A prior merge removed these helpers from tools/approval.py but kept the
api_server callers that import them, breaking every /v1/runs request
with ImportError. Restore the contextvar (`_approval_run_id`) and the
three accessors so the API run path can bind a per-task run id to
pending gateway approvals again.

Clears the 7 failures under tests/gateway/test_api_server_runs.py.

A prior merge deleted gateway/proxy_scope_auth.py and stripped the
HMAC-signature check from the /v1/chat/completions handler, while
leaving the tests that exercise both paths. Restore the module and
re-wire the handler:

- Imports verify_proxy_scope_signature + signature/timestamp headers
  from gateway.proxy_scope_auth.
- Uses ``"hermes_proxy_scope" in body`` (not truthy check) so an
  explicit JSON ``null`` is rejected with 400.
- Returns 403 with "trusted gateway proxy authentication" when the
  signature is missing or invalid.

Clears the 3 TestChatCompletionsEndpoint failures.

A prior merge dropped the is_safe_url() check on http(s) image URLs from
_normalize_multimodal_content, leaving only the scheme guard. Image URLs
pointing at private/internal addresses now reach the multimodal pipeline
and can exfiltrate internal-network content (test_private_image_url_rejected,
test_cloud_metadata_image_url_rejected). Re-add the check before the URL
is normalized into the image part.

…xt test with scrub semantics

Two lost-in-merge regressions in tests/run_agent/test_run_agent.py:

1. _FakeProviderMemoryManager class was deleted but two
   TestConcurrentToolExecution tests still instantiate it, raising
   NameError. Restore the minimal double from #209.

2. test_memory_context_in_stored_content_is_preserved was renamed to
   _is_scrubbed in #478 and the assertions inverted to match the
   storage-boundary scrub the production code now performs. The pre-rename
   version kept the old "preserve" assertions, which fail against the
   correct production behaviour. Update the test to its post-#478 form.

…ver fanout

Two lost-in-merge regressions in hermes_cli/tools_config.py:

- _implicit_default_off_toolsets no longer dropped homeassistant from
  default_off when HASS_TOKEN was set. That regressed Norbert's HA cron
  setup (the original PR NousResearch#14798 carve-out) because cron / cli would
  silently drop the toolset even though the operator had provisioned
  credentials. Restore the HASS_TOKEN check.

- _get_platform_tools required platform_toolsets to explicitly re-list
  every globally configured MCP server (exa, web-search-prime, etc.) to
  keep them enabled. Once a platform had any explicit builtin toolset
  list, MCP servers vanished. Restore the simpler rule: no_mcp opts out;
  otherwise enabled_mcp_servers always fan out — explicit builtin
  selection is the platform allowlist, not the MCP allowlist.

Clears 2 test_tools_config failures and the related
test_reasoning_command "exa in toolsets" assertion.

The inline secret-block in browser_navigate only ran one urllib.unquote
pass, so a URL with double-percent-encoded prefixes (sk%252Dant%252D…)
slipped through and reached the browser. agent.redact.url_contains_secret
applies repeated decoding (3 passes) and also splits the URL into
component values before matching, so it catches the multi-encode tricks
that test_blocks_percent_encoded_api_key_in_url and
test_blocks_split_api_key_in_query_values exercise.

Clears 2 test_browser_secret_exfil failures.

Two adjacent security regressions:

- tools/browser_tool.py: pre-navigation SSRF check skipped local backends
  (`not _is_local_backend()` short-circuited the guard) even though the
  surrounding comment explicitly states local backends must enforce it
  too — browser_snapshot can return local-file / internal-service
  responses in reduced-tool configurations. Drop the local-backend skip
  so the guard fires unless the operator opts in via
  ``browser.allow_private_urls``.

- gateway/platforms/qqbot/adapter.py: restore the attachment pre-auth
  gate from #349. _handle_c2c/_handle_group/_handle_guild/_handle_dm
  now check `_is_source_authorized_for_attachment_processing` before
  calling `_process_attachments`, and forward a text-only event when
  the sender isn't allowlisted. This prevents an unauthorized sender
  from forcing the bot to fetch attacker-controlled attachment URLs
  (SSRF amplification, large-file DoS, redirect attacks). Failure-closed
  when gateway_runner isn't attached yet, with a throttled warning so
  startup races don't spam the log.

Clears 2 test_browser_ssrf_local failures and
test_unauthorized_c2c_skips_attachment_processing.

dispatch_once() was calling waitpid(-1, WNOHANG) on every tick, which
reaps any zombie child of the gateway process — including non-kanban
subprocesses (npm install, agent-browser, etc.) whose callers rely on
their own Popen.wait()/subprocess.run() exit status. That broke
unrelated tools whenever the kanban dispatcher ran in the same process.

Restore the scoped reaper from #393: track each kanban worker PID in
_known_worker_child_pids when it's persisted via _set_worker_pid, and
in dispatch_once only waitpid those specific PIDs. Windows is still a
no-op (no zombies / no WNOHANG).

Clears test_source_gates_waitpid_loop.

… loop

When the batched-delta background task ("_batch_flush_after") hit a
ConnectionResetError on response.write(), the exception was swallowed
in the detached task and the main loop kept waiting on stream_q for
items that would never arrive — the streaming endpoint hung until the
client timed out and the agent was never interrupted.

Restore #398's fix: catch the flush exception in the background task,
stash it in _batch_error, and push a sentinel into stream_q so the main
loop re-raises it on dequeue. Both the live loop and the drain path
honour the sentinel.

Clears test_stream_batched_delta_disconnect_interrupts_agent.

…rust roots

A prior merge widened _SANE_PATH_DIRS to include /opt/homebrew/{bin,sbin}
and /usr/local/{bin,sbin} unconditionally and made _browser_candidate_path_dirs
always inject Homebrew node prefixes. Cron / systemd / locked-down operator
configs that intentionally strip those trust roots from PATH would silently
get them injected back, defeating the restriction.

Restore #234's design:
- _SANE_PATH_DIRS only includes Termux + system dirs (/usr/{bin,sbin}, /{bin,sbin}).
- _browser_candidate_path_dirs(existing_path) takes the operator-provided PATH
  and only adds Homebrew node prefixes / /usr/local / hermes-managed Node bin
  when the operator already opted into that trust root.
- _find_agent_browser passes os.environ.get("PATH","") through to
  _merge_browser_path so the gating actually fires (previously it passed "").

Clears all 4 test_browser_homebrew_paths failures.