Cairn
NousResearch/hermes-agent

Fix approval bypass for API run transport scoping

Cluster 98728 · gateway. Data as of

2 open items. Fix merged in #135049 on 8 Oct 2026. Check it covers your case.

The short answer

1open issue
1open PR
5items grouped
Known?
Yes. 5 related items grouped here, 0 issues already closed.
Fix event
A fix was merged to main in PR #135049. Check it covers your case. No release data is tracked.
Tracker
The maintainers' tracker marks this unresolved. That is separate from the fix event.
Still open
1 issue and 1 PR.

These items address a bug where the /v1/runs approval transport was being bypassed due to incorrect classification or scoping of the api_server as unattended. Fixes scope API runs and unattended exclusions to the correct transport context.

Open issues1

  • Issue#98728[Bug]: /v1/runs approval transport is bypassed because api_server is classified as unattended

Open PRs1

  • PR#98735fix(approval): make unattended exclusion transport-scoped so /v1/runs approval works

Fixes on record

Merged to main. A stamp counts the issues a fix is linked to.

  • #113820 fix(tui_gateway): old app builds no longer stall the agent on clarify/approval (closes remaining atoms of #112548)

    merged to main

    files: apps/desktop/src/lib/json-rpc-gateway-heartbeat.test.ts, apps/shared/src/gateway-contract.generated.ts, apps/shared/src/gateway-contract.openrpc.json, apps/shared/src/json-rpc-channel.test.ts, apps/shared/src/json-rpc-channel.ts, tests/tools/test_approval_gateway_wait_late_choice.py, tests/tui_gateway/test_protocol.py, tools/approval.py, tools/approval_gateway_wait.py, tui_gateway/AGENTS.md, tui_gateway/contracts/liveness.py, tui_gateway/methods_voice.py, tui_gateway/server.py, tui_gateway/server_requests.py, tui_gateway/session_transports.py, ui-tui/src/__tests__/gatewayClient.test.ts, website/docs/developer-guide/programmatic-integration.md

  • #135049 Webhook and listener-less API runs deny flagged commands instantly instead of waiting on an approval nobody can answer (#100532, salvage #125367)

    merged to main

    files: tests/tools/test_approval_unattended_presence.py, tests/tools/test_cron_not_interactive.py, tools/approval.py, tools/approval_context.py, website/docs/user-guide/security.md

1 PR closed without merging

From the close comments: done elsewhere 1

  • #109496 fix(approval): scope API runs to resolver capability · done elsewhere → 8918717, e760a20, 71ff523, 2afb405, #98728, #135049, #113820, #98735, #125658, #125367
How this cluster was grouped
  • Link evidence (structural links throughout): every member is connected by structural evidence: shared changed files, or a closing/superseded reference.
  • Pairwise link density 0.40: the share of item pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. 1.00 means every pair is linked.

Pick up a Lab task

Check whether a fix covers the open issues here, with your own agent. Bring back evidence for maintainers.

Open the Lab

At a glance

Subsystem
gateway
Merged PRs
#113820, #135049
Closed issues
0
Attempts
1 PR closed without merging
Fix link checked
8 Oct 2026

For your agent

The same facts, typed.

cluster/98728.json
cluster/98728.md