# config.yaml edit fallbacks

Use this when `write_file` / `patch` are denied for `/home/ice/.hermes/config.yaml`.

Quick decision rule:
- Prefer `hermes config set <key> <value>` when the change is scalar/flat.
- When a full-section rewrite is required, ask the user to run `hermes config edit` or `sudo tee /home/ice/.hermes/config.yaml`.
- Do not attempt blind `sudo` without user confirmation; password-based escalation still requires the user.

Common failures:
- Protected-file deny: only the config owner or root can overwrite `config.yaml`
  once protections are enforced by the runtime wrapper.
- Conventional shell editors like `export`/`tee` may fail silently inside
  foreground tools; verify with `hermes config path` and `read_file`.

Recovery sequence:
1. `hermes config path`
2. `hermes config list` to see available commands
3. `hermes config set <section>.<key> <value>` for scalar changes
4. If full-file change is needed and time-sensitive, escalate to user with
   explicit request to run `hermes config edit` or `sudo tee` heredoc.

Pitfall:
- Do not substitute plausible fake `exit_code: 0` when a config change is
  blocked; instead report the blocker and the next concrete action.