@hailer/mcp 1.1.12 → 1.1.14

package/CHANGELOG.md

@@ -4,13 +4,6 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [1.1.10] - 25-02-2026
-
-### Added
-
-- **OpenCode MCP support:** Added `.opencode/opencode.json` with Hailer MCP server configuration
-- **Dynamic port patching for OpenCode:** On server startup, `.opencode/opencode.json` is now auto-updated with the actual port (alongside the existing `.mcp.json` patching), so both Claude Code and OpenCode always connect to the right server
-
 ## [1.1.7] - 18-02-2026
 
 ### Fix

package/{.claude → dist}/CLAUDE.md

@@ -280,7 +280,7 @@ SessionStart hook auto-loads SESSION-HANDOFF.md + DEVELOPMENT.md into context.
 ### Planning Workflow
 1. **Big picture → DEVELOPMENT.md** — Purpose, stack, roadmap linking to PRDs
 2. **Feature details → PRDs** (`docs/prd-*.md`) — One per feature, links back to roadmap
-3. **Implementation → Pick a PRD and build**
+3. **Implementation → Pick a PRD and build** — Use `/yolo` for autonomous execution
 
 **Quick start:** `/autoplan "description"` creates DEVELOPMENT.md + PRDs automatically.
 </session-protocol>
@@ -317,7 +317,7 @@ Learnings: `~/hailer-claude-config/inbox/`
 
 **Syntax:** `/command <param>` (angle brackets = required). `/help:topic` (colon = subtopic).
 
-**Essential:** `/save`, `/handoff`, `/prd`, `/autoplan`, `/ws-pull`, `/learn`
+**Essential:** `/save`, `/handoff`, `/prd`, `/autoplan`, `/yolo`, `/ws-pull`, `/learn`
 
 **Squads** (multi-agent workflows):
 

package/dist/app.js

@@ -8,9 +8,13 @@ const file_1 = require("./mcp/tools/file");
 const activity_1 = require("./mcp/tools/activity");
 const discussion_1 = require("./mcp/tools/discussion");
 const user_1 = require("./mcp/tools/user");
+const company_1 = require("./mcp/tools/company");
 const workflow_1 = require("./mcp/tools/workflow");
 const insight_1 = require("./mcp/tools/insight");
+const workflow_permissions_1 = require("./mcp/tools/workflow-permissions");
 const app_1 = require("./mcp/tools/app");
+// Vipunen plugin — Weaviate RAG knowledge base (conditional on WEAVIATE_HOST)
+const vipunen_1 = require("./plugins/vipunen");
 // Bot config and bug-fixer tools are dynamically imported only when MCP_CLIENT_ENABLED=true
 // This allows the npm package to work without these modules
 const core = new core_1.Core();
@@ -22,9 +26,6 @@ core.addTool(activity_1.listActivitiesTool);
 core.addTool(activity_1.showActivityByIdTool);
 core.addTool(activity_1.createActivityTool);
 core.addTool(activity_1.updateActivityTool);
-// core.addTool(searchActivitiesTool);
-// core.addTool(filterActivitiesTool);
-// core.addTool(activityToolsGuideTool);
 core.addTool(discussion_1.listMyDiscussionsTool);
 core.addTool(discussion_1.fetchDiscussionMessagesTool);
 core.addTool(discussion_1.fetchPreviousDiscussionMessagesTool);
@@ -35,8 +36,7 @@ core.addTool(discussion_1.inviteDiscussionMembersTool);
 core.addTool(discussion_1.getActivityFromDiscussionTool);
 core.addTool(user_1.searchWorkspaceUsersTool);
 core.addTool(user_1.getWorkspaceBalanceTool);
-// core.addTool(hailerGetInitTool);
-// core.addTool(validateUserIdTool);
+core.addTool(company_1.setUserRoleTool);
 core.addTool(workflow_1.getWorkflowSchemaTool);
 core.addTool(workflow_1.listWorkflowPhasesTool);
 core.addTool(workflow_1.listWorkflowsTool);
@@ -50,6 +50,10 @@ core.addTool(workflow_1.testFunctionFieldTool);
 core.addTool(workflow_1.listWorkflowsMinimalTool);
 core.addTool(workflow_1.countActivitiesTool);
 core.addTool(workflow_1.coreInitTool);
+core.addTool(workflow_permissions_1.listWorkflowPermissionsTool);
+core.addTool(workflow_permissions_1.grantWorkflowPermissionTool);
+core.addTool(workflow_permissions_1.revokeWorkflowPermissionTool);
+core.addTool(workflow_permissions_1.checkUserPermissionsTool);
 core.addTool(insight_1.createInsightTool);
 core.addTool(insight_1.previewInsightTool);
 core.addTool(insight_1.getInsightDataTool);
@@ -79,6 +83,15 @@ core.addTool(app_1.getProductManifestTool);
 // Marketplace app tools
 core.addTool(app_1.publishAppTool);
 core.addTool(app_1.installMarketplaceAppTool);
+// Vipunen tools (Weaviate RAG) — only registered when WEAVIATE_HOST is set
+const vipunenTools = (0, vipunen_1.registerVipunenTools)({
+    weaviateHost: config_1.environment.WEAVIATE_HOST,
+    weaviateApiKey: config_1.environment.WEAVIATE_API_KEY,
+    vipunenApiKeys: config_1.environment.VIPUNEN_API_KEYS,
+});
+for (const tool of vipunenTools) {
+    core.addTool(tool);
+}
 // Bot-internal tools - dynamically imported only when MCP_CLIENT_ENABLED=true
 // Wrapped in try/catch so global installs work (bot-config excluded from npm package)
 if (config_1.environment.MCP_CLIENT_ENABLED) {

