@securecoms/agent-bridge 0.38.0 → 0.40.0

package/connectors/hermes/adapter.py

@@ -140,6 +140,17 @@ _ACCEPT_POLL_S = 0.02
 # One warning per process when this Hermes lacks the acceptance signal.
 _TURN_TRACKING_WARNED = False
 
+# H0: Hermes session key -> [(ledger token, runner key)] for every ungranted
+# event dispatched into that session and not yet released. Module-level, like
+# _TURN_AUTHZ, so a replaced adapter instance or a task cancelled before its
+# first step cannot strand a count: the next completion that finds the session
+# idle releases it, whichever adapter instance observes it.
+_ATTACHED: Dict[Any, list] = {}
+# One warning per process each: an idle input Hermes does not expose (so no
+# count can be released), and H0.2b's shared room sessions.
+_IDLE_INPUTS_WARNED = False
+_SHARED_ROOMS_WARNED = False
+
 # Hermes's Signal adapter mapping (_MEDIA_TYPE_BY_MIME_PREFIX): first matching
 # prefix wins; anything else is a DOCUMENT so Hermes surfaces the file path.
 _MEDIA_TYPE_BY_MIME_PREFIX = (("audio/", "VOICE"), ("image/", "PHOTO"), ("video/", "VIDEO"))
@@ -267,6 +278,56 @@ def _new_client_session():
     return aiohttp.ClientSession()
 
 
+# Item A (R4): cron / proactive delivery to the owner DM. `agent-bridge wire
+# --harness hermes` sets the cron home channel (CRON_HOME_CHANNEL_ENV, the
+# platform's cron_deliver_env_var) to the literal OWNER_TARGET. Both Hermes
+# cron lanes (the live adapter.send and the out-of-process
+# _standalone_send) resolve it through the bridge's bearer-gated
+# GET /v1/owner-dm, which answers only from the owner-signed manifest in
+# force (OQ-A1). There is no fallback: no manifest means no send. A proactive
+# send carries no in_reply_to and no idempotency_key (OQ-A2: Hermes passes no
+# run id, and job_id is stable across runs, so a job_id key would suppress
+# every later run of the job).
+CRON_HOME_CHANNEL_ENV = "SECURECOMS_HOME_CHANNEL"
+OWNER_TARGET = "owner"
+# Answers that name a target rather than a channel are never a channel id.
+_OWNER_DM_NON_CHANNEL_ANSWERS = ("owner", "default")
+# Fixed failure texts: no channel id, no message text. Wording approved by Eric
+# 2026-11-12 (E-4); OWNER_DM_UNKNOWN_ERROR is byte-equal to the OpenClaw
+# connector's.
+OWNER_DM_UNKNOWN_ERROR = (
+    "SecureComs could not find the owner's direct message. "
+    "The agent needs its signed owner settings first."
+)
+PROACTIVE_MEDIA_ERROR = "SecureComs can send only text in a scheduled message. The file was not sent."
+PROACTIVE_UNAVAILABLE_ERROR = "SecureComs could not reach the agent bridge for a scheduled message."
+_OWNER_DM_TIMEOUT_S = 5.0
+
+
+async def _owner_dm_channel_id(session, bridge_url: str, token: str) -> Optional[str]:
+    """The owner DM channel id from GET /v1/owner-dm, or None on ANY failure
+    (non-200, network error, malformed body, an empty or non-string id, or an
+    answer that is itself a target name). Never raises."""
+
+    async def _get() -> Any:
+        async with session.get(
+            f"{bridge_url}/v1/owner-dm", headers={"Authorization": f"Bearer {token}"}
+        ) as r:
+            if r.status != 200:
+                return None
+            return await r.json()
+
+    try:
+        body = await asyncio.wait_for(_get(), timeout=_OWNER_DM_TIMEOUT_S)
+    except Exception as e:
+        logger.debug("SecureComs: owner DM lookup failed (error_class=%s)", _error_class(e))
+        return None
+    cid = body.get("channel_id") if isinstance(body, dict) else None
+    if not isinstance(cid, str) or not cid or cid in _OWNER_DM_NON_CHANNEL_ANSWERS:
+        return None
+    return cid
+
+
 class SecureComsAdapter(BasePlatformAdapter):
     """Hermes platform adapter fronting the local SecureComs daemon."""
 
