hermes-agent/contributors/emails/topazd2@gmail.com at fix/skills-sync-writable - mirrors/hermes-agent - Cosmolan Git

mirrors/hermes-agent

mirror of https://github.com/NousResearch/hermes-agent.git synced 2026-07-23 16:36:23 +00:00

Teknium 0acdf1d8c8

fix(compression): apply strict redaction at every compaction text boundary (#69294 )

Compaction summaries persist across sessions and re-enter every subsequent
summarizer prompt, but every redact_sensitive_text() call in
context_compressor.py used default mode: a no-op under
security.redact_secrets:false, and opaque OAuth-callback / URL-userinfo
credentials passed through even when enabled. The stored _previous_summary
also re-entered the iterative-update prompt unredacted.

Add _redact_compaction_text() — redact_sensitive_text(force=True,
redact_url_credentials=True) — and thread it through all compaction text
boundaries: serializer input (content + tool args), deterministic fallback
summary, summarizer LLM output, manual + auto focus topics, the latest-user
task snapshot, and _previous_summary re-entry.

Note: force=True at this boundary intentionally overrides
security.redact_secrets:false — that opt-out targets live tool output, not
persisted summaries.

Salvages the compaction half of #49556 (the redact.py strict-URL half
landed independently via 75af6dc57/62a00a739). Addresses #43666 item 2.

Co-authored-by: AndrewMoryakov <topazd2@gmail.com>

2026-07-22 08:11:40 -07:00

1 line

15 B

Text

Raw Permalink Blame History

AndrewMoryakov