ca076eef8a
Review found the knob had no effect on real terminal calls: terminal_tool routes through check_all_command_guards, whose non-interactive early return approves non-cron commands regardless of the setting. Only the direct check_dangerous_command entry point was covered. Applies the policy in the consolidated guard before that return, mirroring the cron branch beside it — dangerous-pattern detection first, then the tirith content check, including the tirith_fail_open handling so an operator who opted into fail-closed is not silently allowed here either. Also adds the two things the review asked for alongside it: - approvals.noninteractive_mode in DEFAULT_CONFIG, so it participates in the documented deep-merge contract rather than existing only as a cfg_get default. New tests exercise the real config path (writing a config.yaml under HERMES_HOME) instead of mocking load_config, and assert sibling keys survive the merge. - The key documented in website/docs/user-guide/configuration.md, which the first pass missed; security.md and the configuration reference in the skills tree were already updated. Verified against a live install: with noninteractive_mode: deny and no human present, `git reset --hard HEAD~3` now blocks through check_all_command_guards where it was previously approved. A profile on the default is unchanged. 24 tests in the new file, 105 across the approval suite plus the config-contract tests. |
||
|---|---|---|
| .. | ||
| docs | ||
| i18n/zh-Hans/docusaurus-plugin-content-docs/current | ||
| scripts | ||
| src | ||
| static | ||
| .gitignore | ||
| .npmrc | ||
| README.md | ||
| docusaurus.config.ts | ||
| package-lock.json | ||
| package.json | ||
| sidebars.ts | ||
| tsconfig.json | ||
README.md
Website
This website is built using Docusaurus, a modern static website generator.
Installation
yarn
Local Development
yarn start
This command starts a local development server and opens up a browser window. Most changes are reflected live without having to restart the server.
Build
yarn build
This command generates static content into the build directory and can be served using any static contents hosting service.
Deployment
Using SSH:
USE_SSH=true yarn deploy
Not using SSH:
GIT_USER=<Your GitHub username> yarn deploy
If you are using GitHub pages for hosting, this command is a convenient way to build the website and push to the gh-pages branch.
Diagram Linting
CI runs ascii-guard to lint docs for ASCII box diagrams. Use Mermaid (````mermaid`) or plain lists/tables instead of ASCII boxes to avoid CI failures.