+ jHjP (a0t$Rt^RIHt^RIt^RIt^RIt^RIt^RIH t ^RI H t ]P!R4t RtRt]!0R"m4tR#t]R$,t]R%,t]!]P*]P,]P.]P0]P2]P4]P604tRR ltR R ltR R ltRRlt RRlt!RRlt"!RR4t#RRlt$R&t%RRlt&]'!4t(R])R&RRlt*RRlt+^R I,H-t.^R!I,H/t0R#)'aCron pre-run preflight: transient provider-resolution error classification, provider-key / delivery-target / skills checks, and the shared-route adapter view used by satellite profiles. Split out of ``cron.scheduler``. Import names from this module directly (``cron.scheduler`` only imports the few it calls itself). Origin-resident helpers and sibling split modules are reached late-bound (``_sched`` / module refs at the bottom) so monkeypatching the defining module works. ) annotationsN)Optional)cron_env_settingzcron.schedulerz[blocked_config]z[blocked_config:silent]c V^8dQhRRRR/#)exc BaseExceptionreturnbool)formats"=/home/ubuntu/.hermes/hermes-agent/cron/scheduler_preflight.py __annotate__r)s$$m$$caa^RIpR Uu0uF!p\W4'gK\W4kK# pp\4pTpVEe"\ V4V9EdVP \ V44\ V4P;'gRo\V4P4o\ V4P\9dR#\;QJdV3RlR 4F 'gK RM RM!V3RlR 44'dK\;QJd#V3Rl\4F 'gK RM RM!V3Rl\44'dR#\V\4'd\WQP 4'dVP"V9dR#M\VRR4\$9dR#\;QJd#V3Rl\&4F 'gK RM RM!V3Rl\&44'dR#\;QJd#V3R l\(4F 'gK RM RM!V3R l\(44'dR#VP*;'g VP,pEK&R#uupi) zTrue when primary provider resolution failed for a transient network reason (DNS blip, ConnectError...). Must be eligible for ``fallback_providers`` like AuthError, else a healthy fallback rung is never tried and the job dies before the first model call.NTc3,<"TF qS9xK R#5iNr ).0mmodules& r 7_is_transient_provider_resolve_error..>sE$DqF{$DFc3,<"TF qS9xK R#5irr rneedlemsgs& r rr>sNA(?fcM(?rerrnoc3,<"TF qS9xK R#5irr rs& r rrGsJ/IVS=/Irc3,<"TF qS9xK R#5irr rs& r rrJs@+?}+?r) EAI_NONAME EAI_AGAINEAI_FAIL EAI_NODATA)httpxhttpcoreaiohttp)sockethasattrgetattrsetidaddtype __module__strlower__name___TRANSIENT_NET_EXC_NAMESany_TRANSIENT_HTTP_NEEDLES isinstanceOSErrorgaierrorr_TRANSIENT_ERRNOS_TRANSIENT_OSERROR_NEEDLES_DNS_FAILURE_NEEDLES __cause__ __context__)rr(n eai_transientseencurrrs& @@r $_is_transient_provider_resolve_errorrB)s %Z$Yq 6  $Y UD#&C /bgT1 Cc%%++#hnn 9  !9 9 3E$DE333E$DE E E##NA(?NA###NA(?NAKAKA c7 # ##//99 -.gt,0AAsJ/IJsssJ/IJJJ 3@+?@333@+?@ @ @mm..s 9s I(I(c V^8dQhRRRR/#)rcfgdictr r r )r s"r rrPsZZZ$ZrcT;'g/PR4p\V\4'*;'gVPRR4RJ#)zAPreflight is ON unless ``cron.preflight`` is literally ``false``.cron preflightTF)getr6rE)rDcron_cfgs& r _cron_preflight_enabledrKPs? rv&H(D) ) Y YX\\+t-LTY-YYrc$V^8dQhRRRRRR/#rjobrErDr Optional[str]r )r s"r rrVs!$$t$$$=$rc 4\P!W4'dR#\TP R4\ 4'dTP R4M/pTP R4;'gG\ T;'g/P R4;'gR4P4;'gRpTP R4;'g\R4;'gRp^RI H pH p^R I H pR TR T/pTP R 4'dTP R 4TR &T!R/TBR# \dR#i;i TdBp T!T 4'dRp ? R#RT R\4 RTP R4 R2uRp ? #Rp ? i\dR#i;i)uTREAD-ONLY probe: would provider resolution fail for lack of a key? Mirrors run_job's requested-provider computation. Skipped when the job has a fallback chain — auth-fallback may legitimately rescue a missing primary key. A pinned job has none (``_job_fallback_chain``), so its missing key blocks even when the global chain is configured.NrGprovidermodel_providerrmodel HERMES_MODEL) AuthErroris_rate_limited_auth_error)resolve_runtime_provider requested target_modelbase_urlexplicit_base_urlzprovider credential missing:  zv. Set the provider API key in .env (or `hermes setup`) for that home, or pin a working provider via `hermes cron edit r,z --provider

