fix(cron): allow read_file and search_files in background review tool whitelist

[EdderTalmor]

Summary

Expands the cron background review tool allowlist to include read-only file tools (, ) as requested in issue #45877.

Changes

• agent/background_review.py: Added and to the thread-local whitelist for background review fork. Updated deny message and user prompt to reflect the expanded allowlist.
• tests/run_agent/test_background_review_toolset_restriction.py: Added assertions for the new allowed tools and verified write tools (, ) remain blocked.

Rationale

The background review fork previously only allowed and tools. This blocked cron agents from reading configuration files, checking previous outputs, or inspecting skill references — forcing workarounds like or blind operation.

and are side-effect-free read-only tools that pose no risk in a cron context. Write tools (, ) remain blocked.

Testing

All existing background review tests pass, including the updated toolset restriction test.

[teknium1]

Thanks for the focused fix. Current main still derives the background-review whitelist solely from memory and skills at agent/background_review.py:806-815, and the thread-local pre-tool gate rejects every other name at hermes_cli/plugins.py:2135-2141. The proposed additions therefore address the reported behavior directly while retaining the runtime gate for write-capable tools.

read_file and search_files are classified as no-effect tools at agent/tool_result_classification.py:15-23; the PR's negative assertions retain coverage that write_file and patch are excluded. No code-level defects found.

The linked issue identifies still-open #45892 as the earlier duplicate, with #46049 also open for the same change; selecting a single implementation is a maintainer triage decision.

Automated hermes-sweeper review.