nSjw8dZddlmZddlZddlZddlZddlZddlmZddl m Z ddl m Z dZ Gdd eZGd d eZGd d eZGddeZGddeZGddeZeGddZeGddZejdZd5dZd6d Zd7d#Zd8d%Zd9d'Zd:d)Zd;d-Zdd4Z"dS)?u#Single resolver for every vision_analyze image source -> bytes + mime. All source handling (data:/http(s)/file/local/container) funnels through :func:`resolve_image_source` so size and magic-byte checks are enforced exactly once. Returns raw bytes (not a path): the downstream step is base64 -> data URL (RFC 2397) and provider base64 content blocks. Security (terminal-backend confinement, GHSA-gpxw-6wxv-w3qq): under a non-local terminal backend the file tools are confined to the sandbox (SECURITY.md 2.2), but vision read images host-side. This resolver enforces the same boundary: * local backend -> read any host path (chosen posture, unchanged) * non-local backend: path in a media cache -> host-read (the gateway/download caches live on the host and are bind-mounted into the sandbox) path anywhere else -> read the bytes *inside the sandbox* via exec-read (the agent can already ``cat`` any container file; this stays within the sandbox boundary and never reaches the host's ``/etc/passwd`` / ``~/.ssh``). So a prompt-injected ``vision_analyze('/etc/passwd')`` under Docker reads the *container's* file (what every other tool sees), not the host's — no escape — while container-only images (tmpfs ``/workspace``, root-owned) are still deliverable. This is the unified delivery + confinement model: the same mechanism that fixes "vision can't see container files" also closes the escape. ) annotationsN) dataclass)Path)Optionali c(eZdZddddfdZxZS) ImageResolutionErrorsrcoriginmessagestrr r cht|||c|_|_dS)N)super__init__r r )selfr r r __class__s 4/home/ice/.hermes/hermes-agent/tools/image_source.pyrzImageResolutionError.__init__/s/ !!! #V$+++)r rr rr r)__name__ __module__ __qualname__r __classcell__)rs@rrr.sL35R,,,,,,,,,,,,rrceZdZdS)UnsupportedSchemeNrrrrrrr4DrrceZdZdS) SourceUnsafeNrrrrr r 8rrr ceZdZdS)SourceTooLargeNrrrrr"r"<rrr"ceZdZdS)SourceNotFoundNrrrrr$r$@rrr$ceZdZdS) NotAnImageNrrrrr&r&Drrr&ceZdZUdZded<dS)ResolveContextN Optional[str]task_id)rrrr*__annotations__rrrr(r(Hs#!G!!!!!!rr(c.eZdZUded<ded<ded<dS) ResolvedImagebytesdatarmimer N)rrrr+rrrr-r-Ms+KKK IIIKKKKKrr-z^[A-Za-z][A-Za-z0-9+.\-]*://r rctxreturncTKt|tr|stdt||}|dr$t |\}}t ||d|S|drGt|}|rt||t t|d{Vdd|St |r8| dstd || dr|tddn|}tt j|}t'||}||r d d lm} n#t.$rd} YnwxYw| K | t|n1#t0$r$} tt| |d d} ~ wwxYwt3j|jd{V}t |dd |St9rtd|d|d t;|||d{VS)Nzimage_url is requiredr data:r/)zhttp://zhttps://r httpzfile://zgUnrecognized image source scheme. Use an http(s) URL, a local file path, a file:// URI, or a data: URL.r)raise_if_read_blockedfiler zimage file not found: '') isinstancerstripr$ startswith_resolve_data_url _finalize_http_block_reasonr _download_to_bytes _SCHEME_REmatchlowerrlenrospath expanduser_permitted_host_read_targetis_fileagent.file_safetyr7 Exception ValueErrorasyncio to_thread read_bytes_is_local_terminal_backend_resolve_container_fallback) r r1sr/r0reason candidatep host_targetr7excs rresolve_image_sourcerXYs c3  Dsyy{{D4#c((CCCC A||G0&q)) dtVQ///||+,,E#A&&  .v1--- -1!44444444b&!DDD 17799#7#7 #B#B  8    '(ggii&:&:9&E&EL#i..//""1I RW   * *++A .a55K;#6#6#8#8 ) ? ? ? ? ? ? ? ) ) )$( ! ! ! ) , C%%c+&6&67777 C C C"3s886BBBB C&{'=>>>>>>>>r61---!##S;q;;;6RRRR-QQ77 7 7 7 7 7 77s*G G.-G.4H H;H66H;rRtuple[bytes, str]c|d\}}}d|vrtd|dd|tddddd pd }t|d zd zt krt d |dd tj|d}n.#t$r!}td||ddd}~wwxYw||fS)N,z;base64z data: URL must be base64-encoded@r4r5;rzapplication/octet-streamzdata: URL exceeds size limitTvalidatezinvalid base64 in data: URL: ) partitionr&rDsplitr;_MAX_INGEST_BYTESr"base64 b64decoderK)rRheader_payloaddeclaredr/rWs rr=r=s"S))FAw;3B3HHHHc'llmm$**32215;;==[A[H G qQ!222;3B3HHHHL$777 LLL>>>AcrcFKKKKL >s4C C6C11C6urlr)cddlm}ddlm}||sdS||}|r|dpdSdS)u Return a human-readable block reason, or None when the URL is allowed. Pre-flight short-circuit: policy-blocked URLs are refused BEFORE any network I/O. ``_download_image`` re-checks policy internally (per attempt and against the final redirect target) — that second evaluation is intentional, not redundant: this one guarantees no bytes move for a blocked URL; the inner one covers redirects and non-resolver callers. Preserves the specific website-policy