`.r )_sched_job_fallback_chain Exceptionr6rIrEr0striprhermes_cli.authrUrVhermes_cli.runtime_providerrW_credential_store_scope_label) rNrD _cron_cfgrXrSrUrVrWkwargsrs && r _preflight_check_provider_keyrfVsu   % %c / / 0 $.cggfot#D#D"I  aasIOO#8#89I#J#P#PbQWWYaa]a GGG  F F 0 @ F FBEEHy.%@ 77:  *-''**=F& ' *6* 9    %c * *+C52O2Q1RS6wwt}o. 0 sGD0/"EE0 D?>D?F F"F?F FFFcV^8dQhRR/#)rr r0r )r s"r rr}s d ds drcT^RIHp^RIHpRV!4;'gR RV!4 R2#)a``[profile '', HERMES_HOME ]`` for the home this preflight read credentials from. The verdict must name the store it judged: a scheduler process whose home differs from the shell where "the same credential works" (Docker HOME vs HERMES_HOME, a multiplexed satellite profile, a gateway launched without the shell's env) otherwise reports a bare "No credentials stored" that cannot be told apart from a real login gap (#116213). )get_active_profile_name)get_hermes_homez [profile 'defaultz', HERMES_HOME ])hermes_cli.profilesrihermes_constantsrj)rirjs r rcrc}s1<0 /1>>Y?O`Naab ccrcV^8dQhRR/#)rr listr )r s"r rrs**$*rc^RIHpHpV!4p\P!V!44pVP 4P RR7VP 4P RR78Xd.#^RIHpV!VP 44pVPR4pVf>\VPR4\4'dVR,PR4p\V\4'g.#^RI Hp^RIHpV!V4U u.uF3p V P"'gKV!V P$4'gK1V NK5 up #uup i \&d\(P+R R R 7.u#i;i) u_Primary gateway ``profile_routes`` targeting the profile being served; ``[]`` if this IS the primary home. Satellite crons are ticked and delivered by the primary gateway (a satellite holding its own token is a ``duplicate_credential`` fatal). Reads the primary home's YAML layers (user file + managed-scope overlay, top-level or nested ``gateway.``) through the same loader ``load_gateway_config()`` uses, without bridging platform config into this process. Shared by preflight rescue and delivery-time resolution so they cannot drift. Under ``gateway.multiplex_profiles`` a satellite profile's cron jobs are ticked by the primary gateway's in-process ticker (#69377) and delivered through the primary gateway's live adapters — the satellite home never holds the platform credentials itself (giving it a token of its own is a ``duplicate_credential`` fatal). )get_default_hermes_rootrjF)strict)read_yaml_layersprofile_routesgateway)parse_profile_routes)profile_matches_homez0primary-gateway profile-route lookup unavailableTexc_info)rnrrrjr]Path expanduserresolvegateway.config_loaderrtrIr6rErpgateway.profile_routingrwrmrxenabledprofiler_loggerdebug) rrrj primary_home current_homertlayered routes_rawrwrxroutes r (_primary_profile_routes_for_current_homers?M.0 {{?#45  # # % - -U - ;&&(000> ?I ;"<#:#:#<=[[!12  *W[[-CT"J"J +//0@AJ*d++I@<3J? ?e}} !5emm!D E?     GRV W s=A.E1BE7E E &E E E E$E54E5c V^8dQhRRRR/#)r platform_namer0r r r )r s"r rrs  # $ rcaVP4o\;QJd'V3Rl\44F 'gK R# R#!V3Rl\444#)zTrue when the primary gateway routes this platform to the profile being served. scheduler is currently serving (preflight rescue, #97476). c3p<"TF+p\VP4P4S8HxK- R#5ir)r0platformr1)rr platform_keys& r rA_delivery_platform_routed_from_primary_gateway..s/?E ENN!!#|3?s36TF)r1r4r)rrs&@r ._delivery_platform_routed_from_primary_gatewayrsT !