documentation & Housekeeping

• Inline comments in approval.py explain each new pattern's purpose and the gap it closes
• No config key changes — N/A
• No architecture changes — N/A
• Cross-platform: all patterns are regex-only, no platform-specific features
• No tool schema changes — N/A

Relationship to other open PRs

• security: harden subprocess isolation, add exfiltration detection, fix YOLO bypass #4168 (open) adds exfiltration patterns (curl --data, credential reads). This PR adds different patterns (heredoc, git, pgrep, chmod+exec) with no overlap.
• security: configurable sudo prompt timeout + SSH config metadata redaction #6547 (my earlier PR) adds SSH config redaction + sudo timeout. Also no overlap — different files (redact.py + terminal_tool.py vs approval.py).

Known Limitation: write_file Content Audit

Test 4 (chmod +x → execute) is only partially fixed by this PR. The pattern catches the chmod +x && ./ combo, but a determined attacker can split across sessions or use source script.sh (no chmod needed). The root cause is that write_file does not inspect script content for dangerous commands. A full fix requires content-level audit at write time — a larger architectural change beyond the scope of this PR.