+ lHjLHTaRRt=0tRt^RIt^RIt^RIt^RIHt^RIHt^RI H t H t ]P!R4t RSRRllt]!R 4t]^k]!R 4t]^k]!R 4t]^k]!R 4t]^k]!R R4t]^kRRltRRltRRltRRltRRlt]!0RTm4tRRltRRltRRltRRlt]]P@]!,]P@]!,]P@]!,3,t"R RR!RR"R/R#R$llt#R%R&lt$RUR'R(llt%R)R*lt&R+R,lt'R-R.lt(]!0RVm4t)R1R2lt*]!R/R004t+R3R4lt,R5R6lt-R7R8lt.RWR9lt/R:R;lt0RXt1R<R=lt2R>R?lt3R@RAlt4RBRClt5RDRElt6RFRGlt7RHRIlt8RJRKlt9RLRMlt:RNROlt;RPRQlt>#>rc.^RIHpV!4R8XdR#R#)zSurface a gateway-rendered approval reports: ``cli`` for a classic CLI session's turn (main prompted those in the CLI process), else ``gateway``.session_surfacecligateway)hermes_cli.plugin_sessionrIrHs rgateway_approval_surfacerMLs:#%.5=I=rc$V^8dQhR\/#r,r-)rs"rrrWs N Nd Nrc^RIHpT!4pTRJ;'dTP\9# \dR#i;i)zTrue for a classic CLI, TUI, Desktop or ACP session's turn, read from the launch policy the gateway froze at ``session.create`` (never a per-turn client flag). Kanban, cron and forwarded routes keep their own sources and stay out.) active_policyFN)gateway.session_policyrP ImportErrorsource_LOCAL_INTERACTIVE_SOURCES)rPpolicys ris_local_interactive_sessionrVWsD8_F   M M&--3M"MM s . ==c$V^8dQhR\/#r,r-)rs"rrrcseederc^RIHpTP4pTfR#TPP ;_uu_4\ ;QJd4RTPP44F 'gK RM) RM%!RTPP444uuRRR4# \dR#i;i +'giR#;i)aTrue while the executing turn is one its session's viewer submitted through ``session.submit`` (as the gateway's FIFO drain recorded for this admission) and a viewer that can answer approvals is attached now: a subscriber holding ``session:approve``, the only answer the gateway's approval resolver accepts. A plugin ``inject_message`` turn, a delegation completion, a background-process or watch notice, a /loop tick, a heartbeat or a hosted-room task is never a viewer turn.) viewer_turnFNc3@"TFpRVP9xK R#5i)zsession:approveN) capabilities).0members& r /is_viewer_turn_with_approver..qsdJc$(;(;;JcsT) gateway.session_ingressrYrRr0 event_streamlockany subscribersvalues)rYlives ris_viewer_turn_with_approverrgcs 7 ?? D |     sd$JZJZJaJaJcdsssd$JZJZJaJaJcdd    s"B+5B=4,B=+ B:9B:= C cZV^8dQhR\R\P\,/#)r session_keyr )r r r)rs"rrrts%8881B1B31G8rc@\PT;'gR4#)zr"r?r@)r8r9r:s$$$r!set_current_observability_contextrssM  ! !'--R 02H2L2L\M_M_]_2` $ $Z%5%52 6 88rc(V^8dQhR\RR/#)rtokensr N)rq)rs"rrrs(((D(rcVwrp\PV4\PV4\PV4R#)z,Restore prior approval hook correlation IDs.N)r@r(r?r>)ru turn_token tool_token session_tokens& r#reset_current_observability_contextrzs6,2)JM}-  ,J'rc0V^8dQhR\R\/#)rr r r5)rs"rrrs::S::rc\\P4;p'dV#^RIHpV!RV4#)uVReturn the active session key: approval contextvar → session_context → os.environ.get_session_envHERMES_SESSION_KEY)rkr0gateway.session_contextr~)r rir~s& rget_current_session_keyrs-+//11{17 / 99rc0V^8dQhR\R\/#)rr r r5)rs"rrrs))s)s)rc^RIHpV!VR4;'gR# \d%\P!TR4;'gRu#i;i)zSession-scoped env value, contextvar-first so one cron/-q job cannot taint unrelated gateway/API/TUI turns in the same