fix: serve raw chat attachments from inbox

[Michaelyklam]

Thinking Path

• Chat uploads were intentionally moved out of workspaces into a per-session attachment inbox.
• The transcript renderer still emits stable api/file/raw?session_id=...&path=<filename> URLs for uploaded images.
• _handle_file_raw only checked session.workspace, so inbox-backed uploads rendered as broken images.
• The narrow fix is to preserve the URL surface and add a session-scoped inbox fallback on the server.
• The fallback must stay scoped to the current session so one session cannot probe another session's attachments.

What Changed

• Added _file_raw_target() to resolve /api/file/raw first from the workspace, then from _session_attachment_dir(session_id).
• Kept traversal failures as not-found responses instead of exposing filesystem paths or falling through to another root.
• Added regression coverage for serving a chat-upload filename from the attachment inbox and rejecting traversal through the fallback.
• Updated an existing raw-file traversal expectation and the inline-HTML CSP source-string guard to reflect the refactor.
• Added an Unreleased changelog entry.

Why It Matters

Uploaded chat images stored under ~/.hermes/webui/attachments/<session_id>/ now load through the URL the frontend already generates, including docker-compose setups where the workspace and attachment root are separate.

Verification

• env -u HERMES_CONFIG_PATH -u HERMES_WEBUI_HOST /home/michael/.hermes/hermes-agent/venv/bin/python -m pytest tests/test_sprint6.py::test_file_raw_serves_session_attachment_inbox tests/test_sprint6.py::test_file_raw_attachment_fallback_rejects_traversal tests/test_sprint6.py::test_file_raw_requires_session_id tests/test_sprint6.py::test_file_raw_unknown_session -q — 4 passed
• env -u HERMES_CONFIG_PATH -u HERMES_WEBUI_HOST /home/michael/.hermes/hermes-agent/venv/bin/python -m pytest tests/test_sprint6.py tests/test_sprint1.py::test_upload_text_file tests/test_sprint1.py::test_upload_respects_attachment_dir_env tests/test_native_image_attachments.py -q — 56 passed
• env -u HERMES_CONFIG_PATH -u HERMES_WEBUI_HOST /home/michael/.hermes/hermes-agent/venv/bin/python -m pytest tests/test_779_html_preview.py::test_inline_html_response_sets_csp_sandbox tests/test_sprint2.py::test_raw_endpoint_path_traversal_blocked tests/test_sprint6.py::test_file_raw_serves_session_attachment_inbox tests/test_sprint6.py::test_file_raw_attachment_fallback_rejects_traversal -q — 4 passed
• env -u HERMES_CONFIG_PATH -u HERMES_WEBUI_HOST /home/michael/.hermes/hermes-agent/venv/bin/python -m pytest tests/ -q — 5734 passed, 6 skipped, 3 xpassed, 8 subtests passed
• python -m py_compile api/routes.py
• git diff --check

Risks / Follow-ups

• This intentionally does not expose _attachment_root() to the browser or switch the frontend to absolute media URLs.
• The attachment fallback is scoped to _session_attachment_dir(session_id), not the attachment root, to avoid cross-session probing.

Closes #2380

Model Used

AI-assisted change with repository inspection, targeted editing, and shell-based test verification.