fix(terminal): block launchctl submit inside gateway

[hermes-jeffrolc]

Summary

• block command-position launchctl submit invocations from local terminal calls running inside the Hermes gateway
• normalize common execution wrappers and the valid bash -c -- <payload> form before command detection
• keep the guard ahead of approval/force=True, so a submitted KeepAlive job cannot repeatedly restart its own gateway host
• preserve external-shell, non-local backend, neutral launchctl bootstrap/load, and existing lifecycle-command behavior

Why

launchctl submit jobs can outlive the terminal command and be relaunched by launchd. In #62891, a submitted helper repeatedly ran hermes gateway restart, causing 263 gateway restarts before the transient job was removed.

Label-only matching is not enough: a neutral label can execute the same payload. This patch blocks the unsafe submit primitive at the local gateway-hosted terminal boundary while leaving Hermes' supported internal restart path and normal external-shell administration untouched.

This is intentionally a foot-gun guard, not a general shell-security boundary. Indirect execution through arbitrary scripts/interpreters remains outside scope.

Closes #62891.

Test plan

• HERMES_HOME=<temp> python -m pytest -q tests/hermes_cli/test_gateway_restart_loop.py tests/tools/test_terminal_tool.py tests/tools/test_terminal_tool_requirements.py tests/tools/test_terminal_tool_pty_fallback.py tests/cron — 493 passed
• python -m ruff check cron/lifecycle_guard.py tools/terminal_tool.py tests/hermes_cli/test_gateway_restart_loop.py
• git diff --check

[teknium1]

Thanks for narrowing this to the local in-gateway terminal boundary. The premise is current: tools/terminal_tool.py:2441-2455 only checks the lifecycle matcher, and cron/lifecycle_guard.py:55-65 does not include launchctl submit; the new guard at tools/terminal_tool.py:2457 covers that direct bypass before approval/force.

Problems

• tests/hermes_cli/test_gateway_restart_loop.py:266 will fail: it looks for lowercase gateway would kill this command, but the existing error at tools/terminal_tool.py:2449 contains The gateway would kill this command with uppercase T.

Suggested changes

• Normalize the asserted error with .lower() or use the emitted capitalization, then rerun the focused restart-loop test file.

Automated hermes-sweeper review.

[teknium1]

This assertion is case-sensitive, but the established terminal error says The gateway would kill this command (tools/terminal_tool.py:2449). Assert against result["error"].lower() or use the emitted capitalization; otherwise every case in this parametrized test fails.

[joelbrilliant]

The direct-submit guard is worth landing, but Closes #62891 is too strong at the current scope.

The second production occurrence documented on the issue used a neutral launchd registration with StartInterval 15, and this PR explicitly preserves neutral bootstrap and load. It also leaves outer-script indirection out of scope. That means the same failure family still has a verified path even if command-position launchctl submit is blocked.

I’d change this to Related to #62891, land the narrow local-terminal guard once the review test is corrected, and keep #62891 open with the remaining bootstrap and script path tracked. If broader closure is the goal, #63272’s execution-aware work is the relevant salvage source, but I’d split and re-review that rather than pull it in wholesale.

[GottZ]

This was generated by AI during triage.

Summary

Nine PRs address or reference the gateway self-lifecycle failure family. #51003, #62896, #63272, #75557, and #75972 target launchd registration or script indirection; #20489, #56517, #57305, and #58289 cover adjacent uninstall, path-expansion, raw-PID, and systemd recovery gaps rather than the reported neutral-label persistent-job cause.

