fix(cron): isolate approval context per job

[brendanlees]

What does this PR do?

Scopes cron approval identity to the active cron task instead of setting process-global HERMES_CRON_SESSION=1 forever.

The gateway and cron scheduler share a process. After the first agent-backed cron run, the leaked flag caused later Discord MCP elicitations to be treated as CLI/cron approvals. They fell through to a terminal prompt with no stdin and failed closed as denied instead of rendering Discord approval controls.

The new task-local context preserves cron policy during the cron run, including worker threads and subprocess environment construction, while preventing completed or concurrent cron runs from changing live gateway approval routing. Legacy process-env callers still work through get_session_env() fallback.

Related Issue

Fixes #76748

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

• Bind cron identity through gateway.session_context per task.
• Make scheduler jobs opt into task-local cron context without mutating os.environ.
• Route approval and bang-shell cron checks through context-local state with legacy env fallback.
• Add scheduler, gateway, and MCP elicitation regression coverage for the observed failure.

How to Test

1. Run an agent-backed cron job inside the gateway process.
2. From a later Discord turn, invoke a form-eliciting MCP tool.
3. Confirm the elicitation uses the Discord approval surface rather than terminal input.
4. Confirm cron-originated approval checks still follow approvals.cron_mode.

Commands run:

scripts/run_tests.sh \
  tests/tools/test_cron_approval_mode.py \
  tests/tools/test_mcp_elicitation.py \
  tests/tools/test_request_tool_approval.py \
  tests/cron/test_cron_approval_context.py \
  tests/cli/test_bang_shell_mode.py \
  tests/gateway/test_session_context_inheritance.py \
  tests/tools/test_local_env_session_leak.py

scripts/run_tests.sh \
  tests/tools/test_execute_code_approval_cluster.py \
  tests/tools/test_hardline_blocklist.py \
  tests/tools/test_denial_circuit_breaker.py \
  tests/cron/test_sessiondb_init_hang.py \
  tests/cron/test_cron_provider_pin.py \
  tests/cron/test_codex_execution_paths.py

ruff check cron/scheduler.py gateway/session_context.py tools/approval.py \
  hermes_cli/bang_shell.py tests/tools/test_cron_approval_mode.py \
  tests/tools/test_request_tool_approval.py tests/tools/test_mcp_elicitation.py \
  tests/cron/test_cron_approval_context.py tests/cli/test_bang_shell_mode.py

python scripts/check-windows-footguns.py --diff origin/main

Results: 325 targeted tests passed, Ruff passed, and no Windows footguns were found.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits
• I searched existing open and closed PRs/issues for duplicates
• My PR contains only changes related to this fix
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes
• I've tested on macOS 15 and a Linux production gateway

Documentation & Housekeeping

• Documentation changes are N/A; behavior and concurrency rationale are documented in code
• cli-config.yaml.example changes are N/A
• CONTRIBUTING.md and AGENTS.md changes are N/A
• Cross-platform impact was checked with check-windows-footguns.py
• Tool description/schema changes are N/A

Screenshots / Logs

Before the fix, the live Discord request was routed to the gateway process terminal and failed closed:

Approval requested by MCP server 'soul_broker'.
Choice [o/s/D]: Denied

Both the scheduler lifecycle test and MCP context-bridge test cover this routing regression.

[teknium1]

Thanks for isolating a real approval-routing leak: current main still sets HERMES_CRON_SESSION process-wide in cron/scheduler.py:3014, and tools/approval.py:241-245 lets that stale flag override later gateway classification.

Problems

• gateway/session_context.py:138 adds HERMES_CRON_SESSION to _VAR_MAP, which makes it a bridged child-process variable (tools/environments/local.py:445-453). But the shared shell snapshot exclusion is explicitly required to stay synchronized with _VAR_MAP (tools/environments/base.py:399-402) and currently only excludes HERMES_SESSION_*, HERMES_UI_SESSION_ID, and HERMES_CRON_AUTO_DELIVER_* (tools/environments/base.py:403-437). The new cron identity can therefore be persisted into the shared snapshot.