@@ -306,6 +367,16 @@ class SecureComsAdapter(BasePlatformAdapter):
             self._send_status_frame, now=time.monotonic
         )
 
+        # H0.2b: Hermes shares ONE room session across every sender when
+        # group_sessions_per_user is off; every room turn is then ungranted.
+        self._room_sessions_shared = self._group_sessions_shared()
+
+    def _group_sessions_shared(self) -> bool:
+        extra = getattr(self.config, "extra", None)
+        if not isinstance(extra, dict):
+            return True
+        return extra.get("group_sessions_per_user", True) is not True
+
     @property
     def name(self) -> str:
         return "SecureComs"
@@ -327,6 +398,14 @@ class SecureComsAdapter(BasePlatformAdapter):
         """
         del is_reconnect  # accepted for contract parity; nothing to preserve
         self._stopped = False
+        self._room_sessions_shared = self._group_sessions_shared()
+        global _SHARED_ROOMS_WARNED
+        if self._room_sessions_shared and not _SHARED_ROOMS_WARNED:
+            _SHARED_ROOMS_WARNED = True
+            logger.warning(
+                "SecureComs: group_sessions_per_user is off, so a room shares one Hermes session "
+                "across senders; every room turn runs without tools"
+            )
 
         # BINDING-STABILITY fold: resolve bound_identity here, ONCE, for the
         # entire process life of this adapter instance. Every subsequent
@@ -523,7 +602,9 @@ class SecureComsAdapter(BasePlatformAdapter):
             if r.status == 200:
                 for c in await r.json():
                     self._channels[c["channel_id"]] = {
-                        "name": c.get("name") or c["channel_id"],
+                        # Member-chosen and reaches the prompt (chat_name,
+                        # get_chat_info): sanitized once, here (R3).
+                        "name": securecoms_transport.display_name(c.get("name")) or c["channel_id"],
                         "is_dm": bool(c.get("is_dm")),
                     }
 
@@ -708,15 +789,127 @@ class SecureComsAdapter(BasePlatformAdapter):
 
     async def on_processing_complete(self, event: Any, outcome: Any) -> None:
         """Hermes lifecycle hook (base.py:3448): record the outcome on the
-        event for _await_acceptance, then keep the base behaviour."""
+        event for _await_acceptance, run the H0 release check, then keep the
+        base behaviour."""
         try:
             event._securecoms_outcome = getattr(outcome, "name", None) or "UNKNOWN"
         except Exception:
             pass
+        try:
+            self._settle_on_completion(event)
+        except Exception as e:
+            logger.warning(
+                "SecureComs: ungranted-turn release check failed; its sender stays without tools "
+                "(error_class=%s)",
+                _error_class(e),
+            )
         base = getattr(super(), "on_processing_complete", None)
         if callable(base):
             await base(event, outcome)
 
