approvals.mode validation, defaults, and UI fixes

Fixes on record

Merged to main. A stamp counts the issues a fix is linked to.

• #54469 fix(approvals): warn and default to manual on unknown approvals.mode

  merged to main

  files: infographic/approval-mode-validation/infographic.png, scripts/release.py, tests/tools/test_approval.py, tools/approval.py

  Show the diff

  • scripts/release.py

    @@ -46,6 +46,7 @@
     # Auto-extracted from noreply emails + manual overrides
     AUTHOR_MAP = {
         "[redacted:email]": "Kolektori",  # PR #6436 salvage (require approval for host-bound Docker commands; container guard fast-path)
    +    "[redacted:email]": "LIC99",  # PR #4682 salvage (warn + default to manual on unknown approvals.mode; #4261)
         "[redacted:email]": "cmcejas",  # PR #41188 salvage (early Telegram auth gate before event build/observe; #40863)
         "[redacted:email]": "oreoluwa",  # PR #49845 salvage (skip preflight content-type probe for OAuth MCP servers so OAuth discovery runs; Akiflow/Hospitable)
         "[redacted:email]": "PRATHAMESH75",  # PR #37550 salvage (ExecStopPost cgroup-orphan reaper to unblock systemd restart; #37454)

  • tests/tools/test_approval.py

    @@ -12,6 +12,7 @@
     from hermes_constants import get_hermes_home
     from tools.approval import (
         _get_approval_mode,
    +    _normalize_approval_mode,
         _smart_approve,
         approve_session,
         detect_dangerous_command,
    @@ -30,6 +31,27 @@ def test_string_off_still_maps_to_off(self):
             with mock_patch("hermes_cli.config.load_config", return_value={"approvals": {"mode": "off"}}):
                 assert _get_approval_mode() == "off"
     
    +    def test_valid_modes_pass_through(self):
    +        assert _normalize_approval_mode("manual") == "manual"
    +        assert _normalize_approval_mode("smart") == "smart"
    +        assert _normalize_approval_mode("off") == "off"
    +
    +    def test_valid_mode_is_case_insensitive_and_trimmed(self):
    +        assert _normalize_approval_mode("  SMART  ") == "smart"
    +
    +    def test_unknown_mode_defaults_to_manual_with_warning(self):
    +        with mock_patch.object(approval_module.logger, "warning") as warn:
    +            assert _normalize_approval_mode("auto") == "manual"
    +            warn.assert_called_once()
    +
    +    def test_empty_string_defaults_to_manual_without_warning(self):
    +        with mock_patch.object(approval_module.logger, "warning") as warn:
    +            assert _normalize_approval_mode("") == "manual"
    +            warn.assert_not_called()
    +
    +    def test_yaml_bool_true_maps_to_manual(self):
    +        assert _normalize_approval_mode(True) == "manual"
    +
     
     class TestSmartApproval:
         def test_smart_approval_uses_call_llm(self):

  • tools/approval.py

    @@ -1097,12 +1097,27 @@ def _normalize_approval_mode(mode) -> str:
         YAML 1.1 treats bare words like `off` as booleans, so a config entry like
         `approvals:\n  mode: off` is parsed as False unless quoted. Treat that as the
         intended string mode instead of falling back to manual approvals.
    +
    +    Unknown string values (e.g. 'auto') are rejected with a warning rather than
    +    being silently accepted and falling through every mode check downstream.
    +    Always returns one of 'manual', 'smart', or 'off'.
         """
    +    _VALID_MODES = ("manual", "smart", "off")
         if isinstance(mode, bool):
             return "off" if mode is False else "manual"
         if isinstance(mode, str):
             normalized = mode.strip().lower()
    -        return normalized or "manual"
    +        if not normalized:
    +            return "manual"
    +        if normalized in _VALID_MODES:
    +            return normalized
    +        logger.warning(
    +            "Unknown approvals.mode %r — defaulting to 'manual'. "
    +            "Valid values: %s",
    +            mode,
    +            ", ".join(_VALID_MODES),
    +        )
    +        return "manual"
         return "manual"
     
