(Gj;)' dZddlZddlZddlZddlZddlZddlZddlZddlZddl Z ddl Z ddl Z ddl Z n #e $rdZ YnwxYw ddlZn #e $rdZYnwxYwddlmZmZddlmZddlmZddlmZmZmZmZmZmZmZejeZddl m!Z"ddl#m$Z$ dd l%m%Z%d Z&n #e $rd Z&YnwxYwe'Z(e(d z Z)e)d z Z*e)dz Z+e)dz Z,dZ-ej.Z/ej0Z1e)dz Z2dZ3defdZ4ej5dZ6e7dhZ8de9defdZ:d|dee9deedee9fdZ;dee9efdee9effdZdee9efdee9effd#Z?d$efd%Z@d$efd&ZAd'ZBd(e9deCfd)ZDd*e9dee9effd+ZEd,edefd-ZFd.ed/edeGfd0ZHd.ed/edeGfd1ZIdd2d*ee9efd3ed4ee9dee9fd5ZJd*eKdeCfd6ZLd~d*ee9efd4ee9dee9fd7ZMd$eddfd8ZNdd9eGddfd:ZOd$edeePfd;ZQdeePfd<ZRdeePfd=ZSdeee9effd>ZTd?eee9effd@ZUd?eee9effdAZVdBee9dee9fdCZWdee9fdDZXd dEdedFeGdee9fdGZYdHedIedJedKedeee9ee9ff dLZZdee9efdeee9ee9ee9eGffdMZ[ ddNee9d*e9dOee9dPeeCdQee9dReee9efdee9deee9dIee9dHee9dJee9dSee9dTeee9ee9fdUeee9dBee9dKeGdVeeGdee9eff$dWZ\de9deee9effdXZ]GdYdZe^Z_d[e9deee9effd\Z`dd]eGdeee9effd^Zade9d_ee9efdeee9effd`Zbd~de9daee9deee9effdbZcde9deee9effdcZdde9deee9effddZede9deGfdeZf d|de9d9eGdfee9dgee9fdhZgde9deGfdiZhde9deGfdjZide9fdkZjdldmde9dneCdeGfdoZkdeee9effdpZldeee9effdqZmdrZndeCfdsZodtedueCdeCfdvZpde9de9fdwZqdee9fdxZr d|dyeee9e9fdzeee9dee9effd{ZsdS)z Cron job storage and management. Jobs are stored in ~/.hermes/cron/jobs.json Output is saved to ~/.hermes/cron/output/{job_id}/{timestamp}.md N)datetime timedelta)Path)get_hermes_home)OptionalDictListAnySetTupleUnion)now)atomic_replace)croniterTFcronz jobs.jsonticker_heartbeatticker_last_success<outputxreturnctdz S)z=Return the advisory lock path for the current cron directory.z .jobs.lock)CRON_DIR//home/rurouni/.hermes/hermes-agent/cron/jobs.py_jobs_lock_filer[s l ""rc #FKttdd}|rF|dzt_ dVtxjdzc_n#txjdzc_wxYwdSt5dt_d} t t t dd}|dt tj |tj nLtEttd| ttd dn9#ttf$r%}td |Yd}~nd}~wwxYw dV| t tj |tjnLtEttd| ttd dn#ttf$rYnwxYw|n#|wxYwn#| t tj |tjnLtEttd| ttd dn#ttf$rYnwxYw|w#|wxYwwxYwdt_n#dt_wxYw ddddS#1swxYwYdS) uSerialize a load_jobs→modify→save_jobs critical section. Combines the in-process threading lock (cheap mutual exclusion between the gateway's parallel tick threads) with a cross-process advisory file lock on ``/.jobs.lock`` (mutual exclusion between the gateway process and standalone ``hermes`` CLI invocations, which previously shared no lock at all — a `cron pause` could be silently clobbered by a concurrent gateway write, leaving a "paused" job still firing). The flock is blocking, but every critical section that uses it is short (field updates only — no agent execution), so contention resolves in milliseconds. If neither fcntl nor msvcrt is available the manager still provides in-process locking, matching the historical behaviour. Nested calls in the same thread reuse the held lock so legacy callers that invoke save_jobs() inside a broader mutation section don't deadlock or try to reacquire the advisory file lock. depthrNza+utf-8encodinglockingLK_LOCKzSjobs.json cross-process lock unavailable (%s); proceeding with in-process lock onlyLK_UNLCK)getattr_jobs_lock_stater_jobs_file_lock ensure_dirsopenrseekfcntlflockLOCK_EXmsvcrtfilenoOSErrorIOErrorloggerwarningLOCK_UNclose)rlock_fdes r _jobs_lockr:`s( $gq 1 1E !& ( EEE  " "a ' " " "  " "a ' " " " " " " ''!" ' J 00$III Q$K7777'.GFI..w~~/?/?QZA[A[]^___W% J J J FGHJJJJJJJJ J (&( ,!K????#/6GFI66w~~7G7GQWYcIdIdfghhh#W-  '7&( ,!K????#/6GFI66w~~7G7GQWYcIdIdfghhh#W-  '&'  " "Q  " & & & & "?''''''''''''''''''sAA(L9B4D.-K7.E$?EK7E$$K7(H),K7/A3G#"H#G74H6G77H:K7H%%K7)K'-A3J! K !J5 2K 4J5 5K 8K' K# #K''K7* L7LLLLidjob_idc*t|pd}|r |dvsd|vsd|vrtd|t|st|jrtd|t |z S)adResolve a job's output directory, rejecting any path-escape attempt. Job IDs are filesystem path components under ``OUTPUT_DIR``. A legacy or crafted ID containing ``..