+    # ── H0: ungranted turns in flight ─────────────────────────────────────
+    #
+    # Hermes v2026.9.24 (read on the Mini): on_processing_complete fires once
+    # per started task, for the event that started it only (base.py:4520-4540),
+    # before the debounce flush and the pending pop. An event can reach a turn
+    # without starting it (redirect, steer, base merge, runner FIFO, debounce),
+    # and an event that DID start its own base task can still be parked by the
+    # runner behind a pending sentinel (run_inbound.py:690-697) or swapped for
+    # an orphaned FIFO head, so its own completion does not prove its text has
+    # run. Every ungranted event's count is therefore attached to its Hermes
+    # session at dispatch and comes down only when the event never reached
+    # Hermes, or at a moment its session is idle: no other running task, no
+    # command guard, nothing pending or debounced, an empty runner FIFO and no
+    # runner turn. Never on a grant. Anything unreadable counts as busy.
+
+    def _session_key_of(self, event: Any) -> Optional[str]:
+        key_fn = getattr(self, "_event_session_key", None)
+        if not callable(key_fn):
+            return None
+        try:
+            key = key_fn(event)
+        except Exception:
+            return None
+        return key if isinstance(key, str) and key else None
+
+    def _runner_key_of(self, event: Any) -> Optional[str]:
+        runner = getattr(self, "gateway_runner", None)
+        key_fn = getattr(runner, "_session_key_for_source", None)
+        if not callable(key_fn):
+            return None
+        try:
+            key = key_fn(event.source)
+        except Exception:
+            return None
+        return key if isinstance(key, str) and key else None
+
+    @staticmethod
+    def _warn_idle_inputs_missing() -> None:
+        global _IDLE_INPUTS_WARNED
+        if _IDLE_INPUTS_WARNED:
+            return
+        _IDLE_INPUTS_WARNED = True
+        logger.warning(
+            "SecureComs: this Hermes does not expose its session idle state; a sender whose "
+            "turn ran without tools stays without tools"
+        )
+
+    def _session_idle(self, session_key: str, completing: Any, runner_keys=()) -> bool:
+        """True only when nothing in this Hermes session can still be
+        processing an event's text. ``completing`` is the task whose
+        on_processing_complete is running (it is ending, so it is not busy)."""
+        try:
+            active = getattr(self, "_active_sessions", None)
+            tasks = getattr(self, "_session_tasks", None)
+            pending = getattr(self, "_pending_messages", None)
+            store_fn = getattr(self, "_text_debounce_store", None)
+            runner = getattr(self, "gateway_runner", None)
+            peek = getattr(runner, "_peek_session_state", None)
+            if (
+                not isinstance(active, dict) or not isinstance(tasks, dict) or not isinstance(pending, dict)
+                or not callable(store_fn) or not callable(peek)
+            ):
+                self._warn_idle_inputs_missing()
+                return False
+            if session_key in pending:
+                return False
+            store = store_fn()
+            if not isinstance(store, dict) or session_key in store:
+                return False
+            task = tasks.get(session_key)
+            if task is not None and task is not completing and not task.done():
+                return False
+            if session_key in active and task is None:
+                return False  # a guard with no owner task: a command is running
+            for key in {session_key, *(k for k in runner_keys if k)}:
+                state = peek(key)
+                if state is None:
+                    continue
+                if state.turn.agent is not None:
+                    return False
+                if state.conversation.queued_events:
+                    return False
+            return True
+        except Exception:
+            return False
+
+    def _release_if_idle(self, session_key: Optional[str], completing: Any, runner_key: Optional[str] = None) -> None:
+        """Release every count attached to this session once it is idle."""
+        if session_key is None:
+            return
+        waiting = _ATTACHED.get(session_key)
+        if not waiting:
+            return
+        runner_keys = tuple(rk for _, rk in waiting) + (runner_key,)
+        if self._session_idle(session_key, completing, runner_keys):
+            for token, _ in _ATTACHED.pop(session_key, []):
+                _TURN_AUTHZ.end_ungranted(*token)
+
+    def _settle_on_completion(self, event: Any) -> None:
+        """H0.2 (d)+(e): at every completion in a session, release what is
+        attached to it if the session is idle."""
+        self._release_if_idle(self._session_key_of(event), asyncio.current_task(), self._runner_key_of(event))
+
     async def _await_acceptance(self, event: Any) -> str:
         """"accepted" once Hermes holds the turn durably (marker persisted) or
         has finished it; "cancelled" when Hermes cancelled it before that
@@ -834,6 +1027,10 @@ class SecureComsAdapter(BasePlatformAdapter):
         # (Hermes keys group sessions per user), never a DM: guessing DM would
         # put a room's messages into a direct-chat session.
         chat_type = "dm" if meta.get("is_dm") is True else "group"
+        if securecoms_authz.block_says_dm(frame):
+            # Audit r2: the daemon's block marks a DM whatever this cache says
+            # (a cache miss or a failed refresh must not skip the H0.2c split).
+            chat_type = "dm"
 
