ߩ^jJNUdZddlmZddlZddlZddlZddlmZddlm Z ddl m Z m Z m Z ddlmZ ddlmZn #e$rdZYnwxYwejeZed Zd ed <d4dZdaded<d5dZ d6d7dZ d6d8dZd9dZd9dZ d6d:d!Zda d"ed#<d;d%Z! d6dd/Z& d6d?d0Z' d6d %sT)rospathisabsloggerwarningtools.path_securityr$resolveis_filedebugr errorr Exception exceptionrstripr) rr hermes_home host_pathr$containment_errorresolveddeniedcontainer_paths rregister_credential_filer9>s.'((K w}}]## [    um+I877777++I{CC ?     u  ""H      @(KKKu#  J    u%c(mm44  A=   uu   '     u&--c22DD]DDN(+H On% LL8(NSSS 4s,D %D21D2entrieslist List[str]cbg}|D]}t|tr|}nUt|tr?|dp|dpd}n|st ||s|||S)zRegister multiple credential files from skill frontmatter entries. Each entry is either a string (relative path) or a dict with a ``path`` key. Returns the list of relative paths that were NOT found on the host (i.e. missing files). r'name) isinstancerstripdictrr9append)r:r missingentryrel_paths rregister_credential_filesrGsG % % eS ! ! {{}}HH t $ $  &))DUYYv->->D"KKMMHH   '.AA % NN8 $ $ $ NrList[Dict[str, str]]c0ttSg} ddlm}t}|}t |dd}t |t rddlm}|D]}t |tr| r| }tj |rtd|z||z }|||} | rtd|| |} | r*d |} |t| | d n2#t&$r%} td | Yd} ~ nd} ~ wwxYw|atS) z=Load ``terminal.credential_files`` from config.yaml (cached).Nr)read_raw_configterminalcredential_filesr#z2credential_files: rejected absolute config path %rz8credential_files: rejected config path traversal %r (%s)z/root/.hermes/r4r8z8Could not read terminal.credential_files from config: %s)rhermes_cli.configrJrr r@r;r+r$rrAr&r'r(r)r*r,r-rCr0) resultrJr3cfg cred_filesr$itemrelr4r5 resolved_pathr8es r_load_config_filesrVs #%F V555555*,, oS*.@AA j$ ' '  ? ? ? ? ? ?"  dC((TZZ\\**,,Cw}}S))!PRU! +c 1I(;(;I{(S(S%(!V!2!$-$5$5$7$7M$,,..)?#)?)? ),]););.<'' VVVQSTUUUUUUUUVM sE E F 'FF cxi}tD]+\}}t|r|||<,t D]@}|d}||vr2t|dr |d||<Ad|DS)zReturn all credential files that should be mounted into remote sandboxes. Each item has ``host_path`` and ``container_path`` keys. Combines skill-registered files and user config. r8r4cg|] \}}||d S)rM).0cphps r z.get_credential_file_mounts..s4    BB//   r)ritemsrr-rV)mountsr8r4rEr[s rget_credential_file_mountsr`s  F&5%6%6%<%<%>%>//!  ?? " " $ $ /%.F> "$%%,, # $ V  U;%7 8 8 @ @ B B {+F2J  llnn   rlist[Dict[str, str]]cg}t}|dz }|r=t|}|||ddd ddlm}t|D]X\}}|r?t|}|||dd|dYn#t$rYnwxYw|S)aMReturn mount info for all skill directories (local + external). Skills may include ``scripts/``, ``templates/``, and ``references/`` subdirectories that the agent needs to execute inside remote sandboxes. **Security:** Bind mounts follow symlinks, so a malicious symlink inside the skills tree could expose arbitrary host files to the container. When symlinks are detected, this function creates a sanitized copy (regular files only) in a temp directory and returns that path instead. When no symlinks are present (the common case), the original directory is returned directly with zero overhead. Returns a list of dicts with ``host_path`` and ``container_path`` keys. The local skills dir mounts at ``/skills``, external dirs at ``/external_skills/``. skillsr%/skillsrMrget_external_skills_dirs/external_skills/) ris_dir_safe_skills_pathrCr2agent.skill_utilsrf enumerate ImportError)r r_r3 skills_dirr4rfidxext_dirs rget_skills_directory_mountrpsI&F&((Kx'J %j11  "!/!6!6s!;!;DDD      >>>>>>%&>&>&@&@AA  LC~~ -g66  !*)7)>)>s)C)C&[&[VY&[&[        Ms(A6C C,+C,z Path | None_safe_skills_tempdirrmc d|dD}|st|S|D]0}td|t j|1ddl}ddl ddl}tr5t r tdt| d  a |dD]}|r||} |z }| r|dd ]|rL|jdd  t|t| fd }||td t S) z@Return *skills_dir* if symlink-free, else a sanitized temp copy.c:g|]}||SrY) is_symlink)rZps rr]z%_safe_skills_path..+s%CCCaALLNNCCCCr*z:credential_files: skipping symlink in skills dir: %s -> %srNT ignore_errorszhermes-skills-safe-)prefix)parentsexist_okcbrddSdS)NTrw)rhrmtree)safe_dirshutilsr_cleanupz#_safe_skills_path.._cleanupIs; ??   8 MM($M 7 7 7 7 7 8 8rz8credential_files: created symlink-safe skills copy at %s)rglobrr)r*r&readlinkatexitrtempfilerqrhr}rmkdtemprt relative_tomkdirr-parentcopy2registerinfo) rmsymlinkslinkrrrRrStargetrr~rs @@rriri'sDC:++C00CCCH :00SR[.. 