fix(agent): replace assert with runtime guard in secret_sources command parser

[JonthanaHanh]

Summary

Replace assert m is not None with a defensive if m is None: continue guard in agent/secret_sources/command.py:116.

Problem

The assert statement at agent/secret_sources/command.py:116 is stripped by python -O (optimized mode), silently removing the invariant check. While the regex match is logically guaranteed by the upstream filter in the list comprehension, relying on assert for production code is a well-known anti-pattern:

• Under python -O, the assert is removed entirely
• If the invariant were ever violated (e.g. regex engine change), the subsequent m.group(1) would raise an unhelpful AttributeError: 'NoneType' object has no attribute 'group'

Fix

Replace:

assert m is not None  # filtered above

With:

if m is None:
    continue  # pragma: no cover — filtered above, defensive guard

This is a no-op in the normal case (the regex always matches lines that already passed the filter) but provides a graceful degradation path instead of an AssertionError crash.

Test Plan

• Syntax check passes (ast.parse())
• Existing tests pass
• python -O -c "import agent.secret_sources.command" — no AssertionError

Notes

This assert was not covered by prior assert-fixing PRs (#56866, #62659, #64818). The agent/secret_sources/ module was recently added and was not included in the earlier assert sweeps.

[teknium1]

Thanks for the defensive cleanup. The target assertion is still present on current main, but the claimed optimized-mode failure is not established by the current parser flow.

Problems

• agent/secret_sources/command.py:109-113 only appends lines for which _ENV_LINE.match(line) succeeds; agent/secret_sources/command.py:115 immediately repeats that same match before the assertion at line 116. Under python -O, removing the assertion does not itself make m nullable or change normal behavior.
• The diff adds no regression test for the new branch; existing parsing coverage at tests/test_command_secret_source.py:88-91 covers the base64 fallback only.

Suggested changes

• Please provide a reachable production condition where the second match can fail, together with a behavior-level test. If none exists, reframe this as a defensive cleanup rather than an optimized-mode bug fix.

Automated hermes-sweeper review.

[teknium1]

The preceding comprehension retains only lines for which this same _ENV_LINE.match succeeded. Under python -O, removing the assertion does not itself make this second match fail; please provide a reachable condition and regression test for this guard, or reframe it as defensive cleanup.