Suggested changes

• Exclude HERMES_CRON_SESSION in both snapshot filtering paths in tools/environments/base.py, and add a snapshot regression test alongside tests/tools/test_snapshot_multiline_session_env_injection.py.

Automated hermes-sweeper review.

[teknium1]

Adding this bridged name also requires updating the shared-shell snapshot exclusion in tools/environments/base.py: its _VAR_MAP synchronization contract currently excludes only HERMES_SESSION_*, HERMES_UI_SESSION_ID, and HERMES_CRON_AUTO_DELIVER_*. Otherwise a cron terminal child can persist HERMES_CRON_SESSION=1 in the shared snapshot.

[alt-glitch]

This was generated by AI during triage.

Related: #43370 and #58663 address the same cron approval-marker leak. This patch covers scheduler, bang-shell, and MCP elicitation; #43370 also explicitly masks stale cron state across gateway, API, ACP, and TUI entrypoints. Maintainer decision needed on the preferred coverage/mechanism.

[GottZ]

This was generated by AI during triage.

Summary

Thirty-nine PRs address or reference this approval-system complex: most cron fixes target the process-global HERMES_CRON_SESSION leak, while the remaining diffs cover plugin-driven tool approval, unattended-policy ordering, file/skill approvals, smart-prompt context, and adjacent hardening. The cron root cause is already fixed on main by #77022; the other subproblems require separate dispositions rather than treating every PR as interchangeable.

