i>NUdZddlmZddlZddlZddlmZddlmZddl m Z m Z ddl m Z ejeZedZd ed <d/d Zdaded<d0dZ d1d2dZ d1d3dZd4dZd4dZ d1d5d Zdad!ed"<d6d$Z d1d7d%Zgd&Zd'ed(< d1d7d)Z d1d8d+Z d1d7d,Z!d9d.Z"dS):uFile passthrough registry for remote terminal backends. Remote backends (Docker, Modal, SSH) create sandboxes with no host files. This module ensures that credential files, skill directories, and host-side cache directories (documents, images, audio, screenshots) are mounted or synced into those sandboxes so the agent can access them. **Credentials and skills** — session-scoped registry fed by skill declarations (``required_credential_files``) and user config (``terminal.credential_files``). **Cache directories** — gateway-cached uploads, browser screenshots, TTS audio, and processed images. Mounted read-only so the remote terminal can reference files the host side created (e.g. ``unzip`` an uploaded archive). Remote backends call :func:`get_credential_file_mounts`, :func:`get_skills_directory_mount` / :func:`iter_skills_files`, and :func:`get_cache_directory_mounts` / :func:`iter_cache_files` at sandbox creation time and before each command (for resync on Modal). ) annotationsN) ContextVar)Path)DictList)cfg_get_registered_fileszContextVar[Dict[str, str]]_registered_files_varreturnDict[str, str]c tS#t$r!i}t||cYSwxYw)zSGet or create the registered credential files dict for the current context/session.)r get LookupErrorset)vals ;/home/piyush/.hermes/hermes-agent/tools/credential_files.py_get_registeredr%sV$((***  !!#&&& s(AAzList[Dict[str, str]] | None _config_filesrc"ddlm}|S)Nrget_hermes_home)hermes_constantsrrs r_resolve_hermes_homer3s"000000 ?   /root/.hermes relative_pathstrcontainer_baseboolc:t}tj|rtd|dS||z }ddlm}|||}|rtd||dS|}| st d|dS| dd|}t|t|<t d||d S) aRegister a credential file for mounting into remote sandboxes. *relative_path* is relative to ``HERMES_HOME`` (e.g. ``google_token.json``). Returns True if the file exists on the host and was registered. Security: rejects absolute paths and path traversal sequences (``..``). The resolved host path must remain inside HERMES_HOME so that a malicious skill cannot declare ``required_credential_files: ['../../.ssh/id_rsa']`` and exfiltrate sensitive host files into a container sandbox. zMcredential_files: rejected absolute path %r (must be relative to HERMES_HOME)Frvalidate_within_dirz1credential_files: rejected path traversal %r (%s)z)credential_files: skipping %s (not found)/z%credential_files: registered %s -> %sT)rospathisabsloggerwarningtools.path_securityr"resolveis_filedebugrstriprr)rr hermes_home host_pathr"containment_errorresolvedcontainer_paths rregister_credential_filer38s;'((K w}}]## [    um+I877777++I{CC ?     u  ""H      @(KKKu&--c22DD]DDN(+H On% LL8(NSSS 4rentrieslist List[str]cbg}|D]}t|tr|}nUt|tr?