fix(security): deny home-root single-file credential stores in media delivery

[r266-tech]

Problem

build_write_denied_paths (agent/file_safety.py:49-53) already forbids the agent from writing five home-root single-file credential stores:

os.path.join(home, ".netrc"),
os.path.join(home, ".pgpass"),
os.path.join(home, ".npmrc"),
os.path.join(home, ".pypirc"),
os.path.join(home, ".git-credentials"),

But the media-delivery denylist in gateway/platforms/base.py does not cover them. #51055 recently extended that denylist so "the delivery/exfil side can't trail the write side", mirroring the write guard — but it only added the ~/.hermes-root credential files (_ROOT_CREDENTIAL_FILES) and the home credential directories (_MEDIA_DELIVERY_DENIED_HOME_SUBPATHS: .ssh, .aws, …). The five home-root single-file stores above were missed.

In the default (non-strict) media-delivery mode, validate_media_delivery_path accepts any existing file that isn't under a denied prefix (base.py). So MEDIA:~/.git-credentials, MEDIA:~/.netrc, etc. remain auto-deliverable — a prompt-injected or buggy agent can attach a plaintext credential file (Git remote tokens, FTP/HTTP logins, Postgres passwords, npm/PyPI registry tokens) straight into a chat reply. This is the exact read/write-vs-delivery divergence #51055 set out to close, and the same threat model the maintainer accepted for ~/.hermes/google_token.json there.

Fix

Add the five basenames to a new _MEDIA_DELIVERY_DENIED_HOME_FILES tuple and append them (joined to $HOME) inside _media_delivery_denied_paths(), right next to the existing home-credential-directory loop. They are matched by exact path in _path_under_denied_prefix (which already handles resolved == resolved_denied), so:

• ~/.netrc / ~/.pgpass / ~/.npmrc / ~/.pypirc / ~/.git-credentials are denied.
• An ordinary file sitting directly in $HOME (not one of these basenames) still delivers — the entries are exact-match, so they don't over-block the user's own home tree.

Scoped to these five home-root credential files only; the per-directory and ~/.hermes-root denials from #51055 (and the sibling targeted PRs #37222 mcp-tokens, #41071 state.db) are untouched.

Tests

tests/gateway/test_platform_base.py:

• test_denylist_blocks_home_root_credential_files — all five are denied in default mode.
• test_non_credential_home_file_still_delivers — a normal $HOME file still delivers (exact-match, no over-blocking).

Mirrors the existing test_denylist_still_blocks_credentials / test_denylist_blocks_google_token_default_mode pattern.

[teknium1]

Thanks for the focused security fix. The premise remains valid on current main: gateway/platforms/base.py:1327-1330 accepts any existing non-denied file in default mode, while the home denylist at gateway/platforms/base.py:1025-1035 contains directories but none of the five exact credential-store basenames. The write guard already treats those stores as sensitive at agent/file_safety.py:49-53.

The proposed exact-path additions match _path_under_denied_prefix()'s equality handling at gateway/platforms/base.py:1224-1235, and the paired ordinary-home-file test preserves the intended non-blanket-deny behavior. The current patch needs manual salvage because it no longer applies at its original context (git apply --check fails at gateway/platforms/base.py:1009), but the required port is limited to the home-file tuple/loop and its tests.

Automated hermes-sweeper review.

[egilewski]

looks mergeable

A patch replay onto current main preserves this focused security fix; the GitHub head still needs that mechanical refresh before merge.

Security evidence:

• trust boundary: Model-authored MEDIA: paths cross from the local host filesystem into gateway-native attachments.
• source/sink/invariant: The five home-root credential stores already denied by build_write_denied_paths() must also be rejected before validate_media_delivery_path() returns an attachment path.
• current-main reproduction: Default-mode validation accepted all five credential files and a symlink resolving to .netrc on current main.
• PR-head or patch-replay validation: The current-main patch replay denied all five direct paths and the symlink, and extract_media() returned no attachments for them.
• positive/negative cases: An ordinary $HOME/report.md remained deliverable, and all 12 default-mode media-delivery tests passed.
• residual bypass search: Resolved symlink aliases, exact-path matching, and adjacent credential-deny paths produced no scope blocker.
• reviewer validation: The new tuple matches the five home-root credential entries in build_write_denied_paths().

Not checked:

• Full test suite
• CodeRabbit review

Signed: GPT-5.6-sol-xhigh in Codex