)jAfUdZddlmZddlZddlZddlZddlmZddlm Z ddl m Z m Z m Z ddlmZejeZedZd ed <d1d Zdaded<d2dZ d3d4dZ d3d5dZd6dZd6dZ d3d7d Zdad!ed"<d8d$Z d3d9d%Zgd&Z d'ed(< d3d9d)Z! d3d:d,Z" d3d;d-Z# d3d9d.Z$d %sT)rospathisabsloggerwarningtools.path_securityr#resolveis_filedebugrstriprr)rr hermes_home host_pathr#containment_errorresolvedcontainer_paths rregister_credential_filer49s;'((K w}}]## [    um+I877777++I{CC ?     u  ""H      @(KKKu&--c22DD]DDN(+H On% LL8(NSSS 4rentrieslist List[str]cbg}|D]}t|tr|}nUt|tr?|dp|dpd}n|st ||s|||S)zRegister multiple credential files from skill frontmatter entries. Each entry is either a string (relative path) or a dict with a ``path`` key. Returns the list of relative paths that were NOT found on the host (i.e. missing files). r&name) isinstancerstripdictrr4append)r5rmissingentryrel_paths rregister_credential_filesrBksG % % eS ! ! {{}}HH t $ $  &))DUYYv->->D"KKMMHH   '.AA % NN8 $ $ $ NrList[Dict[str, str]]c0ttSg} ddlm}t}|}t |dd}t |t rddlm}|D]}t |tr| r| }tj |rtd|z||z }|||} | rtd|| |} | r*d |} |t| | d n2#t&$r%} td | Yd} ~ nd} ~ wwxYw|atS) z=Load ``terminal.credential_files`` from config.yaml (cached).Nr)read_raw_configterminalcredential_filesr"z2credential_files: rejected absolute config path %rz8credential_files: rejected config path traversal %r (%s)z/root/.hermes/r0r3z8Could not read terminal.credential_files from config: %s)rhermes_cli.configrErr r;r6r*r#rr<r%r&r'r(r)r+r,r> Exception) resultrEr/cfg cred_filesr#itemrelr0r1 resolved_pathr3es r_load_config_filesrRs #%F V555555*,, oS*.@AA j$ ' '  ? ? ? ? ? ?"  dC((TZZ\\**,,Cw}}S))!PRU! +c 1I(;(;I{(S(S%(!V!2!$-$5$5$7$7M$,,..)?#)?)? ),]););.<'' VVVQSTUUUUUUUUVM sE E F 'FF cxi}tD]+\}}t|r|||<,t D]@}|d}||vr2t|dr |d||<Ad|DS)zReturn all credential files that should be mounted into remote sandboxes. Each item has ``host_path`` and ``container_path`` keys. Combines skill-registered files and user config. r3r0cg|] \}}||d S)rH).0cphps r z.get_credential_file_mounts..s4    BB//   r)ritemsrr,rR)mountsr3r0r@rWs rget_credential_file_mountsr\s  F&5%6%6%<%<%>%>//!  ?? " " $ $ /%.F> "$%%,, # $ V  U;%7 8 8 @ @ B B {+F2J  llnn   rlist[Dict[str, str]]cg}t}|dz }|r=t|}|||ddd ddlm}t|D]X\}}|r?t|}|||dd|dYn#t$rYnwxYw|S)aMReturn mount info for all skill directories (local + external). Skills may include ``scripts/``, ``templates/``, and ``references/`` subdirectories that the agent needs to execute inside remote sandboxes. **Security:** Bind mounts follow symlinks, so a malicious symlink inside the skills tree could expose arbitrary host files to the container. When symlinks are detected, this function creates a sanitized copy (regular files only) in a temp directory and returns that path instead. When no symlinks are present (the common case), the original directory is returned directly with zero overhead. Returns a list of dicts with ``host_path`` and ``container_path`` keys. The local skills dir mounts at ``/skills``, external dirs at ``/external_skills/``. skillsr$/skillsrHrget_external_skills_dirs/external_skills/) ris_dir_safe_skills_pathr>r.agent.skill_utilsrb enumerate ImportError)rr[r/ skills_dirr0rbidxext_dirs rget_skills_directory_mountrlsI&F&((Kx'J %j11  "!/!6!6s!;!;DDD      >>>>>>%&>&>&@&@AA  LC~~ -g66  !*)7)>)>s)C)C&[&[VY&[&[        Ms(A6C C,+C,z Path | None_safe_skills_tempdirric d|dD}|st|S|D]0}td|t j|1ddl}ddl ddl}tr5t r tdt| d  a |dD]}|r||} |z }| r|dd ]|rL|jdd  t|t| fd }||td t S) z@Return *skills_dir* if symlink-free, else a sanitized temp copy.c:g|]}||SrU) is_symlink)rVps rrYz%_safe_skills_path..s%CCCaALLNNCCCCr*z:credential_files: skipping symlink in skills dir: %s -> %srNT ignore_errorszhermes-skills-safe-)prefix)parentsexist_okcbrddSdS)NTrs)rdrmtree)safe_dirshutilsr_cleanupz#_safe_skills_path.._cleanups; ??   