``, absolute paths, or nested separators would allow output writes/deletes to escape the cron output sandbox. Reject anything that isn't a single safe path component. >.../\z%Invalid cron job id for output path: )strstrip ValueErrorr is_absolutedrive OUTPUT_DIR)r<texts r_job_output_dirrJs v|   " " $ $D M4;&&#++KKKLLL DzzM4::#3MKKKLLL  rskillskillsc||r|gng}n(t|tr|g}nt|}g}|D]@}t|pd}|r||vr||A|S)zPNormalize legacy/single-skill and multi-skill inputs into a unique ordered list.Nr>) isinstancerClistrDappend)rKrL raw_items normalizeditemrIs r_normalize_skill_listrTs ~$,UGG" FC !H LL J$$4:2$$&&  $D **   d # # # rjobct|}t|d|d}||d<|r|dnd|d<|S)zLReturn a job dict with canonical `skills` and legacy `skill` fields aligned.rKrLrN)dictrTget)rUrRrLs r_apply_skill_fieldsrYs[cJ ":>>'#:#:JNN8valuefallbackc(||St|S)zFCoerce legacy/hand-edited nullable cron fields to strings for readers.)rC)rZr[s r_coerce_job_textr]s } u::rclt|d}|r|S|d}t|tr@dD]<}t||}|r|cS=n|t |SdS)Nschedule_displayschedule)displayrZexprrun_at?)r]rXrDrNrWrC)rUrar`keyrIs r_schedule_display_for_jobrfssww'9::;;AACCGwwz""H(D!!9  C#HLL$5$566<<>>D      8}} 3rct|}t|dd}t|d}||d<||d<t|d}|st|d}|p*|dr|ddndp|p|pd }|d d pd }||d<t ||d <t|d }|s|ddrdnd}||d <|S)a,Return a read-safe cron job shape for UI/API/tool/scheduler consumers. Older or hand-edited jobs can have nullable fields like ``prompt``, ``name``, or ``schedule_display``. Keep storage untouched on read, but ensure consumers never crash while formatting or running those records. r;unknownpromptnamescriptrLrr>cron jobN2r_stateenabledT scheduledpaused)rYr]rXrDrf)rUrRr<rirjrk label_sourcerns r_normalize_job_recordrss%S))J jnnT22I > >F jnnX66 7 7FJt!Jx JNN622 3 3 9 9 ; ;D  7!*..":":;;AACC  +5>>(+C+CK 8$Q''    CRC &&((6JJv%>z%J%JJ!" Z^^G44 5 5 ; ; = =E M)~~i>>L HJw rpathcb tj|ddS#ttf$rYdSwxYw)z|}tjd|}|st d|dt |d}|dd}dddd }|||zS) u Parse duration string into minutes. Examples: "30m" → 30 "2h" → 120 "1d" → 1440 zD^(\d+)\s*(m|min|mins|minute|minutes|h|hr|hrs|hour|hours|d|day|days)$zInvalid duration: 'z''. Use format like '30m', '2h', or '1d'r rri)mhd)rDlowerrematchrEintgroup)rrrZunit multiplierss rparse_durationr's  A H\^_ ` `E [YqYYYZZZ  A  E ;;q>>! D..K ;t$ $$rr`c|}|}|}|dr5|dd}t|}d|d|ddS|}t |dkrut d|ddDrTtstd  t|n'#t$r}td |d |d}~wwxYwd ||d Sd|vstj d|r tj|dd}|j)t#j}||}d|d|ddS#t$r}td|d |d}~wwxYw t|}t#t)|z} d| d|dS#t$rYnwxYwtd|d)uM Parse schedule string into structured format. Returns dict with: - kind: "once" | "interval" | "cron" - For "once": "run_at" (ISO timestamp) - For "interval": "minutes" (int) - For "cron": "expr" (cron expression) Examples: "30m" → once in 30 minutes "2h" → once in 2 hours "every 30m" → recurring every 30 minutes "every 2h" → recurring every 2 hours "0 9 * * *" → cron expression "2026-02-03T14:00" → once at timestamp zevery Nintervalr)kindminutesrac3@K|]}tjd|VdS)z ^[\d\*\-,/]+$N)rr).0ps r z!parse_schedule.._s@*+!1%%rzOCron expressions require 'croniter' package. Install with: pip install croniterzInvalid cron expression 'z': r)rrbraTz^\d{4}-\d{2}-\d{2}Zz+00:00tzinfooncezonce at z%Y-%m-%d %H:%M)rrcrazInvalid timestamp 'rzonce in zInvalid schedule 'z'. Use: - Duration: '30m', '2h', '1d' (one-shot) - Interval: 'every 30m', 'every 2h' (recurring) - Cron: '0 9 * * *' (cron expression) - Timestamp: '2026-02-03T14:00:00' (one-shot at time))rDr startswithrsplitlenall HAS_CRONITERrEr Exceptionrrr fromisoformatreplacer _hermes_now isoformatstrftimer) r`originalschedule_lower duration_strrpartsr9dt hermes_tzrcs rparse_scheduler<s$~~HH^^%%N  ** |))++  ..****    NN  E 5zzQ3/4RaRy pnoo o K X     K K KIIIaIIJJ J K    h"(#8(CC E'(8(8h(G(GHHBy 'MM0 ZZyZ11,,..Ebkk2B&C&CEE   E E EC8CCCCDD D E   **7!;!;!;;&&((,(,,          CX C C C  sDC$$ D.DD+BF11 G;GGAH"" H/.H/rctj}|jStjj}|||S||S)aReturn a timezone-aware datetime in Hermes configured timezone. Backward compatibility: - Older stored timestamps may be naive. - Naive values are interpreted as *system-local wall time* (the timezone `datetime.now()` used when they were created), then converted to the configured Hermes timezone. This preserves relative ordering for legacy naive timestamps across timezone changes and avoids false not-due results. Nr)rrrr astimezoner)r target_tzlocal_tzs r _ensure_awarersf $I y<>>,,..5zzz**55i@@@ == # ##rstoredcurrentcv|j|jdS||kS)u Return True when a stored aware timestamp uses a different UTC offset. Naive stored timestamps return False: they carry no offset to compare, and are normalized by ``_ensure_aware`` instead — they intentionally never take the offset-repair path. NF)r utcoffsetrrs r_timezone_offset_mismatchrs;} 6u     !2!2!4!4 44rc^|d|dkS)aReturn True when the stored local wall-clock time has not arrived yet. Cron schedules express local wall-clock intent. If Hermes/system local time changes after next_run_at was persisted, an old offset can make a future wall-clock run look due at