hilos-agent 0.10.0 → 0.11.1

package/README.md

@@ -50,6 +50,7 @@ Running from elsewhere, or want to map several repos explicitly? Use a config:
   "codingCmd": "claude -p --permission-mode acceptEdits",  // safe default; see Permissions / autonomy. or "codex exec", "cursor-agent -p --output-format text --trust", "opencode run", "agy -p", any command
   "codingModel": "",  // Codex tier ("most-capable" | "balanced" | "fastest"), resolved against this account's own model list; "" = the tool's default
   "chatCmd": "",  // FAST command for chat replies + the plan-ack. Empty = derived from codingCmd's tool (codex daemons chat with codex, etc.); set to override
+  "webSearch": true,  // native public-web tools are on by default; false stops Hilos enablement/instructions
   "defaultBranch": "main",
   "gate": false,               // default: open a PR directly. true = approve-before-push
   "heartbeatMs": 180000,       // long runs post one "still working…" thread reply this often (0 = off, min 15s)
@@ -71,10 +72,19 @@ a stderr tail) instead of claiming "no changes". Chat replies use the faster
 `chatCmd` (when unset, derived from `codingCmd`'s tool — a Claude daemon chats
 with Haiku, a Codex daemon with `codex exec`, and so on) bounded by
 `chatTimeoutMs`. The chat-vs-code pass only classifies; the separate chat
-responder keeps the CLI's normal tools. Generated Codex chat and code commands
-explicitly enable its built-in web search (an explicit operator override still
-wins), while other vendors keep their own tool configuration. The responsive
-surface needs a hilos server new enough to expose
+responder keeps the CLI's normal tools. Public web is on by default and stays
+native to the selected CLI: Hilos pre-approves Claude Code's read-only
+`WebSearch`/`WebFetch`, enables Codex search, turns on OpenCode's official Exa
+search switch, preserves Hermes's full web-capable coding toolset, and keeps
+Cursor and Antigravity's built-ins. Generated chat replies use Cursor `ask`
+with safe auto-review, OpenCode
+`plan`, Antigravity `plan`, Codex's read-only sandbox, or Hermes `safe,web`
+where available; coding runs keep their normal tool/approval policy. Run
+`hilos-agent web doctor` to inspect the configured contract. Set
+`"webSearch": false`, `HILOS_WEB_SEARCH=0`, or `--no-web-search` to stop Hilos
+from enabling or requesting web use; the CLI's own global/project tool policy
+still applies. Custom commands retain their own tools without guessed flags.
+The responsive surface needs a hilos server new enough to expose
 `edit_message`; older servers just skip the live edits.
 
 ```sh
@@ -148,7 +158,16 @@ can never approve or merge hilos work. See the complete contract in
   PR thread is executed, not described. The daemon relays the request to hilos
   with the id of the message that asked; hilos verifies the person's role and
   that their message really asks for it, then acts with the workspace's GitHub
-  App. The daemon never merges on its own judgment and holds no merge rights.
+  App. If GitHub reports a same-repository merge conflict, the daemon keeps the
+  same turn alive: it fetches the base branch, starts a real two-parent merge on
+  the existing PR branch, names the conflicted files to the coding agent,
+  verifies that no unmerged entries or conflict markers remain, and pushes the
+  repaired head for fresh human review. It never opens a replacement PR or
+  silently merges after repair. Fork PRs stop with an explicit writable-branch
+  boundary. The daemon never merges on its own judgment and holds no merge
+  rights. With `gate:true`, this existing-branch repair still pushes so the PR
+  can return for fresh review. It is the only approve-before-push exception;
+  the repaired head remains unmerged and needs a new approval.
 - **Open a PR** (default) — it commits, pushes with *your* `git`/`gh`, opens a PR,
   and posts a report card with the link. Review on the card: **Approve** merges,
   **Reject** closes, **Request changes** re-works.
@@ -386,6 +405,16 @@ hilos's GitHub App only for workspace owners/admins). Want a human checkpoint
 before anything is pushed? Set `"gate": true`. Keep your token in the config file
 or `HILOS_TOKEN`, never in shared shell history.