         global _FRAMES_WITHOUT_AUTHORIZATION, _ATTACHMENTS_DROPPED
         if not isinstance(frame.get("authorization"), dict):
@@ -845,7 +1042,20 @@ class SecureComsAdapter(BasePlatformAdapter):
                     "Upgrade @securecoms/agent-bridge"
                 )
         tools_allowed = securecoms_authz.tools_allowed(frame)
-        _TURN_AUTHZ.record(channel_id, sender_id, tools_allowed)
+        if tools_allowed and self._room_sessions_shared and chat_type != "dm":
+            tools_allowed = False  # H0.2b: one room session for every sender
+        # H0.2c: Hermes keys a DM session by chat only. Every non-owner DM turn
+        # runs in its own session (thread NON_OWNER_THREAD), so its text never
+        # enters the transcript the owner's granted turns run in.
+        thread_id = None
+        if chat_type == "dm":
+            thread_id = securecoms_authz.dm_thread(frame)
+        if thread_id is not None:
+            # Defence in depth only: no non-owner or unclassified frame passes
+            # securecoms_authz.tools_allowed, and the ledger forces these
+            # threads off. Removing this line is an equivalent mutant (N4).
+            tools_allowed = False
+        _TURN_AUTHZ.record(channel_id, sender_id, tools_allowed, thread_id)
         if not tools_allowed and not _TOOL_VETO_ACTIVE:
             # This Hermes cannot be made to refuse tool calls, so a turn the
             # daemon did not grant tools never reaches it. Acked at once by
@@ -856,11 +1066,25 @@ class SecureComsAdapter(BasePlatformAdapter):
 
         source = self.build_source(
             chat_id=channel_id,
-            chat_name=meta.get("name", channel_id),
+            # The room name is member-chosen and reaches the prompt: same
+            # sanitizer as the sender label, falling back to the channel id.
+            chat_name=securecoms_transport.display_name(meta.get("name")) or channel_id,
             chat_type=chat_type,
+            # user_id (Hermes's session and the tool ledger key) is the
+            # relay-attributed sender_id; user_name is a sanitized label of
+            # that same sender (R3). thread_id: H0.2c above.
             user_id=sender_id,
-            user_name=sender_id,
+            thread_id=thread_id,
+            user_name=securecoms_transport.own_label(frame),
         )
+        speaker = securecoms_transport.speaker_label(frame)
+        if speaker and isinstance(text, str):
+            # A relayed voice room: one Hermes session (the relay's) holds
+            # several speakers, and Hermes pins user_name in the per-session
+            # system prompt, so the real speaker rides each turn's text, the
+            # way Hermes's own shared sessions prefix "[sender name]". The
+            # label's name part cannot contain "[]()" (R3, M2).
+            text = f"[{speaker}] {text}"
         if not tools_allowed and isinstance(text, str):
             # An ungranted sender must never drive gateway commands. EVERY
             # ungranted text is escaped: Hermes strips leading @url:/@file:
@@ -909,10 +1133,51 @@ class SecureComsAdapter(BasePlatformAdapter):
         prompts = [p for p in (voice_prompt_of(frame), None if tools_allowed else securecoms_authz.NO_TOOLS_TURN_NOTE) if p]
         if prompts:
             event.channel_prompt = "\n\n".join(prompts)
-        event._securecoms_session_was_busy = self._session_was_busy(event)
-        await self.handle_message(event)
+        token = None
+        session_key = None
+        if not tools_allowed:
+            # H0.2 (a): this key has no tools until no turn in its session can
+            # still be processing this event's text. Attached to the session
+            # now; released only when the session is idle.
+            token = (channel_id, sender_id, thread_id, self._room_sessions_shared and chat_type != "dm")
+            _TURN_AUTHZ.begin_ungranted(*token)
+            session_key = self._session_key_of(event)
+            if session_key is None:
+                logger.warning(
+                    "SecureComs: an ungranted turn's Hermes session is unknown; its sender stays without tools"
+                )
+            else:
+                _ATTACHED.setdefault(session_key, []).append((token, self._runner_key_of(event)))
+        reached = False
+        try:
+            event._securecoms_session_was_busy = self._session_was_busy(event)
+            reached = True
+            await self.handle_message(event)
+        except BaseException:
+            if token is not None and not reached:
+                self._detach(session_key, token)  # never reached Hermes
+                _TURN_AUTHZ.end_ungranted(*token)
+            elif token is not None:
+                self._release_if_idle(session_key, None)
+            raise
+        if token is not None:
+            # (b)/(c): released now only if nothing in the session can still
+            # be processing it; else at a later idle completion (d)/(e).
+            self._release_if_idle(session_key, None)
         return event
 