the converted absolute time (for example 21:00+10 becomes 13:00+02). Comparing naive wall-clock values lets us distinguish that migration case from a genuinely missed run whose scheduled wall time has already passed. Nr)rrs r_stored_wall_clock_is_futurers+ >>> & &)E)E EEr last_run_atrrc|ddkrdS|rdS|d}|sdSttj|}||t t z kr|SdS)aReturn a one-shot run time if it is still eligible to fire. One-shot jobs get a small grace window so jobs created a few seconds after their requested minute still run on the next tick. Once a one-shot has already run, it is never eligible again. rrNrc)seconds)rXrrrrONESHOT_GRACE_SECONDS)r`rrrc run_at_dts r_recoverable_oneshot_run_atrs||Fv%%tt \\( # #F th4V<<==IC),ABBBBBB 4rc6d}d}|d}|dkr<|dddz}|dz}t|t||S|d krtr t }t |d |}|t}|t} t| |z }|dz}t|t||S#t$rYnwxYw|S) a(Compute how late a job can be and still catch up instead of fast-forwarding. Uses half the schedule period, clamped between 120 seconds and 2 hours. This ensures daily jobs can catch up if missed by up to 2 hours, while frequent jobs (every 5-10 min) still fast-forward quickly. ri rrrr rrrrb) rXmaxminrrrget_nextrr total_secondsr) r` MIN_GRACE MAX_GRACErperiod_secondsgracerrfirstseconds r_compute_grace_secondsrs II <<  D z!i33b8!#9c%33444 v~~,~ --CHV,c22DMM(++E]]8,,F &5.!?!?!A!ABBN"a'Ey#eY"7"788 8    D  s*BD DDct}|ddkrt|||S|ddkrf|d}|r5ttj|}|t |z}n|t |z}|S|ddkrts0t d| d d S|}|r!ttj|}t|d |}| t}|Sd S) zo Compute the next run time for a schedule. Returns ISO timestamp string, or None if no more runs. rrrrrrrzCannot compute next run for cron schedule %r: 'croniter' is not installed. croniter is a core dependency as of v0.9.x; reinstall hermes-agent or run 'pip install croniter' in your runtime env.rbN) rrrrrrrrr4r5rXrr)r`rrrlastnext_run base_timers rcompute_next_runrs[ --C6!!*8SkRRRR & Z ' '9%  8 !7 !D!DEEDi8888HHYw7777H!!### & V # #  NN V$$    4   K%h&<[&I&IJJI()44==**!!### 4rc>ttjttdd\}} t j|dd5}|ttj| t j | dddn #1swxYwYt||dS#t$r( t j|n#t$rYnwxYwwxYw)aAtomically write the current epoch time to ``path``. Uses the same tmpfile + ``atomic_replace`` pattern as ``save_jobs`` so a concurrent reader in another process (``hermes cron status``) never sees a torn/truncated file. Best-effort: failures are swallowed by callers. .tmpz.hb_dirsuffixprefixwr!r"N)r*tempfilemkstemprCrrvfdopenwritetimeflushfsyncr1r BaseExceptionunlinkr2)rtfdtmp_pathfs r_atomic_write_epochr9sOMMM#H fVTTTLB  Yr3 1 1 1 !Q GGC $$ % % % GGIII HQXXZZ  ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! x&&&&&   Ih        D  sTC*A.C  C* CC*CC** D5D  D DDDDsuccessc ttn#t$rYnwxYw|r( ttdS#t$rYdSwxYwdS)udRecord a ticker liveness signal, and optionally a successful-tick signal. The ticker calls this once per loop iteration. ``success=True`` additionally bumps the *last successful tick* marker. We track two distinct signals so `hermes cron status` can tell a thread that is merely *alive and looping* (heartbeat fresh, success stale) from one that is actually *firing jobs* (both fresh) — a ticker stuck failing every tick would otherwise keep the plain heartbeat fresh and falsely report healthy (#32612, #32895). Best-effort: a write failure must never disrupt the tick loop. N)rTICKER_HEARTBEAT_FILErTICKER_SUCCESS_FILE)rs rrecord_ticker_heartbeatrPs 12222         3 4 4 4 4 4    DD s $$A A Ac |d}tdtjt |z S#t $rYdSwxYw)Nr!r"g) read_textrDrrfloatr)rtraws r_epoch_file_agergsinngn..44663 eCjj0111 ttsAA A)(A)c*ttS)zSeconds since the ticker loop last iterated, or None if unknown. None = heartbeat file missing/unreadable (older build, never ran, or a torn read). Callers treat None as "cannot determine", not "dead". )rrrrrget_ticker_heartbeat_ageros 0 1 11rc*ttS)zHSeconds since the ticker last completed a tick WITHOUT raising, or None.)rrrrrget_ticker_success_agerxs . / //rc8ttsgSd} ttdd5}t j|}dddn #1swxYwYn#tj$rd} ttdd5}t j|d}dddn #1swxYwYn@#t$r3}t d|td ||d}~wwxYwYn?t$r3}t d |td ||d}~wwxYwt|trE|d g}|r+|r)t#|td |St|t&r-|r)t#|td|Stdt)|j)zLoad all jobs from storage.Frr!r"NT)strictz#Failed to auto-repair jobs.json: %sz*Cron database corrupted and unrepairable: zIOError reading jobs.json: %szFailed to read cron database: jobsz8Auto-repaired jobs.json (had invalid control characters)z3Auto-repaired jobs.json (bare list wrapped as dict)z7Cron database corrupted: expected {'jobs': [...]