fix: strip leaked memory context from commentary

[dontcallmejames]

Summary

• sanitize interim assistant commentary before sending it to the UI layer
• sanitize streamed deltas before sending them to UI callbacks
• prevent leaked <memory-context>...</memory-context> blocks from appearing in visible assistant output
• add regression tests covering both commentary and stream-delta leaks

Repro

A visible assistant message included Hermes's internal memory wrapper.
Example leaked shape:

[System note: The following is recalled memory context, NOT new user input. Treat as informational background data.]

Honcho Context

Example recalled memory content that should remain internal to the agent and never be shown in visible assistant output.

This should never be shown to the user.

Root cause

Two user-visible paths were missing memory-context sanitization:

• interim commentary emitted through AIAgent._emit_interim_assistant_message()
• streamed deltas emitted through AIAgent._fire_stream_delta()

Final responses were already sanitized, but these intermediate output paths could still pass raw memory-context fences to UI callbacks.

Fix

Apply sanitize_context(...) before surfacing:

• interim commentary in _emit_interim_assistant_message()
• streamed text in _fire_stream_delta()

Test plan

• pytest tests/run_agent/test_run_agent_codex_responses.py::test_interim_commentary_strips_leaked_memory_context -q -o 'addopts='
• pytest tests/run_agent/test_run_agent_codex_responses.py::test_stream_delta_strips_leaked_memory_context -q -o 'addopts='
• pytest tests/run_agent/test_run_agent_codex_responses.py -q -o 'addopts='
• pytest tests/run_agent/test_run_agent.py -q -o 'addopts=' -k 'MemoryContextSanitization'

[teknium1]

Thanks for this, and for the clean repro + tests — but we're going to close it, because both paths it touches have moved past this approach on current main.

Stream deltas (_fire_stream_delta) are already sanitized: there's a stateful streaming scrubber (#5719) that catches <memory-context> spans even when they're split across deltas. A per-delta sanitize_context() call is redundant here and actually weaker, since it can't span chunk boundaries.

Interim commentary (_emit_interim_assistant_message) is the more important one. The post-stream sanitize_context() scrub on this path was deliberately removed in commit 4a9ac5c3 ("fix(memory): drop scrub from interim commentary + final response"), which landed after this PR was opened. The reasoning there: post-stream scrubs mutate model output too broadly — a model legitimately writing docs or code that contains a literal <memory-context> string would have it silently stripped. Real leaks are handled delta-by-delta by the streaming scrubber upstream, so the post-stream scrubs were redundant and lossy.

There's now an existing test, test_interim_commentary_preserves_assistant_content, that uses the exact same input as your proposed test and asserts the opposite outcome (markers preserved). This PR would re-introduce the behavior that test was written to guard against.

So this is an intentional-design situation rather than a gap — appreciate the contribution and the thorough test plan regardless.