     

• #62661 feat: make smart approvals the default

  merged to main

  files: hermes_cli/config.py, skills/autonomous-ai-agents/hermes-agent/SKILL.md, tests/tools/test_approval.py, tools/approval.py, website/docs/user-guide/configuration.md, website/docs/user-guide/security.md, website/docs/user-guide/skills/bundled/autonomous-ai-agents/autonomous-ai-agents-hermes-agent.md, website/i18n/zh-Hans/docusaurus-plugin-content-docs/current/user-guide/configuration.md, website/i18n/zh-Hans/docusaurus-plugin-content-docs/current/user-guide/security.md, website/i18n/zh-Hans/docusaurus-plugin-content-docs/current/user-guide/skills/bundled/autonomous-ai-agents/autonomous-ai-agents-hermes-agent.md

  Show the diff

  • hermes_cli/config.py

    @@ -2523,15 +2523,15 @@ def _ensure_hermes_home_managed(home: Path):
         },
     
         # Approval mode for dangerous commands:
    -    #   manual — always prompt the user (default)
    -    #   smart  — use auxiliary LLM to auto-approve low-risk commands, prompt for high-risk
    +    #   manual — always prompt the user
    +    #   smart  — use auxiliary LLM to auto-approve low-risk commands (default)
         #   off    — skip all approval prompts (equivalent to --yolo)
         #
         # cron_mode — what to do when a cron job hits a dangerous command:
         #   deny    — block the command and let the agent find another way (default, safe)
         #   approve — auto-approve all dangerous commands in cron jobs
         "approvals": {
    -        "mode": "manual",
    +        "mode": "smart",
             "timeout": 60,
             "cron_mode": "deny",
             # User-defined deny rules: fnmatch globs matched against terminal

  • skills/autonomous-ai-agents/hermes-agent/SKILL.md

    @@ -552,10 +552,10 @@ hermes config set privacy.redact_pii false   # disable (default)
     
     ### Command approval prompts
     
    -By default (`approvals.mode: manual`), Hermes prompts the user before running shell commands flagged as destructive (`rm -rf`, `git reset --hard`, etc.). The modes are:
    +By default (`approvals.mode: smart`), Hermes asks an auxiliary LLM to assess shell commands flagged as destructive (`rm -rf`, `git reset --hard`, etc.). The modes are:
     
    -- `manual` — always prompt (default)
    -- `smart` — use an auxiliary LLM to auto-approve low-risk commands, prompt on high-risk
    +- `smart` — auto-approve a low-risk command once, deny high-risk commands, and prompt when uncertain (default)
    +- `manual` — always prompt
     - `off` — skip all approval prompts (equivalent to `--yolo`)
     
     ```bash

  • tests/tools/test_approval.py

    @@ -55,6 +55,11 @@ def test_yaml_bool_true_maps_to_manual(self):
     
     
     class TestSmartApproval:
    +    def test_smart_is_the_default_approval_mode(self):
    +        from hermes_cli.config import DEFAULT_CONFIG
    +
    +        assert DEFAULT_CONFIG["approvals"]["mode"] == "smart"
    +
         def test_smart_approval_uses_call_llm(self):
             response = SimpleNamespace(
                 choices=[SimpleNamespace(message=SimpleNamespace(content="APPROVE"))]
    @@ -68,6 +73,35 @@ def test_smart_approval_uses_call_llm(self):
             assert mock_call.call_args.kwargs["temperature"] == 0
             assert mock_call.call_args.kwargs["max_tokens"] == 16
     