|dp|dpd}n|st ||s|||S)zRegister multiple credential files from skill frontmatter entries. Each entry is either a string (relative path) or a dict with a ``path`` key. Returns the list of relative paths that were NOT found on the host (i.e. missing files). r%name) isinstancerstripdictrr3append)r4rmissingentryrel_paths rregister_credential_filesrAjsG % % eS ! ! {{}}HH t $ $  &))DUYYv->->D"KKMMHH   '.AA % NN8 $ $ $ NrList[Dict[str, str]]c0ttSg} ddlm}t}|}t |dd}t |t rddlm}|D]}t |tr| r| }tj |rtd|z||z }|||} | rtd|| |} | r*d |} |t| | d n2#t&$r%} td | Yd} ~ nd} ~ wwxYw|atS) z=Load ``terminal.credential_files`` from config.yaml (cached).Nr)read_raw_configterminalcredential_filesr!z2credential_files: rejected absolute config path %rz8credential_files: rejected config path traversal %r (%s)z/root/.hermes/r/r2z8Could not read terminal.credential_files from config: %s)rhermes_cli.configrDrrr:r5r)r"rr;r$r%r&r'r(r*r+r= Exception) resultrDr.cfg cred_filesr"itemrelr/r0 resolved_pathr2es r_load_config_filesrQs #%F V555555*,, oS*.@AA j$ ' '  ? ? ? ? ? ?"  dC((TZZ\\**,,Cw}}S))!PRU! +c 1I(;(;I{(S(S%(!V!2!$-$5$5$7$7M$,,..)?#)?)? ),]););.<'' VVVQSTUUUUUUUUVM sE E F 'FF cxi}tD]+\}}t|r|||<,t D]@}|d}||vr2t|dr |d||<Ad|DS)zReturn all credential files that should be mounted into remote sandboxes. Each item has ``host_path`` and ``container_path`` keys. Combines skill-registered files and user config. r2r/cg|] \}}||d S)rG).0cphps r z.get_credential_file_mounts..s4    BB//   r)ritemsrr+rQ)mountsr2r/r?rVs rget_credential_file_mountsr[s  F&5%6%6%<%<%>%>//!  ?? " " $ $ /%.F> "$%%,, # $ V  U;%7 8 8 @ @ B B {+F2J  llnn   rlist[Dict[str, str]]cg}t}|dz }|r=t|}|||ddd ddlm}t|D]X\}}|r?t|}|||dd|dYn#t$rYnwxYw|S)aMReturn mount info for all skill directories (local + external). Skills may include ``scripts/``, ``templates/``, and ``references/`` subdirectories that the agent needs to execute inside remote sandboxes. **Security:** Bind mounts follow symlinks, so a malicious symlink inside the skills tree could expose arbitrary host files to the container. When symlinks are detected, this function creates a sanitized copy (regular files only) in a temp directory and returns that path instead. When no symlinks are present (the common case), the original directory is returned directly with zero overhead. Returns a list of dicts with ``host_path`` and ``container_path`` keys. The local skills dir mounts at ``/skills``, external dirs at ``/external_skills/``. skillsr#/skillsrGrget_external_skills_dirs/external_skills/) ris_dir_safe_skills_pathr=r-agent.skill_utilsra enumerate ImportError)rrZr. skills_dirr/raidxext_dirs rget_skills_directory_mountrksI&F&((Kx'J %j11  "!/!6!6s!;!;DDD      >>>>>>%&>&>&@&@AA  LC~~ -g66  !*)7)>)>s)C)C&[&[VY&[&[        Ms(A6C C,+C,z Path | None_safe_skills_tempdirrhc d|dD}|st|S|D]0}td|t j|1ddl}ddl ddl}tr5t r tdt| d  a |dD]}|r||} |z }| r|dd ]|rL|jdd  t|t| fd }||td t S) z@Return *skills_dir* if symlink-free, else a sanitized temp copy.c:g|]}||SrT) is_symlink)rUps rrXz%_safe_skills_path..s%CCCaALLNNCCCCr*z:credential_files: skipping symlink in skills dir: %s -> %srNT ignore_errorszhermes-skills-safe-)prefix)parentsexist_okcbrddSdS)NTrr)rcrmtree)safe_dirshutilsr_cleanupz#_safe_skills_path.._cleanups; ??   