fix(gateway): stop self-restart and resume replay loops

[alanwilhelm]

What does this PR do?

Fixes two gateway stability failures from the same local incident:

1. A gateway-run agent could bypass the existing hermes gateway restart protection by shelling directly to the macOS launchd service:

   launchctl kickstart -k gui/501/ai.hermes.gateway

   That sent SIGTERM to the running gateway from inside an active turn.

2. After the interrupted turn, the affected Discord channel stayed broken because the session remained resume_pending=True while replaying an oversized transcript. The local incident had ~329k recorded prompt tokens on a configured 400k context model, below the old 85% gateway hygiene threshold but above the agent's 50% compression threshold. Incomplete turns did not clear resume_pending, so every real user message re-entered the same poisoned context.

This PR now blocks gateway self-restart commands from gateway/API sessions before /yolo or approvals.mode=off, and adds a pre-agent restart-recovery reset gate: oversized resume_pending sessions are rotated to a fresh active session before any model call. The old transcript is preserved in session history; it is not replayed into the current turn.

Related overlap: existing open PRs #7817, #33084, and #33562 also cover launchd gateway lifecycle commands in DANGEROUS_PATTERNS. This PR is stricter in gateway context because it hard-blocks before yolo/off approvals and also covers execute_code snippets.

Related Issue

No public issue for the local incident. Related to the same launchd bypass class discussed in #7817, #33084, and #33562.

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

• tools/approval.py — adds _check_gateway_self_restart_guard() and blocks Hermes gateway lifecycle commands from gateway/API sessions before yolo or disabled approvals can bypass the approval layer.
• tools/approval.py — adds launchd ai.hermes.gateway lifecycle commands to DANGEROUS_PATTERNS for ordinary dangerous-command detection outside the hard-blocked gateway context.
• tools/approval.py — applies the same gateway self-restart guard to check_execute_code_guard() so Python snippets containing launchd gateway lifecycle calls are denied from gateway sessions before whole-script approval bypasses.
• gateway/run.py — adds a restart-recovery safety gate for resume_pending sessions whose transcript is already beyond the agent compression threshold, capped at 50% context. Those sessions are reset before agent startup, with session-boundary transient state cleared and Telegram topic bindings re-pointed when applicable.
• tests/tools/test_approval.py — covers launchd Hermes gateway lifecycle command detection and isolates the find approval-key regression test from host-local permanent allowlists.
• tests/tools/test_command_guards.py — covers terminal and execute_code gateway-session hard blocks, including the approvals.mode=off path.
• tests/gateway/test_restart_resume_pending.py — covers the exact 329k prompt / 400k context incident shape and verifies the oversized resume_pending session rotates before agent startup.

How to Test

1. From a gateway-context guard path, verify launchctl kickstart -k gui/501/ai.hermes.gateway returns approved: False before approval mode/yolo handling.

2. Verify an execute_code snippet containing subprocess.run(['launchctl', 'kickstart', '-k', 'gui/501/ai.hermes.gateway']) is also blocked from a gateway session before whole-script approval bypasses.

3. Verify a resume_pending session with last_prompt_tokens=329_227 and context_length=400_000 resets before agent startup instead of replaying the transcript.

4. Run focused CI-parity wrapper tests:

   scripts/run_tests.sh tests/gateway/test_restart_resume_pending.py
   scripts/run_tests.sh tests/gateway/test_session_hygiene.py tests/tools/test_approval.py tests/tools/test_command_guards.py tests/hermes_cli/test_gateway_restart_loop.py

5. Run syntax/bytecode validation:

   venv/bin/python -m compileall -q gateway/run.py tools/approval.py

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate; related PRs security(approval): close launchctl / hermes CLI self-termination gaps #7817, fix(approval): extend gateway-lifecycle guard to launchctl and pidof-based kills #33084, and fix(approval): close gateway lifecycle bypass gaps (fixes #33071) #33562 are called out above
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass; not run locally because this draft targets gateway restart/recovery behavior and focused CI-parity wrapper tests were run instead
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: macOS 26.2

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — N/A; no user-facing docs changed
• I've updated cli-config.yaml.example if I added/changed config keys — N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide; launchd detection is macOS-specific, existing systemd detection remains unchanged, and the restart-recovery reset gate is platform-neutral
• I've updated tool descriptions/schemas if I changed tool behavior — N/A; no model-facing tool schema changed

For New Skills

N/A.

Screenshots / Logs

Focused wrapper test results:

=== Summary: 1 files, 77 tests passed, 0 failed (100% complete) in 18.0s (24 workers) ===
=== Summary: 4 files, 306 tests passed, 0 failed (100% complete) in 5.9s (24 workers) ===

Compile checks:

venv/bin/python -m compileall -q gateway/run.py tools/approval.py

[alanwilhelm]

Closing stale PR per cleanup (2026-07-07).