}, got )r* JOBS_FILEr|r+jsonloadJSONDecodeErrorloadsreadrr4error RuntimeErrorr3rNrWrX save_jobsr5rOtype__name__) _strict_retryrdatar9rs r load_jobsr sMMM      MH )S7 3 3 3 q9Q< B B BOAOOPPVW W X HHH 4a888?A??@@aGH$xx##  WT W dOOO NNU V V V $  R dOOO NNP Q Q Q YDJJDWYY  sA1A% A1%A))A1,A)-A11EC)C CC CC CE D%.DDE E&.EErcttjttjdd\}} t j|dd5}tj |t d|d | t j |d d d n #1swxYwYt|tt!td S#t"$r( t j|n#t&$rYnwxYwwxYw) z8Save all jobs to storage. Caller must hold _jobs_lock().rz.jobs_rrr!r")r updated_atr)indentN)r*rrrCrparentrvrrdumprrrrr1rr}rrr2)rrrrs r_save_jobs_unlockedrsqMMM#I,<(=(=fU]^^^LB  Yr3 1 1 1 !Q It;==3J3J3L3LMMqYZ [ [ [ [ GGIII HQXXZZ  ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! x+++Y   Ih        D  sUD A3C D CD C,D D?D-,D?- D:7D?9D::D?crt5t|ddddS#1swxYwYdS)zSave all jobs to storage.N)r:r)rs rrrs~ ""D!!!""""""""""""""""""s ,00workdirc|dSt|}|sdSt|}|st d|d|}|st d||st d|t|S)uhNormalize and validate a cron job workdir. Rules: - Empty / None → None (feature off, preserves old behaviour). - ``~`` is expanded. Relative paths are rejected — cron jobs run detached from any shell cwd, so relative paths have no stable meaning. - The path must exist and be a directory at create/update time. We do NOT re-check at run time (a user might briefly unmount the dir; the scheduler will just fall back to old behaviour with a logged warning). Returns the absolute path string, or None when disabled. Raises ValueError on invalid input. Nz+Cron workdir must be an absolute path (got zN). Cron jobs run detached from any shell cwd, so relative paths are ambiguous.zCron workdir does not exist: z!Cron workdir is not a directory: ) rCrDr expanduserrFrEresolver|is_dir)rrexpandedresolveds r_normalize_workdirrst g,,    C tCyy##%%H    ! !  [# [ [ [   !!H ??  ECCCDDD ??  IGXGGHHH x==rc ddl}ddlm}tdz }|sdS|d5}||pi}dddn #1swxYwY ddlm}| |}n#t$rYnwxYw||}| dpi}t|tr|pdSt|trU| d p| d}t|tr|pdSdS#t$rYdSwxYw) ucResolve the global default model the same way the cron ticker does. Mirrors the unpinned-model resolution in ``cron/scheduler.py`` ``run_job``: read ``config.yaml`` ``model.default`` (or the ``model`` alias / bare string form), applying the managed-scope overlay and env expansion. Used by ``create_job`` to snapshot the default model for unpinned jobs so a later swap of the global default is detected at fire time (#44585). Returns the resolved model string, or ``None`` if config is missing/empty or resolution fails (fail-open — caller treats ``None`` as "no snapshot"). rN)_expand_env_varsz config.yamlr!r") managed_scopemodeldefault)yamlhermes_cli.configrrr|r+ safe_load hermes_clirapply_managed_overlayrrXrNrCrDrW)r rcfg_pathrcfgr model_cfgrs r_resolve_default_model_snapshotr(s 666666"$$}4   4 ]]G] , , *..##)rC * * * * * * * * * * * * * * *  0 0 0 0 0 055c::CC    D s##GGG$$* i % % -??$$, , i & & /mmI..H)--2H2HG'3'' /}}.$.t ttsf/EE A-! E-A11E4A15E9BE B"E!B""AE2A)E E,+E,strip_trailing_slashr*ct|tsdS|}|r|d}|pdS)NrA)rNrCrDrstrip)rZr*rIs r_normalize_job_optional_textr-sI eS ! !t ;;==D {{3 <4rproviderrbase_urlno_agentct|}t|}t|d}t|rdSd}d}|y ddlm} ddi} |r|| d<| d i| } t | d pd } | pd}n#t$rd}YnwxYw|$ tpd}n#t$rd}YnwxYw||fS) apSnapshot unpinned inference axes for the provider/model drift guard. Agent cron jobs with unpinned provider/model follow global config at fire time. Capture the current resolution for each unpinned axis so a later global switch fails closed instead of silently changing spend. Pinned axes and no-agent script jobs intentionally carry no snapshot. Tr)NNNr)resolve_runtime_provider requestedexplicit_base_urlr.r>r) r-boolhermes_cli.runtime_providerr3rCrXrDrrr() r.rr/r0normalized_providernormalized_modelnormalized_base_urlprovider_snapshotmodel_snapshotr3runtime_kwargssnap snap_providers r!_compute_provider_model_snapshotsr@sc7x@@3E::6! H~~z'+$(N" % L L L L L L)40N" J6I23++==n==D 4 4 :;;AACCIIKKM - 5   % % % $    % "<>>F$NN " " "!NNN " n ,,s%A%B.. B=<B=C C#"C#ct|dt|dt|ddt|dfS)zBReturn the stored inference-routing fields in their semantic form.r.rr/Tr)r0)r-rXr6)rUs r_normalized_inference_axesrBHso %SWWZ%8%899$SWWW%5%566$SWWZ%8%8tTTT SWWZ !!  