hilos-agent 0.4.0 → 0.5.1

package/README.md

@@ -1,6 +1,6 @@
 # hilos-agent
 
-Run **your own** coding agent — Claude Code, Codex, Cursor, or any command — as
+Run **your own** coding agent — Claude Code, Codex, Cursor, Hermes, or any command — as
 an autonomous teammate inside a [hilos](https://hilos.sh) channel.
 
 It connects to hilos over MCP, watches for `@mentions` of your agent in a
@@ -42,8 +42,8 @@ Running from elsewhere, or want to map several repos explicitly? Use a config:
   "url": "https://hilos.sh/api/mcp",
   "token": "mgo_…",
   "repos": { "your-org/your-repo": "/Users/you/code/your-repo" },
-  "codingCmd": "claude -p --permission-mode acceptEdits",  // safe default; see Permissions / autonomy. or "codex exec", "cursor-agent", any command
-  "chatCmd": "claude -p --model claude-haiku-4-5",  // FAST command for chat replies + the plan-ack (set if your stack isn't Claude)
+  "codingCmd": "claude -p --permission-mode acceptEdits",  // safe default; see Permissions / autonomy. or "codex exec", "cursor-agent -p --output-format text", "agy -p", any command
+  "chatCmd": "",  // FAST command for chat replies + the plan-ack. Empty = derived from codingCmd's tool (codex daemons chat with codex, etc.); set to override
   "defaultBranch": "main",
   "gate": false,               // default: open a PR directly. true = approve-before-push
   "heartbeatMs": 180000,       // long runs post one "still working…" thread reply this often (0 = off, min 15s)
@@ -60,7 +60,8 @@ then edits it in place with elapsed time + the CLI's latest line — so the chan
 shows it's alive without thread spam. When the run ends, that message is retired
 to a short "done" line. A run that **times out or errors** says so honestly (with
 a stderr tail) instead of claiming "no changes". Chat replies use the faster
-`chatCmd` (default Haiku; falls back to `codingCmd` if unset) bounded by
+`chatCmd` (when unset, derived from `codingCmd`'s tool — a Claude daemon chats
+with Haiku, a Codex daemon with `codex exec`, and so on) bounded by
 `chatTimeoutMs`. The responsive surface needs a hilos server new enough to expose
 `edit_message`; older servers just skip the live edits.
 
@@ -125,6 +126,26 @@ It's your own machine, so this is the same trust as running the CLI yourself.
   startup, so a `folders` entry added while the daemon is running needs a restart
   to appear.
 
+### Deploy the folder with your own hosting CLI
+
+Add an optional per-channel deploy target next to `folders`:
+
+```jsonc
+{
+  "folders": { "<channelId>": "/Users/you/notes-site" },
+  "deploy": { "<channelId>": { "provider": "vercel", "prod": false } }
+}
+```
+
+`prod:false` means a preview deployment; `prod:true` means production. If the
+setting is absent, the daemon detects `.vercel/` / `vercel.json` or `.netlify/`
+/ `netlify.toml`; with no marker, deploy stays off. Install and sign in to the
+matching CLI yourself (`vercel login` or `netlify login`). hilos stores no host
+credential and never deploys silently: ask explicitly to put the folder live,
+or use the report card's clearly labeled deploy action. The live URL comes back
+on the same report card. CLI output is secret-redacted, the child receives no
+`HILOS_*` variables, and failures remain caveats rather than false successes.
+
 ## Embedding the daemon
 
 `run(cfg, opts)` is the poll loop, and it's embeddable. Beyond `handler`/`log` it

package/bin/hilos-agent.mjs

@@ -55,9 +55,12 @@ const HELP = `hilos-agent — your coding agent as a teammate in hilos
 Options:
   --channel <id>     watch only one channel (per-channel override)
   --config <path>    use a specific config file
-  --coding-cmd <cmd> the coding agent to run (default: "claude -p")
-  --chat-cmd <cmd>   fast command for chat replies + the plan-ack
-                     (default: "claude -p --model claude-haiku-4-5")
+  --coding-cmd <cmd> the coding agent to run — claude -p, codex exec,
+                     cursor-agent -p, agy -p, hermes, or any command that
+                     takes a prompt as its last arg (default: "claude -p")
+  --chat-cmd <cmd>   fast command for chat replies + the plan-ack (default:
+                     derived from the coding command, so a Codex or Cursor
+                     daemon chats with its own tool)
   --once             one poll then exit (cron-friendly)
   --backfill         also act on mentions that predate startup
   --no-gate          propose only; don't wait for approval / push
@@ -91,7 +94,11 @@ async function main() {
   }
 
