sj&|-UdZddlZddlZddlmZddlmZddlZddlZddl Z ddl Z ddl Z ddl Z ddl Z ddlZddlZ ddlZn #e$rdZYnwxYw ddlZn #e$rdZYnwxYwddlmZmZddlmZddlmZddlmZmZmZmZmZmZm Z m!Z!ej"e#Z$dd l%m&Z'dd l(m)Z)m*Z*da+da,ee-e.d <d e-fd Z/e0Z1e1dz Z2e2dz Z3e2dz Z4e2dz Z5dZ6e j7Z8e j9Z:iZ;eedZ?e2dz Z@dZAedGddZBeddZCeeeBe.d<eBe2e3e@ZDd eBfdZEejFde eZ^d=efd?Z_d=ed@ee j`d dfdAZadBZbdCe@outputxT)frozenc.eZdZUeed<eed<eed<dS)_CronStorePathscron_dir jobs_file output_dirN)__name__ __module__ __qualname__r__annotations__rr'r'ys0NNNOOOr0r'cron_store_override)default_cron_store_overridec(t}||Stttt }|t kr|St}|tkr|S|dz }t||dz |dz S)uReturn paths pinned to this execution context's profile. Precedence, most explicit first: 1. an active use_cron_store() override (ContextVar); 2. deliberately re-pointed module constants — if CRON_DIR/JOBS_FILE/ OUTPUT_DIR no longer match their import-time values, someone chose the documented process-wide compatibility surface; honor it; 3. the ACTIVE profile home, resolved fresh via get_hermes_home() (context-local override, then the HERMES_HOME env var) — so a test or embedder that re-points HERMES_HOME after this module was imported reads/writes ITS OWN store, not whatever jobs.json the import happened to freeze (the filed incident: fixtures that patched the env too late silently rewrote the user's real jobs file); 4. the import-time constants (home unchanged since import — the common path, returned unchanged). Nrrr#) r3getr'CRON_DIR JOBS_FILE OUTPUT_DIR _IMPORT_STORErresolve HERMES_DIR)overridelive_constantshomer(s r_current_cron_storer?s$$''))H$Xy*EEN&&    $ $ & &D zf}H 8X %;X=P Q QQr0r>c#RKt|dz }tt ||dz |dz } dVt|dS#t|wxYw)z@Route cron storage to ``home`` without mutating process globals.rrr#)r(r)r*N)r expanduserr:r3setr'reset)r>r(tokens ruse_cron_storerEsDzz$$&&..0069H $ $,(*     E* ""5)))))""5))))s *B B&c(tjS)z>Return the output directory for the active cron store context.)r?r*r/r0rget_cron_output_dirrGs  ++r0ig@cHtjdd}t}|r/ t |}n#t t f$r t}YnwxYw|dkrt tSt|tzt tS)ugResolve the one-shot running-claim stale-recovery TTL. Derived from ``HERMES_CRON_TIMEOUT`` (the cron inactivity timeout the scheduler enforces on each run) so the safety valve tracks how long a run is actually allowed to go quiet, instead of a magic constant: - unset / invalid → default 600s inactivity limit → TTL = 1800s - ``0`` (unlimited runs) → no finite bound to derive from → fall back to ``ONESHOT_RUN_CLAIM_TTL_SECONDS`` - positive N → ``max(N * headroom, ONESHOT_RUN_CLAIM_TTL_SECONDS)`` so a tiny configured timeout can never expire a claim mid-run. HERMES_CRON_TIMEOUTr) osgetenvstrip _DEFAULT_CRON_INACTIVITY_TIMEOUTfloat ValueError TypeErrorONESHOT_RUN_CLAIM_TTL_SECONDSmax_ONESHOT_RUN_CLAIM_TTL_HEADROOM)rawtimeouts r_oneshot_run_claim_ttl_secondsrXs ))2 . . 4 4 6 6C.G 7 7CjjGGI& 7 7 76GGG 7!||2333 11 +,,  sAAAjob_idc ddlm}||vS#t$r!td|dYdSwxYw)u|Return True when the scheduler in THIS process is still running ``job_id``. Direct liveness signal for stale-entry recovery (#62002): the run_claim TTL alone cannot distinguish "the claiming tick died" from "the run is alive but slow" — a run stalled on network I/O (or a laptop that slept mid-run) legitimately outlives the TTL. The in-process ticker and the run share this process, so the scheduler's running set settles the common single-gateway case without any claim-age guesswork. Imported lazily: the scheduler imports this module at load, so a module-level import here would be circular. r)get_running_job_idszsCron running-set liveness check failed for job %r; keeping the entry to avoid deleting a possibly live one-shot runTexc_info)cron.schedulerr[ Exceptionloggerwarning)rYr[s r_job_running_in_this_processrbsy 666666,,....  C     tts '??c.tjdz S)z=Return the advisory lock path for the current cron directory.z .jobs.lock)r?r(r/r0r_jobs_lock_filerd s  )L 88r0c #Kttdd}|rF|dzt_ dVtxjdzc_n#txjdzc_wxYwdSt5dt_dt_d} t t tdd}|dttj tz} tj |tjtjzn#t t"f$rtj |krWt$d tt |n#t $rYnwxYwd}Yntjd YnwxYwnLt,Ett,d |tt,d dn9#t t"f$r%}t$d |Yd}~nd}~wwxYw dV| t tj |tjnLt,Ett,d |tt,ddn#t t"f$rYnwxYw|n#|wxYwn#| t tj |tjnLt,Ett,d |tt,ddn#t t"f$rYnwxYw|w#|wxYwwxYwdt_dt_n#dt_dt_wxYw ddddS#1swxYwYdS)uSerialize a load_jobs→modify→save_jobs critical section. Combines the in-process threading lock (cheap mutual exclusion between the gateway's parallel tick threads) with a cross-process advisory file lock on ``/.jobs.lock`` (mutual exclusion between the gateway process and standalone ``hermes`` CLI invocations, which previously shared no lock at all — a `cron pause` could be silently clobbered by a concurrent gateway write, leaving a "paused" job still firing). The flock is blocking, but every critical section that uses it is short (field updates only — no agent execution), so contention resolves in milliseconds. If neither fcntl nor msvcrt is available the manager still provides in-process locking, matching the historical behaviour. Nested calls in the same thread reuse the held lock so legacy callers that invoke save_jobs() inside a broader mutation section don't deadlock or try to reacquire the advisory file lock. depthrNa+utf-8encodingTuTimed out after %.0fs waiting for the cron jobs lock (%s) — another process is holding it. Proceeding with in-process locking only so the scheduler stays alive (#60703).皙?lockingLK_LOCKzSjobs.json cross-process lock unavailable (%s); proceeding with in-process lock onlyLK_UNLCK)getattr_jobs_lock_staterf_jobs_file_lock load_stamp ensure_dirsopenrdseekfcntltime monotonic_JOBS_LOCK_TIMEOUT_SECONDSflockLOCK_EXLOCK_NBOSErrorIOErrorr`errorclosesleepmsvcrtfilenoraLOCK_UN)rflock_fd _deadlinees r _jobs_lockrs( $gq 1 1E !& ( EEE  " "a ' " " "  " "a ' " " " " " " I/I/!" '+#@ // J 00$III Q$!% 0 03M MI,,!K1NOOO! '1,,,#~//9<< & %M%?$3$5$5 !"!"!"!)$+MMOOOO'.!)!)!)$(D!)*. % JsOOOOO!, ,*'.GFI..w~~/?/?QZA[A[]^___W% J J J FGHJJJJJJJJ J (&( ,!K????#/6GFI66w~~7G7GQWYcIdIdfghhh#W-  '7&( ,!K????#/6GFI66w~~7G7GQWYcIdIdfghhh#W-  '&'  "*.  ' '&'  "*.  ' . . . . 'SI/I/I/I/I/I/I/I/I/I/I/I/I/I/I/I/I/I/s6AA(O?A$G?*,DG?AF--FF- F F-FF-G?F-*G?,F--AG?>O?H5H0+O0H55O9K:=OA3J43K 4KK KK  O K66O:N8>A3M21N2N NN N N8N4 4N88O;O?O..O??PPc #Ktj}|d|}t5t|t j}dddn #1swxYwY|5ttj tj |j }|d|dz }d}d} t|dd}|d tt!jt$z} tj|tjtjzd }n`#t,t.f$rKt!j|krt0d |Ynt!jd YnwxYwnit6Ht9t6d |t9t6ddd }nt0dn:#t,t.f$r&} t0d|| Yd} ~ nd} ~ wwxYw |V| |r't tj|tjnN|rLt6Et9t6d |t9t6ddn#t,t.f$rYnwxYw|n#|wxYwn#| |r't tj|tjnN|rLt6Et9t6d |t9t6ddn#t,t.f$rYnwxYw|w#|wxYwwxYwddddS#1swxYwYdS)a(Serialize one job's owner mutations and external side effects. Unlike the global jobs lock, this lock may be held across network delivery. It is scoped to one profile + job, so unrelated cron jobs keep progressing. Fencing fails closed when cross-process locking is unavailable. ::Nz.fire-z.lockFrhrirjrTz3Timed out waiting for fire fence %s; failing closedrlrmrnrgz1No cross-process lock backend for cron fire fencez&Cron fire fence unavailable for %s: %sro) r?r(r:_fire_fence_locks_guardr" setdefault threadingRLockrtuuiduuid5 NAMESPACE_URLhexrurvrwrxryrzr{r|r}r~rr`rrrrprrr) rYr(lock_key local_lock lock_name lock_pathracquireddeadlineexcs r_fire_job_lockrys#$$-H""$$0000H OO&11(IO++.HH ( ( GU]U]-JKKK#'#W-(((>++x77"LL U )"E 3( (#* **NN$$gfi&@&@!  