+ jHjI0Rt^RIt^RIt^RIt^RIt^RIt^RIHt^RI H t ^RI H t H t ^RIHt^RIHtHtHtHt]P*!]4tRt]!R4t] !R R 7!R R 44tR R/RRlltR RRR /RRlltRRlt]R=RRll4tRR/RRlltRt R RRR/RRllt!RR/RRllt"RR /R!R"llt#R#R$lt$R%R&lt%R'R(lt&R)R*lt'R+R,lt(R-R /R.R/llt)R0R R1R /R2R3llt*R4R5lt+R6R7lt,R=R8R9llt-R:R /R;R<llt.R#)>zhManaged-files policy for the dashboard file browser: root resolution, path containment, entry metadata. N)contextmanager) dataclass) HTTPExceptionRequestPath)AnyDictIteratorOptionalHERMES_DASHBOARD_FILES_ROOTz /opt/dataT)frozenc,a]tRt^toV3RltRtVtR#)ManagedFilesPolicycL<V^8dQh/S[;R&S[R,;R&S[;R&#) default_pathN locked_rootcan_change_pathrbool)format __classdict__s"@/home/ubuntu/.hermes/hermes-agent/hermes_cli/web_server_files.py __annotate__ManagedFilesPolicy.__annotate__s. N)__name__ __module__ __qualname____firstlineno____annotate_func____static_attributes____classdictcell__)rs@rrrsrrcwdcJV^8dQhR\R\R,R\/#)rrawr%Nreturnstrr)rs"rrrs%++s+C$J+$+rc>\V4P4pVP4'g^Ve\V4P4M\P!4pVP4'g\ RRR7hW2, pVP RR7#)Nz(Session working directory is unavailable status_codedetailFstrict)r expanduser is_absoluter%rresolve)r'r% candidatebases&$ r_resolve_fs_candidater7szS $$&I  " "),tCy##%dhhj!!C8bc c$   E  **rdecode_fallbackcVV^8dQhR\R\R,R\R\/#)rraw_pathr%Nr8r()r*rr)rs"rrr&s3 D Ds DC$J D DX\ Drc\T;'gR4P4pV'g\RRR7hRV9d\RRR7hVP4P R4'd\ P PV4pVPpVP'dLVPP4R8wd-\PR8wd\hR VP V 2p\ PPV4pM#\PR8Xd^R IHpV!V4p\#W1R 7pV'd`R V9dYVP%4'gC\#\ P P'V4VR 7pVP%4'dTpV# \(\*\3d\RRR7hi;i) r,zPath is requiredr- Invalid pathfile: localhostnt//_msys_to_windows_pathr%%)r*striprlower startswithurllibparseurlparsepathnetlocosname ValueErrorrequest url2pathnametools.environments.localrDr7existsunquoteOSError RuntimeError) r:r%r8r'parseduri_pathrDr5decodeds &$$ r_fs_pathr\&sc hnn"  # # %C 4FGG s{NCCD 99; ! !' * *\\**3/F{{H}}}!4!4!6+!E77d?$$ xj9..--h7C WW_ F',C)#7 scz)2B2B2D2D+FLL,@,@,E3OG~~#  \: .DNCCDs $F33F3/AF33$Gc>V^8dQhR\R\R,/#)rr5r(Nr)rs"rrrIs" I IT IdTk Irc^^RIHpHp^RIHpV!4V!4'gR#V!VRR7#)a0One translation attempt under whatever scope is bound; None off the docker backend. The gate keeps a local-backend gateway with leftover ``docker_volumes`` from serving mount sources in place of real host files. Quiet: fs callers also see ordinary host paths, which are not MEDIA misses worth a warning.)_docker_env_active&_translate_docker_container_media_path)_ensure_terminal_env_bridgedNT)quiet)gateway.platforms.baser_r`tools.terminal_toolra)r5r_r`ras& r_translate_agent_pathreIs* b@ "    1)4 HHrcLV^8dQhR\R,R\R,/#)r profile_homeNr()rr )rs"rrrYs"33D4K38D>3rc#"^RIHp^RIHpHpHpHp^RIHpH pH pR;rVeC\V4P4V!4P48wdV!