PR #16849: fix: add security.display_redaction_only to keep secrets usable in tools

• Repository: NousResearch/hermes-agent
• Author: HiddenPuppy
• State: open | merged: False
• Link: https://github.com/NousResearch/hermes-agent/pull/16849

Description (problem / solution / changelog)

Summary

security.redact_secrets was redacting credential values in **both** tool results (file reads, terminal output) and display/logging paths. When the LLM received partially-masked values (sk-a***c12) from tool results, it could not use them in subsequent commands — breaking:

• htpasswd and similar tools that pass passwords via command-line arguments (#16843)
• Bitwarden CLI workflows where Hermes retrieves a secret and passes it to a script (#16700)

Changes

New config: security.display_redaction_only

security:
  redact_secrets: true
  display_redaction_only: true

How it works

• redact_sensitive_text() — used by tool results (file reads, terminal output, code execution). Respects the new flag: skips patterns when display_redaction_only=true so the LLM gets real values.
• redact_for_display() — new function that **always** redacts, used by chat output (send_message), logs (RedactingFormatter), and context summaries. Never skips even when the flag is active.
• All entry points — CLI, gateway, and hermes_cli all bridge the new config to the env var.

Testing

• tests/agent/test_redact.py: 75 tests, all passing ✅

Closes #16843 Closes #16700

Changed files

• .github/workflows/contributor-check.yml (removed, +0/-73)
• .github/workflows/deploy-site.yml (removed, +0/-87)
• .github/workflows/docker-publish.yml (removed, +0/-99)
• .github/workflows/docs-site-checks.yml (removed, +0/-48)
• .github/workflows/nix-lockfile-check.yml (removed, +0/-68)
• .github/workflows/nix-lockfile-fix.yml (removed, +0/-149)
• .github/workflows/nix.yml (removed, +0/-33)
• .github/workflows/skills-index.yml (removed, +0/-101)
• .github/workflows/supply-chain-audit.yml (removed, +0/-139)
• .github/workflows/tests.yml (removed, +0/-82)
• agent/context_compressor.py (modified, +4/-4)
• agent/redact.py (modified, +55/-16)
• cli.py (modified, +3/-0)
• cron/scheduler.py (modified, +3/-3)
• gateway/run.py (modified, +3/-0)
• hermes_cli/config.py (modified, +3/-0)
• hermes_cli/main.py (modified, +3/-0)
• tools/send_message_tool.py (modified, +1/-1)

PR #16851: fix(file-safety): refuse read_file on credential paths (SSH keys, .env, …) (#16809)

• Repository: NousResearch/hermes-agent
• Author: briandevans
• State: open | merged: False
• Link: https://github.com/NousResearch/hermes-agent/pull/16851

Description (problem / solution / changelog)

Summary

• Add a read-side counterpart to build_write_denied_paths() in agent/file_safety.py and have read_file_tool consult it before performing the read.
• Blocks SSH private keys, the active HERMES_HOME .env, shell history, and credential directories (.ssh, .aws, .gnupg, .kube, .docker, .azure, .config/gh) from being read by the model.

The bug

read_file had no sensitive-path deny list. The reproduction in #16809 — and on a fresh checkout of main — succeeds today:

read_file("~/.ssh/id_ed25519")  # → full SSH private key
read_file("~/.hermes/.env")     # → full API keys
read_file("~/.zsh_history")     # → shell history

The only defense was pattern-based output redaction via redact_sensitive_text(), and that path was made off by default in 73753417 ("feat(security): make secret redaction off by default", #16794) and uses a module-level _REDACT_ENABLED snapshotted at import time — so config-driven opt-in is fragile, and well-known credential prefixes are the only thing recognised even when redaction is on.

Write-side protection exists (build_write_denied_paths + _check_sensitive_path) but has no read-side counterpart.

The fix

Add an access-control floor for high-value credential files where leakage is unrecoverable.

agent/file_safety.py gains three new helpers:

• build_read_denied_paths(home) — exact paths: SSH keys (id_rsa/id_ed25519/id_ecdsa/id_dsa/authorized_keys/config), .netrc, .pgpass, .npmrc, .pypirc, the active HERMES_HOME / .env (resolved through get_hermes_home() so profile-aware), and shell history (.bash_history, .zsh_history, .psql_history).
• build_read_denied_prefixes(home) — directory prefixes: ~/.ssh, ~/.aws, ~/.gnupg, ~/.kube, ~/.docker, ~/.azure, ~/.config/gh.
• is_read_denied(path) — symmetric helper. Resolves through os.path.realpath before checking, so symlink shims are caught.

tools/file_tools.py — read_file_tool calls is_read_denied(path) after the existing device / binary / Hermes-internal guards (so denied paths can't return cached content from the dedup tracker either) and returns a structured error message pointing the model at the terminal tool when a credential read is genuinely intentional.

Intentional scope decisions

• /etc/passwd is not blocked — world-readable user metadata, not a secret. /etc/shadow is already unreadable to non-root callers, so blocking it would be cosmetic.
• Shell config (.bashrc, .zshrc, .profile, …) is write-denied but read-allowed: debugging PATH issues / alias setup is a legitimate case, and inline export FOO=key strings remain covered by redact_sensitive_text when security.redact_secrets is on.
• The escape hatch for genuinely intentional reads (e.g. an agent that wants to inspect its own SSH config) is the existing terminal tool, which gates on user approval — exactly the layer this guard is designed to defer to.

Test plan

• Focused — tests/tools/test_read_deny.py (new): 26 tests covering exact paths, prefixes, allowed paths, and end-to-end read_file_tool denial. All pass.
• Adjacent — tests/tools/test_write_deny.py, tests/tools/test_file_read_guards.py, tests/tools/test_file_operations.py, tests/tools/test_read_loop_detection.py, tests/tools/test_file_write_safety.py, tests/agent/test_copilot_acp_client.py. The 6 test_file_read_guards.py::TestFileDedup/TestWriteInvalidatesDedup failures and the 1 test_copilot_acp_client.py::test_read_text_file_redacts_sensitive_content failure reproduce on clean origin/main (8081425a1) — they're pre-existing macOS /private/var write-deny collision and the redaction-off-by-default regression respectively, unrelated to this change.
• Regression guard — verified directly:

  Without guard, contents readable: True
  With guard, error returned: True
  With guard, secret leaked: False

Related

• Fixes #16809.
• Companion to the read-side concerns surfaced in #7826 (v0.8.0 audit) and adjacent to the redaction work in #16794 / #16700 / #16843 / #16849 — those address output-side redaction; this is the access-control floor underneath.

Changed files

• agent/file_safety.py (modified, +69/-0)
• tests/tools/test_read_deny.py (added, +163/-0)
• tools/file_tools.py (modified, +17/-0)