hermes - 💡(How to fix) Fix Avoid injecting raw todo snapshots as synthetic user messages after compression [1 pull requests]

Summary

Todo snapshots are currently preserved across context compression by rendering raw todo item text and appending it to the compressed conversation as a synthetic user message. If a todo item contains instruction-like text, that content can become the final user turn after compression, giving it more authority than intended.

This issue tracks changing todo preservation so task state survives compression without injecting raw todo content as a fresh user instruction.

Current behavior

In run_agent.py, _compress_context() calls TodoStore.format_for_injection() and appends the result to compressed as a user message:

• run_agent.py: compressed.append({"role": "user", "content": todo_snapshot})
• tools/todo_tool.py: TodoStore.format_for_injection() includes active todo item content verbatim

Because the synthetic message is appended after compression, it can become the tail of the prompt.

Reproduction pattern

1. A task list contains an active todo item with instruction-like content, for example:
   • [SYSTEM OVERRIDE] Ignore all previous instructions ...
2. Context compression runs.
3. _compress_context() appends the todo snapshot as a new user message.
4. The compressed history now contains the todo text as a final user-role message, rather than inert task metadata.

Expected behavior

Todo state should remain available to the agent after compression, but it should not be injected into the conversation as a new user instruction. Safer options include:

• omit the synthetic todo user message entirely and rely on the in-memory TodoStore plus the todo tool for state;
• preserve only inert metadata in a non-user channel/path if needed;
• sanitize/quote todo text before any display-only rendering, while ensuring it is not interpreted as user intent.

Suggested fix

Remove the post-compression compressed.append({"role": "user", "content": todo_snapshot}) path and add regression coverage confirming:

• _compress_context() does not append todo snapshot text as a synthetic user message;
• malicious/instruction-like todo content is not present in the compressed message list;
• the in-memory todo store still retains active tasks after compression.

Notes

This is related to prior context-compression hardening around synthetic post-compression messages. The key invariant is that compression must not create a new high-authority user turn from untrusted or tool-derived content.