+ jHjvT.Rt^RIHt^RIt^RIt^RIt^RIHt^RI H t ]P!R4t RRlt RR ltR R ltR tR tRtRtRtRtRtRtRt]P2!R]P4!]4 R]P4!]4 24t]P2!R]P4!]4 R]P4!]4 24tRRltRRltRRltRRlt Rt!R/R R!llt"R"R#R$R#R%R/R&R'llt#R(R)lt$R*R+lt%^R,I&H't(^R-I&H)t*^R.I&H+t,R#)0aCron job prompt assembly: context_from injection, skill loading, the assembled-prompt injection scan, and the credential-exfil / config-block guards. Split out of ``cron.scheduler``. Import names from this module directly (``cron.scheduler`` only imports the few it calls itself). Origin-resident helpers and sibling split modules are reached late-bound (``_sched`` / module refs at the bottom) so monkeypatching the defining module works. ) annotationsN)now)Optionalzcron.schedulerc V^8dQhRRRR/#) script_outputstrreturnbool)formats":/home/ubuntu/.hermes/hermes-agent/cron/scheduler_prompt.py __annotate__rsRRCRDRcT;'gRP4Uu.uFqP4'gKVNK ppV'gR#\P!VR,P44p\ T\4'*;'gTPRR4RJ#uupi \P\ 3dR#i;i)u'Wake gate: False only if the last non-empty stdout line is JSON ``{"wakeAgent": false}`` (agent skipped entirely — no LLM run, no delivery); anything else wakes normally. Any other output (non-JSON, missing flag, gate absent, or ``wakeAgent: true``) means wake the agent normally. See #1232. T wakeAgentF) splitlinesstripjsonloadsJSONDecodeError ValueError isinstancedictget)rlinestripped_linesgates& r _parse_wake_gater s)6(;(;'G'G'IZ'ItZZ\dd'INZ zz.,2245$% % Q Q+t)DE)QQ[  * -sB(B( +B--C  C c ,V^8dQhRRRRRRRRRR/#)rpromptrheadingintrobodyr r )r s"r rr&s7DD3DDSDDPSDrcRV RV RV RV 2#)z:Prefix ``prompt`` with a fenced ``## heading`` data block.z##  z ``` z ``` r )r"r#r$r%s&&&&r _prepend_context_blockr(&s!  E7)D66( CCrc V^8dQhRRRR/#)rjobrr list[str]r )r s"r rr+sGG$G9Grc:VPR4pVf VPR4pV'dV.M.pM\V\4'dV.pVUu.uF=p\V4P4'gK$\V4P4NK? up#uupi)zVNormalized skill names from ``skills`` (list or str) or the legacy singular ``skill``.skillsskill)rrrr)r*r-legacynames& r _job_skill_namesr1+su WWX F ~!#& FC *0 F&$CIOO4E CIOO & FF Fs !B8Bi@zThe following is this job's most recent non-silent output from a previous run. Use it for continuity: avoid repeating what was already reported, and continue where the last run left off.zgThe following is the most recent output from a preceding cron job. Use it as context for your analysis.z**Prompt Characters:** z**Response Characters:** z ## Prompt z ## Response z r'z(?m)^z(\d+)\nc V^8dQhRRRR/#)rarchiverr str | Noner )r s"r rrRs##S#Z#rcV\PV4pVEe,VP\4VP 4\ \4, 8XdVP 4\ VP^44,\ \4,p\PW4pVeWP 4RMRpVeX\ V4\ VP^44\ \4,8wgVP\4'gR#VR\ \4)P4pM=RV9dVP4#VPR4^,P4pV'd\P !V4'dR#V#)uThe reusable answer of a stored run, using its length frame when available. Framed runs (``_PROMPT_FRAME``/``_RESPONSE_FRAME`` stamps) validate the response length before whitespace normalization, so quoted frames inside the prompt or answer can never become boundaries and a truncated write is rejected. Archives without the heading (script-mode runs) stay whole-document. For legacy unframed archives the LAST ``## Response`` occurrence is the writer's boundary — the assembled prompt half can itself carry the literal heading (a skill documenting its response format, an injected previous answer quoting it), so an early split would re-inject the prompt noise this extraction exists to drop. ``None`` marks "no usable answer" — a blank or silent response (any form the delivery lane itself suppresses) — so the caller falls through to an older archive instead of injecting prompt noise the