 
+### Durable activity, not raw output
+
+On a current hilos server, daemon-launched Claude Code, Codex, Cursor, and
+OpenCode repo runs automatically keep the same bounded activity facts used by
+the live card—phases, tool/file activity, notes, reported usage, and completion—
+in hilos's runtime-neutral event record. Writes are batched, retry-safe,
+bounded to two one-second attempts, re-authorized and redacted on the server,
+and never allowed to fail the coding run. Raw stdout is not sent by this path.
+An older server simply leaves it off.
+
 ### Run transcripts are opt-in
 
 The room gets what a teammate needs to see: a plan, live progress, a report, a
@@ -416,3 +445,13 @@ restart — and **deleting** the key counts as off, not as "leave it as it was".
 
 Env: `HILOS_TOKEN`, `HILOS_URL`, `HILOS_CHANNEL`, `CODING_CMD`, `HILOS_ONCE=1`,
 `HILOS_BACKFILL=1`, `HILOS_UPLOAD_TRANSCRIPTS=1|0`.
+
+## Releasing
+
+Bump `version` in `package.json`, merge, then tag that commit
+`hilos-agent-v<version>` and push the tag. The `npm-publish` workflow checks
+the tag against the tree, parses every source file on Node 20, 22, and 24,
+and publishes to npm (without provenance while the repository is private:
+npm refuses a provenance bundle from a private source repository, 1182).
+`workflow_dispatch` runs the same pipeline as a dry run. Needs the
+`NPM_TOKEN` repository secret (1094).

package/bin/hilos-agent.mjs

@@ -18,6 +18,7 @@
 // codingCmd in hilos-agent.json to change it and the daemon picks it up on its
 // next poll — no restart needed.
 
+import { spawnSync } from "node:child_process";
 import { readFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 
@@ -26,6 +27,8 @@ import { readPrivateJoin } from "../src/join-input.mjs";
 import { run } from "../src/run.mjs";
 import { hookMain, hooksMain } from "../src/hook.mjs";
 import { runWebMcpCommand } from "../src/webmcp-bridge.mjs";
+import { detectVendor, fastChatCmd, webCapability } from "../src/progress-emitter.mjs";
+import { commandArgv } from "../src/argv.mjs";
 
 function packageVersion() {
   const pkgPath = fileURLToPath(new URL("../package.json", import.meta.url));
@@ -46,6 +49,8 @@ function parseArgs(argv) {
     else if (a === "--coding-cmd") flags.codingCmd = argv[++i];
     else if (a === "--coding-model") flags.codingModel = argv[++i];
     else if (a === "--chat-cmd") flags.chatCmd = argv[++i];
+    else if (a === "--no-web-search") flags.webSearch = false;
+    else if (a === "--web-search") flags.webSearch = true;
     else if (a === "--once") flags.once = true;
     else if (a === "--backfill") flags.backfill = true;
     else if (a === "--no-gate") flags.gate = false;
@@ -75,6 +80,7 @@ const HELP = `hilos-agent — your coding agent as a teammate in hilos
   hilos-agent webmcp tools       list registered, person-allowlisted read tools
   hilos-agent webmcp call <name> '<json object>'
   hilos-agent webmcp close       close the isolated browser session
+  hilos-agent web doctor         report this CLI's native public-web capability
   hilos-agent                    run the daemon (watch @mentions, propose diffs)
   hilos-agent hooks install      stream this repo's Codex, Claude, and Cursor
                                  sessions to hilos and continue replies in the same
@@ -98,6 +104,7 @@ Options:
   --chat-cmd <cmd>   fast command for chat replies + the plan-ack (default:
                      derived from the coding command, so a Codex or Cursor
                      daemon chats with its own tool)
+  --no-web-search    stop hilos from enabling/requesting native public web
   --once             one poll then exit (cron-friendly)
   --backfill         also act on mentions that predate startup
   --no-gate          propose only; don't wait for approval / push
@@ -169,6 +176,46 @@ async function main() {
     return;
   }
 
+  if (cmd === "web") {
+    const operation = positional[1] || "doctor";
+    if (operation !== "doctor") {
+      throw new Error(`Unknown web command: ${operation}. Try \`hilos-agent web doctor\`.`);
+    }
+    const cliFlags = { ...flags };
+    delete cliFlags.help;
+    const cfg = resolveConfig({ flags: cliFlags });
+    const codingCommand = cfg.codingCmd;
+    const chatCommand = cfg.chatCmd || fastChatCmd(detectVendor(codingCommand)) || codingCommand;
+    const describe = (command) => {
+      const argv = commandArgv(command);
+      const vendor = detectVendor(command);
+      const capability = webCapability(vendor, {
+        enabled: cfg.webSearch !== false,
+        args: argv.slice(1),
+      });
+      const binary = argv[0] || "";
+      const probed = binary
+        ? spawnSync(binary, ["--version"], { encoding: "utf8", timeout: 5_000 })
+        : null;
+      const binaryAvailable = Boolean(binary) && !probed?.error;
+      const version = String(probed?.stdout || probed?.stderr || "").trim().split("\n")[0] || null;
+      return { vendor, binary, binaryAvailable, version, command, ...capability };
+    };
+    const chat = describe(chatCommand);
+    const code = codingCommand === chatCommand ? chat : describe(codingCommand);
+    console.log(JSON.stringify({
+      ok: [chat, code].every((lane) => lane.status === "enabled" && lane.binaryAvailable),
+      chat,
+      code,
+      note: !chat.binaryAvailable || !code.binaryAvailable
+        ? "One or more selected CLI binaries are not installed or not on PATH."
