fix(hooks): close two residual secret-disclosure channels to the model

[Kyzcreig]

Follow-up to #819 (merged as 846ba49). Closes the three residual P1s
Apollo named on t_59c0886e after the FleetReview record for
hermes-agent-pr-819-7945f423 came back with unresolvedP0P1 = 3.

#819 sanitized the shell-hook callback __name__; these are the two
paths it did not cover, both of which render operator-supplied text into
a model-facing refusal.

Reproduced before fixing

Both on the real paths, with __file__ asserted against the worktree
(the shared venv resolves the LIVE tree — the round-2 measurement trap).
Probe: qa-output/round13/repro_p1a_p1b.py.

	before	after
P1-a	hook sh#8ece5304 failed closed: command "/bin/sh -c 'export TOK=<planted>; echo hi" cannot be parsed: No closing quotation	hook sh#8ece5304 failed closed: command cannot be parsed (ValueError)
P1-b	pre_tool_call plugin callback functools.partial(<function _slow at 0x…>, '<planted>') timed out after 0.407s	pre_tool_call plugin callback partial(_slow) timed out after 0.402s

P1-a — agent/shell_hooks.py

An unparseable command is exactly the shape that still holds an
inline credential (sh -c 'export TOK=… with the quote left open).
_spawn put the raw command into result["error"], and
_evaluate_result hands that to _fail_closed_block as the model-facing
reason — so hook_display_name sanitized the hook's name while the raw
command walked in through the reason. Argus's 15 adversarial shapes in
round 8 were all parseable, so this path was never exercised.

Now reports the exception class only. Swept the two sibling
str(exc) producers (spawn / communicate) for the same reason —
exception text routinely embeds argv. All six result["error"]
producers are now secret-free; the raw command stays on the log channel
(6 sites, unchanged) for operators.

P1-b — hermes_cli/plugins.py

getattr(cb, "__name__", repr(cb)) fell through to repr() for any
callback without a __name__, and functools.partial's repr renders
every bound argument. One _callback_label() helper now covers all
three sites (:5709 model-facing via both fail-closed paths,
:5955/:6141 log): __qualname__/__name__, else the wrapped
function's name for partials, else <type>@id — never repr.

Labels stay diagnostically useful: partial(_policy), hook sh#8ece5304.

P1-c — regressions

Two tests driven through the real consumers
(resolve_pre_tool_block / _evaluate_result), each asserting the
sentinel is absent from both fail-closed paths while the block itself
is preserved and the hook stays identifiable.

Sentinel local is named planted (not secret) per the round-7 gitleaks
convention; .gitleaks.toml is byte-unchanged.

Verification

• 314/314 across 10 plugin/hook suites (test_plugins,
  test_shell_hooks, test_shell_hooks_fail_closed, _consent,
  _tree_kill, test_plugin_event_bus, test_hooks_cli,
  test_subagent_stop_hook, test_plugin_dev, test_agent_plugins).
• Mutation, both arms independent — reverting P1-a turns
  test_unparseable_hook_command_is_not_disclosed RED by name while the
  P1-b test stays green, and vice versa for
  test_refusals_do_not_disclose_a_callback_without_a_name. Tree
  restored byte-exact after each (git status --porcelain clean).
• ruff check clean; gitleaks protect --staged — no leaks.
• Nothing in the repo pins the changed strings.

Fail-closed policy is unchanged: a hook that cannot be parsed, or a
callback that times out, still blocks — only the wording changed.

Base: fork/main @ a3e3c16, with #819's merge 846ba49 confirmed as
an ancestor.

Card: t_59c0886e. Not enqueued and not marked ready — Apollo lands this
via fleet-merge.sh against the FleetReview record.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[Kyzcreig]

FleetReview

Reviewed with 2 of 3 model families — openai unavailable.

Confidence: 3/5

Findings

• P1 agent/outbound_webhooks.py:399 — New _callback_label still leaks a webhook credential to the model: outbound_webhook callbacks synthesize __name__ from the raw webhook URL
• P2 agent/shell_hooks.py:564 — Collapsing result["error"] to the exception class name also blinds the operator-facing hermes hooks test / doctor output
• P2 hermes_cli/plugins.py:504 — _callback_label fallback puts a CPython heap address in a model-facing string and is not "stable" as documented

---

FleetReview provenance · models: C=claude-code-opus-5, D=grok-4.6, G=grok-4.6 · cost: $6.50 · duration: 12m 42s · rounds: 1 · files examined: 3

[Kyzcreig]

FleetReview

Reviewed with 2 of 3 model families — openai unavailable.

Confidence: 3/5

Findings

• P2 agent/outbound_webhooks.py:163 — display_label / hook_display_name digests are unsalted commitments to the secret they replace
• P2 tests/agent/test_shell_hooks.py:703 — test_spawn_failure_detail_distinguishes_errno is vacuous — its assertions never execute on the path it claims to cover
• P0 tests/hermes_cli/test_plugins.py:1599 — New anonymous-callback test asserts a branch that class instances never reach (__qualname__ is inherited from the class __dict__)

---

FleetReview provenance · models: C=claude-code-opus-5, D=grok-4.6, G=grok-4.6 · cost: $10.77 · duration: 1h 29m 37s · rounds: 4 · files examined: 6