fix(prompt): preserve context around blocked command lines

[yungchentang]

Summary

• replace line-local curl/wget/read-secret findings with a blocked-line placeholder instead of discarding the entire context file
• preserve all surrounding SOUL.md / AGENTS.md identity and safety instructions
• keep whole-file fail-closed behavior when any other prompt-injection finding is present

Root Cause

_scan_context_content() replaced an entire context file whenever the shared threat scanner returned any finding. A single command-shaped exfil_curl false positive in an otherwise legitimate SOUL.md therefore removed the user's full identity and safety policy, even though the matched command itself was confined to one line.

The scanner rules remain unchanged. This patch only narrows the reaction to line-local command findings: the matched line never reaches the system prompt, the sanitized content is rescanned, and any remaining finding still blocks the full file.

Tests

• scripts/run_tests.sh tests/agent/test_prompt_builder.py tests/tools/test_threat_patterns.py -q (214 passed)
• python3 -m py_compile agent/prompt_builder.py tests/agent/test_prompt_builder.py
• git diff --check origin/main...HEAD

Refs #63977

[teknium1]

Thanks for preserving the surrounding identity and safety context while keeping the matched command out of the prompt. The full-file blocking premise is still present on current main at agent/prompt_builder.py:61-64.

Problems

• agent/prompt_builder.py:74 scans each line, but retains only redactable IDs. scan_for_threats() caps each call at 65,536 characters (tools/threat_patterns.py:53,229). With an early redactable command and a later non-redactable injection beyond that cap, the per-line pass observes then discards the later finding; the capped rescan at PR lines 93-95 misses it and returns sanitized_content. Context truncation preserves the tail (agent/prompt_builder.py:1818-1826), so that content can reach the prompt.

Suggested changes

• Preserve any non-redactable per-line finding and fail closed; add the >MAX_SCAN_CHARS mixed-findings regression case.
• Update website/docs/user-guide/features/context-files.md:160-164 if the line-redaction behavior is retained.

Automated hermes-sweeper review.

[GottZ]

This was generated by AI during triage.

Summary

Two PRs are included, but they address different causes: #23412 covers the requested HERMES_HOME global-context loading, while #63986 changes threat handling so redactable command lines do not discard surrounding context.

Related pull requests

• feat(prompt): load global HERMES.md operational context #23412 related — (+211/-19) — n/a: The recorded scope adds first-non-empty HERMES_HOME context loading with HERMES.md, AGENTS.md, and CLAUDE.md aliases, tests, and documentation, directly addressing feat(prompt_builder): scan HERMES_HOME for global context files (HERMES.md, AGENTS.md, CLAUDE.md) #31762. The keep_open contributor review says it must be rebased to preserve current dynamic-cap/read-path behavior and must explicitly decide and test the workdir-less cron contract.
• fix(prompt): preserve context around blocked command lines #63986 related — (+120/-7) — n/a: The complete diff redacts exfiltration or secret-read command lines while preserving surrounding context, retains whole-file blocking for other findings, updates documentation, and includes the >MAX_SCAN_CHARS mixed-findings regression requested by the keep_open contributor review; this is security-scanner work rather than the global-context feature requested by feat(prompt_builder): scan HERMES_HOME for global context files (HERMES.md, AGENTS.md, CLAUDE.md) #31762.

Duplicates

#23412 and #63986 are not duplicates: #23412 implements global context discovery, whereas #63986 changes context-file threat handling.

Suggested consolidation

Author action on #23412: rebase onto main while preserving the current dynamic-cap/read-path contract, then decide and test whether global policy applies to workdir-less cron jobs. Keep #63986 open with the salvage path shown in its updated diff—the line-redaction implementation, fail-closed handling of later non-redactable findings, regression coverage, and documentation—but track it separately from #31762; neither PR should be closed as a duplicate of the other.

Cross-PR triage: Reviewed 2 pull requests and 1 issue in this complex. Diffs were read for 1 of 2 PRs (rest unavailable); Assessment working set: 8 kB of PR diffs, 6 kB of issue/PR text, 5 kB of discussion (6 comments), 0 verify verdicts. verdicts reflect diff content, not PR titles. Part of an automated triage batch.