sj]7dZddlZddlZddlZddlZddlZddlZddlmZddl m Z m Z m Z m Z mZddlmZejeZdZdZejdeeejjddlmZmZmZmZm Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(dd Z)gd Z*gd Z+d Z,de,dfde,dfde,dfde,dfde,ddfgZ-ddl.m/Z0dZ1dZ2de3d e4fdZ5dede3d e4fd Z6d!ed efd"Z7d!ed efd#Z8d!ed efd$Z9d!ed e:ee;effd%Zd e e eeffd)Z?d*e ee fd+e ed e efd,Z@d*e ee fd efd-ZAdd.e ed/e e d e efd0ZBd1d2d3e e d4e4d e efd5ZCd3e d e efd6ZDd7e ed e efd8ZEd9e e d:e e d e efd;ZFdZH dd*e ee fd?e ed e ee ffd@ZI dd*e ee fd?e ed e ee ffdAZJddCedDe3d e efdEZK dd*e ee fdFe ed?e ed e e ee ffdGZLdHe eee efdIe4d e e efdJZM ddKedCe ed!e edLe edMe edNe e3d7e edOe4d.e ed/e e edPe ed9e ed:e edQe edK|]\}}|cxko|kncVdSN).0lohir3s r z_is_emoji_cp..s;GG&"brR~~~~2~~~~GGGGGG)any_EMOJI_NEIGHBOUR_CP_RANGES)r3s`r _is_emoji_cpr?s' GGGG,FGGG G GGr<textidxc8|dz }|dkrGt||tkr)|dz}|dkrt||tk)|dz}|t|krTt||tkr6|dz }|t|krt||tk6|dkoV|t|koCtt||o!tt||S)zGReturn True when the ZWJ at text[idx] appears inside an emoji sequence.r)ord_VARIATION_SELECTOR_CPlenr?)r@rAleftrights r_zwj_has_emoji_neighbourrIs  7D !))DJ+AAA   !))DJ+AAA !GE #d))  DK 0 04J J J   #d))  DK 0 04J J J   +ec$ii' + T$Z ) ) + T%[)) * *r<promptcd|vr|Sg}t|D]1\}}|dkrt||r||2d|S)N‍) enumeraterIappendjoin)rJcleanedrAchs r_strip_legitimate_emoji_zwjrSstv GV$$R >>6vsCC> r 777  r<cXtjdtdd|tjS)uStrip the GitHub `Authorization: token $GITHUB_TOKEN` auth-header pattern so it doesn't trip the broader curl-auth-header exfil rule. Allows the bundled GitHub skill fallback without opening a blanket exemption for arbitrary Authorization-header exfiltration. Uses ``re.sub`` so EVERY occurrence is scrubbed, not just the first — a cron job that loads 2+ GitHub skills (e.g. github-issues + github-pr-workflow + github-code-review) contains several such blocks, and the old ``re.search`` + single ``str.replace`` left the rest to trip the exfil_curl_auth_header detector on every run. The trailing ``[^\s;&|$`]*`` consumes only the URL path — never whitespace, command separators, or subshell openers — so a payload smuggled onto the same line (``;``, ``&&``, ``|``, ``$(...)``, backticks) survives the strip and is still scanned. The host must be exactly ``api.github.com`` followed by ``/``, whitespace, quote, or end: lookalike authorities (``api.github.com.evil.com``, ``api.github.com@evil.com``) are not the trusted construct and fall through to the exfil detectors, while legitimately quoted bare-host URLs stay exempt. zBcurl\s+[^\n;&|$`]*(?:-H|--header)\s+["\']Authorization:\s*token\s+zJ["\']\s+["\']?https://api\.github\.com(?::\d+)?(?:/|\s|$|["\'])[^\s;&|$`]*z curl https://api.github.com/user)flags)resub_CRON_SECRET_VAR_RE IGNORECASE)rJs r_strip_cron_safe_constructsrZsC* 6 QNa Q Q Q*m    r<clt|}tD]}||vrdt|ddcSdS)zReturn an error string if the prompt contains invisible-unicode injection markers (ZWJ inside legitimate emoji sequences is allowed). z-Blocked: prompt contains invisible unicode U+04Xz (possible injection).rM)rS_CRON_INVISIBLE_CHARSrD)rJprompt_for_invisible_scanchars r_check_invisible_unicoder`sY!Strip invisible-unicode characters from *prompt*, preserving the ZWJ that lives inside legitimate emoji sequences. Returns ``(cleaned_prompt, removed_codepoints)`` where ``removed_codepoints`` is the sorted list of ``U+XXXX`` labels that were stripped (empty when the prompt was already clean). Used by the skills-attached cron path, where the skill body is already vetted at install time by ``skills_guard.py`` — a stray zero-width space in a code example should be sanitized, not turned into a hard block that permanently kills the job. rLzU+r\rM) setrNr]rIrOaddrDrPsorted)rJremovedrQrArRs r_strip_invisible_unicoderfs rzGGV$$R & & &X~~":63"G"G~r""" KK*SWW*** + + + r 777  VG__ ,,r<ct|}t|}|r|StD]-\}}tj||tjrd|dcS.t D]-\}}tj||tjrd|dcS.dS)u}Scan the USER-SUPPLIED cron prompt for critical threats. Strict pattern set — used at job create/update time and as a runtime defense-in-depth for prompts authored before the scanner existed. The user prompt is small and directive; bare `cat .env` or `rm -rf /` there is a smoking gun, not prose. Returns an error string when blocked, else empty string. (Blocked: prompt matches threat pattern 'D'. Cron prompts must not contain injection or exfiltration payloads.rM)rZr`_CRON_THREAT_PATTERNSrVsearchrY_CRON_EXFIL_COMMAND_PATTERNS)rJprompt_to_scan invisible_errpatternpids r_scan_cron_promptrqs188N,^<>N- >- #O$>??G4   !G33()DEEMJ !c)nnJ?? <=F!   LL=?N    (%()CDDL" ''?