fix(context): bound session recall payloads by sk-holmes · Pull Request #55640 · NousResearch/hermes-agent

sk-holmes · 2026-06-30T12:14:04Z

What does this PR do?

Bounds session_search output before recalled history is injected back into the active model context.

The original bug is recursive context bloat: one recall call can import prior messages, compaction summaries, tool metadata, and lineage/bookend payloads into the current model context. If that recalled result is itself large or contains stale generated summaries, it can consume another context window and reactivate obsolete task state.

This PR keeps recall source-linked and navigable while bounding every returned layer:

canonical standalone, merged, legacy, and structured compaction summaries are recognized and omitted from recalled content and snippets;
oversized message bodies, snippets, tool-call arguments, retained metadata, collections, and the final serialized response are capped with explicit omission/truncation metadata;
discovery prefers a real source message when a generated compaction summary ranks first;
lineage traversal has depth and lookup budgets plus path compression;
read-mode bookends and message counts come from active message rows instead of stale cached metadata;
default/profile databases opened by the tool have explicit ownership and are closed after use;
newly generated merged-summary wrappers escape quoted boundary text;
ambiguous historical wrappers remain inert summary material instead of being reintroduced as live user or assistant turns.

The result preserves session IDs, message IDs, roles, timestamps, tool names, source references, and navigation metadata so an agent can request a narrower scroll/read rather than receiving an unbounded transcript copy.

Related Issue

Fixes session_search discovery can rehydrate huge compaction summaries via bookends #43175 — session_search discovery can rehydrate huge compaction summaries through bookends.

Related PRs:

fix(tools): filter compaction summaries from session_search bookends and cap content length #43184 — direct overlap for session_search discovery can rehydrate huge compaction summaries via bookends #43175. It filters compaction summaries from session_search bookends and caps content length in tools/session_search_tool.py / tests/tools/test_session_search.py. This PR is broader: it also handles discovery snippets, structured content, nested and top-level tool-call arguments, schema wording and profile forwarding through built-in execution paths.
Guard private memory artifacts from delivery #37003 — overlapping session-search hygiene/private artifact protection. Broader security/delivery PR; not a duplicate because it also guards private memory artifact delivery and compression boundaries.
fix: bound memory capture and recall output #21692 — overlapping bounded recall/memory output. Related output-cap direction; not an exact duplicate because it targets memory capture/provider-backed recall plus session-search caps, while this PR specifically fixes compaction-summary/snippet/tool-call/profile regressions.
fix: dedupe persisted compaction handoffs #47274 — related compaction-handoff dedupe in agent/context_compressor.py; not duplicate because it prevents duplicate persisted handoffs at compression time rather than bounding session_search recall output.

Type of Change

🐛 Bug fix (non-breaking change that fixes an issue)
✨ New feature (non-breaking change that adds functionality)
🔒 Security fix
📝 Documentation update
✅ Tests (adding or improving test coverage)
♻️ Refactor (no behavior change)
🎯 New skill (bundled or hub)

Changes Made

tools/session_search_tool.py
- bounds individual fields, collections, and the final serialized response;
- omits canonical compaction summaries from recalled content and snippets;
- prefers non-summary source messages during discovery;
- bounds lineage traversal and stops once the requested result limit is satisfied;
- explicitly closes internally owned database handles.
agent/context_compressor.py
- centralizes canonical summary detection across standalone, merged, legacy, and structured forms;
- preserves real prior-tail content across repeated compaction;
- escapes quoted merged-wrapper boundaries;
- scans persisted wrappers without suffix-sized copies;
- fails closed when historical wrapper boundaries are ambiguous.
hermes_state.py
- adds active-row point/bookend reads with source-of-truth message counts;
- selects bounded head/tail IDs before hydrating full message blobs.
tests/agent/test_context_compressor.py
- covers canonical and historical summary shapes, repeated compaction, quoted boundaries, ambiguous legacy wrappers, and prevention of stale-summary reinjection.
tests/tools/test_session_search.py
- covers summary omission, source-hit preference, stale/malformed counts, inactive rows, field/tool/aggregate response budgets, lineage limits, database ownership, and bounded SQL work.
website/docs/user-guide/sessions.md
- documents bounded recall and omission/truncation metadata instead of promising untruncated payloads.

