{"repo":"NousResearch/hermes-agent","public_id":"77927","display_label":"NUL-padded scripts bypassing lifecycle guard scan","summary":"A regression introduced a bypass where NUL-padded text scripts were incorrectly treated as binary and skipped by the lifecycle guard scan. Multiple fixes explore correcting the binary detection logic, such as checking magic bytes instead of bare NUL characters.","subsystem":"cron","counts":{"members":5,"open_issues":0,"open_issues_distinct":0,"open_prs":0,"closed_issues":1,"merged_prs":1,"attempt_prs":3},"landed_fix":{"status":"merged_to_main","basis":"structural","pr":93411},"resolution":{"state":"unresolved","by":null},"freshness":{"state":"verified","last_verified_at":"2026-08-24T01:24:37+00:00","is_stale":false},"grouping":{"backbone":"STRUCTURAL_SPANNING","link_density":0.4},"fix_edges":[{"issue_number":76762,"pr_number":93411,"tier":"verified","basis":"superseded_ref","confidence":0.9,"recoverable_from_timeline":false},{"issue_number":77925,"pr_number":93411,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true},{"issue_number":77927,"pr_number":93411,"tier":"verified","basis":"superseded_ref","confidence":0.9,"recoverable_from_timeline":false},{"issue_number":82887,"pr_number":93411,"tier":"verified","basis":"superseded_ref","confidence":0.9,"recoverable_from_timeline":false},{"issue_number":87280,"pr_number":93411,"tier":"verified","basis":"superseded_ref","confidence":0.9,"recoverable_from_timeline":false}],"members":[{"kind":"issue","number":77927,"title":"lifecycle_guard: NUL-padded text script bypasses the scan (regression from #76762 binary check)","url":null,"state":"closed"},{"kind":"pr","number":77928,"title":"fix(cron): close NUL-padded script bypass in lifecycle guard (#77927)","url":null,"state":"closed","close_reason":{"refs":[{"kind":"commit","value":"a9e46229b265","number":0},{"kind":"pr","value":"#93411","number":93411}],"category":"merged_via","implication":"superseded"},"merged":false},{"kind":"pr","number":78083,"title":"fix(cron): check binary magic bytes instead of bare NUL for lifecycle guard (#77927)","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#77928","number":77928}],"category":"duplicate_of","implication":"duplicate"},"merged":false},{"kind":"pr","number":82637,"title":"fix(lifecycle_guard): scan NUL-padded text scripts instead of treating NUL as binary signal (#77927)","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#93411","number":93411},{"kind":"pr","value":"#77928","number":77928},{"kind":"pr","value":"#77927","number":77927}],"category":"uncategorized","implication":"needs_llm"},"merged":false},{"kind":"pr","number":93411,"title":"fix: dot-sourced and NUL-padded scripts no longer bypass the gateway lifecycle guard (#77925 #77927, salvage #77926 #77928)","url":null,"state":"merged","close_reason":{"category":"merged","implication":"superseded"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["cron/lifecycle_guard.py","tests/hermes_cli/test_gateway_restart_loop.py"]}],"trust":{"default_tier":"verified","includes_suggested":false}}