   if (cmd === "init") {
-    const path = writeStarterConfig(joinPayload ? GLOBAL_CONFIG : flags.config, joinPayload || {});
+    // Carry an explicit --coding-cmd into the starter file so an init run from a
+    // non-Claude connect command doesn't write the Claude default over it.
+    const starter = { ...(joinPayload || {}) };
+    if (flags.codingCmd) starter.codingCmd = flags.codingCmd;
+    const path = writeStarterConfig(joinPayload ? GLOBAL_CONFIG : flags.config, starter);
     console.log(`Wrote ${path}.`);
     console.log(joinPayload ? "Token + endpoint set from your link." : "Fill in token + repos, then run `hilos-agent`.");
     console.log('Map your repos: "repos": { "owner/name": "/abs/path/to/checkout" }');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hilos-agent",
-  "version": "0.4.0",
+  "version": "0.5.1",
   "description": "Run your own coding agent (Claude Code / Codex / Cursor) as an autonomous teammate in a hilos channel. Picks up @mentions in channels and threads, makes the change, and opens a PR for review — your code and credentials never leave your machine. (Approve-before-push is available via gate:true.)",
   "type": "module",
   "bin": {

package/src/cli.mjs

@@ -7,6 +7,88 @@
 
 import { spawn } from "node:child_process";
 
+// ── Environment isolation ────────────────────────────────────────────────────
+// The coding/chat CLI we spawn (`claude -p`, `codex`, …) is a model with tool
+// use: it can run `env`/`printenv` and echo whatever it sees into the channel.
+// So hilos's OWN workspace bearer token (HILOS_TOKEN and the rest of the HILOS_*
+// connection vars) must NEVER be in the child's environment — the coding tool
+// never needs it (the DAEMON talks to hilos, the child only edits files), and
+// leaking it would hand a reader the keys to the workspace. We strip HILOS_* by
+// default on every spawn. Note the common `--join` paste-one-command flow keeps
+// the token in daemon memory (never in env), so this is a no-op there and only
+// bites the env-auth path (`HILOS_TOKEN=… hilos-agent`) — which is exactly where
+// the leak was. Hooks read the token from the config file, so they're unaffected.
+
+// Control flags (not secrets) that must survive the scrub: the documented
+// HILOS_HOOKS=off kill switch is read by the hook helper INSIDE the spawned
+// CLI's process tree, so stripping it would silently re-enable hook sends
+// from daemon-spawned sessions. Nothing here carries workspace access.
+const HILOS_CONTROL_KEYS = new Set(["HILOS_HOOKS"]);
+
+/**
+ * True for a hilos-owned connection var the coding tool must never inherit.
+ * @param {string} key
+ */
+function isHilosSecretKey(key) {
+  return /^HILOS_/i.test(key) && !HILOS_CONTROL_KEYS.has(key.toUpperCase());
+}
+
+/**
+ * A shallow copy of `base` (default `process.env`) with every hilos-owned env
+ * var (HILOS_*) removed. Applied to every child by runCli so the model can't
+ * read — and therefore can't echo — hilos's workspace token.
+ * @param {Record<string, string | undefined>} [base]
+ * @returns {Record<string, string>}
+ */
+export function scrubHilosEnv(base = process.env) {
+  const out = {};
+  for (const [k, v] of Object.entries(base)) {
+    if (v === undefined) continue;
+    if (isHilosSecretKey(k)) continue;
+    out[k] = v;
+  }
+  return out;
+}
+
+// Strict-isolation allowlist: what a coding CLI genuinely needs to start and
+// authenticate to ITS OWN provider — nothing else. Everything outside this list
+// (AWS/GCP/DB creds, PATs, SSH-agent sockets, arbitrary secrets in the user's
+// shell) is dropped so a task can't sweep them up. Opt-in via `codingEnv:
+// "minimal"`; users can widen it with `codingEnvAllow: ["FOO", …]`.
+const MINIMAL_ENV_EXACT = new Set([
+  "PATH", "HOME", "USER", "LOGNAME", "SHELL", "TERM", "TMPDIR", "TMP", "TEMP",
+  "TZ", "PWD", "LANG", "LC_ALL", "LC_CTYPE", "COLUMNS", "LINES", "COLORTERM",
+]);
+// Prefixes the coding tools use for their own config/auth (never hilos's).
+const MINIMAL_ENV_PREFIXES = [
+  "LC_", "XDG_", "NODE_", "NPM_", "npm_", "NVM_", "VOLTA_", "FNM_",
+  "ANTHROPIC_", "CLAUDE_", "OPENAI_", "CODEX_", "CURSOR_", "QWEN_", "DASHSCOPE_",
+  "SSL_", "NODE_EXTRA_CA_",
+];
+
+/**
+ * A curated child environment for strict isolation: only the vars a coding CLI
+ * needs to run and reach its own model provider, plus any `extraAllow` names the
+ * user opted into. HILOS_* is always excluded. Use for `codingEnv: "minimal"`.
+ * @param {Record<string, string | undefined>} [base]
+ * @param {string[]} [extraAllow]
+ * @returns {Record<string, string>}
+ */
+export function minimalEnv(base = process.env, extraAllow = []) {
+  const allowExtra = new Set(extraAllow || []);
+  const out = {};
+  for (const [k, v] of Object.entries(base)) {
+    if (v === undefined || isHilosSecretKey(k)) continue;
+    const ok =
+      MINIMAL_ENV_EXACT.has(k) ||
+      HILOS_CONTROL_KEYS.has(k.toUpperCase()) ||
+      allowExtra.has(k) ||
+      MINIMAL_ENV_PREFIXES.some((p) => k.startsWith(p));
+    if (ok) out[k] = v;
+  }
+  return out;
+}
+
 /** Human-readable elapsed time: "45s", "2m 3s". */
 export function fmtElapsed(ms) {
   const total = Math.max(0, Math.round(ms / 1000));
@@ -62,6 +144,9 @@ const MAX_CAPTURE_BYTES = 50 * 1024 * 1024;
  *   whole process group: SIGTERM, then SIGKILL after a short grace)
  * @property {(chunk: string) => void} [onData] - called with each stdout chunk as
  *   it arrives (lets a caller track the latest output line for a heartbeat)
+ * @property {Record<string, string>} [env] - base environment for the child. Any
+ *   hilos-owned var (HILOS_*) is stripped from it regardless. Omit to inherit the
+ *   daemon's environment minus HILOS_* (the safe default).
  */
 