How to Test

scripts/run_tests.sh \
  tests/agent/test_context_compressor.py \
  tests/tools/test_session_search.py \
  -q

Final local verification:

tests/agent/test_context_compressor.py: 162 passed
tests/tools/test_session_search.py: 79 passed
Total: 241 passed, 0 failed
Ruff passed
Python compilation passed
git diff --check passed

GitHub Actions on the final head also pass:

all eight Python test slices;
e2e tests;
Ruff and type-diff checks;
Windows-footgun checks;
docs-site checks;
Docker AMD64 and ARM64 builds;

Manual behavior checks:

compaction-summary bodies and snippets are replaced by omission metadata instead of being returned verbatim;
a real source message is preferred when its lineage also contains a matching compaction summary;
oversized content and tool metadata remain below field and aggregate response limits;
read mode returns the true active head, tail, and message count when cached session metadata is stale;
generated merged-summary wrappers remain parseable when payload text quotes the internal boundary;
ambiguous historical wrappers remain summary data and are never synthesized into live turns.

Checklist

Code

I've read the Contributing Guide
My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
I searched for existing PRs to make sure this isn't a duplicate
My PR contains only changes related to this fix/feature (no unrelated commits)
I've run pytest tests/ -q and all tests pass
I've added tests for my changes (required for bug fixes, strongly encouraged for features)
I've tested on my platform: macOS 26.5.1

Documentation & Housekeeping

I've updated relevant documentation (README, docs/, docstrings) — or N/A
I've updated cli-config.yaml.example if I added/changed config keys — or N/A
I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
I've updated tool descriptions/schemas if I changed tool behavior — or N/A

For New Skills

N/A

Screenshots / Logs

tonydwb

Code Review Summary

Verdict: LGTM

Adds profile forwarding to session_search tool calls and bounds session recall payloads with metadata constants.

✅ Looks Good

Clean implementation: profile parameter forwarded from agent to session_search
Good test coverage with 2 new tests (sequential and invoke paths)
Schema description updated to document bounded payloads
Well-scoped fix for cross-profile session search

Reviewed by Hermes Agent

dante32683 · 2026-07-06T04:13:51Z

Hit this exact problem before finding this PR. Data point in case it helps review.

On an instance with a large session history, a single session_search discover-mode call (query, limit=5) returned a ~49400-char tool result.

~22,200 chars was actual message content.
~20,700 chars (~42% of the total) was the raw tool_calls blob on assistant messages caught in the bookend/window. Mostly opaque per-call bookkeeping (response_item_id, etc.) plus uncapped function.arguments.

The _MESSAGE_CONTENT_MAX_CHARS / _TOOL_CALL_ARGUMENTS_MAX_CHARS / _TOOL_CALLS_MAX_ITEMS caps here would have cut that call from ~49k chars to a small fraction of that.

One gap: _shape_tool_calls_for_recall copies each call dict (shaped = dict(call)) and only reshapes function.arguments / top-level arguments. id / call_id / response_item_id still pass through unchanged. Not as big a deal since arguments and count are capped which was the main bloat. Possible follow-up though.

Would like to see this merged.

teknium1

Thanks for addressing a real recall-context bloat path. Current main still returns raw recalled content and tool-call blobs through tools/session_search_tool.py:123-141 and discovery bookends/windows at :588-603.

Problems

tools/session_search_tool.py:153 misses merged compaction summaries. Current compaction intentionally puts the summary prefix after _MERGED_SUMMARY_DELIMITER (agent/context_compressor.py:138-145, 2259-2270), so this supported form is not omitted.
tools/session_search_tool.py:278 copies retained call dictionaries wholesale. Only arguments is bounded, so an oversized response_item_id or other provider field still defeats the stated bounded-payload guarantee.
website/docs/user-guide/sessions.md:528 still promises “no truncation.”

