fix(security): reject path traversal in credential file registration

[memosr]

What does this PR do?

tools/credential_files.py had no containment check on the
relative_path argument passed to register_credential_file().
A malicious skill could declare:

required_credential_files:
  - path: '../../.ssh/id_rsa'

and the function would silently mount the host's SSH private key
(or any other file reachable via ..) into the Docker/Modal sandbox,
leaking it to the skill's execution environment.

The same applies to absolute paths — required_credential_files: ['/etc/passwd']
would also be accepted without any check.

Type of Change

• 🔒 Security fix

Changes Made

tools/credential_files.py — register_credential_file():

• Reject absolute paths immediately with a warning log
• Resolve the path with Path.resolve() (follows symlinks, normalises ..) before any containment check
• Verify the resolved path is inside HERMES_HOME via relative_to() — raises ValueError if outside
• Use the resolved (canonical) path in the registry instead of the raw unresolved path

tests/tools/test_credential_files.py — new TestPathTraversalSecurity class (6 cases):

• test_dotdot_traversal_rejected — ../sensitive.json
• test_deep_traversal_rejected — ../../.ssh/id_rsa
• test_absolute_path_rejected — /etc/passwd style
• test_legitimate_file_still_works — normal files inside HERMES_HOME unaffected
• test_nested_subdir_inside_hermes_home_allowed — subdirs still work
• test_symlink_traversal_rejected — symlink pointing outside HERMES_HOME

How to Test

Checklist

• Read the Contributing Guide
• Commit messages follow Conventional Commits
• No duplicate PR found
• PR contains only this security fix
• pytest passes
• Tests added for the fix
• Tested on: Ubuntu 24.04
• Cross-platform: uses pathlib — N/A

[dieutx]

Related: my #2714 adds a read-path deny list for credential and secret files, covering the read side of this attack surface. This PR (rejecting path traversal in credential file registration) is complementary — worth ensuring the path validation logic is consistent between the two. Happy to coordinate if needed.

[memosr]

Thanks for the heads up! I took a look at #2714 — you're right that
they're complementary. Happy to align the path validation logic if
needed. Let me know what works best.

[memosr]

Thanks! I checked out #2714 - the read-side deny list and this write-side
containment check do cover complementary attack surfaces.

I kept the same
pattern (Path.resolve() + relative_to() for containment) so the logic
should be consistent.

Happy to adjust if there's anything that needs to
align better with your implementation.

[teknium1]

Merged via PR #4316. Your commit was cherry-picked onto current main with your authorship preserved in git log. We also extended the same path traversal checks to the config-based credential file loader (_load_config_files) as a defense-in-depth follow-up. Thanks @memosr!