@@HD((ABBJd)   , 4r<job user_deliverc|pddkrdS ddlm}||rdSn(#t$r|drYdSYnwxYw dS)uUReturn an informational notice when a created job won't deliver anywhere. TUI/CLI sessions cannot be captured as a cron ``origin`` (no ``HERMES_SESSION_PLATFORM``/``CHAT_ID`` is set for them), so a ``deliver="origin"`` request — or an omitted ``deliver`` that defaults to origin-or-local — produces a job that runs and saves output to ``last_output`` but is never delivered back into the session. This is by design (there is no live-delivery channel for local sessions), but silently dropping the user's "tell me when it runs" intent is the trap reported in #51568. Surface it at create time so the agent can relay it instead of promising a delivery that never happens. Returns ``None`` when the user explicitly asked for ``local`` (no surprise), or when the job resolves to a real delivery target. rMlocalNr)_resolve_delivery_targetsoriginuQThis is a local-only cron job: its output is saved (view it with cronjob(action='list')) but will NOT be delivered back into this session — CLI/TUI sessions have no live-delivery channel. To be notified when it runs, recreate or update the job with deliver set to a gateway-connected platform, e.g. deliver='telegram' or deliver='all'.)striplowerrrrget)rrrs r_local_delivery_noticerqs" !!##))++w66t<<<<<< $ $S ) ) 4   778   44    RsAA)(A)c|dpid}|dpidd}|dS|dkr |dkrdndS|r|d |n|d S) Nrepeattimes completedrforeverrConcez1/1/z timesr)rrrs r_repeat_displayrs WWX   $" ) )' 2 2E""(b--k1==I }y zz"avvU2%. Di ! !% ! ! !u4D4D4DDr<skillskillsc||r|gng}n(t|tr|g}nt|}g}|D]@}t|pd}|r||vr||A|S)NrM) isinstancerlistrrO)rr raw_items normalizeditemr@s r_canonical_skillsrs ~$,UGG" FC !H LL J$$4:2$$&&  $D **   d # # # r<Fstrip_trailing_slashvaluerc|dSt|}|r|d}|pdS)Nr)rrrstrip)rrr@s r_normalize_optional_job_valuersF }t u::    D {{3 <4r<c|dSt|ttfr%d|D}|rd|ndSt |}|pdS)uNormalize a user-supplied ``deliver`` value to the canonical string form. The cron schema documents ``deliver`` as a string (``"local"``, ``"origin"``, ``"telegram"``, ``"telegram:chat_id[:thread_id]"``, or comma-separated combos). Some callers — MCP clients passing arrays, scripts building the payload as a list — supply ``["telegram"]``. ``create_job``/``update_job`` store it as-is, and the scheduler's ``str(deliver).split(",")`` then serializes the list to the literal ``"['telegram']"`` which is not a known platform. Flatten lists / tuples at the API boundary so storage is always a string. Returns ``None`` for ``None``/empty so callers can treat it as "not supplied". Ncg|]D}t|#t|ESr7rrr8ps r z,_normalize_deliver_param..s9AAAA#a&&,,..AQAAAr<,)rrtuplerPrr)rpartsr@s r_normalize_deliver_paramrsq }t%$''2AAAAA"'1sxxT1 u::    D <4r<deliverc^ddlmddlm}|dds|Sdtffd | Sd t |d D}fd |D}t fd |D}|rd |ndS) uHResolve ``origin`` to a concrete target for cron-context creates. A job created FROM a cron run must never store the literal ``origin``: the creating session is ephemeral, so by fire time there is no origin to resolve and the scheduler would fall back to guessing a home channel. Resolve at create time instead, using the creating run's own concrete delivery target — the ``HERMES_CRON_AUTO_DELIVER_*`` contextvars that ``run_job`` publishes per run (already per-job-safe under the parallel pool). Rules: * Not a cron-context session → returned unchanged (chat/CLI creates keep today's fire-time ``origin`` semantics, byte-identical). * ``origin`` element (or an omitted value, which the scheduler treats as origin) → replaced with ``platform:chat_id[:thread_id]`` from the creating run's target; ``local`` when the creating run has no concrete target (e.g. its own deliver is ``local``). * Every other element (``local``, ``all``, explicit ``platform:...``) passes through verbatim, including inside comma lists. rry)is_truthy_valueHERMES_CRON_SESSIONrMrcdd}dd}|r|sdSdd}|r |d|d|S|d|S)N!HERMES_CRON_AUTO_DELIVER_PLATFORMrM HERMES_CRON_AUTO_DELIVER_CHAT_IDr"HERMES_CRON_AUTO_DELIVER_THREAD_ID:r)rrrrzs r_creator_targetz6_resolve_cron_context_deliver.._creator_targets"?#FKKQQSS!/"DbIIOOQQ w 7#O$H"MMSSUU  76666966 6&&W&&&r<Nc^g|]*}||+Sr7rrs rrz1_resolve_cron_context_deliver..s- E E E117799 EQWWYY E E Er<rcXg|]&}|dkr n|'S)rr)r8rrs rrz1_resolve_cron_context_deliver..s8QQQaQWWYY(%:%:!!!QQQr<cFg|]}|v||Sr7)rc)r8rseens rrz1_resolve_cron_context_deliver..s, D D DA!t))txx{{)a)))r<)rrzutilsrrsplitrbrP)rrrresolveduniquerrzrs @@@r_resolve_cron_context_deliverrs (877777%%%%%% ???+@"EE F F'S''''''   E EG 2 23 7 7 E E EEQQQQ5QQQHD D D D D D D DF% /388F   4/r<providerbase_urlct|d}|sdSt|}|s dS ddlm}m}m}ddlm}ddlm}m } n#t$r d |d cYSwxYw| d krdS||rb ||} n#t$rd} YnwxYw| r!