PQQQ! P P P LLA63 O O O O O O O O P $NNN" $E$5 GU];;;;!f&82 22#NN,,gfj.I.I1 )DMMOOOOGMMOOOO#w" $E$5 GU];;;;!f&82 22#NN,,gfj.I.I1 )DMMOOOOGMMOOOO#K0$0$0$0$0$0$0$0$0$0$0$0$0$0$0$0$0$0$s-A//A36A3>OOA7M>=N*>N N*N N*O*O OOOOexpected_ownerc#Kt5}|sdV ddddSt5tfdtDd}t |t r|dnd}t |t o|d|k}dddn #1swxYwY|VddddS#1swxYwYdS)zEHold a per-job fence while an owner performs an external side effect.FNc3NK|]}|dk|V dSidNr5).0itemrYs r z#fire_claim_fence..s7QQ&8P8P8P8P8P8PQQr0 fire_claimby)rrnext load_jobs isinstancedictr5)rYrrjobclaim owns_claims` rfire_claim_fencers    8 KKK         \\  QQQQQQQSWXXC-7T-B-BLCGGL)))E5$''MEIIdOO~,M                                   s:C!C!BC9 C!C C! C C!!C%(C%rcBt|pd}|r |dvsd|vsd|vrtd|t|st|jrtd|t j|z S)adResolve a job's output directory, rejecting any path-escape attempt. Job IDs are filesystem path components under ``OUTPUT_DIR``. A legacy or crafted ID containing ``..``, absolute paths, or nested separators would allow output writes/deletes to escape the cron output sandbox. Reject anything that isn't a single safe path component. rK>.../\z%Invalid cron job id for output path: )strrNrQr is_absolutedriver?r*)rYtexts r_job_output_dirrs v|   " " $ $D M4;&&#++KKKLLL DzzM4::#3MKKKLLL  +d 22r0skillskillsc||r|gng}n(t|tr|g}nt|}g}|D]@}t|pd}|r||vr||A|S)zPNormalize legacy/single-skill and multi-skill inputs into a unique ordered list.NrK)rrlistrNappend)rr raw_items normalizedrrs r_normalize_skill_listrs ~$,UGG" FC !H LL J$$4:2$$&&  $D **   d # # # r0rct|}t|d|d}||d<|r|dnd|d<|S)zLReturn a job dict with canonical `skills` and legacy `skill` fields aligned.rrrN)rrr5)rrrs r_apply_skill_fieldsrs[cJ ":>>'#:#:JNN8>D      8}} 3r0c~t|}t|dd}t|d}||d<||d<t|d}|st|d}|p*|dr|ddndp|p|pd }|d d pd }||d<t ||d <t ||d <|S)a,Return a read-safe cron job shape for UI/API/tool/scheduler consumers. Older or hand-edited jobs can have nullable fields like ``prompt``, ``name``, or ``schedule_display``. Keep storage untouched on read, but ensure consumers never crash while formatting or running those records. runknownpromptnamescriptrrrKcron jobN2rstate)rrr5rNreffective_job_state)rrrYrrr label_sources r_normalize_job_recordrsO%S))J jnnT22I > >F jnnX66 7 7FJt!Jx JNN622 3 3 9 9 ; ;D  7!*..":":;;AACC  +5>>(+C+CK 8$Q''    CRC &&((6JJv%>z%J%JJ!" .j99Jw r0ct|ddkrdSt|dS)z>True when the record carries any operator-facing pause signal.rpausedT paused_at)rr5rNrrs r_has_pause_markerr4sL(())//11X==t  $$ % %%r0cX|ddsdSt|rdSdS)zTrue iff the scheduler may fire this job. ``enabled`` is the scheduler-honoured flag. Pause markers (``state`` / ``paused_at``) are a second gate so a contradictory half-paused record never fires even before self-heal runs. enabledTF)r5rrs ris_job_runnabler;s9 779d # #uu 4r0ct|d}|dvr|S|ddst|s|dkrdS|pdS|dks|drdS|pdS)u&Operator-facing state derived from the scheduler-honoured flag. A job with ``enabled=true`` must never display as paused — that was the 07-30 outage failure mode (list looked frozen, fleet kept merging). Terminal states (completed/error) are preserved regardless of enabled. r>r completedrTrr scheduled)rr5rNr)rstoreds rrrIscggg.. / / 5 5 7 7F ''' 779d # #" S ! ! Vx%7%78!! SWW[11{  [ r0pathcb tj|ddS#ttf$rYdSwxYw)z > > F v}fm44444     0 &-           s$BB8 B C$(CCct}|jdd|jddt |jt |jdS)z6Ensure cron directories exist with secure permissions.Tparentsexist_okN)r?r(mkdirr*rstores rrtrtsk  ! !E N555 4$777 !!!!!r0sc>|}tjd|}|st d|dt |d}|dd}dddd }|||zS) u Parse duration string into minutes. Examples: "30m" → 30 "2h" → 120 "1d" → 1440 zD^(\d+)\s*(m|min|mins|minute|minutes|h|hr|hrs|hour|hours|d|day|days)$zInvalid duration: 'z''. Use format like '30m', '2h', or '1d'rgrr!i)mhd)rNlowerrematchrQintgroup)rr runit multiplierss rparse_durationrs  A H\^_ ` `E [YqYYYZZZ  A  E ;;q>>! D..K ;t$ $$r0rc|}|}|}|dr5|dd}t|}d|d|ddS|}t |dkr|t d|ddDr[tstd  t|n'#t$r}td |d |d}~wwxYwd ||d Sd|vstj d|r tj|dd}|j)t#j}||}d|d|ddS#t$r}td|d |d}~wwxYw t|}t#t)|z} d| d|dS#t$rYnwxYwtd|d)uM Parse schedule string into structured format. Returns dict with: - kind: "once" | "interval" | "cron" - For "once": "run_at" (ISO timestamp) - For "interval": "minutes" (int) - For "cron": "expr" (cron expression) Examples: "30m" → once in 30 minutes "2h" → once in 2 hours "every 30m" → recurring every 30 minutes "every 2h" → recurring every 2 hours "0 9 * * *" → cron expression "2026-02-03T14:00" → once at timestamp zevery Nintervalr)kindminutesrc3@K|]}tjd|VdS)z ^[\d\*\-,/]+$N)r r )rps rrz!parse_schedule..s@*+!1%%r0zOCron expressions require 'croniter' package. Install with: pip install croniterzInvalid cron expression 'z': r)rrrTz^\d{4}-\d{2}-\d{2}Zz+00:00tzinfooncezonce at z%Y-%m-%d %H:%M)rrrzInvalid timestamp 'rzonce in zInvalid schedule 'z'. Use: - Duration: '30m', '2h', '1d' (one-shot) - Interval: 'every 30m', 'every 2h' (recurring) - Cron: '0 9 * * *' (cron expression) - Timestamp: '2026-02-03T14:00:00' (one-shot at time))rNr startswithrsplitlenallrrQrr_r r r fromisoformatreplacer _hermes_now isoformatstrftimer) roriginalschedule_lower duration_strrpartsrdt hermes_tzrs rparse_scheduler-s$~~HH^^%%N  ** |))++  ..****    NN  E 5zzQ3/4RaRy !! pnoo o K X     K K KIIIaIIJJ J K    h"(#8(CC E'(8(8h(G(GHHBy 'MM0 ZZyZ11,,..Ebkk2B&C&CEE   E E EC8CCCCDD D E   **7!;!;!;;&&((,(,,          CX C C C  sDC++ D5D  D2BF88 GGG AH)) H65H6r+ctj}|jStjj}|||S||S)aReturn a timezone-aware datetime in Hermes configured timezone. Backward compatibility: - Older stored timestamps may be naive. - Naive values are interpreted as *system-local wall time* (the timezone `datetime.now()` used when they were created), then converted to the configured Hermes timezone. This preserves relative ordering for legacy naive timestamps across timezone changes and avoids false not-due results. Nr)r$rrr astimezoner#)r+ target_tzlocal_tzs r _ensure_awarer2sf $I y<>>,,..5zzz**55i@@@ == # ##r0rcurrentcv|j|jdS||kS)u Return True when a stored aware timestamp uses a different UTC offset. Naive stored timestamps return False: they carry no offset to compare, and are normalized by ``_ensure_aware`` instead — they intentionally never take the offset-repair path. NF)r utcoffsetrr3s r_timezone_offset_mismatchr7-s;} 6u     !2!2!4!4 44r0c^|d|dkS)aReturn True when the stored local wall-clock time has not arrived yet. Cron schedules express local wall-clock intent. If Hermes/system local time changes after next_run_at was persisted, an old offset can make a future wall-clock run look due at the converted absolute time (for example 21:00+10 becomes 13:00+02). Comparing naive wall-clock values lets us distinguish that migration case from a genuinely missed run whose scheduled wall time has already passed. Nr)r#r6s r_stored_wall_clock_is_futurer99s+ >>> & &)E)E EEr0 last_run_atrr;cDt|tr|ddkrdS|rdS|d}|sdS tt j|}n#t $rYdSwxYw||ttz kr|SdS)aReturn a one-shot run time if it is still eligible to fire. One-shot jobs get a small grace window so jobs created a few seconds after their requested minute still run on the next tick. Once a one-shot has already run, it is never eligible again. rrNr)seconds) rrr5r2rr"r_rONESHOT_GRACE_SECONDS)rrr;r run_at_dts r_recoverable_oneshot_run_atr@Fs h % %f)=)=)G)Gtt \\( # #F t!("8"@"@AA ttC),ABBBBBB 4s!A11 A?