feat: add PATH export to profile and enable secret redaction by default

Dockerfile

@@ -64,6 +64,12 @@ p.write_text(src.replace(old, new), encoding="utf-8")
 print("kanban patch: applied")
 PY
 
+# Ensure hermes CLI is discoverable in ALL shell types (login, interactive,
+# non-interactive). /etc/profile.d/ is sourced by login shells after /etc/profile
+# resets PATH, so this survives even full environment resets.
+RUN echo 'export PATH="/opt/hermes/.venv/bin:/opt/data/.local/bin:$PATH"' \
+    > /etc/profile.d/hermes-venv.sh
+
 ENV HERMES_HOME=/opt/data \
     HUGGINGMES_APP_DIR=/opt/huggingmes \
     HERMES_AGENT_VERSION=${HERMES_AGENT_VERSION} \

start.sh

@@ -263,6 +263,7 @@ if custom_base and model_name:
 config.setdefault("terminal", {}).setdefault("cwd", os.environ.get("MESSAGING_CWD", str(home / "workspace")))
 config.setdefault("compression", {}).setdefault("enabled", True)
 config.setdefault("display", {}).setdefault("background_process_notifications", os.environ.get("HERMES_BACKGROUND_NOTIFICATIONS", "result"))
+config.setdefault("security", {}).setdefault("redact_secrets", True)
 
 platforms = config.setdefault("platforms", {})