fix(gateway): translate Docker container paths for media delivery

[liuhao1024]

What does this PR do?

Adds Docker container-to-host path translation in validate_media_delivery_path() so that media delivery works when the agent runs in a Docker sandbox with configured volume mounts.

Related Issue

Fixes #42299

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)

Changes Made

• gateway/platforms/base.py: Added _translate_docker_container_path() helper that maps container paths (e.g. /output/report.pdf) to host paths using longest-prefix match against terminal.docker_volumes config entries. Translation runs before resolve() so the host file can be found; all existing validation (denylist, strict mode, recency window) applies unchanged after translation.
• tests/gateway/test_platform_base.py: Added TestDockerContainerPathTranslation class with 11 tests covering: basic translation, nested paths, longest-prefix match, non-docker backend, no matching volume, empty volumes, config errors, exact mount point match, integration with validate_media_delivery_path, and denylist enforcement after translation.

How to Test

1. Configure terminal.backend: docker with docker_volumes: ["/host/path:/output"]
2. Have the agent produce a file inside the container at /output/report.pdf
3. Verify the file is delivered successfully via MEDIA:/output/report.pdf
4. Run tests: pytest tests/gateway/test_platform_base.py::TestDockerContainerPathTranslation -v

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: macOS

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

Code Intelligence

• Analyzed: validate_media_delivery_path() (module-level function, called by BasePlatformAdapter class method + gateway adapters)
• Blast radius: LOW — additive change; no existing behavior modified; only activates when terminal.backend == docker
• Related patterns: telegram.py::_missing_media_path_error() already had a hint about container paths; this fix resolves the underlying validation gap

[teknium1]

Thanks for targeting the host/container boundary; the premise is still present on current main: gateway/platforms/base.py:1302-1305 resolves MEDIA paths only on the host and rejects an unresolved container path.

Problems

• Security: gateway/platforms/base.py:1074-1075 joins an unnormalized suffix onto the host mount with no containment check. With /host/export:/output, MEDIA:/output/../../home/user/file resolves outside /host/export. In default mode, current validation accepts existing paths that are not denylisted (gateway/platforms/base.py:1320-1330), so this can bypass the intended bind-mount boundary.
• Docker syntax: gateway/platforms/base.py:1060 uses rpartition(':'), so a documented mount such as /host/data:/data:ro is parsed with ro as its container prefix. The documented syntax explicitly supports host_path:container_path[:options] (website/docs/user-guide/configuration.md:426-434).

Suggested changes

• Resolve both the translated file and mapped host root, then require containment within that root; add a traversal regression test.
• Parse optional Docker mount modes correctly and test a :ro mount.

Automated hermes-sweeper review.

[teknium1]

This misparses supported host:container[:options] specs: /host/data:/data:ro produces container_part == "ro", so paths below /data never translate. Please parse the optional mode separately and add a :ro regression test.

[teknium1]

The suffix is unnormalized, so /output/../../home/user/file under /host/export:/output becomes /host/export/../../home/user/file and can resolve outside the configured bind mount. Resolve the host root and candidate and reject results not contained in that root before returning them.

[teknium1]

Closing as resolved by #81746 (merge commit 238351a), which merged the same container→host mount translation approach salvaged from #37207 — with #27779 by @LEAFERx as the first submission for this bug. Your PR independently arrived at the same fix; credit to all four contributors in the cluster. Thanks!