>A?cd}d}t|}|s|St|dz}t|t||S)aCompute how late a job can be and still catch up instead of fast-forwarding. Uses half the schedule period (via ``_schedule_cadence_seconds``, the single cadence-measurement implementation), clamped between 120 seconds and 2 hours. This ensures daily jobs can catch up if missed by up to 2 hours, while frequent jobs (every 5-10 min) still fast-forward quickly. r$i r)_schedule_cadence_secondsr rTmin)r MIN_GRACE MAX_GRACEperiod_secondsgraces r_compute_grace_secondsrHdsUII.x88N    1 $E y#eY// 0 00r0_persisted_error_recoveries"_persisted_error_recoveries_recentc|ddkrdStt|dpdrdS|d}|sdS tt j|}n#t tf$rYdSwxYw||z }|dkrdSt|}|t|}||t|zkS)uTrue when a recurring job is wedged in a stale persisted error state. Condition (all must hold): * it is a recurring (cron/interval) job (checked by caller); * its persisted ``last_status == "error"`` (a prior fire errored and the job never recovered); * it has NOT successfully re-fired within its natural cadence — its ``last_run_at`` is older than ``cadence + grace``, so this is not a normal transient-error retry that will fire on its own soon, it is a job that has been sitting errored for a full period with no recovery; * it is not currently running in this process (a live run must never be re-armed underneath itself, #62002-style). ``last_run_at`` being older than one cadence is the key discriminator: a job that errors and is retried on its normal schedule keeps ``last_run_at`` fresh (mark_job_run stamps it on every fire, success or failure), so the stale check does not fire for a job that is merely erroring-and-retrying. last_statusrFrrKr;r) r5rbrr2rr"rQrR total_secondsrBrH)rrrlast_run last_run_dt age_secondscadence_secondss r_job_is_stale_error_recurringrSs. ww}((u#C (;$<$<==uww}%%H u#H$:8$D$DEE  "uu$3355KQu/99O1:: /,B8,L,LL MMs)!B B B ct|tsdS|d}|dkrD|d} |rt|dzndS#tt f$rYdSwxYw|dkrt sdS|d}|sdS|tvr t|S t}t||}| t}| t}||z }|dkr|nd} n#t$rd} YnwxYwttd krt| t|<| SdS) uApproximate the natural period of a schedule, in seconds, or None. Interval jobs use ``minutes * 60``. Cron jobs measure the gap between the next two fire times with croniter (falling back to None when croniter is missing or the expr is malformed). Cron results are cached per expr — this runs inside ``_jobs_lock`` on every tick for every stale-errored job, and two croniter evaluations per call add up (the same reason ``scheduler.py`` caches ``_cron_interval_minutes``). The measured gap can vary with the base time for irregular exprs; the cache trades that precision for not re-evaluating croniter under the lock, which is fine for a staleness *threshold*. NrrrgN@rrr)rrr5rPrRrQr_cron_cadence_cacher$rget_nextrrNr_r clear) rrrrbaseitfirstsecondgapresults rrBrBs h % %t <<  D z,,y)) ,3=5>>D(( =:&   44  v~~!! 4||F## 4 & & &&t, , ==D$%%BKK))E[[**FE>0022C!GGSSFF   FFF  " # #s * *  % % ' ' '$*D! 4s% AA43A4>A3D22 EErVprevious_next_runct}|d|dp|d||d}tdz at|tdt = tjdz }|j ddt|d d 5}| tj|d zddddS#1swxYwYdS#t$r&}t d |Yd}~dSd}~wwxYw)zEPersist a countable, probe-visible signal for one stale-error re-arm.rr)rYrprevious_next_run_at rearmed_atrgNz persisted_error_recoveries.jsonlTrarirj z4Could not append persisted-error-recovery record: %s)r$r5r%rIrKr!_PERSISTED_ERROR_RECOVERY_HISTORYr?r(parentrruwritejsondumpsr_r`debug)rr_rentryrfhrs r _record_persisted_error_recoveryrms --C''$--03774== 1mmoo   E  1$&--e444*+N-N,N+NOR"$$-0RR $666 $g . . . /" HHTZ&&- . . . / / / / / / / / / / / / / / / / / / RRR KSQQQQQQQQQRs=AD!+D D!DD!DD!! E+E  Ec:tttdS)z5Probe-visible snapshot of persisted-error recoveries.)persisted_error_recoveriesrecent)rIrrKr/r0r"get_persisted_error_recovery_statsrqs#'B9::  r0cvt}t|tsdS|d}|dS|dkrt |||S|dkr|d}|dS|rY t t j|}|t|z}n6#t$r|t|z}YnwxYw|t|z}| S|dkr|d }|sdStst d |dS|}|r5 t t j|}n#t$r|}YnwxYwt||} | t }| SdS) zo Compute the next run time for a schedule. Returns ISO timestamp string, or None if no more runs. Nrrr:rrrrrzCannot compute next run for cron schedule %r: 'croniter' is not installed. croniter is a core dependency as of v0.9.x; reinstall hermes-agent or run 'pip install croniter' in your runtime env.)r$rrr5r@r2rr"rr_r%rr`rarrW) rr;rrrlastnext_runr base_timers rcompute_next_runrvs --C h % %t <<  D |t v~~*8SkRRRR   ,,y)) ?4  8 <$X%;K%H%HII)G"<"<"<< < < <7!;!;!;; <Yw7777H!!### ||F## 4!!  NN    4    )(*@*M*MNN      i((==**!!### 4s$94B..C C!E)) E87E8ctt|ttjddS)aRAtomically write the current epoch time to ``path``. Delegates to :func:`utils.atomic_write_text` (tmpfile + fsync + ``atomic_replace``, same pattern as ``save_jobs``) so a concurrent reader in another process (``hermes cron status``) never sees a torn/truncated file. Best-effort: failures are swallowed by callers. z.hb_) tmp_prefixN)rtrrrxrs r_atomic_write_epochryIs6MMMdC ,,@@@@@@r0c 8ttjt|jdd\}} t j|dd5}|ttd|| t j | dddn #1swxYwYt||dS#t$r( t j|n#t$rYnwxYwwxYw) z2Atomically persist a non-negative integer counter..tmpz.count_dirsuffixprefixwrirjrN)rttempfilemkstemprrfrLfdopenrgrTflushfsyncrr BaseExceptionunlinkr~)rrfdtmp_pathfs r_atomic_write_counterrUsTMMM#DK(8(8PYZZZLB  Yr3 1 1 1 !Q GGCAu && ' ' ' GGIII HQXXZZ  ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! x&&&&&   Ih        D  sTC'A+C > C' CC'CC'' D2DD DDDDFsuccessct} t|jdz n#t$rYnwxYw|r+ t|jdz dS#t$rYdSwxYwdS)u?Record a ticker liveness signal, and optionally a successful-tick signal. The ticker calls this once per loop iteration. ``success=True`` additionally bumps the *last successful tick* marker. We track two distinct signals so `hermes cron status` can tell a thread that is merely *alive and looping* (heartbeat fresh, success stale) from one that is actually *firing jobs* (both fresh) — a ticker stuck failing every tick would otherwise keep the plain heartbeat fresh and falsely report healthy (#32612, #32895). Resolution uses ``_current_cron_store()`` so the heartbeat is correctly scoped to the active profile's store — critical under multiplex_profiles where each profile needs its own liveness signal (#69377). Best-effort: a write failure must never disrupt the tick loop. rr N)r?ryr(r_)rrs rrecord_ticker_heartbeatrgs ! !E EN-??@@@@        1F F G G G G G    DD s( 55A A"!A"c |d}tdtjt |z S#t $rYdSwxYw)Nrirjg) read_textrNrTrxrPr_)rrVs r_epoch_file_agersinngn..44663 eCjj0111 ttsAA A)(A)cLt}t|jdz S)uSeconds since the ticker loop last iterated, or None if unknown. None = heartbeat file missing/unreadable (older build, never ran, or a torn read). Callers treat None as "cannot determine", not "dead". Resolution uses ``_current_cron_store()`` so the heartbeat is correctly scoped to the active profile — critical under multiplex_profiles where ``hermes cron status`` must report per-profile liveness (#69377). rr?rr(rs rget_ticker_heartbeat_agers% ! !E 5>,>> ? ??r0cLt}t|jdz S)u-Seconds since the ticker last completed a tick WITHOUT raising, or None. Resolution uses ``_current_cron_store()`` so the heartbeat is correctly scoped to the active profile — critical under multiplex_profiles where ``hermes cron status`` must report per-profile liveness (#69377). r rrs rget_ticker_success_agers% ! !E 5>,AA B BBr0c8tjdz } t|d}n#t t f$rd}YnwxYwt|td|dzdS#t$rYdSwxYw)zIIncrement the profile-local stale-schedule catch-up counter, best effort.catch_up_occurrencesrirjrrgN) r?r(r rrNr~rQrrTr_)rrs rrecord_catch_up_occurrencers  ),B BD  88>>@@AAEE$   EEE dC5MMA$566666      s/5AB A%"B $A%%$B BBmessagect}|jdz } ttjt |jdd\}} tj|dd5}| tj d| d| tj |d d d n #1swxYwYt||d S#t $r( tj|n#t$$rYnwxYwwxYw#t&$rYd SwxYw) aOPersist the most recent tick failure so other processes can surface it. The ticker thread lives inside the gateway process; ``hermes cron status``/``list`` run in a separate process and previously could only infer "ticks may be failing" from marker staleness, with no clue WHY. A root-owned ``jobs.json`` (#68483) failed every tick for ~14h with the reason visible only in the gateway's errors.log. Writing the last error next to the heartbeat markers gives the CLI something concrete to show. Best-effort: a write failure must never disrupt the tick loop. ticker_last_errorr{z.terr_r|rrirjrdN)r?r(rtrrrrfrLrrgrxrNrrrrrrr~r_)rrrrrrs rrecord_ticker_errorrs ! !E >/ /D  'DK     H 2sW555 %49;;=='--//===>>> $$$ % % % % % % % % % % % % % % % 8T * * * * *     (####             sl:ED,A9C1% D1C55D8C59D ED.