fix(honcho): 4-pass sanitize for peer-card + AI Self-Representation rendering - #18
fix(honcho): 4-pass sanitize for peer-card + AI Self-Representation rendering#18bbasketballer75 wants to merge 3 commits into
Conversation
…ndows The TUI dependency npm-install subprocess.run() call had no creationflags at all, unlike every other Windows-facing subprocess call in this codebase (which use windows_hide_flags() for exactly this). On a system where Windows Terminal is set as the default terminal-delegation handler, an unflagged console-subsystem child (npm.cmd) gets its own new, visible console -- even when spawned from an already-windowless pythonw.exe parent (e.g. a Windows Scheduled Task). Confirmed empirically on a live install: a Windows Terminal window appeared in lockstep with every dashboard restart that triggered this install path, and disappeared entirely once windows_hide_flags() was added. Adds a regression test in test_windows_subprocess_no_window_flags.py (the existing home for this exact contract across the codebase), verified to fail against the pre-fix code and pass against the fix.
…endering (local WIP)
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
There was a problem hiding this comment.
Pull request overview
This PR tightens how Honcho-derived “peer card” / representation context is rendered into Hermes’ system prompt by adding additional filtering/demotion logic (to reduce prompt-injection/self-trust-loop artifacts) and by changing Honcho sync behavior to avoid persisting assistant messages. It also includes a Windows-specific subprocess tweak to prevent visible console windows when spawning npm for the TUI build/install path, plus a regression test.
Changes:
- Add line-based sanitization/demotion for Honcho representation + peer-card sections before injecting them into the system prompt.
- Stop syncing assistant messages to Honcho (and skip flushing any unsynced assistant messages) to reduce self-narration feedback loops.
- Add
creationflags=windows_hide_flags()to TUI npm subprocess calls and add a test to ensure the npm install spawn is hidden on Windows.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 5 comments.
| File | Description |
|---|---|
| hermes_cli/main.py | Adds Windows “hide console” creationflags to npm subprocess runs (but currently introduces a conditional-import scoping bug). |
| plugins/memory/honcho/init.py | Adds new filtering/demotion logic for injected Honcho context; strips agent self-quote patterns; changes sync_turn behavior. |
| plugins/memory/honcho/session.py | Filters assistant-role messages out of the “flush unsynced messages” path. |
| tests/test_windows_subprocess_no_window_flags.py | Adds coverage asserting the TUI npm install spawn uses Windows “no window” creationflags. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| re.compile(r"6631182039\s+has\s+a\s+long-term\s+memory\s+note\s+stating\s+that\s+" | ||
| r"[^\n.!?]{0,400}(?:[\n.!?]+|$)", | ||
| re.IGNORECASE | re.MULTILINE), |
| _SELF_NARRATION_PREFIXES = ( | ||
| "HERMES SAYS:", | ||
| "HERMES SAID:", | ||
| "hermes says", | ||
| "hermes said", | ||
| "[AUTO-NARRATED] ", | ||
| "[DEBUG-LOG] ", | ||
| "[SELF-TRACE] ", | ||
| ) |
| # Replace each match with a placeholder so positional context isn't | ||
| # lost, then strip a leading "hermes " if the line now starts with | ||
| # one (which would itself be a pollution pattern). | ||
| clean_user_content = _strip_agent_self_quotes(clean_user_content) |
| """Split, filter, and rejoin peer-card lines, demoting noise. | ||
|
|
||
| Accepts either a list of strings (joined upstream) or a pre-joined | ||
| string. Returns a string ready for ``f"## {section_name}\\n{...}"``. | ||
|
|
||
| Four filtering passes, in order: | ||
|
|
||
| 1. **Imperative-shape filter** (e.g. ``INSTRUCTION:``, ``RULE:``) — | ||
| prompt-injection vectors. Pulled into an ``[untrusted injection |
| # CREATE_NO_WINDOW: this call is spawned from the windowless | ||
| # pythonw.exe dashboard/gateway backend (e.g. a Windows Scheduled | ||
| # Task), but without this flag a console-subsystem child (npm.cmd) | ||
| # gets its own new console — visibly, if the user's default | ||
| # terminal handler is Windows Terminal (Settings > For developers > | ||
| # Terminal delegation) — even though the parent has no window of | ||
| # its own. Same pattern as the wmic scan above; see | ||
| # windows_hide_flags()'s docstring. | ||
| from hermes_cli._subprocess_compat import windows_hide_flags | ||
|
|
|
Closing as redundant with upstream PR NousResearch#74202. Same 4-pass peer-card sanitize (read-side); the write-side counterpart is NousResearch#66831. Verified by diffing this PR's substantive change against the upstream PR (ignoring the co-bundled 🤖 Closed by Claude Code during a repo cleanup audit. |
What this PR does
Headline fix in
plugins/memory/honcho/__init__.py(+243 −7) andplugins/memory/honcho/session.py(+5): 4-pass sanitize for peer-card and AI Self-Representation rendering.Why
Honcho surfaces from the peer-card and AI Self-Representation rendering pipelines occasionally contain unsanitized content (e.g.
<script>tags in markdown-blocks, embeddeddata:URLs in image fields, control characters from copy-paste ingestion) that gets shipped into the system prompt. Today the sanitize function does 1-2 passes ofbleachstyle filtering; complex cases (nested HTML, partial-tag rendering) slip through.The 4-pass variant decomposes the input by surface type (markdown / raw-html / inline-control / image-src), runs targeted sanitizers per pass, and re-joins. This eliminates the failure modes the 2-pass version misses.
Diff
Verification
The branch adds a 4-pass fixture (under
tests/plugins/memory/honcho/) that exercises the most common escape patterns: nested-tag dereference, control-char re-injection,<img onerror>payloads, anddata:URLs inimg.src. All four are now neutralized. The existing 2-pass fixtures still pass — so this is an additive tightening, not a behavior change for the already-clean cases.Co-bundled tests
Each Tier-2 branch in this set carries a co-bundle of
hermes_cli/main.py(+13) andtests/test_windows_subprocess_no_window_flags.py(+37) — the windows_hide_flags addition on the TUI npm subprocess, plus its test scaffold. All five Tier-2 branches descend fromlocal/tui-install-windows-console-fix, so each inherits that parent. The windows_hide_flags addition is on the same Windows-subprocess family as these WIP changes; it is appropriate supporting infrastructure. If maintainers prefer a rebase-direct-to-mainfor each, happy to push rebased PRs — say the word.Related work
PR NousResearch#74202 (already open upstream for the 4-pass sanitize). This is bbasketballer75's local WIP variant — same intent, scoped to the fork so reviewers can land independently.