fix(gateway,cron): prevent agent gateway-restart loops (salvage #30728) - #35679
Merged
Conversation
…eway commands (#30719) Three defenses against SIGTERM-respawn loops when agent schedules its own gateway restart under launchd/systemd KeepAlive: 1. HERMES_IN_GATEWAY env var: gateway sets it at startup; stop/restart subcommands refuse to run when set (exit 1 with clear message). 2. Cron create payload filter: regex pre-flight rejects prompts/scripts containing hermes gateway restart/stop, launchctl kickstart/unload, systemctl restart/stop, and pkill patterns. 3. 30 new tests: pattern matching (14), cron block (5), gateway guard (4), safe command negatives (7).
Contributor
🔎 Lint report:
|
| Rule | Count |
|---|---|
unresolved-import |
1 |
First entries
tests/hermes_cli/test_gateway_restart_loop.py:12: [unresolved-import] unresolved-import: Cannot resolve imported module `pytest`
✅ Fixed issues: none
Unchanged: 4945 pre-existing issues carried over.
Diagnostics are surfaced as warnings — this check never fails the build.
teknium1
force-pushed
the
hermes/hermes-e976ff2c
branch
from
May 31, 2026 04:06
b00becb to
014de2b
Compare
…n regex Follow-up to the salvaged #30728: - Gateway already exports _HERMES_GATEWAY=1 at startup (gateway/run.py) and cli.py already keys off it. Drop the redundant new HERMES_IN_GATEWAY var; guard stop/restart on _HERMES_GATEWAY instead. One marker for one fact. - Drop the greedy \bgateway.*restart alternation from the cron lifecycle filter — it false-positived on legit prompts that merely mention an unrelated gateway + a restart (API/payment gateway monitoring). The specific 'hermes gateway (restart|stop|start)' pattern already covers the real command. - Rework the two negative guard tests to sentinel the first downstream call so they don't drive real signal delivery (tripped the live-system guard). - Add false-positive regression cases to test_safe_commands.
teknium1
force-pushed
the
hermes/hermes-e976ff2c
branch
from
May 31, 2026 04:12
014de2b to
0a09ed3
Compare
alt-glitch
added
type/bug
Collaborator
This was referenced Jun 1, 2026
4 tasks
drzeast-png
pushed a commit
to drzeast-png/hermes-agent
that referenced
this pull request
Jun 4, 2026
…estarts Allow restart/stop from inside the gateway (e.g. via WeChat/Telegram) so the user can manage the gateway remotely. Trust launchd KeepAlive as the only respawn policy; the upstream blanket guard (NousResearch#35679) blocks legitimate manual restarts. Supersedes the still-open PR NousResearch#35815 (loop-detector variant).
drzeast-png
pushed a commit
to drzeast-png/hermes-agent
that referenced
this pull request
Jun 4, 2026
…estarts Allow restart/stop from inside the gateway (e.g. via WeChat/Telegram) so the user can manage the gateway remotely. Trust launchd KeepAlive as the only respawn policy; the upstream blanket guard (NousResearch#35679) blocks legitimate manual restarts. Supersedes the still-open PR NousResearch#35815 (loop-detector variant).
drzeast-png
pushed a commit
to drzeast-png/hermes-agent
that referenced
this pull request
Jun 5, 2026
…estarts Allow restart/stop from inside the gateway (e.g. via WeChat/Telegram) so the user can manage the gateway remotely. Trust launchd KeepAlive as the only respawn policy; the upstream blanket guard (NousResearch#35679) blocks legitimate manual restarts. Supersedes the still-open PR NousResearch#35815 (loop-detector variant).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Stops an agent from killing its own gateway in a SIGTERM-respawn loop. Two defenses:
hermes gateway stop/restartrefuse to run from inside the gateway process, andhermes cron createrejects prompts/scripts containing gateway-lifecycle commands.Salvages #30728 by @SimoKiihamaki (fixes #30719) onto current main, with two follow-up fixes.
Root cause
Agent schedules a cron job that restarts the gateway (
launchctl kickstart/hermes gateway restart) → gateway gets SIGTERM → launchd/systemdKeepAliverevives it → auto-resume re-runs the same session → loop every ~10s until manual kill. Real community incident (2026-05-22 and again 2026-05-25).Changes
hermes_cli/gateway.py— guardstop/restartsubcommands when running inside the gatewayhermes_cli/cron.py— regex pre-flight rejecting gateway-lifecycle commands in cron payloadsgateway/run.py— (contributor commit) original env marker; superseded belowtests/hermes_cli/test_gateway_restart_loop.py— 33 testsFollow-up fixes on top of the salvage
_HERMES_GATEWAY=1at startup (gateway/run.py:740) andcli.pyalready keys off it for the same "am I inside the gateway?" check. Dropped the redundant newHERMES_IN_GATEWAYvar; guards now use_HERMES_GATEWAY. One marker for one fact.\bgateway.*restartalternation — it false-positived on legitimate prompts that merely mention an unrelated gateway + a restart ("summarize the API gateway logs and report restart events", "check if the payment gateway needs a restart"). The specifichermes gateway (restart|stop|start)pattern already covers the real command.Validation
launchctl/systemctl/hermes gateway restartpayloads; allows legit gateway-mentioning promptshermes gateway stop/restartexit 1 with "Refusing…" when_HERMES_GATEWAY=1Not in scope
Issue #30719 also proposed a loop detector (#3) and "don't auto-resume turns whose last tool calls touched gateway/cron" (#4). #4 is the narrowest belt-and-suspenders net — worth a follow-up, not needed here once the known scheduling paths are blocked.
Original PR: #30728. Commit authorship preserved via rebase merge.
Infographic