Related pull requests

• feat(approvals): add approvals.context for customizable smart-approval prompts #16483 [closed] best fix — (+118/-3) — closed design experiment: added approvals.context to the smart-approval prompt, but it targeted the obsolete client path and was closed after the maintainer decided against operator-supplied prompt guidance, superseding the earlier keep_open review.
• fix(cron): restore cron session environment after jobs #29854 fixes — (+127/-9) — close as already implemented on main: its ContextVar-based cron scope overlaps fix(cron): scope cron approval context per session #77022, whose merged commit fb6446f and tests/cron/test_scheduler_cron_session_isolation.py provide the landed implementation.
• fix(security): move HERMES_CRON_SESSION from os.environ to contextvars #31184 partial — (+1/-2) — close as duplicate of fix(cron): scope cron approval context per session #77022: its set_session_vars call does not create a cron ContextVar and it updates none of the approval consumers identified by the keep_open review.
• fix(cron): restore cron session env after jobs #35515 partial — (+79/-2) — close as duplicate of fix(cron): restore HERMES_CRON_SESSION after jobs #43549 and ultimately fix(cron): scope cron approval context per session #77022: serial env save/restore leaves concurrent cron jobs unsafe, as the contributor review documented.
• fix: isolate cron approval context #36004 fixes — (+169/-28) — close as duplicate of fix(cron): scope cron approval context per session #77022: it has the right ContextVar direction but is stale and lacks the real scheduler worker-handoff regression requested by the keep_open review.
• fix(cron): isolate gateway approvals from environment pollution #37969 [closed] best fix — (+439/-36) — superseded by fix(cron): scope cron approval context per session #77022, closed: it developed the same scoped cron identity and additional ask-mode/delegation handling, but the landed implementation came from Fix cron session context isolation #43370.
• Fix cron session context isolation #43370 [closed] best fix — (+364/-15) — merged reference implementation via fix(cron): scope cron approval context per session #77022, closed: its tri-state ContextVar, explicit non-cron gateway/API/ACP/TUI bindings, and end-to-end isolation tests supplied the salvaged design.
• fix(cron): restore HERMES_CRON_SESSION after jobs #43549 [closed] partial — (+51/-3) — superseded by fix(cron): scope cron approval context per session #77022, closed: its minimal env restoration addressed serial leakage but not overlapping jobs or concurrent gateway turns.
• fix: restore cron approval env after job runs #46167 [closed] partial — (+11/-3) — duplicate of fix(cron): restore cron session environment after jobs #29854, closed: it used the same per-job env save/restore mechanism and was voluntarily consolidated.
• fix(security): block execute_code secret egress #46900 related — (+129/-4) — keep open with a salvage path: retain the goal of an enforceable execute_code secret-egress boundary, but replace the bypassable regex classifier and reconcile it with current host-access guards.
• fix(approval): let gateway session indicators override process-wide cron flag #56784 partial — (+129/-25) — close as already implemented on main: its consumer-side gateway precedence is covered more completely by fix(cron): scope cron approval context per session #77022 commit fb6446f, which scopes cron identity and explicitly masks stale state at live entrypoints.
• fix(approval): ignore leaked HERMES_CRON_SESSION in interactive sessions (#56771) #56788 [closed] partial — (+115/-7) — competing consumer-side fix, closed: it inferred live sessions from gateway/session keys but was withdrawn in favor of the stronger source-level ContextVar lane.
• fix(approval): use per-job ContextVar for cron-session flag instead of leaking env var (#56771) #56796 partial — (+349/-31) — close as already implemented on main: its per-job ContextVar approach is superseded by fix(cron): scope cron approval context per session #77022 commit fb6446f and tests/cron/test_scheduler_cron_session_isolation.py.
• fix(cron): clean up HERMES_CRON_SESSION env var after each job run (#56771) #57124 partial — (+3/-0) — close as already implemented on main: the one-line env cleanup is both concurrency-unsafe and superseded by fix(cron): scope cron approval context per session #77022’s task-local implementation.
• fix(approval): ignore leaked cron env in gateway sessions #57169 partial — (+136/-18) — close as duplicate of fix(cron): scope cron approval context per session #77022: its extra cron-job-ID classifier leaves the legacy process marker alive, whereas the landed fix removes that shared-state dependency.
• fix(security): scope the cron-session approval marker to the job context #58663 best fix — (+640/-87) — close as already implemented on main despite its high-salvageability keep_open review: fix(cron): scope cron approval context per session #77022 commit fb6446f landed the same token-reset ContextVar design with explicit non-cron entrypoint masking.
• feat(plugins): pre_tool_call approve action escalates to human gate (closes #51221) #58698 [merged] partial — (+669/-106) — historical merged implementation later superseded by feat(plugins): re-land pre_tool_call approve escalation with rule keys + working gateway notify #60504: it introduced pre_tool_call approve escalation, but lacked the final rule-key and working gateway-notification integration.
• feat(plugins): pass approve rule keys to approval gate #59163 [closed] fixes — (+767/-108) — superseded by feat(plugins): re-land pre_tool_call approve escalation with rule keys + working gateway notify #60504, closed: its plugin rule_key propagation was cherry-picked with authorship preserved into the active re-land.
• fix(approval): deny unattended gateway jobs via cron mode #59179 best fix — (+295/-77) — keep open with a salvage path: preserve unattended cron/kanban precedence over inherited HERMES_EXEC_ASK for terminal and execute_code, the verified best fix for [Bug]: approvals.cron_mode: deny never applies to gateway-hosted cron/kanban sessions — each gated call blocks for approvals.gateway_timeout #58673 and consistent with its keep_open review.
• fix(cron): clean up HERMES_CRON_SESSION env var after each job run (#59236) #59242 [closed] partial — (+3/-0) — duplicate of fix(cron): clean up HERMES_CRON_SESSION env var after each job run (#56771) #57124, closed: it added the same concurrency-unsafe os.environ.pop cleanup and was voluntarily consolidated.