8 MM($M 7 7 7 7 7 8 8rz8credential_files: created symlink-safe skills copy at %s)rglobrr(r)r%readlinkatexitr{tempfilermrdryrmkdtemprp relative_tomkdirr,parentcopy2registerinfo) risymlinkslinkrrrNrOtargetr|rzr{s @@rreresDC:++C00CCCH :00SR[.. 0 0 0 0MMMMMMOOO@ 4 ; ; = =@ *$ ???H$$,A$BBCCH#  %% 1 1 ??    z**C ;;== 1 LLL 5 5 5 5 \\^^ 1 M  t  < < < LLTCKK 0 0 0888888 OOH KKJHUUU x==rcPg}t}|dz }|r|dd}|dD]j}|s|s+||}|t||d|dk ddl m }t|D]\}} | s|dd|}| dD]j}|s|s+|| }|t||d|dkn#t$rYnwxYw|S) a>Yield individual (host_path, container_path) entries for skills files. Includes both the local skills dir and any external dirs configured via skills.external_dirs. Skips symlinks entirely. Preferred for backends that upload files individually (Daytona, Modal) rather than mounting a directory. r_r$r`rrrHrrarc) rrdr.r}rpr,rr>rrfrbrgrh) rrKr/ricontainer_rootrNrOrbrjrks riter_skills_filesr&s$&F&((Kx'J *11#66???$$S))  D     "":..C MM YY%3";";c";";      >>>>>>%&>&>&@&@AA  LC>>##  . 5 5c : :RRSRRN c**  ??$$DLLNN&&w// !$T)7&?&?#&?&?          MsCF F#"F#))zcache/documentsdocument_cache)z cache/images image_cache)z cache/audio audio_cache)zcache/screenshotsbrowser_screenshotszlist[tuple[str, str]] _CACHE_DIRScddlm}g}tD]d\}}|||}|r?|dd|}|t ||de|S)a Return mount entries for each cache directory that exists on disk. Used by Docker to create bind mounts. Each entry has ``host_path`` and ``container_path`` keys. The host path is resolved via ``get_hermes_dir()`` for backward compatibility with old directory layouts. rget_hermes_dirr$rH)rrrrdr.r>r)rrr[ new_subpathold_namehost_dirr3s rget_cache_directory_mountsrbs0/////#%F!, X!>+x88 ??    . 5 5c : :JJ[JJN MM ]]"0    Mrr0 Optional[str]ct|}t|D]l}t|d} ||}n#t$rY:wxYwt j|d|cSdS)aMap a host cache path to its mounted path under *container_base*. Returns the POSIX container path when *host_path* lives under one of the auto-mounted cache directories, otherwise ``None``. Backend-agnostic: the caller decides which ``container_base`` applies (Docker ``/root/.hermes``, SSH ``/.hermes``, etc.) and whether translation is wanted. Always joins with ``posixpath`` because container/remote paths are POSIX regardless of the host OS. rr0r3N)rrr ValueError posixpathjoinas_posix)r0rr&mountrrOs rmap_cache_path_to_containerrzs  ??D+>JJJGGk*++ ""8,,CC    H ~e$45s||~~FFFFF 4sA AAc|tjdddkr|St||}||n|S)aTranslate a host cache path to its mounted path inside the sandbox. Returns the input unchanged if it is not under any auto-mounted cache directory, or if the active terminal backend does not require path translation (only Docker for now). TERMINAL_ENVlocaldockerr)r%environrr)r0rmappeds rto_agent_visible_cache_pathrsF z~~ng..(:: (> R R RF'66Y6rcddlm}g}tD]\}}|||}|s&|dd|}|dD]j}|s|s+||}| t||d|dk|S)zReturn individual (host_path, container_path) entries for cache files. Used by Modal to upload files individually and resync before each command. Skips symlinks. The container paths use the new ``cache/`` layout. rrr$rrrH) rrrrdr.r}rpr,rr>r) rrrKrrrrrNrOs riter_cache_filesrs0/////#%F!,   X!>+x88    *11#66FFFFNN3''  D     ""8,,C MM YY%3";";c";";       MrNonecFtdS)z8Reset the skill-scoped registry (e.g. on session reset).N)rclearrUrrclear_credential_filesrs r)r r )r r)r)rrrrr r )r5r6rrr r7)r rC)rrr r])rirr r)rrr rC)r0rrrr r)r0rrrr r)r r)&__doc__ __future__rloggingr%r contextvarsrpathlibrtypingrrrrIr getLogger__name__r(r __annotations__rrrr4rBrRr\rlrmrerrrrrrrrUrrrs(#""""" """"""''''''''''%%%%%%  8 $ $5?J?R4S4SSSSS.2 1111*/////h*2****Z6******Z%)((((((((X*+++++h&&& *4*4*77777,*6r