+    @staticmethod
+    def _detach(session_key: Optional[str], token: tuple) -> None:
+        waiting = _ATTACHED.get(session_key) if session_key is not None else None
+        if not waiting:
+            return
+        for i, (t, _) in enumerate(waiting):
+            if t is token:
+                del waiting[i]
+                break
+        if not waiting:
+            _ATTACHED.pop(session_key, None)
+
     def _may_look_up(self, channel_id: str) -> bool:
         """Negative cache for unknown channels: True at most once per
         _UNKNOWN_CHANNEL_RETRY_S per channel (bounded map, oldest evicted)."""
@@ -945,12 +1210,14 @@ class SecureComsAdapter(BasePlatformAdapter):
     def toolsets_for_source(self, source) -> Optional[list]:
         """Hermes per-turn toolset override (gateway run_turn
         _resolve_enabled_toolsets_for_source). None keeps the configured
-        toolsets: only for a (chat, sender) whose latest turn was granted
-        tools. Anything else, including an unknown source, gets the no-tools
-        override."""
+        toolsets: only for a (chat, sender, thread) whose latest turn was
+        granted tools and that has no ungranted turn still in flight (H0).
+        Anything else, including an unknown source and every turn in the
+        non-owner DM thread, gets the no-tools override."""
         chat_id = getattr(source, "chat_id", None)
         user_id = getattr(source, "user_id", None)
-        if _TURN_AUTHZ.tools_allowed(chat_id, user_id):
+        thread_id = getattr(source, "thread_id", None)
+        if _TURN_AUTHZ.tools_allowed(chat_id, user_id, thread_id):
             return None
         return list(securecoms_authz.NO_TOOLS_TOOLSETS)
 
@@ -988,6 +1255,15 @@ class SecureComsAdapter(BasePlatformAdapter):
     ) -> SendResult:
         if not self._session or self._session.closed:
             return SendResult(success=False, error="not connected")
+        if chat_id == OWNER_TARGET:
+            # Cron live lane (Item A): the home channel literal resolves only
+            # from the manifest in force; a proactive send answers no turn, so
+            # it carries no in_reply_to and no idempotency_key.
+            resolved = await _owner_dm_channel_id(self._session, self.bridge_url, self._token)
+            if resolved is None:
+                return SendResult(success=False, error=OWNER_DM_UNKNOWN_ERROR)
+            chat_id = resolved
+            reply_to = None
         block = self._block_key(reply_to, content) if reply_to else None
         try:
             async with self._session.post(
@@ -1019,11 +1295,39 @@ class SecureComsAdapter(BasePlatformAdapter):
         await self._status.on_typing(chat_id)
 
     async def send_image(self, chat_id: str, image_url: str, caption: str = "", **kwargs) -> SendResult:
+        if chat_id == OWNER_TARGET:
+            # A proactive send never carries a file (Item A, live lane).
+            return SendResult(success=False, error=PROACTIVE_MEDIA_ERROR)
         # The daemon's text send is the only modality wired today; degrade to
         # sending the URL + caption as text rather than failing the turn.
         text = f"{caption}\n{image_url}".strip() if caption else image_url
         return await self.send(chat_id, text)
 
