Skip to content

feat(webapi): add /api/jobs endpoint to expose cron jobs to UI#2111

Closed
nock4 wants to merge 9 commits into
NousResearch:mainfrom
nock4:main
Closed

feat(webapi): add /api/jobs endpoint to expose cron jobs to UI#2111
nock4 wants to merge 9 commits into
NousResearch:mainfrom
nock4:main

Conversation

@nock4

@nock4 nock4 commented Mar 20, 2026

Copy link
Copy Markdown

Summary

Adds a new /api/jobs endpoint to the Hermes WebAPI that exposes cron job management capabilities to the Workspace UI.

Changes

  • New endpoint: GET /api/jobs - Lists all cron jobs (with optional include_disabled)
  • Create: POST /api/jobs - Create new cron jobs with full validation
  • Read: GET /api/jobs/{id} - Fetch single job
  • Update: PATCH /api/jobs/{id} - Partial updates (schedule, name, prompt, etc.)
  • Delete: DELETE /api/jobs/{id} - Remove a job
  • Actions:
    • POST /api/jobs/{id}/pause - Pause a job
    • POST /api/jobs/{id}/resume - Resume a paused job
    • POST /api/jobs/{id}/run - Trigger immediate execution
    • GET /api/jobs/{id}/output - Retrieve recent output logs (with path traversal protection)

Security Hardening

  • Job ID format validation (12 hex chars)
  • Path traversal protection for output logs (resolve + containment check)
  • Input validation: schedule format, deliver targets, length limits
  • Optional prompt threat scanning via _scan_cron_prompt (if available)
  • Delivery target whitelist: local, origin, telegram, discord, slack

Motivation & Context

The Hermes Workspace Jobs tab previously only showed skill-based jobs. This change unifies the view, allowing both skill jobs and system cron jobs to be managed from one place.

Testing

  • Verified endpoint returns existing cron jobs (17 total)
  • Confirmed path traversal attempts are blocked
  • Tested invalid schedule/deliver rejection
  • Checked prompt injection detection works

Checklist

  • Code follows project style
  • Self-reviewed
  • Tested locally
  • Documentation not needed (API is internal)
  • No breaking changes

Closes #XXXX (if applicable)

Aurora and others added 9 commits March 20, 2026 00:55
…ex auth auto-sync

- Add webapi to setuptools packages.find + hermes-webapi CLI entry point
- Add fastapi/uvicorn to core dependencies
- Auto-detect port (8642 → 8643 fallback) when gateway occupies 8642
- Auto-sync Codex credentials from ~/.codex/auth.json when newer than Hermes store
- Add new router at /api/jobs with full CRUD operations
- Transform cron job format for workspace compatibility
- Include security hardening:
  * Job ID format validation (12 hex chars)
  * Path traversal protection for output logs
  * Input validation (schedule, deliver, lengths)
  * Optional prompt threat scanning via _scan_cron_prompt
- Implement action endpoints: pause, resume, run, output
- Register router in webapi/app.py

This allows the Hermes Workspace Jobs tab to display and manage
both skill-based jobs and system cron jobs in a unified view.

Closes #<issue-number-if-any>
teknium1 added a commit that referenced this pull request Mar 22, 2026
CRUD + actions for cron jobs on the existing API server (port 8642):
  GET    /api/jobs              — list jobs
  POST   /api/jobs              — create job
  GET    /api/jobs/{id}         — get job
  PATCH  /api/jobs/{id}         — update job
  DELETE /api/jobs/{id}         — delete job
  POST   /api/jobs/{id}/pause   — pause job
  POST   /api/jobs/{id}/resume  — resume job
  POST   /api/jobs/{id}/run     — trigger immediate run

All endpoints use existing API_SERVER_KEY auth. Job ID format
validated (12 hex chars). Logic ported from PR #2111 by nock4,
adapted from FastAPI to aiohttp on the existing API server.
@teknium1

Copy link
Copy Markdown
Contributor

The jobs CRUD logic was ported to our existing aiohttp API server in PR #2450 (179 lines vs the full 1974-line FastAPI server). Same endpoints, same validation, no new dependencies. Thanks for the well-structured route logic!

