fix: surface approval prompt in UI instead of getting stuck in Thinking (#187)

* fix: surface approval prompt in UI instead of getting stuck in Thinking

When a dangerous command was detected during streaming, the approval system
would call submit_pending() but no SSE 'approval' event would be emitted to
the frontend. The agent thread either blocked indefinitely (gateway path) or
returned an approval_required status the UI never saw (EXEC_ASK path). Either
way the chat UI stayed stuck in 'Thinking...' with no prompt shown.

Root cause: streaming.py used HERMES_EXEC_ASK=1 but never registered a
register_gateway_notify() callback. Without it, check_all_command_guards()
fell back to the legacy polling path (submit_pending only), which relies on
on_tool() polling -- but on_tool() fires *before* the tool runs, so by the
time the terminal tool detected the dangerous command and called submit_pending,
the approval event had already missed its window.

Fix (streaming.py):
- Register a gateway-style notify_cb via register_gateway_notify() before the
  agent runs. The callback calls put('approval', ...) to emit the SSE event
  the moment a dangerous command is detected, regardless of on_tool() timing.
- Unregister via unregister_gateway_notify() in the finally block to unblock
  any threads still waiting if the stream ends or is cancelled mid-approval.
- Keep the on_tool() fallback poll for older approval module versions.

Fix (routes.py):
- Import and call resolve_gateway_approval() in _handle_approval_respond().
  This unblocks the agent thread parked in entry.event.wait() when the user
  clicks Allow or Deny in the UI. Without this call the thread would block
  until the 5-minute gateway timeout.

Tests (tests/test_approval_unblock.py):
- 16 new tests covering: resolve_gateway_approval() event signalling, deny/
  session/once choices, resolve_all, notify_cb registration/firing/cleanup,
  unregister signals blocked entries, full end-to-end streaming simulation,
  module symbol exports, and HTTP endpoint regressions.

515 tests pass (499 existing + 16 new).

* feat: full approval UI — i18n buttons, keyboard shortcut, loading state, scoping fix

---------

Co-authored-by: Nathan Esquenazi <nesquena@gmail.com>

static/i18n.js

@@ -32,6 +32,18 @@ const LOCALES = {
     regen_failed: 'Regenerate failed: ',
     reconnect_active: 'A response is still being generated. Reload when ready?',
     reconnect_finished: 'A response was in progress when you last left. Messages may have updated.',
+    // approval card
+    approval_heading: 'Approval required',
+    approval_desc_prefix: 'Dangerous command detected',
+    approval_btn_once: 'Allow once',
+    approval_btn_once_title: 'Allow this one command (Enter)',
+    approval_btn_session: 'Allow session',
+    approval_btn_session_title: 'Allow for this conversation session',
+    approval_btn_always: 'Always allow',
+    approval_btn_always_title: 'Always allow this command pattern',
+    approval_btn_deny: 'Deny',
+    approval_btn_deny_title: 'Deny — do not run this command',
+    approval_responding: 'Responding\u2026',
     untitled: 'Untitled',
     n_messages: (n) => `${n} messages`,
     model_unavailable: ' (unavailable)',
@@ -154,6 +166,18 @@ const LOCALES = {
     regen_failed: '\u91cd\u65b0\u751f\u6210\u5931\u8d25\uff1a',
     reconnect_active: '\u56de\u590d\u4ecd\u5728\u751f\u6210\u4e2d\uff0c\u51c6\u5907\u597d\u540e\u8981\u91cd\u65b0\u52a0\u8f7d\u5417\uff1f',
     reconnect_finished: '\u4f60\u79bb\u5f00\u65f6\u6709\u56de\u590d\u6b63\u5728\u751f\u6210\uff0c\u6d88\u606f\u5185\u5bb9\u53ef\u80fd\u5df2\u7ecf\u66f4\u65b0\u3002',
+    // approval card
+    approval_heading: '需要审批',
+    approval_desc_prefix: '检测到危险命令',
+    approval_btn_once: '允许一次',
+    approval_btn_once_title: '允许执行此命令一次（Enter）',
+    approval_btn_session: '本次允许',
+    approval_btn_session_title: '本次会话期间允许',
+    approval_btn_always: '始终允许',
+    approval_btn_always_title: '始终允许此命令模式',
+    approval_btn_deny: '拒绝',
+    approval_btn_deny_title: '拒绝 — 不执行此命令',
+    approval_responding: '处理中…',
     untitled: '\u672a\u547d\u540d',
     n_messages: (n) => `${n} \u6761\u6d88\u606f`,
     model_unavailable: '\uff08\u4e0d\u53ef\u7528\uff09',