[erpzz]

What does this PR do?

The local runtime prompt names the operating system and home directory but omits effective identity and the actual terminal shell. This leaves the agent to infer privileges from names and to assume the user's login shell or Linux interfaces on macOS.

Extend the existing startup environment block with the local bash backend, a cheap POSIX effective-UID snapshot, and a short macOS/BSD compatibility note. Explicitly distinguish process identity from sudo availability, authorization and remote privileges. Remote backends continue to receive only their own environment block.

Related Issue

Searched existing effective-UID/environment reports; the matching results concern updater ownership and container UID mapping rather than the local agent prompt.

Type of Change

• Bug fix / missing execution-context capability
• Tests

Changes Made

• hermes_platform/host/identity.py: read-only identity snapshot, no subprocesses, environment-variable input or sudo probes.
• agent/prompt_builder.py: use the existing environment block; avoid changing any past context or per-call tool surface.
• tests/agent/test_environment_execution_identity.py: native-host identity/macOS checks and remote-host separation.

How to Test

scripts/run_tests.sh -j 1 tests/agent/test_environment_execution_identity.py tests/agent/test_prompt_builder.py
python scripts/check

Before patching: two new native-macOS tests failed; the remote-isolation case passed. After patching: 60 tests passed, one platform-specific test skipped on macOS. All 14 lint/code-health checks pass on the independent branch.

Limitations

The identity is a new-session snapshot; it is not refreshed by mutating a cached conversation prefix. Windows elevation is deliberately not inferred from POSIX UID rules. No claim is made that this prompt addition has yet improved a held-out model benchmark.

Checklist

• Read CONTRIBUTING.md and applicable AGENTS.md.
• Conventional commit; focused source change with regression tests.
• Searched existing issues/PRs; related work is disclosed above.
• python scripts/check: all 14 checks pass on this branch.
• Tested on macOS ARM64; host-specific tests use the project's platform markers.
• Full repository test suite (not run; focused suites below were run with the canonical runner).
• No configuration keys, dependencies, approval changes or runtime installations.
• Documentation/config/schema updates: N/A beyond relevant docstrings and prompt text.

Only synthetic reproductions are included. No private session, credentials, host inventory or security scan output is published.