`gjw8dZddlmZddlZddlZddlZddlZddlmZddl m Z ddl m Z dZ Gdd eZGd d eZGd d eZGddeZGddeZGddeZeGddZeGddZej.dZd#dZd$dZd%dZd&dZd'dZd(dZd)dZd*d Z d+d!Z!d,d"Z"y)-u#Single resolver for every vision_analyze image source -> bytes + mime. All source handling (data:/http(s)/file/local/container) funnels through :func:`resolve_image_source` so size and magic-byte checks are enforced exactly once. Returns raw bytes (not a path): the downstream step is base64 -> data URL (RFC 2397) and provider base64 content blocks. Security (terminal-backend confinement, GHSA-gpxw-6wxv-w3qq): under a non-local terminal backend the file tools are confined to the sandbox (SECURITY.md 2.2), but vision read images host-side. This resolver enforces the same boundary: * local backend -> read any host path (chosen posture, unchanged) * non-local backend: path in a media cache -> host-read (the gateway/download caches live on the host and are bind-mounted into the sandbox) path anywhere else -> read the bytes *inside the sandbox* via exec-read (the agent can already ``cat`` any container file; this stays within the sandbox boundary and never reaches the host's ``/etc/passwd`` / ``~/.ssh``). So a prompt-injected ``vision_analyze('/etc/passwd')`` under Docker reads the *container's* file (what every other tool sees), not the host's — no escape — while container-only images (tmpfs ``/workspace``, root-owned) are still deliverable. This is the unified delivery + confinement model: the same mechanism that fixes "vision can't see container files" also closes the escape. ) annotationsN) dataclass)Path)Optionali c(eZdZddddfdZxZS)ImageResolutionErrorsrcorigincBt||||c|_|_y)N)super__init__r r )selfmessager r __class__s E/root/.hermes/venv/lib/python3.12/site-packages/tools/image_source.pyrzImageResolutionError.__init__/s  ! #V$+)rstrr rr r)__name__ __module__ __qualname__r __classcell__)rs@rrr.s35R,,rrc eZdZy)UnsupportedSchemeNrrrrrrr4rrc eZdZy) SourceUnsafeNrrrrr r 8rrr c eZdZy)SourceTooLargeNrrrrr"r"<rrr"c eZdZy)SourceNotFoundNrrrrr$r$@rrr$c eZdZy) NotAnImageNrrrrr&r&Drrr&ceZdZUdZded<y)ResolveContextN Optional[str]task_id)rrrr*__annotations__rrrr(r(Hs !G]!rr(c,eZdZUded<ded<ded<y) ResolvedImagebytesdatarmimer N)rrrr+rrrr-r-Ms K I Krr-z^[A-Za-z][A-Za-z0-9+.\-]*://crKt|tr|jstdt||j}|j drt |\}}t ||d|S|j dr9t|}|r t||t t|d{dd|Stj|r,|jj ds td ||jj dr|tddn|}tt j"j%|}t'||}|`|j)rP d d lm} |  | t|t3j4|j6d{}t |dd |St9rtd|d|d t;|||d{S7C#t.$rd} YwxYw#t0$r} tt| |d d} ~ wwxYw77Bw)Nzimage_url is requiredr data:r/)zhttp://zhttps://r httpzfile://zgUnrecognized image source scheme. Use an http(s) URL, a local file path, a file:// URI, or a data: URL.r)raise_if_read_blockedfiler zimage file not found: '') isinstancerstripr$ startswith_resolve_data_url _finalize_http_block_reasonr _download_to_bytes _SCHEME_REmatchlowerrlenrospath expanduser_permitted_host_read_targetis_fileagent.file_safetyr5 Exception ValueErrorasyncio to_thread read_bytes_is_local_terminal_backend_resolve_container_fallback) r ctxsr/r0reason candidatep host_targetr5excs rresolve_image_sourcerWYs c3 syy{4#c(CC A||G&q) dtVQ//||+,#A& v1- -1!44b&!DD1779#7#7 #B 8  '(ggi&:&:9&E#i./"1I RWW   *+A .a5K;#6#6#8 ) ? ! , C%c+&67&&{'='=>>r61--!#6qc;6RR-QQ7 77[5: )$( ! )  C"3s86BB C> 8syB2H74G75CH77G:=H7H "H73H34>H72H53H7: HH7HH7 H0H++H00H75H7c|jd\}}}d|vrtd|dd|tddjddd j xsd }t|d zd zt kDrt d |dd tj|d}||fS#t$r}td||ddd}~wwxYw)N,z;base64z data: URL must be base64-encoded@r2r3;rzapplication/octet-streamzdata: URL exceeds size limitTvalidatezinvalid base64 in data: URL: ) partitionr&rBsplitr9_MAX_INGEST_BYTESr"base64 b64decoderI)rQheader_payloaddeclaredr/rVs rr;r;sS)FAw;3BHHc'lm$**3215;;=[A[H G qQ!22;3BHHL$7 > L8>AcrFKKLsB!! C*B==Cclddlm}ddlm}||sy||}|r|j dxsdSy)u Return a human-readable block reason, or None when the URL is allowed. Pre-flight short-circuit: policy-blocked URLs are refused BEFORE any network I/O. ``_download_image`` re-checks policy internally (per attempt and against the final redirect target) — that second