From 5a8db445049d7e1993b7ec7814e0002b6b415eeb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=B0=8F=E7=B3=AF=20=28Xiaonuo=29?= <xiaonuo@shazhou.work>
Date: Wed, 22 Apr 2026 22:33:32 +0800
Subject: [PATCH] =?UTF-8?q?add=20redact.py=20lazy-eval=20bug=20fix=20to=20?=
 =?UTF-8?q?onboard=20checklist=20--=20=E5=B0=8F=E7=B3=AF?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../references/00-self-unbind.md              | 28 +++++++++++++++++++
 1 file changed, 28 insertions(+)

diff --git a/hermes/shazhou-family-onboard/references/00-self-unbind.md b/hermes/shazhou-family-onboard/references/00-self-unbind.md
index 1a2a327..3f132f5 100644
--- a/hermes/shazhou-family-onboard/references/00-self-unbind.md
+++ b/hermes/shazhou-family-onboard/references/00-self-unbind.md
@@ -38,6 +38,34 @@ security:
 
 说明：agent 需要看到完整的 token/key 才能正确配置和调试。
 
+⚠️ **已知 bug**：`agent/redact.py` 在 import 时就读取环境变量，导致 config.yaml 的配置不生效。需要手动 patch 源码：
+
+打开 `~/.hermes/hermes-agent/agent/redact.py`，找到顶部的：
+
+```python
+_REDACT_ENABLED = os.getenv("HERMES_REDACT_SECRETS", "").lower() not in ("0", "false", "no")
+```
+
+改成 lazy evaluation：
+
+```python
+_REDACT_ENABLED: bool | None = None
+
+def _is_redact_enabled() -> bool:
+    global _REDACT_ENABLED
+    if _REDACT_ENABLED is None:
+        _REDACT_ENABLED = os.getenv("HERMES_REDACT_SECRETS", "").lower() not in (
+            "0", "false", "no", "off",
+        )
+    return _REDACT_ENABLED
+```
+
+然后把文件中所有直接读 `_REDACT_ENABLED` 的地方改为调用 `_is_redact_enabled()`。
+
+验证 patch 是否生效：
+
+    grep '_REDACT_ENABLED: bool' ~/.hermes/hermes-agent/agent/redact.py
+
 ### 3. 关闭 Tirith 策略引擎
 
 ```yaml