fix(oneshot): honor --ignore-rules / HERMES_IGNORE_RULES on -z path (#26633)

[briandevans]

Summary

hermes -z --ignore-rules is documented to skip auto-injection of AGENTS.md, SOUL.md, .cursorrules, and persistent memory. On the chat path it does. On the oneshot (-z) path it was a silent no-op — the flag was parsed, the env var was set, but hermes_cli.oneshot never propagated it to AIAgent.

This wires ignore_rules end-to-end so -z matches chat semantics for the flag.

Fixes #26633.

The bug

The reporter's table (from the issue) shows the chat path correctly drops ~4.2k chars of injected context when --ignore-rules is set; the -z path is unchanged:

Invocation	system_prompt	memory	profile	SOUL
hermes chat -Q -q "say ok"	26,625	✓	✓	✓
hermes chat -Q --ignore-rules -q "say ok"	22,417	✗	✗	✗
hermes -z "say ok"	26,625	✓	✓	✓
hermes -z --ignore-rules "say ok"	26,635	✓	✓	✓

Root cause, three sites:

1. hermes_cli/main.py parses --ignore-rules and (at ~:1410) sets HERMES_IGNORE_RULES=1. ✅
2. hermes_cli/main.py -z dispatch calls run_oneshot(args.oneshot, model=…, provider=…, toolsets=…) — never forwards ignore_rules. ❌
3. hermes_cli/oneshot.run_oneshot() doesn't accept ignore_rules and doesn't read HERMES_IGNORE_RULES. _run_agent() builds AIAgent(...) without skip_context_files= / skip_memory=, so both default to False. ❌

The chat path's reference pattern is cli.py:2709:

self.ignore_rules = ignore_rules or os.environ.get("HERMES_IGNORE_RULES") == "1"

then AIAgent(skip_context_files=self.ignore_rules, skip_memory=self.ignore_rules, …) at cli.py:4477-4478.

The fix

Mirror the chat path exactly:

• run_oneshot(prompt, …, ignore_rules: bool = False) reads the env-var fallback (HERMES_IGNORE_RULES == "1") and passes the resolved bool into _run_agent().
• _run_agent() forwards it as skip_context_files= and skip_memory= on the AIAgent(...) call.
• hermes_cli/main.py -z dispatch now passes ignore_rules=getattr(args, "ignore_rules", False).

Diff is +16/-1 across two production files, plus a focused regression test file.

Test plan

• Focused regression: tests/hermes_cli/test_oneshot_ignore_rules.py — 10 tests covering
  • _run_agent forwards both skip_context_files and skip_memory when ignore_rules=True
  • explicit param propagates through run_oneshot → _run_agent
  • HERMES_IGNORE_RULES=1 env var propagates when the param is False
  • only literal "1" activates the gate (matches the chat path)
  • default behavior (flag absent) leaves both skip-kwargs False
  • dispatch in hermes_cli/main.py includes ignore_rules= in its run_oneshot(...) call
• Adjacent: tests/hermes_cli/test_ignore_user_config_flags.py (chat-path coverage) and tests/hermes_cli/test_tui_resume_flow.py (updated to reflect the new run_oneshot kwarg in the -z dispatch capture) — all 40 tests pass.
• Regression guard: stashed the production changes and re-ran the new test file — all 10 tests fail with the production fix removed, confirming the tests actually exercise the bug. Restored, all pass.

Related

Sibling code paths that may need the same fix: hermes_cli.config.load_config() does not honour HERMES_IGNORE_USER_CONFIG=1 the way cli.load_cli_config() does, so hermes -z --ignore-user-config is likely also a silent no-op on the same -z path. Intentionally left out of this PR to keep the diff small and the regression scope tight to the reported --ignore-rules symptom — happy to widen the fix to cover --ignore-user-config if preferred.

[briandevans]

CI audit — all 4 test failures are pre-existing baselines unrelated to this PR's touched code (hermes_cli/oneshot.py, tests/hermes_cli/test_oneshot_ignore_rules.py).

Test	Symptom on CI	Root cause on main
tests/hermes_cli/test_gateway_service.py::TestSystemUnitHermesHome::test_system_unit_uses_target_user_home_not_calling_user	PermissionError: [Errno 13] Permission denied: '/root/.hermes/node/bin'	Test mocks Path.home() to /root but does not mock _build_service_path_dirs() — generate_systemd_unit() calls it, which probes real filesystem via hermes_node.is_dir() at hermes_cli/gateway.py:2125. On CI as root the path exists with restricted perms.
tests/hermes_cli/test_gateway_service.py::TestSystemUnitHermesHome::test_system_unit_remaps_profile_to_target_user	PermissionError: [Errno 13] Permission denied: '/root/.hermes/profiles/coder/node/bin'	Same root cause as above.
tests/tools/test_transcription_dotenv_fallback.py::TestProviderSelectionGate::test_explicit_xai_sees_dotenv	AssertionError: assert 'none' == 'xai'	After e13c1b806, xAI credential resolution moved into tools.xai_http.resolve_xai_http_credentials(); the test still only patches hermes_cli.config.load_env, not the new tools.xai_http.get_env_value entry point used by the resolver.
tests/tools/test_transcription_dotenv_fallback.py::TestEndToEndRegressionGuard::test_xai_key_only_in_dotenv_before_fix	assert False is True	Same root cause — _transcribe_xai now reaches the xAI key through the same resolver.

Same 4 failures show on PR #26622 and PR #26640 in the same window. Happy to re-run CI once these are addressed on main.

[briandevans]

Closing this to keep the contribution queue manageable while it awaits maintainer review. The fix still applies cleanly and I'm happy to reopen if a maintainer wants to pick it up — just give it a nudge and I'll refresh it against main.