fix(cronjob): require explicit truthy session env values

tests/tools/test_cronjob_tools.py

@@ -122,6 +122,13 @@ class TestCronjobRequirements:
 
         assert check_cronjob_requirements() is False
 
+    @pytest.mark.parametrize("false_like_value", ["0", "false", "no", "off"])
+    def test_rejects_false_like_interactive_env(self, monkeypatch, false_like_value):
+        monkeypatch.setenv("HERMES_INTERACTIVE", false_like_value)
+        monkeypatch.delenv("HERMES_GATEWAY_SESSION", raising=False)
+        monkeypatch.delenv("HERMES_EXEC_ASK", raising=False)
+        assert check_cronjob_requirements() is False
+
 
 class TestUnifiedCronjobTool:
     @pytest.fixture(autouse=True)

tools/cronjob_tools.py

@@ -662,6 +662,14 @@ Important safety rule: cron-run sessions should not recursively schedule more cr
 }
 
 
+def _is_truthy_env(var_name: str) -> bool:
+    """Return True only for explicit truthy env values."""
+    value = os.getenv(var_name)
+    if value is None:
+        return False
+    return value.strip().lower() in {"1", "true", "yes", "on"}
+
+
 def check_cronjob_requirements() -> bool:
     """
     Check if cronjob tools can be used.
@@ -671,9 +679,9 @@ def check_cronjob_requirements() -> bool:
     so no external crontab executable is required.
     """
     return bool(
-        os.getenv("HERMES_INTERACTIVE")
+        _is_truthy_env("HERMES_INTERACTIVE")
-        or os.getenv("HERMES_GATEWAY_SESSION")
+        or _is_truthy_env("HERMES_GATEWAY_SESSION")
-        or os.getenv("HERMES_EXEC_ASK")
+        or _is_truthy_env("HERMES_EXEC_ASK")
     )