Saved prompts: transcript redaction + per-submission custom instructions

[agenticbuddy]

Closes #3013

Why

• Reduce clutter and improve privacy: saved prompts can be very large (hundreds of lines). By default, their bodies are redacted from the transcript, and only the user-typed command is shown (e.g., /name). Users can override via CLI/config.
• Enable flexibility: add per-submission custom instructions. A single saved prompt can be reused with different runtime directives without hard-coding variants.

Before

• Transcript always showed the full saved prompt body as the user message.
• No support for appending custom instructions to saved prompts.

What We Did (Overview)

• Transcript redaction: transcript renders exactly what the user typed (/<name> or /<name> <instruction>). The full saved prompt body is still sent to the agent.
• User control: CLI flags (--show-saved-prompt, alias --no-redact-saved-prompt) and config key redact_saved_prompt_body (default true).
• Custom instructions: /<name> <instruction> (multiline supported). Agent receives a structured Directive where priority is explicit (CustomInstruction > SavedPrompt). Both parts wrapped in CDATA for robustness.
• Queue vs execute UX: while a task is running, the queue shows only what the user typed; on execute, redaction policy applies — ON shows the typed command, OFF shows a human-readable layout (“Custom instruction:” → “Saved prompt:”).
• Docs: prompts.md and config.md updated.

After

• By default, the transcript shows only what the user typed; bodies stay private unless redaction is disabled.
• Saved prompts become significantly more flexible due to per-submission instructions.
• Queues stay concise; execution history can render expanded context when redaction is OFF.
• Existing saved prompts without arguments continue to work unchanged; default redaction is opt-out via CLI/config.
• Privacy note: transcript redaction does not alter what the agent receives; logs/traces avoid leaking template bodies.
• All tests green; workspace builds and lints clean.

Technical Details

• TUI: introduce SubmittedWithDisplay { text, display, pretty_unredacted }. History uses display (redaction ON) or pretty_unredacted (redaction OFF). Agent always uses text.
• Composer: extract multiline custom instruction; build Directive with explicit priority. Provide pretty_unredacted layout (“Custom instruction:” then “Saved prompt:”) when redaction OFF.
• ChatWidget: queue always shows display_text; history selects display_text vs pretty_unredacted based on config.
• Config/CLI: add redact_saved_prompt_body key; wire CLI flags --show-saved-prompt / --no-redact-saved-prompt.
• CLI tests: override logic inline; test-only helper verifies flags. Removed unused helper to satisfy clippy.
• Cross-crate: exec and mcp-server initializers updated with redact_saved_prompt_body: None; core tests updated.

Tests Added / Updated

• selecting_custom_prompt_submits_file_contents (updated)
• selecting_custom_prompt_with_instruction_wraps_and_displays_typed (added)
• custom_prompt_shows_command_in_history (added)
• custom_prompt_shows_body_when_redaction_disabled (added)
• custom_instruction_with_cdata_terminator_does_not_panic_and_is_included (added)
• CLI override tests (added):
  • flag_show_saved_prompt_sets_override_false
  • alias_no_redact_saved_prompt_sets_override_false
  • default_no_flag_sets_no_override

Docs

• prompts.md: sections “Transcript redaction of saved prompts” and “Custom instructions for saved prompts”.
• config.md: new key redact_saved_prompt_body.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[agenticbuddy]

I have read the CLA Document and I hereby sign the CLA

[agenticbuddy]

Some screens of the new functionality
With reduction:

No reduction, one command is waiting:

No reduction, both commands are executed: