fix: add security.display_redaction_only to keep secrets usable in tools

[HiddenPuppy]

Summary

security.redact_secrets was redacting credential values in **both** tool results (file reads, terminal output) and display/logging paths. When the LLM received partially-masked values (sk-a***c12) from tool results, it could not use them in subsequent commands — breaking:

• htpasswd and similar tools that pass passwords via command-line arguments (Secret redaction breaks functional credential use in terminal commands #16843)
• Bitwarden CLI workflows where Hermes retrieves a secret and passes it to a script (security.redact_secrets redacts values before passing to tools, breaking Bitwarden CLI workflows #16700)

Changes

New config: security.display_redaction_only

Setting	Effect
false (default)	Current behavior — redact everywhere (backward compatible)
true	Redact only in chat display + logs; real values pass through to tools

security:
  redact_secrets: true
  display_redaction_only: true

How it works

• redact_sensitive_text() — used by tool results (file reads, terminal output, code execution). Respects the new flag: skips patterns when display_redaction_only=true so the LLM gets real values.
• redact_for_display() — new function that **always** redacts, used by chat output (send_message), logs (RedactingFormatter), and context summaries. Never skips even when the flag is active.
• All entry points — CLI, gateway, and hermes_cli all bridge the new config to the env var.

Testing

• tests/agent/test_redact.py: 75 tests, all passing ✅

Closes #16843
Closes #16700

[alt-glitch]

Related to #16700 and #16843 — same root cause (redact_secrets breaks tool execution). Note: #16794 (flip default to off) already merged as interim fix.

[plcunha]

Review — PR #16849: security.display_redaction_only

Author: @HiddenPuppy
Reviewer: PooL / João Vitor Cunha
Verdict: ✅ Approach is correct — the right fix for this class of bugs. Needs rebase + minor cleanup before merge.

---

✅ What this PR gets right

The display_redaction_only flag is exactly the right architectural fix for the redaction-usability tension:

• redact_sensitive_text() — when display_redaction_only=true, becomes a no-op. Tool results (terminal, file reads, execute_code) pass real credential values to the LLM → it can use them in subsequent commands.
• redact_for_display() — ALWAYS redacts, used in chat messages, logs, context summaries, cron output. User never sees secrets.
• Backward compatible — default false preserves existing behavior for users who want aggressive redaction.

This directly fixes:

• #43083 (P1, open) — "Passwords get replaced by *** but model reads back its own conversation history and fails on second tool call"
• #16843 — "Secret redaction breaks functional credential use in terminal commands"
• #16700 — "Bitwarden CLI workflows where Hermes retrieves a secret and passes it to a script"

I hit #43083 in production today (2026-06-22): trying to query a PostgreSQL DB via PGPASSWORD=*** (the real password pool2026db was redacted to *** by the terminal tool output). The agent retried 8+ times in a loop, unable to see that the password was being masked.

---

🔴 Issues that need fixing

1. Workflow file deletions (903 lines)

The commit e71a2ad1f deletes all .github/workflows/*.yml files:

.github/workflows/contributor-check.yml  |  73 ------
.github/workflows/deploy-site.yml        |  87 ------
.github/workflows/docker-publish.yml     |  99 ------
.github/workflows/docs-site-checks.yml   |  48 ------
.github/workflows/nix-lockfile-check.yml |  68 ------
.github/workflows/nix-lockfile-fix.yml   | 149 ------
.github/workflows/nix.yml                |  33 ------
.github/workflows/skills-index.yml       | 101 ------
.github/workflows/supply-chain-audit.yml | 139 ------
.github/workflows/tests.yml              |  82 ------

These must be reverted. Removing CI/CD, tests, supply-chain audit, and lockfile checks would break the repo infrastructure. Likely an accident from forking/pushing to a personal fork.

2. Branch is stale — needs rebase onto current main

The PR branch is based on 8081425a1 (from ~April 2026). Since then, the codebase has evolved significantly:

• agent/chat_completion_helpers.py now exists on main (lines 874-1027) and uses redact_sensitive_text() — this is the exact codepath that causes #43083
• The PR currently deletes this file (it was not in the old base)
• Multiple redaction-related fixes have landed on main (1f28b1a9b, 6f0ecf37d, 3b56d3a29, etc.)

