hilos-agent 0.11.7 → 0.11.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hilos-agent",
-  "version": "0.11.7",
+  "version": "0.11.9",
   "description": "Run your own coding agent (Claude Code, Codex, Cursor, OpenCode, Hermes, or any command) as a teammate in a hilos room. The checkout and credentials stay local; changes go to your configured Git remote as a PR for human review, and bounded progress and reports go to hilos.",
   "type": "module",
   "bin": {

package/skills/hilos-handoff/SKILL.md

@@ -5,8 +5,15 @@ description: Hand work from this session to the room's agents — one ask, or a
 
 # Handoff
 
-Give work to the room instead of doing all of it here. Everything below is
-posted as the person running this session; they are the author of record.
+Give work to the room instead of doing all of it here. Two names are involved,
+and the difference matters: the ask is posted as the person running this
+session, so they are the author of record; the work is done by the named agent
+they chose, under that agent's own name. Never present an agent's result as
+the person's, and never let this session do the delegated work itself.
+
+Needs the hilos MCP server (`list_room_roster`, `ask_agent`, `propose_plan`).
+If those tools are not in this session, say so and point to
+https://hilos.sh/docs/share-from-your-terminal.
 
 1. Call `list_room_roster` for the room. Offer the agents it returns as the
    options, with their state, so nobody hands work to an agent already busy.

package/skills/hilos-room/SKILL.md

@@ -8,6 +8,10 @@ description: Show who is in the hilos room this session is attached to, and what
 Who is at the table right now, and what is waiting on the person running this
 session. Read-only: this skill never posts anything.
 
+Needs the hilos MCP server (`list_channels`, `list_room_roster`,
+`list_mentions`). If those tools are not in this session, say so and point to
+https://hilos.sh/docs/share-from-your-terminal; never invent a roster.
+
 1. Find the room. Use the channel this session has already posted into. If
    there is none, call `list_channels` and ask which room to read.
 2. Call `list_room_roster` with that channel id.

package/skills/hilos-share/SKILL.md

@@ -6,7 +6,12 @@ description: Post a short summary, a diff, or a link from this session into the
 # Share
 
 Put what just happened in front of the people in the room. The message is
-posted as the person running this session, under their name.
+posted as the person running this session, under their name, with a small
+"via Claude Code" (or Codex, Cursor) marker.
+
+Needs the hilos MCP server (`list_channels`, `post_message`). If those tools
+are not in this session, say so and point to
+https://hilos.sh/docs/share-from-your-terminal instead of pretending to post.
 
 1. Find the thread. Use the thread this session last posted into. If there is
    none, call `list_channels`, ask which room, and post at top level there.

package/src/codex-mcp-session.mjs

@@ -59,6 +59,9 @@ import {
   resolveHilosPermissionReply,
 } from "./permission-gate.mjs";
 
+// Codex 0.153.4 accepts on-request/never on its MCP tool. `untrusted`
+// is rejected before a turn starts. Keep the workspace sandbox and route its
+// escalation requests through the same hilos permission callbacks.
 const DEFAULT_TIMEOUT_MS = 30 * 60_000;
 const SHUTDOWN_GRACE_MS = 750;
 
@@ -177,7 +180,7 @@ export async function runCodexMcpSession({
   model = null,
   webSearch = true,
   sandbox = "workspace-write",
-  approvalPolicy = "untrusted",
+  approvalPolicy = "on-request",
   resumeThreadId = null,
   timeoutMs = DEFAULT_TIMEOUT_MS,
   pollIntervalMs = DEFAULT_PERMISSION_POLL_MS,
@@ -511,6 +514,15 @@ export async function runCodexMcpSession({
     if (resumeThreadId) sessionId = resumeThreadId;
     const result = await rpc("tools/call", { name: toolCall.name, arguments: toolCall.arguments });
     status = result?.isError === true ? 1 : 0;
+    // 1268: configuration failures arrive as tool errors, without agent events.
+    // Keep their explanation ahead of incidental stderr (such as deprecation
+    // warnings), so the room shows the reason the run actually failed.
+    if (result?.isError === true) {
+      const detail = (Array.isArray(result.content) ? result.content : [])
+        .filter((item) => item?.type === "text" && typeof item.text === "string")
+        .map((item) => item.text).join("\n").trim();
+      stderr = `${detail || "Codex tool failed without an explanation."}\n${stderr}`;
+    }
   } catch (callError) {
     error = spawnError ?? callError;
     status = null;