How it fits together
- Hermes feature
- Dangerous command approval, set by
approvals.modeinconfig.yaml - Where you answer
- Cards in bot chats and group rooms, and Approve or Deny on a banner
- Time to answer
- Five minutes by default (
approvals.timeout: 300), then Hermes denies - Alerts while Herald sleeps
- The
hermes-bot-pushplugin and a tap on Register - Setting in Herald
- Settings › General › Command approvals
How approvals work in Hermes
Hermes Agent checks every shell command a bot wants to run against a list of dangerous patterns, such as recursive deletes. A match pauses the turn and asks a person. A small hardline blocklist is refused outright: no answer and no approval mode can lift it.
Herald is one more place to answer. It speaks the same protocol as Hermes Desktop and the terminal, so a card you answer in Herald is the same request the other apps see. If nobody answers within the Hermes timeout, five minutes by default, the command is denied; tap a banner after that and Herald tells you “This request expired”. Ask the bot again and it raises a fresh request.
Your four answers
| Button | What Hermes does |
|---|---|
| Allow once | Runs this one command |
| This session | Allows this kind of command for the rest of the session |
| Always | Adds it to the permanent allowlist (command_allowlist in config.yaml), so it never asks again |
| Deny | Blocks the command; the bot has to find another way |
Choose how often Hermes asks
| Herald option | approvals.mode | What happens |
|---|---|---|
| Smart | smart, the Hermes default | A helper model judges risk: low-risk commands run, clearly dangerous ones are denied and uncertain ones ask you |
| Ask every time | manual | Every flagged command waits for you |
| Never ask | off | Nothing asks, the same as running Hermes with --yolo |
Herald saves this in your primary connection’s Hermes config, so it applies wherever that Hermes asks, not only in Herald.
Set it up
- Connect Herald to your Hermes
Run
npx herald-setupon the computer and scan the QR code. Approval cards work as soon as you are connected. - Pick an approval mode
Open Settings › General › Command approvals and choose Smart, Ask every time or Never ask.
- Turn on Alerts
Settings › General › Notifications › Alerts gives you banners while Herald is in the background, for the chat you have open.
- Add push for when Herald is asleep
Install the
hermes-bot-pushplugin on the computer and tap Register under Settings › General › Push notifications. See push notifications. - Answer from the card or the banner
Tap a button on the card, or Approve or Deny on the banner. Banner buttons open Herald, which answers as soon as the bot’s chat reconnects.
Other questions a bot can ask
Approvals are not the only pause. If a command needs sudo, Herald shows a “Password needed” sheet; the password is sent once to your Hermes and not stored on the phone. A bot can ask for a named secret the same way. Clarifying questions appear as a card you answer with a choice or a typed reply, and an “MCP setup” card appears when a bot wants a server installed, enabled or authorised.
In group rooms the card names the member that needs approval, and banners name the bot, as in “Rev needs approval”. If several requests are waiting when you tap a banner, Herald asks you to pick the one you meant from the cards.
Limits
- Push banners come from your primary connection’s Hermes, where the plugin and your registration live.
- Banner buttons open Herald. The answer travels over Herald’s own connection, and iOS gives a closed app no time to send it in the background.
- A request older than the Hermes timeout can’t be answered. Ask the bot to try again.
- Apple Watch and CarPlay have no approval buttons.
- Commands on the Hermes hardline blocklist can’t be approved from anywhere.
Questions
Can I approve from the Lock Screen?
Yes, with the Approve and Deny buttons on a banner. Herald opens and sends your answer once the bot’s chat reconnects.
What happens if I don’t answer?
Hermes waits for its approval timeout, five minutes unless you changed approvals.timeout, then denies the command. The bot is told not to retry on its own in that turn.
Where does Always save my choice?
In command_allowlist in ~/.hermes/config.yaml on the computer. Remove the entry there to be asked again.
Does the setting affect Telegram and the terminal too?
Yes. Command approvals sets approvals.mode for that Hermes, so every app connected to it follows the same policy.
Do I need push for approvals?
No. Cards appear in the chat whenever Herald is connected. Push matters when Herald has been in the background long enough for its connection to sleep.