8 MM($M 7 7 7 7 7 8 8rz8credential_files: created symlink-safe skills copy at %s)rglobrr'r(r$readlinkatexitrztempfilerlrcrxrmkdtempro relative_tomkdirr+parentcopy2registerinfo) rhsymlinkslinkr~rrMrNtargetr{ryrzs @@rrdrdsDC:++C00CCCH :00SR[.. 0 0 0 0MMMMMMOOO@ 4 ; ; = =@ *$ ???H$$,A$BBCCH#  %% 1 1 ??    z**C ;;== 1 LLL 5 5 5 5 \\^^ 1 M  t  < < < LLTCKK 0 0 0888888 OOH KKJHUUU x==rcPg}t}|dz }|r|dd}|dD]j}|s|s+||}|t||d|dk ddl m }t|D]\}} | s|dd|}| dD]j}|s|s+|| }|t||d|dkn#t$rYnwxYw|S) a>Yield individual (host_path, container_path) entries for skills files. Includes both the local skills dir and any external dirs configured via skills.external_dirs. Skips symlinks entirely. Preferred for backends that upload files individually (Daytona, Modal) rather than mounting a directory. r^r#r_rqrGrr`rb) rrcr-r|ror+rr=rrerarfrg) rrJr.rhcontainer_rootrMrNrarirjs riter_skills_filesr%s$&F&((Kx'J *11#66???$$S))  D     "":..C MM YY%3";";c";";      >>>>>>%&>&>&@&@AA  LC>>##  . 5 5c : :RRSRRN c**  ??$$DLLNN&&w// !$T)7&?&?#&?&?          MsCF F#"F#))zcache/documentsdocument_cache)z cache/images image_cache)z cache/audio audio_cache)zcache/screenshotsbrowser_screenshotszlist[tuple[str, str]] _CACHE_DIRScddlm}g}tD]d\}}|||}|r?|dd|}|t ||de|S)a Return mount entries for each cache directory that exists on disk. Used by Docker to create bind mounts. Each entry has ``host_path`` and ``container_path`` keys. The host path is resolved via ``get_hermes_dir()`` for backward compatibility with old directory layouts. rget_hermes_dirr#rG)rrrrcr-r=r)rrrZ new_subpathold_namehost_dirr2s rget_cache_directory_mountsras0/////#%F!, X!>+x88 ??    . 5 5c : :JJ[JJN MM ]]"0    Mrr/cXtjdddkr|St|}t |D]c}t|d} ||}t t|d|z cS#t$rY`wxYw|S)aTranslate a host cache path to its mounted path inside the sandbox. Returns the input unchanged if it is not under any auto-mounted cache directory, or if the active terminal backend does not require path translation (only Docker for now). TERMINAL_ENVlocaldocker)rr/r2)r$environrrrrr ValueError)r/rr%mountrrNs rto_agent_visible_cache_pathrys z~~ng..(::  ??D+>JJJk*++ ""8,,CtE"2344s:;; ; ; ;    H  s9B B'&B'cddlm}g}tD]\}}|||}|s&|dd|}|dD]j}|s|s+||}| t||d|dk|S)zReturn individual (host_path, container_path) entries for cache files. Used by Modal to upload files individually and resync before each command. Skips symlinks. The container paths use the new ``cache/`` layout. rrr#rqrG) rrrrcr-r|ror+rr=r) rrrJrrrrrMrNs riter_cache_filesrs0/////#%F!,   X!>+x88    *11#66FFFFNN3''  D     ""8,,C MM YY%3";";c";";       MrNonecFtdS)z8Reset the skill-scoped registry (e.g. on session reset).N)rclearrTrrclear_credential_filesrs r)r r )r r)r)rrrrr r)r4r5rrr r6)r rB)rrr r\)rhrr r)rrr rB)r/rrrr r)r r)#__doc__ __future__rloggingr$ contextvarsrpathlibrtypingrrrHr getLogger__name__r'r __annotations__rrrr3rArQr[rkrlrdrrrrrrrTrrrs^(#""""" """"""%%%%%%  8 $ $5?J?R4S4SSSSS.2 1111*/////h*2****Z6******Z%)((((((((X*+++++h&&& *4*:*6r