fix(approval): add glob matching for command_allowlist entries

[richardiitse]

Problem

command_allowlist entries (e.g. python3 << *) are glob patterns, but is_approved() was doing only set membership checks against pattern keys like script execution via heredoc. This means glob entries in command_allowlist never matched and commands always required approval.

Fix

Add fnmatch-based glob checking before the pattern-key lookup in check_dangerous_command(). Now glob patterns like python3 << * correctly bypass approval prompts.

# In check_dangerous_command(), after detect_dangerous_command():
with _lock:
    if any(fnmatch.fnmatch(command, p) for p in _permanent_approved):
        return {"approved": True, "message": None}

Testing

check_dangerous_command("python3 << EOF\nprint(1)\nEOF", "local")
# => {"approved": True, "message": None}  # was: approval_required

check_dangerous_command("pdftotext /root/test.pdf", "local")
# => {"approved": True, "message": None}  # already worked

Files changed

• tools/approval.py: +1 import (fnmatch), +6 lines (glob pre-check)

[teknium1]

Thanks for identifying the command-text versus danger-key mismatch.

Problems

• tools/approval.py:612 matches the entire command with an unrestricted glob. That permits a pattern such as python3 << * to span embedded newlines and shell syntax. Current main intentionally rejects compound commands before allowlist matching (tools/approval.py:1588-1607) and has regression coverage for chaining, pipes, redirects, newlines, backticks, and substitutions (tests/tools/test_command_guards.py:276-304).
• The patch only covers check_dangerous_command(). Current main uses its shared matcher from both check_dangerous_command() and check_all_command_guards() (tools/approval.py:2276, tools/approval.py:2591).

Suggested changes

• A safe heredoc-specific policy would need a constrained parser-based design and tests rather than unrestricted full-command globbing.

Automated hermes-sweeper review.

[teknium1]

fnmatch here runs against the whole shell string, so * can span newlines and shell operators. This would let a glob such as python3 << * approve appended/chained content; use a constrained matcher that rejects compound shell syntax before granting the shortcut.