\V44p V!4RJ;'d,V!4P4V!4P48gp V fV 'dV!4fV!V!44p RxV e V!V 4V e V!V 4R#R# T e T!T 4T e T!T 4ii;i5i)aBind the profile whose sandbox a container path names: its home and its terminal policy. A requested ``profile_home`` other than the current home binds that home and its complete terminal policy, as MEDIA delivery does (#109024). A home already bound by the caller (a native profile ticket's override) gets its own terminal policy when no scope is bound, so translation never reads the launch profile's ambient ``TERMINAL_DOCKER_VOLUMES``. An override naming the launch home keeps the ambient env, which may carry env-only policy. Translation and the unmapped-path classification both run inside this scope, so they agree about the backend. get_hermes_home)get_hermes_home_overrideget_process_hermes_homereset_hermes_home_overrideset_hermes_home_override)get_terminal_scopeinstall_profile_terminal_scopereset_terminal_scopeN)hermes_cli.configrjhermes_constantsrkrlrmrntools.terminal_scoperorprqrr4r*) rgrjrkrlrmrnrorprq home_token scope_tokenforeign_overrides & r_agent_path_scoperxXs2nm##JD$6$>$>$@ODUD]D]D_$_-c,.?@  346dBcc / 1 9 9 ;?V?X?`?`?b b   !&6;M;O;W89JKK  "  -  ! &z 2 "  "  -  ! &z 2 "s*A&D)C'97C'1C' D'DDrgcXV^8dQhR\R\R,R\R,/#rr'rgNr(r))rs"rrr{s*$$s$TD[$DSWK$rc2VPR4'd.VPR4'gRVPR49dR#^RIHp^RIHpHpHpHp\V4p\V4;_uu_4\V4pVf V!4e VuuRRR4#V!V!V!444p \V4V!V 4uuRRR4# T!T 4i;i +'giR#;i \d\PRTRR 7R#i;i) aHMap an agent-visible container path to its host bind mount, or None. Docker agents emit container paths (``/workspace/...``, ``/root/...``) in transcripts and MEDIA tags, while the dashboard fs routes stat the gateway HOST filesystem (#85238). Reuse the gateway's MEDIA volume translator inside ``_agent_path_scope(profile_home)``. When no terminal scope is bound even then (``serve --isolated`` after a failed early bridge), retry once under the current profile's complete terminal policy, never replacing an already-bound scope or refusal (retry from #104992). Runs on the raw string, before host normalization: on a Windows gateway ``Path("/workspace/x").resolve()`` anchors to the current drive and the container path is gone before translation sees it. ``..`` segments are never translated, so the managed routes keep refusing them. /rB..Nri)build_profile_terminal_scoperorqset_terminal_scopez.agent container path translation failed for %sTexc_info)rIsplitrrrjrtr~rorqrrrxre Exceptionloggerdebug) r'rgrjr~rorqrr5 translatedtokens &$ r_agent_container_pathr{s >>#  #.."6"6$#))C.:P5  I | , ,.y9J%);)=)I!