Related pull requests

• fix(gateway): block uninstall from gateway child #20489 related — (+32/-8) — keep open with a salvage path: the diff adds the still-distinct in-gateway uninstall guard and launchctl bootout coverage, not the persistent submit/bootstrap bypass in macOS gateway lifecycle guard can be bypassed via launchctl submit, creating an infinite restart loop #62891. This follows the keep_open review by retaining the requested narrow uninstall scope.
• fix(gateway): block launchd restart helper loops #51003 [closed] partial — (+21/-0) — close as duplicate of fix(guard): block launchctl submit/bootstrap and wrapped-script gateway restarts #75972: the diff adds label-anchored submit/bootstrap and primary-label bootout matching, but neutral labels remain outside its coverage. Despite the earlier keep_open review, fix(guard): block launchctl submit/bootstrap and wrapped-script gateway restarts #75972 subsequently incorporated the submit/bootstrap work with credit and added label-independent and referenced-script detection.
• fix(cron): catch RuntimeError from Path.expanduser() in lifecycle guard #56517 related — (+26/-1) — keep open with a salvage path: catching RuntimeError from Path.expanduser() prevents lifecycle-guard creation crashes, but it does not address the restart-loop cause. The keep_open review identifies the concrete remaining salvage work: handle the same unknown-user path at cron/scheduler.py:2050 and add creation- and runtime-level regressions.
• fix(terminal): block raw-PID kills of the gateway's own process #57305 related — (+177/-5) — author action: rebase onto main, or split out the part that can merge: literal raw-PID self-kill detection is a separate bypass from launchd persistence. The MAINTAINER-BOT keep_open verdict remains controlling because the diff applies the local PID to SSH execution and misclassifies pkill -P; salvage the local-backend kill operand check with SSH pass-through coverage.
• feat: allow gateway restart via systemd-run escape hatch #58289 related — (+57/-2) — keep open with a salvage path: the diff proposes a systemd-run recovery wrapper rather than blocking the macOS launchd loop, and its global exemption can also allow an unwrapped lifecycle command after a separator. The keep_open review requires command-structure validation and environment-specific handling before this recovery path is viable.
• fix(gateway): block launchctl submit in the gateway lifecycle guard #62896 [closed] duplicate — (+51/-2) — close as duplicate of fix(guard): block launchctl submit/bootstrap and wrapped-script gateway restarts #75972: this diff adds launchctl submit plus shell-continuation normalization for the exact multiline report, but remains label-anchored. Despite the earlier keep_open review, fix(guard): block launchctl submit/bootstrap and wrapped-script gateway restarts #75972 incorporated that normalization with credit and extended the fix to neutral labels, bootstrap, and referenced scripts.
• fix: block persistent gateway self-restart jobs #63272 [closed] duplicate — (+625/-47) — close as duplicate of fix(guard): block launchctl submit/bootstrap and wrapped-script gateway restarts #75972: its bounded recursive script scanner, remote reads, live-session cwd handling, and label-independent persistent-job detection directly address the indirection behind macOS gateway lifecycle guard can be bypassed via launchctl submit, creating an infinite restart loop #62891. Despite the MAINTAINER-BOT keep_open verdict on the earlier head, the documented follow-up resolved its three blockers, and those commits were then incorporated into merged fix(guard): block launchctl submit/bootstrap and wrapped-script gateway restarts #75972 with authorship preserved.
• fix(terminal): block launchctl submit inside gateway #75557 partial — (+475/-4) — close as duplicate of fix(guard): block launchctl submit/bootstrap and wrapped-script gateway restarts #75972: the diff blocks command-position launchctl submit locally, but explicitly permits neutral bootstrap/load and excludes arbitrary script indirection, so it does not close the verified failure family. Despite the keep_open review on fix(terminal): block launchctl submit inside gateway #75557, its narrow guard is superseded by fix(guard): block launchctl submit/bootstrap and wrapped-script gateway restarts #75972, whose diff covers label-independent submit and bootstrap plus nested referenced scripts; the review’s test-assertion defect also remains visible in this diff.
• fix(guard): block launchctl submit/bootstrap and wrapped-script gateway restarts #75972 [merged] duplicate — (+777/-49) — merged reference implementation: the diff combines shell-continuation normalization, label-independent launchctl submit/bootstrap detection, and bounded recursive scanning of local and remote referenced scripts at both terminal and cron enforcement points. It therefore covers the direct, neutral-label, and helper-script variants documented for macOS gateway lifecycle guard can be bypassed via launchctl submit, creating an infinite restart loop #62891.

Duplicates

#51003, #62896, #63272, and #75557 substantially overlap on blocking launchd-mediated gateway restart jobs and are superseded by #75972; #62896 supplies continuation normalization, #51003 supplies submit/bootstrap coverage, #63272 supplies the execution-aware recursive scanner, and #75557 supplies a narrower direct-submit guard. #20489, #56517, #57305, and #58289 are adjacent but not duplicates of that fix.

Suggested consolidation

Close #75557 as duplicate of #75972, with the chain #75557 → #75972; likewise close #51003, #62896, and #63272 as duplicates or incorporated predecessors of #75972. This departs from the visible keep_open review on #75557 because the later merged #75972 diff covers the exact direct-submit scope and additionally closes the documented neutral-label bootstrap and referenced-script paths that #75557 leaves open. Keep #20489, #56517, #57305, and #58289 separate for their explicitly identified salvage work rather than treating them as fixes for #62891.

Complex graph

flowchart TD
    classDef open fill:#dbeafe,stroke:#1d4ed8,color:#1e3a8a
    classDef merged fill:#dcfce7,stroke:#15803d,color:#14532d
    classDef closed fill:#e5e7eb,stroke:#6b7280,color:#1f2937
    classDef unverified fill:#f3f4f6,stroke:#9ca3af,color:#374151
    classDef best stroke-width:3px,stroke:#b45309
    classDef target stroke-width:3px,stroke:#4338ca
    I62891(["issue #62891 (closed)"])
    subgraph Dup51003 ["PRs duplicating each other"]
        P51003["PR #51003 (closed)"]
        P62896["PR #62896 (closed)"]
        P63272["PR #63272 (closed)"]
        P75557["PR #75557 (open)"]
        P75972["PR #75972 (merged)"]
    end
    P75557 -.->|partial| I62891
    class I62891 closed
    class P51003 closed
    class P62896 closed
    class P63272 closed
    class P75557 open
    class P75972 merged
    class P62896 best
    class P63272 best
    class P75972 best
    class P75557 target
    click I62891 "https://github.com/NousResearch/hermes-agent/issues/62891"
    click P51003 "https://github.com/NousResearch/hermes-agent/pull/51003"
    click P62896 "https://github.com/NousResearch/hermes-agent/pull/62896"
    click P63272 "https://github.com/NousResearch/hermes-agent/pull/63272"
    click P75557 "https://github.com/NousResearch/hermes-agent/pull/75557"
    click P75972 "https://github.com/NousResearch/hermes-agent/pull/75972"

Loading

Graph: solid arrow = fixes / best fix, dashed arrow = partial or unverified (see edge label); boxed group = PRs duplicating each other; amber border = best fix; indigo border = target; gray node = closed (state tag in the node label).

Cross-PR triage: Reviewed 9 pull requests and 1 issue in this complex. Each diff was read against this issue; Assessment working set: 130 kB of PR diffs, 22 kB of issue/PR text, 18 kB of discussion (19 comments), 10 verify verdicts. verdicts reflect diff content, not PR titles. Part of an automated triage batch.