fix(approval): sudo-S brute-force block + sudo-stdin/askpass DANGEROUS (salvage of #22194 + #21128)

[kshitijk4poor]

Summary

Salvages two complementary security fixes for the sudo-password class of issues into one PR. Both target the same underlying problem: an LLM agent with no TTY can attempt sudo brute-forcing or unauthorized privilege escalation by piping passwords via sudo -S/--stdin/--askpass. The two PRs cover different layers of the defense:

Layer	From	What it does
Unconditional block	#22194 by @29206394	Blocks sudo -S (the LLM brute-force vector) in check_all_command_guards above yolo, when SUDO_PASSWORD is unset. Cannot be bypassed by --yolo / approvals.mode=off.
Approval-required (DANGEROUS)	#21128 by @fr33d3m0n	Adds sudo -S/--stdin/-A/--askpass/-s/-a and combined-short-flag variants to DANGEROUS_PATTERNS. Surfaces the privilege-relevant invocations through normal approval (yolo can bypass — by design).

Together they address #9590 (sudo password chat-leak via small-model brute-force) and #17873 cat 4 (broader sudo privilege-flag surface).

Why both layers

• fix(terminal): block sudo -S password guessing when SUDO_PASSWORD is unset #22194 alone would miss sudo --askpass, herestring (<<<), and combined-flag forms (-nS, -sA).
• fix(approval): catch sudo with stdin/askpass/shell privilege flags #21128 alone is approval-required, which yolo bypasses — agents running with --yolo could still brute-force sudo -S [guess].
• Together: yolo-proof unconditional block on the brute-force vector, plus broader approval-required visibility on all privilege-relevant sudo invocations.

The two layers don't overlap behaviorally. The unconditional guard fires only when SUDO_PASSWORD is unset; the legitimate Hermes _transform_sudo_command path (which injects -S itself when SUDO_PASSWORD is configured) is unchanged.

Closes / supersedes

• Closes Security: Agent attempts to guess and display sudo password in chat #9590 (root cause: brute-force vector blocked unconditionally; the chat-leak symptom was downstream of the agent retrying with guessed passwords).
• Addresses tools/approval.py: Add reverse shell, download-execute, and credential read patterns to DANGEROUS_PATTERNS #17873 category 4 (sudo privilege-flag detection). The other categories (reverse shell, download-execute, credential reads) are tracked separately.
• Supersedes #20130 (also targeted Security: Agent attempts to guess and display sudo password in chat #9590 but with system-prompt + tool-description + final-response regex scrubbing — the regex had high false-positive rate on env-file examples, code snippets, and doc placeholders, and the fix didn't address the brute-force mechanism).

Changes

File	+lines	What
tools/approval.py	+78	_check_sudo_stdin_guard() + 2 DANGEROUS_PATTERNS entries
tests/tools/test_hardline_blocklist.py	+88	6 tests for the unconditional guard (positive, allow, password-bypass, integration, yolo-can't-bypass, container bypass)
tests/tools/test_approval.py	+137	9+ tests for the DANGEROUS_PATTERNS coverage (stdin, askpass, herestring, combined flags, printf form)
scripts/release.py	+2	AUTHOR_MAP entries for both contributors

303 net lines, 254 tests pass in the modified suites (test_hardline_blocklist.py + test_approval.py).

E2E verification

Verified through check_all_command_guards() with real imports (no mocks) that:

Case	Expected	Actual
sudo -S whoami (SUDO_PASSWORD unset)	BLOCKED unconditionally	✅ BLOCKED
`echo guess1	sudo -S whoami` (brute-force)	BLOCKED
sudo -k && sudo -S whoami	BLOCKED	✅ BLOCKED
sudo whoami (plain sudo)	ALLOWED	✅ ALLOWED
ls -la	ALLOWED	✅ ALLOWED
sudo -S whoami with HERMES_YOLO_MODE=1	BLOCKED (yolo can't bypass)	✅ BLOCKED
sudo -S whoami in docker backend	ALLOWED (container isolated)	✅ ALLOWED
sudo --stdin id, sudo -A whoami, sudo -nS id, sudo -u root -S whoami, sudo -S id <<< 'pw', `printf "%s\n" "$PW"	sudo -S id`	flagged as DANGEROUS (approval required)

Test plan

# Modified test suites
bash scripts/run_tests.sh tests/tools/test_hardline_blocklist.py tests/tools/test_approval.py
# 254 passed, 0 failed

# Full tools/ directory: 11 pre-existing failures on origin/main
# (all in test_file_read_guards.py / test_file_staleness.py / test_file_state_registry.py
#  — macOS /var → /private/var symlink issue, unrelated to this PR)

Lint diff: ruff clean, no new ty issues on changed files.

Authorship

Cherry-picked individual commits to preserve per-commit authorship:

• fix(terminal): block sudo -S password guessing when SUDO_PASSWORD is not set — @29206394 (PR fix(terminal): block sudo -S password guessing when SUDO_PASSWORD is unset #22194)
• fix(approval): catch sudo with stdin/askpass/shell privilege flags — @fr33d3m0n (PR fix(approval): catch sudo with stdin/askpass/shell privilege flags #21128)
• chore: AUTHOR_MAP entries for sudo-hardening salvage contributors — @kshitijk4poor (this salvage)

Both contributors credited via AUTHOR_MAP. Original PRs will be closed pointing to this one.

[github-actions]

🔎 Lint report: salvage/sudo-hardening-9590-17873 vs origin/main

ruff

Total: 0 on HEAD, 0 on base (➖ 0)

🆕 New issues: none

✅ Fixed issues: none

Unchanged: 0 pre-existing issues carried over.

ty (type checker)

Total: 8158 on HEAD, 8158 on base (➖ 0)

🆕 New issues: none

✅ Fixed issues: none

Unchanged: 4288 pre-existing issues carried over.

Diagnostics are surfaced as warnings — this check never fails the build.