No secret redaction on the Hermes capture path; tau/privacy.py reads as general but is Tau-only #1650

Summary

integrations/tau/privacy.py implements credential masking for automatically captured memory, and its docstring states that hidden reasoning and tool payloads are excluded structurally before the filter. integrations/hermes has no equivalent: the capture path writes user and assistant text into the note verbatim. Nothing enforces redaction.

This is partly a docs problem — the Tau filter reads like a property of automatic capture in general, and it is easy to assume it applies to the other integrations. I made exactly that assumption and wrote it into internal documentation before checking, which is why I am filing it.

What the Hermes path does

Traced by the Hermes agent in its installed copy (credit to it):

• The capture path formats _truncate(user, 4000) and _truncate(asst, 4000) directly into the note.
• A search of integrations/hermes found no redaction or masking implementation comparable to privacy.py.
• The only protection is guidance in the bundled skill: "Don't capture credentials or personal data without confirmation." That is advice to a model, not an enforced filter.

What we actually observed

Scanning the notes it had already captured, for sk-, ghp_, hf_, Bearer tokens, JWTs, PEM private keys and PASSWORD=/API_KEY=/TOKEN=/SECRET= assignments: zero hits. Also zero hits for tool-output markers (tool_result, stdout, exit_code, functions.).

That is reassuring, and the structural reason is sound: sync_turn receives user and assistant text rather than the full internal message/tool transcript, so raw tool payloads are not in scope.

But it is an observation about one corpus, not a guarantee. If an assistant quotes tool output, or a user pastes a key into a message, that text is written to the note as-is. On this machine assistant turns routinely contain operational detail, which is why we chose not to point capture at a shared, git-committed project.

Request

Either of these would resolve it; the first is cheap:

1. Document the boundary. State plainly that privacy.py is Tau-only and that other integrations' capture paths are unfiltered, so operators do not generalise it. A line in integrations/shared/README.md and in each integration's README would do.
2. Share the filter. public_text() is self-contained and host-agnostic — moving it to integrations/shared/ and applying it on the Hermes capture path before write_note would make the guarantee real rather than advisory.

Worth noting for prioritisation: the risk is highest exactly where the plugin is most useful. Capture into a private, non-git project is low-consequence; capture into a shared team project is where an unfiltered credential becomes a shared secret. A promoteFolder/bm-share flow makes that the easy path, so the filter matters most on the paths you would most want people to use.