fix(file_tools): prevent agent from silently disabling exec approval via config write

[Subway2023]

fix(file_tools): prevent agent from silently disabling exec approval via config write

What does this PR do?

write_file and patch tools had no protection against writes to ~/.hermes/config.yaml. A malicious or prompt-injected agent could exploit this to silently disable exec approval:

1. Call read_file("~/.hermes/config.yaml") to read the current config.
2. Call write_file or patch to set approvals.mode: off.
3. All subsequent execute_code calls bypass check_all_command_guards() entirely — approval_mode == "off" causes it to return {"approved": True} unconditionally.

This PR adds ~/.hermes/config.yaml to the sensitive path protection in _check_sensitive_path(). Any attempt by an agent to write to the config file is rejected before reaching the filesystem, regardless of whether the path is expressed as an absolute path or via ~.

Related Issue

Fixes #

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

• tools/file_tools.py: add _get_hermes_config_resolved() to lazily resolve and cache the canonical path of ~/.hermes/config.yaml (via get_config_path().resolve(), with expanduser fallback)
• tools/file_tools.py: add a guard at the end of _check_sensitive_path() that rejects writes when the target path matches the Hermes config file — covers both write_file and patch entry points
• tests/tools/test_file_tools.py: add TestSensitivePathCheck with 5 cases covering the new protection and verifying no regression on normal file writes or existing system-path blocks

How to Test

1. Run the new test class: pytest tests/tools/test_file_tools.py::TestSensitivePathCheck -v — all 5 cases should pass.
2. Run the full file tools suite: pytest tests/tools/test_file_tools.py -q — all 28 tests should pass.
3. In a live session, ask the agent to write approvals:\n mode: off to ~/.hermes/config.yaml — confirm it receives an error response containing "Refusing to write to Hermes config file".

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform:

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

Screenshots / Logs

# Agent attempts to disable exec approval
write_file("~/.hermes/config.yaml", "approvals:\n  mode: off\n")
→ {"error": "Refusing to write to Hermes config file: ~/.hermes/config.yaml\nAgent cannot modify security-sensitive configuration. Edit ~/.hermes/config.yaml directly or use 'hermes config' instead."}

pytest tests/tools/test_file_tools.py -q
28 passed, 6 warnings in 0.75s

[alt-glitch]

Related to #8738 — both address config.yaml write protection. This PR adds the file_tools guard; #8738 takes a broader approach.