• fix(cron): scope approval marker to cron execution context (#58662) #59719 partial — (+452/-11) — close as already implemented on main: its ContextVar cron-marker work is superseded by fix(cron): scope cron approval context per session #77022 commit fb6446f, which also covers sibling gateway isolation.
• fix(cron): clean up HERMES_CRON_SESSION env var after each job to prevent process-wide leak into gateway sessions #60386 [closed] partial — (+68/-0) — duplicate of fix(cron): clean up HERMES_CRON_SESSION env var after each job run (#56771) #57124, closed: besides the same env cleanup it bundled an unrelated dependency-audit change that would have required a separate PR.
• feat(plugins): re-land pre_tool_call approve escalation with rule keys + working gateway notify #60504 [merged] best fix — (+834/-108) — merged reference implementation: it re-landed plugin approval escalation with per-rule keys and a functioning _await_gateway_decision notification round-trip across messaging surfaces.
• fix(plugins): re-enable pre_tool_call approve escalation with correct gateway notify path (#59201) #60544 [closed] fixes — (+559/-95) — duplicate of feat(plugins): re-land pre_tool_call approve escalation with rule keys + working gateway notify #60504, closed: its gateway-notify repair is already present on main at tools/approval.py:2216, consistent with the automated close verdict on [Bug]: Approval plugin doesn't show approve controls on desktop and gateway (works on CLI) #59201.
• fix: evaluate cron_mode deny before session approval in approval gate #60547 [closed] partial — (+11/-5) — superseded by fix: evaluate cron_mode deny before session approval in approval gate #61064, closed: it first reordered cron policy ahead of cached approvals but lacked the focused regression requested during review.
• fix: make /skills slash command available in desktop and dashboard #60550 best fix — (+19/-3) — author action: rebase onto main, or split out the part that can merge; preserve the Desktop command work but redesign it as a Skills-sidebar pending/diff/approve flow without bypassing the existing gateway config gate.
• fix(cron): clean up HERMES_CRON_SESSION env var after job completes (#60350) #60611 partial — (+6/-0) — close as already implemented on main: its unconditional env pop is concurrency-unsafe and superseded by fix(cron): scope cron approval context per session #77022 commit fb6446f with task-local isolation tests.
• fix(approval): gate remote repository mutations #60799 [closed] related — (+232/-22) — duplicate of fix(approval): gate unattended VCS mutations #60077, closed: its distinct GraphQL-mutation and execute_code approval-key tests remain useful reference material for the broader remote-mutation boundary.
• fix: evaluate cron_mode deny before session approval in approval gate #61064 best fix — (+13/-5) — keep open with a salvage path: retain the cron-before-cache ordering for Approval gate: fail-closed option for non-interactive contexts + permanent allowlist bypasses cron_mode deny #60505, but satisfy the visible keep_open verdict by adding a cron-deny regression with is_approved() true.
• fix(approvals): make cron-session classification task-local, not process-global #62111 [closed] partial — (+195/-9) — duplicate of fix(security): scope the cron-session approval marker to the job context #58663, closed: its intended ContextVar migration was undermined by a recursive fallback and missing token restoration.
• feat(approvals): add write-file approval mode #63847 [closed] best fix — (+1307/-38) — closed design reference: it implemented write_file/patch ask mode, but maintainer direction rejected this cross-cutting policy in favor of native safety, plugin hooks, ACP approval, and tool disabling.
• fix(cron): keep approval context task-local #64194 [closed] fixes — (+79/-18) — duplicate of fix(security): scope the cron-session approval marker to the job context #58663, closed: it used the same task-local cron identity and was voluntarily consolidated into the stronger token-reset implementation.
• fix(cron): isolate cron approval context #69566 [closed] partial — (+35/-7) — duplicate of fix(security): scope the cron-session approval marker to the job context #58663, closed: it re-derived ContextVar isolation but reset with an explicit empty value rather than preserving fallback state via a token.
• fix(cron): pop HERMES_CRON_SESSION env var after last cron job finishes #69740 [closed] partial — (+191/-0) — closed intermediate approach: reference-counted process-env cleanup was abandoned because it retained a race-prone global marker instead of fixing the root cause.
• fix(cron): migrate HERMES_CRON_SESSION from os.environ to ContextVar #69766 [closed] fixes — (+366/-9) — duplicate of fix(security): scope the cron-session approval marker to the job context #58663, closed: its useful Feishu regression ideas were forwarded to the canonical ContextVar implementation, while the submitted diff also contained unresolved conflict markers.
• fix(cron): isolate approval state per session #70768 fixes — (+58/-14) — close as already implemented on main: despite its keep_open review, fix(cron): scope cron approval context per session #77022 commit fb6446f uses token reset to preserve legacy fallback and covers the same task-local isolation.
• fix(cron): isolate approval context per job #76749 best fix — (+181/-32) — close as already implemented on main despite the keep_open review and recorded best-fix verdict: fix(cron): scope cron approval context per session #77022 commit fb6446f lands the same cron ContextVar fix and additionally excludes HERMES_CRON_SESSION in tools/environments/base.py snapshot filtering.
• fix(cron): restore HERMES_CRON_SESSION after run_job to stop gateway approval leak (#76748) #76763 [closed] partial — (+75/-0) — duplicate of fix(cron): restore HERMES_CRON_SESSION after jobs #43549, closed: serial env restoration remains unsafe for overlapping cron jobs and concurrent gateway turns.
• fix(cron): scope cron approval context per session #77022 [merged] best fix — (+368/-15) — merged reference implementation: commit fb6446f replaces the global marker with scoped ContextVar state, masks stale state at gateway/API/ACP/TUI entrypoints, filters shell snapshots, and adds tests/cron/test_scheduler_cron_session_isolation.py.