rrirjrepeatdeliveroriginrk context_fromenabled_toolsetsattach_to_sessionct|}||dkrd}|ddkr|d}||rdnd}tjjdd}t }t ||}t|}t| }t| d }t| tr!t|  nd}|pd}| r d | Dnd}|pd}t|}t|}t|tr|nd}|r|std t| tr,| r| gnd} n&t| trd | Dpd} nd} t|}ddlm}||||p|r|dndp|r|ndpd}t%||||\} }!id|d|p|dd d|d|d|r|dndd|d|d| d|!d|d|d|d| d|d |d!|d"|dd#d$d d%dd|t)|dddd||||d& }"|||"d'<t+5t-}#|#|"t1|#dddn #1swxYwY|"S)(uX Create a new cron job. Args: prompt: The prompt to run (must be self-contained, or a task instruction when skill is set). Ignored when ``no_agent=True`` except as an optional name hint. schedule: Schedule string (see parse_schedule) name: Optional friendly name repeat: How many times to run (None = forever, 1 = once) deliver: Where to deliver output ("origin", "local", "telegram", etc.) origin: Source info where job was created (for "origin" delivery) skill: Optional legacy single skill name to load before running the prompt skills: Optional ordered list of skills to load before running the prompt model: Optional per-job model override provider: Optional per-job provider override base_url: Optional per-job base URL override script: Optional path to a script whose stdout feeds the job. With ``no_agent=True`` the script IS the job — its stdout is delivered verbatim. Without ``no_agent``, its stdout is injected into the agent's prompt as context (data-collection / change-detection pattern). Paths resolve under ~/.hermes/scripts/; ``.sh`` / ``.bash`` files run via bash, anything else via Python. context_from: Optional job ID (or list of job IDs) whose most recent output is injected into the prompt as context before each run. Useful for chaining cron jobs: job A finds data, job B processes it. enabled_toolsets: Optional list of toolset names to restrict the agent to. When set, only tools from these toolsets are loaded, reducing token overhead. When omitted, all default tools are loaded. Ignored when ``no_agent=True``. workdir: Optional absolute path. When set, the job runs as if launched from that directory: AGENTS.md / CLAUDE.md / .cursorrules from that directory are injected into the system prompt, and the terminal/file/code_exec tools use it as their working directory (via TERMINAL_CWD). When unset, the old behaviour is preserved (no context files injected, tools use the scheduler's cwd). With ``no_agent=True``, ``workdir`` is still applied as the script's cwd so relative paths inside the script behave predictably. no_agent: When True, skip the agent entirely — run ``script`` on schedule and deliver its stdout directly. Empty stdout = silent (no delivery). Requires ``script`` to be set. Ideal for classic watchdogs and periodic alerts that don't need LLM reasoning. Returns: The created job dict Nrrrr rElocal Tr)cg|]D}t|#t|ESrrCrD)rts r zcreate_job..s9VVVas1vv||~~V3q66<<>>VVVrudno_agent=True requires a script — with no agent and no script there is nothing for the job to run.cg|]D}t|#t|ESrrMrjs rrOzcreate_job..s9OOO1A OA OOOr)check_gateway_lifecyclerlr.rr/r0r;rjrmrirLrKrr.r;r<r/rkr0rFr`r_rarC)times completedrorp) rn paused_at paused_reason created_at next_run_atr last_status last_errorlast_delivery_errorrDrErGrrH)ruuiduuid4hexrrrTr-rNrCrDrr6rErOr]cron.lifecycle_guardrSr@rXrr:r rPr)$rir`rjrCrDrErKrLrr.r/rkrFrGrr0rHparsed_scheduler<rnormalized_skillsr9r8r:normalized_scriptnormalized_toolsetsnormalized_workdirnormalized_no_agentnormalized_attach prompt_textrSrrr;r<rUrs$ r create_jobrjRsD%X..Ofkkv&((V^$1((' Z\\ crc "F -- ! ! # #C-eV<<3E::6x@@6xVZ[[[/9&#/F/FPF ))+++D)1TZjtVV3CVVVVpt-5+G44x..-78I4-P-PZ))VZ  #4  3   ,$$1=1C1C1E1EO **,,--4 L$ ' 'OO OOOWSW  "6**K=<<<<<K):;;;Q.s&11A$111111rz Job name 'u' is ambiguous — matches z jobs: z. Use the job ID instead.)rorpjoinsuper__init__r)selfrorpids __class__s rrvzAmbiguousJobReference.__init__s ii1111111  ' ' 'W ' 'c ' ' '     r) r __module__ __qualname____doc__rCr rr rv __classcell__)rys@rrnrns^;; C $tCH~*>          rrnroc<|sdSt}|D]}|d|krt|cS |fd|D}|sdSt|dkrt |d|Dt|dS)aUResolve a job reference (ID or name) to a job record. - Exact ID match wins (works even if a different job's name equals this ID). - Otherwise, case-insensitive name match. - If a name matches more than one job, raises AmbiguousJobReference so the caller can surface the matching IDs rather than silently picking one. Nr;cng|]1}|dpdk/|2S)rjr>)rXr)rrR ref_lowers rrOz#resolve_job_ref../s>RRR!f (;'B'B'D'D 'Q'QA'Q'Q'Qrr c,g|]}t|SrrsrQs rrOz#resolve_job_ref..4s!AAAq'**AAArr)r rsrrrn)rorrU name_matchesrs @rresolve_job_refr s t ;;D.. t9  (-- - - -  IRRRRtRRRL t <1# AALAAA    !a 1 11rinclude_disabledcRdtD}|s d|D}|S)z2List all jobs, optionally including disabled ones.c,g|]}t|SrrrQs rrOzlist_jobs..;s! : : : !! $ $ : : :rc>g|]}|dd|S)roT)rXrQs rrOzlist_jobs..