hilos-agent 0.11.5 → 0.11.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hilos-agent",
-  "version": "0.11.5",
+  "version": "0.11.7",
   "description": "Run your own coding agent (Claude Code, Codex, Cursor, OpenCode, Hermes, or any command) as a teammate in a hilos room. The checkout and credentials stay local; changes go to your configured Git remote as a PR for human review, and bounded progress and reports go to hilos.",
   "type": "module",
   "bin": {

package/src/acp-session.mjs

@@ -215,6 +215,7 @@ export async function runAcpSession({
   onEvent,
   requestPermission,
   getPermissionDecision,
+  localAllow = null,
   /** Session to continue (0778); null starts a fresh one. */
   resumeSessionId = null,
   mcpServers = [],
@@ -333,6 +334,7 @@ export async function runAcpSession({
       now,
       log,
       label: "acp permission",
+      localAllow,
     });
     const option = pickAcpPermissionOption(msg.params?.options, reply);
     if (option && (reply !== "reject" || option.kind?.startsWith("reject"))) {

package/src/child-mcp.mjs

@@ -213,7 +213,10 @@ export function codexChildMcpArgs(url) {
  */
 export function claudeChildMcpArgs(configPath) {
   if (!configPath) return [];
-  return ["--mcp-config", configPath, "--allowedTools", CLAUDE_CHILD_MCP_TOOL_PATTERN];
+  // `--allowedTools` is variadic: written as two argv entries before the prompt it
+  // swallows the prompt as one more tool name (seen live on 1198 step 6). The
+  // `=` form binds the value to the flag and leaves the prompt alone.
+  return ["--mcp-config", configPath, `--allowedTools=${CLAUDE_CHILD_MCP_TOOL_PATTERN}`];
 }
 
 /**

package/src/claude-permissions.mjs

@@ -179,7 +179,8 @@ export function claudePermissionArgs({
     configPath,
     "--permission-prompt-tool",
     toolId,
-    ...(allowedTools ? ["--allowedTools", allowedTools] : []),
+    // The `=` form: `--allowedTools` is variadic and would swallow the prompt (1255).
+    ...(allowedTools ? [`--allowedTools=${allowedTools}`] : []),
   ];
 }
 
@@ -227,6 +228,7 @@ export async function startClaudePermissionServer({
   // file to delete; a second config would be a second lifetime to get wrong.
   extraServers = null,
   allowedTools = "",
+  localAllow = null,
 }) {
   if (typeof requestPermission !== "function" || typeof getPermissionDecision !== "function") {
     throw new Error("claude permission server requires requestPermission and getPermissionDecision");
@@ -389,6 +391,7 @@ export async function startClaudePermissionServer({
           pollIntervalMs,
           log,
           label: "claude permission",
+          localAllow,
         });
         decisionReply = resolved.reply;
         outcome = resolved.outcome;

package/src/codex-mcp-session.mjs

@@ -186,6 +186,7 @@ export async function runCodexMcpSession({
   onEvent,
   requestPermission,
   getPermissionDecision,
+  localAllow = null,
   beforeSpawn,
   spawnImpl = spawn,
   sleep,
@@ -316,6 +317,7 @@ export async function runCodexMcpSession({
       now,
       log,
       label: "codex permission",
+      localAllow,
     });
     respond(msg.id, { decision: mapCodexDecision(reply, available) });
   }

package/src/config.mjs

@@ -118,6 +118,11 @@ const DEFAULTS = {
   // ON by default. `childMcp: false` here turns it off; HILOS_CHILD_MCP=off (or
   // =on) does the same from the environment and wins over the file.
   childMcp: true,
+  // 1256 — edits inside the run's own checkout are allowed on the daemon and
+  // never raise a permission card: the pull request is the gate. `true` here
+  // (or HILOS_GATE_REPO_EDITS=1) restores a card per file for rooms that
+  // want it.
+  gateRepoEdits: false,
   // Replies in an exact thread bound by an opted-in local-session hook resume
   // that same provider session (0847). The hook install is the consent gate;
   // this switch lets an operator pause inbound pickup without uninstalling it.
@@ -234,6 +239,12 @@ export function resolveConfig({ flags = {}, join: joinPayload } = {}) {
         : /^(0|off|false|no)$/i.test(process.env.HILOS_CHILD_MCP || "")
           ? false
           : undefined,
+    gateRepoEdits:
+      /^(1|on|true|yes)$/i.test(process.env.HILOS_GATE_REPO_EDITS || "")
+        ? true
+        : /^(0|off|false|no)$/i.test(process.env.HILOS_GATE_REPO_EDITS || "")
+          ? false
+          : undefined,
   };
   const merged = { ...DEFAULTS, ...file };
   for (const [k, v] of Object.entries(env)) if (v !== undefined && v !== "") merged[k] = v;