    +    def test_smart_approval_does_not_allowlist_the_pattern_for_session(self, monkeypatch):
    +        session_key = "test-smart-per-command"
    +        command = "python -c \"print('hello')\""
    +        dangerous, pattern_key, _ = detect_dangerous_command(command)
    +        assert dangerous is True
    +
    +        monkeypatch.setenv("HERMES_SESSION_KEY", session_key)
    +        monkeypatch.setenv("HERMES_EXEC_ASK", "1")
    +        monkeypatch.delenv("HERMES_CRON_SESSION", raising=False)
    +        monkeypatch.setattr(
    +            approval_module,
    +            "_get_approval_config",
    +            lambda: {"mode": "smart"},
    +        )
    +        monkeypatch.setattr(approval_module, "_YOLO_MODE_FROZEN", False)
    +        monkeypatch.setattr(approval_module, "_smart_approve", lambda *_: "approve")
    +        monkeypatch.setattr(
    +            "tools.tirith_security.check_command_security",
    +            lambda _command: {"action": "allow", "findings": [], "summary": ""},
    +        )
    +        approval_module.clear_session(session_key)
    +        approval_module._permanent_approved.clear()
    +
    +        result = approval_module.check_all_command_guards(command, "local")
    +
    +        assert result["approved"] is True
    +        assert result["smart_approved"] is True
    +        assert is_approved(session_key, pattern_key) is False
    +
     
     class TestDetectDangerousRm:
         def test_rm_rf_detected(self):
    @@ -2140,11 +2174,13 @@ def test_timeout_message_is_emphatic_against_retry_and_rephrase(self, monkeypatc
             assert "rephrase" in msg.lower()
             assert "different command" in msg.lower()
     
    -    def test_explicit_deny_carries_same_no_consent_shape(self):
    +    def test_explicit_deny_carries_same_no_consent_shape(self, monkeypatch):
             """An explicit /deny must produce the same shape as timeout —
             the agent should treat both identically."""
             from tools import approval as mod
     
    +        self._force_short_timeout(monkeypatch, seconds=60)
    +
             notified = []
             mod.register_gateway_notify(self.SESSION_KEY, lambda data: notified.append(data))
     

  • tools/approval.py

    @@ -2745,9 +2745,9 @@ def check_all_command_guards(command: str, env_type: str,
             combined_desc_for_llm = "; ".join(desc for _, desc, _ in warnings)
             verdict = _smart_approve(command, combined_desc_for_llm)
             if verdict == "approve":
    -            # Auto-approve and grant session-level approval for these patterns
    -            for key, _, _ in warnings:
    -                approve_session(session_key, key)
    +            # Approve this command only. Pattern-level persistence would let one
    +            # benign command suppress review of later commands that happen to
    +            # match the same broad detector category.
                 logger.debug("Smart approval: auto-approved '%s' (%s)",
                              command[:60], combined_desc_for_llm)
                 return {"approved": True, "message": None,

  • website/docs/user-guide/configuration.md

    @@ -1879,13 +1879,13 @@ Control how Hermes handles potentially dangerous commands:
     
     ```yaml
     approvals:
    -  mode: manual   # manual | smart | off
    +  mode: smart   # smart | manual | off
     ```
     
     | Mode | Behavior |
     |------|----------|
    -| `manual` (default) | Prompt the user before executing any flagged command. In the CLI, shows an interactive approval dialog. In messaging, queues a pending approval request. |
    -| `smart` | Use an auxiliary LLM to assess whether a flagged command is actually dangerous. Low-risk commands are auto-approved with session-level persistence. Genuinely risky commands are escalated to the user. |
    +| `smart` (default) | Use an auxiliary LLM to assess whether a flagged command is actually dangerous. Low-risk commands are auto-approved for that command only. Genuinely risky commands are denied; uncertain decisions escalate to the user. |
    +| `manual` | Prompt the user before executing any flagged command. In the CLI, shows an interactive approval dialog. In messaging, queues a pending approval request. |
     | `off` | Skip all approval checks. Equivalent to `HERMES_YOLO_MODE=true`. **Use with caution.** |
     
     Smart mode is particularly useful for reducing approval fatigue — it lets the agent work more autonomously on safe operations while still catching genuinely destructive commands.