=s+:::a155D#9#9::::r)r )rrs r list_jobsr9s9 : :ikk : : :D ;::4::: Krupdatesc @t|pi}|r2tddt |t 5t }t|D]\}}|d|krd|vr$|d}|dvrd|d<nt||d<t|}ti||}d|v} thd|ot||k} d |vsd |vrJt| d | d } | |d <| r| d nd|d <| r|d} t| trt!| } | |d<| d | d | d |d <| ddkrt#| |d<| rlt%| d| d| d| d\} }| |d<||d<| ddrF| ddkr-| dst#|d|d<|||<t'|t)||ccdddS dddn #1swxYwYdS)zCUpdate a job by ID, refreshing derived schedule fields when needed.z%Cron job field(s) cannot be updated: rrr;r>FNr>Nr`>rr/r0r.rLrKrr_rarnrqrZr.rr/r0rTr;r<roT)_IMMUTABLE_JOB_FIELDS intersectionrErtsortedr:r  enumeraterrBrYr6rTrXrNrCrrr@rrs)r<r bad_fieldsrirU_wdprevious_inference_axesupdatedschedule_changedinference_fields_changedrcupdated_scheduler;r<s r update_jobrAs '33GMrBBJ  SDIIfZ>P>P4Q4Q S S    9292{{oo7 27 2FAs4yF""G##i(+++)-GI&&);C)@)@GI&&@&E&E #)*N-O-OGM*' ;4U$[[44!++g..$[[44$[[44 5551!> 0A+,,:(){{9d++ O G0D0D0P0PY`YdYderYsYs0P)9'*:M)N)N &DG dOOO(a11 1 1s92929292929292927 2929292929292929292929292929292t 4sJLLLreasonct|}|sdSt|dddt|dS)z:Pause a job without deleting it. Accepts a job ID or name.Nr;Frq)rornrWrXrrrr)r<rrUs r pause_jobrs[ & ! !C t  D $0022#     rc t|}|sdSt|d}t|ddddd|dS)zWResume a paused job and compute the next future run from now. Accepts a job ID or name.Nr`r;TrprornrWrXrZ)rrr)r<rUrZs r resume_jobrs_ & ! !C t"3z?33K  D  !&      rc t|}|sdSt|dddddtdS)zKSchedule a job to run on the next scheduler tick. Accepts a job ID or name.Nr;Trprr)r<rUs r trigger_jobrs^ & ! !C t  D  !&==2244      rct|}|sdS|dt5t}t|}fd|D}t||krTt }t ||rtj| ddddS dddn #1swxYwYdS)zRemove a job by ID or name.Fr;c,g|]}|dk|S)r;r)rrR canonical_ids rrOzremove_job..s';;;a1T7l#:#:#:#:#:rNT) rr:r rrJrr|shutilrmtree)r<rUr original_lenjob_output_dirrs @r remove_jobrs8 & ! !C ut9L   {{4yy ;;;;4;;; t99| # #-\::N dOOO$$&& . n---         $                5sBC  CCrdelivery_errorc t5t}t|D]\}}|d|krt}||d<|rdnd|d<|s|nd|d<||d<d|d <|d r|d }|d } |d d } |did} | dko| duo | d ko| d k} | s | dz } | |d <| >| d kr8| | kr2||t|ddddSt|d||d<|d|did} | dvrVd|d<|dsd|d<t d|d|d| n)d|d<d |d<n|ddkrd|d<t|ddddSt d|ddddS#1swxYwYdS)uK Mark a job as having been run. Updates last_run_at, last_status, increments completed count, computes next_run_at, and auto-deletes if repeat limit reached. ``delivery_error`` is tracked separately from the agent error — a job can succeed (agent produced output) but fail delivery (platform down). r;rokrr[Nr\r] fire_claimrCrUrVrr`rrr rZ>rrrnztFailed to compute next run for recurring schedule (is the 'croniter' package installed in the gateway's Python env?)zyJob '%s' (%s) could not compute next_run_at; leaving enabled and marking state=error so the job is not silently disabled.rjFrorqrpz0mark_job_run: job_id %s not found, skipping save) r:r rrrrXpoprrr4rr5) r<rrrrrrUrrCrUrVrpreclaimed_oneshots r mark_job_runrs LSLS{{ooH H FAs4yF""!mm--//%(M"-4%ATT'M"18$BEEdL!-;)*%)L!778$$ ]F"JJw//E & ; : :I77:r2266v>>D*!-*!AI*&M ' .8!Q .7{+(UQYY9;M;M !$OLSLSLSLSLSLSLSLST&6c*os%K%KM"}%-77:r2266v>>D333'.G "ww|44!J -  < GGFCI66 */I'2G WWW%%11#.CL$ULSLSLSLSLSLSLSLS#R I6RRRYLSLSLSLSLSLSLSLSLSLSLSLSLSLSLSLSLSLSsD8I(CI(>I((I,/I,c t5t}t|D]\}}|d|kr|diddkrddddS|d}|sddddS|d}||d krddddS|d d }||kri||t |t d |d |d||dddd S|dz|d <t |t d|d |d|d |ddddSt d| ddddS#1swxYwYdS)upAtomically claim a finite one-shot job dispatch BEFORE execution. Increments ``repeat.completed`` under the cross-process jobs lock and persists the claim immediately, so that if the tick dies mid-execution (gateway kill, OOM, segfault, hard-timeout) the dispatch is not lost. This converts finite one-shot jobs from *at-least-once* to *at-most-times* semantics — a job that self-destructs fires at most ``repeat.times`` times instead of infinitely (issue #38758). Returns ``True`` if the caller may proceed to run the job, ``False`` if the dispatch limit is already reached (in which case the stale job is removed). Only claims jobs with ``schedule.kind == "once"`` and ``repeat.times > 0``. Recurring jobs (they use ``advance_next_run``) and infinite-repeat / no-repeat jobs are left unchanged and always allowed to proceed. r;r`rrNTrCrUrrVu5Job '%s': dispatch limit reached (%d/%d) — removingrjFr z Job '%s': claimed dispatch %d/%du|claim_dispatch: job_id %s not in store — proceeding without claim (handed-in job dict; nothing to persist a claim against)) r:r rrXrrr4infodebug)r<rrrUrCrUrVs rclaim_dispatchr.s" ++{{oo" " FAs4yF""wwz2&&**622f<< ++++++++WWX&&F ++++++++JJw''E} ++++++++ ;22IE!! $ KGGFCI..  