Duplicates

The cron-leak chain is #35515/#43549/#46167/#57124/#59242/#60386/#60611/#76763 for env restoration and #29854/#36004/#37969/#43370/#56796/#58663/#59719/#62111/#64194/#69566/#69766/#70768/#76749 for task-local isolation, all superseded by merged #77022. The plugin chain is #58698 → #59163 → #60504, with #60544 duplicating the landed gateway-notify repair; #60547 is superseded by #61064.

Suggested consolidation

Close the remaining cron-leak PRs as already implemented on main by #77022 (commit fb6446f, tests/cron/test_scheduler_cron_session_isolation.py), including #76749 despite its keep_open review and best-fix record because the merged diff contains its mechanism plus the requested shell-snapshot exclusion. Keep #59179, #61064, and #46900 open only on their concrete salvage paths, require author action on #60550, and close the identified duplicate chains.

Complex graph

flowchart LR
    classDef open fill:#dbeafe,stroke:#1d4ed8,color:#1e3a8a
    classDef merged fill:#dcfce7,stroke:#15803d,color:#14532d
    classDef closed fill:#e5e7eb,stroke:#6b7280,color:#1f2937
    classDef unverified fill:#f3f4f6,stroke:#9ca3af,color:#374151
    classDef best stroke-width:3px,stroke:#b45309
    classDef target stroke-width:3px,stroke:#4338ca
    I76748(["issue #76748 (open)"])
    P76749["PR #76749 (open)"]
    P76749 -->|best fix| I76748
    class I76748 open
    class P76749 open
    class P76749 best
    class P76749 target
    click I76748 "https://github.com/NousResearch/hermes-agent/issues/76748"
    click P76749 "https://github.com/NousResearch/hermes-agent/pull/76749"

Loading

Graph: solid arrow = fixes / best fix, dashed arrow = partial or unverified (see edge label); boxed group = PRs duplicating each other; amber border = best fix; indigo border = target; gray node = closed (state tag in the node label).

Cross-PR triage: Reviewed 39 pull requests and 17 issues in this complex. Each diff was read against this issue; Assessment working set: 700 kB of PR diffs, 142 kB of issue/PR text, 129 kB of discussion (159 comments), 127 verify verdicts. verdicts reflect diff content, not PR titles. Part of an automated triage batch.