feat(approvals): detect exec-via-flag escapes on read-only commands (port kilocode#11890)

[teknium1]

Summary

The approval system now detects exec-via-flag escapes on otherwise read-only commands — sort --compress-program, rg --pre / --hostname-bin, ag --pager, and man -P / --pager / --html — and surfaces payloads smuggled through those flags to the hardline floor.

Port of Kilo-Org/kilocode#11890 ("close read-only bash exec-flag escapes"), adapted to Hermes's regex-based dangerous-pattern detection instead of Kilo's glob allow/deny rule list.

The gap (confirmed live on main): these flags make an innocuous-looking command execute an arbitrary program. Before this change, sort --compress-program=sh names.txt ran with zero approval, and — worse — sort --compress-program='rm -rf --no-preserve-root /' f bypassed the unconditional hardline floor entirely, because the payload was opaque argument text that never anchored at a command position.

Changes

• tools/approval.py:
  • 7 new DANGEROUS_PATTERNS entries flagging the mechanism itself (approval required even when the payload is a script whose contents we cannot inspect).
  • _exec_flag_payloads() + wiring in _command_detection_variants(): extracts each flag's program value and yields it as its own detection variant, so a hardline payload inside the flag anchors at command position and hits the floor. man's short -P/-H flags are scoped to a man command context so grep -P (perl regex) never false-positives.
• tests/tools/test_exec_via_flag_guard.py: 30 tests — attack shapes, hardline-payload floor coverage, legit-command negatives (rg --pretty, pip install --pre, man -k pager, grep -P), payload-extraction unit tests.

Adaptation notes

• Kilo's fix edits a glob rule table (readOnlyBash) on their allowlist agent; Hermes has no per-agent allowlist, so the port lands in the shared DANGEROUS_PATTERNS / detection-variant machinery that guards every terminal call.
• Kilo's sort --files0-from deny was not ported: it only reads a file list, which is within Hermes's threat model for the agent (it has read_file anyway) — flagging it would be a pointless approval prompt.
• Defense-in-depth is layered: mechanism-level dangerous flag (yolo can pass it through, as intended) + payload-level hardline floor (nothing passes it through).

Validation

	Before	After
sort --compress-program=sh f	no prompt	approval required
sort --compress-program='rm -rf /' f	runs under yolo	hardline blocked
man -P 'rm -rf /' ls	no prompt	hardline blocked
rg --pretty, grep -P, pip install --pre	pass	still pass

554 tests green across the approval suites (test_approval, test_hardline_blocklist, test_approval_deny_rules, test_smart_approval_injection, test_exec_via_flag_guard + interrupt/cron/write/clean-slate suites).

Infographic

[teknium1]

Closing — this exec-via-flag detection already landed on main via b90dbac1d6 "fix(approval): unify execution-bearing option detection", which uses a quote-aware structural tokenizer covering the same flag set as this PR plus interpreter -e/-c, shell -c, heredocs, and recursive nested-payload handling. Superset of this port; closing as already-implemented.