  • website/docs/user-guide/security.md

    @@ -30,7 +30,7 @@ The approval system supports three modes, configured via `approvals.mode` in `~/
     
     ```yaml
     approvals:
    -  mode: manual                    # manual | smart | off
    +  mode: smart                     # smart | manual | off
       timeout: 60                     # seconds to wait for user response (default: 60)
       cron_mode: deny                 # deny | approve — what cron jobs do when they hit a dangerous command
       mcp_reload_confirm: true        # /reload-mcp asks before invalidating the MCP tool cache
    @@ -41,7 +41,7 @@ The full set of keys:
     
     | Key | Default | What it controls |
     |---|---|---|
    -| `mode` | `manual` | Approval policy for dangerous shell commands — see the table below. |
    +| `mode` | `smart` | Approval policy for dangerous shell commands — see the table below. |
     | `timeout` | `60` | Seconds Hermes waits for an approval reply before timing out. |
     | `cron_mode` | `deny` | How [cron jobs](./features/cron.md) behave headlessly when they trigger a dangerous-command prompt. `deny` blocks the command (the agent must find another path); `approve` auto-approves everything in cron context. |
     | `mcp_reload_confirm` | `true` | When true, `/reload-mcp` asks before rebuilding the MCP tool set. Rebuilding invalidates the provider prompt cache (tool schemas live in the system prompt), so the next message re-sends full input tokens. Users who click **Always Approve** flip this key to `false`. |
    @@ -49,8 +49,8 @@ The full set of keys:
     
     | Mode | Behavior |
     |------|----------|
    -| **manual** (default) | Always prompt the user for approval on dangerous commands |
    -| **smart** | Use an auxiliary LLM to assess risk. Low-risk commands (e.g., `python -c "print('hello')"`) are auto-approved. Genuinely dangerous commands are auto-denied. Uncertain cases escalate to a manual prompt. |
    +| **smart** (default) | Use an auxiliary LLM to assess risk. Low-risk commands (e.g., `python -c "print('hello')"`) are auto-approved for that command only. Genuinely dangerous commands are auto-denied. Uncertain cases escalate to a manual prompt. |
    +| **manual** | Always prompt the user for approval on dangerous commands. |
     | **off** | Disable all approval checks — equivalent to running with `--yolo`. All commands execute without prompts. |
     
     :::warning

  • website/docs/user-guide/skills/bundled/autonomous-ai-agents/autonomous-ai-agents-hermes-agent.md

    @@ -492,10 +492,10 @@ hermes config set privacy.redact_pii false   # disable (default)
     
     ### Command approval prompts
     
    -By default (`approvals.mode: manual`), Hermes prompts the user before running shell commands flagged as destructive (`rm -rf`, `git reset --hard`, etc.). The modes are:
    +By default (`approvals.mode: smart`), Hermes asks an auxiliary LLM to assess shell commands flagged as destructive (`rm -rf`, `git reset --hard`, etc.). The modes are:
     
    -- `manual` — always prompt (default)
    -- `smart` — use an auxiliary LLM to auto-approve low-risk commands, prompt on high-risk
    +- `smart` — auto-approve a low-risk command once, deny high-risk commands, and prompt when uncertain (default)
    +- `manual` — always prompt
     - `off` — skip all approval prompts (equivalent to `--yolo`)
     
     ```bash

  • website/i18n/zh-Hans/docusaurus-plugin-content-docs/current/user-guide/configuration.md

    @@ -1583,13 +1583,13 @@ security:
     
