Fixes #12689.

In CLI -w (worktree) mode, cli.py correctly sets TERMINAL_CWD to the isolated worktree path. However, file_tools.py resolves all paths using Path(path).resolve() and os.path.realpath(), which anchor to the process CWD (main repo root) instead of TERMINAL_CWD. This means read_file, write_file, patch, and search can silently escape the worktree and corrupt files in the main repository.

Root cause

Four path resolution call sites in _check_sensitive_path, read_file_tool, _update_read_timestamp, and _check_file_staleness all ignore TERMINAL_CWD.

Fix

Adds a _resolve_path() helper that reads TERMINAL_CWD and uses it as the base for relative path resolution. Absolute paths are left unchanged. Falls back to os.getcwd() when TERMINAL_CWD is not set — no behaviour change in non-worktree mode.

def _resolve_path(path: str) -> Path:
    """Resolve a path against TERMINAL_CWD (worktree root) when set, else CWD."""
    p = Path(path).expanduser()
    if not p.is_absolute():
        base = os.environ.get("TERMINAL_CWD") or os.getcwd()
        return (Path(base) / p).resolve()
    return p.resolve()

Test plan

• Launch hermes -w and verify read_file/write_file/patch resolve paths inside the worktree, not the main repo
• Verify non-worktree sessions are unaffected (no TERMINAL_CWD set → falls back to os.getcwd())
• Verify absolute paths are unaffected by the helper