process; process env is the fallback for CLI tests and older entrypoints.r}r)rr~r<osgetenv)r r~s& r _session_envrsG);tR(..B. )yyr"((b()s(A A  A c$V^8dQhR\/#r,r5)rs"rrrs33s3rc\R4#)zBReturn the current gateway platform from contextvars/env fallback.HERMES_SESSION_PLATFORM)rrr_get_session_platformrs 1 22rc$V^8dQhR\/#r,r-)rs"rrrs@@4@rc*\\R44#)z?True when the current approval decision is running inside cron.HERMES_CRON_SESSION)rrrrr_is_cron_approval_contextrs <(=> ??rwebhookmsgraph_webhookc$V^8dQhR\/#r,r-)rs"rrrsEE$Erc$\4\9#)uTrue when the session platform is a programmatic/unattended surface. Webhook, msgraph_webhook, and api_server sessions bind ``HERMES_SESSION_PLATFORM`` like chat gateways do, but there is no human who can resolve a pending approval. Treating them as gateway approval contexts blocks the session for the full approval timeout (60-300s) and then fails closed anyway — the deadlock in #37284/#87509. )r_UNATTENDED_APPROVAL_PLATFORMSrrr(_is_unattended_platform_approval_contextrs ! "&D DDrc$V^8dQhR\/#r,r-)rs"rrrsHH4Hrcv^RIHpV!4RJdR#\\ R44# \dL!i;i)a-True for a single-query (-q) session: ``hermes chat -q`` exports ``HERMES_INTERACTIVE=1`` (so sudo password prompts work) but nobody is waiting to answer approvals; without this marker the gate would wait the full timeout, fail closed and push the agent toward workarounds (e.g. execute_code). ``approvals.single_query_mode`` makes the path deterministic. A gateway-admitted turn carries the same fact as the submission's ``finite`` flag (``hermes -z`` / ``chat -q`` over the daemon): the viewer detaches on the first prompt, so nobody answers there either.finite_turn_requiredTHERMES_SINGLE_QUERY_SESSION)gateway.session_finiterrRrrrs r!_is_single_query_approval_contextrsD? !T ) * <(EF GG    s * 88c$V^8dQhR\/#r,r-)rs"rrrs;;T;rc^\4;'g\4;'g \4#)zTrue in single-query (-q), cron and unattended-platform sessions. `hermes chat -q` still registers the CLI panel callback, so a prompt that only checks for a callback would wait the full timeout for nobody.)rrrrrr_no_user_can_answerrs/ . / : :3L3N : :79;rc$V^8dQhR\/#r,r-)rs"rrrsVVdVrc\4'g\4'dR#\R4;'g\\ 44#)a}True inside a gateway/API session that can answer an approval. Legacy integrations set HERMES_GATEWAY_SESSION; concurrent paths bind HERMES_SESSION_PLATFORM via contextvars. Cron is NEVER a gateway approval context even when it originated from a platform (cron binds the platform for delivery routing): falling through would submit a pending approval with no listener and block the job indefinitely; unattended platforms likewise. Unattended programmatic platforms (webhook, msgraph_webhook, api_server) are excluded for the same reason: those adapters have no ``send_exec_approval`` and no way to receive ``/approve`` replies. Submitting a pending approval there blocks the session for the full approval timeout (60-300 s) with no human who can resolve it (#37284, 87509). Their dangerous-command handling is governed by ``approvals.unattended_mode`` config (default deny), mirroring cron. FHERMES_GATEWAY_SESSION)rrrrrrrr_is_gateway_approval_contextrs6!""