message so the agent sees *why*. r) is_safe_url)check_website_accesszblocked: unsafe or private URLr zblocked by website policyN)tools.url_safetyrntools.website_policyroget)rlrnroblockeds rr?r?sv-,,,,,999999 ;s  0//""3''GE{{9%%D)DD 4rr.cKddl}ddlm}|dd5}t |j}dddn #1swxYwY |||d{Vt j|jd{V | dS#t$r$}tt||d d}~wwxYw#| dwxYw) Nr)_download_imagez.imgF)suffixdeleteT) missing_okr6r ) tempfiletools.vision_toolsruNamedTemporaryFilernamerMrNrOunlinkPermissionErrorr r)rlryrutftmprWs rr@r@sYOOO222222  $ $F5 $ A AR27mm$oc3'''''''''&s~666666666 d #### ===3s88V<<<<= d ####s5AA  A 0B C#CCC C"boolcxtjdddvS)zTrue when the terminal backend runs directly on the host. Mirrors ``tools.browser_tool._is_local_backend`` and terminal_tool's own dispatch, which key off ``TERMINAL_ENV``. TERMINAL_ENVlocal)rr )rEgetenvr;rCrrrrPrPs3 9^W - - 3 3 5 5 ; ; = = NNrlistcVddlm}|}|dz |dz |dz |dz |dz |dz gS) a-Agent-managed media cache directories under HERMES_HOME (host side). The only host paths vision may read under a non-local backend: gateway- downloaded inbound media and the tools' own URL-download temp dirs. Covers the consolidated ``cache/`` layout and the legacy flat directories. r)get_hermes_homecache image_cache audio_cache video_cachetemp_vision_imagestemp_video_files)hermes_constantsr)rhomes r_media_cache_rootsrs^100000 ?  D w } } } ## !!  rrUrOptional[Path]ctr' |S#t$r|cYSwxYwddlm}t |t |} |}n#t$rYdSwxYwtD]=} |||cS#t$rY:wxYwdS)aReturn the host path to read, or ``None`` if a host read is not permitted. - Local backend: any path is permitted (chosen posture). Returns ``p``. - Non-local backend: permitted only if the path resolves inside a media cache root. A container-visible cache path (e.g. ``/root/.hermes/cache/ images/x.png``) is first translated back to its host mount; anything that is not under a cache returns ``None`` so the caller routes it to the in-sandbox exec-read instead of reading the host filesystem. r)from_agent_visible_cache_pathN) rPresolverKtools.credential_filesrrrr relative_torL)rUr1rhost_candidaterealroots rrHrHs"## 99;;    HHH EDDDDD77A??@@N%%'' tt"$$    T\\^^ , , ,KKK    H  4s0$ 33"A77 BB(C CCr*cP|sdS ddlm}||S#t$rYdSwxYw)Nr)get_active_env)tools.terminal_toolrrK)r*rs r_get_active_envrsX t666666~g&&& tts  %%cKddl}ddl}t|j}|t d|d|d|t |}|j|jdtdzd |d d{V}| d ddkrt d |d |d tj | ddd}n)#t$r} td|d| |d} ~ wwxYwt|tkrt!d|dt#|dd|S)aRead the image bytes inside the sandbox (fail-closed when none exists). Reached when a host read is not permitted or the host file is absent. The agent can already ``cat`` any container file (file_operations.py reads root-owned mode-600 files this way), so this stays within the same sandbox boundary and never touches the host filesystem. ``--`` stops a leading-dash path from being parsed as a ``base64`` option; ``base64 -w0`` is GNU-only, so pipe through ``tr -d`` for BusyBox. Fail-closed: if there is no active sandbox env we refuse rather than falling back to a host read, so a non-cache host path under a sandbox never leaks. rNr9z[' is not reachable inside the sandbox and no active sandbox session is available to read it containerr zhead -c r^z < z | base64 | tr -d '\n' returncodezcould not read 'z' inside the sandboxoutputr Traz%sandbox returned non-image data for 'z': r4image exceeds size limit)rMshlexrr*r$quoterrNexecutererrrfrgrKr&rDr"r>) rUr1r rMrenvqpresr/rWs rrQrQsNNNLLL #+ & &C { / / / /K))) ) SVV  B!! H$q(HHRHHHJJ J J J J J JC ww|Q1$$GGGGSYdeeeeW" 5 5EEE WWWLLLsLLRUVVVVW 4yy$$$7SUUUU T2{C 0 00s5*C D*DDr/ declared_mimer c$ddlm}t|tkrt d||||}|Bd|ddvrt |d| Std ||t ||| S) u(Intrinsic-correctness chokepoint: ingest byte cap + magic-byte sniff. The cap here is the generous 50MB *ingest* budget, not the 20MB provider payload cap — a 20-50MB image must survive this step so the call site can resize it under the payload cap. See ``_MAX_INGEST_BYTES``. r)"_detect_image_mime_type_from_bytesrr Nsr>?sFEEEEE 4yy$$$7SPPPP0066G d5D5k'')) ) )!dPPP P;VTTTT d @ @ @@r)r rr1r(r2r-)rRrr2rY)rlrr2r))rlrr2r.)r2r)r2r)rUrr1r(r2r)r*r))rUrr1r(r rr2r-) r/r.rrr rr rr2r-)#__doc__ __future__rrMrfrEre dataclassesrpathlibrtypingrrerKrrr r"r$r&r(r-compilerArXr=r?r@rPrrHrrQr>rrrrs4#""""" !!!!!!%,,,,,9,,,      ,        '        )        )        %    """"""" "  RZ7 8 8 88888888v    *$$$$"OOOO(@+1+1+1+1\AAAAAAr