5++++++++8#,a-F;  dOOO LL2D **{#     I++++++++L   G    W++++++++++++++++++s2AG;G G A8GAG2GG"Gc t5t}|D]}|d|kr|did}|dvrddddSt}t |d|}|r;||dkr"||d<t |ddddSddddS ddddS#1swxYwYdS) uPreemptively advance next_run_at for a recurring job before execution. Call this BEFORE run_job() so that if the process crashes mid-execution, the job won't re-fire on the next gateway restart. This converts the scheduler from at-least-once to at-most-once for recurring jobs — missing one run is far better than firing dozens of times in a crash loop. One-shot jobs are left unchanged so they can still retry on restart. Returns True if next_run_at was advanced, False otherwise. r;r`r>rrNFrZT)r:r rXrrrr)r<rrUrrnew_nexts radvance_next_runrms {{  C4yF""wwz2..226::333 "mm--//+C OSAA CGGM,B,B B B)1C &dOOO#s%A C9)A&C9C9*C99C=C=ctjdd}|r|S ddl}|}n#t $rd}YnwxYw|dtjS)zStable-ish identifier for claim attribution/debugging (NOT correctness). Uses ``HERMES_MACHINE_ID`` if set, else hostname + pid. The CAS correctness comes from the file lock + the fresh-claim check, not from this value. HERMES_MACHINE_IDr>rNrh:)rvgetenvrDsocket gethostnamergetpid)explicitrhosts r _machine_idrs y,b117799H !!##  " "RY[[ " ""sA AAi,)claim_ttl_secondsrc\t5t}|D]q}|d|kr|ddr|ddkrddddSt}|d}|rb t t j|d }||z |krddddSn#t$rYnwxYw| td |d<|d id }|d vr/t|d | }|r||d<t|ddddS ddddS#1swxYwYdS)uTAtomically claim a job for a single external 'fire' (multi-machine at-most-once). Returns True iff THIS caller won the claim. Used by the external-provider fire path (``CronScheduler.fire_due``) when an external scheduler (Chronos) signals a job is due across N gateway replicas: exactly one wins. Single-machine deployments always win. Under the file lock: reject if the job is missing/disabled/paused. If a fresh claim (younger than ``claim_ttl_seconds``) already exists, lose. Otherwise stamp a ``fire_claim`` and, for recurring jobs, advance ``next_run_at`` (mirrors ``advance_next_run``'s at-most-once bump so a stale re-delivery for the old time can't re-fire). One-shots keep ``next_run_at`` but the fresh ``fire_claim`` blocks a duplicate retry for the same fire. ``mark_job_run`` clears the claim on completion so a re-armed recurring job is claimable again next fire. The stale-claim TTL means a machine that crashed after claiming but before completing doesn't wedge the job forever — after the TTL another fire can reclaim it. r;roTrnrqNFrat)rbyr`r>rrrZ) r:r rXrrrrrrrrrr) r<rrrUrexisting claimed_atrnxts rclaim_job_for_firersY* {{  C4yF""779d++ swww/?/?8/K/K --Cww|,,H !.x/Ehtn/U/U!V!VJj(7799.s! D D Dq  " " D D DrFroTrZr`rrrzone-shotN>rrz4Job '%s' had no next_run_at; recovering %s run at %srjr;rzlJob '%s' next_run_at offset changed (%s -> %s). Recomputing cron run to preserve local wall-clock intent: %sz~Job '%s' missed its scheduled time (%s, grace=%ds). Running now; next run provisionally set to: %s (re-anchored on completion)rrCrUrVruNJob '%s': one-shot dispatch limit reached (%d/%d) — removing stale due entry)rr copydeepcopyrXrrrr4rrrrrrrrrremoverPr)rraw_jobsrdue needs_saverUrr`rrecovered_next recovery_kindrjraw_next_run_dt next_run_dtrrrCrUrVs rrrs --C{{H D DDM(,C,C D D DD CJTTwwy$''  77=))% wwz2..H<<''D9GGM22N +9BJJdM" )d.B&B&B!1(CMMOO!L!L!)$(M! !/C %H KKFD **       d8s4y(((6B}%!%JE) #0::77:r**||F###O44 " FNNs"")/3??#,_cBB#(#--//BBH  SGGFCI..#--//MMOO #B$x3t9,,,4=)%) - #   +844E+++{1B0Q0Q0S0SV[0[0[,HcmmooFF"KK6D 22  "'""d8s4y0008B}-)-J!E1v~~**!"JJw//E & ; : :I(UQYY9;M;M ;GGFCI66%! #+&&B!$x3t944 ( 3 3 3-1 % 5! JJsOOO( Jrrmc ddlm}|pi}t|tr|dini}t |dt S#t$r t cYSwxYw)zVResolve the per-job output-file retention cap from config (``cron.output_retention``).r) load_configroutput_retention)r!rrNrWrXr_CRON_OUTPUT_DEFAULT_KEEPr)rr&cron_cfgs r_cron_output_keeprs)111111kmm!r*4S$*?