- ,''CODU'VWE ,,Y7$U+- ,%U+- , ,  EsUY ZsT0C/8C C/C1 C;C C/ CC C, &C/,C//#DDzNFile not found on the gateway host: the path may live inside the agent sandboxcdV^8dQhR\R\R,R\R,R\/#)rr:r%Nrgr(r))rs"rrrs4''':'<@4K' 'rc\T;'gR4P4p\PR8wdN\ WR7p\P !V\P 4'dV#\W2R7pVeV#T#\W2R7pVeV#\W2R7'd\R\R7h\ WR7#)a``_fs_path`` for agent-facing reads; container paths resolve to their host mount, so callers' boundary guards see the real host target. POSIX: a readable host path wins, and translation only runs when the host lookup misses, so a root-run gateway can still browse its own ``/root``. Windows: a container-shaped path never names a host file (it would anchor to the current drive), so a translation miss is a 404 rather than a drive lookup. r<rArE)rgr-) r*rGrOrPr\accessR_OKr_is_unmapped_container_pathrSANDBOX_NOT_FOUND)r:r%rgr'hostrs&$$ r_agent_fs_pathrs hnn"  # # %C ww$* 99T277 # #K*3J '3z==&sFJ"3BB4EFF H &&rcJV^8dQhR\R\R,R\/#rz)r*rr)rs"rrrs+OOSO4$;ORVOrcaSPR4'dSPR4'dR#^RIHpHp^RIHp\ V4;_uu_4V!4'dV!S4S8wd RRR4R#RR0R V!44mpRRR4\;QJdT3R lX4F 'gK R # R#!T3R lX44# +'giLJ;i \d\PR SR R 7R#i;i)zA docker-backend container path (``/workspace``, ``/root`` or a configured volume target) rather than a host path or a typo elsewhere on the host. Reads the backend and volumes in the same profile scope translation used.r|rBF)r__parse_docker_volume_mountsrCNz /workspacez/rootc3F"TFwrVP4xK R#5iN)as_posix).0_cs& r ._is_unmapped_container_path..s-eGdtqajjllGds!z+container path classification failed for %sTrc3<"TF9pSV8H;'g(SPVPR4R,4xK; R#5i)r|N)rIrstrip)rrr's& rrrs6N1sax>>3>>!((3-#*=>>s A0A) rIrcr_rrTrDrxrrrany)r'rgr_rrDrootssf$ rrrs >>#  #.."6"6 ZB | , ,%''+@+E+L- ,"7f-eGbGd-efE- 3NN33N3N3NN NN- ,  BCRV Ws;!C!C0C!:C C! C C!C!!#DDrequire_existsFc<V^8dQhR\R\R\/#)rrMrr(r)rs"rrrs&DD$D4DDDrcVP4PVR7# \dT'd\RRR7hh\\ 3d\RRR7hi;i)r0rzPath not foundr-r,r>)r2r4FileNotFoundErrorrrWrX)rMrs&$r_canonical_pathrsbD (((??  C8HI I \ "DNCCDs"A!A!A!cFV^8dQhR\\,R\/#)rr:r(r))rs"rrrs  3: $ rc\V4P4pVPRRR7VP4pTP4'g\ RRR7hT# \\ 3dp\ RRT 2R7hRp?ii;i)T)parentsexist_okz#Managed files root is unavailable: r-Nz%Managed files root is not a directory)rr2mkdirr4rWrXris_dir)r:rootresolvedexcs& r_ensure_managed_rootrs > $ $ &Da 4$ /<<> ??  4[\\ O \ "a6YZ]Y^4_``as#A##B 4BB c<V^8dQhR\R\R\/#rrtargetr(r)rs"rrrs!444t44rc6W8H;'gWP9#r)r)rrs&&r_path_is_underrs > 3 3T^^33rc>V^8dQhR\R,R\/#)rr:Nr()r*)rs"rrrstrct\T;'gR4P4pRV9d\RRR7hV#)r<r=r,r>r-)r*rGr)r:texts& r _path_textrs4 x~~2  $ $ &D ~NCC Krc$V^8dQhR\/#rr(r)rs"rrrs . .