+        : chat.verified && code.verified
+          ? "Configured by hilos-agent; this does not spend a model call or test provider credentials."
+          : "Custom commands keep their own tool configuration; hilos-agent does not guess flags.",
+    }, null, 2));
+    return;
+  }
+
   // run (default) — when --join is passed without init, connect straight away.
   const cliFlags = { ...flags };
   delete cliFlags.join;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hilos-agent",
-  "version": "0.10.0",
+  "version": "0.11.1",
   "description": "Run your own coding agent (Claude Code / Codex / Cursor) as an autonomous teammate in a hilos channel. Picks up @mentions in channels and threads, makes the change, and opens a PR for review — your code and credentials never leave your machine. (Approve-before-push is available via gate:true.)",
   "type": "module",
   "bin": {
@@ -12,7 +12,7 @@
     "README.md"
   ],
   "engines": {
-    "node": ">=18"
+    "node": ">=20"
   },
   "homepage": "https://hilos.sh",
   "repository": {

package/src/cli.mjs

@@ -332,6 +332,13 @@ function runCliOnce(opts) {
 // inside runCli (not a wrapper) so every call site, present and future, gets it.
 const UNKNOWN_TRUST_RE = /unknown option '--trust'/;
 
+// Compat retry (0974): --auto-review is the current Cursor CLI's safe,
+// server-classified approval mode, which lets read-only Web calls run in the
+// conversational `ask` profile. Older Cursor CLIs do not know that flag. On
+// the exact commander error, retry without it so upgrading Hilos cannot make
+// an otherwise-working older local CLI fail before it sees the prompt.
+const UNKNOWN_CURSOR_AUTO_REVIEW_RE = /unknown option '--auto-review'/;
+
 // Compat retry (0777): the permission gate adds `--permission-prompt-tool` (and
 // the `--mcp-config` that serves it) to claude runs. The flag is real but
 // undocumented on 2.1.233, so a Claude Code old enough not to know it would
@@ -373,7 +380,28 @@ export async function runCli(opts) {
     args.includes("--trust") &&
     UNKNOWN_TRUST_RE.test(first.stderr || "")
   ) {
-    return runCliOnce({ ...opts, args: args.filter((a) => a !== "--trust") });
+    const withoutTrust = args.filter((a) => a !== "--trust");
+    const retried = await runCliOnce({ ...opts, args: withoutTrust });
+    if (
+      retried.status !== 0 &&
+      !retried.aborted &&
+      withoutTrust.includes("--auto-review") &&
+      UNKNOWN_CURSOR_AUTO_REVIEW_RE.test(retried.stderr || "")
+    ) {
+      return runCliOnce({
+        ...opts,
+        args: withoutTrust.filter((a) => a !== "--auto-review"),
+      });
+    }
+    return retried;
+  }
+  if (
+    first.status !== 0 &&
+    !first.aborted &&
+    args.includes("--auto-review") &&
+    UNKNOWN_CURSOR_AUTO_REVIEW_RE.test(first.stderr || "")
+  ) {
+    return runCliOnce({ ...opts, args: args.filter((a) => a !== "--auto-review") });
   }
   if (
     first.status !== 0 &&

package/src/codex-mcp-session.mjs

@@ -149,6 +149,7 @@ export function mapCodexDecision(reply, availableDecisions) {
  *   prompt?: string,
  *   env?: Record<string, string | undefined>,
  *   model?: string | null,
+ *   webSearch?: boolean,
  *   sandbox?: string,
  *   approvalPolicy?: string,
  *   resumeThreadId?: string | null,
@@ -173,6 +174,7 @@ export async function runCodexMcpSession({
   prompt = "",
   env,
   model = null,
+  webSearch = true,
   sandbox = "workspace-write",
   approvalPolicy = "untrusted",
   resumeThreadId = null,
@@ -464,7 +466,7 @@ export async function runCodexMcpSession({
             // The gated transport cannot inherit `codex exec` argv. Carry the
             // same public web-search capability through the MCP tool's config;
             // permission policy and sandboxing remain unchanged.