 /**
@@ -86,6 +171,7 @@ export function runCli(opts) {
     log = console,
     signal,
     onData,
+    env,
   } = opts || {};
   return new Promise((resolve) => {
     // Already cancelled before we even start.
@@ -98,7 +184,17 @@ export function runCli(opts) {
       // detached:true makes the child its own process-group leader, so we can
       // kill the WHOLE tree (claude → node → git …) with process.kill(-pid) on
       // cancel/timeout instead of orphaning its subprocesses.
-      child = spawn(cmd, args, { cwd, detached: true });
+      // stdin MUST be 'ignore' (/dev/null → instant EOF), never a dangling pipe:
+      // `codex exec` appends piped stdin to its prompt and blocks until EOF, so
+      // an open pipe hangs it until the run timeout ("Reading additional input
+      // from stdin…"). Nothing we spawn is ever fed via stdin.
+      // Always strip hilos's own token from the child's env (see scrubHilosEnv).
+      child = spawn(cmd, args, {
+        cwd,
+        detached: true,
+        stdio: ["ignore", "pipe", "pipe"],
+        env: scrubHilosEnv(env || process.env),
+      });
     } catch (error) {
       resolve({ status: null, stdout: "", stderr: "", error });
       return;

package/src/config.mjs

@@ -48,15 +48,31 @@ const DEFAULTS = {
   // folder on this machine. Changes apply directly (no branch/PR). Live-reloadable
   // like `repos`. Shape: { "<channelId>": "/abs/path" }.
   folders: {},
+  // Optional local-folder deploy target. Outward deploys are always triggered
+  // explicitly by a request or report-card action; this only chooses provider
+  // and preview (default) vs production. Shape:
+  // { "<channelId>": { provider: "vercel" | "netlify", prod: false } }.
+  deploy: {},
   // acceptEdits lets the CLI make file edits without prompting (bias to action);
   // it still won't run arbitrary commands. Override in hilos-agent.json if you
   // want a stricter (or `--dangerously-skip-permissions`) command.
   codingCmd: "claude -p --permission-mode acceptEdits",
-  // Chat replies + the code-task plan-ack use a FAST one-shot model so a casual
+  // Environment handed to the coding/chat CLI. hilos's own token (HILOS_*) is
+  // ALWAYS stripped either way. "inherit" (default) passes the rest of your
+  // shell env so the coding tool behaves exactly as if you ran it yourself.
+  // "minimal" hands the child only what it needs to run + reach its own model
+  // provider (PATH/HOME/locale + ANTHROPIC_*/OPENAI_*/… ), dropping unrelated
+  // secrets (AWS/DB/SSH-agent/etc.) so a task can't sweep them up. Widen minimal
+  // mode with codingEnvAllow: ["MY_VAR", …].
+  codingEnv: "inherit",
+  codingEnvAllow: [],
+  // Chat replies + the code-task plan-ack use a FAST one-shot command so a casual
   // reply (or "I see it, here's my plan") comes back in seconds, not minutes.
   // Bounded by chatTimeoutMs with a template fallback so it can never dead-air.
-  // If your coding stack isn't Claude, set this to your own fast reply command.
-  chatCmd: "claude -p --model claude-haiku-4-5",
+  // Empty = derive from codingCmd's vendor (fastChatCmd in progress-emitter.mjs),
+  // so a Codex/Cursor daemon chats with ITS OWN tool — Claude Code is never
+  // required just because it's hilos's default. Set explicitly to override.
+  chatCmd: "",
   defaultBranch: "main",
   // Bias to action: open a PR directly for review (approve = merge on the card).
   // Set gate:true for the older approve-before-push flow (propose a diff, wait).
@@ -118,6 +134,7 @@ export function resolveConfig({ flags = {}, join: joinPayload } = {}) {
   merged.repos = { ...DEFAULTS.repos, ...(file.repos || {}) };
   // Local-folder map, merged like `repos` (an object, not a scalar overlay).
   merged.folders = { ...DEFAULTS.folders, ...(file.folders || {}) };
+  merged.deploy = { ...DEFAULTS.deploy, ...(file.deploy || {}) };
   // Remember where the file lives so reloadConfig can re-read it live.
   merged.configPath = findConfigPath(flags.config) || null;
   return merged;
@@ -129,6 +146,8 @@ export function resolveConfig({ flags = {}, join: joinPayload } = {}) {
 const LIVE_FIELDS = [
   "codingCmd",
   "chatCmd",
+  "codingEnv",
+  "codingEnvAllow",
   "defaultBranch",
   "gate",
   "maxRounds",
@@ -146,6 +165,7 @@ const LIVE_FIELDS = [
   // live merge (with DEFAULTS) happens in the special-cased block below, exactly
   // like `repos`, so a partial edit doesn't drop the defaults.
   "folders",
+  "deploy",
 ];
 
 /**
@@ -174,6 +194,7 @@ export function reloadConfig(prev) {
   // Merge the folder map like repos (overriding the raw scalar-loop assignment
   // above with a proper DEFAULTS-merged object).
   if (file.folders) next.folders = { ...DEFAULTS.folders, ...file.folders };
+  if (file.deploy) next.deploy = { ...DEFAULTS.deploy, ...file.deploy };
   return next;
 }
 