     ```yaml
     approvals:
    -  mode: manual   # manual | smart | off
    +  mode: smart   # smart | manual | off
     ```
     
     | 模式 | 行为 |
     |------|----------|
    -| `manual`（默认） | 在执行任何被标记的命令之前提示用户。在 CLI 中显示交互式审批对话框。在消息中排队待处理的审批请求。 |
    -| `smart` | 使用辅助 LLM 评估被标记的命令是否真正危险。低风险命令以会话级持久性自动批准。真正有风险的命令升级给用户。 |
    +| `smart`（默认） | 使用辅助 LLM 评估被标记的命令是否真正危险。低风险命令仅对当前命令自动批准，真正危险的命令自动拒绝，不确定的情况升级给用户。 |
    +| `manual` | 在执行任何被标记的命令之前提示用户。在 CLI 中显示交互式审批对话框。在消息中排队待处理的审批请求。 |
     | `off` | 跳过所有审批检查。等同于 `HERMES_YOLO_MODE=true`。**谨慎使用。** |
     
     智能模式对于减少审批疲劳特别有用 —— 它让 agent 在安全操作上更自主地工作，同时仍然捕获真正破坏性的命令。

  • website/i18n/zh-Hans/docusaurus-plugin-content-docs/current/user-guide/security.md

    @@ -30,14 +30,14 @@ Hermes Agent 采用纵深防御安全模型。本页涵盖所有安全边界—
     
     ```yaml
     approvals:
    -  mode: manual    # manual | smart | off
    +  mode: smart     # smart | manual | off
       timeout: 60     # 等待用户响应的秒数（默认：60）
     ```
     
     | 模式 | 行为 |
     |------|----------|
    -| **manual**（默认） | 始终提示用户审批危险命令 |
    -| **smart** | 使用辅助 LLM 评估风险。低风险命令（如 `python -c "print('hello')"` ）自动批准，真正危险的命令自动拒绝，不确定的情况升级为手动提示。 |
    +| **smart**（默认） | 使用辅助 LLM 评估风险。低风险命令（如 `python -c "print('hello')"`）仅对当前命令自动批准，真正危险的命令自动拒绝，不确定的情况升级为手动提示。 |
    +| **manual** | 始终提示用户审批危险命令。 |
     | **off** | 禁用所有审批检查——等同于使用 `--yolo` 运行。所有命令无需提示即可执行。 |
     
     :::warning

  • website/i18n/zh-Hans/docusaurus-plugin-content-docs/current/user-guide/skills/bundled/autonomous-ai-agents/autonomous-ai-agents-hermes-agent.md

    @@ -481,10 +481,10 @@ hermes config set privacy.redact_pii false   # 禁用（默认）
     
     ### 命令审批提示
     
    -默认情况下（`approvals.mode: manual`），Hermes 在运行被标记为破坏性的 shell 命令（`rm -rf`、`git reset --hard` 等）之前会提示用户。模式如下：
    +默认情况下（`approvals.mode: smart`），Hermes 会让辅助 LLM 评估被标记为破坏性的 shell 命令（`rm -rf`、`git reset --hard` 等）。模式如下：
     
    -- `manual` — 始终提示（默认）
    -- `smart` — 使用辅助 LLM 自动批准低风险命令，对高风险命令提示
    +- `smart` — 低风险命令仅批准一次，高风险命令拒绝，不确定时提示（默认）
    +- `manual` — 始终提示
     - `off` — 跳过所有审批提示（等同于 `--yolo`）
     
     ```bash

• #63271 fix(dashboard): align approval mode options

  merged to main

  files: hermes_cli/web_server.py, scripts/release.py, tests/hermes_cli/test_web_server.py, website/docs/user-guide/features/web-dashboard.md, website/i18n/zh-Hans/docusaurus-plugin-content-docs/current/user-guide/features/web-dashboard.md

  Show the diff

  • hermes_cli/web_server.py

    @@ -671,7 +671,7 @@ async def _token_auth_seam(request: Request, call_next):
         "approvals.mode": {
             "type": "select",
             "description": "Dangerous command approval mode",
    -        "options": ["ask", "yolo", "deny"],
    +        "options": ["manual", "smart", "off"],
         },
         "context.engine": {
             "type": "select",

