fix(approval): honor glob command allowlist entries

[helix4u]

What does this PR do?

Honors manual command_allowlist entries as command text patterns, including shell-style globs such as podman *.

Permanent approvals already store danger-category keys like recursive delete, while users can also manually configure command text in command_allowlist. Before this change, manual wildcard entries were loaded but not matched against the actual command in the current guard paths, so a user trying to allow local commands like podman * still hit approval prompts.

The fix adds a small shared matcher for exact command text and fnmatch globs, then uses it in both approval entry points after the hardline/sudo floors and before normal Tirith/dangerous-command prompts. That means podman * can suppress normal local-command approval prompts, but it cannot bypass catastrophic hardline blocks such as rm -rf /.

Related Issue

Support report: local Podman users cannot pre-allow trusted command prefixes such as podman * for unattended local-terminal work.

Related open PR checked: #9163. It has the same general idea, but only patches check_dangerous_command(); this PR also covers the current combined check_all_command_guards() path.

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

• tools/approval.py - Added a shared permanent command allowlist matcher for exact command text and shell-style globs.
• tools/approval.py - Applied the matcher in both check_dangerous_command() and check_all_command_guards() after the hardline/sudo floors.
• tests/tools/test_command_guards.py - Added regression coverage for podman *, dangerous-pattern glob allowlisting, and hardline non-bypass behavior.

How to Use

After this lands, a user who intentionally wants unattended local Podman commands can add a glob entry to command_allowlist in config.yaml:

command_allowlist:
  - "podman *"

Then restart the Hermes process/session that is running the agent so the approval module reloads the allowlist.

This is for trusted local command prefixes only. It skips normal approval prompts for matching commands, but it does not bypass hardline blocks such as rm -rf /, and it does not change approvals.mode globally.

How to Test

1. scripts/run_tests.sh tests/tools/test_command_guards.py -j 4
2. Confirm podman * in the permanent allowlist approves podman run --rm ... through the combined guard path.
3. Confirm rm * in the permanent allowlist still does not bypass the hardline block for rm -rf /.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: WSL Ubuntu

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — pure Python command matching
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

For New Skills

N/A

Screenshots / Logs

Focused local validation:

scripts/run_tests.sh tests/tools/test_command_guards.py -j 4

Result: 21/21 passed.

Full test suite not run locally; leaving broad coverage to CI.