package/src/deploy.mjs

@@ -0,0 +1,234 @@
+// Local-folder deploys through the user's own Vercel or Netlify CLI session.
+// No OAuth or credentials are stored by hilos. Every captured string returned
+// to callers is redacted before it can reach a report, transcript, or log.
+
+import { constants as fsConstants } from "node:fs";
+import { accessSync, existsSync } from "node:fs";
+import { delimiter, join } from "node:path";
+
+import { runCli, scrubHilosEnv } from "./cli.mjs";
+import { redactSecrets } from "./redact.mjs";
+
+export const DEPLOY_PROVIDERS = ["vercel", "netlify"];
+export const DEFAULT_DEPLOY_TIMEOUT_MS = 5 * 60_000;
+
+function isProvider(value) {
+  return DEPLOY_PROVIDERS.includes(value);
+}
+
+export function findDeployCli(provider, env = process.env) {
+  if (!isProvider(provider)) return null;
+  for (const entry of String(env.PATH || "").split(delimiter)) {
+    if (!entry) continue;
+    const candidate = join(entry, provider);
+    try {
+      accessSync(candidate, fsConstants.X_OK);
+      return candidate;
+    } catch {
+      // Continue through PATH.
+    }
+  }
+  return null;
+}
+
+/** Resolve explicit channel config first, then provider-owned project markers. */
+export function resolveDeployTarget({ cfg, channelId, folderPath, env = process.env, pathExists = existsSync }) {
+  const configured = cfg?.deploy?.[channelId];
+  let provider = isProvider(configured?.provider) ? configured.provider : null;
+  let prod = configured?.prod === true;
+  let source = provider ? "config" : null;
+
+  if (!provider) {
+    if (pathExists(join(folderPath, ".vercel")) || pathExists(join(folderPath, "vercel.json"))) {
+      provider = "vercel";
+      source = "detected";
+    } else if (pathExists(join(folderPath, ".netlify")) || pathExists(join(folderPath, "netlify.toml"))) {
+      provider = "netlify";
+      source = "detected";
+    }
+    prod = false;
+  }
+
+  if (!provider) return { enabled: false, reason: "not-configured" };
+  const cliPath = findDeployCli(provider, env);
+  return {
+    enabled: true,
+    available: Boolean(cliPath),
+    provider,
+    prod,
+    source,
+    cliPath,
+    reason: cliPath ? null : "cli-missing",
+  };
+}
+
+export function deployArgs(provider, prod) {
+  if (provider === "vercel") return prod ? ["--prod", "--yes"] : ["--yes"];
+  if (provider === "netlify") {
+    return prod ? ["deploy", "--prod", "--json"] : ["deploy", "--json"];
+  }
+  throw new Error("Unsupported deploy provider.");
+}
+
+function stripAnsi(value) {
+  return String(value || "").replace(/\x1b\[[0-?]*[ -/]*[@-~]/g, "");
+}
+
+function vercelUrlCandidates(stdout, stderr) {
+  const lines = `${stripAnsi(stdout)}\n${stripAnsi(stderr)}`.split(/\r?\n/);
+  const candidates = [];
+  for (const line of lines) {
+    for (const match of line.matchAll(/https:\/\/[^\s"'<>]+/gi)) {
+      // Vercel's aligned output has no colon and may have a gutter glyph:
+      // `▲ Aliased         https://example.com`. Older releases used colons.
+      const beforeUrl = line.slice(0, match.index ?? 0);
+      const label = /\b(preview|production|aliased)\b\s*:?\s*$/i
+        .exec(beforeUrl)?.[1]?.toLowerCase() ?? null;
+      const raw = match[0].replace(/[),.;\]]+$/g, "");
+      try {
+        const parsed = new URL(raw);
+        const host = parsed.hostname.toLowerCase();
+        // `Inspect: https://vercel.com/<team>/<project>/...` is a dashboard
+        // link, not the deployment. Never put it on a report card.
+        if (host === "vercel.com" || host.endsWith(".vercel.com")) continue;
+        candidates.push({ raw, host, label });
+      } catch {
+        // Ignore malformed URL-shaped CLI output.
+      }
+    }
+  }
+  return candidates;
+}
+
+export function parseDeployUrl(provider, stdout, stderr = "", prod = false) {
+  if (provider === "vercel") {
+    const candidates = vercelUrlCandidates(stdout, stderr);
+    if (prod) {
+      // Production deploys may finish by printing only a custom alias. Prefer
+      // the explicit alias, then the CLI's Production line, before falling back
+      // to the canonical *.vercel.app deployment URL.
+      return (
+        candidates.find((candidate) => candidate.label === "aliased")?.raw ??
+        candidates.find((candidate) => candidate.label === "production")?.raw ??
