fix(tools): reload permanent allowlist by replacement

tests/tools/test_approval.py

@@ -618,6 +618,26 @@ class TestPatternKeyUniqueness:
             assert is_approved("legacy-find", key_delete) is True
 
 
+class TestPermanentAllowlistReload:
+    def test_load_permanent_replaces_stale_entries(self):
+        with mock_patch.object(approval_module, "_permanent_approved", set()):
+            load_permanent({"old-pattern"})
+            assert is_approved("reload", "old-pattern") is True
+
+            load_permanent({"new-pattern"})
+
+            assert is_approved("reload", "old-pattern") is False
+            assert is_approved("reload", "new-pattern") is True
+
+    def test_load_permanent_allowlist_clears_when_config_is_empty(self):
+        with mock_patch.object(approval_module, "_permanent_approved", {"stale-pattern"}):
+            with mock_patch("hermes_cli.config.load_config_readonly", return_value={"command_allowlist": []}):
+                assert approval_module.load_permanent_allowlist() == set()
+
+            assert approval_module._permanent_approved == set()
+            assert is_approved("reload", "stale-pattern") is False
+
+
 class TestFullCommandAlwaysShown:
     """The full command is always shown in the approval prompt (no truncation).
 

tools/approval.py

@@ -330,7 +330,9 @@ def approve_permanent(pattern_key: str):
 def load_permanent(patterns: set):
     """Bulk-load permanent allowlist entries from config."""
     with _lock:
-        _permanent_set().update(patterns)
+        governing = _permanent_set()
+        governing.clear()
+        governing.update(patterns)
 
 
 def _persist_choice(session_key: str, choice: str, warnings: list[tuple]) -> None:
@@ -392,8 +394,7 @@ def load_permanent_allowlist() -> set:
     so is_approved() honors 'always' choices from previous sessions."""
     try:
         patterns = _read_permanent_allowlist()
-        if patterns:
-            load_permanent(patterns)
+        load_permanent(patterns)
         with _lock:
             _permanent_baseline_by_home[_baseline_key()] = set(patterns)
         return patterns