-E. D;8E:D;;EE EEctjdz } tdt|dS#t tf$rYdSwxYw)z7Return the profile-local stale-schedule catch-up count.rrrirj)r?r(rTr rrNr~rQrs rget_catch_up_occurrence_countrst  ),B BD1c$..'.::@@BBCCDDD Z qqsAAA0/A0c~t} |jdz dS#t$rYdSwxYw)zGRemove the last-tick-error marker after a successful tick. Best-effort.rN)r?r(rr~rs rclear_ticker_errorrsT  ! !E - -5577777      s . <<c8t} |jdz d}n#t$rYdSwxYw|}t |dkrdSd|dd}|pdS)z>>PP tt NN  E 5zzA~~tiiabb ""((**G ?ds / ==r)ct|dd5}|}dddn #1swxYwY tj|dfS#tj$rtj|ddfcYSwxYw)aTolerantly parse jobs.json; shared by load_jobs and the save-path peek. Returns ``(data, used_strict_fallback)``. utf-8-sig absorbs a Windows BOM; a strict parse failure is retried with ``strict=False`` to survive bare control characters in string values. IO errors from the open and parse errors from the fallback propagate to the caller, which decides between repair (load_jobs) and bail-out (peek). rz utf-8-sigrjNF)strictT)rureadrhloadsJSONDecodeError)r)rrVs r_parse_jobs_filers i{ 3 3 3qffhh3z#%%  333z#e,,,d22223s488A'B?Bctj}tt|}|st dgS t |\}}n{#t$r3}t d|td||d}~wt$r3}t d|td||d}~wwxYwt|trT|dg}|r+|r)t|tdt ||St|t"r<|r)t|tdt ||Std t%|j) zLoad all jobs from storage.NzIOError reading jobs.json: %szFailed to read cron database: z#Failed to auto-repair jobs.json: %sz*Cron database corrupted and unrepairable: jobsz8Auto-repaired jobs.json (had invalid control characters)z3Auto-repaired jobs.json (bare list wrapped as dict)z7Cron database corrupted: expected {'jobs': [...]}, got )r?r)rt_jobs_file_stampr_record_load_stamprrr`r RuntimeErrorr_rrr5 save_jobsrartyper+)r)pre_read_stampdata _strict_retryrrs rrr s#%%/IMMM&i00N     4    T.y99mm HHH 4a888?A??@@aG TTT :A>>>KKKLLRSST$xx##  WT W dOOO NNU V V V>*** $  R dOOO NNP Q Q Q>*** YDJJDWYY  s$A** C"4.B"" C"/.CC"cXtj}|sgS t|\}}n#t$rYdSwxYwt |t r/|dg}t |tr|ndSt |tr|SdS)uBest-effort read of on-disk jobs without repair side-effects. Caller must hold ``_jobs_lock()``. Returns ``[]`` when the file is missing, ``None`` when the payload is unreadable/corrupt (caller should not attempt a shrink-merge against an unknown baseline). Never calls ``save_jobs`` — the repair-free property is what keeps the save path re-entrancy-safe (a repairing read here would recurse through ``_save_jobs_unlocked``). Nr) r?r)rrr_rrr5r)r)r_rs r_peek_jobs_unlockedr8s$%%/I      "9--aa tt$8xx##!$--7tt47$ 4s> A  A cv |}|j|j|jfS#t$rYdSwxYw)u^Cheap change-detection stamp for jobs.json: ``(mtime_ns, size, ino)``. ``None`` means the file is missing/unstatable. Used as a fast-path gate in front of the shrink-merge so the healthy no-race save costs one ``stat()`` instead of a full read+parse (the ``advance_next_runs`` batching exists because this path is hot — see its docstring). ``st_ino`` is included because every legitimate writer goes through mkstemp+rename (new inode), so even a same-size write inside one mtime quantum on a coarse-clock filesystem (ext4 jiffies, network mounts) cannot false-match. N)stat st_mtime_nsst_sizest_inor~)r)sts rrrQsK ^^   BI66 tts '* 88stampcNttddsdS|t_dS)ueRemember jobs.json's stamp for the enclosing _jobs_lock() section. No-op outside a critical section. Lets the save path skip the shrink-merge parse when the file provably hasn't changed since this section loaded it (#80703's fast-path). The caller must capture the stamp BEFORE reading the file: a sibling landing mid-read then leaves the recorded stamp OLDER than disk — a mismatch, so the merge runs (fail-safe direction). Stamping after the read would let that sibling's write be certified as "seen" without being in the loaded payload, wrongly suppressing the recovery. rfrN)rprqrs)rs rrrds- #Wa 0 0"'r0 removed_idsrrcttdd}|&ttj|kr|St }||Sd|pdD}t }|D]T}t|tr=| dr(| t|dUg}|D]r}t|ts| d} | s0t| } | |vs| |vrH| || | s|s|Stdt|d|D||zS)uReturn *jobs* plus any on-disk jobs missing from the save payload (#80624). Under ``_jobs_lock()``'s degraded flock-timeout path (#60703), two processes can both believe they own the store. A writer that loaded an older/smaller snapshot then calls ``save_jobs`` and would otherwise clobber concurrent creates (the filed ``no_agent`` watchdog pattern: CLI/tool create succeeds, then a gateway tick/remove rewrites ``jobs.json`` empty or without the new id). Intentional deletes pass ``removed_ids``. Any other id present on disk but absent from *jobs* is treated as a concurrent create and merged back before the atomic write. The caller's list is never mutated — a new list is returned when anything was recovered. Fast path: when the enclosing critical section recorded a load stamp and the file's ``(mtime_ns, size)`` still matches, nothing can have changed underneath us, so the read+parse is skipped entirely — one ``stat()`` on the healthy no-race save. rsNc0h|]}|t|Sr/rris r z._merge_unexpected_disk_jobs..s#@@@!a@s1vv@@@r0r/rzPreserved %d cron job(s) present on disk but missing from the in-memory save payload (concurrent create under degraded lock or stale writer) (#80624): %sc8g|]}|dSrrrjs r z/_merge_unexpected_disk_jobs..s"(((t(((r0)rprqrr?r)rrBrrr5addrrr`rar ) rrr disk_jobsintended_removenew_idsr recovereddisk_jobdisk_ids r_merge_unexpected_disk_jobsrus0 $lD 9 9E -.A.C.C.MNNRWWW #%%I @@ (9r@@@OG(( c4  (SWWT]] ( KKCI ' ' '&(I  (D))  ,,t$$  g,, g  O!;!; """ G   NN ( I((i(((  ) r0rr#r#c tj}t tj|}n=#t $r0 tj|j}n#t $rd}YnwxYwYnwxYwd} tdD]}|st||}tj t|jdd\}} tj |dd 5}tj|td |d d |tj|dddn #1swxYwYn7#t($r* tj|n#t $rYnwxYwd}wxYw|st-t.dd} | duot1|| k} | rdn t3} | `d|D d|pdD t5 fd| Dr* tj|n#t $rYnwxYwd}t7||d}t9|t;||t=ddS|st||}tj t|jdd\}}tj |dd 5}tj|td |d d |tj|dddn #1swxYwYt7||d}t9|t;||dS#t($r*|& tj|n#t $rYnwxYwwxYw)aSave all jobs to storage. Caller must hold _jobs_lock(). ``removed_ids`` lists job ids this mutation intentionally deleted. ``replace=True`` skips the shrink-merge guard (tests / disaster recovery that mean to rewrite the store wholesale). Nrrr{z.jobs_r|rrirj)r updated_atrF)indent ensure_asciirsch|]A}t|t|d,t|dBSrrrr5rrs rrz&_save_jobs_unlocked..sV###%a..#4555;;#AdG ###r0c0h|]}|t|Sr/rrs rrz&_save_jobs_unlocked..s#III1qIAIIIr0r/c3K|]\}t|toB|do-t|dvot|dvV]dSrr)rdjintended payload_idss rrz&_save_jobs_unlocked..s  #2t,,:FF4LL:4MM<: 4MM9 r0)r?r)rtrLrr~rfrangerrrrrrhdumpr$r%rrrrrrprqrranyrrrr)rrr#r) _stat_beforer_attemptrr_stamp _unchangedrrrs @@r_save_jobs_unlockedrs6$%%/IMMM wy))     79#344LL   LLL  H`aD D H R24[QQQ#+ ())&LB Yr3999)QI!