fix(test): mock _YOLO_MODE_FROZEN in test_yolo_overrides_cron_deny

[talwayh1]

What

Fix test_yolo_overrides_cron_deny — the test was broken by the _YOLO_MODE_FROZEN security hardening (module-level freeze at import time).

Root Cause

_YOLO_MODE_FROZEN is frozen at tools/approval.py module import time and ignores monkeypatch.setenv('HERMES_YOLO_MODE', '1'). The test expected the yolo bypass (line 948) to fire before the cron deny path, but the frozen value remained False from import time, causing check_dangerous_command() to fall through to the cron deny block.

Fix

monkeypatch.setattr(approval_module, '_YOLO_MODE_FROZEN', True) so the yolo check evaluates correctly.

Verification

All 24 tests in tests/tools/test_cron_approval_mode.py pass:

24 passed in 0.75s

Related

• CI failure: https://github.com/NousResearch/hermes-agent/actions/runs/26396350667
• Original PR: fix: add centralized hermes_subprocess_env() helper for credential-safe subprocess spawns #31959 (test (5) slice)

[teknium1]

Thanks for the focused test-isolation fix. This is already implemented on current main.

• Automated hermes-sweeper review verified the same direct _YOLO_MODE_FROZEN patch in tests/tools/test_cron_approval_mode.py:344.
• The equivalent fix merged as PR test(approval): patch _YOLO_MODE_FROZEN directly in test_yolo_overrides_cron_deny #32019, commit 79799c80f576f111b92cedfcfbdbecee950cdff8, which is an ancestor of current main.
• tools/approval.py:32-35 still intentionally freezes the process-scoped YOLO value at import time; the current test correctly patches that frozen value rather than weakening the security invariant.