(GjdZddlmZddlZddlmZddlmZGddeZ ej dZ dd Z ddZ ddZ dddZdS)uGateway lifecycle guard for cron job creation (#30719). An agent running inside a gateway can schedule a cron job that calls ``hermes gateway restart`` (or ``launchctl kickstart ai.hermes.gateway`` or ``systemctl restart hermes-gateway``). When the cron fires, the gateway dies, the supervisor (launchd KeepAlive / systemd Restart=) revives it, auto-resume picks up the offending session, and the resumed turn re-runs the same logic — a SIGTERM-respawn loop every ~10 seconds until manually broken. This module rejects cron job specs whose prompt or script contains a direct shell-level gateway-lifecycle command. It is enforced at ``cron.jobs.create_job`` so it fires on every job-creation path: the ``hermes cron create`` CLI subcommand AND the agent's ``cronjob`` model tool (which calls ``create_job`` directly, bypassing the CLI layer). The pattern is intentionally command-shaped: it anchors on a concrete command identifier (``hermes gateway``, ``launchctl ... hermes-gateway``, ``systemctl ... hermes-gateway``, ``pkill`` against the gateway) so it cannot fire on prose. A cron ``prompt`` is fed to a future LLM, not a shell, so an over-broad substring match on English ("Kong API gateway autoscaling and restart behavior") would produce a high false-positive rate without preventing the actual foot-gun, which requires a real command shape. This is a defence-in-depth layer. ``tools/terminal_tool.py`` already blocks these commands at *execution* time when ``_HERMES_GATEWAY=1``, and ``hermes gateway stop|restart`` refuse to self-target from inside the gateway. Blocking at *creation* time as well means the agent gets an immediate, informative rejection instead of scheduling a job that will only fail (silently) when it fires. ) annotationsN)Path)OptionalceZdZdZdS)GatewayLifecycleBlockedzARaised when a cron job spec contains a gateway-lifecycle command.N)__name__ __module__ __qualname____doc__:/home/rurouni/.hermes/hermes-agent/cron/lifecycle_guard.pyrr)sKKKKr ra'(?i)(?:hermes\s+gateway\s+(?:restart|stop))|(?:launchctl\s+(?:kickstart|unload|load|stop|restart)\b[^\n]*\bhermes[.\-]?gateway)|(?:systemctl\s+(?:-\S+\s+)*(?:restart|stop|start)\b[^\n]*\bhermes[.\-]?gateway)|(?:p?kill\b[^\n]*\bhermes\b[^\n]*\bgateway)|(?:p?kill\b[^\n]*\bgateway\b[^\n]*\bhermes)textstrreturnboolcX|sdStt|S)zCReturn True if *text* contains a gateway lifecycle command pattern.F)r_GATEWAY_LIFECYCLE_PATTERNsearch)rs r"contains_gateway_lifecycle_commandrEs, u *11$77 8 88r script_pathrcddlm}t|}|r|S|dz |z S)uEResolve a cron ``script`` value the same way the scheduler does. The scheduler (``cron.scheduler``) resolves a bare/relative script path under ``/scripts/`` and only accepts absolute paths as-is. We MUST mirror that here so the guard scans the file that will actually run — otherwise a job whose script lives at the scheduler's real location (``~/.hermes/scripts/restart.sh``) but is passed as the bare name ``restart.sh`` would read as a nonexistent relative path and silently scan prompt-only content, letting the command through. r)get_hermes_homescripts)hermes_constantsrr expanduser is_absolute)rrraws r_resolve_script_pathrLs^100000 {   & & ( (C  ?  y (3 ..r c t|ddS#t$rYdSwxYw)uRead a script file for lifecycle-pattern scanning. Decodes with ``errors="replace"`` so binary or non-UTF-8 content does not silently bypass the check — a plain text-mode read raises ``UnicodeDecodeError`` on such files, and swallowing that error would let an attacker hide the command in binary noise. Returns an empty string only when the file cannot be read at all. zutf-8replace)errors)r read_bytesdecodeOSError)rs r_read_script_for_scanningr'_sb#K00;;==DD IE    rrs58 AAprompt Optional[str]scriptNonec~|pd}|rt|}|r|d|}t|rtddS)aERaise ``GatewayLifecycleBlocked`` if *prompt* or *script* contains a gateway-lifecycle command pattern. ``prompt`` is scanned directly. ``script``, when supplied, is read from disk and concatenated for the scan. Both are considered together so a job cannot slip through by splitting the command across the prompt and the script. Callers should let the exception propagate when they want the create to fail with a ``ValueError``-shaped error (the agent's ``cronjob`` tool surfaces this as a tool error; the CLI prints it in red and exits 1). r# aBlocked: cron job contains a gateway lifecycle command (restart/stop/kill). This is blocked to prevent agent-driven SIGTERM-respawn loops under launchd/systemd supervision (#30719). Run `hermes gateway restart` from a shell outside the running gateway instead.N)r'rr)r(r*combined script_texts rcheck_gateway_lifecycler0psn |H 4/77  4"33k33H)(33 % +     r )rrrr)rrrr)rrrr)N)r(r)r*r)rr+)r __future__rrepathlibrtypingr ValueErrorrcompilerrrr'r0r r rr7sB#""""" LLLLLjLLL(RZ4*9999////&&!       r