&&(L 3=?3333=? rc<]tRt^tRtRRltRRltR RltRtR#) SharedRouteAdaptersudRead-only adapter map for a credentialless satellite profile. ``get(platform, target)`` resolves the PRIMARY adapter iff the inbound route matcher (``ProfileRoute.matches``) accepts the target; anything else (unmatched target, disabled route, other profile, or target-less ``get(platform)``) is a miss — fail closed, never the default bot. See #101113. cV^8dQhRR/#)rr Noner )r s"r r SharedRouteAdapters.__annotate__s**D*rc n\T;'g/4Vn\T;'g.4VnR#r)rE_primaryrp_routes)selfprimary_adaptersroutess&&&r __init__SharedRouteAdapters.__init__s)-334 FLLb) rcV^8dQhRR/#)rr r r )r s"r rrs::$:rc f\VP4;'d\VP4#r)r rr)rs&r __bool__SharedRouteAdapters.__bool__s"DMM"99tDLL'99rNc V'gV#VPPV4pVfV#\\VRV44P 4p\VPR4;'gR4;'gRpVPR4pV'd \V4MRpVP Fp\VP 4P 4V8wdK-VP'gVP'gKSVP\VP 4VPWgR7'gKVu# V#)Nvaluechat_idr thread_id)guild_idrr) rrIr0r*r1rrrrmatchesr) rrtargetrkadapterrrrrs &&&& r rISharedRouteAdapters.getsN--##H- ?N78Wh?@FFH fjj+11r2::dJJ{+ &/C NT \\E5>>"((*l:MMMU___}}ENN#enng"r)rr)NN) r2r/ __qualname____firstlineno____doc__rrrI__static_attributes__r rr rrs*:rrc V^8dQhRRRR/#rrNrEr rOr )r s"r rrs9949M9rc\P!VPRR44p\P!\P!VRR74pV.pW!8wdVP V4.pVFpVP R4FpVP 4pV'dVP4R9dK2\P!V4eKLVP VP R^4^,P 44K K V'gR#RpVFp\P!V4'g RV R 2u#VfT^R I H p V !4p V P4U u0uFqPkK pp V\P!V4,pVP4V9gK\%V4'dKRV R 2u# R#uup i \d\ P#R RR 7R#i;i)uCheck delivery targets resolve to configured platforms. ``local``/``origin``/``all`` are never checked (no gateway-config load). Unknown platform always blocks; known platform blocks only if the gateway config loads AND reports it unconnected; config load failures fail OPEN. ``failure_deliver`` gets the same rules — a typo'd failure platform would otherwise only surface when a failure occurs (NS-788).deliverlocalT) for_failure,N:zdelivery platform 'zu' is not a known cron delivery target. Fix the job's `deliver` value or configure the platform's gateway credentials.)load_gateway_configuLpreflight: gateway config unavailable — skipping delivery credential checkryz~' has no gateway credentials configured (not connected). Configure it via `hermes setup` or change the job's `deliver` target.>allrorigin) _delivery_normalize_deliver_valuerI_delivery_lane_valueappendsplitr`r1parse_bot_chat_deliver_token_is_known_delivery_platformgateway.configrget_connected_platformsr!_relay_fronted_delivery_platformsr_rrr) rN deliver_valuefailure_deliver_value lane_valuesplatform_parts lane_valuepart connectedrrgateway_configps & r _preflight_check_deliveryrs 66swwy'7RSM%>>&&s=? /K-01 "N! $$S)D::!4!6.<.T.T.VW.VWW.V WYHHSS     ! 2C=QQ&m_5GG 5(> )X  0:>@  s$ G(G<GG"G=<G=c V^8dQhRRRR/#rr )r s"r rr/s-rc ^^RIHpV!V4pV'gR#^RIHpVFp\P !V!V44p\T\4'dTPR4'gKOTPR4'gTPR4R8XgK~\UUUu.uF8wrgTPT4;'g.FpTPT4NK K: p pppRPT 4;'gRp R T R T R 2u# R# \ dEKi;iuupppi) zBlock only on an affirmative ``setup_needed`` verdict from ``skill_view``; skills that fail to load fall through to ``_build_job_prompt``'s skipped-skill handling (fail-open).)_job_skill_namesN) skill_viewsuccess setup_neededreadiness_status, zrequired setup incompletezattached skill 'z' is not ready: missing zF. Provide the missing prerequisites or detach the skill from this job.) cron.scheduler_promptrtools.skills_toolrjsonloadsr_r6rErI_SKILL_MISSING_FIELDSr join) rNr skill_namesr skill_namepayloadkeyfmtnamemissingdetails & r _preflight_check_skillsr/s7"3'K ,!  