fix(gateway): translate Docker container paths to host for MEDIA delivery (#66086, #42299) - #81746
Merged
Merged
Conversation
Translate MEDIA paths under configured Docker volume mounts (and the default persistent /workspace) to host paths before media delivery validation, using longest container-prefix match so host:/workspace and /output export mounts work.
… and in-process gateways Follow-ups on the salvaged commit (#37207 by @charzhou): - Persistent /root home mount translates too: an agent writing /root/out.png produced a real host file under <sandbox>/docker/default/home the gateway could not find. - /root/.hermes cache mounts translate to the HOST cache (longest-prefix beats the home mount), so MEDIA:<agent_visible_image> paths deliver. - /root/.hermes/* OUTSIDE a cache mount never translates through the home mount: those are the sandbox's credential copies (.env, auth.json) that sit outside the host-side denylist prefixes — fail closed. - Run the idempotent terminal-config->env bridge before mount parsing so in-process gateways (Desktop backend, hermes serve) see the active backend and docker_volumes (covers #42299's /output case there too).
Contributor
૮ >ﻌ< ა ci reviewran on 78a0deb
|
alt-glitch
added
type/bug
This was referenced Aug 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Outbound MEDIA delivery now translates Docker container paths to their host equivalents before validation, so an agent writing
/workspace/chart.png,/output/report.pdf, or/root/out.pnginside the sandbox gets its attachment delivered instead of silently dropped. Fixes #66086 and #42299 — the outbound inverse of the inbound file-visibility class closed in #80801/#81200/#81677/#81717.Root cause: MEDIA delivery runs in the host gateway process, where container-absolute paths fail
resolve(strict=True)invalidate_media_delivery_pathand the attachment vanishes with no error.Changes
Salvaged from #37207 (@charzhou, authorship preserved) — the cleanest of a 4-PR cluster (#27779, #42305, #47716 same idea):
_translate_docker_container_media_path(): longest-prefix match across configureddocker_volumes(named volumes skipped) plus a synthetic/workspacemount for the default persistent sandbox / cwd bind; containment check after resolve.Our follow-up commit widens it to the full mount surface:
/roothome mount —<sandbox>/docker/default/homeis a real bind mount;/root/out.pngnow delivers.MEDIA:/root/.hermes/cache/images/…(theagent_visible_imagepath the agent legitimately sees under docker) translates to the HOST cache file via longest-prefix./root/.hermes/*outside a cache mount (the sandbox's.env/auth.jsoncopies, which live outside the host denylist prefixes) never translates through the home mount.hermes servegateways seeterminal.backend/docker_volumeswithout a launcher bridge.Validation
/workspace/chart.png/output/report.pdf(docker_volumes)/root/out.png/root/.hermes/cache/images/gen.png/root/.hermes/auth.jsontest_platform_base.py+test_send_image_file.py— 94/94 (5 salvaged tests + 3 new). Ruff clean. E2E: all six scenarios above verified against the realvalidate_media_delivery_pathin an isolated HERMES_HOME.Infographic