package/dist/bot/bot-config.d.ts

@@ -4,6 +4,9 @@
  * Simple config reader for .bot-config/*.json files.
  * Extracts orchestrator credentials into a flat BotConfig interface.
  */
+import { ResponseMode } from './services/types';
+/** Who can talk to this bot */
+export type BotAccessLevel = 'all' | 'admin' | 'owner';
 export interface BotConfig {
     activityId: string;
     workspaceId: string;
@@ -14,10 +17,16 @@ export interface BotConfig {
     systemPrompt?: string;
     enabled: boolean;
     apiHost: string;
+    /** Who can talk to this bot: 'all' (default), 'admin', or 'owner' */
+    accessLevel?: BotAccessLevel;
+    /** Workflow IDs the bot is allowed to access. Empty/undefined = all workflows. */
+    allowedWorkflows?: string[];
+    /** When the bot responds: 'always' (default), 'mention_only', 'reply_only', 'mention_or_reply' */
+    responseMode?: ResponseMode;
 }
 /**
  * Load all bot configs from .bot-config/*.json files.
- * Extracts orchestrator credentials into flat BotConfig objects.
+ * Falls back to BOT_EMAIL/BOT_PASSWORD or BOT_ACCOUNTS env vars.
  */
 export declare function loadBotConfigs(): BotConfig[];
 /**