@teknium1 teknium1 closed this Mar 22, 2026
outsourc-e pushed a commit to outsourc-e/hermes-agent that referenced this pull request Mar 26, 2026
CRUD + actions for cron jobs on the existing API server (port 8642):
  GET    /api/jobs              — list jobs
  POST   /api/jobs              — create job
  GET    /api/jobs/{id}         — get job
  PATCH  /api/jobs/{id}         — update job
  DELETE /api/jobs/{id}         — delete job
  POST   /api/jobs/{id}/pause   — pause job
  POST   /api/jobs/{id}/resume  — resume job
  POST   /api/jobs/{id}/run     — trigger immediate run

All endpoints use existing API_SERVER_KEY auth. Job ID format
validated (12 hex chars). Logic ported from PR NousResearch#2111 by nock4,
adapted from FastAPI to aiohttp on the existing API server.
angelburgosrosado pushed a commit to angelburgosrosado/hermes-agent that referenced this pull request Apr 27, 2026
CRUD + actions for cron jobs on the existing API server (port 8642):
  GET    /api/jobs              — list jobs
  POST   /api/jobs              — create job
  GET    /api/jobs/{id}         — get job
  PATCH  /api/jobs/{id}         — update job
  DELETE /api/jobs/{id}         — delete job
  POST   /api/jobs/{id}/pause   — pause job
  POST   /api/jobs/{id}/resume  — resume job
  POST   /api/jobs/{id}/run     — trigger immediate run

All endpoints use existing API_SERVER_KEY auth. Job ID format
validated (12 hex chars). Logic ported from PR NousResearch#2111 by nock4,
adapted from FastAPI to aiohttp on the existing API server.
02356abc pushed a commit to 02356abc/hermes-agent that referenced this pull request May 14, 2026
CRUD + actions for cron jobs on the existing API server (port 8642):
  GET    /api/jobs              — list jobs
  POST   /api/jobs              — create job
  GET    /api/jobs/{id}         — get job
  PATCH  /api/jobs/{id}         — update job
  DELETE /api/jobs/{id}         — delete job
  POST   /api/jobs/{id}/pause   — pause job
  POST   /api/jobs/{id}/resume  — resume job
  POST   /api/jobs/{id}/run     — trigger immediate run

All endpoints use existing API_SERVER_KEY auth. Job ID format
validated (12 hex chars). Logic ported from PR NousResearch#2111 by nock4,
adapted from FastAPI to aiohttp on the existing API server.
olympus-terminal pushed a commit to olympus-terminal/hermes-agent that referenced this pull request May 16, 2026
CRUD + actions for cron jobs on the existing API server (port 8642):
  GET    /api/jobs              — list jobs
  POST   /api/jobs              — create job
  GET    /api/jobs/{id}         — get job
  PATCH  /api/jobs/{id}         — update job
  DELETE /api/jobs/{id}         — delete job
  POST   /api/jobs/{id}/pause   — pause job
  POST   /api/jobs/{id}/resume  — resume job
  POST   /api/jobs/{id}/run     — trigger immediate run

All endpoints use existing API_SERVER_KEY auth. Job ID format
validated (12 hex chars). Logic ported from PR NousResearch#2111 by nock4,
adapted from FastAPI to aiohttp on the existing API server.
gweeteve pushed a commit to gweeteve/hermes-agent that referenced this pull request Jun 2, 2026
CRUD + actions for cron jobs on the existing API server (port 8642):
  GET    /api/jobs              — list jobs
  POST   /api/jobs              — create job
  GET    /api/jobs/{id}         — get job
  PATCH  /api/jobs/{id}         — update job
  DELETE /api/jobs/{id}         — delete job
  POST   /api/jobs/{id}/pause   — pause job
  POST   /api/jobs/{id}/resume  — resume job
  POST   /api/jobs/{id}/run     — trigger immediate run

All endpoints use existing API_SERVER_KEY auth. Job ID format
validated (12 hex chars). Logic ported from PR NousResearch#2111 by nock4,
adapted from FastAPI to aiohttp on the existing API server.
Egavasyug pushed a commit to Egavasyug/hermes-agent that referenced this pull request Jun 10, 2026
CRUD + actions for cron jobs on the existing API server (port 8642):
  GET    /api/jobs              — list jobs
  POST   /api/jobs              — create job
  GET    /api/jobs/{id}         — get job
  PATCH  /api/jobs/{id}         — update job
  DELETE /api/jobs/{id}         — delete job
  POST   /api/jobs/{id}/pause   — pause job
  POST   /api/jobs/{id}/resume  — resume job
  POST   /api/jobs/{id}/run     — trigger immediate run

All endpoints use existing API_SERVER_KEY auth. Job ID format
validated (12 hex chars). Logic ported from PR NousResearch#2111 by nock4,
adapted from FastAPI to aiohttp on the existing API server.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants