hermes-admin/hermes-agent
1
0
Fork 0
Code Issues Pull Requests Actions 7 Packages Projects Releases Wiki Activity

docs(approval): _get_approval_config returns the live cache sub-dict

Browse Source 
Review follow-up on the #76194 salvage: the readonly swap makes this
function leak the live config-cache 'approvals' sub-dict to callers.
All current callers are read-only (audited); the docstring now carries
the do-not-mutate contract for future ones.
This commit is contained in:
kshitij
2026-08-02 19:45:15 +05:30
parent 48e8254567
commit 024f3e044b
1 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
tools/approval.py
View File

@@ -2601,7 +2601,11 @@ def _normalize_approval_mode(mode) -> str:
def _get_approval_config() -> dict:
"""Read the approvals config block. Returns a dict with 'mode', 'timeout', etc."""
"""Read the approvals config block. Returns a dict with 'mode', 'timeout', etc.
Returns the LIVE config-cache sub-dict (load_config_readonly contract) —
callers must not mutate it or any nested structure.
"""
try:
from hermes_cli.config import load_config_readonly
config = load_config_readonly()