`gjJNUdZddlmZddlZddlZddlZddlmZddlm Z ddl m Z m Z m Z ddlmZ ddlmZej&eZed Zd ed <d"d Zdad ed<d#dZ d$ d%dZ d$ d&dZd'dZd'dZ d$ d(dZda ded<d)dZ! d$ d*dZ"gdZ#ded< d$ d*dZ$ d$ d+dZ% d$ d,dZ& d$ d-dZ' d$ d*d Z(d.d!Z)y#e$rdZYwxYw)/uFile passthrough registry for remote terminal backends. Remote backends (Docker, Modal, SSH) create sandboxes with no host files. This module ensures that credential files, skill directories, and host-side cache directories (documents, images, audio, screenshots) are mounted or synced into those sandboxes so the agent can access them. **Credentials and skills** — session-scoped registry fed by skill declarations (``required_credential_files``) and user config (``terminal.credential_files``). **Cache directories** — gateway-cached uploads, browser screenshots, TTS audio, and processed images. Mounted read-only so the remote terminal can reference files the host side created (e.g. ``unzip`` an uploaded archive). Remote backends call :func:`get_credential_file_mounts`, :func:`get_skills_directory_mount` / :func:`iter_skills_files`, and :func:`get_cache_directory_mounts` / :func:`iter_cache_files` at sandbox creation time and before each command (for resync on Modal). ) annotationsN) ContextVar)Path)DictListOptional)cfg_get)get_read_block_error_registered_fileszContextVar[Dict[str, str]]_registered_files_varc| tjS#t$ri}tj||cYSwxYw)zSGet or create the registered credential files dict for the current context/session.)r get LookupErrorset)vals I/root/.hermes/venv/lib/python3.12/site-packages/tools/credential_files.py_get_registeredr+s=$((**  !!#& s ";;zList[Dict[str, str]] | None _config_filescddlm}|S)Nrget_hermes_home)hermes_constantsrrs r_resolve_hermes_homer9s0  ct}tjj|rtj d|y||z }ddlm}|||}|rtj d||y|j}|jstjd|yttjd|y tt|}|rtj d |y|j!d d |}t|t#|<tjd ||y #t$rtjd|YywxYw) ueRegister a credential file for mounting into remote sandboxes. *relative_path* is relative to ``HERMES_HOME`` (e.g. ``google_token.json``). Returns True if the file exists on the host and was registered. Security: rejects absolute paths and path traversal sequences (``..``). The resolved host path must remain inside HERMES_HOME so that a malicious skill cannot declare ``required_credential_files: ['../../.ssh/id_rsa']`` and exfiltrate sensitive host files into a container sandbox. Containment alone is not sufficient, because HERMES_HOME is exactly where the MASTER credential stores live. A skill legitimately needs its own service token (``google_token.json``); it never needs ``.env`` (every provider key), ``auth.json`` (all provider tokens and OAuth grants), ``mcp-tokens/`` or the Bitwarden plaintext cache. Those are refused via the canonical read deny-list (``agent.file_safety.get_read_block_error``) — the same guard that stops the agent reading them with ``read_file``, so the mount surface cannot hand a skill what the read surface denies it. zMcredential_files: rejected absolute path %r (must be relative to HERMES_HOME)Frvalidate_within_dirz1credential_files: rejected path traversal %r (%s)z)credential_files: skipping %s (not found)u|credential_files: refusing %r — agent.file_safety could not be imported, so the master-store deny-list cannot be consultedu3credential_files: refusing %r — read guard raiseducredential_files: refused %r — it is a credential store the agent is denied from reading; a skill may mount its own service token, not the master key files/z%credential_files: registered %s -> %sT)rospathisabsloggerwarningtools.path_securityrresolveis_filedebugr errorstr Exception exceptionrstripr) relative_pathcontainer_base hermes_home host_pathrcontainment_errorresolveddeniedcontainer_paths rregister_credential_filer5>sY.'