%[]]5L5L5N5NOO %*  GGIIIHQXXZZ((()))))))))))))))!   Ih''''D   ! !!1<FF$&P+;I+F+F&+P%/IDD4G4I4I (##!%###K JI1BIIIH #,  !!Ih////&!!! D!#' 8Y / / /H  # # # $Y = = = t $ $ $ FF N.tMMMD'I$%%fX   HYr3 1 1 1 !Q I[]]-D-D-F-FGG"      GGIII HQXXZZ  ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! x+++Y L99999     (####     s: A4AA4 A.+A4-A..A43A4:AN E/#A4E# E/#E' 'E/*E' +E/.N / F#:FF# FF#FF##Afalsedisablednone)rrNrhermes_constantsrrQ)rrrs r_normalize_reasoning_effortr s }t u::     # # % %D t777777d##+ 2 2 2 2    $$$v Kr0providerrbase_urlno_agentct|}t|}t|d}t|rdSd}d}|y ddlm} ddi} |r|| d<| d i| } t | d pd } | pd}n#t$rd}YnwxYw|$ tpd}n#t$rd}YnwxYw||fS) apSnapshot unpinned inference axes for the provider/model drift guard. Agent cron jobs with unpinned provider/model follow global config at fire time. Capture the current resolution for each unpinned axis so a later global switch fails closed instead of silently changing spend. Pinned axes and no-agent script jobs intentionally carry no snapshot. TrNNNr)resolve_runtime_provider requestedexplicit_base_urlr rKr/) rrhermes_cli.runtime_providerrrr5rNrr_r) r rr rnormalized_providernormalized_modelnormalized_base_urlprovider_snapshotmodel_snapshotrruntime_kwargssnap snap_providers r!_compute_provider_model_snapshotsrsc7x@@3E::6! H~~z'+$(N" % L L L L L L)40N" J6I23++==n==D 4 4 :;;AACCIIKKM - 5   % % % $    % "<>>F$NN " " "!NNN " n ,,s%A%B.. B=<B=C C#"C#ct|dt|dt|ddt|dfS)zBReturn the stored inference-routing fields in their semantic form.r rr Trr)rr5rrs r_normalized_inference_axesrso %SWWZ%8%899$SWWW%5%566$SWWZ%8%8tTTT SWWZ !!  r0monitor_script monitor_urlrc|r|rtd|s|r|rtd|r|stddSdS)a.Shared create/update validation for job execution-mode invariants. ONE owner for the class: create_job and update_job both call this so an invariant enforced at create time cannot be violated through the update door (monitor jobs silently degrading when no_agent is flipped on, etc.). uamonitor_script and monitor_url are mutually exclusive — a job can only have one monitor source.umonitor_script/monitor_url cannot be combined with no_agent=True — the whole point of a monitor job is to suppress or wake the AGENT based on source changes. Use a plain no_agent script job instead.udno_agent=True requires a script — with no agent and no script there is nothing for the job to run.N)rQ)r r!rrs r_validate_job_mode_invariantsr#s +  0     + 8  P      3       r0rrrepeatdeliverorigin context_fromenabled_toolsetsattach_to_sessionreasoning_effortc\t|}||dkrd}|ddkr|d}||rdnd}tjjdd}t }t ||}t|}t| }t| d }t| tr!t|  nd}|pd}| r d | Dnd}|pd}t|}t|}t|tr|nd}t|} t|tr!t| nd}!|!pd}!t|tr!t| nd}"|"pd}"t|!|"||t| tr,| r| gnd} n&t| trd | Dpd} nd} t!|}#dd lm}$|$|#||#p|r|dndp|r|ndpd}%t'||||\}&}'t)|}(|ddkrr|(p|dp|})t,d|p|%dd |)t0t3d|)dt0did|d|p|%dd d|#d|d|r|dndd|d|d|&d|'d|d |d!|d"|!d#|"d$dd%| d&|id'|d(|d)|dd*d+d d,d-d.dd/dd0|d1|(d2dd3dd4dd5dd6dd7|d|d8|d9|}*|||*d:<| | |*d;<t55t7}+|+|*t;|+dddn #1swxYwY|*S).s9VVVas1vv||~~V3q66<<>>VVVr0cg|]D}t|#t|ESr/r/rs rrzcreate_job..s9OOO1A OA OOOr0)check_gateway_lifecyclerr rr rrzKRejecting one-shot cron job '%s': run_at %s is outside the %ss grace windowrRequested one-shot time  is more than &s in the past and cannot be scheduled.rrrrrrr rrr rrr r! monitor_stater'rrrr$)timesrrrrr paused_reason created_at next_run_atr;rM last_errorlast_delivery_errorfailure_streakr%r(rr)r*)r-ruuid4rr$r%rrrrrNrrr r#rrcron.lifecycle_guardr2rrvr5r`rar>rQrrrr),rrrr$r%r&rrrr r rr'r(rrr)r r!r*parsed_schedulerYrnormalized_skillsrrrnormalized_scriptnormalized_toolsetsnormalized_workdirnormalized_no_agentnormalized_attachnormalized_reasoning_effortnormalized_monitor_scriptnormalized_monitor_url prompt_textr2rrrr;rrrs, r create_jobrLsx%X..Ofkkv&((V^$1((' Z\\ crc "F -- ! ! # #C-eV<<3E::6x@@6xVZ[[[/9&#/F/FPF ))+++D)1TZjtVV3CVVVVpt-5+G44x..-78I4-P-PZ))VZ"=>N"O"O?I.Z]?^?^ hN 3 3 9 9 ; ; ;dh 9 AT9CKQT9U9U_S--33555[_3;t"! ,$$1=1C1C1E1EO **,,--4 L$ ' 'OO OOOWSW  "6**K=<<<<<K):;;;Q ?, @ cA, B {C, D tE, F tG, H dI, J tK, L !M, P 7Q, R &S, T /U, V %W, , C`$#4  #."=  {{ C$ Js"3P!!P%(P%cft}|D]}|d|krt|cS dS)zGet a job by ID.rN)rrrYrrs rget_jobrO sG ;;D.. t9  (-- - - -  4r0cHeZdZdZdedeeeefffd ZxZ S)AmbiguousJobReferencez1Raised when a job name matches more than one job.refmatchesc ||_||_dd|D}td|dt |d|ddS)N, c3&K|] }|dV dSrr/)rrs rrz1AmbiguousJobReference.__init__..s&11A$111111r0z Job name 'u' is ambiguous — matches z jobs: z. Use the job ID instead.)rRrSrsuper__init__r )selfrRrSids __class__s rrXzAmbiguousJobReference.__init__s ii1111111  ' ' 'W ' 'c ' ' '     r0) r+r,r-__doc__rr r r rX __classcell__)r[s@rrQrQs^;; C $tCH~*>          r0rQrRc<|sdSt}|D]}|d|krt|cS |fd|D}|sdSt|dkrt |d|Dt|dS)aUResolve a job reference (ID or name) to a job record. - Exact ID match wins (works even if a different job's name equals this ID). - Otherwise, case-insensitive name match. - If a name matches more than one job, raises AmbiguousJobReference so the caller can surface the matching IDs rather than silently picking one. Nrcng|]1}|dpdk/|2S)rrK)r5r)rr ref_lowers rrz#resolve_job_ref../s>RRR!f (;'B'B'D'D 'Q'QA'Q'Q'Qr0rgc,g|]}t|Sr/rrs rrz#resolve_job_ref..4s!AAAq'**AAAr0r)rrrr rQ)rRrr name_matchesr`s @rresolve_job_refrd s t ;;D.. t9  (-- - - -  IRRRRtRRRL t <1# AALAAA    !a 1 11r0include_disabledcdtD}|s d|D} ddlm}|d|D}n#t$ri}YnwxYw|D].}||dd|d</|S) z2List all jobs, optionally including disabled ones.c,g|]}t|Sr/rbrs rrzlist_jobs..;s! : : : !! $ $ : : :r0c>g|]}|dd|S)rTrrs rrzlist_jobs..=s+:::a155D#9#9::::r0r)latest_executionsc:g|]}|ddS)rrKr)rrs rrzlist_jobs..As&#F#F#F#CGGD"$5$5#F#F#Fr0rrKlatest_execution)rcron.executionsrir_r5)rerrilatestrs r list_jobsrn9s : :ikk : : :D ;::4:::555555""#F#F#F#F#FGG @@"(**SWWT2->->"?"?  KsA AAupdatesc \ t|pi}|r2tddt |t 5t }t|D]\}}|d|krd|vr$|d}|dvrd|d<nt||d<dD]M}||vrG||}t|tr!t| nd}|pd||<Nd|vrt|d|d<t|} ti||} hd |r| d } t| tr!t|  nd} t!| d pd| d pdt#| d | pdd|v} t#hd|ot| | k} d|vsd|vrJt%| d| d}|| d<|r|dnd| d<| r!| d}t|trt'|}|| d<|d|d| d| d<| ddkrt)|}||ddkrh|dp|}t*d| d||t.td|dt.d|| d<| rlt1| d | d!| d"| d #\}}|| d$<|| d%<| d&d'r| ddkr| dsrt)| d}|V| dddkr7| ddd(}td|d)t.d*|| d<| ||<t3|t5||ccdddS dddn #1swxYwYdS)+zCUpdate a job by ID, refreshing derived schedule fields when needed.z%Cron job field(s) cannot be updated: rUrr>FNrKN)r r!r*>rrr!r rr r!rr>rr rr rrrrrrrrrrzRRejecting one-shot cron job update '%s': run_at %s is outside the %ss grace windowrr4r5r6r;r rr r3rrrTr is in the past (grace window: zs) and cannot be scheduled.)_IMMUTABLE_JOB_FIELDS intersectionrQrsortedrr enumeraterrrrNr rrr5r#rrr-rvr`rar>rrr)rYro bad_fieldsrrr_wd _mon_field_mvprevious_inference_axesupdated _upd_scriptschedule_changedinference_fields_changedrBupdated_scheduleupdated_next_runrrrrts r update_jobrIsp '33GMrBBJ  SDIIfZ>P>P4Q4Q S S    x2x2{{oov 2v 2FAs4yF""G##i(+++)-GI&&);C)@)@GI&@ 6 6 ((!*-C.8c.B.BL#c((..***C*-+GJ' "W,,.I.///*+'A&E&E #)*#*:#6 .44;'56F'G'G$*:GJ'.5kk&$((GKK@R4S4STT//*+;;w''833'78H'I'I$)0,0088FBB!1!5!5h!?!?!SCS>#KK77"1 )]v]]4]]].>GM*' ;4U$[[44!++g..$[[44$[[44 5551!> 0A+,,:(){{9d++ 2 G0D0D0P0PY`YdYderYsYs0P+GJ,?