{"repo":"NousResearch/hermes-agent","public_id":"21849","display_label":"Pre-execution approval gating for tool calls","summary":"These issues and PRs concern adding configurable approval gates that intercept tool calls before execution, with particular focus on ensuring write_file, patch, send_message, and other consequential tools cannot bypass human-in-the-loop or permission checks. Work spans feature requests, security reports, plugin hooks, and fixes to close bypass gaps.","subsystem":"agent","counts":{"members":15,"open_issues":6,"open_issues_distinct":6,"open_prs":3,"closed_issues":4,"merged_prs":1,"attempt_prs":4},"landed_fix":null,"resolution":{"state":"partially_resolved","by":"pr-58698"},"freshness":{"state":"never_verified","last_verified_at":null,"is_stale":false},"grouping":{"backbone":"STRUCTURAL_PARTIAL","link_density":0.0819047619047619},"fix_edges":[],"members":[{"kind":"issue","number":21849,"title":"feat: Tool Permission Gating System (per-tool rules + mode-based fallback)","url":null,"state":"closed"},{"kind":"issue","number":33905,"title":"[Feature]: Per-Tool / Per-Toolset Approval Policies","url":null,"state":"closed"},{"kind":"issue","number":34319,"title":"Feature: Deterministic approval gate — intercept consequential tool calls before execution","url":null,"state":"closed"},{"kind":"issue","number":34320,"title":"Feature: Deterministic approval gate — intercept consequential tool calls before execution","url":null,"state":"open"},{"kind":"issue","number":34348,"title":"Feature: User-approval gate for outbound communication tools (send_message, email, etc.)","url":null,"state":"open"},{"kind":"issue","number":35357,"title":"[Security] Tirith approval gate does not cover non-shell tools — send_message, write_file bypass human-in-the-loop entirely","url":null,"state":"open"},{"kind":"issue","number":49167,"title":"Feature: Tool-level approval gating for MCP tools (like terminal security scan, but for external writes)","url":null,"state":"open"},{"kind":"issue","number":51221,"title":"Feature Request: User-Configurable Runtime Approval for External Actions","url":null,"state":"closed"},{"kind":"issue","number":56969,"title":"[Feature]: Tool Call Pre-Execution Hook — Enable URL Routing Rules Before Tool Dispatch","url":null,"state":"open"},{"kind":"issue","number":60440,"title":"write_file and patch tools bypass skills.write_approval gate","url":null,"state":"open"},{"kind":"pr","number":58698,"title":"feat(plugins): pre_tool_call approve action escalates to human gate (closes #51221)","url":null,"state":"merged","close_reason":{"category":"merged","implication":"superseded"},"merged":true},{"kind":"pr","number":60482,"title":"fix: block write_file/patch from bypassing skills.write_approval gate","url":null,"state":"open","close_reason":{"category":"uncategorized","implication":"needs_llm"},"merged":false},{"kind":"pr","number":60501,"title":"fix(tools): route skill-path writes through write_approval gate (#60440)","url":null,"state":"open","close_reason":{"category":"uncategorized","implication":"needs_llm"},"merged":false},{"kind":"pr","number":63847,"title":"feat(approvals): add write-file approval mode","url":null,"state":"closed","close_reason":{"category":"uncategorized","implication":"needs_llm"},"merged":false},{"kind":"pr","number":102820,"title":"fix(skills): honor active profile in file write guard","url":null,"state":"open","close_reason":{"refs":[{"kind":"pr","value":"#60482","number":60482},{"kind":"pr","value":"#60501","number":60501},{"kind":"pr","value":"#60440","number":60440}],"category":"uncategorized","implication":"needs_llm"},"merged":false}],"trust":{"default_tier":"verified","includes_suggested":false}}