fix(agent): allow background review to read files

[yinkev]

Fixes #40003
Supersedes stale #27422, which targeted the old run_agent.py path and did not include tests.

Summary

• allow the background review runtime whitelist to call the read-only read_file tool
• keep write/search/terminal/web/delegation tools denied
• update review guidance to say read_file is only for read-only inspection when available, with a privacy guard against copying local file contents into durable skills
• add regression coverage for the whitelist and review prompt

Compatibility notes

• fix(agent): narrow background-review tool schema for local providers #39997 is complementary but may need a small reconciliation if it lands first, because local endpoint schema narrowing to memory+skills would not advertise read_file unless that branch also includes this allowance.
• fix(background-review): whitelist dynamic memory-provider tools #39746 is complementary dynamic memory-provider whitelist work.

Tests

• uv run --extra dev python -m pytest -q tests/run_agent/test_background_review_toolset_restriction.py
• uv run --extra dev python -m ruff check agent/background_review.py tests/run_agent/test_background_review_toolset_restriction.py
• uv run --extra dev python -m py_compile agent/background_review.py
• git diff --check

[teknium1]

Thanks for the focused implementation and regression coverage. The current code still has the deny-wall this patch targets (agent/background_review.py:806-844), but this change revives an intentionally rejected design direction.

Problems

• The maintainer decision on #27422 says the review fork's memory+skills-only whitelist is intentional: skill_view is the supported read path for SKILL.md and its linked skill assets, while arbitrary-file reads require a broader file-operations safety-boundary design.
• read_file accepts absolute, relative, and home-relative paths (tools/file_tools.py:2043-2053), so the proposed prompt-only privacy instruction does not provide that requested boundary.

Suggested changes

• Retain skill_view for skill-owned content. If arbitrary external-file inspection is reconsidered, propose it as a broader, explicitly bounded design with end-to-end safety coverage rather than a one-off whitelist exception.

This is an automated hermes-sweeper review.

[yinkev]

Closing because the maintainer review confirmed that arbitrary read_file access in the background-review fork conflicts with the intentionally narrow memory+skills safety boundary. A future reconsideration would need a broader bounded file-access design rather than this whitelist exception.