fix: block stale write_file overwrites

[danspicytaco]

Context

write_file is a full-file replacement tool. If the model has an older copy of a file in conversation context, it can use that stale copy as its working base and overwrite manual or external edits made after the last read.

Problem

The existing staleness checks only attached warnings after the write had already landed. That meant the guard could tell the model the file was stale while still allowing the data-loss overwrite that the warning was meant to prevent.

Solution

This adds an explicit full-file baseline for write_file: existing host-visible files need a current non-partial read_file or prior successful same-task write_file before full replacement is allowed. Known-stale baselines now fail closed before disk mutation, and the refusal tells the model to re-read, merge, and retry. Targeted patch remains warning-only and does not bless a later full-file overwrite.

Fixes #65604

[alt-glitch]

This was generated by AI during triage.

Related: #30713 protects only truncated-read overwrites and #62591 preserves correct mtime detection during a torn read. This PR adds the broader pre-mutation complete-baseline/staleness refusal.

[tonydwb]

Code Review Summary

Verdict: Comment

Scope

• 1 file, +305/-115 lines. Blocks stale write_file overwrites (part of related PR chain with 65618).

Quality

• Test suite updates reflect the new blocking behavior.
• Consistent with the staleness-check hardening pattern.

Looks Good

• Test coverage for the blocking behavior.

---

Reviewed by Hermes Agent

[teknium1]

Thanks for addressing the pre-mutation clobber path. Current main still writes at tools/file_tools.py:1629 before returning its staleness warning at :1631-1633, so the core premise is confirmed.

Problems

• tools/file_tools.py:1390-1392 marks every non-partial read as a full-write baseline, but read_file redacts content before returning it (tools/file_tools.py:1316-1319). agent/redact.py:510-519 explicitly says the file-read sentinel is non-round-trippable to prevent credential corruption. This new baseline would nevertheless permit a later full overwrite from that incomplete view.

Suggested changes

• Do not establish a full-write baseline when file-read redaction altered the returned content; add an integration test that verifies a secret-bearing file remains unchanged after the attempted full overwrite.

Automated hermes-sweeper review.

[GottZ]

This was generated by AI during triage.

Summary

One PR, #65605, addresses issue #65604. Its diff moves the existing staleness handling ahead of disk mutation, requires a current complete and round-trippable baseline for full-file replacement, and adds refusal-and-reread coverage for stale, partial, redacted, cross-task, and post-compression cases.

Related pull requests

• fix: block stale write_file overwrites #65605 best fix — (+336/-116) — n/a: The diff makes write_file fail closed before overwriting an existing file when its task lacks a full-file baseline or the baseline is stale, while leaving targeted patch warning-only. The contributor keep-open review identified redacted reads as unsafe baselines; the visible diff explicitly excludes reads altered by redaction and adds an integration test proving that a secret-bearing file remains unchanged.

Suggested consolidation

Keep #65605 open with a salvage path: retain the pre-mutation stale/no-baseline refusal, the complete round-trippable baseline tracking, and the regression tests, including the redacted-read case requested by the contributor review. No duplicate PR is present in this complex.

Complex graph

flowchart LR
    classDef open fill:#dbeafe,stroke:#1d4ed8,color:#1e3a8a
    classDef merged fill:#dcfce7,stroke:#15803d,color:#14532d
    classDef closed fill:#e5e7eb,stroke:#6b7280,color:#1f2937
    classDef unverified fill:#f3f4f6,stroke:#9ca3af,color:#374151
    classDef best stroke-width:3px,stroke:#b45309
    classDef target stroke-width:3px,stroke:#4338ca
    I65604(["issue #65604 (open)"])
    P65605["PR #65605 (open)"]
    P65605 -->|best fix| I65604
    class I65604 open
    class P65605 open
    class P65605 best
    class P65605 target
    click I65604 "https://github.com/NousResearch/hermes-agent/issues/65604"
    click P65605 "https://github.com/NousResearch/hermes-agent/pull/65605"

Loading

Graph: solid arrow = fixes / best fix, dashed arrow = partial or unverified (see edge label); boxed group = PRs duplicating each other; amber border = best fix; indigo border = target; gray node = closed (state tag in the node label).

Cross-PR triage: Reviewed 1 pull request and 1 issue in this complex. Each diff was read against this issue; Assessment working set: 39 kB of PR diffs, 3 kB of issue/PR text, 4 kB of discussion (6 comments), 2 verify verdicts. verdicts reflect diff content, not PR titles. Part of an automated triage batch.

[danspicytaco]

Hi @kshitijk4poor, bumping this for your review. It prevents stale write_file calls from overwriting newer external edits while preserving the current file guards, cache behavior and warning-only handling for patch. The focused file-tool checks pass.

[teknium1]

Salvaged onto current main in #91238 with your two commits cherry-picked (authorship preserved), plus a hardening commit on top: the redacted-read regression test now force-enables redaction so it exercises the sentinel path in hermetic CI, a sibling test pinning the old overwrite-without-read behavior was updated to the new contract, and the docs now describe the read-before-overwrite rule. Thanks @danspicytaco — this PR will be closed with credit once the salvage merges.