-            config: { tools: { web_search: true } },
+            ...(webSearch ? { config: { tools: { web_search: true } } } : {}),
             ...(model ? { model } : {}),
           },
         };

package/src/config.mjs

@@ -59,6 +59,10 @@ const DEFAULTS = {
   // { origins: { "https://example.com": { readTools: ["search_docs"] } },
   //   profile?: "/absolute/private/browser/profile" }
   webMcp: null,
+  // Public web is a baseline agent capability. Supported local CLIs use their
+  // own search/fetch tools; false stops Hilos from enabling or requesting it.
+  // The CLI's own global/project policy remains the ultimate authority.
+  webSearch: true,
   // acceptEdits lets the CLI make file edits without prompting (bias to action);
   // it still won't run arbitrary commands. Override in hilos-agent.json if you
   // want a stricter (or `--dangerously-skip-permissions`) command.
@@ -173,6 +177,12 @@ export function resolveConfig({ flags = {}, join: joinPayload } = {}) {
     codingCmd: process.env.CODING_CMD,
     codingModel: process.env.HILOS_CODING_MODEL,
     chatCmd: process.env.HILOS_CHAT_CMD,
+    webSearch:
+      /^(1|on|true)$/i.test(process.env.HILOS_WEB_SEARCH || "")
+        ? true
+        : /^(0|off|false)$/i.test(process.env.HILOS_WEB_SEARCH || "")
+          ? false
+          : undefined,
     heartbeatMs: process.env.HILOS_HEARTBEAT_MS ? Number(process.env.HILOS_HEARTBEAT_MS) : undefined,
     progressMs: process.env.HILOS_PROGRESS_MS ? Number(process.env.HILOS_PROGRESS_MS) : undefined,
     chatTimeoutMs: process.env.HILOS_CHAT_TIMEOUT_MS ? Number(process.env.HILOS_CHAT_TIMEOUT_MS) : undefined,
@@ -258,6 +268,7 @@ const LIVE_FIELDS = [
   "folders",
   "deploy",
   "webMcp",
+  "webSearch",
 ];
 
 /**
@@ -304,6 +315,10 @@ export function reloadConfig(prev) {
   // bridge on the next poll rather than preserving stale origins/tools until a
   // restart. An explicit null and a deleted edited key both mean disabled.
   if (changed("webMcp")) next.webMcp = file.webMcp ?? null;
+  // Native web is safe-on by default. Removing an edited `webSearch:false`
+  // returns to that default on the next poll instead of pinning a stale opt-out
+  // until restart; the environment override below still wins.
+  if (changed("webSearch")) next.webSearch = file.webSearch !== false;
   // The environment stays the operator's override on reload, in both
   // directions — a machine that opted out with =0 must not be opted back in by
   // a file edit (0792).
