Ë ÿ`gj±ãóœ—dZddlmZddlZddlmZddlmZGd„de«Z ejd«Z d d „Z dd „Z dd „Z d dd „Zy)uÖGateway lifecycle guard for cron job creation (#30719). An agent running inside a gateway can schedule a cron job that calls ``hermes gateway restart`` (or ``launchctl kickstart ai.hermes.gateway`` or ``systemctl restart hermes-gateway``). When the cron fires, the gateway dies, the supervisor (launchd KeepAlive / systemd Restart=) revives it, auto-resume picks up the offending session, and the resumed turn re-runs the same logic — a SIGTERM-respawn loop every ~10 seconds until manually broken. This module rejects cron job specs whose prompt or script contains a direct shell-level gateway-lifecycle command. It is enforced at ``cron.jobs.create_job`` so it fires on every job-creation path: the ``hermes cron create`` CLI subcommand AND the agent's ``cronjob`` model tool (which calls ``create_job`` directly, bypassing the CLI layer). The pattern is intentionally command-shaped: it anchors on a concrete command identifier (``hermes gateway``, ``launchctl ... hermes-gateway``, ``systemctl ... hermes-gateway``, ``pkill`` against the gateway) so it cannot fire on prose. A cron ``prompt`` is fed to a future LLM, not a shell, so an over-broad substring match on English ("Kong API gateway autoscaling and restart behavior") would produce a high false-positive rate without preventing the actual foot-gun, which requires a real command shape. This is a defence-in-depth layer. ``tools/terminal_tool.py`` already blocks these commands at *execution* time when ``_HERMES_GATEWAY=1``, and ``hermes gateway stop|restart`` refuse to self-target from inside the gateway. Blocking at *creation* time as well means the agent gets an immediate, informative rejection instead of scheduling a job that will only fail (silently) when it fires. é)Ú annotationsN)ÚPath)ÚOptionalcó—eZdZdZy)ÚGatewayLifecycleBlockedzARaised when a cron job spec contains a gateway-lifecycle command.N)Ú__name__Ú __module__Ú __qualname__Ú__doc__©óúG/root/.hermes/venv/lib/python3.12/site-packages/cron/lifecycle_guard.pyrr)s„ÚKr ra'(?i)(?:hermes\s+gateway\s+(?:restart|stop))|(?:launchctl\s+(?:kickstart|unload|load|stop|restart)\b[^\n]*\bhermes[.\-]?gateway)|(?:systemctl\s+(?:-\S+\s+)*(?:restart|stop|start)\b[^\n]*\bhermes[.\-]?gateway)|(?:p?kill\b[^\n]*\bhermes\b[^\n]*\bgateway)|(?:p?kill\b[^\n]*\bgateway\b[^\n]*\bhermes)cóD—|syttj|««S)zCReturn True if *text* contains a gateway lifecycle command pattern.F)ÚboolÚ_GATEWAY_LIFECYCLE_PATTERNÚsearch)Útexts rÚ"contains_gateway_lifecycle_commandrEs€á ØÜ Ô*×1Ñ1°$Ó7Ó 8Ð8r có~—ddlm}t|«j«}|j «r|S|«dz |z S)uEResolve a cron ``script`` value the same way the scheduler does. The scheduler (``cron.scheduler``) resolves a bare/relative script path under ``/scripts/`` and only accepts absolute paths as-is. We MUST mirror that here so the guard scans the file that will actually run — otherwise a job whose script lives at the scheduler's real location (``~/.hermes/scripts/restart.sh``) but is passed as the bare name ``restart.sh`` would read as a nonexistent relative path and silently scan prompt-only content, letting the command through. r)Úget_hermes_homeÚscripts)Úhermes_constantsrrÚ expanduserÚ is_absolute)Ú script_pathrÚraws rÚ_resolve_script_pathrLs<€õ1ä ˆ{Ó × &Ñ &Ó (€CØ ‡Ô؈ Ù Ó ˜yÑ (¨3Ñ .Ð.r cóv— t|«j«jdd¬«S#t$rYywxYw)uRead a script file for lifecycle-pattern scanning. Decodes with ``errors="replace"`` so binary or non-UTF-8 content does not silently bypass the check — a plain text-mode read raises ``UnicodeDecodeError`` on such files, and swallowing that error would let an attacker hide the command in binary noise. Returns an empty string only when the file cannot be read at all. zutf-8Úreplace)ÚerrorsÚ)rÚ read_bytesÚdecodeÚOSError)rs rÚ_read_script_for_scanningr%_sG€ðÜ# KÓ0×;Ñ;Ó=×DÑDØ ˜IðEó ð øô òÙðús ‚),¬ 8·8cóh—|xsd}|rt|«}|r|›d|›}t|«r td«‚y)aERaise ``GatewayLifecycleBlocked`` if *prompt* or *script* contains a gateway-lifecycle command pattern. ``prompt`` is scanned directly. ``script``, when supplied, is read from disk and concatenated for the scan. Both are considered together so a job cannot slip through by splitting the command across the prompt and the script. Callers should let the exception propagate when they want the create to fail with a ``ValueError``-shaped error (the agent's ``cronjob`` tool surfaces this as a tool error; the CLI prints it in red and exits 1). r!ú aBlocked: cron job contains a gateway lifecycle command (restart/stop/kill). This is blocked to prevent agent-driven SIGTERM-respawn loops under launchd/systemd supervision (#30719). Run `hermes gateway restart` from a shell outside the running gateway instead.N)r%rr)ÚpromptÚscriptÚcombinedÚ script_texts rÚcheck_gateway_lifecycler,psL€ð Š|˜€HÙ Ü/°Ó7ˆ Ù Ø"˜ 2 k ]Ð3ˆHä)¨(Ô3Ü%ð +ó ð ð4r )rÚstrÚreturnr)rr-r.r)rr-r.r-)N)r(ú Optional[str]r)r/r.ÚNone)r Ú __future__rÚreÚpathlibrÚtypingrÚ ValueErrorrÚcompilerrrr%r,r r rúr7srðñõB#ã ÝÝôL˜jôLð(˜RŸZ™Zð4óÐó*9ó/ó&ð&!ð Ø ð à ð ð ô r