fix(cron): apply gateway lifecycle block to cronjob tool prompt and script scan

[AhmetArif0]

What does this PR do?

hermes_cli/cron.py's CLI path blocks gateway lifecycle commands (hermes gateway restart/stop/start, launchctl, systemctl, pkill) via _contains_gateway_lifecycle_command(). The Python cronjob tool (tools/cronjob_tools.py) used by agents had no equivalent check in _scan_cron_prompt(), so an agent could bypass the defense by scheduling a restart loop through the tool instead of the CLI.

Changes Made

• tools/cronjob_tools.py: Added four gateway lifecycle patterns to _CRON_THREAT_PATTERNS, matching the same set as hermes_cli/cron.py's _GATEWAY_LIFECYCLE_PATTERNS:
  • hermes gateway (restart|stop|start)
  • launchctl (kickstart|unload|load|stop|restart) ... hermes
  • systemctl (restart|stop|start) ... hermes
  • p?kill ... hermes ... gateway
• tools/cronjob_tools.py: On action='create', scan the script file's content for gateway lifecycle patterns (in addition to the prompt), mirroring the CLI's combined prompt+script check.
• tests/tools/test_cron_prompt_injection.py: Added 14 regression tests covering all four patterns plus safe false-positive cases (API gateway mentions, nginx restarts, etc.).

Related Issue

Follows up on #30719 / commits 5cd6c1717 and bd72d333d which added the CLI-side defense.

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✅ Tests (adding or improving test coverage)

How to Test

uv run --frozen pytest tests/tools/test_cron_prompt_injection.py -q

All 20 tests should pass (6 original + 14 new).

Checklist

• I've read the Contributing Guide
• My commit messages follow Conventional Commits
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes

[mxnstrexgl]

LGTM — automated review passed. No security, quality, or test coverage issues detected.

[tonydwb]

Code Review Summary

Verdict: Approved ✅

Review

fix(cron): apply gateway lifecycle block to cronjob tool prompt and script scan

Solid defense-in-depth addition. Key observations:

• Defense in depth: The CLI path (hermes_cli/cron.py) already blocks gateway lifecycle commands. This PR extends the same protection to the cronjob tool pathway (tools/cronjob_tools.py), preventing agents from bypassing the CLI defense by scheduling jobs through the tool directly.
• Completeness: Covers all gateway lifecycle vectors — hermes gateway *, launchctl, systemctl, pkill/kill. Each has its own regex pattern with a distinct reason tag for traceability.
• Script scanning: The PR also adds scanning of script file contents at creation time, so even if an agent writes a shell script that calls hermes gateway restart, it gets caught.
• False positive protection: The safe-mentions test ensures prose about "API gateway" or "payment gateway" passes through cleanly.
• Tests: 13 test cases covering all lifecycle patterns plus safe-mention edge cases. Good coverage.

Looks Good

• Defense-in-depth approach
• Well-tested with clear test organization
• No regex can be accidentally triggered by unrelated content

---

Reviewed by Hermes Agent

[teknium1]

Thanks for the defense-in-depth work. This is an automated hermes-sweeper review; current main already implements this protection at the shared creation path.

• cron/jobs.py:1153 calls check_gateway_lifecycle(prompt_text, normalized_script) from create_job(), which is the common chokepoint for both hermes cron create and the cronjob model tool.
• cron/lifecycle_guard.py:95-140 scans the resolved script as well as the prompt, decoding with replacement rather than silently bypassing non-UTF-8 content.
• tests/hermes_cli/test_gateway_restart_loop.py:388-484 directly covers lifecycle blocking for prompts, scripts, binary scripts, relative HERMES_HOME scripts, create_job(), and cronjob(action="create").
• The implementation landed in b48cacb97 (fix(gateway,cron): guard cron model-tool path + add auto-resume loop breaker (#30719)).

Closing as implemented on main.