Skip to content

fix(cron): do not treat delivery origin as live gateway sender identity#22356

Closed
oferlaor wants to merge 1 commit into
NousResearch:mainfrom
oferlaor:ofer/fix-cron-origin-access-control
Closed

fix(cron): do not treat delivery origin as live gateway sender identity#22356
oferlaor wants to merge 1 commit into
NousResearch:mainfrom
oferlaor:ofer/fix-cron-origin-access-control

Conversation

@oferlaor

@oferlaor oferlaor commented May 9, 2026

Copy link
Copy Markdown

Title: fix(cron): do not treat delivery origin as live gateway sender identity

Summary

  • stop seeding cron execution session identity from stored delivery origin
  • keep delivery routing via HERMES_CRON_AUTO_DELIVER_*
  • prevent access-control from stripping configured cron job toolsets based on a delivery chat/group

Why

Cron origin is routing metadata. Treating it as the live gateway sender can remove web/file/terminal tool schemas from authorized scheduled jobs.

Tests

  • python -m pytest tests/cron tests/tools/test_cronjob_tools.py -q -o 'addopts='

Closes #22351

@alt-glitch alt-glitch added type/bug Something isn't working P2 Medium — degraded but workaround exists comp/cron Cron scheduler and job management labels May 9, 2026
@kshitijk4poor

Copy link
Copy Markdown
Collaborator

Salvaged via #22382 (now merged) and rebased onto current main with your authorship preserved — your commit landed as dbafa083b in the git history. Thanks @oferlaor!

A few notes for context: the salvage PR ended up rewriting the rationale around the consumers of HERMES_SESSION_* that actually drive this bug on current main (background-process notification routing in tools/terminal_tool.py, TTS format selection, per-platform skill caching, _check_send_message gating), rather than the access-control framing in your PR description — there is no per-identity toolset filter on main today (enabled_toolsets are passed straight to AIAgent), so the web/file/terminal strip you described isn't reproducible. That said, the mechanical fix is the right one for the consumer-routing reasons, and we landed it. Closes #22351.

JZKK720 pushed a commit to JZKK720/hermes-agent that referenced this pull request May 11, 2026
rmulligan pushed a commit to rmulligan/hermes-agent that referenced this pull request May 11, 2026
JinyuID pushed a commit to JinyuID/hermes-agent that referenced this pull request May 11, 2026
jsboige pushed a commit to jsboige/hermes-agent that referenced this pull request May 14, 2026
Egavasyug pushed a commit to Egavasyug/hermes-agent that referenced this pull request May 25, 2026
gweeteve pushed a commit to gweeteve/hermes-agent that referenced this pull request Jun 2, 2026
Egavasyug pushed a commit to Egavasyug/hermes-agent that referenced this pull request Jun 10, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

comp/cron Cron scheduler and job management P2 Medium — degraded but workaround exists type/bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Cron delivery origin should not seed live gateway sender identity for tool access-control

3 participants