0 0 0 0MMMMMMOOO@ 4 ; ; = =@ *$ ???H$$,A$BBCCH#  %% 1 1 ??    z**C ;;== 1 LLL 5 5 5 5 \\^^ 1 M  t  < < < LLTCKK 0 0 0888888 OOH KKJHUUU x==rcPg}t}|dz }|r|dd}|dD]j}|s|s+||}|t||d|dk ddl m }t|D]\}} | s|dd|}| dD]j}|s|s+|| }|t||d|dkn#t$rYnwxYw|S) a>Yield individual (host_path, container_path) entries for skills files. Includes both the local skills dir and any external dirs configured via skills.external_dirs. Skips symlinks entirely. Preferred for backends that upload files individually (Daytona, Modal) rather than mounting a directory. rcr%rdrvrMrrerg) rrhr2rrtr-rrCrrjrfrkrl) r rOr3rmcontainer_rootrRrSrfrnros riter_skills_filesrRs$&F&((Kx'J *11#66???$$S))  D     "":..C MM YY%3";";c";";      >>>>>>%&>&>&@&@AA  LC>>##  . 5 5c : :RRSRRN c**  ??$$DLLNN&&w// !$T)7&?&?#&?&?          MsCF F#"F#))zcache/documentsdocument_cache)z cache/images image_cache)z cache/audio audio_cache)z cache/videos video_cache)zcache/screenshotsbrowser_screenshots)z cache/web web_cache)zcache/delegationdelegation_cachezlist[tuple[str, str]] _CACHE_DIRScddlm}g}tD]d\}}|||}|r?|dd|}|t ||de|S)a Return mount entries for each cache directory that exists on disk. Used by Docker to create bind mounts. Each entry has ``host_path`` and ``container_path`` keys. The host path is resolved via ``get_hermes_dir()`` for backward compatibility with old directory layouts. rget_hermes_dirr%rM)rrrrhr2rCr)r rr_ new_subpathold_namehost_dirr8s rget_cache_directory_mountsrs0/////#%F!, X!>+x88 ??    . 5 5c : :JJ[JJN MM ]]"0    Mrr4 Optional[str]ct|}t|D]l}t|d} ||}n#t$rY:wxYwt j|d|cSdS)aMap a host cache path to its mounted path under *container_base*. Returns the POSIX container path when *host_path* lives under one of the auto-mounted cache directories, otherwise ``None``. Backend-agnostic: the caller decides which ``container_base`` applies (Docker ``/root/.hermes``, SSH ``/.hermes``, etc.) and whether translation is wanted. Always joins with ``posixpath`` because container/remote paths are POSIX regardless of the host OS. r r4r8N)rrr ValueError posixpathjoinas_posix)r4r r'mountrrSs rmap_cache_path_to_containerrs  ??D+>JJJGGk*++ ""8,,CC    H ~e$45s||~~FFFFF 4sA AAr8c<tjdddkr|St|}t |D]U} ||d}n#t $rY+wxYwtt|d|z cS|S)usTranslate a sandbox/container cache path back to its host path. Inverse of :func:`to_agent_visible_cache_path`. Returns the input unchanged when the active backend is not Docker, or when the path is not under any auto-mounted cache directory — the caller then treats a still-container path as "no host file" and falls back to an in-container read. TERMINAL_ENVlocaldockerrr8r4)r&environrrrrrr)r8r r'rrSs rfrom_agent_visible_cache_pathrs z~~ng..(::   D+>JJJ33 ""5)9#:;;CC    H 4k*++c122222 s A%% A21A2c|tjdddkr|St||}||n|S)aTranslate a host cache path to its mounted path inside the sandbox. Returns the input unchanged if it is not under any auto-mounted cache directory, or if the active terminal backend does not require path translation (only Docker for now). rrrr)r&rrr)r4r mappeds rto_agent_visible_cache_pathrsF z~~ng..(:: (> R R RF'66Y6rcddlm}g}tD]\}}|||}|s&|dd|}|dD]j}|s|s+||}| t||d|dk|S)zReturn individual (host_path, container_path) entries for cache files. Used by Modal to upload files individually and resync before each command. Skips symlinks. The container paths use the new ``cache/`` layout. rrr%rvrM) rrrrhr2rrtr-rrCr) r rrOrrrrrRrSs riter_cache_filesrs0/////#%F!,   X!>+x88    *11#66FFFFNN3''  D     ""8,,C MM YY%3";";c";";       MrNonecFtdS)z8Reset the skill-scoped registry (e.g. on session reset).N)rclearrYrrclear_credential_filesr s r)r r)r r)r)rrr rr r!)r:r;r rr r<)r rH)r rr ra)rmrr r)r rr rH)r4rr rr r)r8rr rr r)r4rr rr r)r r)*__doc__ __future__rloggingr&r contextvarsrpathlibrtypingrrrrNr agent.file_safetyr rl getLogger__name__r)r __annotations__rrrr9rGrVr`rprqrirrrrrrrrrYrrrs(#""""" """"""''''''''''%%%%%% 6666666      8 $ $5?J?R4S4SSSSS.2 1111*VVVVVv*2****Z6******Z%)((((((((X*+++++h&&& *4*4*4*77777,*6s:AA