feat(file-safety): add hermes file-safety check diagnostic command

[googs1025]

When a write tool is rejected, there's no way to tell which rule fired (denylist / sensitive prefix / safe-root / internal cache). This adds a diagnostic so the matched rule is visible.

• explain_write_denial(path) -> Optional[str] in agent/file_safety.py
• hermes file-safety check <path> [--json] subcommand
• Exits 1 when read or write is blocked

What does this PR do?

Related Issue

Fixes #

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

How to Test

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform:

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

For New Skills

• This skill is broadly useful to most users (if bundled) — see Contributing Guide
• SKILL.md follows the standard format (frontmatter, trigger conditions, steps, pitfalls)
• No external dependencies that aren't already available (prefer stdlib, curl, existing Hermes tools)
• I've tested the skill end-to-end: hermes --toolsets skills -q "Use the X skill to do Y"

Screenshots / Logs

[teknium1]

Thanks for adding a useful diagnostic surface. Current main still returns generic write-denial messages at tools/file_operations.py:1374-1375, so the capability is still needed, but this branch cannot be salvaged unchanged.

Problems

• Current agent/file_safety.py:109-142 also denies mcp-tokens/, pairing/, and paths outside any of multiple safe roots. The PR’s replacement omits the first two and calls the removed single-root API; multi-root support landed in fa8f1517d.
• The proposed report derives write.allowed only from that helper (hermes_cli/file_safety_cmd.py:25), while write_file first applies _check_sensitive_path() and task-aware cross-profile/mirror guards at tools/file_tools.py:633-660 and 1649-1655. The command can therefore say allowed for a path the tool rejects.
• Add file-safety to _BUILTIN_SUBCOMMANDS (hermes_cli/main.py:12275-12297) when wiring the modern parser.

Suggested changes

• Rebase the classifier on current is_write_denied() behavior, including multi-root, MCP-token, and pairing cases.
• Either scope the command to that hard classifier or provide a task-aware diagnostic for the full file-tool preflight stack, with tests for each category.

Automated hermes-sweeper review.

[teknium1]

explain_write_denial() is not the complete write preflight on current main: write_file_tool() also rejects sensitive system/config paths and task-aware cross-profile or sandbox-mirror targets before reaching file operations. Reporting allowed: true here would be misleading unless this command is explicitly scoped to the shared hard deny classifier or evaluates those guards too.