hermes - 💡(How to fix) Fix `hermes hooks allow` command does not exist in v0.14.x; no documented path for non-TTY selective allowlisting

Environment

• Hermes Agent: v0.14.0 (2026.5.16)
• • OS: Debian 13 (Trixie)
• • • Python: 3.11.15

Description

Multiple community guides and setup tutorials reference hermes hooks allow <path> as the mechanism for allowlisting a shell hook script. The command does not exist. Running it produces an error listing only the available subcommands.

The official hooks documentation describes three bypass mechanisms for non-interactive consent (--accept-hooks, HERMES_ACCEPT_HOOKS=1, hooks_auto_accept: true) but none of these allowlist a hook persistently for future runs — they only bypass the prompt for the current invocation. A service account or headless deployment with no TTY and no desire to use hooks_auto_accept: true globally has no documented path to selectively allowlist a specific hook.

Steps to Reproduce

hermes hooks allow ~/.hermes/hooks/my-hook.py

Actual Result

usage: hermes hooks [-h] {list,ls,test,revoke,remove,rm,doctor} ...
hermes hooks: error: argument hooks_action: invalid choice: 'allow'
(choose from 'list', 'ls', 'test', 'revoke', 'remove', 'rm', 'doctor')

Expected Result

Either:

• A hermes hooks allow <path> command exists and writes the correct allowlist entry, or
• • The documentation clearly describes how to manually write ~/.hermes/shell-hooks-allowlist.json for non-interactive deployments

Workaround (discovered from source code)

The correct allowlist format, found by reading agent/shell_hooks.py _is_allowlisted():

import json
from pathlib import Path

script    = Path("/path/to/hook.py")
allowlist = Path.home() / ".hermes/shell-hooks-allowlist.json"
data = {
    "approvals": [
        {"event": "post_llm_call", "command": str(script)}
    ]
}
allowlist.write_text(json.dumps(data, indent=2))

After writing this file, hermes hooks list correctly shows ✓ allowed.

Additional Notes

• HERMES_ACCEPT_HOOKS=1 on its own does not cause hermes hooks list to show ✓ allowed — it only bypasses the prompt during an active session
• • hooks_auto_accept: true auto-approves all hooks globally, which is too broad for deployments that want selective allowlisting per hook