+        candidates.find((candidate) => candidate.host.endsWith(".vercel.app"))?.raw ??
+        null
+      );
+    }
+    // Preview output remains deliberately strict: an arbitrary URL printed by
+    // a build is not evidence that Vercel deployed there.
+    return candidates.find((candidate) => candidate.host.endsWith(".vercel.app"))?.raw ?? null;
+  }
+  if (provider === "netlify") {
+    const clean = stripAnsi(stdout).trim();
+    const candidates = [clean, clean.slice(clean.indexOf("{"), clean.lastIndexOf("}") + 1)];
+    for (const candidate of candidates) {
+      if (!candidate) continue;
+      try {
+        const parsed = JSON.parse(candidate);
+        const value = prod
+          ? parsed.url || parsed.deploy_url
+          : parsed.deploy_url || parsed.url;
+        if (typeof value === "string" && /^https?:\/\//i.test(value)) return value;
+      } catch {
+        // Netlify should emit one JSON object; try the bounded object fallback.
+      }
+    }
+  }
+  return null;
+}
+
+function loginCaveat(provider, output) {
+  const text = String(output || "").toLowerCase();
+  const authFailure =
+    /not (?:logged|signed) in|not authenticated|authentication required|unauthorized|no auth token|login required|token is not valid|invalid (?:auth )?token/.test(text);
+  if (!authFailure) return null;
+  return provider === "vercel"
+    ? "Vercel is not logged in on this Mac. Run `vercel login` in a terminal once, then try again."
+    : "Netlify is not logged in on this Mac. Run `netlify login` in a terminal once, then try again.";
+}
+
+function safeDeploymentUrl(value) {
+  try {
+    const parsed = new URL(value);
+    if (parsed.protocol !== "https:" && parsed.protocol !== "http:") return null;
+    parsed.username = "";
+    parsed.password = "";
+    parsed.search = "";
+    parsed.hash = "";
+    return redactSecrets(parsed.toString());
+  } catch {
+    return null;
+  }
+}
+
+export async function deployFolder({
+  folderPath,
+  target,
+  timeoutMs = DEFAULT_DEPLOY_TIMEOUT_MS,
+  env = process.env,
+  signal = undefined,
+  run = runCli,
+}) {
+  const provider = target?.provider;
+  const prod = target?.prod === true;
+  if (!isProvider(provider)) {
+    return { ok: false, provider: null, prod, caveat: "Choose Vercel or Netlify before deploying." };
+  }
+  if (!target.available || !target.cliPath) {
+    const label = provider === "vercel" ? "Vercel" : "Netlify";
+    return {
+      ok: false,
+      provider,
+      prod,
+      caveat: `Install the ${label} CLI, sign in, then try again.`,
+    };
+  }
+
+  const result = await run({
+    cmd: target.cliPath,
+    args: deployArgs(provider, prod),
+    cwd: folderPath,
+    timeoutMs,
+    heartbeatMs: 0,
+    label: "deploying",
+    signal,
+    // Defense in depth: runCli strips HILOS_* too, but an injected runner sees
+    // the same scrubbed environment the real child receives.
+    env: scrubHilosEnv(env),
+  });
+  const stdout = redactSecrets(String(result?.stdout || ""));
+  const stderr = redactSecrets(String(result?.stderr || ""));
+  const error = redactSecrets(String(result?.error?.message || ""));
+  const combined = [stdout, stderr, error].filter(Boolean).join("\n");
+
+  if (result?.aborted) {
+    return { ok: false, provider, prod, aborted: true, stdout, stderr, caveat: "Deployment was stopped." };
+  }
+  if (result?.status !== 0) {
+    return {
+      ok: false,
+      provider,
+      prod,
+      stdout,
+      stderr,
+      caveat:
+        loginCaveat(provider, combined) ||
+        (error.includes("timed out")
+          ? `The ${provider === "vercel" ? "Vercel" : "Netlify"} deployment timed out after ${Math.round(timeoutMs / 1000)} seconds.`
+          : `${provider === "vercel" ? "Vercel" : "Netlify"} deployment failed: ${(stderr || error || "unknown error").slice(0, 240)}`),
+    };
+  }
+
+  const url = safeDeploymentUrl(parseDeployUrl(provider, result.stdout, result.stderr, prod));
+  if (!url) {
+    return {
+      ok: false,
+      provider,
+      prod,
+      stdout,
+      stderr,
+      caveat: `${provider === "vercel" ? "Vercel" : "Netlify"} finished without returning a deployment URL.`,
+    };
+  }
+  return { ok: true, provider, prod, url, stdout, stderr };
+}