@@ -314,6 +329,8 @@ export function reloadConfig(prev) {
   if (process.env.CODING_CMD) next.codingCmd = process.env.CODING_CMD;
   if (process.env.HILOS_CODING_MODEL) next.codingModel = process.env.HILOS_CODING_MODEL;
   if (process.env.HILOS_CHAT_CMD) next.chatCmd = process.env.HILOS_CHAT_CMD;
+  if (/^(1|on|true)$/i.test(process.env.HILOS_WEB_SEARCH || "")) next.webSearch = true;
+  if (/^(0|off|false)$/i.test(process.env.HILOS_WEB_SEARCH || "")) next.webSearch = false;
   if (process.env.HILOS_HEARTBEAT_MS) next.heartbeatMs = Number(process.env.HILOS_HEARTBEAT_MS);
   if (process.env.HILOS_PROGRESS_MS) next.progressMs = Number(process.env.HILOS_PROGRESS_MS);
   if (process.env.HILOS_CHAT_TIMEOUT_MS) next.chatTimeoutMs = Number(process.env.HILOS_CHAT_TIMEOUT_MS);
@@ -338,6 +355,7 @@ export function writeStarterConfig(path, partial = {}) {
     repos: partial.repos || { "owner/name": "/absolute/path/to/checkout" },
     codingCmd: partial.codingCmd || DEFAULTS.codingCmd,
     ...(partial.codingModel ? { codingModel: partial.codingModel } : {}),
+    webSearch: partial.webSearch !== false,
     defaultBranch: DEFAULTS.defaultBranch,
     // false = open a PR directly (bias to action); true = approve-before-push.
     gate: false,

package/src/conflicts.mjs

@@ -0,0 +1,156 @@
+// 0991 — deterministic Git ownership for local merge-conflict recovery.
+// The coding model edits files; this wrapper creates and validates the merge.
+
+const MAX_NAMED_FILES = 40;
+
+const lines = (value) =>
+  String(value || "")
+    .split("\n")
+    .map((line) => line.trim())
+    .filter(Boolean);
+
+export function validConflictRecovery(value, repoFullName) {
+  if (!value || typeof value !== "object" || value.repairable !== true) return null;
+  const required = ["repoFullName", "prUrl", "branch", "baseBranch", "headSha"];
+  if (required.some((key) => typeof value[key] !== "string" || !value[key].trim())) return null;
+  if (!Number.isInteger(value.prNumber) || value.prNumber <= 0) return null;
+  if (
+    repoFullName &&
+    value.repoFullName.toLowerCase() !== String(repoFullName).toLowerCase()
+  ) {
+    return null;
+  }
+  return {
+    repoFullName: value.repoFullName,
+    prNumber: value.prNumber,
+    prUrl: value.prUrl,
+    branch: value.branch,
+    baseBranch: value.baseBranch,
+    headSha: value.headSha,
+  };
+}
+
+export function conflictRepairBrief(conflict) {
+  return (
+    `Resolve the merge conflicts on existing pull request #${conflict.prNumber} ` +
+    `(${conflict.prUrl}). Preserve the intended work from both \`${conflict.branch}\` and ` +
+    `\`${conflict.baseBranch}\`, run the repository's required verification, and update only ` +
+    `that existing pull request. Do not merge it; return the changed head for fresh human review.`
+  );
+}
+
+export function conflictPromptBlock({ baseBranch, files }) {
+  if (!files.length) {
+    return (
+      `hilos has already merged \`${baseBranch}\` into this pull request branch and Git resolved every file cleanly. ` +
+      "The checkout is still mid-merge so hilos can make the two-parent merge commit after you finish. " +
+      "Run the repository's required verification and make no edits unless verification exposes a real integration problem. Do not run git."