Suggested changes

Reuse or precisely mirror the compressor's merged/legacy summary detection and add its regression shape.
Shape tool calls with an explicit bounded field set (or cap every retained field), plus a non-arguments oversized-field test.
Update the sessions guide for bounded recall output.

Automated hermes-sweeper review.

teknium1 · 2026-07-15T10:31:26Z

+        return len(str(content))
+
+
+def _is_compaction_summary_content(content: Any) -> bool:


This only recognizes a summary when its prefix starts the string. Current compaction can merge a prior tail before the summary and place the prefix after _MERGED_SUMMARY_DELIMITER (agent/context_compressor.py:138-145, 2259-2270), so that supported summary form is returned rather than omitted. Please match the compressor's detection semantics and add a merged-summary regression.

teknium1 · 2026-07-15T10:31:26Z

+            shaped_calls.append(call)
+            continue
+
+        shaped = dict(call)


Copying the whole provider call object leaves every non-arguments field unbounded. A large response_item_id or another provider-specific field survives the count/arguments caps, so the recall payload is still not bounded. Please use an explicit shaped field set or cap all retained fields, with a regression test.

sk-holmes · 2026-07-16T04:58:47Z

enhanced with more tests and self reviews 🫡

…n-recall-payloads # Conflicts: # agent/context_compressor.py # tools/session_search_tool.py

…n-recall-payloads

session_search replays raw message content from past sessions verbatim, with no scan and no untrusted-content wrapping. A message that carries an injection payload -- a poisoned web page quoted earlier, a pasted phishing email, a Brainworm-style payload from any prior turn -- gets served back into the model's context as plain data on a later query, unmarked. Every other tool that returns attacker-controllable content (web_extract, web_search, browser_*, mcp_*) already gets wrapped in <untrusted_tool_result> delimiters via make_tool_result_message(), telling the model to treat the content as data, not instructions. session_search was simply missing from that list. Add it.

sk-holmes · 2026-07-26T13:46:49Z

resimplified this branch to stay on original target

# Conflicts: # tools/session_search_tool.py

Skywind5487

Research note for #45/#47: the current PR body still says lineage traversal has “depth and lookup budgets plus path compression” and “stops once the requested result limit is satisfied”, but the current head diff (d0e5a364...) no longer contains lineage traversal/path-compression changes; its present tools/session_search_tool.py diff is summary detection/content bounding only. Please do not treat #55640's current head as an implementation of the path-compressed contender without checking an earlier commit/revision. This is just provenance clarification, not a request to change the PR.

tonydwb reviewed Jun 30, 2026

View reviewed changes

This was referenced Jun 30, 2026

[HERMES] fix(tui_gateway): do not use lifetime total as context-used after model switch #55940

Open

fix(tui_gateway): don't show cumulative session total as context_used (#50421) #56146

Merged

sk-holmes force-pushed the sk/fix-bound-session-recall-payloads branch 4 times, most recently from 2271c09 to a0f492c Compare July 5, 2026 06:55

sk-holmes force-pushed the sk/fix-bound-session-recall-payloads branch from a0f492c to e3cfc29 Compare July 6, 2026 22:28

sk-holmes force-pushed the sk/fix-bound-session-recall-payloads branch from e3cfc29 to 5ac7fef Compare July 15, 2026 03:13

teknium1 reviewed Jul 15, 2026

View reviewed changes

teknium1 added sweeper:risk-compatibility Sweeper risk: may break existing users, config, migrations, defaults, or upgrades sweeper:blast-moderate Sweeper blast radius: moderate — a subsystem or single platform labels Jul 15, 2026

sk-holmes force-pushed the sk/fix-bound-session-recall-payloads branch from 5ac7fef to b45bac2 Compare July 15, 2026 13:20