(K ww}}]# [  m+I8+I{C ?     "H     @(K#  J  %c(m4  '   &--c231]ODN(+H On% LL8(NS #  A=  sD55EEc,g}|D]}t|tr|j}nHt|tr7|j dxs|j dxsdj}nl|sot ||r||j ||S)zRegister multiple credential files from skill frontmatter entries. Each entry is either a string (relative path) or a dict with a ``path`` key. Returns the list of relative paths that were NOT found on the host (i.e. missing files). r name) isinstancer)stripdictrr5append)entriesr.missingentryrel_paths rregister_credential_filesrAsG % eS !{{}H t $ &)DUYYv->D"KKMH  '.A NN8 $ % NrcttSg} ddlm}t}|}t |dd}t |t rddlm}|D]}t |ts|js%|j}tjj|rtjd|k||z }|||} | rtjd|| |j!} | j#sd |} |j%t| | d |atS#t&$r'} tjd | Yd} ~ |atSd} ~ wwxYw) z=Load ``terminal.credential_files`` from config.yaml (cached).Nr)read_raw_configterminalcredential_filesrz2credential_files: rejected absolute config path %rz8credential_files: rejected config path traversal %r (%s)z/root/.hermes/r0r4z8Could not read terminal.credential_files from config: %s)rhermes_cli.configrCrr r9listr$rr)r:rr r!r"r#r%r&r<r*) resultrCr/cfg cred_filesritemrelr0r1 resolved_pathr4es r_load_config_filesrPsR #%F V5*, S*.@A j$ ' ?" dC(TZZ\**,Cww}}S)PRU! +c 1I(;I{(S%(V!2!$-$5$5$7M$,,.+9#)? ),]);.<'' 4M  VQSTUUM  Vs+AD, D,1BD,$D,, E5EEcXi}tjD]$\}}t|js |||<&t D]1}|d}||vs t|djs*|d||<3|jDcgc] \}}||d c}}Scc}}w)zReturn all credential files that should be mounted into remote sandboxes. Each item has ``host_path`` and ``container_path`` keys. Combines skill-registered files and user config. r4r0rF)ritemsrr&rP)mountsr4r0r?cphps rget_credential_file_mountsrVs  F&5%6%<%<%>/!  ? " " $%.F> "/ $%, # $ V U;%7 8 @ @ B{+F2J,lln  BB/  sB&cg}t}|dz }|jr1t|}|j||j ddd ddlm}t|D]I\}}|jst|}|j||j dd|dK |S#t$rY|SwxYw)aMReturn mount info for all skill directories (local + external). Skills may include ``scripts/``, ``templates/``, and ``references/`` subdirectories that the agent needs to execute inside remote sandboxes. **Security:** Bind mounts follow symlinks, so a malicious symlink inside the skills tree could expose arbitrary host files to the container. When symlinks are detected, this function creates a sanitized copy (regular files only) in a temp directory and returns that path instead. When no symlinks are present (the common case), the original directory is returned directly with zero overhead. Returns a list of dicts with ``host_path`` and ``container_path`` keys. The local skills dir mounts at ``/skills``, external dirs at ``/external_skills/``. skillsr/skillsrFrget_external_skills_dirs/external_skills/) ris_dir_safe_skills_pathr<r,agent.skill_utilsr[ enumerate ImportError)r.rSr/ skills_dirr0r[idxext_dirs rget_skills_directory_mountres&F&(Kx'J%j1  "!/!6!6s!; %&>&@A LC~~-g6  !*)7)>)>s)C(DDUVYUZ&[  M   M s,B95B99 CCz Path | None_safe_skills_tempdirct |jdDcgc]}|js|}}|s t|S|D],}tj d|t j |.ddl}ddl ddl }tr+tjr jtdt|jd a |jdD]}|jr|j|} |z }|jr|j!dd N|j#s_|j$j!dd  j't|t| fd } |j)| tj+d t Scc}w) z@Return *skills_dir* if symlink-free, else a sanitized temp copy.*z:credential_files: skipping symlink in skills dir: %s -> %srNT ignore_errorszhermes-skills-safe-)prefix)parentsexist_okcNjrjdyy)NTri)r]rmtree)safe_dirshutilsr_cleanupz#_safe_skills_path.._cleanupIs" ??  MM($M 7 rz8credential_files: created symlink-safe skills copy at %s)rglob is_symlinkr)r"r#rreadlinkatexitrqtempfilerfr]rormkdtemp relative_tomkdirr&parentcopy2registerinfo) rbpsymlinkslinkrvrwrLrMtargetrrrprqs @@rr^r^'sr&++C0CaALLNCHC :0SR[[. 00 4 ; ; = *$ ?H$$,A$BCH#  % 1 ??  