Scrub secrets from profile export archives

[OutThisLife]

Summary

Profile export already excludes auth.json / .env, but secret-shaped strings sitting in skills, SOUL.md, memories, and other text still left the machine in the shareable .tar.gz. Export now force-runs agent.redact.redact_sensitive_text(..., force=True) on the staged copy (same pass as hermes sessions export --redact) before writing the archive.

• Live profile on disk is never rewritten
• Symlinks to text files are materialized only when redaction changes content (so scrubbing cannot follow a link back into the source tree)
• force=True ignores security.redact_secrets / HERMES_REDACT_SECRETS — share archives stay scrubbed even when live redaction is off
• This is secret-pattern scrubbing, not general PII (names/emails/paths in prose still ship)

Test plan

• scripts/run_tests.sh tests/hermes_cli/test_profile_export_credentials.py -q
• Export a profile with a known sk-or-v1-… string in a skill/SOUL.md and confirm the archive does not contain it while the source file still does

[github-actions]

૮ >ﻌ< ა ci review

_{ran on 6c5cb2d — fix(profiles): scrub secret-shaped strings from export archi}

⚠️ Warnings

OSV vulnerability scan · View job

2 known vulnerabilities found in pinned dependencies.

• CVE-2026-70608 in package-lock.json
• CVE-2026-70606 in package-lock.json

How to fix:

Review the findings in the Security tab. Update the affected dependencies if a patched version is available.

---

debug info

CI timings

CI timings · View report · View job

Wall time 3m30s vs 7m12s (-51.4%). 11 job(s) slower, 13 faster, 1 unchanged.

• Python tests / Run tests slice 7/12: +81.0s
• Detect affected areas: +35.0s
• Python tests / Run tests slice 12/12: -32.0s
• Python tests / Run tests slice 10/12: +18.0s
• Python tests / Run tests slice 8/12: -17.0s