*?G37762&&&R8<< 24MNNOOO )))(((()sA&A))A=<A=rkeepc^|dkrdS td|dDdd}n#t$rYdSwxYwd}||dD]T} ||dz }#t$r+}td |j|Yd}~Md}~wwxYw|S) aRemove the oldest ``*.md`` run-output files beyond *keep*. Returns count deleted. Mirrors the quick-snapshot retention in ``hermes_cli.backup._prune_quick_snapshots``: output filenames are timestamp-based (``%Y-%m-%d_%H-%M-%S.md``) so a reverse lexical sort orders newest-first, and everything past *keep* is the tail to drop. A non-positive *keep* disables pruning. Pruning failures are swallowed so they can never break output saving. rc3BK|]}||VdSN)is_file)rrs rrz$_prune_job_output..s/ C C1qyy{{ CQ C C C C C Crz*.mdc|jSr)rj)rs rz#_prune_job_output..s!&rT)rereverseNr z"Failed to prune cron output %s: %s)rglobr2rr4rrj)rrfilesdeletedstaleexcs r_prune_job_outputrs qyyq C C++F33 C C C      qqGtuuPP P LLNNN qLGG P P P LL=uz3 O O O O O O O O P Ns'0; A A A55 B*?!B%%B*c tt|}|ddt|t d}||dz }t jt|dd\}} tj |dd 5}| || tj |d d d n #1swxYwYt||t!|n5#t"$r( tj|n#t&$rYnwxYwwxYwt)|t+|S) zSave job output to file.Trz%Y-%m-%d_%H-%M-%Sz.mdrz.output_rrr!r"N)r*rJrrzrrrrrCrvrrrrr1rr}rrr2rr)r<rr timestamp output_filerrrs rsave_job_outputrsMMM$V,,N555 &&':;;I i#4#4#44K#N(;(;FS]^^^LB  Yr3 1 1 1 !Q GGFOOO GGIII HQXXZZ  ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! x---[!!!!   Ih        D  n&7&9&9::: sUD3,AD< D3D  D3D "D33 E%>EE% E E%E  E%c t}n:#t$r-tddt cYSwxYwt }|D]}t |t st|d|dD]M}t| d}|r| |N|S)u>Return the set of skill names referenced by ANY cron job. Includes paused and disabled jobs deliberately: a paused job never fires, so its skills never get a ``bump_use`` from the scheduler, yet resuming it must still find its skills present. The curator uses this set to protect referenced skills from inactivity archival — a skill a live job depends on is "in use" regardless of when it was last loaded. Best-effort: a corrupt/unreadable jobs store returns an empty set rather than raising, so a cron issue can never break the curator. z0referenced_skill_names: failed to load cron jobsT)exc_inforKrLrA) r rr4rsetrNrWrTrXrCrDlstripadd)rnamesrUrjcleaneds rreferenced_skill_namesrs{{  GRV WWWuu eeE###t$$  )#'''*:*:CGGH umbrella_skill_name``. pruned: list of skill names that were archived with no forwarding target. Returns a report dict:: { "rewrites": [ { "job_id": ..., "job_name": ..., "before": [...], "after": [...], "mapped": {"old": "new", ...}, "dropped": ["old", ...], }, ... ], "jobs_updated": N, "jobs_scanned": M, } Best-effort: exceptions from loading/saving propagate to the caller so tests can assert behaviour; the curator invocation site wraps this call in a try/except so a failure here never breaks the curator. r)rewrites jobs_updated jobs_scannedFrKrLNTr;rj)r<job_namebeforeaftermappeddroppedz2Curator rewrote skill references in %d cron job(s)) rWrkeysr:r rTrXrPrOrr4rr) rr pruned_setrrchangedrU skills_beforerr new_skillsrjtargets rrewrite_skill_refsr sd *++LV\r""J#l''))***J F F1EEE 3 3 {{)+" " C1#'''2B2BCGGHDUDUVVM  %'F!#G$&J% , ,<'')$/F#)F4L2& ":":"))&111Z''NN4((((++%%d+++ ' &CM,6@:a==DCLG OO''$--GGFOOr)F)NNNNNNNNNNNNNFN)tr| contextlibrrloggingrr threadingrrvrr^r- ImportErrorr0rrpathlibrhermes_constantsrtypingrrr r r r r getLoggerrr4 hermes_timerrutilsrrrr HERMES_DIRrrrrTICKER_INTERVAL_SECONDSRLockr)rJr(rHrrcontextmanagerr: frozensetrrCrJrTrYr]rfrsrzr}r*rrrrr6rrrrWrrrrrrrrr rrrr(r-r@rBrjrl LookupErrorrnrrrrrrrrrrrrrrrrrrrr rrrrsY    LLLL EEEMMMM FFF((((((((,,,,,,??????????????????  8 $ $****** !!!!!!LLLLL&_   & & ( (   { " !#55!66  ")/##"9?$$  #####  ;';';'B" 4&)) C D     #x}X\]`Xa"T#s(^S#XC34S>c" tCH~ $sCx.    F d     t    %c%c%%%%*aSaT#s(^aaaaH$h$8$$$$& 5h 5 5d 5 5 5 5 F FH F F F F F""& 38n #  c] 6Tc@++tCH~+HSM+U]^aUb++++ddt.Td.$8E?2(5/222200000-4S#X'----`d4S>2&"Dc3h(""""  (3-B$#$$$$NNSdW_`cWd*-*- *- *-  *-  8C=(3- '( *-*-*-*-ZDcNuXc]HUXM[cdg[hjn=n7o !'+"&"" 48,0!(,#uu SMuu 3-u SM u c] u T#s(^ $ u C=u T#Y u C=usmusmu SMu5d3i01utCy)uc]u !u" ~#u$ #s(^%uuuupCHT#s(^4      K    22$sCx.!922222d38n1EEsET#s(^Ec3h8PEEEEP  c 8C= HT#s(^*&&&&$ad4S>2aaaaR)3))))d##:CFC<.2"&n n 4S>*n T#Y n  #s(^n n n n n n s05??AAAB!!B+*B+