NousResearch/hermes-agent merged commit e2fe529ef on July 5, adding approvals.deny to config, command-guard checks, security docs, and tests that prove deny rules fire before yolo, session yolo, mode off, and permanent allowlists.
For agent operators, the morning decision is to add explicit deny rules for commands that should never run through the agent, then watch whether Hermes reintroduces a broader plugin approval gate after reverting it later the same day.
Facts
- The new config field accepts case-insensitive fnmatch globs such as
git push --force*and*curl*|*sh*. - The guard code checks the deny list after the hardline blocklist and before yolo, approvals-off, and command allowlist shortcuts.
- A separate pre-tool-call approval escalation landed earlier on July 5 and was reverted by commit
74cc9ee3fon July 6.
Evidence
The public receipts are the deny-rules commit, the security and configuration documentation it changed, the new approval-deny tests, the earlier pre-tool approval commit, and the revert that removed that broader hook path.
Context
This matters because yolo modes trade friction for speed. Hermes is now separating "do not ask me" from "never do this," which gives operators a smaller, inspectable control before broader plugin-mediated approvals settle.
Limits
The evidence proves a host-side command guard, not complete tool governance. The reverted plugin path shows the wider approval design is still unsettled. What to watch: whether a future Hermes commit brings back tool-level approval with the same fail-closed discipline.