| | pi d d nd } | r||| rdSd|d|d| pddS ||} n#t$r|} YnwxYwt| tr| | nd} | | rt| dd nd }|r|||rdSd|d|dS)aReject pairing a named provider's stored credential with an off-host base_url. The cron tool is model-callable, so a prompt-injected job could set a real provider plus an attacker ``base_url``; on fire the scheduler resolves that provider's stored API key and sends it to the URL, exfiltrating the credential (CWE-200/CWE-522). Allow a ``base_url`` override only when it cannot leak a stored secret: no override at all, a configured custom/byok provider that carries its own endpoint+key, or an override whose host matches the named provider's own endpoint. Returns an error string if blocked, else None (valid). TrNzwbase_url override requires an explicit provider. Set provider to a configured custom provider to use a custom endpoint.r)has_named_custom_providerresolve_requested_provider_get_named_custom_provider)PROVIDER_REGISTRY)base_url_host_matchesbase_url_hostnamez2Unable to validate base_url override for provider z ; refused.customrrMz base_url z is not allowed for provider z_. A named custom provider's stored credential may only be sent to its own configured endpoint (unknownz).inference_base_urlz. A named provider's stored credential may only be sent to its own endpoint; use a configured custom provider (provider="custom") for a custom base_url.)rhermes_cli.runtime_providerrrrhermes_cli.authrrrrrrrrrgetattr)rrbuprovrrrrrrr3cfg_hostrpconfig known_hosts r_validate_cron_base_urlrs 'xd K K KB t ( 2 2D   C   W          655555BBBBBBBBB WWWVDVVVVVVW zz||xt  &&  ++D11BB   BBB HJR$$bhB^^J%C%CDDDPR  --b(;; 4 > > >4 > >$,$9  > > > --d33 1;Hc1J1JT##H---PTG""QX#`774H"#M#M#M^`aaJ++B ;;t  WB W Wt W W Ws5AAA B BB" C.. C=<C=scriptc^|r|sdSddlm}|}|dst |dkr|ddkrd|d Sdd lm}|d z }|d d |||z |}|rd|SdS)a3Validate a cron job script path at the API boundary. Scripts must be relative paths that resolve within HERMES_HOME/scripts/. Absolute paths and ~ expansion are rejected to prevent arbitrary script execution via prompt injection. Returns an error string if blocked, else None (valid). Nr)get_hermes_home)r~rCrzXScript path must be relative to ~/.hermes/scripts/. Got absolute or home-relative path: z@. Place scripts in ~/.hermes/scripts/ and use just the filename.)validate_within_dirscriptsT)parentsexist_okz9Script path escapes the scripts directory via traversal: )rhermes_constantsr startswithrFtools.path_securityrmkdir)rrrawr scripts_dircontainment_errors r_validate_cron_script_pathrOs t000000 ,,..C ~~j!! c#hh!mmA#  N36 N N N 877777!/##i/KdT222++K#,={KK O O O  4r<c,tdpd}tdd}tdpd}tdp|ddp|r|d ndp|pd }id |d|d|r|d ndd|d t|d kr |dd dzn|ddddddddpddt ddddddddddddddddt dd d!}d"r d"|d"<d#r d#|d#<d$r d$|d$<d%r d%|d%<d&r d&|d&<d'rd|d'<d(r d(|d(<d)r d)|d)<d*pg}t |tr|g}tfd+|Drd|d,<fd-|D}|r||d*<|S).NrJrMrridrname2rzcron jobjob_idprompt_previewdz...modelrrscheduleschedule_display?rrr next_run_at last_run_at last_statuslast_delivery_errorlast_fire_errorenabledT paused_at paused_reason)staterr rreasoning_effortmonitor_script monitor_url monitor_stateno_agentenabled_toolsetsworkdir context_fromc3K|]T}t|dkp|dkVUdS)selfrNrrrrr8rrs rr;z_format_job..sV W Wa3q66<<>>   ! !V + AqCGGDMM/A W W W W W Wr< continuitycg|]T}t|dk9|dkR|US)rrrrs rrz_format_job..s\ q66<<>>   ! !V + +SWWT]]0B0B 0B0B0Br<)rrrrFrr rr=)rrJrrrresult stored_refs external_refss` r _format_jobrvs1 ""(b ) )F swww//1B1B C CF +) , ,F swwvf&"+fv2M&))2fRXf\f g gD& f.$ &  #f++2C2C&#,..  !!  CGGJ'' CGGJ'' CGG.//63 /#&& 3779g.. sww}-- sww}-- sww}-- sww'<== 377#455!" 3779d++#&%S))WW[))11+F. wwx)x=x ww!""=%();%<!" ww  9#&'7#8  ww}3 #M 2} ww7"%o"6 wwz"!z ww!""=%();%<!" wwy+ Ny''.))/RK+s##$"m  W W W W; W W WWW$#|M/!.~ Mr< extra_promptc|d}d} t|d}t|ts.t|}|d}nt |sd}nd}dd|d Snv#t $ri}t d || t|dt|n#t $rYnwxYwddt|d cYd}~Sd}~wwxYwt|| S) uExecute a cron job immediately, outside the scheduler tick. Atomically claims the job first via ``claim_job_for_fire`` — the same at-most-once CAS the scheduler/external-provider fire path uses — so a concurrently-running gateway ticker cannot also fire it (the claim both blocks a duplicate fire and advances ``next_run_at`` for recurring jobs). If the claim is lost (another fire is in flight), this is a no-op. The actual firing is delegated to ``run_one_job`` — the single shared execute→save→deliver→mark body the ticker and external providers use — so failure delivery, ``[SILENT]`` handling, and live-adapter delivery stay identical across paths and can't drift. Returns {"claimed": bool, "success": bool, "error": str|None}. rNT return_job%Job no longer exists; nothing to run.1Job is paused/disabled; resume it before running.;Job is already being fired by the scheduler; not run again.Fclaimedsuccesserrorz1Failed to claim cron job %s for immediate run: %sr) r rdictr rrrtr(rr_run_claimed_job)rrr claimed_job refreshedreasones r_execute_job_nowr0sA$YFKD(DAAA +t,, I  I @$Y// WLV$HH H I DDD H&RSTTT  A / / / /    D ECFFCCCCCCCC D Kl C C CCsBAA!! C+CB'&C' B41C3B44C CCc(|d}d}d} ddlm}m}m}||sddddSd}|d }t |t r$t|d pd nd} dd lm } | n#t$rdYnwxYwtj d} Wt|d p|dfd } tj | dd} | tjd} t#| dd} t%| r | nd}|t#|ddnd}|t#|ddnd} |||||}| | t*dzn:#| | t*dzwwxYwd}||n#d}||wxYwt-|pi}|ddk}dt/|o||ddS#t$r}t0d|||r# ddlm}||n#t$rYnwxYw t5|dt||n#t$rYnwxYwddt|dcYd}~Sd}~wwxYw) uFire an already-claimed job through the shared ``run_one_job`` body. Split out of ``_execute_job_now`` so the background dispatch path (``_try_dispatch_background_run``) can take the claim synchronously — so the tool response can report "paused"/"already firing" immediately — and hand the actual run to a daemon worker. Returns {"claimed": True, "success": bool, "error": str|None}. rFNr)release_running_job run_one_jobtry_register_running_jobTcJob is already running (a scheduler tick or another manual run is executing it); not started again.r% fire_claimbyrM)get_activity_callbackrrcztj}tstj|z }|tkrt d|dS ddt|dn#t$rYwxYwtdSdS)Nuucronjob run heartbeat ceiling reached for job '%s' (%.0fs) — stopping heartbeat; gateway watchdog regains authorityzcronjob: running job '' (z s elapsed)) time monotonicwait_CRON_RUN_HEARTBEAT_INTERVAL_CRON_RUN_HEARTBEAT_CEILINGrtruintr)startedelapsed_heartbeat_stop activity_cbjob_names r_heartbeat_loopz)_run_claimed_job.._heartbeat_loop)s.**)../KLL!"n..8G!<<<9%g  !# ZXZZ#g,,ZZZ%!!!! !!*../KLL!!!!!s/B BBzcronjob-run-heartbeat)targetdaemonrz gateway.run_gateway_runner_refadapters _gateway_loop)rJlooprrC)timeoutrok last_errorz-Failed to execute cron job %s immediately: %s)r2)expected_fire_ownerrN)rr2r3r4rrr*rtools.environments.baser8r threadingEventThreadstartsysmodulesrcallablerbrPr>r boolrtr(r)rrr _registered fire_ownerr2r3r4claimr8_heartbeat_threadrFgateway_module runner_refrunnerrJ gateway_loop processedr-rNr/_releaserCrDrEs @@@rr+r+szYFKJW           ('//  F    %%3=eT3J3JTS4.B///PT "  E E E E E E 0/11KK   KKK $/++   "3776??4f55H ! ! ! ! ! ! ! !0!* 0&,!!!   # # % % %77^-BDII !)*!5!5?48>8J76:t444PTAGASwv===Y]  ( U'K(!-  ##%%%$0%**3ORS3S*TTT ##%%%$0%**3ORS3S*TTTT1 K   ' ' ' ' K   ' ' ' 'FOO)r ]]= ) )T 1I,"--]]<00       DfaPPP    JJJJJJ          A$.           D VV        - sI7AI7?BI7 BI7BC&I7G 5H 7HHI7H""AI77 LL  J21L 2 J?<L >J??L  K$#L $ K1.L 0K11L L Lr max_charscV ddlm}||z }t|d}|sdS|ddd}|sdSt ||kr|d|d |dd z}|S#t$rYdSwxYw) aBest-effort excerpt of the job's most recent saved output file. Included in the background-run completion block so the parent agent sees what the job actually produced without having to dig through ``~/.hermes/cron/output/``. Never raises. r)get_cron_output_dirz*.mdNzutf-8replace)encodingerrorsu … (truncated; full output: )) cron.jobsrhrdglob read_textrrFr)rrfrhout_dirfilesr@s r_latest_job_output_excerptrss111111%%''&0w||F++,, 4Ry""GI"FFLLNN 4 t99y   #&Tb &T&T&TTD tts7B1B.+B B('B( session_idc @ ddlm}|sdSn#t$rYnwxYw|dt|dp ddlm}|}|rtd|n2#t$r%}t d|Yd}~nd}~wwxYw dd l m }|d }n#t$rd }YnwxYw|s|rt|}|sdS dd l m } | vrd d ddSn#t$rYnwxYwtdtt s.t#} | d} nt%| sd} nd} d d | dSnw#t$rj} td|  t)d t| n#t$rYnwxYwdd d t| dcYd} ~ Sd} ~ wwxYwd } ddlm}|dd pd } n#t$rYnwxYw ddlm}m}|}nK#t$r>} td| t3}d |d<|cYd} ~ Sd} ~ wwxYw ddlm}|}n#t$rd}YnwxYwt9j|dd d!t:tt<fffd" }|d#d$d%d&dd'|d(||rt|nd|| ||) }|d*dkrdd|d+d,Std-|d.d/t3|}d |d<|S)0uhClaim ``job`` now, then fire it on the async-delegation daemon executor. A manual ``cronjob(action='run')`` used to execute the job synchronously on the calling agent's tool thread. A cron job is a full agent run that routinely takes minutes-to-hours, so the parent turn sat inside ONE tool call the whole time: uninterruptible (the interrupt flag is only checked between loop iterations) and serial (a batch of runs executed one by one). This dispatches the run like ``delegate_task``'s background mode: the tool returns immediately with a handle, the run executes on the shared async daemon executor, and a ``type="async_delegation"`` completion event re-enters the conversation as a fresh turn when the job finishes — riding the existing completion-queue rail (CLI drain + gateway watcher), which keeps message-role alternation legal and the prompt cache intact. The at-most-once claim is taken SYNCHRONOUSLY before dispatch so unrunnable jobs (paused / missing / already firing) report in the tool response immediately instead of as a delayed completion event. Returns ------- None Background delivery unavailable on this session runtime (one-shot ``hermes -z``, stateless HTTP, Kanban worker, nested cron run). Caller falls back to the synchronous path unchanged. dict ``{"claimed": False, "success": False, "error": ...