fix(gateway): block launchctl submit in the gateway lifecycle guard

[jackjin1997]

What does this PR do?

_GATEWAY_LIFECYCLE_PATTERN's launchctl branch (Branch B in cron/lifecycle_guard.py) only matched the verbs kickstart|unload|load|stop|restart. As reported in #62891, an agent whose direct gateway restart/kill was correctly blocked by the guard instead laundered the same effect through:

launchctl submit -l ai.hermes.gateway-hard-restart-no-photon-notice -- /bin/sh <helper-script>

launchctl submit creates a new launchd keepalive job wrapping an arbitrary helper script — a different verb shape than the existing service ops the pattern already caught, so it slipped through both enforcement points that share this function (cron.jobs.create_job at job-creation time, and tools/terminal_tool.py's execution-time hard-block). The helper script killed the real gateway and re-triggered it every ~20s via launchctl kickstart -k, running 9,447 times before manual removal.

Related Issue

Fixes #62891

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)

Changes Made

• cron/lifecycle_guard.py: add submit to Branch B's verb alternation, with a comment explaining the indirection this closes.
• tests/hermes_cli/test_gateway_restart_loop.py: added the exact reproduction command from the issue plus a second launchctl submit variant as positive matches, and a launchctl submit on an unrelated label as a negative (no-false-positive) case.

Scope note

The issue's "Suggested fixes" section lists five items; this PR addresses #1 (the concrete pattern gap that caused the actual incident) and its accompanying regression test (#5). Items #2 (treating any post-rejection workaround as the same prohibited effect — needs session-level intent tracking, not just pattern matching), #3 (a supported one-shot detached restart helper — a new tool surface), and #4 (enumerating submitted launchd jobs in restart-loop diagnostics) are broader hardening/feature work that I think deserves separate design discussion rather than being bundled into a reactive pattern fix — flagging them here in case a maintainer wants to track them as follow-ups.

How to Test

1. Before this fix: _contains_gateway_lifecycle_command("launchctl submit -l ai.hermes.gateway-x -- /bin/sh helper.sh") returns False — the exact command from the issue is not caught.
2. After this fix: it returns True, and the same protection applies at both the cron-job-creation guard and the terminal execution-time guard (both call this shared function).
3. pytest tests/hermes_cli/test_gateway_restart_loop.py -q — 66 passed (2 pre-existing failures unrelated to this change: this sandbox's venv has no pip/croniter installed, confirmed identical on a clean origin/main checkout via git stash).

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits
• I searched for existing PRs (by issue number and by file/mechanism — _GATEWAY_LIFECYCLE_PATTERN, launchctl submit, related Cron tool can schedule gateway lifecycle scripts that cause restart loops #51976/fix(cron): apply gateway lifecycle block to cronjob tool prompt and script scan #36194/fix(cron): block gateway lifecycle commands on job update #51980) to make sure this isn't a duplicate
• My PR contains only changes related to this fix (no unrelated commits)
• I've run pytest tests/hermes_cli/test_gateway_restart_loop.py -q — 66/66 relevant tests pass (2 pre-existing environment-only failures noted above)
• I've added tests for my changes
• I've tested on my platform: macOS 15 (Darwin)

Documentation & Housekeeping

• N/A — no docs, config keys, or tool schemas changed

AI Disclosure

This bug was identified and fixed with AI assistance.

[teknium1]

Thanks for closing the real launchctl submit omission: current main's Branch B at cron/lifecycle_guard.py:59 does not include that verb.

Problems

• The changed regex at cron/lifecycle_guard.py:64 still uses [^\n]* between the verb and gateway label. The actual #62891 command puts a shell-continuation newline after launchctl submit, so this pattern stops before -l ai.hermes.gateway-… and does not block the reported form.

Suggested changes

• Normalize shell continuations before matching, or permit continuation-newline segments in Branch B without relaxing the gateway-label constraint.
• Add the literal multiline #62891 command to tests/hermes_cli/test_gateway_restart_loop.py, including the terminal guard path described in the PR.

Automated hermes-sweeper review.

[teknium1]

[^\n]* still prevents this branch from reaching a -l ai.hermes.gateway-… label when launchctl submit is written with the backslash-newline continuation shown in #62891. Please normalize or explicitly handle shell continuations and add that literal reproduction.

[jackjin1997]

Good catch — the exact reported command was split across backslash-newline shell continuations, so [^\n]* never bridged the verb to the gateway label. Pushed a follow-up commit that normalizes continuations (\ immediately followed by a newline) to a single space before matching, mirroring what the shell itself does, rather than loosening [^\n]* globally. Added the literal multi-line command from the issue as a test case, plus a negative test confirming two genuinely separate (non-continued) lines still don't get bridged. Verified the new test fails without the normalization.

[teknium1]

Fixed via PR #75972 (#75972) — your shell line-continuation normalization was incorporated with Co-authored-by credit in the consolidation commit, alongside #63272's script scanner and the submit/bootstrap regex extension. Fixes #62891. Thanks!