$ .rcl\PPRR4P4pV'gR#^RIHpV!4P 4PRR7pV\8H# \\3d5\T4P 4PRR7pT\8H#i;i) HERMES_HOMEr<F)get_default_hermes_rootr0) rOenvirongetrGrsrr2r4rWrXr_HOSTED_MANAGED_FILES_ROOT)r'rrs r _default_hermes_root_is_opt_datars **.. + 1 1 3C <<&(335==U=K - -- \ "<Cy##%--U-; - --?Tn!tW\]] 499; 'D 4TSW XXr for_writefor_agent_readc V^8dQhR\R,R\R\R\R\\\ \3,/#)rr:NrRrrr()r*rrtuplerr)rs"rrr.sG*+*+Dj*+#**+:>*+*+ tS ()*+rcZ\V4p\V4pVPpV'dzV'drVPR4'g[\P R8Xg,\P !V\P4'g\V4pVe \V4pVeV'dVR 9dTpMV'gVPpM\V4P4pVe{VP4'ge\;QJd&RVP4F 'gK RM RM!RVP44'd\!RRR7hWh, pM#VP4'g\!RRR7hR VP9d\!RRR7hV'd?VP#4'g)\%VP&4p WP , p M\%W'*R 7p Ve\)Wj4'g\!R R R7hWJ\V 43#)r?rAc3*"TF qR8HxK R#5i)r}Nr)rparts& rr(_resolve_managed_path..Fs.r|)rrrrIrOrPrrrr*rrr2r3rpartsrrUrparentr) r:rRrrpolicyrrrr5rrs &&$$ r_resolve_managed_pathr.s#7 +F h D   D$tw'?'? GGtO299T277#;#;+40  !z?D ); '' J))+  I$9$9$;$;s >4UVV S] **rcRV^8dQhR\R\\\3,/#)rrr()rdictr*r)rs"rrr[s'hh#5h$sCx.hrcpVPe\VP4MRpRVRVRVP/#)Nrrr)rr*r)rrs& r_managed_response_metar[s;-3-?-?-K#f(()QUK K =NPVPfPf ggrc<V^8dQhR\R\R\/#rr)rs"rrr`s&UU$UUUrc^RIHp\V4p\W4;'d#V!V4'*;'dV!V4'*#))_is_sensitive_path)hermes_cli.web_routers.filesrrr)rrrrs&& r_hosted_fs_path_allowedr`sK?v&H 4 * T T&v.. T T7I(7S3SUrc`V^8dQhR\R\\,R\R,/#)rrrRr(N)rr r)rs"rrrhs+  $ '1B dUYk rcx\VRR7PpVe\W 4'g\RRR7hV#)zPreview and Git reads share managed-file restrictions on locked deployments. ``request`` is unused (the policy is env/home driven) and optional so the route functions stay callable directly, e.g. from agent-side tests. F)rrz)Path is outside the managed read boundaryr-)rrrr)rrRrs&& r_hosted_fs_read_guardrhs: !e < H HD  7 E E4_`` Kr skip_missingc xV^8dQhR\R\R\R\\\ 3,R,/#)rrrrr(N)rrrrr*r)rs"rrrts9;; ;(,;?C; #s(^d;rcVP4pRpTP 4'dTP 4pTPe*\TPT4'g\RRR7hTfTP 4p\ P!TP4pT'dRM0\P!TP4^,;'gRpRTP;'g TP;'g \T4R\T4R TR T'dRM TP RTP"RT/# \\3d\RRR7hi;i \ dTPeS\TPTPP4TP, 4'g\RRR7hRTP;'g TP;'g \T4R\T4R R R R R RRRRR/u#\dELi;i \ d$pT'dRp?R#\RRT 2R7hRp?i\dp\RRT 2R7hRp?ii;i)zNDescribe an entry; listings may skip vanished files, while writes stay strict.r,r>r-NrrrPrM is_directoryF broken_linkTsizemtime mime_typerzCould not stat path: zapplication/octet-stream)r4rWrXr is_symlinkstatrrrrrPr*S_ISDIRst_mode mimetypes guess_typest_sizest_mtime)rrrrstrrrs&&$ r_managed_file_entryrts7D>># B  B(%nV=O=OQY.Z.Z4UVV z WB\\"** %FY%9%9(--%H%K%i%iOiI ==x}}==H H BJJY  ] \ "DNCCD! !!-n""FMM$9$9$;fkk$I77$<]^^ EEx}}EEH F tT    ! WC:OPSu8UV V WC:OPSu8UV V WseEE*7H2E'*A>H/)H/="H/!H/*H/.H/2 I>=I I I>(I>)I99I>r)/__doc__loggingrrOrurllib.requestrJ contextlibr dataclassesrfastapirrpathlibrtypingrr r r getLoggerrrrrrr7r\rerxrrrrrrrrrrrrrrrrrrrr sQ %!*00   8 $7!+. $ ++ D Dt DF I33D$4$Ne'(,'JN'4OO(D%D 4 .6YTY"*+AF*+ *+Zh U ;FK;;r