package/src/handler.mjs

@@ -104,6 +104,7 @@ import {
   startChildHilosMcp,
 } from "./child-mcp.mjs";
 import { createUngatedRunNotice } from "./permission-gate.mjs";
+import { repoEditAllowance } from "./permission-gate.mjs";
 import { webMcpAgentPrompt } from "./webmcp-bridge.mjs";
 import {
   conflictCommitTitle,
@@ -361,8 +362,14 @@ function openCodePermissionCallbacks({
   // decides, instead of the gate discovering the decision on its next 1s poll.
   // 0 (older servers) keeps the plain immediate read.
   decisionWaitMs = 0,
+  // 1256 — the checkout this run edits; an edit under it is allowed on the
+  // daemon without a card (the pull request is the gate). Empty means "no
+  // local allowance": every ask still reaches the room.
+  repoRoot = "",
+  gateRepoEdits = false,
 }) {
   return {
+    localAllow: (request) => repoEditAllowance(request, { repoRoot, gateRepoEdits }),
     requestPermission: async (request) => {
       const detail =
         request.metadata && typeof request.metadata === "object"
@@ -2938,6 +2945,8 @@ async function handleFolderTask({ message, channelId, tool, me, caps, cfg, deps,
             threadRoot,
             decisionWaitMs: caps.decisionWaitMs,
             provider: vendor,
+            repoRoot: folderPath,
+            gateRepoEdits: cfg.gateRepoEdits === true,
           }),
         });
       } else if (gateClaudePermissions) {
@@ -2959,6 +2968,8 @@ async function handleFolderTask({ message, channelId, tool, me, caps, cfg, deps,
             threadRoot,
             decisionWaitMs: caps.decisionWaitMs,
             provider: vendor,
+            repoRoot: folderPath,
+            gateRepoEdits: cfg.gateRepoEdits === true,
           }),
         });
       } else {
@@ -4598,6 +4609,8 @@ export async function handleTask({ message, channelId, tool, me, caps = {}, iter
             decisionWaitMs: caps.decisionWaitMs,
             runId,
             provider: vendor,
+            repoRoot: repoPath,
+            gateRepoEdits: cfg.gateRepoEdits === true,
           }),
         });
       } else if (gateClaudePermissions) {
@@ -4624,6 +4637,8 @@ export async function handleTask({ message, channelId, tool, me, caps = {}, iter
             decisionWaitMs: caps.decisionWaitMs,
             runId,
             provider: vendor,
+            repoRoot: repoPath,
+            gateRepoEdits: cfg.gateRepoEdits === true,
           }),
         });
       } else {

package/src/permission-gate.mjs

@@ -13,6 +13,7 @@
 // the same block, the same timeout" a mechanical fact instead of three
 // hand-copied implementations that can drift apart.
 
+import path from "node:path";
 import { mapOpenCodePermissionDecision } from "./opencode-permissions.mjs";
 
 export const DEFAULT_PERMISSION_TIMEOUT_MS = 30 * 60_000;
@@ -136,6 +137,59 @@ function withDeadline(promise, { signal, deadlineAt, now, label }) {
   });
 }
 