  • scripts/release.py

    @@ -46,6 +46,7 @@
     # Auto-extracted from noreply emails + manual overrides
     AUTHOR_MAP = {
         "[redacted:email]": "ansel-f",  # PR #62388 salvage (approval: allow exact verifier temp cleanup without broadening rm safety boundary)
    +    "[redacted:email]": "Hopfensaft",  # PR #31933 salvage (dashboard: align approvals.mode dropdown with canonical engine values)
         "[redacted:email]": "professorpalmer",  # PR #48591 salvage (sessions: CLI workspace filter + restore-cwd-on-resume)
         "[redacted:email]": "Supersynergy",  # PR #59241 salvage (desktop: workspace path status-bar action)
         "[redacted:email]": "esthonjr",  # PR #61950 salvage (desktop: legacy non-git workspace grouping + Windows path identity)

  • tests/hermes_cli/test_web_server.py

    @@ -3539,6 +3539,26 @@ def test_overrides_applied(self):
                 assert "options" in entry
                 assert "local" in entry["options"]
     
    +    def test_approvals_mode_options_match_config_values(self):
    +        """approvals.mode select options must match the values accepted by config.py.
    +
    +        Previously the dashboard showed ['ask', 'yolo', 'deny'] which are stale
    +        names that don't correspond to any real config value. The correct values
    +        are 'manual', 'smart', and 'off' (see hermes_cli/config.py).
    +        'smart' was missing entirely, making it unreachable from the UI.
    +        """
    +        from hermes_cli.web_server import CONFIG_SCHEMA
    +        entry = CONFIG_SCHEMA["approvals.mode"]
    +        assert entry["type"] == "select"
    +        options = entry["options"]
    +        assert "manual" in options, "'manual' missing from approvals.mode options"
    +        assert "smart" in options, "'smart' missing from approvals.mode options"
    +        assert "off" in options, "'off' missing from approvals.mode options"
    +        # Stale names that were previously shown but don't match config values
    +        assert "ask" not in options, "stale option 'ask' should not appear"
    +        assert "yolo" not in options, "stale option 'yolo' should not appear"
    +        assert "deny" not in options, "stale option 'deny' should not appear"
    +
         def test_empty_prefix_produces_correct_keys(self):
             from hermes_cli.web_server import _build_schema_from_config
             test_config = {"model": "test", "nested": {"key": "val"}}

  • website/docs/user-guide/features/web-dashboard.md

    @@ -194,7 +194,7 @@ A form-based editor for `config.yaml`. All 150+ configuration fields are auto-di
     - **agent** — max iterations, gateway timeout, service tier
     - **delegation** — subagent limits, reasoning effort
     - **memory** — provider selection, context injection settings
    -- **approvals** — dangerous command approval mode (ask/yolo/deny)
    +- **approvals** — dangerous command approval mode (smart/manual/off)
     - And more — every section of config.yaml has corresponding form fields
     
     Fields with known valid values (terminal backend, skin, approval mode, etc.) render as dropdowns. Booleans render as toggles. Everything else is a text input.

  • website/i18n/zh-Hans/docusaurus-plugin-content-docs/current/user-guide/features/web-dashboard.md

    @@ -95,7 +95,7 @@ Chat 标签页是每次 `hermes dashboard` 启动的一部分——内嵌的浏
     - **agent** — 最大迭代次数、gateway 超时、服务层级
     - **delegation** — 子 agent 限制、推理力度
     - **memory** — 提供商选择、上下文注入设置
    -- **approvals** — 危险命令审批模式（ask/yolo/deny）
    +- **approvals** — 危险命令审批模式（smart/manual/off）
     - 更多——config.yaml 的每个部分都有对应的表单字段
     
     具有已知有效值的字段（terminal 后端、皮肤、审批模式等）渲染为下拉菜单。布尔值渲染为开关。其余均为文本输入框。