fix(gateway): clear session-level overrides and YOLO state on shutdown drain - #32835
Closed
waefrebeorn wants to merge 2 commits into
Closed
waefrebeorn wants to merge 2 commits into
waefrebeorn wants to merge 2 commits into
Conversation
…n drain Gateway shutdown/_finalize_shutdown_agents was cleaning per-agent resources (memory provider, tool resources) but leaving session-scoped state intact: - _session_model_overrides retained stale model switches across restarts - _session_yolo (in tools/approval.py) kept YOLO approval bypass active - _pending_approvals carried stale gateway approval requests Add clear_all_sessions() to tools/approval.py that resets all per-session approval and YOLO state atomically under lock. Call it from _finalize_shutdown_agents alongside clearing model/reasoning overrides and pending approval dicts. This fixes: YOLO mode persisting through gateway restart, stale model overrides after drain, and gateway drain not actually resetting session configuration.
|
CI is mostly green, but Failing line from the Actions log: The requested fix is in "wubu.bounty.hunter@users.noreply.github.com": "<github-username>",Use the intended GitHub username/credit string for the value (the log labels it |
alt-glitch
added
type/bug
Contributor
waefrebeorn
pushed a commit
to waefrebeorn/slermes
that referenced
this pull request
May 26, 2026
When _try_refresh_nous_client_credentials fails on every credential path (Portal OAuth, refresh token, shared credentials store), write ~/.hermes/.auth_restart_requested so the GatewayRunner can trigger a process restart as the last-resort recovery mechanism. This is the final step in the fix cascade: 1. Session overrides cleared on drain → PR NousResearch#32835 2. Shared credentials fallback → this PR 3. Gateway restart (last resort) → this commit
… resort When _try_refresh_nous_client_credentials exhausts every credential path, it writes ~/.hermes/.auth_restart_requested. The gateway now checks for this marker at the start of every message and triggers a process restart if the marker is recent (< 5 min). This is the final step in the fix cascade: 1. Session overrides cleared on drain → this PR 2. Shared credentials fallback → PR NousResearch#32826 3. Gateway restart (last resort) → this commit
Contributor
Author
|
Last-resort auto-restart added in 64ccc29: when all credential paths fail (session drain → shared creds fallback), the gateway now auto-restarts on the next incoming message. The .auth_restart_requested marker is written by the agent when _try_refresh_nous_client_credentials returns False, and the GatewayRunner checks it at message handler entry. Fix cascade now:
|
This was referenced May 26, 2026
Contributor
Author
|
AUTHOR_MAP fix landed in PR #33044 — adds wubu.bounty.hunter@users.noreply.github.com → WuBuBountyHunter. Once that merges, this PR's check-attribution should pass. |
alt-glitch
added
the
sweeper:risk-session-state
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
When the Hermes gateway drains and restarts, session-level configuration state was leaking across the boundary:
/yolotoggled_session_yolointools/approval.py, but_finalize_shutdown_agentsnever cleared it. On restart, YOLO stayed active._session_model_overridesand_session_reasoning_overrideswere in-memory dicts that survived restart._pending_approvalscarried old gateway approval requests that could block new sessions.Changes
tools/approval.py: Addedclear_all_sessions()— atomically clears_session_yolo,_session_approved,_gateway_queues, and_pendingunder the module lock. Denies any in-flight approval entries so they don't hang.gateway/run.py(_finalize_shutdown_agents): Now clears_session_model_overrides,_session_reasoning_overrides,_pending_approvals,_pending_model_notes, and callsclear_all_sessions()before agent resource cleanup.Type of Change
Checklist