@@# (;(?(?(G(G6(Q(Q$Z044XyIIF$]6]]*?]]]*2 &DG dOOO(a11 1 1qx2x2x2x2x2x2x2x2v 2x2x2x2x2x2x2x2x2x2x2x2x2x2x2x2r 4sR(T!!T%(T%reasonct|}|sdSt|dddt|dS)z:Pause a job without deleting it. Accepts a job ID or name.NrFr)rrrr9rdrr$r%)rYrrs r pause_jobrs[ & ! !C t  D $0022#     r0c :t|}|sdSt|d}|V|dddkr7|ddd}td|dtd t |d d d dd|d S)zWResume a paused job and compute the next future run from now. Accepts a job ID or name.NrrrrrzCannot resume: one-shot time rqzs) and will never fire.rTrrrrr9r;)rdrvr5rQr>r)rYrr;rs r resume_jobrs & ! !C t"3z?33Ks:226::fDDZ$$Xy99 MF M M3 M M M     D  !&      r0c t|}|sdSt|dddddtdS)zKSchedule a job to run on the next scheduler tick. Accepts a job ID or name.NrTrrr)rYrs r trigger_jobrs^ & ! !C t  D  !&==2244      r0ct|}|sdS|dt5t}t|}fd|D}t||krt }t |h|rtj| ddl m }|n-#t$r t dd YnwxYwtjd }t"5t$|d d d d n #1swxYwY d d d dS d d d n #1swxYwYdS) zRemove a job by ID or name.Frc,g|]}|dk|Srr/)rr canonical_ids rrzremove_job.. s';;;a1T7l#:#:#:#:#:r0rr) clear_notepadz*Failed to clear notepad for removed job %sTr\rN)rdrrr rrrshutilrmtree cron.notepadrr_r`rjr?r(r:rr"pop)rYrr original_lenjob_output_dirr _fence_keyrs @r remove_jobr sO & ! !C ut9L {{4yy ;;;;4;;; t99| # #-\::N d 7 7 7 7$$&& . n--- 666666 l++++    @ 4 011:BBDDVV VVJ( 8 8!%%j$777 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8; $ < 5sZBE24CE2'C0-E2/C004E2$E  E2 E E2E E22E69E6)expected_fire_ownerrdelivery_errorstatusrc t|5}|s ddddSt||||||cdddS#1swxYwYdS)NFrr)r_mark_job_run_locked)rYrrrrrrs r mark_job_runr1 s     8          $     3                       sAAA Afieldct5t}t|D]{\}}|d|krjt||}|rd||<n||d||kr|||<t ||ccdddS| dddn #1swxYwYdS)aSet/clear a persisted alert-dedup marker; return the PRIOR value. The marker records that the operator was already alerted about this job's condition, so the scheduler alerts exactly once and stays silent on subsequent ticks until the condition heals (same alert-once shape as the dead-pin auto-pause in #73506). Persisted on the job record so the dedup survives gateway restarts. Fields: ``preflight_alerted`` (blocked config, T1-26) and ``drift_alerted`` (#44585 drift-guard skip). rTNF)rrrurr5rr)rYrrrrrpriors r_set_alert_flagrG s/   {{oo  FAs4yF""SWWU^^,,)!%CJJGGE4(((E>>!DGdOOO         #                 5sB B6(B66B:=B:c$t|d|S)zCSet/clear the preflight alert-dedup marker; return the PRIOR value.preflight_alertedr)rYrs r_set_preflight_alertedra s 6#6 > >>r0c"t|dS)zAMark the job as preflight-alerted; return True if it already was.TrrYs rmark_preflight_alertedrf s !&$ / //r0c&t|ddS)z@Clear the preflight alert-dedup marker (config validates again).FNrrs rclear_preflight_alertedrk s65)))))r0c$t|ddS)z=Mark the job as drift-alerted; return True if it already was. drift_alertedTrrs rmark_drift_alertedrp s 6?D 9 99r0c(t|dddS)z>Clear the drift alert-dedup marker (resolution matches again).rFNrrs rclear_drift_alertedru sFOU33333r0detailcpt5t}t|D]p\}}|d|kr_tt |pdddd|d<|||<t |ddddSq dddn #1swxYwYdS) unDurably record that a scheduled fire could not be handed to the runner. Written by the dashboard fire webhook when the loopback forward to the gateway api_server fails (gateway unreachable / listener not bound) — the shape behind "job runs manually but never auto-fires". Without this stamp the miss is invisible outside gui.log: no execution row is created (the claim never happens) and ``last_status``/``last_error`` only cover runs that actually started. Stored as ``last_fire_error`` (``{"at": iso, "detail": str}``) on the job record so `cronjob list`, the CLI, and the dashboard all surface it. Cleared by the next successful run (``mark_job_run``). Repeated failures overwrite in place — latest miss wins; per-fire history lives in the scheduler's own logs. Returns True when a job record was found and stamped. rrKNi)atrlast_fire_errorTF)rrrur$r%rr)rYrrrrs rnote_fire_forward_failurerz s#$   {{oo  FAs4yF""%--1133!&,B//5**%&Q$        #                 5sBB+B++B/2B/rc t5t}t|D]\}}|d|kr|l|d} t | t r| d|kr)t d|ddddSt } | |d<|p|rdnd |d <|s|nd|d <|rB| d d| d d| dd|rd|d<n*t|dpddz|d<||d<d|d<|dd|d<|dr|d} | d} | dd} |did}|dko| duo | dko| dk}|s | dz } | | d<| 8| dkr2| | kr,d|d<d|d<d|d<t|ddddSt|d| |d<|d|did}|dvrdd |d<|d sd|d <t d |d!|dd"|n)d|d<d|d<n|dd#krd$|d<t|ddddSt d%| ddddS#1swxYwYdS)&u Mark a job as having been run. Updates last_run_at, last_status, increments completed count, computes next_run_at, and auto-deletes if repeat limit reached. ``delivery_error`` is tracked separately from the agent error — a job can succeed (agent produced output) but fail delivery (platform down). ``status`` overrides the derived ``last_status`` ("ok"/"error") with a specific terminal status for this run — e.g. ``"blocked_config"`` when the pre-dispatch configuration validation refused to run the agent (T1-26), so `cronjob list` distinguishes "your config is broken" from "the run itself failed". rNrrzMmark_job_run: job_id %s fire claim owner changed; discarding stale completionFr;okrrMr<rrrrr>rgr= run_claimr$r8rrrrrrr;T>rrztFailed to compute next run for recurring schedule (is the 'croniter' package installed in the gateway's Python env?)zyJob '%s' (%s) could not compute next_run_at; leaving enabled and marking state=error so the job is not silently disabled.rrrrz0mark_job_run: job_id %s not found, skipping save)rrrur5rrr`rar$r%rr rrvr)rYrrrrrrrrrrr$r8rrpreclaimed_oneshots rrr s0 {{{{oov v FAs4yF""&2GGL11E%eT22%eiiooI\6\6\:" %{{{{{{{{"mm--//%(M"%+%M0LWM"18$BEEdL! 5GG/666GGOT222GG-t444 T,-C()),/8H0I0I0NQ,O,ORS,SC()-;)*%)L!77;''3'+C $778$$$ ]F"JJw//E & ; : :I77:r2266v>>D*!-*!AI*&M ' .8!Q .7{+(UQYY9;M;M*/I'2G -1M*!$#k{{{{{{{{p&6c*os%K%KM"}%-77:r2266v>>D333'.G "ww|44!J -  < GGFCGGD#,>,>?? */I'2G WWW%%11#.CL$q{{{{{{{{#n I6RRRw{{{{{{{{{{{{{{{{{{s&BM1.FM1C+M1M11M58M5cF|ddS |dpi}|dpi}d|dd|dd |d d d |d d d|ddd|dddtd}t|dd|td|d|dd dS#t $r:}td|d|Yd}~dSd}~wwxYw)uLeave an operator-visible trace when a wedged one-shot is removed. A finite one-shot whose dispatch was claimed (``repeat.completed`` >= ``repeat.times``) but which never reached ``mark_job_run`` (``last_run_at`` is null) was interrupted mid-run — scheduler restart, gateway kill, or a non-Exception escape (#73973). The recovery guards remove such jobs so they stop appearing due, but a silent removal leaves the user with no output, no error, and no job record. Write a small diagnostic file into the job's output directory so the removal is observable and debuggable. Best-effort: diagnostics must never break the removal itself. r;Nr$rz7# Cron job removed without producing output - job id: rz - name: rz - dispatch claimed: rrrr8z - run claimed at: rrz by rz - removed at: u This one-shot job's dispatch was claimed, but the run never completed (`last_run_at` was never written) — the scheduler process was most likely killed or restarted mid-execution. The job has been removed to stop it re-firing; recreate it to run again. rKuXJob '%s': removed without a completed run — diagnostic written to its output directoryz8Failed to write wedged-oneshot diagnostic for job %r: %s)r5r$r%save_job_outputr`rar_rj)rr$rrrs r _write_wedged_oneshot_diagnosticr0 s ww}) ""(b $$*   wwv  $*::k3#?#?  