@securecoms/agent-bridge 0.37.0 → 0.38.0

package/connectors/hermes/securecoms_transport.py

@@ -26,7 +26,9 @@ from __future__ import annotations
 
 import json
 import os
-from typing import Awaitable, Callable, Mapping, NamedTuple, Optional, Tuple
+import re
+import stat
+from typing import Awaitable, Callable, List, Mapping, NamedTuple, Optional, Tuple
 
 from securecoms_gate import evaluate_gate, resolve_bound_identity
 
@@ -196,6 +198,100 @@ def should_drop_inbound(frame: dict, bound_identity: str) -> bool:
     return bool(sender_id) and bool(bound_identity) and sender_id == bound_identity
 
 
+# Inbound attachments. For an artifact_share the daemon decrypts the file to
+# <attachmentsDir>/<channel_id>/<message_id>-<name> and puts
+# {filename, mime, size, path, sha256} on the frame. Python twin of
+# openclaw-entry.js's scanInboundAttachments. The frame's fields are claims;
+# only a file that passes ALL of these reaches Hermes:
+#   - path: a string, absolute and already normalized (normpath collapses any
+#     "." or ".." segment and a trailing "/", so any traversal or an empty
+#     basename fails the equality), no C0/C1 control or bidi character,
+#     parent dir == the frame's channel id inside a dir named "attachments",
+#     every kept file in one dir;
+#   - filename (when present): no control or bidi character;
+#   - the file itself (opened O_NOFOLLOW|O_NONBLOCK): a regular file of at most
+#     MAX_INBOUND_ATTACHMENT_BYTES whose first bytes are a PNG, JPEG, GIF or
+#     WEBP signature, and the claimed mime equals that sniffed type.
+# Images only. Anything else is dropped; at most MAX_INBOUND_ATTACHMENTS kept.
+MAX_INBOUND_ATTACHMENTS = 8
+MAX_INBOUND_ATTACHMENT_BYTES = 5 * 1024 * 1024
+_FORBIDDEN_CHARS = re.compile("[\u0000-\u001f\u007f-\u009f\u202a-\u202e\u2066-\u2069]")
+
+
+def sniff_image_mime(b: bytes) -> Optional[str]:
+    """The image type from a file's leading bytes, or None."""
+    if b.startswith(b"\x89PNG\r\n\x1a\n"):
+        return "image/png"
+    if b.startswith(b"\xff\xd8\xff"):
+        return "image/jpeg"
+    if b.startswith(b"GIF87a") or b.startswith(b"GIF89a"):
+        return "image/gif"
+    if len(b) >= 12 and b[:4] == b"RIFF" and b[8:12] == b"WEBP":
+        return "image/webp"
+    return None
+
+
+def _sniff_file(path: str) -> Optional[str]:
+    try:
+        # O_NONBLOCK: a FIFO planted at the path must not hang the gateway in
+        # open(); fstat below then drops it as not a regular file.
+        fd = os.open(path, os.O_RDONLY | getattr(os, "O_NOFOLLOW", 0) | getattr(os, "O_NONBLOCK", 0))
+    except OSError:
+        return None
+    try:
+        st = os.fstat(fd)
+        if not stat.S_ISREG(st.st_mode) or st.st_size > MAX_INBOUND_ATTACHMENT_BYTES:
+            return None
+        return sniff_image_mime(os.pread(fd, 12, 0))
+    except OSError:
+        return None
+    finally:
+        os.close(fd)
+
+
+def scan_inbound_attachments(frame: dict) -> Tuple[List[Tuple[str, str]], int]:
+    """(kept (path, sniffed mime) pairs, dropped count) for a daemon frame."""
+    raw = frame.get("attachments") if isinstance(frame, dict) else None
+    channel_id = frame.get("channel_id") if isinstance(frame, dict) else None
+    if not isinstance(raw, list):
+        return [], 0
+    if not isinstance(channel_id, str) or not channel_id:
+        return [], len(raw)
+    kept: List[Tuple[str, str]] = []
+    first_dir: Optional[str] = None
+    for a in raw:
+        if len(kept) >= MAX_INBOUND_ATTACHMENTS:
+            break
+        if not isinstance(a, dict):
+            continue
+        path, mime, filename = a.get("path"), a.get("mime"), a.get("filename")
+        if not isinstance(path, str) or not isinstance(mime, str):
+            continue
+        if filename is not None and (not isinstance(filename, str) or _FORBIDDEN_CHARS.search(filename)):
+            continue
+        if _FORBIDDEN_CHARS.search(path) or not os.path.isabs(path) or os.path.normpath(path) != path:
+            continue
+        parent = os.path.dirname(path)
+        if not os.path.basename(path) or os.path.basename(parent) != channel_id:
+            continue
+        if os.path.basename(os.path.dirname(parent)) != "attachments":
+            continue
+        if first_dir is not None and parent != first_dir:
+            continue
+        sniffed = _sniff_file(path)
+        if sniffed is None or sniffed != mime.lower():
+            continue
+        if first_dir is None:
+            first_dir = parent
+        kept.append((path, sniffed))
+    return kept, len(raw) - len(kept)
+
+
+def inbound_attachments(frame: dict) -> List[Tuple[str, str]]:
+    """Validated (path, sniffed mime) pairs from a daemon `message` frame."""
+    return scan_inbound_attachments(frame)[0]
+
+
 class ChannelStatusManager:
     """Per-channel working/idle status emitter, decoupled from any one reply
     turn (unlike openclaw-entry.js's inline reportStatus("working")/("idle")