package/src/handler.mjs

@@ -26,9 +26,9 @@ import {
   mentionHandle,
   detectPrContinuation,
 } from "./daemon.mjs";
-import { runCli, buildHeartbeat, ackText, oneLine, fmtElapsed } from "./cli.mjs";
+import { runCli, buildHeartbeat, ackText, oneLine, fmtElapsed, minimalEnv } from "./cli.mjs";
 import { makeStreamParser } from "./agent-events.mjs";
-import { detectVendor, codeStreamArgs, createProgressEmitter } from "./progress-emitter.mjs";
+import { detectVendor, codeStreamArgs, createProgressEmitter, fastChatCmd } from "./progress-emitter.mjs";
 import { resolveFollowupMode, classifyFollowupCue, normalizeSignal } from "./followup.mjs";
 import { buildResumeArgs, readStateEntry, writeState, HILOS_DIR } from "./resume.mjs";
 import {
@@ -38,6 +38,30 @@ import {
   shouldReview,
 } from "./review.mjs";
 import { buildMemoryBlock } from "./memory.mjs";
+import { deployFolder, resolveDeployTarget } from "./deploy.mjs";
+
+/**
+ * The environment for a coding/chat CLI run. runCli always strips HILOS_* on top
+ * of whatever this returns; here we additionally honor `codingEnv: "minimal"`
+ * (strict isolation — only what the tool needs to reach its own model provider).
+ * Returns undefined for the default "inherit" mode so runCli falls back to the
+ * scrubbed process.env.
+ */
+function codingChildEnv(cfg) {
+  return cfg?.codingEnv === "minimal"
+    ? minimalEnv(process.env, cfg.codingEnvAllow)
+    : undefined;
+}
+
+/**
+ * The fast chat command for this config: an explicit chatCmd wins, else the
+ * coding vendor's verified non-interactive print mode (fastChatCmd), else the
+ * coding command itself. Keeps chat/plan-ack/review on the USER'S tool — a
+ * Codex or Cursor daemon must never require Claude Code on PATH (0521).
+ */
+function chatCmdFor(cfg) {
+  return cfg.chatCmd || fastChatCmd(detectVendor(cfg.codingCmd)) || cfg.codingCmd;
+}
 
