fix(security): guard native image routing with file-safety policy

[necoweb3]

Summary

Native image routing now honors the shared file-safety read guard before embedding local image bytes into the model-provider request.

Problem

agent.image_routing.build_native_content_parts() reads local image paths through _file_to_data_url() and converts them into base64 data: URLs for native multimodal model input.

That path did not call the shared agent.file_safety read guard. As a result, a protected target could still be embedded into the outbound model request if it reached native image routing as a local image attachment, including the symlink case where an image-looking path points at a read-denied credential file.

This is the same boundary shape as other local media/provider-input fixes: local file bytes cross from Hermes into an external model provider request, so the shared file-safety policy should be applied at the final byte-loading chokepoint.

Changes

• Call raise_if_read_blocked() inside _file_to_data_url() before reading local image bytes.
• Treat blocked files like unreadable/unsupported attachments: skip them and continue the turn.
• Add regression coverage for:
  • direct read-denied local image paths
  • native content parts skipping blocked images
  • image-looking symlinks whose resolved target is read-denied

Tests

python -m pytest tests/agent/test_image_routing.py -q -k "read_denied or symlink or png_passes" --timeout-method=thread
4 passed, 93 deselected

[alt-glitch]

This was generated by AI during triage.
Related: same credential-read-guard family as #57827 (vision_tools.py local-file branches) — this closes the analogous chokepoint in agent/image_routing.py _file_to_data_url(). Complements the merged #57726/#57695 provider-input guard work; not a duplicate (different code site).

[egilewski]

looks mergeable

Security evidence: The affected trust boundary is local image paths converted into base64 data URLs for native multimodal provider requests, and I verified the current-main route embedded a synthetic PNG at HERMES_HOME/auth.json while the PR-merge route skipped that denied path, still passed a normal PNG through, covered denied .env paths and symlink-to-denied-file behavior in the focused image-routing tests (4 passed, 93 deselected), and kept _file_to_data_url as the byte-loading chokepoint used by build_native_content_parts.

CodeRabbit reported the broad exception around raise_if_read_blocked; source review found no remaining blocker because actual file-safety denials are raised as ValueError and return None before path.read_bytes(), while unexpected file-safety machinery failures already have documented best-effort/no-op semantics in agent.file_safety. I also checked the patch scope, current-base merge tree, and whitespace, and found no evidence-backed blocker.

Signed: GPT-5.5-xhigh in Codex

[teknium1]

Merged via PR #58752 — your commit was cherry-picked onto current main with your authorship preserved in git history (c13281a). Guarding at the single byte-loading chokepoint with graceful skip semantics was exactly the right shape, and the symlink regression test carried over as-is. Thanks!