+    # Item A, live lane. Hermes routes a cron run's media through the adapter's
+    # media methods, whose base stubs degrade to a notice posted through
+    # emit_warning / emit_media_warning (-> self.send, which resolves OWNER_TARGET).
+    # We refuse the owner literal at those two chokepoints, so a proactive send
+    # never carries a file or a path. DO NOT override the base send_document /
+    # send_voice / send_video / send_animation / send_image_file here: Hermes's
+    # _send_live_adapter_media treats "type(adapter).<m> is BasePlatformAdapter.<m>"
+    # as "not implemented natively", and an override makes a normal channel
+    # delegate to the base stub, which posts a fallback notice and reports a
+    # false success. send_image above is the one pre-existing override.
+    async def emit_warning(self, *args, **kwargs):
+        return await self._owner_refused_warning("emit_warning", args, kwargs)
+
+    async def emit_media_warning(self, *args, **kwargs):
+        return await self._owner_refused_warning("emit_media_warning", args, kwargs)
+
+    async def _owner_refused_warning(self, method_name, args, kwargs):
+        target = kwargs["chat_id"] if "chat_id" in kwargs else (args[0] if args else None)
+        if target == OWNER_TARGET:
+            return SendResult(success=False, error=PROACTIVE_MEDIA_ERROR)
+        base = getattr(super(), method_name, None)
+        if base is None:
+            return SendResult(success=False, error=PROACTIVE_MEDIA_ERROR)
+        return await base(*args, **kwargs)
+
     async def get_chat_info(self, chat_id: str) -> Dict[str, Any]:
         meta = self._channels.get(chat_id)
         if not meta:
@@ -1053,6 +1357,71 @@ def check_requirements() -> bool:
     return os.path.isfile(os.getenv("SECURECOMS_CONNECTION_FILE") or _BINDING_PATH)
 
 
+async def _standalone_send(
+    pconfig,
+    chat_id: str,
+    message: str,
+    *,
+    thread_id: Optional[str] = None,
+    media_files: Optional[list] = None,
+    force_document: bool = False,
+    **_ignored,
+) -> Dict[str, Any]:
+    """Hermes PlatformEntry.standalone_sender_fn: a cron run delivered with no
+    live adapter in this process (tools/send_message_tool.py:575-591). Returns
+    {"success": True, "message_id": ...} or {"error": <fixed text>}.
+
+    The daemon's address and bearer come the way connect() gets them: the
+    binding resolves the identity, then probe_and_gate_bound reads the
+    connection and token files and runs the two-anchor gate. `pconfig` holds
+    nothing for SecureComs. OWNER_TARGET resolves via GET /v1/owner-dm (a
+    failure is an error, never a guess); any other chat id passes through.
+    No in_reply_to, no idempotency_key (OQ-A2). A non-empty media_files is
+    refused before anything is read or posted (no turn, no grant: item B).
+    thread_id and force_document are ignored.
+    """
+    del pconfig, thread_id, force_document, _ignored
+    if media_files:
+        return {"error": PROACTIVE_MEDIA_ERROR}
+    bound_identity = resolve_bound_identity(os.environ, _read_file_text, _BINDING_PATH)
+    if not bound_identity:
+        return {"error": PROACTIVE_UNAVAILABLE_ERROR}
+    session = _new_client_session()
+    try:
+        target, _reason = await securecoms_transport.probe_and_gate_bound(
+            session, bound_identity, _read_file_text, _CONNECTIONS_DIR
+        )
+        if target is None:
+            return {"error": PROACTIVE_UNAVAILABLE_ERROR}
+        channel_id = chat_id
+        if chat_id == OWNER_TARGET:
+            channel_id = await _owner_dm_channel_id(session, target.bridge_url, target.token)
+            if channel_id is None:
+                return {"error": OWNER_DM_UNKNOWN_ERROR}
+        async with session.post(
+            f"{target.bridge_url}/v1/send",
+            headers={"Authorization": f"Bearer {target.token}"},
+            json={"channel_id": channel_id, "text": message},
+        ) as r:
+            if 200 <= r.status < 300:
+                # Posted: a body we cannot parse never turns that into an error.
+                try:
+                    j = await r.json()
+                except Exception:
+                    j = None
+                mid = j.get("message_id") if isinstance(j, dict) else None
+                return {"success": True, "message_id": str(mid) if isinstance(mid, (str, int)) and mid != "" else None}
+            return {"error": f"SecureComs scheduled send failed (HTTP {int(r.status)})."}
+    except Exception as e:
+        logger.debug("SecureComs: scheduled send failed (error_class=%s)", _error_class(e))
+        return {"error": PROACTIVE_UNAVAILABLE_ERROR}
+    finally:
+        try:
+            await session.close()
+        except Exception:
+            pass
+
+
 def _securecoms_pre_tool_call(**_kwargs):
     """Hermes pre_tool_call hook: block every tool call in a SecureComs turn
     that the daemon did not grant tools, and any call whose turn identity is
@@ -1097,7 +1466,21 @@ def _install_tool_veto(ctx) -> bool:
         ):
             return False
         from gateway import session_context
-        from gateway.session_context import get_session_env
+
+        # Read the turn's task-local ContextVars directly: Hermes's own
+        # get_session_env falls back to os.environ, which a concurrent turn or
+        # the process can set. Unset (_UNSET) reads as None, never as a value.
+        var_map = getattr(session_context, "_VAR_MAP", None)
+        unset = getattr(session_context, "_UNSET", None)
+        names = ("HERMES_SESSION_PLATFORM", "HERMES_SESSION_CHAT_ID", "HERMES_SESSION_USER_ID", "HERMES_SESSION_THREAD_ID")
+        if unset is None or not isinstance(var_map, dict) or not all(
+            callable(getattr(var_map.get(n), "get", None)) for n in names
+        ):
+            return False
+
+        def get_session_env(name, default=""):
+            value = var_map[name].get()
+            return None if value is unset else value
 