CI**WVYBZBZ  "'4!;!;  BG4QZA[A[   )]]4466     b))4000 # GGFCGGD#.. / /         F GGDMM1          sEE F &/FF c :t5t}t|D]8\}}|d|kr|diddkrddddS|d}|sddddS|d}||d krddddS|d d }||kr|d qd |d <d |d<d|d<t |t d|d|dd||dddd S||t ||ht|t d|d|dd||dddd S|dz|d <t |t d|d|dd|d |ddddSt d| ddddS#1swxYwYdS)upAtomically claim a finite one-shot job dispatch BEFORE execution. Increments ``repeat.completed`` under the cross-process jobs lock and persists the claim immediately, so that if the tick dies mid-execution (gateway kill, OOM, segfault, hard-timeout) the dispatch is not lost. This converts finite one-shot jobs from *at-least-once* to *at-most-times* semantics — a job that self-destructs fires at most ``repeat.times`` times instead of infinitely (issue #38758). Returns ``True`` if the caller may proceed to run the job, ``False`` if the dispatch limit is already reached (in which case the stale job is removed). Only claims jobs with ``schedule.kind == "once"`` and ``repeat.times > 0``. Recurring jobs (they use ``advance_next_run``) and infinite-repeat / no-repeat jobs are left unchanged and always allowed to proceed. rrrrNTr$r8rrr;Frrr;u>Job '%s': dispatch limit reached (%d/%d) — marking completedrrru5Job '%s': dispatch limit reached (%d/%d) — removingrgz Job '%s': claimed dispatch %d/%du|claim_dispatch: job_id %s not in store — proceeding without claim (handed-in job dict; nothing to persist a claim against)) rrrur5rr`inforrrj)rYrrrr$r8rs rclaim_dispatchr\ s" >>{{oo5 5 FAs4yF""wwz2&&**622f<< >>>>>>>>WWX&&F >>>>>>>>JJw''E} >>>>>>>> ;22IE!!77=))5 &+C N#.CL)-C &dOOOKKXc(:(:;;!  !?>>>>>>>>H $VH55550555 KGGFCGGD#$6$677  [>>>>>>>>^#,a-F;  dOOO LL2c 2 233{#     o>>>>>>>>r   G    }>>>>>>>>>>>>>>>>>>s9AJ;J J BJ.Arrr;rgN)rBrrr$r%r5rvr)job_idsrZrradvancedrrnew_nexts radvance_next_runsr sY g,,C q {{mm%%''  C4y##77:r**..v66D///'J==H H (>(>>>%-M"A    dOOO!sBrrr;)rrrr$r5r2rr"rNr_rrr?rr%rvrcopydeepcopy) rYrrrrrrexisting claimed_at_ageownerrnxts rrrC s< ,,{{) >) >C4yF""  !5!5 ,,,,,,,,--Cww|,,H  !.x/Ehtn/U/U!V!VJ *,;;==DD4444#444444$1,,,,,,,,2!D ,!%I*G #'K '+O$#}}99tz||'799E'*}}e D DC 77:r**..v66D+++&s: HH-),C & dOOO)3=4=%%% = =W,,,,,,,,XY,,,,,,,,,,,,,,,,,,sI3G%G5ACGG CGCC G GG!Gc ddlm}|pi}t|tr|dini}t |dt S#t$rt t cYSwxYw)aResolve the completed one-shot retention window from config. ``cron.completed_retention_days`` (number, default ``COMPLETED_ONESHOT_RETENTION_DAYS``). A non-positive value disables the sweep, retaining completed one-shot records indefinitely. r load_configrcompleted_retention_days)rrrrr5rP COMPLETED_ONESHOT_RETENTION_DAYSr_rrrs r!_completed_oneshot_retention_daysr s 7111111kmm!r*4S$*?*?G37762&&&R LL*,L     7775666667sA&A))B  B raw_jobsc t}|dkrdS|t|z }d}t|D]} |ddkr|d}t |t r|dnd}|d krf|d } t | t s ttj | } n#t$rYwxYw| |kr| |d }|d } |$| r"| t | td |d|d d| |d#t$r5td|d dd YwxYw|S)u{Prune terminal ``state == "completed"`` one-shot records past retention. Mutates *raw_jobs* in place; returns True when anything was removed (the caller persists). Ids removed are added to *removed_ids* when provided so ``save_jobs``'s shrink-merge guard (#80624) allows the intentional delete. Only one-shot (``schedule.kind == "once"``) records in the terminal completed state are candidates; recurring jobs and non-terminal one-shots are never touched. Age is measured from ``last_run_at`` — a completed record without a parseable ``last_run_at`` is kept (never guess a record into deletion). rF)daysrrrrNrr;TrzNJob '%s': pruning completed one-shot record (finished %s, retention %.1f days)rrz/Retention sweep skipped malformed job record %rr\)rrrr5rrrr2rr"r_removerr`rrj) rrrretention_dayscutoffremovedrjrrrOrPrids r_sweep_completed_oneshotsr s"788Nu 9.111 1FG8nn""! vvg+--vvj))H+5h+E+EO8<<'''4Dv~~vvm,,Hh,,  +H,B8,L,LMM     f$$ OOB   G&&,,C&3&C))) KK5vrvvdC0011         LLAtS!!        NsIFAF!*F !C/.F/ C<9F;C<< FBF;GGct|5}|s ddddSt||cdddS#1swxYwYdS)NF)r)r_heartbeat_fire_claim_locked)rYrrs rheartbeat_fire_claimr s    8         , )                     s>>AAct5t}|D]}|d|kr|d}t|tr|d|krddddSt |d<t|ddddS dddn #1swxYwYdS)aRefresh an active ``fire_claim`` without extending another owner's lease. A cron execution can legitimately outlive the fire-claim TTL. The shared run wrapper calls this periodically so another scheduler process cannot treat a live execution as abandoned and dispatch it again. Comparing the owner copied at dispatch prevents a stale runner from refreshing a claim that has since been recovered by another process. rrrNFrTrrs rrr sR   {{  Cwwt}}&&GGL))EeT** eiioo.O.O        &--1133E$K dOOO                         5sA1C 3CC!Ccnt5tcdddS#1swxYwYdS)uGet all jobs that are due to run now. For recurring jobs (cron/interval), if the scheduled time is stale (more than one period in the past, e.g. because the gateway was down OR because a long-running previous execution overran the interval), the accumulated missed runs are collapsed — ``next_run_at`` is fast-forwarded to the next future occurrence so a backlog does NOT burst-fire on restart — but the job still fires ONCE now. This prevents the perpetual-defer loop (#33315) where a job whose runtime exceeds ``interval + grace`` would be skipped forever. Note: firing once on catch-up flows through ``mark_job_run``, so a job with a ``repeat.times`` limit consumes one of its runs on that catch-up fire. N)r_get_due_jobs_lockedr/r0r get_due_jobsr s{ &&#%%&&&&&&&&&&&&&&&&&&s *..c t}td}t}D]R}|ds;|ddpt jjdd|d<d}Sdtj D}g}|D]1}t|dtsi|d<d}2D]1}t|dtsi|d<d}2|D]}|d }|lt|ts|d dd}G tj|]#t$r|d dd}YwxYwD]}|d }|lt|ts|d dd}G tj|]#t$r|d dd}YwxYw|D]}|d }|.t|ts|d dd}Gt|tr> tj|r#t$r|d dd}YwxYwD]}|d }|.t|ts|d dd}Gt|tr> tj|r#t$r|d dd}YwxYwt!} t#|| rd}fd |D}|D]} | d dst%| r| d} t&d| d| | D]n}|d| krd|d <d|d<|ds||d<|dsd|d<d}| d} | r| diddkro t-tj| d} || z }d|cxkr| krnnvn#t0t2t4f$rYnwxYw| d }|s| di}|d}t7||| d }|rdnd}|s*|dvr&t9||}|r|}|s1|| d <|}t&d| d| dd||D]}|d| dkr ||d <d}ntj|}| di}|d}t-|}|dkr||krt=||rt?||rt9||}|rt&d | d| dd| | |D]}|d| dkr ||d <d}n|d!vr||krtC| ||r| d} |d"kr|}|}nbt9||} |r!t-tj|nd}n#t2t4f$rd}YnwxYw|rj|h||krbt&"d#| d| | |tG| ||| d <|}D]}|d| kr ||d <d}n||krtI|}|dvr||z |krt9||}|rtt&d$| d| dd|||D]}|d| dkr ||d <d}ntK|dkrl| d%}|rT|d&}|d'd}|&|dkr||krtM| dd(rGt&d)| d| dd||wt&d*| d| dd||D]U}|d| dkrA'||(t|dd}nVtS| %|dkrH|tUd+}|| d<D]}|d| dkr ||d<d}n|+| #t$rIt&,d,| dp| dpdYwxYw|rt[|pd |S)-zLInner implementation of get_due_jobs(); must be called with _jobs_lock held.FrrYNr-Tc,g|]}t|Sr/)rrs rrz(_get_due_jobs_locked../ s! D D Dq  " " D D Dr0rr;r;rcLg|]tfdD S)c3pK|]0}|ddkV1dSrr)rrrs rrz2_get_due_jobs_locked... s<&V&Vrrvvd||quuT{{'B&V&V&V&V&V&Vr0)r)rrrs @rrz(_get_due_jobs_locked.. s<WWWa3&V&V&V&VX&V&V&V#V#VWWWWr0rzsJob '%s' (%s) has pause markers while enabled=true; self-disabling so it cannot fire (pause must be authoritative).rrrrr9z+auto-disabled: enabled+paused contradictionrrrrrr:zone-shot>rrz4Job '%s' had no next_run_at; recovering %s run at %srrzlJob '%s' next_run_at offset changed (%s -> %s). Recomputing cron run to preserve local wall-clock intent: %s)rrrucron.persisted_error.recovered job='%s' id=%s — recurring job wedged in stale last_status=error without re-firing for a full cadence; re-arming next_run_at to %s so it re-dispatches without force-run/resumez~Job '%s' missed its scheduled time (%s, grace=%ds). Running now; next run provisionally set to: %s (re-anchored on completion)r$r8rrKuiJob '%s': dispatch limit reached (%d/%d) but its run is still in flight in this process — keeping entryuNJob '%s': one-shot dispatch limit reached (%d/%d) — removing stale due entryrz.Skipping malformed cron job %r during due scan).r$rrBr5rrr?rrrrrrrr"r_rXrrr`rr%r2rNKeyErrorrQrRr@rvrr7r9r5rSrarmrHrrbrrrrr exceptionr)r needs_saveintentionally_removedrrduernrlr_run_claim_ttlrjidexisting_claimrrrtrrrecovered_next recovery_kindraw_next_run_dt next_run_dtrrecovered_next_dtrGr$r8rrrs @rrr sl --C{{HJ&)eevvd|| vvh--F1A#2#1FBtHJ D DDM(,C,C D D DD C!