Review found the knob had no effect on real terminal calls: terminal_tool
routes through check_all_command_guards, whose non-interactive early
return approves non-cron commands regardless of the setting. Only the
direct check_dangerous_command entry point was covered.
Applies the policy in the consolidated guard before that return, mirroring
the cron branch beside it — dangerous-pattern detection first, then the
tirith content check, including the tirith_fail_open handling so an
operator who opted into fail-closed is not silently allowed here either.
Also adds the two things the review asked for alongside it:
- approvals.noninteractive_mode in DEFAULT_CONFIG, so it participates in
the documented deep-merge contract rather than existing only as a
cfg_get default. New tests exercise the real config path (writing a
config.yaml under HERMES_HOME) instead of mocking load_config, and
assert sibling keys survive the merge.
- The key documented in website/docs/user-guide/configuration.md, which
the first pass missed; security.md and the configuration reference in
the skills tree were already updated.
Verified against a live install: with noninteractive_mode: deny and no
human present, `git reset --hard HEAD~3` now blocks through
check_all_command_guards where it was previously approved. A profile on
the default is unchanged. 24 tests in the new file, 105 across the
approval suite plus the config-contract tests.
ca076eef8a