fix(cron): no_agent and script failures stop masquerading as provider errors

[teknium1]

Cron failure summaries stop blaming LLM providers for failures in script jobs and script timeouts, stop matching stray "429" digits, and the script timeout becomes a recognized config key.

Consolidated salvage of the no_agent/script-timeout misclassification cluster, cherry-picked with authorship preserved:

• fix(cron): don't attribute no_agent script failures to a provider #77648 (@Yanir-R, Aug 3, earliest of the no_agent dupes): a no_agent job never reaches a provider, so the summarizer's rate-limit/timeout/auth branches are gated on job mode — a script whose output contains "timed out", "429" or "authentication" now gets its own error reported instead of "provider timeout. Fallback chain was exhausted…". Duplicates fix(cron): don't mislabel no_agent failures as provider failures #79451 (@jacques-commits) and fix(cron): stop reporting no_agent script failures as provider errors #81629 (@hydracoco7) fixed the same bug and are credited.
• fix(cron): classify script timeouts separately #82460 (@jbagdonas): the script runner's explicit "Script timed out after Ns" contract is classified before generic timeout matching — "script timed out. No model was invoked." — covering agent-backed jobs whose context script times out too. Earlier sibling fix(config): recognize cron script timeout #78503 flagged the same gap.
• fix(config): recognize cron script timeout #78503 (@daxro): cron.script_timeout_seconds added to config defaults so hermes config set recognizes the key the scheduler already reads (alongside HERMES_CRON_SCRIPT_TIMEOUT).
• fix(cron): avoid false provider failure summaries #83188 (@cation98): 429 matched as a whole token, so identifiers like hash429abc.md no longer trip a false rate-limit alert. The PR's no_agent fallback-note half is superseded by fix(cron): don't attribute no_agent script failures to a provider #77648's stronger mode gate; its tests were reconciled to the composed contract.

Composition note: all four land in _summarize_cron_failure_for_delivery on top of yesterday's #85508 (honest chain wording, inactivity/lock classification). Order in the function: drift → mode gate → script-timeout contract → rate limit (token match) → inactivity → cwd-lock → provider timeout → auth.

Validation

Failure	Before	After
no_agent script prints "timed out"/"429"/"401"	"provider timeout. Fallback chain was exhausted…"	script's own error, script named
"Script timed out after 900s: …" (any job)	"provider timeout…"	"script timed out. No model was invoked."
Error text contains hash429abc.md	"provider rate limit"	generic summary with the real error
hermes config set cron.script_timeout_seconds 600	"not a recognized config key"	accepted, read by scheduler

Tests: 171 passed across the three touched test files; full cron suite 674 passed, 1 skipped.

Closes #77648, closes #79451, closes #81629, closes #82460, closes #78503, closes #83188.

Infographic

[github-actions]

૮ >ﻌ< ა ci review

_{ran on f2b4e96 — chore: map contributor emails for cherry-picked commits}

⚠️ Warnings

OSV vulnerability scan · View job

5 known vulnerabilities found in pinned dependencies.

• CVE-2026-67213 in package-lock.json
• CVE-2026-67213 in website/package-lock.json
• CVE-2026-70608 in package-lock.json
• CVE-2026-56876 in package-lock.json
• CVE-2026-70606 in package-lock.json

How to fix:

Review the findings in the Security tab. Update the affected dependencies if a patched version is available.

---

debug info

CI timings

CI timings · View report · View job

Wall time 7m8s vs 9m28s (-24.6%). 13 job(s) slower, 10 faster, 1 unchanged.

• Python tests / Run tests slice 2/12: +19.0s
• Python tests / Run tests slice 7/12: +11.0s
• Python tests / Run tests slice 1/12: -9.0s
• OS-specific tests / macOS-only tests: +9.0s
• Python tests / Run tests slice 4/12: -8.0s

[teknium1]

Credit correction: the post-merge sweep surfaced four earlier submissions of these fixes that the pre-merge duplicate sweep missed — #60593 (@cpahgw-rgb, Jul 8) was the earliest no_agent mode-gate fix, #61969 (@angroni84-wq, Jul 10) the earliest script-timeout contract classification, and #70977 (@brian717) + #70913 (@webtecnica) also predate the cherry-picked PRs. All four closed with credit; first-submitter acknowledgment belongs to @cpahgw-rgb and @angroni84-wq respectively.

[webtecnica]

Thanks @teknium1 for the careful post-merge sweep and the credit correction — closing #70913 with credit is the right call, and the first-submitter acknowledgment to @cpahgw-rgb and @angroni84-wq is exactly how it should work. Glad the consolidated salvage landed cleanly (674 passed). Appreciate the diligence on attribution.