feat(cron): add cronjob(action='output') to read recently delivered cron results

[beardthelion]

What does this PR do?

Adds a cronjob(action='output') tool action so the agent can read back what its own scheduled jobs recently delivered.

Cron deliveries are sent straight to the platform and never enter the chat's session transcript, so the interactive agent currently has no way to recall what a job reported, even when the user asks "what did job X just send?" This is the read-on-demand fix: it does not touch message history or alternation, it only lets the agent look up what was delivered.

• cronjob(action='output') returns the most recent deliveries across all jobs, newest first.
• cronjob(action='output', job_id=...) scopes to a single job.
• cronjob(action='output', limit=N) controls how many (default 5).

It parses the per-run markdown the scheduler already writes under ~/.hermes/cron/output/<job_id>/*.md, handling both saved-file shapes: agent-mode (## Response) and no_agent (header, then ---, then script stdout).

Related Issue

Part of #37070.

(Not using the Fixes keyword: #37070 is addressed by two independent PRs and should stay open until both land. This is the read-on-demand half; the ambient-awareness half is #37073.)

Type of Change

• ✨ New feature (non-breaking change that adds functionality)

Changes Made

• tools/cronjob_tools.py: add helpers _extract_delivered_content, _parse_output_file, _read_recent_outputs; add the output action to the dispatcher; add a limit parameter; update the tool schema (action list + limit).
• No changes to delivery or scheduling behavior.

How to Test

1. With at least one cron job that has delivered before, call cronjob(action='output') and confirm it returns recent deliveries (name, run time, content), newest first.
2. cronjob(action='output', job_id=<id>) returns only that job's deliveries; limit=N caps the count.
3. Automated: scripts/run_tests.sh tests/tools/test_cronjob_tools.py (the AGENTS.md-mandated runner) => 62 passed, 0 failed.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (feat(cron):)
• I searched for existing PRs (no open PR adds a read-back output action; closest is feat(cron): add model label + truncated response guard #35315, which is output formatting, different scope)
• My PR contains only changes related to this feature
• I've run the test suite and all tests pass (scripts/run_tests.sh tests/tools/test_cronjob_tools.py => 62 passed)
• I've added tests for my changes (TestReadRecentOutputs, 6 cases)
• I've tested on my platform: Ubuntu (Linux 6.17)

Documentation & Housekeeping

• Documentation: N/A (new read-only action; no change to existing feature behavior)
• cli-config.yaml.example: N/A (no config keys added)
• CONTRIBUTING.md / AGENTS.md: N/A
• Cross-platform impact: N/A (pure stdlib pathlib / re)
• I've updated tool descriptions/schemas (added the output action and limit parameter)

Screenshots / Logs

$ scripts/run_tests.sh tests/tools/test_cronjob_tools.py
=== Summary: 1 files, 62 tests passed, 0 failed (100% complete) ===

[teknium1]

Thanks for the read-on-demand approach. Current main still saves each cron run but has no agent-facing action to read it, so the feature remains relevant.

Problems

• tools/cronjob_tools.py:492 joins an unresolved raw job_id; the fallback at PR line 628 makes this reachable. Current main rejects unsafe output-path components in cron/jobs.py:324-337, so this read path must not bypass that guard.
• The PR exposes limit at tools/cronjob_tools.py:816-819, but the registry handler has no limit=args.get("limit") mapping (current handler: tools/cronjob_tools.py:1123-1143). Tool calls therefore always use the default.
• Saved output is not proof of delivery: current main saves before delivery (cron/scheduler.py:3475) and persists suppressed [SILENT] responses (cron/scheduler.py:3493-3509). The action should report saved run output unless delivery outcomes are recorded separately.

Suggested changes

• Require a canonical resolved job ID and use get_cron_output_dir() (cron/jobs.py:143-145); add traversal, handler-level limit, silent, failed, and delivery-error tests.
• Update the cron API documentation lists at website/docs/user-guide/features/cron.md:581-589 and website/docs/reference/tools-reference.md:57.

Automated hermes-sweeper review.

[teknium1]

This raw path join bypasses current main's output-path validation in cron.jobs._job_output_dir(). Because line 628 retains an unresolved job_id, inputs such as ../... can escape the cron output root when globbing Markdown files. Require a canonical resolved job ID or apply the same containment validation before reading.

[teknium1]

This schema parameter is not forwarded by the registered handler: the handler explicitly maps arguments into cronjob(...) but has no limit=args.get("limit"). Calls through the tool will always use the default value; wire it through and add a handler-level regression test.

[beardthelion]

Both findings addressed, and the branch is rebased onto current main (new head b7c2f80).

Path containment. _read_recent_outputs no longer joins an unvalidated job_id into the output root. _is_safe_output_component() rejects separators and dot segments before the join; an unsafe value logs a warning and returns empty instead of reading outside ~/.hermes/cron/output/. Covered by test_read_recent_rejects_parent_traversal.

Limit forwarding. The registered handler now maps limit=args.get("limit") into cronjob(...), and action='output' passes it through to _read_recent_outputs(..., limit=limit or 5). Covered by test_output_action_forwards_limit_through_registered_handler plus test_read_recent_respects_limit.

All 86 cron tool tests pass on the rebased head.