hilos-agent 0.11.10 → 0.11.12

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hilos-agent",
-  "version": "0.11.10",
+  "version": "0.11.12",
   "description": "Run your own coding agent (Claude Code, Codex, Cursor, OpenCode, Hermes, or any command) as a teammate in a hilos room. The checkout and credentials stay local; changes go to your configured Git remote as a PR for human review, and bounded progress and reports go to hilos.",
   "type": "module",
   "bin": {

package/src/hook.mjs

@@ -26,6 +26,7 @@ import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 import { sanitizeText, webTarget } from "./agent-events.mjs";
 import { resolveConfig } from "./config.mjs";
+import { normalizeSeatRepository } from "./seat-repository.mjs";
 
 export const HOOK_STATE_DIR = join(homedir(), ".hilos", "hook-state");
 export const CODEX_HOOK_SCOPE_FILE = join(homedir(), ".hilos", "codex-hook-scope.json");
@@ -376,13 +377,15 @@ const PERSONAL_CLIENTS = {
 };
 
 /**
- * Resolve the personal-seat config from the environment. `HILOS_MCP_TOKEN` is
- * the same `hpt_` token the plugin's MCP server entry uses, so installing the
- * plugin is the only gesture; `--personal` forces the lane on for a hook
- * installed by `hooks install --claude --personal`. PURE.
+ * Resolve the personal-seat config from the environment. Claude Code exports
+ * its saved plugin option to hooks; manual hooks and other clients still use
+ * HILOS_MCP_TOKEN. A nonempty saved option wins, including an invalid/revoked
+ * one: never silently attach as the fallback identity. PURE.
  */
 export function personalHookConfig(env = {}, { vendor = "unknown" } = {}) {
-  const token = typeof env.HILOS_MCP_TOKEN === "string" ? env.HILOS_MCP_TOKEN.trim() : "";
+  const option = typeof env.CLAUDE_PLUGIN_OPTION_HILOS_MCP_TOKEN === "string"
+    ? env.CLAUDE_PLUGIN_OPTION_HILOS_MCP_TOKEN.trim() : "";
+  const token = option || (typeof env.HILOS_MCP_TOKEN === "string" ? env.HILOS_MCP_TOKEN.trim() : "");
   if (!token || !token.startsWith("hpt_")) return null;
   const client = PERSONAL_CLIENTS[vendor];
   if (!client) return null;
@@ -402,24 +405,25 @@ export function seatLabel(value) {
 }
 
 /**
- * The label for this session's seat: the repo from `git remote`, else the
- * folder name. `git` is asked once per session (SessionStart) with a short
- * timeout, and a failure just falls back — a hook never blocks the CLI.
+ * The canonical origin for this session. Git is asked once at attach with a
+ * short timeout. A missing or unsupported origin leaves the seat unbound.
  */
-export function readSeatLabel(cwd, { spawn = spawnSync } = {}) {
-  const folder = seatLabel(cwd);
+export function readSeatRepository(cwd, { spawn = spawnSync } = {}) {
   try {
     const out = spawn("git", ["-C", String(cwd || "."), "remote", "get-url", "origin"], {
       encoding: "utf8",
       timeout: 1500,
     });
-    const remote = out?.status === 0 ? seatLabel(out.stdout) : "";
-    return remote || folder;
+    return out?.status === 0 ? normalizeSeatRepository(out.stdout) : null;
   } catch {
-    return folder;
+    return null;
   }
 }
 
+export function readSeatLabel(cwd, options) {
+  return seatLabel(readSeatRepository(cwd, options)) || seatLabel(cwd);
+}
+
 /** One bounded personal `tools/call`. Returns the parsed payload, or null. */
 export async function callPersonalTool({ url, token, client, name, args }) {
   const controller = new AbortController();
@@ -463,7 +467,8 @@ export async function runPersonalSeat({
   now = Date.now,
   note = "",
   call = callPersonalTool,
-  label = readSeatLabel,
+  label,
+  repository = readSeatRepository,
 }) {
   if (!personal || !ev) return state;
   const seat = state.seat && typeof state.seat === "object" ? state.seat : {};
@@ -479,12 +484,14 @@ export async function runPersonalSeat({
     ev.event === "PostToolUse";
   if (!seat.id && !wantsSeat) return state;
   if (ev.event === "SessionStart" || !seat.id) {
+    const repositoryUrl = repository(ev.cwd);
     const attached = await call({
       ...base,
       name: "attach_session",
       args: {
         client: personal.client,
-        label: label(ev.cwd),
+        label: label ? label(ev.cwd) : seatLabel(repositoryUrl) || seatLabel(ev.cwd),
+        ...(repositoryUrl ? { repositoryUrl } : {}),
         sessionKey: ev.sessionId,
       },
     });
@@ -945,7 +952,7 @@ export async function hookMain({ vendor = "unknown", scopeManaged = false, perso
     // `--personal` is the plugin's install: this session belongs to a person,
     // so it never streams into an agent's live card even when an agent
     // credential happens to sit in ~/.hilos/agent.json. The seat itself rides
-    // HILOS_MCP_TOKEN, because a plugin cannot prompt for a token.
+    // the saved Claude plugin option, or HILOS_MCP_TOKEN for manual hooks.
     const cfg = personal ? {} : resolveConfig({});
     await runHook({ raw, cfg, vendor, personal: personalHookConfig(process.env, { vendor }) });
   } catch {

package/src/seat-repository.d.mts

@@ -0,0 +1 @@
+export function normalizeSeatRepository(value: unknown): string | null;

package/src/seat-repository.mjs

@@ -0,0 +1,24 @@
+/**
+ * A GitHub origin as a credential-free HTTPS URL. Room links currently name
+ * GitHub repositories, so another host (even with the same owner/repo), local
+ * paths, SSH aliases, and malformed remotes cannot select a room.
+ */
+export function normalizeSeatRepository(value) {
+  if (typeof value !== "string") return null;
+  const text = value.trim();
+  if (!text || /[\\\s]/.test(text)) return null;
+  let url;
+  try {
+    const scp = text.match(/^git@github\.com:([^?#]+)$/i);
+    url = new URL(scp ? `https://github.com/${scp[1]}` : text);
+  } catch {
+    return null;
+  }
+  if (!["https:", "http:", "ssh:", "git:"].includes(url.protocol) ||
+      url.hostname.toLowerCase() !== "github.com" || url.port) return null;
+  const path = url.pathname.replace(/\/$/, "").replace(/\.git$/i, "");
+  if (!/^\/[a-z0-9-]+\/[a-z0-9_.-]+$/i.test(path)) return null;
+  const [, owner, repo] = path.split("/");
+  if (repo === "." || repo === "..") return null;
+  return `https://github.com/${owner.toLowerCase()}/${repo.toLowerCase()}`;
+}