job already has. Nrz ## Response)_PROMPT_FRAME_REsearchfind_PROMPT_HEADINGendlenintgroup_PROMPT_SEPARATOR_RESPONSE_FRAME_REmatch_RESPONSE_TERMINATORendswithr rpartition_sched_is_cron_silence_response)r3 prompt_frameresponse_startframetailanswers& r _archive_answerrKRs:$$**73L  _-1A1A1Cc/FZ1ZZ%))+c,2D2DQ2G.HH3O`Kaa"((A(-(9wyy{|$r MSY#ekk!n*=DX@Y*YY}}%9::1011288: g %}}##M215;;= V55f== Mrc V^8dQhRRRR/#)rtextrr r )r s"r rrxsSS#S#Src\V4\8:dV#\^,p\V4^V,, pVRV RV RW)R 2#)zKClip oversized context head+tail; conclusions and summaries sit at the end.Nz [... z chars omitted ...] )r;_MAX_CONTEXT_CHARS)rMkeepomitteds& r _clip_to_context_budgetrRxsT 4y&&  "D$i!d("G5Dk])G9,CDL> RRrc$V^8dQhRRRRRR/#)rr*rr"rr ztuple[str, bool]r )r s"r rrs"==d=C=4D=rc VPR4pV'gVR3#^RIHpV!4p\V\4'dV.pRpVEFZp\V\4'dHVP 4P 4R8Xd%\ VPR4;'gR4pW`PR48HpV'd;\;QJdRV4F 'dK RM RM !RV44'gN\PR W`PR4VPR 4\P!V44EK\WF, PR 4R RR 7pRp VFp V PRR7p V PR^4^,PR^4^,p V P!R4;'dQ\";QJd*RV P%44F 'gK RM RM!RV P%444p V P 4'd V 'dK\'V 4pVfKTp M V 'gEK\)V 4p V'd\+VR\,V 4pM\+VRV R2\.V 4pRpEK] W3# \0\23d#p\PRYo4Rp?EKRp?ii;i)zWPrepend the latest output of each ``context_from`` job; returns ``(prompt, injected)``. context_fromF)get_cron_output_dirselfidrc3*"TF qR9xK R#5i)0123456789abcdefNr ).0cs& r '_inject_context_from..s'WA-?(?sTz@context_from: skipping invalid job_id %r for job_id=%r name=%r%sr0z*.mdc6VP4P#)N)statst_mtime)fs&r &_inject_context_from..sIZIZr)keyreversez utf-8-sig)encodingz --- z ## Promptz # Cron Job:c3D"TFpVPR4xK R#5i)**Status:** no_changeN)riz**Status:** silentz&Script gate returned `wakeAgent=false`) startswith)r[rs& r r]r^s0K!4OO%OPP 3s NzYour previous run's outputzOutput from job ''z2context_from: failed to read output for job %r: %s)r cron.jobsrVrrrlowerallloggerwarning _delivery_cron_job_origin_log_suffixsortedglob read_textsplitrjanyrrKrRr(_SELF_CONTEXT_INTRO_UPSTREAM_CONTEXT_INTROOSErrorPermissionError)r*r"rUrV output_dirinjected source_job_idis_self output_files latest_output output_file candidateheader silent_auditrJes&& r _inject_context_fromrs77>*L u}-$&J,$$$~ H% mS ) )m.A.A.C.I.I.Kv.U 3 34M774=0CC'W'WCCC'W'W$W$W NNRwwt}cggfo55c:  % c!+11&9?ZLM+ '11;1G #A6q9?? qQRST(33MB  ssK!' 1 1 3KsssK!' 1 1 3KH !((L(3> & ! ,"!3MBM/8:M}^0/ a@BY!H_&f  ) c NNOQ^ b b cs= BJ* J*J*?8J*8J* J*$>J**K;KKc$V^8dQhRRRRRR/#)rr*r skill_namesr+r r )r s"r rrs&@@@9@@rc aaa^RIHp^RIHp^RIHpHp^RIHpH p^RI H pVPRVPR44o\VPR4;'gR4;'gR p .p .oR R /R VVV3R lllp VEFfoV!SPR 44p V 'dQV!V RV R7p V 'd3V 'dV PR4V PV ^,4M V !RS4Ks\ P"!V!V!S444pT!ST4;p'd T !RYR7KTPR4'g)T !RTPR4;'gRS R24KT!ST R7T 'dT PR4T P/RS R2R\TPR4;'gR4P14.4T!Y4EKi S'd8V P3^RR P5S4 R!R P5S4 R"24V # \ P$\&3dT !RS4EKi;i \(d\*P-RSRR7ELi;i)#zWLoad each named skill/bundle into prompt parts; unknown ones are skipped with a notice.) skill_view)bump_use)build_bundle_invocation_messageresolve_bundle_command_key)_inject_skill_configambiguous_skill_label)normalize_skill_lookup_namer0rXrNlabelc$V^8dQhRRRRRR/#)rmsgrrr4r Noner )r s"r r,_load_cron_skill_parts..