}`` — claim lost; same shape as ``_execute_job_now`` so the caller's existing response formatting applies. ``{"claimed": True, "dispatched": True, "delegation_id": ...}`` — run is executing in the background. ``{"claimed": True, "dispatched": False, "success": ..., "error": ...}`` — dispatch pool was at capacity; the run executed inline (the claim was already taken and must not be stranded). r)async_delivery_supportedNrr)recover_interrupted_executionszSReclaimed %d stale cron execution(s) from dead owner(s) before dispatching job '%s'z"Stale execution reclaim failed: %s)get_current_session_keyrM)default)get_running_job_idsFr5r%Tr r"r#r$z2Failed to claim cron job %s for background run: %s)r& dispatchedr'r(ryHERMES_UI_SESSION_ID)_current_origin_session_iddispatch_async_delegationzQcronjob run: async delegation registry unavailable (%s); running job '%s' inline.r)r{)_get_max_async_childrenrrrct}ttj z d}tpi}d ddd|drdnd |d rd |d nd zd dkrdndzg}|dr|d|dt }|r*|d|||drdnd d||d d|dS)Nr)r Cron job 'r:z) finished its manual run.zResult: r'rNFAILEDr(u — rMzDelivery target: rz/ (output was delivered there by the job itself)z (output saved locally only)rzNext scheduled run: z--- JOB OUTPUT ---r r)statussummaryr( api_callsduration_seconds)r+roundr;r rrOrsrP) resdurationr-linesexcerptr,rrrrE started_ats r_runnerz-_try_dispatch_background_run.._runnerPs{FFFz1155FOO)r H H Hf H H H Aswwy11?ttx A A-0WWW-=-=E)swww'')))2 G ) ) )g%%BA3     == ' ' L LLJ -0HJJ K K K,V44  " LL- . . . LL ! ! !%(WWY%7%7DkkWyy''WWW%% (    r<zManual run of cron job 'r:rmztTriggered via cronjob(action='run'). The job executed in its own fresh cron session; this block reports its outcome.cron_runr) goalcontexttoolsetsroler session_keyparent_session_idraorigin_ui_session_idorigin_session_idmax_async_childrenr delegation_id)r&r{rzGcronjob run: background pool unavailable (%s); running job '%s' inline.r(rejected) rrvrrrcron.executionsrwrtrurtools.approvalrxrrzr rr*r rr(rrztools.async_delegationr}r~r+tools.delegate_toolrr;rrinfo)rrtrrvrw _reclaimed _reap_excrxrrzr-r.r/rrzr}r~rrr max_asyncrdispatchr,rrrErs ` @@@@@r_try_dispatch_background_runrsR DDDDDD'')) 4       YF3776??,f--HFBBBBBB3355   NN.     FFF  99EEEEEEEEF::::::--b999   &:& *oo t&Y  : : : : : :,,....$$J /    D  )DAAA +t,, II @$Y// WLV$HH H I YYY I6STUUU  A / / / /    D uQTUVQWQWXXXXXXXX Y ;;;;;;./ErJJPb              7688  '()8   "+LIII$| ??????++--  Jggi))G T#s(^           :)( > > >V > > > B ggg-7A#j///T1+$H"||H--%\\/::    KKQ Wj))8c = = =F F< Ms ((.B B6B11B6:C CC8DE6 DE6DAE66 G*G%F<;G%< G G%G  G%G*%G*0H HHH)) I133I,&I1,I15J JJrrc4t|tr,|r|gng}n|r d|D}ng}td|D}|r|s|dn|s|r d|D}|pdS)aTranslate the ``continuity`` flag into the ``context_from`` list. ``continuity=True`` ensures ``"self"`` is present (the job's own previous output is injected each run); ``continuity=False`` removes any ``"self"``/own-id entry. Other entries are preserved untouched. cg|]D}t|#t|ESr7rr8js rrz%_apply_continuity..s9GGG1A GA GGGr<c3FK|]}|dkVdS)rNrr8rs rr;z$_apply_continuity..s/55117799&555555r<rcBg|]}|dk|S)rrrs rrz%_apply_continuity..s*777a17799#6#6#6#6#6r<N)rrrr=rO)rrrefshas_selfs r_apply_continuityrs,$$)5););)=)=E ""$$%%2 GG GGG5555555H8(8 F 8H8774777 <4r<actionrrrinclude_disabledrr.rrrattach_to_sessionr r r task_idc~ |pd}|dkr`|stddSt|| }t |}|r|stddSn|s|stddS|r"t |}|rt|dS|r"t |}|rt|dS|r"t |}|rt|dSt| | } | rt| dS|rdd lm }!t|tr|gn|}"|"D]d}#t|#tr+|#d krB|!|#std |#d dcSe|t||}ddl m}$m}% |%daid|pdd|d|d|dt!t#|dt%d|dt'| dt'| dt'| ddt'|d|d|pd dt'|d|d |d!t'|d"t'|d#|}&nH#|$$r@}'|'}(t|(d$fd%di|(cYd }'~'Sd }'~'wwxYwd&|&dd'})t-|&t#|}*|*r|)d(|*})t/jd|&d)|&d|&d*|&dg|&d+t5|&|&dd,|&d-t7|&|)d. d/0S|d1krAd2t9|3D}+t/jdt;|+|+d4d/0S|std5|d6dS t=|}&nM#t>$r@}'t/jdt|'d7|'j Dd8d/0cYd }'~'Sd }'~'wwxYw|&st/jdd9|d:d;d/0S|&d)}|d||&d|&d+d?d@d/0S|dAkrEtG|| B}-tEt/jdt7|-dCd/0S|dDkrCtI|}-tEt/jdt7|-dCd/0S|dEvr|pd }.|.r"t |.}|rt|dStK|&||.F}/|/|/dGrjtEt7t|pd)|i}0d|0dH<dI|0dJ<|/dK|0dK<t/jd|0dLdMd/0S|/|/ntM|&|.N}1|1dOdrtEt7t|pd)|i}0|1dOd|0dH<|1d%d|0dP<|1dOds|1d$pdQ|0dR<n |1d$r |1d$|0dS<t/jd|0dCd/0S|dTkrYi}2|'t |}|rt|dS||2d<|||2d<|t!t#||2d<| |$t|| }||2d<|r|dnd |2d*<| t'| |2d<| t'| |2d<| t'| d|2d<|||2d#<d|2vr|2dn|&d}3d|2vr|2dn|&d}4t|3|4} | rt| dS|:|r"t |}|rt|dS|rt'|nd |2d<|:|r"t |}|rt|dS|rt'|nd |2d!<||rt'|nd |2d"<||Wd!|2vr|2d!n|&d!}5d"|2vr|2d"n|&d"}6|5r|6rtdUdS|||$|&dpg}7dV|7D}"nMt|tr,|r|gng}"n dW|D}"|t|"|pg}"|"rFdd lm }!|"D]=}#|#d kr|!