 /** PR number from a github pull-request URL, or null. */
 function prNumberFromUrl(url) {
@@ -102,6 +126,8 @@ function defaultDeps() {
     // Does a path exist on disk? Injectable so folder mode's "missing folder"
     // guard is unit-testable without touching the real filesystem.
     pathExists: (p) => existsSync(p),
+    resolveDeployTarget: (args) => resolveDeployTarget(args),
+    deployFolder: (args) => deployFolder(args),
     openPR: (cwd, { title, body, branch, base }) => {
       const r = spawnSync(
         "gh",
@@ -167,7 +193,15 @@ async function awaitDecision({ tool, channelId, reportMessageId, cfg, deps, pare
       report = m && m.report ? m.report : null;
     }
     const kind = report ? decisionKind(report) : null;
-    if (kind) return { kind, note: report.decision?.note || null };
+    if (kind === "deploy") {
+      const provider = report.decision?.provider;
+      const prod = report.decision?.prod;
+      if ((provider === "vercel" || provider === "netlify") && typeof prod === "boolean") {
+        return { kind, provider, prod };
+      }
+    } else if (kind) {
+      return { kind, note: report.decision?.note || null };
+    }
     await deps.sleep(cfg.decisionPollMs);
   }
   return { kind: "timeout" };
@@ -371,7 +405,7 @@ const CODE_SIGNAL = "__CODE__";
  */
 async function routeIntent({ name, repoFullName, transcript, workspaceMemory, cfg, signal, hasActiveRun = false, runCliFn }) {
   const doRun = runCliFn || runCli; // folder mode injects deps.runCli; repo flow uses the import
-  const cmd = cfg.chatCmd || cfg.codingCmd;
+  const cmd = chatCmdFor(cfg);
   const parts = cmd.split(" ").filter(Boolean);
   // When this thread already owns an OPEN pull request (a follow-up reply), the
   // router ALSO reads whether the latest message continues that PR, wants a
@@ -558,7 +592,7 @@ export function planAckPrompt(o) {
  * empty/timeout/error so the run keeps the instant template and never stalls.
  */
 async function proposePlanAck({ task, transcript, repoFullName, cfg, signal }) {
-  const cmd = cfg.chatCmd;
+  const cmd = chatCmdFor(cfg);
   if (!cmd) return null;
   const parts = cmd.split(" ").filter(Boolean);
   const prompt = planAckPrompt({ task, transcript, repoFullName });
@@ -568,6 +602,7 @@ async function proposePlanAck({ task, transcript, repoFullName, cfg, signal }) {
     timeoutMs: Math.min(cfg.chatTimeoutMs || 90000, 45000),
     label: "thinking",
     signal,
+    env: codingChildEnv(cfg),
   });
   if (run.aborted || signal?.aborted) return null;
   const text = (run.stdout || "").trim();
@@ -597,10 +632,10 @@ async function respondConversationally({ message, channelId, tool, me, cfg, repo
     `${memoryPreamble(workspaceMemory)}` +
     `Conversation so far:\n${transcript}`;
 
