hilos-agent 0.11.11 → 0.11.12

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hilos-agent",
-  "version": "0.11.11",
+  "version": "0.11.12",
   "description": "Run your own coding agent (Claude Code, Codex, Cursor, OpenCode, Hermes, or any command) as a teammate in a hilos room. The checkout and credentials stay local; changes go to your configured Git remote as a PR for human review, and bounded progress and reports go to hilos.",
   "type": "module",
   "bin": {

package/src/hook.mjs

@@ -377,13 +377,15 @@ const PERSONAL_CLIENTS = {
 };
 
 /**
- * Resolve the personal-seat config from the environment. `HILOS_MCP_TOKEN` is
- * the same `hpt_` token the plugin's MCP server entry uses, so installing the
- * plugin is the only gesture; `--personal` forces the lane on for a hook
- * installed by `hooks install --claude --personal`. PURE.
+ * Resolve the personal-seat config from the environment. Claude Code exports
+ * its saved plugin option to hooks; manual hooks and other clients still use
+ * HILOS_MCP_TOKEN. A nonempty saved option wins, including an invalid/revoked
+ * one: never silently attach as the fallback identity. PURE.
  */
 export function personalHookConfig(env = {}, { vendor = "unknown" } = {}) {
-  const token = typeof env.HILOS_MCP_TOKEN === "string" ? env.HILOS_MCP_TOKEN.trim() : "";
+  const option = typeof env.CLAUDE_PLUGIN_OPTION_HILOS_MCP_TOKEN === "string"
+    ? env.CLAUDE_PLUGIN_OPTION_HILOS_MCP_TOKEN.trim() : "";
+  const token = option || (typeof env.HILOS_MCP_TOKEN === "string" ? env.HILOS_MCP_TOKEN.trim() : "");
   if (!token || !token.startsWith("hpt_")) return null;
   const client = PERSONAL_CLIENTS[vendor];
   if (!client) return null;
@@ -950,7 +952,7 @@ export async function hookMain({ vendor = "unknown", scopeManaged = false, perso
     // `--personal` is the plugin's install: this session belongs to a person,
     // so it never streams into an agent's live card even when an agent
     // credential happens to sit in ~/.hilos/agent.json. The seat itself rides
-    // HILOS_MCP_TOKEN, because a plugin cannot prompt for a token.
+    // the saved Claude plugin option, or HILOS_MCP_TOKEN for manual hooks.
     const cfg = personal ? {} : resolveConfig({});
     await runHook({ raw, cfg, vendor, personal: personalHookConfig(process.env, { vendor }) });
   } catch {