__annotate__s!,,3,j,D,rc~<\P!RV,S.VO5!SPT;'gS4R#)zCron job '%s': N)rorpappend)rrargs job_label skill_nameskippeds&$*r _skip%_load_cron_skill_parts.._skips0(3. ADAu** +r/)user_instructiontask_idz/bundle '%s' could not load any skills, skippingz*skill '%s' returned invalid JSON, skippingu%s — skipping)rsuccessu skill not found, skipping — %serrorzFailed to load skill 'rk)rz-Cron job: failed to bump skill usage for '%s'T)exc_infoz&[IMPORTANT: The user has invoked the "zf" skill, indicating they want you to follow its instructions. The full skill content is loaded below.]contentze[IMPORTANT: The following skill(s) were listed for this job but could not be found and were skipped: z, un. Start your response with a brief notice so the user is aware, e.g.: '⚠️ Skill(s) not found and skipped: z'])tools.skills_toolrtools.skill_usageragent.skill_bundlesrragent.skill_commandsrragent.skill_utilsrrrlstriprrrr TypeError Exceptionrodebugextendrinsertjoin)r*rrrrrrrrrpartsr bundle_keybundle_payloadloaded ambiguousrrrs&& @@@r _load_cron_skill_partsrs^,*_P= .I#''$-%%2&..$GEG,4,," / 0A0A#0FG <RBNLL$ ^A./GT  ZZ +Fz+R STF.j&A A9 A #Y @ zz)$$ 2 7#MM)? |1'M O  e Z 1  LL  4ZLAg h   9%++ , 2 2 46 7 V+O"R Q!!%7!3 4577;yy7I6J" N LA$$i0  > K   e LLH*_cL d es$>"H6= I"6$II"#J J uo[IMPORTANT: You are running as a scheduled cron job. DELIVERY: Your final response will be automatically delivered to the user — do NOT use send_message or try to deliver the output yourself. Just produce your report/output as your final response and the system handles the rest. SILENT: If there is genuinely nothing new to report, respond with exactly "[SILENT]" (nothing else) to suppress delivery. [SILENT] is a literal ASCII control token — never translate or rephrase it, whatever language the rest of your answer uses. Never combine [SILENT] with content — either report your findings normally, or say [SILENT] and nothing more. FAILURE: If a delegated child fails and this cron run must be recorded as failed, put [CRON_FAILURE] on the first line by itself, then explain the child failure on following lines. RECURSION: This is a run of an EXISTING scheduled job — execute the task now. NEVER create or update a cron job because of recurring or future-schedule language in the task prompt below; treat phrasing like "each Monday" or "every day at 9" as context for this run, not as a request to schedule another job.] c ,V^8dQhRRRRRRRRRR /#) rr*r prerun_scriptzOptional[tuple] extra_prompt Optional[str]runtime_data_promptr rr )r s"r rrs=QQ Q-QDQQ&Q Qrc D\VPR4;'gR4pV'dV RV 2pTpRpV'd V RV 2pRpVPR4pV'dVeTM^\P!T\P !T\VPR4;'gR44VPR 4R 7wrV'd V 'gR#V'dRMRwr\ WZW4pRp\W4wr\T;'gT p^R IH p T P\VPR4;'gR44pV'd V V 2pRp\V,p\V4pV'g\WPRVVR 7#\W4pRpV'd!^R IHpVP#R4V!VV4p\RP%V4VRR7pV'd?\'V4\'V48d&VP)V4'd^RIHpV!V4V#)uBuild the effective prompt for a cron job, optionally loading skills first. ``prerun_script``: cached ``(success, stdout)`` from a script the caller already ran (wake-gate check) — skips re-execution. ``extra_prompt``: user-authored per-run ``## Run Context`` for this fire only, never persisted to the job. ``runtime_data_prompt`` is operator-configured runtime data (such as monitor output) and is scanned as injected data rather than user input. When provided, the script is not re-executed and the cached result is used for prompt injection. When omitted, the script (if any) runs inline as before. extra_prompt: Optional per-run context (from ``cronjob(action='run')``, 57331 — salvaged from #57342 by @liuhao1024). r"rz ## Run Context FTscriptNrX interpreter)workdirr)notepad) has_skillshas_injected_data user_prompt)append_user_instructionr')r)register_stable_prefix)z Script OutputzZThe following data was collected by a pre-run script. Use it as context for your analysis.)z Script Errorz;The data-collection script failed. Report this to the