feat: confirmation prompt for gateway /update command

[jcjc81]

/## /update fires instantly -- no "are you sure?"

/update pulls new code and restarts the running gateway, interrupting every
active session on the host -- but it fired the instant the command was received,
with no confirmation. An accidental or fat-fingered invoke had no undo.

This PR: always prompt, never persist approval

/update now always routes through the existing slash-confirm primitive
before spawning: native Approve Once / Cancel buttons on Telegram,
Discord, and Slack, with a text fallback elsewhere.

There is deliberately no "Always Approve" button and no config opt-out --
unlike /reload-mcp and the destructive session commands (/new, /reset,
/undo), where a permanent one-tap opt-out is reasonable because they run
often and are low-stakes. /update is rare and high-stakes: a permanent
one-tap disable would reintroduce the exact accidental-fire footgun this
confirmation exists to close.

Mechanism

Area	Change
send_slash_confirm (base + Telegram/Discord/Slack/WhatsApp)	Added allow_always: bool = True; when False, the middle button is suppressed
_request_slash_confirm (run.py)	Accepts + forwards allow_always
/update handler	Passes allow_always=False; always prompts; any non-cancel choice proceeds once, persists nothing
locales/en.yaml	Two-button prompt (Approve Once / Cancel), no always_followup

Design decisions

• Default allow_always=True means /reload-mcp and the destructive commands
  are byte-for-byte unchanged -- this is a generic widening of the shared
  hook, not a special-case.
• Cheap pre-flight validation (platform allowlist, managed-install, git-repo,
  hermes-binary) still fast-fails before prompting.
• Detached-spawn mechanics extracted verbatim into _execute_update; the
  confirm handler calls it on approval. No change to the spawn.

Tests

• tests/gateway/test_update_command.py: spawn-mechanics tests call
  _execute_update directly (post-approval); validation/platform-gate tests
  still hit _handle_update_command with a stubbed confirm hook.
• tests/gateway/test_update_slash_confirm.py: always-prompts,
  no-always-button, allow_always=False forwarded to adapter, once/cancel
  resolution, defense-in-depth that a stray "always" proceeds once and never
  persists, and pre-flight-beats-prompt.
• 64 tests pass across update, slash-confirm, destructive-confirm,
  Telegram, Discord, and Slack suites.

[teknium1]

Thanks for adding a confirmation gate to a command that restarts the gateway. The premise is confirmed on current main: gateway/slash_commands.py:4611-4706 writes the update marker and starts the detached process without a prior confirmation.

Problems

• gateway/run.py:14435 passes allow_always to every adapter invocation, including the default three-button flow. Platform adapters are an extension surface: gateway/platforms/ADDING_A_PLATFORM.md:121 documents the existing optional signature. A deployed adapter with that signature raises TypeError; the broad catch at gateway/run.py:14439-14443 silently falls back to text and loses its native confirmation buttons.

Suggested changes

• Pass allow_always only when it is False, and add a legacy-adapter regression test for the default path. That preserves existing adapter behavior while allowing /update to use text fallback where a platform has not adopted the two-button extension.

Automated hermes-sweeper review.

[teknium1]

Passing this new keyword even when it is True breaks already-deployed external adapters implementing the documented pre-change signature; the catch below turns their TypeError into a silent text fallback. Please only add this kwarg when allow_always is False, and cover a legacy-signature adapter in the default path.

[jcjc81]

Fixed in f726277f5: allow_always is now only added to kwargs when it's False (non-default); legacy adapters never see the new keyword. Added test_default_allow_always_not_passed_to_legacy_adapter to cover the default path. All 47 tests in test_update_slash_confirm.py + test_cmd_update.py pass.

[jcjc81]

CI is green on e422431cd. Two issues found and fixed beyond the allow_always gating:

1. test_i18n.py::test_catalog_keys_match_english (15 locales) — the original commit added gateway.update.confirm_prompt / gateway.update.cancelled to locales/en.yaml only. Translated both keys into all 15 other locale catalogs (af, de, es, fr, ga, hu, it, ja, ko, pt, ru, tr, uk, zh-hant, zh), matching the tone/structure of the existing gateway.reload_mcp.confirm_prompt translations already in each file.
2. test_update_streaming.py::test_spawns_with_gateway_flag — stale test calling _handle_update_command directly and asserting on subprocess.Popen, which is no longer reached before confirm-approval. Updated it to call _execute_update directly, matching the pattern test_update_command.py already uses.

Both pre-existed on the original commit (confirmed by reproducing locally before either fix), unrelated to the allow_always change discussed above.

[jcjc81]

Rebased onto current main (999703fd43). The previous head was ~4 weeks stale against upstream.

What changed in the rebase:

1. Windows /update spawn fix (3f6d4c6338) — upstream reworked the Windows spawn path in the same function this PR refactors. Auto-merged cleanly; both intents are now present (confirm-flow + module spawn).

2. New ar.yaml locale (a96f7c805b) — upstream added a 16th locale after our original i18n fix covered 15. Added the two new keys (gateway.update.confirm_prompt, gateway.update.cancelled) to ar.yaml with Arabic translations.

3. Test updates — test_update_command.py had evolved on main (new notification tests, different _make_runner). Took upstream main's version and re-applied the 2 confirm-flow test updates (test_writes_pending_marker, test_fallback_when_no_setsid) to call _execute_update directly.

Commit history (6 commits on main):

958648efbc feat: confirmation prompt for gateway /update command
0f18f3dabc fix(gateway): only pass allow_always=False to adapters
4f0968f5ed fix(i18n): add gateway.update keys to all 15 original locales
d4fbece5f6 test(gateway): fix stale test_spawns_with_gateway_flag
ad1f07d358 fix(i18n): add gateway.update keys to ar.yaml (new locale)
8c810c106d test(gateway): update pending-marker and setsid tests for confirm-flow

CI should be green on the new head. The 1 remaining test failure (test_managed_install_blocks_before_prompt) is pre-existing on main.

[jcjc81]

Fixed the one remaining CI failure: test_managed_install_blocks_before_prompt.

Root cause: The test used HERMES_MANAGED=homebrew, but upstream intentionally ignores homebrew in _IGNORED_MANAGED_VALUES (hermes_cli/config.py:447) — homebrew installs self-update via the Hermes tap, so the managed-install block doesn't apply. The test was outdated.

Fix: Switched the test to use HERMES_MANAGED=nix (which IS blocked) and updated the assertion from "managed by Homebrew" to "managed by nix". The test's intent — managed installs block before the confirm prompt — is unchanged.

New head: 805a80c9d1. CI should be fully green.

[jcjc81]

Closing — the feature in this PR is already on main.

The /update confirmation prompt (with allow_always=False), the allow_always parameter on send_slash_confirm across all button adapters, the _execute_update extraction, and the i18n keys across all 16 locales (including the new ar.yaml) are all present on current main. The feature was merged through a rebased version while this PR was open.

Verified on origin/main:

• gateway/slash_commands.py — _handle_update_command confirm gate + _execute_update
• gateway/run.py — _request_slash_confirm(allow_always=...)
• gateway/platforms/base.py + telegram/discord/slack/whatsapp adapters — allow_always param + conditional Always button
• locales/*.yaml (16 files) — gateway.update.confirm_prompt / cancelled
• tests/gateway/test_update_slash_confirm.py — present with upstream's managed-install fix

Nothing here is missing from main, so this PR is redundant. Thanks for the review time.