+    );
+  }
+  const named = files.slice(0, MAX_NAMED_FILES);
+  const rest = files.length - named.length;
+  return [
+    `hilos has already started a real merge of \`${baseBranch}\` into this pull request branch. Resolve EVERY conflict by editing the files into the correct combined result. Keep BOTH sides' work unless they are genuinely exclusive; never discard the base branch merely to remove a marker. Regenerate generated files from their sources when the repository provides a generator. Do not run git — hilos owns the merge commit and refuses to push unresolved entries or marker lines.`,
+    ...(named.length ? ["Conflicted files:", ...named.map((file) => `- ${file}`)] : []),
+    ...(rest > 0 ? [`…and ${rest} more.`] : []),
+  ].join("\n");
+}
+
+/** Fetch + start the two-parent merge before the coding model runs. */
+export function startConflictMerge({ git, cwd, conflict }) {
+  const fetched = git(cwd, [
+    "fetch",
+    "origin",
+    `+refs/heads/${conflict.baseBranch}:refs/remotes/origin/${conflict.baseBranch}`,
+  ]);
+  if (fetched.status !== 0) {
+    return {
+      ok: false,
+      reason: `couldn't fetch ${conflict.baseBranch}: ${String(fetched.stderr || "").trim().slice(0, 200)}`,
+    };
+  }
+
+  const merged = git(cwd, [
+    "merge",
+    "--no-commit",
+    "--no-ff",
+    `origin/${conflict.baseBranch}`,
+  ]);
+  const files = lines(git(cwd, ["diff", "--name-only", "--diff-filter=U"]).stdout);
+  if (merged.status !== 0 && files.length === 0) {
+    git(cwd, ["merge", "--abort"]);
+    return {
+      ok: false,
+      reason: `couldn't start the merge: ${String(merged.stderr || "").trim().slice(0, 200)}`,
+    };
+  }
+
+  const mergeHead = git(cwd, ["rev-parse", "-q", "--verify", "MERGE_HEAD"]);
+  if (merged.status === 0 && mergeHead.status !== 0) {
+    return { ok: true, state: "up-to-date", files: [] };
+  }
+  if (mergeHead.status !== 0) {
+    git(cwd, ["merge", "--abort"]);
+    return { ok: false, reason: "Git did not leave a merge to complete." };
+  }
+  return { ok: true, state: files.length ? "conflicts" : "clean", files };
+}
+
+/** Check BEFORE git add: staging clears unmerged index entries. Marker scanning
+ * catches a model that ran git add itself despite the prompt.
+ * @param {{ git: (cwd: string, args: string[]) => { stdout?: string }, cwd: string, knownFiles?: string[] }} args
+ */
+export function remainingConflictFiles({ git, cwd, knownFiles = [] }) {
+  const unmerged = lines(git(cwd, ["diff", "--name-only", "--diff-filter=U"]).stdout);
+  const known = new Set(knownFiles);
+  // The original paths remain unmerged in Git's index until the wrapper stages
+  // the model's edited result. That state alone is expected here; only a NEW
+  // unmerged path (the model started another merge) is structurally unsafe.
+  const unexpectedUnmerged = unmerged.filter((file) => !known.has(file));
+  // With no original conflicts there is nothing useful to scan. Running
+  // `git grep` without pathspecs would inspect the entire repository and could
+  // mistake a deliberate marker example in documentation for this merge's
+  // unresolved work.
+  const markers = knownFiles.length
+    ? lines(
+        git(cwd, [
+          "grep",
+          "-l",
+          "-e",
+          "^<<<<<<< ",
+          "-e",
+          "^>>>>>>> ",
+          "--",
+          ...knownFiles,
+        ]).stdout,
+      )
+    : [];
+  return [...new Set([...unexpectedUnmerged, ...markers])].sort();
+}
+
+/** A coding CLI may run git despite the prompt. Accept its self-commit only
+ * when Git proves it completed the prepared merge; reject an aborted/reset
+ * merge before anything can be pushed.
+ * @param {{ git: (cwd: string, args: string[]) => { status: number, stdout?: string }, cwd: string, baseBranch: string }} args
+ */
+export function validateConflictMergeState({ git, cwd, baseBranch }) {
+  if (git(cwd, ["rev-parse", "-q", "--verify", "MERGE_HEAD"]).status === 0) {
+    return { ok: true, committedByAgent: false };
+  }
+  const baseIsAncestor =
+    git(cwd, ["merge-base", "--is-ancestor", `origin/${baseBranch}`, "HEAD"]).status === 0;
+  const parents = lines(git(cwd, ["rev-list", "--parents", "-n", "1", "HEAD"]).stdout)[0]
+    ?.split(/\s+/)
+    .filter(Boolean) ?? [];
+  if (baseIsAncestor && parents.length >= 3) {
+    return { ok: true, committedByAgent: true };
+  }
+  return {
+    ok: false,
+    reason: `the prepared merge of ${baseBranch} was aborted or replaced before verification`,
+  };
+}
+
+export function conflictCommitTitle(baseBranch) {
+  return `Merge ${baseBranch}: resolve conflicts`;
+}