         engaged = getattr(session_context, "session_context_engaged", None)
         _SESSION_ENGAGED = engaged if callable(engaged) else None
@@ -1127,6 +1510,9 @@ def _install_tool_veto(ctx) -> bool:
         return False
 
 
+_CRON_REGISTER_KWARGS = ("cron_deliver_env_var", "standalone_sender_fn")
+
+
 def register(ctx):
     """Plugin entry point: called by the Hermes plugin system."""
     global _TOOL_VETO_ACTIVE
@@ -1135,7 +1521,7 @@ def register(ctx):
         logger.warning(
             "SecureComs: tool veto inactive; turns without a tool grant will be refused"
         )
-    ctx.register_platform(
+    platform_kwargs = dict(
         name="securecoms",
         label="SecureComs",
         adapter_factory=lambda cfg: SecureComsAdapter(cfg),
@@ -1153,3 +1539,21 @@ def register(ctx):
             "never sees plaintext. Respond normally and conversationally."
         ),
     )
+    # Item A: cron delivery. The env var holds the cron home channel (`wire`
+    # sets OWNER_TARGET); the standalone sender delivers a cron run when no
+    # live adapter is in this process.
+    cron_kwargs = dict(
+        cron_deliver_env_var=CRON_HOME_CHANNEL_ENV,
+        standalone_sender_fn=_standalone_send,
+    )
+    try:
+        ctx.register_platform(**platform_kwargs, **cron_kwargs)
+    except TypeError as e:
+        # A Hermes older than PlatformEntry.cron_deliver_env_var /
+        # standalone_sender_fn rejects them as unexpected keywords. Register
+        # without them so chat keeps working; only cron delivery is missing.
+        # Any other TypeError (or any other exception) propagates unchanged.
+        if not any(name in str(e) for name in _CRON_REGISTER_KWARGS):
+            raise
+        logger.warning("SecureComs: this Hermes has no cron delivery hooks; scheduled messages are off")
+        ctx.register_platform(**platform_kwargs)