z*C ;;= LLL 5 \\^ MM  t  < LLTCK 0 18 OOH KKJHU x=IDs F5F5cg}t}|dz }|jr~|jdd}|jdD]V}|j s|j s$|j |}|jt||d|dX ddl m }t|D]\}} | js|jdd|}| jdD]V}|j s|j s$|j | }|jt||d|dX |S#t$rY|SwxYw) a>Yield individual (host_path, container_path) entries for skills files. Includes both the local skills dir and any external dirs configured via skills.external_dirs. Skips symlinks entirely. Preferred for backends that upload files individually (Daytona, Modal) rather than mounting a directory. rXrrYrhrFrrZr\) rr]r,rsrtr&ryr<r)r_r[r`ra) r.rIr/rbcontainer_rootrLrMr[rcrds riter_skills_filesrRsw$&F&(Kx'J*11#67w?$$S) D  "":.C MM Y%3$4AcU";    >%&>&@A LC>># . 5 5c :;;LSERN c* ??$DLLN&&w/ !$T)7(8#&?    M   M s!B/E E E ))zcache/documentsdocument_cache)z cache/images image_cache)z cache/audio audio_cache)z cache/videos video_cache)zcache/screenshotsbrowser_screenshots)z cache/web web_cache)zcache/delegationdelegation_cachezlist[tuple[str, str]] _CACHE_DIRScddlm}g}tD]R\}}|||}|js |j dd|}|j t ||dT|S)a Return mount entries for each cache directory that exists on disk. Used by Docker to create bind mounts. Each entry has ``host_path`` and ``container_path`` keys. The host path is resolved via ``get_hermes_dir()`` for backward compatibility with old directory layouts. rget_hermes_dirrrF)rrrr]r,r<r))r.rrS new_subpathold_namehost_dirr4s rget_cache_directory_mountsrst0#%F!, X!+x8 ??  . 5 5c :;1[MJN MM ]"0   Mrct|}t|D]J}t|d} |j|}t j |d|j cSy#t$rYYwxYw)aMap a host cache path to its mounted path under *container_base*. Returns the POSIX container path when *host_path* lives under one of the auto-mounted cache directories, otherwise ``None``. Backend-agnostic: the caller decides which ``container_base`` applies (Docker ``/root/.hermes``, SSH ``/.hermes``, etc.) and whether translation is wanted. Always joins with ``posixpath`` because container/remote paths are POSIX regardless of the host OS. r.r0r4N)rrry ValueError posixpathjoinas_posix)r0r.r mountrrMs rmap_cache_path_to_containerrs  ?D+>JGk*+ ""8,C~~e$45s||~FF G    sA&& A21A2ctjjdddk7r|St|}t |D]2} |j |d}tt|d|z cS|S#t $rYBwxYw)usTranslate a sandbox/container cache path back to its host path. Inverse of :func:`to_agent_visible_cache_path`. Returns the input unchanged when the active backend is not Docker, or when the path is not under any auto-mounted cache directory — the caller then treats a still-container path as "no host file" and falls back to an in-container read. TERMINAL_ENVlocaldockerrr4r0)renvironrrrryrr))r4r.r rrMs rfrom_agent_visible_cache_pathrs zz~~ng.(:  D+>J3 ""5)9#:;C4k*+c122 3    sA44 B?Bcrtjjdddk7r|St||}||S|S)aTranslate a host cache path to its mounted path inside the sandbox. Returns the input unchanged if it is not under any auto-mounted cache directory, or if the active terminal backend does not require path translation (only Docker for now). rrrr)rrrr)r0r.mappeds rto_agent_visible_cache_pathrs= zz~~ng.(: (> RF'66Y6rcfddlm}g}tD]\}}|||}|js |j dd|}|j dD]V}|j s|js$|j|}|jt||d|dX|S)zReturn individual (host_path, container_path) entries for cache files. Used by Modal to upload files individually and resync before each command. Skips symlinks. The container paths use the new ``cache/`` layout. rrrrhrF) rrrr]r,rsrtr&ryr<r)) r.rrIrrrrrLrMs riter_cache_filesrs0#%F!,  X!+x8 *11#67q FNN3' D  ""8,C MM Y%3$4AcU";     Mrc4tjy)z8Reset the skill-scoped registry (e.g. on session reset).N)rclearrrclear_credential_filesr sr)returnzDict[str, str])rr)z /root/.hermes)r-r)r.r)rbool)r=rHr.r)rz List[str])rList[Dict[str, str]])r.r)rzlist[Dict[str, str]])rbrrr))r.r)rr)r0r)r.r)rz Optional[str])r4r)r.r)rr))r0r)r.r)rr))rNone)*__doc__ __future__rloggingrr contextvarsrpathlibrtypingrrrrGr agent.file_safetyr ra getLogger__name__r"r __annotations__rrrr5rArPrVrerfr^rrrrrrrrrrrrs(# "''% 6   8 $5??R4S1S.2 *1*VVV Vv* 2*Z6****Z%)k((X*+++h& "*4*4* 4*777 7,*6Q  sC##C-,C-