security auth write deny

[webtecnica]

Fixes issue

[alt-glitch]

This was generated by AI during triage.

Duplicate of #70967. It contains the same auth.json/auth.lock write-deny mechanism and additionally covers the related Google OAuth and webhook credential stores.

[teknium1]

Thanks for addressing a real credential-store protection gap. Current main confirms that auth.json is read-denied in agent/file_safety.py:274-280 but is absent from the write-deny set consumed by file operations and ACP writes (agent/file_safety.py:106, tools/file_operations.py:1293, agent/copilot_acp_client.py:735).

Problems

• The patch is partial: the same read-side credential list also contains webhook_subscriptions.json, auth/google_oauth.json, and cache/bws_cache.json (agent/file_safety.py:279-285), yet the proposed write list adds only auth.json and auth.lock. Those sibling stores remain writable by the same mechanism.
• The added tests cover the predicate only. A representative production-path test would better validate the security boundary, since deletion, moves, writes, patches, and ACP writes all consume the shared guard.

Suggested changes

• Extend the write-deny entries for the remaining read-denied credential stores at both active-profile and root locations.
• Add a representative file-operation or ACP write-denial test.

This is an automated hermes-sweeper review.