+/**
+ * Edits inside the run's own checkout never raise a card (1256).
+ *
+ * The room asked the agent to change this repository, the daemon commits the
+ * result to a branch, and a person decides at the pull request. Asking that
+ * same person to approve every file the agent touches on the way is the
+ * ten-minute silence seen live on 1198 step 6: a permission card for the very
+ * README the ask named, and nobody there to click it. So a file edit whose
+ * every path resolves under the repo root (and outside `.git`) is allowed
+ * here, on the daemon, before hilos is asked. Everything else keeps the gate:
+ * shell commands, network, writes outside the tree, and any request whose
+ * paths the daemon cannot see. `gateRepoEdits: true` restores the old asking.
+ */
+export const REPO_EDIT_ACTIONS = new Set(["Edit", "Write", "MultiEdit", "NotebookEdit", "edit"]);
+
+function requestPaths(request) {
+  const out = [];
+  const meta = request?.metadata && typeof request.metadata === "object" ? request.metadata : {};
+  if (typeof meta.path === "string" && meta.path) out.push(meta.path);
+  for (const r of Array.isArray(request?.resources) ? request.resources : []) {
+    if (typeof r === "string" && r.startsWith("/")) out.push(r);
+  }
+  // The same file rides in both `metadata.path` and `resources`; one file is one file.
+  return [...new Set(out)];
+}
+
+function underRoot(candidate, repoRoot) {
+  const resolved = path.resolve(repoRoot, candidate);
+  const rel = path.relative(repoRoot, resolved);
+  if (!rel || rel === "") return false;
+  if (rel.startsWith("..") || path.isAbsolute(rel)) return false;
+  if (rel === ".git" || rel.startsWith(".git" + path.sep)) return false;
+  return true;
+}
+
+export function repoEditAllowance(request, { repoRoot = "", gateRepoEdits = false } = {}) {
+  if (gateRepoEdits || !repoRoot || !request) return null;
+  if (!REPO_EDIT_ACTIONS.has(String(request.action || ""))) return null;
+  const root = path.resolve(repoRoot);
+  const meta = request.metadata && typeof request.metadata === "object" ? request.metadata : {};
+  const paths = requestPaths(request);
+  if (paths.length) {
+    if (!paths.every((p) => underRoot(p, root))) return null;
+    return { reason: `edit inside the repository (${paths.length === 1 ? path.relative(root, path.resolve(root, paths[0])) : paths.length + " files"})` };
+  }
+  // Codex patch approvals name no files, only the directory the patch applies
+  // in; a patch applied inside the checkout is the same edit.
+  if (typeof meta.cwd === "string" && meta.cwd && (path.resolve(meta.cwd) === root || underRoot(meta.cwd, root))) {
+    return { reason: "patch applied inside the repository" };
+  }
+  return null;
+}
+
 /**
  * Raise one permission card and block until a human decides it.
  *
@@ -153,8 +207,9 @@ function withDeadline(promise, { signal, deadlineAt, now, label }) {
  *   settlementTimeoutMs?: number,
  *   sleep?: (ms: number) => Promise<void>,
  *   now?: () => number,
- *   log?: { error?: (message: string) => void },
+ *   log?: { error?: (message: string) => void, info?: (message: string) => void },
  *   label?: string,
+ *   localAllow?: ((request: Record<string, unknown>) => { reason?: string } | null) | null,
  * }} options
  * @returns {Promise<{ reply: "once"|"always"|"reject", outcome: string, handle: unknown }>}
  */
@@ -171,10 +226,18 @@ export async function resolveHilosPermissionReply({
   now = () => Date.now(),
   log,
   label = "permission",
+  localAllow = null,
 }) {
   if (typeof requestPermission !== "function" || typeof getPermissionDecision !== "function") {
     throw new Error("permission gate requires requestPermission and getPermissionDecision");
   }
+  // 1256 — a daemon-side allowance answers before hilos is asked: no card, no
+  // wait, one log line so the run's exhaust still says what happened.
+  const local = typeof localAllow === "function" ? localAllow(request) : null;
+  if (local && typeof local === "object") {
+    log?.info?.(`${label}: allowed on the daemon, ${local.reason || "local rule"}`);
+    return { reply: "once", outcome: "local-allow", handle: null, byPolicy: false, policyReason: null, localReason: local.reason || null };
+  }
   const deadline = deadlineAt ?? now() + Math.max(1, timeoutMs || DEFAULT_PERMISSION_TIMEOUT_MS);
   let handle = null;
   let reply = "reject";