|#std |#d dcS>|"pd |2d<||pd |2d<|t ||2d <|t'|pd |2d<|Wt |}8|8rAd|2vr|2dn|&d}9|9stdXdS|8|2d<|8|dkrd n|}:tO|&dpi};|:|;dY<|;|2d<|PtQ|}<|<|2d<|<dZ||2d+<|&d[d\kr d]|2d[<d|2d^<|2std_dStS||2}-tEt/jdt7|-dCd/0Std`|d6dS#tT$r(}=tt|=dcYd }=~=Sd }=~=wwxYw)bz!Unified cron job management tool.rMcreatezschedule is required for createF)r'uFcreate with no_agent=True requires a script — the script is the job.z3create requires either prompt or at least one skillr)r rzcontext_from job 'z>' not found. Use cronjob(action='list') to see available jobs.N)CronSchedulerRegistrationError&create_job_with_scheduler_registrationrJrrrrrrrrrTrrrrrrrr r r r(r'rz ' created. rrrrr) r'rrrrrrrrrmessager)indentrc,g|]}t|Sr7)r)r8rs rrzcronjob..Es ]]]K$$]]]r<)r)r'countjobszjob_id is required for action ''cg|]H}|d|d|d|ddIS)rrrr)rrrrr)r8ms rrzcronjob..Rsd    #$D'$%EE&MM().@(A(A+,55+?+?    r<)r'r(matcheszJob with ID or name 'z8' not found. Use cronjob(action='list') to inspect jobs.)r'r(removezFailed to remove job 'z ' removed.)rrr)r'r removed_jobpause)r.)r'rresume>runrun_nowtrigger)rtrr{executed backgroundexecution_moderuThe job is running in the background. You and the user can keep working; its outcome re-enters the conversation as a new message when it finishes. Do not wait or poll — just continue.)r'rnoter)r&execution_successz4Already being fired by the scheduler; not run again.execution_skippedexecution_errorupdateu]monitor_script and monitor_url are mutually exclusive — clear one before setting the other.cg|]D}t|#t|ESr7rrs rrzcronjob..!s9OOOqA OCFFLLNNOOOr<cg|]D}t|#t|ESr7rrs rrzcronjob..%s9SSSqCFFLLNNSCFFLLNNSSSr<ziCannot set no_agent=True on a job without a script. Set `script` in the same update, or on the job first.rdisplayr paused scheduledrzNo updates provided.zUnknown cron action 'r7)+rr tool_errorrrZrqrrrnr rrrrrrrrrrto_dictpoprjsondumpsrrrrrFrr rrrrrrr0r*rrr)>rrrJrrrrrrrrrrr.rrrrrrrr r r rrtrcanonical_skills _no_agent scan_error script_error monitor_errorbase_url_error_get_jobrref_idrrrexc_partial_create_message _local_noticerreupdatedrbgr exec_resultupdates eff_provider eff_base_urleff_mon_script eff_mon_urlexistingtarget_no_agenteffective_scriptnormalized_repeat repeat_stateparsed_scheduler/s> rcronjobrs: Z1l))++1133  ! ! T!"CUSSSS0?? XI  h%1 %  h$4 h!"Wafgggg A.v66 A%j%@@@@ C9&AA C%lEBBBB D :> J J  D%mUCCCC5XxHHN A!.%@@@@ 999999)3L#)F)FX ~~L"  F"&#..!6<<>>3G3G3I3IV3S3S #8F++)PPPP$)   %0zJJ           T<<!>>;8DDD;8Z^____9@@@".&6%= :'BBB!"'Y#$'8&7%&$A#P#P#P'(!>k J J J)4&6%5582 T T T;;==!(,,w"7"7SSS(SSSSSSSS TC3v;BBBO238PQX8Y8YZZM G%4"F"F}"F"F:#!$iK WWW--!ggh33 #$6 7-c22"wwy'::#&}#5&s++.   "   ]] K[0\0\0\]]]D:$TDQQZ[\\\ \ ^M MMMW\]]] ] !&))CC$   :$ XX  "%            " :!-EF-E-E-EFF  T  ! ! ((G U!"D6"D"D"DeTTTT . 0 0 0:#CCKCCC$ #F $'GG,>$?$?$$      v666G . 0 0 0:${77K7KLLUVWWW W  ! ! ((G . 0 0 0:${77K7KLLUVWWW W 6 6 6 ">TL A.|<< A%j%@@@@. B~"&&"6"6~2444$WV__%FvGG%)z"+7'(*,&&*A*A'z#'%E      "n%c EEE y%00 52444 !BT6NCCF!,E!B!BF: *5//)U*K*KF& '??9e44 A.9oog.F.F/J*++)) A,7,@():$v>>qIII I  ! !&(G!.v66 A%j%@@@@$*!"&"%B,W55&& "!U%6#4UF#C#C $4!:J#T#3A#6#6PT  #@#G#G #&CH&M&M ##&CHcg&h&h&h #+/?*+(2W'<'< ###''*BUBU (2W'<'< ###''*BUBU 5\<PPN A!.%@@@@!G#=f#E#EL#G),FFFFMS$]$A&$I$I$IY]!)!H$>~$N$NM$H)-GGGGES]1.AAAY]()&CNW1+>>>SW &)[-D1AW1L1LG,--RURYRYZjRkRk/ % ':+A '"ww~66<"HOOHOOODD c22T5A5G5G5I5IQL..0011rDDSSLSSSD),T:>>D"D ======"&  !<<>>V33$'x//#-!TV!T!T!T(-$$$ +/,$'+.>.F$*+ ,/34E/F/F+,"&C7%K%K%St "##'x.."@HG@S@Sw{{8'<'<'n.%%n. ;n.Bn.Cn."Bn.1B#n.An.n.. o 8oo o ruManage scheduled cron jobs with a single compressed tool. Use action='create' to schedule a new job from a prompt or one or more skills. Use action='list' to inspect jobs. Use action='update', 'pause', 'resume', 'remove', or 'run' to manage an existing job. action='run' fires the job immediately in the BACKGROUND (like delegate_task): the call returns at once with a handle and the job's outcome re-enters the conversation as a new message when it finishes. Do not wait or poll after triggering a run — just continue. Optionally pass 'prompt' with action='run' to inject transient per-run context (appended to the job's stored prompt for that single fire only, never persisted). To stop a job the user no longer wants: first action='list' to find the job_id, then action='remove' with that job_id. Never guess job IDs — always list first. Jobs run in a fresh session with no current-chat context, so prompts must be self-contained. If skills are provided on create, the future cron run loads those skills in order, then follows the prompt as the task instruction. On update, passing skills=[] clears attached skills. NOTE: The agent's final response is auto-delivered to the target. Put the primary user-facing content in the final response. Cron jobs run autonomously with no user present — they cannot ask questions or request clarification. Scheduling from cron-run sessions is disabled by default and enabled via cron.allow_agent_scheduling in config.yaml. When enabled, jobs created