evaluation is intentional, not redundant: this one guarantees no bytes move for a blocked URL; the inner one covers redirects and non-resolver callers. Preserves the specific website-policy message so the agent sees *why*. r) is_safe_url)check_website_accesszblocked: unsafe or private URLrzblocked by website policyN)tools.url_safetyrktools.website_policyrlget)urlrkrlblockeds rr=r=s:-9 s /"3'G{{9%D)DD rcKddl}ddlm}|jdd5}t |j }ddd ||d{t j|jd{|jdS#1swYTxYw7I7$#t$r}tt||d d}~wwxYw#jdwxYww) Nr)_download_imagez.imgF)suffixdeleteT) missing_okr4r ) tempfiletools.vision_toolsrsNamedTemporaryFilernamerKrLrMunlinkPermissionErrorr r)rprwrstftmprVs rr>r>s2  $ $F5 $ AR277m$c3'''&&s~~66 d # (6 =3s8V<<= d #snCB C B B &B2B3B6C BCBB B>"B99B>>CCCcjtjddjjdvS)zTrue when the terminal backend runs directly on the host. Mirrors ``tools.browser_tool._is_local_backend`` and terminal_tool's own dispatch, which key off ``TERMINAL_ENV``. TERMINAL_ENVlocal)rr )rCgetenvr9rArrrrNrNs, 99^W - 3 3 5 ; ; = NNrcPddlm}|}|dz |dz |dz |dz |dz |dz gS) a-Agent-managed media cache directories under HERMES_HOME (host side). The only host paths vision may read under a non-local backend: gateway- downloaded inbound media and the tools' own URL-download temp dirs. Covers the consolidated ``cache/`` layout and the legacy flat directories. r)get_hermes_homecache image_cache audio_cache video_cachetemp_vision_imagestemp_video_files)hermes_constantsr)rhomes r_media_cache_rootsrsJ1  D w } } } ## !!  rc^tr |jSddlm}t |t |} |j}tD]%} |j|j|cSy#t$r|cYSwxYw#t$rYywxYw#t$rYTwxYw)aReturn the host path to read, or ``None`` if a host read is not permitted. - Local backend: any path is permitted (chosen posture). Returns ``p``. - Non-local backend: permitted only if the path resolves inside a media cache root. A container-visible cache path (e.g. ``/root/.hermes/cache/ images/x.png``) is first translated back to its host mount; anything that is not under a cache returns ``None`` so the caller routes it to the in-sandbox exec-read instead of reading the host filesystem. r)from_agent_visible_cache_pathN) rNresolverItools.credential_filesrrrr relative_torJ)rTrPrhost_candidaterealroots rrFrFs"# 99; E7A?@N%%'#$    T\\^ ,K ! H      s4BB B  B B BB B,+B,cD|sy ddlm}||S#t$rYywxYw)Nr)get_active_env)tools.terminal_toolrrI)r*rs r_get_active_envrs- 6g&& s  cLKddl}ddl}t|j}|t d|d|d|j t |}|j|jdtdzd |d d{}|jd ddk7rt d |d |d tj|jddd}t|tkDrt!d|dt#|dd|S7#t$r} td|d| |d} ~ wwxYww)aRead the image bytes inside the sandbox (fail-closed when none exists). Reached when a host read is not permitted or the host file is absent. The agent can already ``cat`` any container file (file_operations.py reads root-owned mode-600 files this way), so this stays within the same sandbox boundary and never touches the host filesystem. ``--`` stops a leading-dash path from being parsed as a ``base64`` option; ``base64 -w0`` is GNU-only, so pipe through ``tr -d`` for BusyBox. Fail-closed: if there is no active sandbox env we refuse rather than falling back to a host read, so a non-cache host path under a sandbox never leaks. rNr7z[' is not reachable inside the sandbox and no active sandbox session is available to read it containerr zhead -c r\z < z | base64 | tr -d '\n' returncodezcould not read 'z' inside the sandboxoutputr Tr_z%sandbox returned non-image data for 'z': r2image exceeds size limit)rKshlexrr*r$quoterrLexecutercrordrerIr&rBr"r<) rTrPr rKrenvqpresr/rVs rrOrOsJ #++ &C {s. /K) ) SV B!!! $q()RD0GHJ JC ww|Q1$/s2FGSYdeeW" 5E 4y$$7SUU T2{C 00 J W@3seLRUVVWs6A:D$<C>=+D$)'D/D$ D! DD!!D$cddlm}t|tkDrt d||||}|1d|ddj vrt |d| Std ||t ||| S) u(Intrinsic-correctness chokepoint: ingest byte cap + magic-byte sniff. The cap here is the generous 50MB *ingest* budget, not the 20MB provider payload cap — a 20-50MB image must survive this step so the call site can resize it under the payload cap. See ``_MAX_INGEST_BYTES``. r)"_detect_image_mime_type_from_bytesrr NsrNrrFrrOr<rrrrs4# !%,9,  ,  '  )  )  %  "" "  RZZ7 8 88v *$"O(@+1\Ar