{"record":{"id":"0ac78a15d7cc1de3","repo":"NousResearch/hermes-agent","slug":"could-not-repair-the-desktop-installation-id","errorCode":null,"errorMessage":"Could not repair the desktop installation ID.","messagePattern":"Could not repair the desktop installation ID\\.","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"apps/desktop/electron/desktop-installation.ts","lineNumber":122,"sourceCode":"      }\n\n      fs.writeFileSync(filePath, JSON.stringify({ installationId }), { encoding: 'utf8', flag: 'wx', mode: 0o600 })\n\n      return installationId\n    } finally {\n      if (repairFd !== undefined) {\n        fs.closeSync(repairFd)\n      }\n\n      try {\n        fs.unlinkSync(repairPath)\n      } catch {\n        void 0\n      }\n    }\n  }\n\n  throw new Error('Could not repair the desktop installation ID.')\n}\n\nfunction sshOwnershipId(installationId, scope) {\n  if (!INSTALLATION_ID_RE.test(String(installationId || ''))) {\n    throw new Error('Desktop installation ID is invalid.')\n  }\n\n  return crypto\n    .createHash('sha256')\n    .update(`${installationId}\\0${String(scope || '')}`)\n    .digest('hex')\n    .slice(0, 32)\n}\n\nexport { INSTALLATION_ID_RE, loadOrCreateInstallationId, parseInstallationId, readInstallationId, sshOwnershipId }\n","sourceCodeStart":104,"sourceCodeEnd":138,"githubUrl":"https://github.com/NousResearch/hermes-agent/blob/c896c09c42910c584c4c7d2325b58c14713ea42c/apps/desktop/electron/desktop-installation.ts#L104-L138","documentation":"GatewayLifecycleBlocked from cron/lifecycle_guard.py:708: the job's prompt and/or script (including referenced script files) contains a gateway lifecycle command (e.g. `hermes gateway restart/stop`) or a persistent `launchctl submit` operation. Under launchd/systemd supervision, killing the gateway causes the supervisor to SIGTERM-respawn it in a loop — an agent could wedge the machine (#30719) — so creation/update of such cron jobs is blocked outright.","triggerScenarios":"create_job whose prompt says 'run hermes gateway restart nightly', whose script invokes `hermes gateway stop/restart`, or whose prompt references a script file containing those strings (scripts are scanned too, non-regular/oversized script files fail closed via a sentinel).","commonSituations":"Trying to automate gateway restarts for config changes or memory leaks; an agent asked to 'keep the gateway healthy' choosing a cron restart; embedding lifecycle commands in a .py helper the job runs.","solutions":["Remove `hermes gateway restart/stop` (and launchctl submit) from the job's prompt and any scripts it references.","If a restart is genuinely needed, run `hermes gateway restart` from a shell OUTSIDE the running gateway, or via systemd `systemctl --user restart hermes-gateway` defined by the admin, not by a cron job.","For config reload needs, check whether the gateway picks up config without a restart instead."],"exampleFix":"# before\ncreate_job(prompt=\"run `hermes gateway restart` to apply config\", schedule=\"1d\")\n\n# after\n# (no cron job) — from a user shell:\n#   hermes gateway restart","handlingStrategy":"validation","validationCode":"from cron.lifecycle_guard import contains_gateway_lifecycle_command_or_referenced_script\n\nprompt = \"nightly maintenance\"\nif contains_gateway_lifecycle_command_or_referenced_script(prompt, cwd=None):\n    raise ValueError(\"refusing to create job: contains gateway lifecycle command\")\ncreate_job(prompt=prompt, schedule=\"1d\")","typeGuard":null,"tryCatchPattern":"from cron.lifecycle_guard import GatewayLifecycleBlocked\ntry:\n    create_job(prompt=p, schedule=\"1d\", script=s)\nexcept GatewayLifecycleBlocked:\n    # strip `hermes gateway restart/stop` / launchctl submit from prompt AND scripts, then retry;\n    # if a restart is truly needed, do it from a user shell, not a cron job\n    raise","preventionTips":["Never put `hermes gateway restart/stop` or `launchctl submit` in any cron prompt or script — including helper files the job reads.","Do gateway restarts from a shell outside the running gateway (or an admin-defined systemd unit)."],"tags":["cron","security","gateway","lifecycle","guard"],"backgroundTag":null,"analyzedSha":"c896c09c42910c584c4c7d2325b58c14713ea42c","analyzedAt":"2026-08-14T17:18:01.089Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}