from a cron run are user-owned in the same flat job table as every other job, and their delivery resolves to the creating job's own persistent target — never to the ephemeral cron-run session. Prefer updating an existing job (list first, then update by job_id) over creating near-duplicates.objectstringz~One of: create, list, update, pause, resume, remove, run. When action=create, the 'schedule' and 'prompt' fields are REQUIRED.)type descriptionz+Required for update/pause/resume/remove/runzFor create: the full self-contained prompt. If skills are also provided, this becomes the task instruction paired with those skills. For run: optional transient context appended to the stored prompt for that single fire only (never persisted).aREQUIRED for action=create. For create/update: '30m', 'every 2h', '0 9 * * *', or ISO timestamp. Examples: '30m' (every 30 minutes), 'every 2h' (every 2 hours), '0 9 * * *' (daily at 9am), '2026-06-01T09:00:00' (one-shot). You MUST include this field when action=create.zOptional human-friendly nameintegerzTOptional repeat count. Omit for defaults (once for one-shot, forever for recurring).aOmit this parameter to auto-deliver back to the current chat and topic (recommended). Auto-detection preserves thread/topic context. Only set explicitly when the user asks to deliver somewhere OTHER than the current conversation. Values: 'origin' (same as omitting), 'local' (no delivery, save only), 'all' (fan out to every connected home channel), or platform:chat_id:thread_id for a specific destination. Combine with comma: 'origin,all' delivers to the origin plus every other connected channel. Examples: 'telegram:-1001234567890:17585', 'discord:#engineering', 'sms:+15551234567', 'all'. WARNING: 'platform:chat_id' without :thread_id loses topic targeting. 'all' resolves at fire time, so a job created before a channel was wired up will pick it up automatically once connected.arrayrzOptional ordered list of skill names to load before executing the cron prompt. On update, pass an empty array to clear attached skills.)ritemsra3Optional path to a script that runs each tick. In the default mode its stdout is injected into the agent's prompt as context (data-collection / change-detection pattern). With no_agent=True, the script IS the job and its stdout is delivered verbatim (classic watchdog pattern). Relative paths resolve under zx/scripts/. ``.sh``/``.bash`` extensions run via bash, everything else via Python. On update, pass empty string to clear.zIOptional monitor-mode source script (same rules as `script`: relative to u^/scripts/, .sh/.bash via bash, else Python). Each tick it runs FIRST and its output is hashed as exact bytes: UNCHANGED output suppresses the agent run entirely (no LLM, no delivery, recorded as a silent no_change tick); CHANGED output injects a MONITOR CHANGE DETECTED block (unified diff + new output) into the prompt before a normal agent run. The first tick always runs the agent (baseline). Scripts must emit STABLE output — no timestamps or random ordering — or every tick looks changed. Mutually exclusive with monitor_url; incompatible with no_agent=True. On update, pass empty string to clear.uOptional http(s) URL used as the monitor source instead of a script — fetched with a bounded GET (30s timeout, 256KB cap) each tick. Same hash-suppression semantics as monitor_script. Mutually exclusive with monitor_script. On update, pass empty string to clear.booleanu_Default: False (LLM-driven job — the agent runs the prompt each tick). Set True to skip the LLM entirely: the scheduler just runs ``script`` on schedule and delivers its stdout verbatim. No tokens, no agent loop, no model override honoured. REQUIREMENTS when True: ``script`` MUST be set (``prompt`` and ``skills`` are ignored). DELIVERY SEMANTICS when True: (a) non-empty stdout is sent verbatim as the message; (b) EMPTY stdout means SILENT — nothing is sent to the user and they won't see anything happened, so design your script to stay quiet when there's nothing to report (the watchdog pattern); (c) non-zero exit / timeout sends an error alert so a broken watchdog can't fail silently. WHEN TO USE True: recurring script-only pings where the script itself produces the exact message text (memory/disk/GPU watchdogs, threshold alerts, heartbeats, CI notifications, API pollers with a fixed output shape). WHEN TO USE False (default): anything that needs reasoning — summarize a feed, draft a daily briefing, pick interesting items, rephrase data for a human, follow conditional logic based on content.)rryruOptional job ID or list of job IDs whose most recent completed output is injected