From 70cffa4d3b4982e367b7607de0eec696c0c79956 Mon Sep 17 00:00:00 2001
From: 0xbyt4 <35742124+0xbyt4@users.noreply.github.com>
Date: Sat, 7 Mar 2026 19:30:00 +0300
Subject: [PATCH] fix: return "deny" on approval callback timeout instead of
 None

_approval_callback() had no return statement after the timeout break,
causing it to return None. Callers expect a string ("once", "session",
"always", or "deny"), so None could lead to undefined behavior when
approving dangerous commands.
---
 cli.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/cli.py b/cli.py
index 4d1941f81..7e22757bd 100755
--- a/cli.py
+++ b/cli.py
@@ -2245,6 +2245,8 @@ class HermesCLI:
         self._approval_state = None
         self._approval_deadline = 0
         self._invalidate()
+        return "deny"
+
     def chat(self, message, images: list = None) -> Optional[str]:
         """
         Send a message to the agent and get a response.