§ øžyjãó2—dZddlmZddlZddlmZd d „ZdS) zÌ``hermes approvals`` subcommand parser. Follows the cron/security pattern: parser construction lives here, the handler is injected by ``main.py`` so this module never imports ``main`` (cycle avoidance). é)Ú annotationsN)ÚCallableÚ cmd_approvalsrÚreturnÚNonecó6—| ddd¬¦«}| dd¬¦«}| dd d ¬¦«}| d d d d¬¦«| ddd¬¦«| dtdd¬¦«| ddtdd¬¦«| dtdd¬¦«| d d!¬"¦«| |¬#¦«| d$d%d&¬¦«}| d'd(d)d*¬+¦«| ddd¬¦«| d,t jd-d.¬/¦«| |¬#¦«| |¬#¦«d0S)1z6Attach the ``approvals`` subcommand to ``subparsers``.Ú approvalsz=Approval-prompt tools (mine history into allowlist proposals)zÚTools for the dangerous-command approval system. `hermes approvals suggest` mines past approval decisions from the session database and proposes command_allowlist entries so repeatedly-approved commands stop prompting.)ÚhelpÚ descriptionÚapprovals_commandz )ÚdestÚmetavarÚsuggestz5Propose command_allowlist entries from past approvalsa/Scan the session database for dangerous-classified commands that ran with user approval, rank the recurring patterns, and print a numbered allowlist proposal. Nothing is written unless --apply is given. Destructive classes (recursive delete, sudo, disk writes, credential edits, ...) are never proposed.z--applyÚ apply_indiceszN[,M...]zUMerge the numbered proposals (from a prior run) into command_allowlist in config.yaml)r rr z--jsonÚ store_truez9Emit machine-readable JSON instead of human-readable text)Úactionr z--dayséZz;How far back to scan session history (default: 90; 0 = all))ÚtypeÚdefaultr z --min-countÚ min_countéz@Minimum approval count for a pattern to be proposed (default: 2))r rrr z--limitéz1Maximum number of proposals to show (default: 20)z--dbzCPath to an alternate session database (default: ~/.hermes/state.db))r )ÚfuncÚtestz>Dry-run the approval verdict for a command (never executes it)uñEvaluate a command against the REAL runtime approval guards — hardline blocklist, user approvals.deny rules, dangerous-pattern detection, allowlist, yolo/off bypass — and print the verdict, the matching rule, and the normalized-command trace, without executing the command, prompting anyone, or persisting anything. Exit codes: 0 allow, 2 ask-approval, 3 deny (hardline or user deny rule). Tip: use `--` before the command so its own flags aren't parsed: hermes approvals test -- rm -rf /tmp/xz --env-typeÚenv_typeÚlocalzsTerminal backend type to evaluate against (default: local; isolated container backends like docker skip the guards))r rr Ú command_wordsÚcommandz=The command to evaluate (prefix with -- to protect its flags))Únargsrr N)Ú add_parserÚadd_subparsersÚ add_argumentÚintÚ set_defaultsÚargparseÚ REMAINDER)Ú subparsersrÚapprovals_parserÚapprovals_subparsersÚsuggest_parserÚ test_parsers úF/home/ragecks/.hermes/hermes-agent/hermes_cli/subcommands/approvals.pyÚbuild_approvals_parserr-sm€à!×,Ò,ØØ Lð ;ð -ñ ô Ðð,×:Ò:Ø Øð;ñôÐð *×4Ò4ØØ Dð Fð 5ñ ô €Nð×ÒØØ Øð+ð  ñôðð×ÒØØØ Hð ñôðð ×ÒØÝ ØØ Jð  ñôðð ×ÒØØ Ý ØØ Oð  ñôðð×ÒØÝ ØØ @ð  ñôðð ×ÒØØ Rð ñôðð×Ò ]ÐÑ3Ô3Ð3à&×1Ò1ØØ Mð Dð 2ñ ô €Kð×ÒØØ ØðCð ñôðð×ÒØØØ Hðñôðð ×ÒØÝÔ ØðMð ñôðð×Ò -ÐÑ0Ô0Ð0à×!Ò! }Ð!Ñ5Ô5Ð5Ð5Ð5ó)rrrr)Ú__doc__Ú __future__rr%Útypingrr-©r.r,úr3sbðððð#Ð"Ð"Ð"Ð"Ð"à€€€ØÐÐÐÐÐðe6ðe6ðe6ðe6ðe6ðe6r.