hermes - 💡(How to fix) Fix Tirith approval buttons misleading: "permanently" is actually session-scoped [1 pull requests]

Bug

When a Tirith security scan triggers an approval prompt in the Telegram gateway, the "Approve permanently" button says "permanently" but is actually downgraded to session-scoped.

Root Cause

In tools/approval.py line 1344, Tirith warnings explicitly reject permanent approval: python if choice == "session" or (choice == "always" and is_tirith): approve_session(session_key, key) # session only Comment at line 1421 confirms: # tirith: session only (no permanent broad allowlisting)

This is a reasonable security policy, but the Telegram button label and confirmation message both say "permanently" — the user expects the approval to survive restart but it doesn't.

Suggested Fix

For Tirith warnings, replace "permanently" with "this session" in the button label, or add a note explaining Tirith approvals are always session-scoped.