From 655090b3d337f212dd9484ca22ee6881d1c8179f Mon Sep 17 00:00:00 2001 From: firefly Date: Thu, 28 May 2026 17:47:09 -0400 Subject: [PATCH] feat(gateway): warn at startup on manual approvals with no risk assessor When approvals.mode=manual with security.tirith_enabled off and no auxiliary.approval model, dangerous commands and execute_code scripts can only be gated by live in-chat approval; with routing fixed they now fail closed (block) rather than silently auto-run. Surface that at startup so operators knowingly enable tirith or auxiliary.approval for unattended gateways. Refs #30882 --- gateway/run.py | 29 ++++++++++++++++++++++++++++- 1 file changed, 28 insertions(+), 1 deletion(-) diff --git a/gateway/run.py b/gateway/run.py index 96ed2a388..e5d9095d2 100644 --- a/gateway/run.py +++ b/gateway/run.py @@ -1807,7 +1807,34 @@ class GatewayRunner: ensure_installed(log_failures=False) except Exception: pass # Non-fatal — fail-open at scan time if unavailable - + + # Startup heads-up (#30882): a gateway in manual approval mode with no + # automated risk assessor (tirith disabled AND no auxiliary.approval + # model) can only gate dangerous commands / execute_code scripts via + # live in-chat approval. With approval routing fixed, those actions now + # fail closed (block) rather than silently auto-running — surface that + # so operators knowingly enable tirith or configure auxiliary.approval + # for unattended gateways. + try: + from hermes_cli.config import load_config as _load_full_config + _appr_cfg = _load_full_config() + _appr_mode = str( + cfg_get(_appr_cfg, "approvals", "mode", default="manual") or "manual" + ).strip().lower() + _tirith_on = bool(cfg_get(_appr_cfg, "security", "tirith_enabled", default=True)) + _aux_approval = cfg_get(_appr_cfg, "auxiliary", "approval", default=None) + if _appr_mode == "manual" and not _tirith_on and not _aux_approval: + logger.warning( + "Gateway approvals.mode=manual with no automated risk " + "assessor (security.tirith_enabled is false and " + "auxiliary.approval is unset): dangerous commands and " + "execute_code scripts will BLOCK until a human approves " + "them in chat. Enable security.tirith_enabled or configure " + "auxiliary.approval for unattended operation." + ) + except Exception: + logger.debug("approvals.mode startup check skipped", exc_info=True) + # Initialize session database for session_search tool support self._session_db = None try: