fix(compaction): redact credential-like values from summary pipeline

[teknium1]

Summary

Credentials surfaced through tool output (env dumps, .env reads, curl -v, etc.) no longer leak into context-compression summaries or survive across compactions.

Root cause: agent/context_compressor.py serializes tool results and assistant tool-call arguments verbatim into the summarizer prompt, and the prompt explicitly instructs the model to preserve "specific values" for a concrete handoff. API keys, bearer tokens, and env-var assignments were copied into the stored _previous_summary and re-injected on every subsequent compaction. agent/redact.py already had a robust pattern set (40+ token prefixes, env assignments, JSON fields, auth headers, JWTs) but was wired only to log formatters and cron output — never to the compression pipeline.

Ported from openclaw/openclaw#67801. OpenClaw's fix combined a prompt wording change (remove "tokens, API keys" from the preservation instruction) with a payload-side sanitizer. Hermes's summarizer prompt never listed tokens/keys as preservation targets, so only the payload-side fix is needed here.

Changes

• agent/context_compressor.py: import redact_sensitive_text; apply at three points
  • _serialize_for_summary return value (primary defense — scrubs tool results, assistant messages, and tool-call arguments before they reach the summarizer)
  • previous-summary re-injection on iterative compaction (heals older session state produced before this fix)
  • LLM-returned summary before storage in _previous_summary (belt-and-suspenders if summarizer echoes a secret from the input)
• tests/agent/test_context_compressor.py: 6 new regression tests — API key prefixes, env assignments, authorization headers, JSON token fields, non-secret content preservation, summarizer-echo defense.

Validation

	Before	After
echo $OPENAI_API_KEY in tool output	full key in summary, retained across compactions	masked sk-*** in serialized input and stored summary
Authorization: Bearer ghp_... in curl output	full token preserved	Bearer ghp_***
File paths / UUIDs / ports / error messages	preserved	preserved (6th test asserts no collateral damage)
tests/agent/test_context_compressor.py	48 passed	54 passed (6 new)
tests/agent/test_redact.py	56 passed	56 passed

E2E verified with real imports: read_file(".env") tool result containing a mock production key is scrubbed to OPENAI_API_KEY=*** in the serialized summary input.

Source

Ported from openclaw/openclaw#67801 'fix(compaction): stop retaining credential-like values'

[teknium1]

Redundant — same three-layer redaction landed on main in commit 3368814 (PR #9200 by @entropidelic, Apr 20). Both PRs applied redact_sensitive_text at the three correct points (serialize input, previous-summary re-injection, and LLM-returned summary before storage). Going with the one already on main.