fix(gateway): block Hermes home media attachments

[zapabob]

Summary

• Treat non-cache files under the active Hermes home and shared Hermes root as denied for native media delivery.
• Preserve delivery from Hermes-managed cache roots and explicit HERMES_MEDIA_ALLOW_DIRS operator roots.
• Add regressions for OAuth/MCP/session files under HERMES_HOME, cache allowlist precedence, and operator allowlist precedence.

Why

Default media delivery mode blocked a few named Hermes credential files, but other non-cache Hermes state files such as OAuth refresh tokens, MCP token JSON, and session metadata could still be attached if a model emitted their path. Cache and explicit operator roots are already checked first, so denying the Hermes roots closes that leak without breaking generated artifact delivery.

Related

• Related to Canonical media cache directories should be safe delivery roots #33549, Bug: send_message tool bypasses validate_media_delivery_path security check #34270, and Gateway MEDIA extraction can attach stale files from serialized tool/search-result text #34375 in the broader native media delivery path-validation area.
• This PR is narrower than cache-root and MEDIA extraction behavior changes: it only blocks non-cache Hermes home/root state files while preserving cache and explicit operator allowlists.

Tests

• ruff check gateway/platforms/base.py tests/gateway/test_platform_base.py tests/gateway/test_extract_local_files.py
• python -X utf8 -m pytest -p no:cacheprovider tests/gateway/test_platform_base.py::TestMediaDeliveryDefaultMode tests/gateway/test_extract_local_files.py -q --timeout-method=thread
• ruff check .

[alt-glitch]

Related to closed #32090 and merged #35634 (both deny entire HERMES_HOME tree in media delivery). Also related to merged #30432 (original MEDIA path delivery fix). Verify this doesn't conflict with already-merged #35634.

[liuhao1024]

I verified this change — the blanket denial of the entire HERMES_HOME directory is the correct security posture, and the allowlist override semantics are preserved.

Verification details:

1. Allowlist beats denylist. In validate_media_delivery_path() (base.py:1052-1060), the cache/operator allowlist check runs before the denylist check. So hermes_dir/cache/documents/report.pdf still delivers correctly even when the entire hermes_dir is denied — confirmed by test_cache_allowlist_beats_hermes_home_denylist.

2. Blocks the real attack surface. The old denylist missed OAuth tokens (.anthropic_oauth.json), MCP tokens (mcp-tokens/server.json), session databases (sessions.json), and any future credential files added under HERMES_HOME. Blanket denial is defense-in-depth — new files are blocked by default.

3. USERPROFILE env var patching is correct. On Windows, os.path.expanduser("~") reads USERPROFILE (not HOME). The test patches both to ensure cross-platform coverage.

4. Operator override preserved. HERMES_MEDIA_ALLOW_DIRS still works for explicit operator allowlists under HERMES_HOME (tested by test_operator_allowlist_beats_hermes_home_denylist).

Note: The existing merged PR #35634 denied specific Hermes root files. This PR supersedes that approach with a blanket denial — cleaner and more future-proof. The PR body should mention this supersedes #35634's per-file approach.

No issues found. Ready to merge.

[egilewski]

Looks mergeable from this security review.

Checked current main 6f6eb871d83415fe2980f3483cc41a435ba22196 against PR head 7ba4e041c9d564ea81bd415cd4da13866abff205. I reproduced the default-mode media-delivery gap on current main with a synthetic HERMES_HOME: .hermes/.anthropic_oauth.json, auth/google_oauth.json, mcp-tokens/server.json, and sessions.json all returned deliverable paths. In the PR state, the same paths returned None, while cache delivery and explicit HERMES_MEDIA_ALLOW_DIRS roots under HERMES_HOME still returned resolved paths.

Validation:

• python -m pytest -o addopts='' -p no:cacheprovider tests/gateway/test_platform_base.py -k 'denylist_blocks_non_cache_hermes_home_files or cache_allowlist_beats_hermes_home_denylist or operator_allowlist_beats_hermes_home_denylist' -q -> 3 passed, 150 deselected
• git diff --cached --check HEAD -> clean
• CodeRabbit on the uncommitted PR patch against 6f6eb871d83415fe2980f3483cc41a435ba22196 -> No findings
• GitHub reports MERGEABLE / CLEAN, with checks successful or expected skipped

Signed: GPT-5.5-xhigh in Codex

[teknium1]

Thanks for the focused media-delivery security review. Current main has moved to a deliberately targeted model rather than a whole-Hermes-home denial.

Problems

• The added whole-root deny would break the current contract at gateway/platforms/base.py:1163-1165: non-credential skills, logs, and ad-hoc Hermes-home files remain deliverable. tests/gateway/test_platform_base.py:1165-1184 explicitly asserts a fresh ~/.hermes/adhoc_report.pdf is delivered and says it prevents reintroducing the rejected whole-tree deny.
• The listed OAuth/MCP paths are now protected individually: .anthropic_oauth.json and auth/google_oauth.json are denied at gateway/platforms/base.py:1172-1179; mcp-tokens/ is denied at gateway/platforms/base.py:1185-1202 via 42d0174.

Suggested changes

• Re-scope to a specifically unprotected sensitive store, preserving the current ad-hoc artifact behavior. Session/SQLite-store denial is already being handled by open PR #41071.

Automated hermes-sweeper review.

[teknium1]

This whole-root deny reverses current main's intentional targeted policy. Main explicitly preserves fresh non-credential files under Hermes home (tests/gateway/test_platform_base.py:1165-1184); please re-scope to a concrete sensitive path instead.

[GottZ]

This was generated by AI during triage.

Summary

Two PRs address the issue's Hermes media-delivery path protection. #35634 adds shared-root blocking for named configuration and credential files, while #35939 broadens the deny rule to non-cache files under the active Hermes home and shared root to cover additional token and session state.

Related pull requests

• Block shared Hermes root config in media delivery #35634 [merged] related — (+49/-8) — n/a: Extends the media-delivery denylist from the active profile to both the active Hermes home and shared Hermes root for config and credential files, with regression tests. Merged as the reference implementation for the narrower named-file protection; fix(gateway): block Hermes home media attachments #35939 builds on this area with a broader rule.
• fix(gateway): block Hermes home media attachments #35939 related — (+57/-6) — n/a: Replaces named-file blocking with denial of the active Hermes home and shared root while preserving cache and explicit operator allowlists, covering OAuth, MCP, and session-state files. The [PR review:COMMENTED] keep_open review states that current main intentionally permits ad-hoc Hermes-home artifacts, individually protects the listed OAuth/MCP paths, and is handling session/SQLite denial in fix(gateway): block state.db and kanban.db in media-delivery denylist #41071.

Duplicates

#35634 and #35939 overlap in Hermes-root media-delivery protection, but they are not the same change: merged #35634 covers named config/credential paths, whereas #35939 proposes blanket non-cache root denial.

Suggested consolidation

author action: rebase onto main, or split out the part that can merge. Do not merge #35939 over the [PR review:COMMENTED] keep_open review: re-scope it to a specifically unprotected sensitive store while preserving the documented ad-hoc artifact behavior; session/SQLite coverage is already being handled by #41071. #35634 is already merged and should not be reopened.

Cross-PR triage: Reviewed 2 pull requests and 0 issues in this complex. Each diff was read against this issue; Assessment working set: 10 kB of PR diffs, 2 kB of issue/PR text, 5 kB of discussion (5 comments), 0 verify verdicts. verdicts reflect diff content, not PR titles. Part of an automated triage batch.