mirror of
https://github.com/NousResearch/hermes-agent.git
synced 2026-06-09 08:21:50 +00:00
568e127612
Batch extraction of every remaining subcommand whose handler is top-level and whose parser block is pure argparse: model, setup, postinstall, whatsapp, slack, login, logout, auth, status, webhook, hooks, doctor, security, dump, debug, backup, import, config, version, update, uninstall, dashboard, gui, logs, prompt-size. Each becomes hermes_cli/subcommands/<name>.py with build_<name>_parser() and an injected handler (no main import). dashboard also injects cmd_dashboard_register for its nested 'register' action. Behavior-neutral: all 25 subcommands' --help output (and nested subaction help) diff-verified byte-identical to pre-extraction. Two RawDescriptionHelpFormatter epilogs (debug, logs) needed their multi-line string interiors preserved at column 0 — caught by the --help diff, not compile. main() 3297 -> 1798 LOC across this PR; add_parser calls in main.py 179 -> 89. Validation: tests/hermes_cli/ 6476 passed / 0 failed under per-file process isolation; new test_subcommands_batch.py smoke-tests all 25 builders + the dashboard two-handler case.
62 lines
2.2 KiB
Python
62 lines
2.2 KiB
Python
"""``hermes security`` subcommand parser.
|
|
|
|
Extracted verbatim from ``hermes_cli/main.py:main()`` (god-file Phase 2).
|
|
Handler injected to avoid importing ``main``.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
from typing import Callable
|
|
|
|
|
|
def build_security_parser(subparsers, *, cmd_security: Callable) -> None:
|
|
"""Attach the ``security`` subcommand to ``subparsers``."""
|
|
# =========================================================================
|
|
security_parser = subparsers.add_parser(
|
|
"security",
|
|
help="Supply-chain audit (OSV.dev) for venv, plugins, and MCP servers",
|
|
description=(
|
|
"On-demand vulnerability scan against OSV.dev. Covers the Hermes "
|
|
"venv (installed PyPI dists), Python deps declared by plugins under "
|
|
"~/.hermes/plugins/, and pinned npx/uvx MCP servers in config.yaml. "
|
|
"Does NOT scan globally-installed packages or editor/browser extensions."
|
|
),
|
|
)
|
|
security_subparsers = security_parser.add_subparsers(
|
|
dest="security_command",
|
|
metavar="<subcommand>",
|
|
)
|
|
|
|
audit_parser = security_subparsers.add_parser(
|
|
"audit",
|
|
help="Run a one-shot supply-chain audit",
|
|
description="Query OSV.dev for known vulnerabilities in installed components.",
|
|
)
|
|
audit_parser.add_argument(
|
|
"--json",
|
|
action="store_true",
|
|
help="Emit machine-readable JSON instead of human-readable text",
|
|
)
|
|
audit_parser.add_argument(
|
|
"--fail-on",
|
|
default="critical",
|
|
choices=["low", "moderate", "high", "critical"],
|
|
help="Exit non-zero when any finding meets this severity (default: critical)",
|
|
)
|
|
audit_parser.add_argument(
|
|
"--skip-venv",
|
|
action="store_true",
|
|
help="Skip scanning the Hermes Python venv",
|
|
)
|
|
audit_parser.add_argument(
|
|
"--skip-plugins",
|
|
action="store_true",
|
|
help="Skip scanning plugin requirements files",
|
|
)
|
|
audit_parser.add_argument(
|
|
"--skip-mcp",
|
|
action="store_true",
|
|
help="Skip scanning pinned MCP servers in config.yaml",
|
|
)
|
|
audit_parser.set_defaults(func=cmd_security)
|
|
security_parser.set_defaults(func=cmd_security)
|