fix: stop attributing machine plumbing to the user peer

[ajspig]

Summary by CodeRabbit

• New Features

  • Added configuration to control whether Git change events are saved, including environment-variable support.
  • Improved detection of automated prompts and brief replies to better tailor saved conversation data.

• Bug Fixes

  • Prevented automated harness messages from being uploaded.
  • Disabled reasoning metadata for terse replies when appropriate.
  • Simplified session-end handling and removed unnecessary remote session-end activity.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

Walkthrough

Honcho adds configurable Git event persistence, filters harness-injected and terse prompts during uploads, and replaces remote session-end marker handling with local logging, cleanup, and immediate exit.

Changes

Honcho filtering and lifecycle handling

Layer / File(s)	Summary
Git event configuration and upload gating plugins/honcho/src/config.ts, plugins/honcho/src/hooks/session-start.ts	Adds saveGitEvents to configuration sources and environment overrides, then requires it to enable Git observation uploads.
Harness prompt detection and upload handling plugins/honcho/src/hooks/user-prompt.ts, plugins/honcho/src/hooks/save-user-message.ts	Adds prompt classifiers, skips harness-injected messages, and disables reasoning for terse uploaded replies.
Session-end local completion plugins/honcho/src/hooks/session-end.ts	Removes remote session-end API work and completes by logging, clearing session files, and exiting.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant UserPromptHook
  participant SaveUserMessageHook
  participant HonchoAPI
  UserPromptHook->>SaveUserMessageHook: Provide prompt
  SaveUserMessageHook->>SaveUserMessageHook: Detect harness or terse content
  SaveUserMessageHook->>HonchoAPI: Skip upload or post with reasoning disabled

Loading

Possibly related PRs

• plastic-labs/claude-honcho#21: Changes the same session-end upload and marker workflow.
• plastic-labs/claude-honcho#42: Changes which messages are uploaded during session end.
• plastic-labs/claude-honcho#71: Modifies session-end message configuration and upload behavior.

Suggested reviewers: akattelu

Poem

I’m a rabbit guarding each event,
Git hops only when the switch is meant.
Harness echoes fade from sight,
Terse replies lose reasoning weight,
Sessions clear their burrow—goodnight!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title matches the core change: preventing machine-plumbing or harness-injected content from being attributed to the user peer.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch abigail/dev-2086

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@CHANGELOG.md`:
- Around line 13-15: Update the changelog entry for harness-injected turns and
terse acknowledgements to clarify that terse acknowledgements remain uploaded
for conversational continuity but no longer generate content-free conclusions;
avoid implying they are excluded from user memory or persistence.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 0d0e8a49-c232-4633-b2f8-76cc3f7bc95e

📥 Commits

Reviewing files that changed from the base of the PR and between dfab286 and 4706bd9.

📒 Files selected for processing (4)

• CHANGELOG.md
• plugins/honcho/.claude-plugin/plugin.json
• plugins/honcho/package.json
• plugins/honcho/src/hooks/user-prompt.ts

🚧 Files skipped from review as they are similar to previous changes (1)

• plugins/honcho/src/hooks/user-prompt.ts

[akattelu]

lgtm.

since hooks accept input from stdin, it should be possible to write some tests (not bundled with the plugin) that verify behavior like this, but not blocking as requirement of this PR.

[akattelu]

i think you need to address merge conflicts but lgtm otherwise!

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

plugins/honcho/src/hooks/user-prompt.ts (1)

312-312: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Do not write prompt-derived queries to activity logs.

logApiCall embeds details in its activity message, so these calls retain the first 60 characters of user input (or a template containing it). Prompts can contain credentials or PII; log query source/length instead.

• plugins/honcho/src/hooks/user-prompt.ts#L312-L312: replace the dialectic query preview with non-sensitive metadata.
• plugins/honcho/src/hooks/user-prompt.ts#L360-L360: replace the context search-query preview with non-sensitive metadata.

Proposed fix

-    logApiCall("peer.chat (dialectic)", "POST", `${reasoning}: ${query.slice(0, 60)}`, elapsedMs, true);
+    logApiCall("peer.chat (dialectic)", "POST", `${reasoning}; query length: ${query.length}`, elapsedMs, true);
...
-    logApiCall(contextLabel, "GET", `search: ${searchQuery.slice(0, 60)}`, Date.now() - startTime, true);
+    logApiCall(contextLabel, "GET", `search; query length: ${searchQuery.length}`, Date.now() - startTime, true);

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@plugins/honcho/src/hooks/user-prompt.ts` at line 312, Update both logApiCall
sites in user-prompt.ts at lines 312 and 360 to remove prompt-derived query
previews from activity details. Replace the dialectic and context search details
with non-sensitive metadata such as query source and length, without including
any query content or templates containing it.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@plugins/honcho/src/hooks/user-prompt.ts`:
- Line 312: Update both logApiCall sites in user-prompt.ts at lines 312 and 360
to remove prompt-derived query previews from activity details. Replace the
dialectic and context search details with non-sensitive metadata such as query
source and length, without including any query content or templates containing
it.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: cc90c29f-6d84-4960-8d07-66317d98d5be

📥 Commits

Reviewing files that changed from the base of the PR and between 4966ae1 and 54a7b95.

📒 Files selected for processing (5)

• plugins/honcho/src/config.ts
• plugins/honcho/src/hooks/save-user-message.ts
• plugins/honcho/src/hooks/session-end.ts
• plugins/honcho/src/hooks/session-start.ts
• plugins/honcho/src/hooks/user-prompt.ts

🚧 Files skipped from review as they are similar to previous changes (3)

• plugins/honcho/src/hooks/session-start.ts
• plugins/honcho/src/hooks/session-end.ts
• plugins/honcho/src/config.ts