user.)rr_script_run_job_scriptrD_resolve_job_workdirr(rcronrrender_notepad_section _CRON_HINTr1_scan_assembled_cron_promptrrrrrr;rjagent.prompt_cache_boundaryr)r*rrrrr"r script_pathrrr#r$ _ctx_injected cron_notepadnotepad_sectionrr stable_prefixr assembledrs&&&& r _build_job_promptrscggh'--2.K$ %9,H F8/0C/DE ''(#K*6M((V%@%@c#''RV-J]J][]F^%_GGM24  = Fa  (N 0=F)::]-"99#cggdm>Q>Qr:RSO#$VH-  & F"3'K * E=N#  #3 4EM @ R 0v> +DIIe,.2OS rcr^RIHp^RIHpV'g V'd,V!V4wrV'gV'gV'd V!V4pMV!V4pV'd`\P RVP R4;'gVP R4;'gRV4\P!V4hV#)uScan the assembled cron prompt for injection; raise ``CronPromptInjectionBlocked`` on a hit. Needed because skill content is loaded from disk at runtime (never scanned at create/update) and cron auto-approves tool calls. Tier by what the prompt CONTAINS: user prompt + hint only → STRICT ``_scan_cron_prompt``; skills or injected data → LOOSER ``_scan_cron_skill_assembled`` (command-shape patterns dropped, invisible unicode sanitized not blocked, so a false positive cannot permanently kill a job); injected data without skills also scans ``user_prompt`` STRICT. Since cron runs non-interactively (auto-approves tool calls), a malicious skill carrying an injection payload bypassed every gate. See #3968. )_scan_cron_prompt)_scan_cron_skill_assembleduCCron job '%s': assembled prompt blocked by injection scanner — %sr0rXz ) tools.cronjob_toolsrtools.cronjob_prompt_scanrrorprrDCronPromptInjectionBlocked)rr*rrrrr scan_errors&&$$$ r rros6D& :9 E **;7J&y1  Q GGFO ; ;swwt} ; ; Z I// ;; rc V^8dQhRRRR/#)rr*rr rr )r s"r rrsMMTMdMrc~^RIHpV!VPR4VPR44pV'd9VPR4p\ PR WB4\R V R V 24hR# \dApTPR4'dRTPP RT R2MRpRp?LRp?ii;i) a7Fail closed (RuntimeError) if the stored provider/base_url pair could exfiltrate a key. Runtime backstop: jobs persisted before the create/update guard, or written directly to the store, reach provider resolution unchecked. Fallback providers come from operator config and are validated by the caller, not here.)_validate_cron_base_urlproviderbase_urlz+could not validate provider/base_url pair (z: z=); refusing to run a job with an unverified base_url overrideNrXudJob '%s': refusing to run — unsafe provider/base_url pair could exfiltrate a stored credential: %sz Cron job 'z' blocked for safety: ) rrrr __class____name__ror RuntimeError)r*rerrexcjob_ids& r _guard_job_credential_exfilrs +?%cggj&9377:;NO   1  Zx/EcUKLL   +WWZ  &&'r#/. .'+ +s-A11 B<<6B77B<c(V^8dQhRRRRRRRR/#)rrrjob_namereasonr z$tuple[bool, str, str, Optional[str]]r )r s"r rrs,%% %%(+%0T%rc  ^RIHp\PRW4V!VRV 24\ 4PR4pRV RV RV R V R 2 pR V R V 2pR WVV3# \d\P RT4LXi;i)zFail a run closed and pause the job: an unrunnable job left enabled re-fires every tick forever; ``paused_at``/``paused_reason`` give an auditable record.) pause_jobz Job '%s': %szAuto-paused by scheduler: z-Job '%s': failed to auto-pause unrunnable jobz%Y-%m-%d %H:%M:%Sz # Cron Job: z **Job ID:** z **Run Time:** u7 **Status:** blocked (unrunnable job) — auto-paused r'u⚠ Cron job 'z' was auto-paused F)rlrrorr exception _hermes_nowstrftime)rrrrnow_isodocalerts&&& r _block_and_pause_jobrs$ LL0R&6vh?@m$$%89G xj!h "C ("  XJ&;F8 DE #f $$ RH&QRs A!BB) scheduler)scheduler_delivery)scheduler_script)NNN)-__doc__ __future__rrloggingre hermes_timerrtypingr getLoggerror r(r1rOrxry _PROMPT_FRAME_RESPONSE_FRAMEr9_RESPONSE_HEADINGr>rAcompileescaper6r?rKrRrrrrrrrrrrDrrqrrr rr rsI#  *   + ,R"D G * -!%:: RYY} % &gbii.H-IJLZZ RYY ' ( :K0L/MNP#LS=@@HK .Qh5:V[!%>M2%2%0,r