fix(security): harden terminal safety and sandbox file writes

[ismoilh]

What does this PR do?

This PR hardens Hermes Agent’s terminal and filesystem safety in two ways:

1. Dangerous command detection: expands the approval system to treat all bash|sh|zsh|ksh -...c invocations (including bash -lc) as dangerous inline shell execution, closing common RCE patterns that were not previously caught explicitly.
2. File write sandboxing: adds an optional HERMES_WRITE_SAFE_ROOT guard that constrains all write_file/patch operations to a configured directory tree, denying writes outside that subtree even if they are not on the static deny list. This gives operators a simple way to sandbox file writes to a workspace checkout, especially in gateway/messaging deployments.

This approach builds on the existing approval and write‑deny mechanisms, keeps behavior backwards‑compatible by default (safe root is opt‑in), and adds tests to prevent regressions.

Related Issue

Fixes #

Type of Change

• 🔒 Security fix
• ✅ Tests (adding or improving test coverage)
• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 📝 Documentation update
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

• tools/approval.py

  • Generalized the dangerous shell pattern to treat any bash|sh|zsh|ksh -[... ]c invocation (including bash -lc) as “shell command via -c/-lc flag”.

• tools/file_operations.py

  • Introduced _get_safe_write_root() helper that resolves HERMES_WRITE_SAFE_ROOT.
  • Extended _is_write_denied() to:
    • First apply the existing static deny list and prefixes.
    • Then, when HERMES_WRITE_SAFE_ROOT is set, deny any write/patch whose resolved path is outside the configured safe root subtree.

• tests/tools/test_approval.py

  • Added regression tests for:
    • bash -lc 'echo pwned' being detected as dangerous.
    • A multiline bash -lc command still being caught by the detector.

• tests/tools/test_yolo_mode.py

  • Extended YOLO‑mode tests to include bash -lc 'echo pwned' in the list of dangerous commands, ensuring HERMES_YOLO_MODE consistently bypasses all dangerous patterns (including the new one) as designed.

• tests/tools/test_file_write_safety.py (new)

  • Added tests for write safety:
    • Verifies that arbitrary temp files are not denied by the static deny list by default.
    • Verifies that, when HERMES_WRITE_SAFE_ROOT is set, writes inside the safe root are allowed and writes outside are denied.
    • Verifies that an empty HERMES_WRITE_SAFE_ROOT behaves as “feature disabled”.

How to Test

1. Run targeted tests (after activating your virtualenv):

   pytest tests/tools/test_approval.py tests/tools/test_yolo_mode.py tests/tools/test_file_write_safety.py -q

[ismoilh]

Hi @teknium1
could you review PR please?

[teknium1]

Merged via PR #1653. Both changes (expanded shell -c detection and HERMES_WRITE_SAFE_ROOT sandboxing) were salvaged onto current main with authorship preserved and additional tests. Thanks for the security contribution!