fix: add .ics, .vcf, .vcs to MEDIA_DELIVERY_EXTS and gateway regex

[sxhorschi]

Problem

Calendar files (.ics) and contact files (.vcf, .vcs) were missing from the allowed file extensions list in MEDIA_DELIVERY_EXTS. This caused MEDIA:/path/to/file.ics tags in agent responses to be silently ignored and never delivered as file attachments on any platform.

Fix

Added .ics, .vcf, and .vcs to two locations:

• gateway/platforms/base.py: MEDIA_DELIVERY_EXTS tuple — the source of truth that drives MEDIA_TAG_CLEANUP_RE
• gateway/run.py: _TOOL_MEDIA_RE regex — mirrors the allowed extensions for tool result scanning

How it was discovered

A user asked Hermes to create an iCalendar (.ics) file with university course dates and send it via Slack. The MEDIA: tag was emitted correctly in the response but never delivered — after debugging, the root cause was the missing extension in MEDIA_DELIVERY_EXTS.

[alt-glitch]

Duplicate of #38455 — that open PR already adds .ics to MEDIA_DELIVERY_EXTS. This is part of the saturated MEDIA-regex whitelist cluster whose canonical fix is dynamic derivation from SUPPORTED_DOCUMENT_TYPES (#29609).

[tonydwb]

Code Review Summary

Verdict: Approved

Looks Good

• Small file extension addition: Adds .ics, .vcf, .vcs to MEDIA_DELIVERY_EXTS and gateway regex.
• Correct file type handling: These are standard calendar/contact file formats that should be delivered as media.
• No security concerns: Simple file extension list addition.

---

Reviewed by Hermes Agent

[teknium1]

Thanks for tracing the shared gateway extraction path. The reported gap is still present on current main: MEDIA_DELIVERY_EXTS at gateway/platforms/base.py:1455-1472 omits all three extensions, and _TOOL_MEDIA_RE at gateway/run.py:1061-1066 also stops at apk|ipa.

Problems

• The changed _TOOL_MEDIA_RE line remains a second hardcoded allowlist. It already differs from MEDIA_DELIVERY_EXTS (for example, current main allows .md, .json, .yaml, .svg, and .html in gateway/platforms/base.py:1455-1472, but the tool regex does not). This preserves the drift class that the shared source-of-truth refactor in 781604ce4 addressed for the primary extraction paths.
• The PR adds no regression tests for the three new extensions.

Suggested changes

• Derive the tool-result matcher from the shared delivery set, or add parity coverage.
• Add focused extraction/matcher tests and reconcile the overlapping .ics MIME/test work in open PR #38455.

This is an automated hermes-sweeper review.

[teknium1]

This remains a separate hardcoded list from MEDIA_DELIVERY_EXTS. Current main already has delivery extensions absent from this matcher; please derive this matcher from the shared set or add a parity invariant so another extension addition cannot drift again.

[teknium1]

Closing as resolved on main: PR #65510 replaced the extension-allowlist approach with universal validated egress — .ics/.vcf/.vcs (and any other extension) now deliver via MEDIA: after passing validate_media_delivery_path. Verified live on main for all three. Thanks for the contribution!