&N&P&P 3 4 U U=R=T8UUrcNVeV#^RIHpV!4# \dR#i;i)zXExplicit callback, else the per-thread one from ``terminal_tool.set_approval_callback``.N)_get_approval_callback)tools.terminal_toolrr<)approval_callbackrs& r_resolve_cli_approval_callbackrs1$  >%'' s  $$c0V^8dQhR\R\/#)ris_clir r-)rs"rrrsPPDP[_PrcH\T;'dVRJ;'dVRJ4#)a[Prefer the CLI Dangerous Command panel over a silent pending approval: ``HERMES_EXEC_ASK`` (or a platform marker) can leak into an interactive CLI process (historically via ``import gateway.run``), and without a gateway notify listener the ask branch used to return ``pending_approval`` immediately and skip the panel the user can actually answer.Nr-)rr notify_cbs$$$r$_should_fall_through_to_cli_approvalrs* NN,D8NNY$=N OOrc$V^8dQhR\/#r,r5)rs"rrr scrc,\V\4'd VRJdR#R#\V\4'd^VP4P 4pV\ 9dV#V'd+\ PRVRP\ 44R#)aNormalize approval mode values loaded from YAML/config. YAML 1.1 parses a bare ``off`` as False, so ``mode: off`` arrives as a bool; treat it as the intended string mode. Unknown strings (e.g. 'auto') warn and fall back to 'manual' instead of silently failing every mode check.FoffmanualuFUnknown approvals.mode %r — defaulting to 'manual'. Valid values: %sz, ) isinstancerr striplower _VALID_MODESrAwarningjoin)mode normalizeds& r_normalize_approval_moder sw $ u383$ZZ\'')  %   NN./3TYY|5L N rc$V^8dQhR\/#r,dict)rs"rrrsdrc^RIHpV!4PR/4;'g/# \d#p\P RT4/uRp?#Rp?ii;i)uRead the approvals config block: the LIVE config-cache sub-dict (load_config_readonly contract) — callers must not mutate it or any nested structure.load_config_readonly approvalsz"Failed to load approval config: %sN)hermes_cli.configrr0r<rAr)res r_get_approval_configrsL:#%))+r:@@b@ ;Q? s#)) AA AAc$V^8dQhR\/#r,r5)rs"rrr&sRRCRrc^RIHpV!4;pe VP#\ \ 4P RR44# \dL0i;i)zKReturn 'manual', 'smart', or 'off' (a hosted-room policy overrides config).)current_room_execution_policyrr)$gateway.hosted_room_execution_policyr approval_moder<rrr0)r room_policys r_get_approval_moder&s\ V8: :K G,, , H $$8$:$>$>vx$P QQ    sA AAc$V^8dQhR\/#r,)int)rs"rrr1ssrc\\4PRR44p^RIHp\T4pY8d\PRY4\Y4# \\3dR#i;i \dRpLNi;i)aRead ``approvals.timeout`` (default 300s: gateway push notifications may not be seen for minutes; 60s failed closed before Telegram taps landed). Clamped to ``agent.deadline.MAX_SAFE_TIMEOUT_S`` (~1 year): a larger value overflows ``time_t`` inside ``Thread.join`` / ``Lock.acquire`` on macOS and crashed every parallel tool batch; clamping at the single config-read site keeps every consumer platform-safe at once.timeouti,)MAX_SAFE_TIMEOUT_SzGapprovals.timeout=%s exceeds the platform-safe maximum; clamping to %ss) rrr0 ValueError TypeErroragent.deadlinerr<rArmin)rawrsafe_caps r_get_approval_timeoutr1s&(,,Y<=5)* ~`bep s   " s"#AA6A32A36 BBc0V^8dQhR\R\/#)rsecondsr )rr )rs"rrrFs l lC lC lrc\\T;'g^4^4pV'dVR,^8Xd VR,Rr!M$V'dV^<,^8Xd V^<,Rr!MTRr!