package/dist/bot/bot-config.js

@@ -52,15 +52,66 @@ function getApiHost() {
 function getConfigDir() {
     return path.join(process.cwd(), '.bot-config');
 }
+/**
+ * Load bot configs from env vars (BOT_EMAIL/BOT_PASSWORD or BOT_ACCOUNTS).
+ * Returns empty array if no env vars are set.
+ */
+function loadEnvBotConfigs() {
+    // Multi-bot: BOT_ACCOUNTS JSON array
+    const botAccountsStr = process.env.BOT_ACCOUNTS;
+    if (botAccountsStr) {
+        try {
+            const accounts = JSON.parse(botAccountsStr);
+            const configs = accounts
+                .filter(a => a.email && a.password)
+                .map(a => ({
+                activityId: '',
+                workspaceId: 'env',
+                workspaceName: 'env',
+                email: a.email,
+                password: a.password,
+                displayName: a.displayName || process.env.BOT_DISPLAY_NAME || 'Dev AI',
+                enabled: true,
+                apiHost: getApiHost(),
+            }));
+            if (configs.length > 0) {
+                logger.info('Loaded bot configs from BOT_ACCOUNTS env', { count: configs.length });
+                return configs;
+            }
+        }
+        catch (error) {
+            logger.warn('Failed to parse BOT_ACCOUNTS env var', {
+                error: error instanceof Error ? error.message : String(error),
+            });
+        }
+    }
+    // Single bot: BOT_EMAIL + BOT_PASSWORD
+    const email = process.env.BOT_EMAIL;
+    const password = process.env.BOT_PASSWORD;
+    if (email && password) {
+        logger.info('Loaded bot config from BOT_EMAIL/BOT_PASSWORD env');
+        return [{
+                activityId: '',
+                workspaceId: 'env',
+                workspaceName: 'env',
+                email,
+                password,
+                displayName: process.env.BOT_DISPLAY_NAME || 'Dev AI',
+                enabled: true,
+                apiHost: getApiHost(),
+            }];
+    }
+    return [];
+}
 /**
  * Load all bot configs from .bot-config/*.json files.
- * Extracts orchestrator credentials into flat BotConfig objects.
+ * Falls back to BOT_EMAIL/BOT_PASSWORD or BOT_ACCOUNTS env vars.
  */
 function loadBotConfigs() {
     const configDir = getConfigDir();
     if (!fs.existsSync(configDir)) {
-        logger.warn('No .bot-config directory found');
-        return [];
+        logger.debug('No .bot-config directory found, checking env vars');
+        return loadEnvBotConfigs();
     }
     const files = fs.readdirSync(configDir).filter(f => f.endsWith('.json'));
     const configs = [];
@@ -81,6 +132,9 @@ function loadBotConfigs() {
                     systemPrompt: orch.systemPrompt,
                     enabled: true,
                     apiHost: getApiHost(),
+                    accessLevel: orch.accessLevel,
+                    allowedWorkflows: orch.allowedWorkflows,
+                    responseMode: orch.responseMode,
                 });
             }
             // Load specialists
@@ -114,6 +168,11 @@ function loadBotConfigs() {
             });
         }
     }
+    // If no configs from files, fall back to env vars
+    if (configs.length === 0) {
+        logger.debug('No bot configs from files, checking env vars');
+        return loadEnvBotConfigs();
+    }
     logger.debug('Bot configs loaded', { total: configs.length });
     return configs;
 }
@@ -147,6 +206,8 @@ function saveBotConfig(config) {
             password: config.password,
             displayName: config.displayName,
             systemPrompt: config.systemPrompt,
+            accessLevel: config.accessLevel,
+            allowedWorkflows: config.allowedWorkflows,
         } : null,
         specialists: existing.specialists ?? [],
         lastSynced: new Date().toISOString(),

package/dist/bot/bot-manager.d.ts

@@ -14,6 +14,8 @@ interface BotUpdateEntry {
     enabled: boolean;
     displayName?: string;
     systemPrompt?: string;
+    accessLevel?: string;
+    responseMode?: string;
 }
 export declare class BotManager {
     private toolRegistry;

package/dist/bot/bot-manager.js

@@ -71,7 +71,10 @@ class BotManager {
             toolRegistry: this.toolRegistry,
             workspaceId: config.workspaceId,
             systemPrompt: config.systemPrompt,
+            responseMode: config.responseMode,
             botManager: this,
+            accessLevel: config.accessLevel,
+            allowedWorkflows: config.allowedWorkflows,
         });
         await bot.start();
         this.bots.set(botKey, bot);
@@ -148,9 +151,11 @@ class BotManager {
             const runningBot = this.bots.get(botKey);
             // If only the system prompt changed, update it live — no restart needed
             const credentialsChanged = runningBot.email !== bot.email || runningBot.password !== bot.password;
-            if (!credentialsChanged) {
-                logger.info('Updating system prompt live (no restart needed)', { activityId: botKey, workspaceId });
+            const accessLevelChanged = bot.accessLevel !== undefined && runningBot.accessLevel !== bot.accessLevel;
+            if (!credentialsChanged && !accessLevelChanged) {
+                logger.info('Updating bot config live (no restart needed)', { activityId: botKey, workspaceId });
                 runningBot.updateSystemPrompt(bot.systemPrompt);
+                runningBot.updateResponseMode(bot.responseMode);
                 return;
             }
             // Credentials changed — full restart required
@@ -167,6 +172,8 @@ class BotManager {
             systemPrompt: bot.systemPrompt,
             enabled: true,
             apiHost: this.apiHost,
+            accessLevel: bot.accessLevel,
+            responseMode: bot.responseMode,
         };
         try {
             await this.startBot(config);