into the prompt as context before each run. Use this to chain cron jobs: job A collects data, job B processes it. Each entry must be a valid job ID (from cronjob action='list'); for a job's OWN previous output, prefer the `continuity` flag. Note: injects the most recent completed output — does not wait for upstream jobs running in the same tick. On update, pass an empty array to clear.aWhen true, this recurring job carries continuity across runs: each run wakes up with the job's own most recent output injected into its prompt, so it can dedupe against what was already reported and continue where the last run left off (scouts, monitors, incremental digests). First run has no previous output and runs unchanged. On update, pass false to turn continuity off (other context_from entries are preserved). Default: false.uOptional list of toolset names to restrict the job's agent to (e.g. ["web", "terminal", "file", "delegation"]). When set, only tools from these toolsets are loaded, significantly reducing input token overhead. When omitted, all default tools are loaded. Infer from the job's prompt — e.g. use "web" if it calls web_search, "terminal" if it runs scripts, "file" if it reads files, "delegation" if it calls delegate_task. On update, pass an empty array to clear.u1Optional absolute path to run the job from. When set, AGENTS.md / CLAUDE.md / .cursorrules from that directory are injected into the system prompt, and the terminal/file/code_exec tools use it as their working directory — useful for running a job inside a specific project repo. Must be an absolute path that exists. When unset (default), preserves the original behaviour: no project context files, tools use the scheduler's cwd. On update, pass an empty string to clear. Jobs with workdir run sequentially (not parallel) to keep per-job directories isolated.uWhen True, this job becomes CONTINUABLE: the user can reply to its delivery and the agent has the brief in context instead of asking 'what is that?'. On thread-capable platforms (Telegram topics, Discord/Slack threads) a dedicated thread is opened for the job and its replies; on DM-only platforms (WhatsApp/Signal) the brief is mirrored into the origin DM session. Use this for conversational recurring jobs the user will reply to — daily briefings, reminders that kick off follow-up work. Leave unset for fire-and-forget alerts/watchdogs. Overrides the global cron.mirror_delivery config for this one job. Only the origin chat is touched (never fan-out targets); no effect when deliver='local'.)r propertiesrequired)rr parameterscPddlm}|dp|dp |dS)u Check if cronjob tools can be used. Available in interactive CLI mode and gateway/messaging platforms. The cron system is internal (JSON file-based scheduler ticked by the gateway), so no external crontab executable is required. Session env vars must hold an explicit truthy string (``1``, ``true``, ``yes``, ``on``) — false-like values (``0``, ``false``, ``no``, ``off``) leave the tool disabled. Uses the shared ``env_var_enabled`` helper so every consumer of these flags agrees on the truthy set. renv_var_enabledHERMES_INTERACTIVEHERMES_GATEWAY_SESSIONHERMES_EXEC_ASK)rrrs rcheck_cronjob_requirementsrsQ&%%%%% ,-- . ?3 4 4 . ?, - -r<)registryrc tdid|ddd|dd|dd|dd|dd|dd|dd |d d d |d d |d d |d d|dd|dd|dd|dd|dd|dd|dd|dd|dd|dS)NrrMrrJrrrrrTrrr.rrrrrrr r rrtr7)rr)argskws rr s%w   xx"%%% xx!!! xx!!! *%%%   XXf      xx!!!  ### "4d;;; hhw xx!!!  xx!!!! "xx!!!# $XXn---% &88L)))' ("4555) *###+ ,*%%%- .xx 0111/ 0HH]+++1 2y!!!3 466,'''5 r<u⏰)rtoolsetschemahandlercheck_fnemojirQ)NNr6)re)NNNNNNFNNNNNNNNNNNNNNNNNN)U__doc__rloggingrVrWrSr;pathlibrtypingrrrrrrr getLogger__name__rtr>r?pathinsertr__file__parentrnr r r r rrrrrrrrrrrjrvrXrltools.threat_patternsr1r]r>rEr@rZr?rIrSrZr`rrrfrqrwrrrrrrrrrrr0r+rsrrrCRONJOB_SCHEMArtools.registryrrregisterr7r<rr sC    33333333333333000000  8 $ $ $)33ttH~~,344555"    R   $"""T?)<>>@PQ>)<>>@PQgReggiz{F1DFFHYZkQdkkknFG (KJJJJJ  HSHTHHHH 3 S T    <SS-S-U3S >-B----:cc,#%S/D2(4S>22222j"S#X"hsm"PXY\P]""""JEc3hECEEEE  Xc] 8C= TXY\T]    $Y^#QUbjknboCHSM*,08C=,0Xc],0,0,0,0^MsmM'/}M c]MMMM`$x}$#$$$$N7T#s(^7S#X7777v8<,D,D c3h,D'/},D #s(^,D,D,D,D`8<f f c3hf '/}f  #s(^f f f f Rsshsm26:"&mm c3hm%-c]m3-md38nmmmm`5d3i01d3i4! " !""&""  48!%,0!#(,$(!%&* $5y1y1 y1 SMy1 SMy1sm y1 3- y1 SM y1c]y1y1 C=y1 T#Y y1 C=y1smy1smy1 SMy1 SMy1 5d3i01!y1"#y1$tCy)%y1&c]'y1(tn)y1* ~+y1,SM-y1.#/y10sm1y123y14 5y16 7y1y1y1y1| y(g   `g  L g    Ug    pg "  =#g * !u+g 2   s 3g :  (+ i;g D   eViViVkVk e e eEg L   a k~k~lAlA a a a Mg T   jUg \ !  ] ]g @  (+?  Ag \ !6  ]g t  (+ @!!ug ~   S g F ! \ ""Gg PJUkk+AAHD.0///////     8( C""""""r<