\V^8Xd RV R2VR7#RV R2VR7#) uThe ONE human wording for an approval timeout window, shared by the CLI timeout notice, the tool result's ``user_summary`` and the gateway card copy so every surface agrees: 300 → "5 minutes", 90 → "90 seconds", 7200 → "2 hours".ihourminutesecondzapproval.window._one_other)count)maxrr)rrunits& rformat_approval_windowrFs#gll#Q'G7T>Q&ovt Wr\Q&mXtxt eqjvT *ej kk@PQUPVV\>]ej kkrc$V^8dQhR\/#r,r)rs"rrrTsQQQrcB\4pR\V4RV^,/#)z``{waited, suggested}`` for the ``approval.timeout`` copy: how long we waited (``5 minutes`` / ``90 seconds``) and a tripled ``approvals.timeout`` value the user can paste into ``hermes config set``.waited suggested)rr)rs rapproval_timeout_notice_kwargsrTs%$%G ,W5{GaK PPrc0V^8dQhR\R\/#)rkeyr r5)rs"rrr[sssrc ^RIHp\\V!4RVRR74P 4P 4pVR9dR#R# \ dR#i;i)z?Read ``approvals.`` as 'approve' or 'deny' (default deny).rrdenyrapprove>ryesallowr)rrr rrrr<)rrrs& r_binary_approval_moder[sZ:7/1;VTU[[]cce $FFyRFR sAA A AAc$V^8dQhR\/#r,r5)rs"rrres...rc\R4#)zERead the cron approval mode from config. Returns 'deny' or 'approve'. cron_moderrrr_get_cron_approval_moderes  --rc$V^8dQhR\/#r,r5)rs"rrrjs666rc\R4#)zRRead the single-query (-q) approval mode from config. Returns 'deny' or 'approve'.single_query_moderrrr_get_single_query_approval_moderjs !4 55rc$V^8dQhR\/#r,r5)rs"rrros44s4rc\R4#)uApproval mode for webhook / msgraph_webhook / api_server sessions; default deny — an unattended session never silently runs a flagged action unless the operator explicitly trusts it.unattended_moderrrr_get_unattended_approval_moderos !!2 33rcTV^8dQhR\\\R,3,/#)rr N)tupler )rs"rrrvs# O Oc3:o(> Orc^RIHpV!4;'g/PR4;'g/PR4;'g/p\VPR4;'gR4P 4P 4p\VPR4;'gR4P 4P 4pT;'gRTR8XdR3#R3# \ dR u#i;i) zCReturn explicitly selected transport and fail-closed fallback mode.rsecurityapproval transportbuiltintransport_fallbackrN)z config-errorN)rrr0r rrr<)rcfgselectedfallbacks r_get_approval_transport_configr vs$:$&,,"11*=CCHHTZZXZsww{+88y9??AGGIsww34::;AACIIK  yx9/D) NN$ NN $$#$s-C#C#C#C#(?C#(#C## C32C3cV^8dQh/^\9d\P\,;R&^\9d\P\,;R&^\9d\P\,;R&^\9d\P\,;R&^\9d&\P\R,,;R&#)rrkr>r?r@Nr!)__conditional_annotations__r rr )rs"rrrs.RQ{--c2Q/0JI;))#.I12TS ..s3S3:POk,,S1O;D_^//d ;^Er)r>acprJguituir>r api_serverr)N)rsmartr)>r __doc__r loggingr agent.i18nrrrutilsrr getLoggerrArrkr>r?r@r!r#r*r2rErM frozensetrTrVrgrlrorrr rqrsrzrrrrrr"_NOTIFIER_BLIND_APPROVAL_PLATFORMSrrrrrrrrrrrrrrrrr r)r s@rrs %2   + ,9 6::P5QQ156H1II6:;R6SS599N4OO ?CCWY]>^^C ) f M,>''CD Ne"8 '  !!#& (9(9#(> @Q@QRU@VV W88PR8fh8 (:)3 @"++W!XE"&/ ;L/M%N"H$;V(P* "R* lQ. 6 4 Or