jjJ!78G'4(( I0F0F  ;;~ & &'++6H*I^*[!6 5HC#KK,222D 4 2! 5  YYw'FF+FF":,.F('' "& !    sD)D( D(  D%$D%r+_RECONNECTING_WARNEDc$V^8dQhRRRRRR/#rMr )r s"r rrQs!//t/$/=/rcRaa a VPR4;'g.Uu.uFp\V4NK ppV'gR#^RIHp^RIHp^RIHo VUu.uF#pW$!V49gKV!V4'dK!VNK% pp\V 3RlV44o \VPRR44o\PVV 3R l\\444S Uu.uFpSV3\9gKVNK ppV'dF\PV3R lV44\PR SR PV44S 'dVUu.uF q"S 9gK VNK ppV'gR#R R P\V44 R2#uupiuupiuupiuupi)aReason when an MCP server the job's own ``enabled_toolsets`` names resolves to zero tools. Runs AFTER cron MCP discovery. The server's toolset alias is process-global while its tools are registered per profile overlay, so under a multiplexer a job can name a server that is connected for another profile and build a tool-less agent that ``quiet_mode`` never reports. Only servers the job explicitly asked for count; the implicit enabled-server merge does not. enabled_toolsetsN)enabled_mcp_server_names)resolve_toolset)mcp_server_reconnectingc3H<"TFpS!V4'gKVxK R#5irr )rrrs& r r0_empty_requested_mcp_toolsets..esT746Md6S$$7s" "r,?c3f<"TF&q^,S8XgKV^,S9gK"VxK( R#5i)Nr )rrjob_id reconnectings& r rris/+f1Vv5E#a&XdJd1s 1 1 1c3,<"TF pSV3xK R#5irr )rrrs& r rrms#HxtVTNxruJob '%s': MCP server(s) %s named in enabled_toolsets are reconnecting — running without their tools until they recover (a server parked on a permanent error blocks the job instead)rzMCP server(s) u named in this job's enabled_toolsets resolved to zero tools for this profile (never connected for this profile, or connected for another profile only). If the server is only temporarily unreachable this clears by itself — the check re-runs on every dispatch and the job resumes once the server reconnects. If the name is wrong or belongs to another profile, fix the server or remove it from the job's toolsets.)rIr0hermes_cli.tools_configrtoolsetsrtools.mcp_tool_discoveryrsortedrdifference_updaterpupdaterwarningr) rNrDrrXrrrunwarnedrrrs && @@@r _empty_requested_mcp_toolsetsrQs),0B(C(I(Ir(IK(ItT(IIK @(@ )W 2377@OPT@Ut GW T7TTL s# $F**+f01+ff!-\&$G[1[H\###Hx#HH  & ((; =$+HGD'_preflight_job_config..s !>sC!Hrskillsc<\S4#r)rrNsr rrs 237rdeliveryc<\S4#r)rrsr rrs 6s;ru*preflight check %s raised — failing openTryN)r_rr)rNrDrcheckreasonsff r _preflight_job_configr ss HI 78 ;<>  WF 6M>    LLEtVZL [  s:#A! A!) scheduler)scheduler_delivery> PoolTimeout ReadTimeout ConnectError NetworkError WriteTimeout ClientOSErrorConnectTimeoutTimeoutExceptionServerTimeoutErrorClientConnectorErrorClientConnectorDNSError)znodename nor servnamezname or service not known)z$temporary failure in name resolutionznetwork is unreachable)zfailed to resolvezconnection refusedz timed outtimeout))&missing_required_environment_variableszenv ${})missing_required_commandsz command '{}')missing_credential_fileszcredential file {})1__conditional_annotations__r __future__rrrloggingostypingrcron.env_settingsr getLoggerrBLOCKED_CONFIG_MARKERBLOCKED_CONFIG_SILENT_MARKER frozensetr3r;r:r5 ECONNREFUSED ECONNRESET EHOSTUNREACH ENETUNREACHENETDOWN ETIMEDOUTEAGAINr9rBrKrfrcrrrrrrr+r__annotations__rr rGr r]r r)rs@r r/s*#  .   + ,+8$&N15FF48GG ((%*<*O>OQVQ_Q_ OOU\\#$ $NZ $N d*Z &&R9z8 > Ec!/d0%0r