Request: Rebase onto main and verify chat_completion_helpers.py correctly inherits the display_redaction_only behavior. Since redact_sensitive_text() is the function being modified, it should work automatically — but this needs to be tested against the current code.

3. send_message_tool.py aliasing is confusing

from agent.redact import redact_for_display as redact_sensitive_text

Aliasing redact_for_display as redact_sensitive_text works but is semantically misleading. The call sites in the file use redact_sensitive_text(content) but actually get display-only redaction. This is the correct behavior (send_message output IS display), but the alias hides intent.

Suggestion: Rename the local usage at the call sites instead:

from agent.redact import redact_for_display
# then at call sites:
content = redact_for_display(content)

4. Test coverage for #43083 scenario

The existing 75 tests are solid. Consider adding a regression test specifically for the #43083 pattern:

• Redacted tool arguments in conversation history
• Model receives real values via tools despite display redaction
• Verify no *** leakage into tool execution arguments when display_redaction_only=true

---

🟢 Confirmed working

• Config bridging at all 3 entry points (cli, gateway, hermes_cli) ✅
• cron/scheduler.py switch to redact_for_display ✅
• context_compressor.py switch to redact_for_display ✅
• RedactingFormatter switch to redact_for_display ✅
• Default config template updated ✅

---

📋 Summary

Item	Status
Core approach (display_redaction_only flag)	✅ Approved
Workflow file deletions	🔴 Must revert
Rebase onto current main	🔴 Required
send_message_tool.py aliasing	🟡 Cleanup suggested
Test coverage	🟡 Regression test for #43083 suggested

This is the right fix — once rebased and cleaned up, this should land. The production impact is real (89+ repeated failures in our logs from a single session hitting this).

[teknium1]

Thanks for addressing the credential-usability problem. Current main already fixes the replay corruption that turned later credential-bearing tool calls into ***: agent/chat_completion_helpers.py:1142-1158 preserves tool-call arguments verbatim, from bbe1bf404.

Problems

• The submitted diff deletes ten unrelated CI/CD workflow files, including .github/workflows/tests.yml and supply-chain-audit.yml; these deletions must not be part of a redaction change.
• The proposed global redact_sensitive_text() bypass would need a current-main boundary audit. Current user-facing approval copies still call that helper at tools/approval.py:1682-1688 and 2119-2126, and TUI quick-command output does so at tui_gateway/server.py:11830-11839.
• No tests are included. The config is read before import-time redaction state is initialized; see the existing fresh-process bridge coverage in tests/hermes_cli/test_redact_config_bridge.py:23-158.

Suggested changes

• Salvage only the intended redaction work, excluding workflow deletions.
• Rework it around current forced display/log safety boundaries and add end-to-end tests for raw model-visible tool output versus masked chat, logs, and approvals.

Automated hermes-sweeper review.

[teknium1]

Blocking: this redaction PR must not delete the repository test workflow. Please exclude this unrelated workflow deletion, along with the other CI/CD workflow removals in this commit.

[plcunha]

Correction to my June 22 review after re-auditing this PR against current main: I no longer recommend rebasing/merging this implementation as-is.

The primary replay bug from #43083 is already fixed on main by bbe1bf404 / #54136: build_assistant_message() now preserves tool-call arguments verbatim, so the model no longer replays PGPASSWORD='***' on the next turn. The current regression coverage passes locally (155 passed across test_tool_call_arg_no_redaction.py, test_redact.py, and test_redact_config_bridge.py).

The sweeper's remaining concerns are valid:

• commit e71a2ad1f deletes ten unrelated CI/CD workflows and must never be carried forward;
• globally turning redact_sensitive_text() into a no-op under display_redaction_only is unsafe on current main, because user-facing approval copies still call it in tools/approval.py, TUI quick-command output calls it in tui_gateway/server.py, and other log/display boundaries depend on it;
• the old branch has no current-main boundary or fresh-process config-bridge tests.

Recommendation: close this PR as stale/implemented for the original bug. If a display-only mode is still desired, it should be a new current-main design that separates model-visible raw tool data from forced-redaction display/log/approval surfaces, with end-to-end tests for every boundary. Simply rebasing this global bypass would risk exposing credentials to users and logs.

Apologies for the overly positive architectural verdict in my earlier review; it predated the merged #43083 fix and did not account for all current display boundaries.