%% ++T22 AjMJ"&&,,d33 BzNJ & & UU= ! ! >b#&& &mT***! &*2.... &&&EE-...!%JJJ&  & & VVM " " >b#&& &}d+++! &*2.... &&&FF=$///!%JJJ&  " " UU= ! ! >*R"5"5> EE- & & &JJ C  " "&r**** " " "mT***!  " "  " " VVM " " >*R"5"5> FF=$ ' ' 'JJ C  " "&r**** " " "}d+++!  " "455N!311111  *i8Dww}--H% 77:r22||F++"= # 6 6""" /= F $ &-$2F*F*F%5h %P%PN%-(, %%3M") JGGFCGGD#$6$677!"  #B$x3t9,,,:=)%) - '4X>>Owwz2..H<<''D'88K"3&&-osCC'0#FF',HcmmooFFKKWc(:(:;;'1133  '""d8s4y0008B}-)-J!E1(,,,#%%1#xEE&ggdmm:%%%(]]__N(+%%%5h %P%PN1 .&M(*@*P*PQQQ!%*) ' 2111,0)))1!"&7&CHY\gHgHgNNA,,&5S(CCC)7C &"3K&""d8s??0>B}-)-J!E+ c!! /x88///S;5F4U4U4W4WZ_4_4_ 0#--//JJH5 : GGFCGGD#,>,>??$!$"#+&&B!$x3t9444<= 1-1 % 534446>> WWX..F)% & 7 3 3$*JJ{A$>$>  ,yE?Q?Q >#&==??+--HHE',C $&""d8s4y00.3B{O)-J!E1  3      @73774==7C    H  G((=(EFFFF JsE**"FFG22"HH:J"J43J4L,,"MM l"Cl(Al-AS>=l>TlTBl8FlA2l%_'&l'_=:l<_==G?l>B,l,A#lAm$#m$rc ddlm}|pi}t|tr|dini}t |dt S#t$r t cYSwxYw)zVResolve the per-job output-file retention cap from config (``cron.output_retention``).rrroutput_retention)rrrrr5r _CRON_OUTPUT_DEFAULT_KEEPr_rs r_cron_output_keepr s)111111kmm!r*4S$*?*?G37762&&&R8<< 24MNNOOO )))(((()sA&A))A=<A=rkeepc^|dkrdS td|dDdd}n#t$rYdSwxYwd}||dD]T} ||dz }#t$r+}td |j|Yd}~Md}~wwxYw|S) aRemove the oldest ``*.md`` run-output files beyond *keep*. Returns count deleted. Mirrors the quick-snapshot retention in ``hermes_cli.backup._prune_quick_snapshots``: output filenames are timestamp-based (``%Y-%m-%d_%H-%M-%S.md``) so a reverse lexical sort orders newest-first, and everything past *keep* is the tail to drop. A non-positive *keep* disables pruning. Pruning failures are swallowed so they can never break output saving. rc3BK|]}||VdSN)is_file)rrs rrz$_prune_job_output.. s/ C C1qyy{{ CQ C C C C C Cr0z*.mdc|jSr)r)rs rz#_prune_job_output.. s!&r0T)rreverseNrgz"Failed to prune cron output %s: %s)rtglobr~rr`rjr)rrfilesdeletedstalers r_prune_job_outputr" s qyyq C C++F33 C C C      qqGtuuPP P LLNNN qLGG P P P LL=uz3 O O O O O O O O P Ns'0; A A A55 B*?!B%%B*c tt|}|ddt|t d}||dz }t jt|dd\}} tj |dd 5}| || tj |d d d n #1swxYwYt||t!|n5#t"$r( tj|n#t&$rYnwxYwwxYwt)|t+|S) zSave job output to file.Trz%Y-%m-%d_%H-%M-%Sz.mdr{z.output_r|rrirjN)rtrrrr$r&rrrrLrrgrrrrrrrr~r"r)rYr#r timestamp output_filerrrs rrr sMMM$V,,N555 &&':;;I i#4#4#44K#N(;(;FS]^^^LB  Yr3 1 1 1 !Q GGFOOO GGIII HQXXZZ  ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! x---[!!!!   Ih        D  n&7&9&9::: sUD3,AD< D3D  D3D "D33 E%>EE% E E%E  E%rVc"t|pd}|sdS ddlm}||p|}n-#t$r t d|dYnwxYw|dS)uReduce one job skill reference to the bare name the curator matches on. A job may store an absolute path under ``HERMES_HOME/skills`` or an external skills dir; the scheduler resolves those through ``normalize_skill_lookup_name`` before handing them to ``skill_view``. The curator compares this set against bare skill names, so it has to resolve them the same way — otherwise a path-referencing job's skill looks unreferenced and gets archived out from under it. Best-effort: if the resolver is unavailable or rejects the value, fall back to the plain cleanup so a broken import can never lose a name. rKr)normalize_skill_lookup_namez8referenced_skill_names: could not normalize skill ref %rTr\r)rrNagent.skill_utilsr'r_r`rjlstrip)rVrr's r_canonical_skill_refr* s  rNN " "E r AAAAAA++E22;e     F       ;;==   $ $$s='A'&A'c t}n:#t$r-tddt cYSwxYwt }|D]w}t |t st|d|dD](}t|}|r| |)x|S)uReturn the set of skill names referenced by ANY cron job. Includes paused and disabled jobs deliberately: a paused job never fires, so its skills never get a ``bump_use`` from the scheduler, yet resuming it must still find its skills present. The curator uses this set to protect referenced skills from inactivity archival — a skill a live job depends on is "in use" regardless of when it was last loaded. Names are canonicalized the way the scheduler resolves them at load time, so a job that stores an absolute skill path is protected too. Best-effort: a corrupt/unreadable jobs store returns an empty set rather than raising, so a cron issue can never break the curator. z0referenced_skill_names: failed to load cron jobsTr\rr) rr_r`rjrBrrrr5r*r)rnamesrrcleaneds rreferenced_skill_namesr.;s{{  GRV WWWuu eeE###t$$  )#'''*:*:CGGH umbrella_skill_name``. pruned: list of skill names that were archived with no forwarding target. Returns a report dict:: { "rewrites": [ { "job_id": ..., "job_name": ..., "before": [...], "after": [...], "mapped": {"old": "new", ...}, "dropped": ["old", ...], }, ... ], "jobs_updated": N, "jobs_scanned": M, } Best-effort: exceptions from loading/saving propagate to the caller so tests can assert behaviour; the curator invocation site wraps this call in a try/except so a failure here never breaks the curator. r)rewrites jobs_updated jobs_scannedFrrNTrr)rYjob_nameraftermappeddroppedz2Curator rewrote skill references in %d cron job(s)) rrBkeysrrrr5rrrr`rr ) r/r0 pruned_setrr2changedr skills_beforer7r8 new_skillsrtargets rrewrite_skill_refsr?[sd *++LV\r""J#l''))***J F F1EEE 3 3 {{)+" " C1#'''2B2BCGGHDUDUVVM  %'F!#G$&J% , ,<'')$/F#)F4L2& ":":"))&111Z''NN4((((++%%d+++ ' &CM,6@:a==DCLG OO''$--GGFOOr'r3r9r?contextmanagerrErGrSrUrOrPrXrbrdrrr frozensetrrrrrrrrrrrrr stat_resultrrtr rr-r2r7r9r@rrHrIrerKrrSrBrVrmrqrvryrrrrrrrrrrrrrrrrrrrrrr rrr#rLrO LookupErrorrQrdrnrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr"rr*r.r?r/r0rrQs? """"""!!!!!!   LLLL EEEMMMM FFF((((((((,,,,,,KKKKKKKKKKKKKKKKKKKK  8 $ $******33333333 # htn### $    8_   & & ( (    { " !#55!66  ")/##"9?$$024Y_,-222().**"   $ ?Ij ???j/!:; )Z@@ R_RRRR>  *sDy) * * * * ,T,,,,!%#$#( :499999  e/e/e/P <$3<$<$<$<$~  S S    $" 4&)) 3C 3D 3 3 3 3 #x}X\]`Xa"T#s(^S#XC34S>c" tCH~ $sCx.    F&4S>&d&&&& c3h D    !T#s(^!!!!!( d     t    # 4# ".1I# d# # # # L"""%c%c%%%%*aSaT#s(^aaaaH$h$8$$$$& 5h 5 5d 5 5 5 5 F FH F F F F F""& 38n #  c] <1T1c1111:$%S$$$$&!+-"D---+N c3h+N38n+N +N +N+N+N+N\.S#X.8E?....d35T#x./444R$sCx.RSRUYRRRR,DcN;;tCH~;HSM;U]^aUb;;;;D Ad At A A A AST$Td8$8E? @(5/ @ @ @ @CCCCC              Fs     x}    $33sDy)93333",4S#X',,,,^Xd4S>&:;2%S# 2F)G&(huS#s]';<((((((.2<<< tCH~ <*S/*< $sCx. <<<<D.2 CCC tCH~ C*S/*C CCCCR.2 L L L tCH~  L*S/* L L L L L (3-B)#))))XNSdW_`cWd s x}    F*-*- *- *-  *-  8C=(3- '( *-*-*-*-ZDcNuXc]HUXM[cdg[hjn=n7o SM #   SM       B !'+"&"" 48,0!(,$(!%&*)pp SMpp 3-p SM p c] p T#s(^ $ p C=p T#Y p C=psmpsmp SMp5d3i01ptCy)pc]p !p" ~#p$SM%p&#'p(sm)p* #s(^+ppppfCHT#s(^4      K    22$sCx.!922222   d38n1E     DsDT#s(^Dc3h8PDDDDN  c 8C= HT#s(^"9 9#c(# 9  9999x       .&d4S>*&&&&$qd4S>2qqqqr )3))))d##:CF%c%c%%%%6CB.2"&n n 4S>*n T#Y n  #s(^n n n n n n s#AA  A AAA