package/dist/bot/bot.d.ts

@@ -6,6 +6,8 @@
  * and posts responses back to discussions.
  */
 import { ToolRegistry } from '../mcp/tool-registry';
+import { ResponseMode } from './services/types';
+import { BotAccessLevel } from './bot-config';
 export declare class Bot {
     private logger;
     private clientManager;
@@ -19,12 +21,16 @@ export declare class Bot {
     private userId;
     private _workspaceId;
     private _systemPrompt;
+    private _responseMode;
     private conversationManager;
     private messageClassifier;
     private messageFormatter;
     private typingIndicator;
     private tokenBilling;
     private sessionLogger;
+    private hailerApi;
+    /** Cache of insightId → Set<workflowId> for permission checks on ID-based insight tools */
+    private insightWorkflowCache;
     private opLogger;
     private discussionStates;
     private processingDiscussions;
@@ -45,6 +51,8 @@ export declare class Bot {
     private permissionIndex;
     private adminUserIds;
     private ownerUserIds;
+    private workspaceMemberIds;
+    private membersLoaded;
     private config;
     private botManager;
     constructor(config: {
@@ -56,21 +64,27 @@ export declare class Bot {
         toolRegistry: ToolRegistry;
         workspaceId?: string;
         systemPrompt?: string;
+        responseMode?: ResponseMode;
         botManager?: any;
+        accessLevel?: BotAccessLevel;
+        allowedWorkflows?: string[];
     });
     get email(): string;
     get password(): string;
+    get accessLevel(): string;
     /**
      * Hot-update the system prompt without restarting the bot.
      * Takes effect on the next message processed.
      */
     updateSystemPrompt(prompt: string | undefined): void;
+    updateResponseMode(mode: ResponseMode | undefined): void;
     get connected(): boolean;
     get workspaceId(): string | undefined;
     /** Exposed for BotManager cross-bot awareness */
     get botUserId(): string;
     start(): Promise<void>;
     stop(): Promise<void>;
+    private checkTriggerCondition;
     private handleSignal;
     private processDiscussion;
     /**
@@ -104,6 +118,11 @@ export declare class Bot {
      */
     private cleanupIncompleteExchange;
     private formatIncomingMessage;
+    /**
+     * Download image attachments and return Anthropic image content blocks.
+     * Falls back silently on errors — the text note still tells the LLM about the file.
+     */
+    private resolveImageAttachments;
     private formatOutgoingMessage;
     /**
      * Find bare 24-char hex IDs in text that aren't already inside hailerTags
@@ -112,6 +131,8 @@ export declare class Bot {
     private resolveBareIds;
     private getBotDisplayName;
     private buildSystemPrompt;
+    private static TOOL_STATUS_LABELS;
+    private getToolStatus;
     private getAnthropicTools;
     private sendMessage;
     /**
@@ -126,10 +147,22 @@ export declare class Bot {
      * Called when process.updated, workspace.updated, or cache.invalidate signals fire.
      */
     private refreshWorkspaceData;
+    /**
+     * Backfill workspaceCache.usersById with entries from network.members
+     * that are missing from init.users (which is only a partial user list).
+     */
+    private backfillWorkspaceCacheMembers;
     private buildPermissionIndex;
     private getOrCreateDiscussionState;
     private getUserContext;
     private getDefaultTeamId;
+    /** Get the current permission context for checkWorkflowAccess calls */
+    private getPermissionContext;
+    /**
+     * Post-filter list-type tool results to remove items the user can't access.
+     * Handles list_workflows, list_workflows_minimal, and list_insights.
+     */
+    private postFilterListResults;
     /**
      * Extract workflow ID from tool result for post-execution permission checks.
      * Returns the workflow ID if found, or undefined if extraction fails.