diff --git a/tools/file_operations.py b/tools/file_operations.py
index 7f39a0277d..56ed1319f7 100644
--- a/tools/file_operations.py
+++ b/tools/file_operations.py
@@ -94,7 +94,7 @@ def _get_safe_write_root() -> Optional[str]:
 
 def _is_write_denied(path: str) -> bool:
     """Return True if path is on the write deny list."""
-    resolved = os.path.realpath(os.path.expanduser(path))
+    resolved = os.path.realpath(os.path.expanduser(str(path)))
 
     # 1) Static deny list
     if resolved in WRITE_DENIED_PATHS: