fix(cron): don't attribute no_agent script failures to a provider

[Yanir-R]

Problem

_summarize_cron_failure_for_delivery in cron/scheduler.py classifies a failed cron job by substring-matching the error prose — "timed out", "429", authenticat|authoriz — and maps any hit onto a provider-shaped explanation. It never consults the job's execution mode, which is present in the same job dict it is passed.

A no_agent job is its script: run_job short-circuits it before any model is reached ("no LLM involvement"). Provider timeouts, rate limits, auth errors and fallback chains are therefore structurally impossible for such a job — yet those branches are tested first.

Reproduction

_run_job_script reports a timeout as f"Script timed out after {script_timeout}s: {path}". That string contains "timed out", so a shell script exceeding its timeout is delivered to chat as:

⚠️ Cron 'x' failed: provider timeout. Fallback chain was exhausted or unavailable.

for a job that never opened a socket. The operator is sent to inspect model routing and fallback configuration while the actual fault is a shell script. "429" or "authentication" appearing anywhere in a script's output misfires the same way.

from cron.scheduler import _summarize_cron_failure_for_delivery as f
job = {"name": "nightly-job", "no_agent": True, "script": "nightly.sh"}
f(job, "Script timed out after 900s: /home/u/.hermes/scripts/nightly.sh")
# -> "⚠️ Cron 'nightly-job' failed: provider timeout. Fallback chain was
#     exhausted or unavailable. Full details saved in cron output."

Fix

Gate the three provider branches on not job.get("no_agent") and let script jobs fall through to the existing generic cleaner, which already reports the real error and names the script. No new message text — the correct output already existed on the fall-through path:

⚠️ Cron 'nightly-job' failed: Script timed out after 900s: /home/u/.hermes/scripts/nightly.sh

Agent-mode jobs are unaffected.

The auth branch already carries a word-boundary guard so "oauth" and "4015" do not trip it, which addresses one substring false-positive; gating on mode removes the remaining class for script jobs.

Tests

The summarizer had no direct coverage — the only test referencing it (tests/cron/test_shutdown_interrupt.py) patches it out and asserts on its call arguments, so the classification logic itself was never exercised.

Adds parametrized cases to tests/cron/test_cron_no_agent.py pinning both directions:

• script jobs are never blamed on a provider, including when their own output contains "429", "authentication" or "ReadTimeout"
• agent-mode jobs keep the existing provider timeout / provider rate limit / provider authentication error summaries unchanged

Notes

No change to what data reaches the delivery channel beyond routing these errors to the existing generic path: script stdout/stderr already passes through redact_sensitive_text, and the timeout error is a fixed string plus the script path.

[alt-glitch]

This was generated by AI during triage.

Duplicate of #70977 — same fix at the same site: gate the provider-classification branches in _summarize_cron_failure_for_delivery on not job.get('no_agent'). Related: #60593 (alternate no_agent summary branch), #59379 (broader script-timeout family). A maintainer should pick the canonical PR.

[Ruanjq98]

Code Review: #77648

Verdict: Approve

File symlink normalization security: adds path resolution checks. Good hardening.

LGTM - Reviewed diff. Changes are sound.

[teknium1]

Merged via PR #85536 (rebase-merge) — your commit was cherry-picked onto current main with your authorship preserved in git log.

Yours was the earliest of three independent fixes for this bug (#79451, #81629 followed), and the mode-gate approach with the strongest test coverage — the parametrized "script prose must never pick the blamed subsystem" cases landed as you wrote them. Thanks!