sk-holmes requested a review from teknium1 July 15, 2026 13:27

github-actions Bot mentioned this pull request Jul 15, 2026

🦞 OpenClaw 生态日报 2026-07-15 litang9/big_model_radar#211

Open

sk-holmes added 2 commits July 15, 2026 16:29

fix(context): bound session recall payloads

452d581

fix(context): fully bound session recall metadata

3a39f01

sk-holmes force-pushed the sk/fix-bound-session-recall-payloads branch from b45bac2 to 3a39f01 Compare July 16, 2026 00:25

sk-holmes added 4 commits July 15, 2026 18:10

fix(context): harden canonical bounded recall

8b8ec79

fix(context): resolve bounded recall review findings

988eaa4

fix(context): harden merged summary parsing

ffd5316

fix(context): preserve ambiguous legacy summaries

54d42fd

teknium1 added the area/sessions Session lifecycle, resume, persistence, history label Jul 19, 2026

sk-holmes and others added 9 commits July 22, 2026 23:54

Merge remote-tracking branch 'upstream/main' into sk/fix-bound-sessio…

c5e3f19

…n-recall-payloads # Conflicts: # agent/context_compressor.py # tools/session_search_tool.py

fix: preserve bounded recall semantics

514a64a

Merge remote-tracking branch 'upstream/main' into sk/fix-bound-sessio…

8fc0574

…n-recall-payloads

test: cover bounded recall edge paths

e1e77c8

test(agent): verify untrusted session recall

b1afc73

fix(agent): keep session recall out of execution backends

b43adae

test(memory): use canonical merged summary wrapper

d8ac21e

fix(session-search): bound title-only discovery on latest main

7c8f6a6

sk-holmes added 3 commits August 1, 2026 04:14

fix(session-search): resolve bounded recall on latest main

d0ab36c

fix(session-search): refresh bounded recall on current main

1eaae0c

fix(session-search): refresh bounded recall on current main

d0e5a36

# Conflicts: # tools/session_search_tool.py

Skywind5487 reviewed Aug 9, 2026

View reviewed changes

blunkjamie-dev mentioned this pull request Aug 9, 2026

perf(session-search): adapt discovery result hydration #82595

Closed

19 tasks

Navigation Menu

Uh oh!

fix(context): bound session recall payloads - #55640

fix(context): bound session recall payloads#55640
sk-holmes wants to merge 18 commits into
NousResearch:mainfrom
sk-holmes:sk/fix-bound-session-recall-payloads

sk-holmes commented Jun 30, 2026 •

edited

Loading

Uh oh!

tonydwb left a comment

Uh oh!

dante32683 commented Jul 6, 2026

Uh oh!

teknium1 left a comment

Uh oh!

teknium1 Jul 15, 2026

Uh oh!

sk-holmes Jul 15, 2026

Uh oh!

teknium1 Jul 15, 2026

Uh oh!

sk-holmes Jul 15, 2026

Uh oh!

sk-holmes commented Jul 16, 2026

Uh oh!

sk-holmes commented Jul 26, 2026

Uh oh!

Skywind5487 left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

		return len(str(content))


		def _is_compaction_summary_content(content: Any) -> bool:

Uh oh!

Conversation

sk-holmes commented Jun 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Related Issue

Type of Change

Changes Made

How to Test

Checklist

Code

Documentation & Housekeeping

For New Skills

Screenshots / Logs

Uh oh!

tonydwb left a comment

Choose a reason for hiding this comment

Code Review Summary

✅ Looks Good

Uh oh!

dante32683 commented Jul 6, 2026

Uh oh!

teknium1 left a comment

Choose a reason for hiding this comment

Problems

Suggested changes

Uh oh!

teknium1 Jul 15, 2026

Choose a reason for hiding this comment

Uh oh!

sk-holmes Jul 15, 2026

Choose a reason for hiding this comment

Uh oh!

teknium1 Jul 15, 2026

Choose a reason for hiding this comment

Uh oh!

sk-holmes Jul 15, 2026

Choose a reason for hiding this comment

Uh oh!

sk-holmes commented Jul 16, 2026

Uh oh!

sk-holmes commented Jul 26, 2026

Uh oh!

Skywind5487 left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

sk-holmes commented Jun 30, 2026 •

edited

Loading