-  // Chat uses the FAST one-shot command (fall back to codingCmd if unset) bounded
-  // by chatTimeoutMs, so a casual reply lands in seconds and a stalled model can't
-  // dead-air the channel for the full coding timeout.
-  const cmd = cfg.chatCmd || cfg.codingCmd;
+  // Chat uses the FAST one-shot command (the coding vendor's own print mode when
+  // chatCmd is unset) bounded by chatTimeoutMs, so a casual reply lands in seconds
+  // and a stalled model can't dead-air the channel for the full coding timeout.
+  const cmd = chatCmdFor(cfg);
   const parts = cmd.split(" ").filter(Boolean);
   console.log(`  chat → running \`${cmd}\` (output appears when it finishes)…`);
 
@@ -636,6 +671,7 @@ async function respondConversationally({ message, channelId, tool, me, cfg, repo
       timeoutMs: cfg.chatTimeoutMs || cfg.runTimeoutMs,
       label: "thinking",
       signal,
+      env: codingChildEnv(cfg),
     });
   } finally {
     beatStopped = true;
@@ -807,7 +843,7 @@ async function reviewTask({ message, channelId, tool, me, cfg, workspaceMemory,
   // Read-only run: a throwaway cwd contains any stray write; the daemon reads ONLY
   // stdout and never stages/commits anything. Review uses the fast chat command
   // when set (no acceptEdits → can't write), falling back to the coding command.
-  const cmd = cfg.reviewCmd || cfg.chatCmd || cfg.codingCmd;
+  const cmd = cfg.reviewCmd || chatCmdFor(cfg);
   const parts = String(cmd).split(" ").filter(Boolean);
   let sandboxDir = null;
   try {
@@ -823,6 +859,7 @@ async function reviewTask({ message, channelId, tool, me, cfg, workspaceMemory,
     timeoutMs: cfg.chatTimeoutMs ? Math.max(cfg.chatTimeoutMs, 120000) : cfg.runTimeoutMs,
     label: "reviewing",
     signal,
+    env: codingChildEnv(cfg),
   });
   if (sandboxDir) {
     try {
@@ -890,6 +927,207 @@ function renderChangedList({ created, modified, deleted }) {
   return lines.join("\n");
 }
 
+function deployLabel(target) {
+  const provider = target.provider === "vercel" ? "Vercel" : "Netlify";
+  return `${provider} (${target.prod ? "production" : "preview"})`;
+}
+
+function folderDeployState(folderPath, git) {
+  const inside = git(folderPath, ["rev-parse", "--is-inside-work-tree"]);
+  const isGit = inside.status === 0 && String(inside.stdout || "").trim() === "true";
+  if (!isGit) return { commit: null, stat: "", changed: null };
+  const commitResult = git(folderPath, ["rev-parse", "--short", "HEAD"]);
+  const statResult = git(folderPath, ["diff", "--stat", "HEAD"]);
+  const statusResult = git(folderPath, ["status", "--porcelain"]);
+  const changed = diffStatusSets("", String(statusResult.stdout || ""));
+  return {
+    commit: commitResult.status === 0 ? String(commitResult.stdout || "").trim() : null,
+    stat: truncateDiff(String(statResult.stdout || "")).text.trim(),
+    changed,
+  };
+}
+
+// A report-card Deploy click is stored durably on the report as a pending
+// decision, and list_mentions re-projects it on EVERY poll until a post_report
+// settle clears it. So every terminal exit of handleFolderDeploy — including
+// "stopped" and "deploy is off" — must settle the source report, or the
+// decision re-triggers the deploy on the next poll / daemon restart (an
+// explicit human cancel of a production deploy would not stick) and the card
+// stays wedged on "deployment requested" with its action row hidden. Settling
+// re-posts the prior report content untouched plus one honest caveat; the
+// server replaces metadata.report wholesale, which clears the decision by
+// construction and brings the Deploy button back for a retry.
+async function settleDeploySource({ tool, channelId, sourceReportId, caveat }) {
+  if (!sourceReportId) return;
+  const prior = await tool("get_report", { messageId: sourceReportId }).catch(() => null);
+  const p = prior?.found && prior.report ? prior.report : null;
+  const caveats = [
+    ...(Array.isArray(p?.caveats) ? p.caveats.filter((v) => typeof v === "string") : []),
+    caveat,
+  ];
+  await tool("post_report", {
+    channelId,
+    messageId: sourceReportId,
+    broadcast: true,
+    ...(typeof p?.title === "string" ? { title: p.title } : {}),
+    summary: typeof p?.summary === "string" && p.summary ? p.summary : caveat,
+    caveats: [...new Set(caveats)],
+    todos: Array.isArray(p?.todos) ? p.todos.filter((v) => typeof v === "string") : [],
+    ...(Array.isArray(p?.verified) ? { verified: p.verified.filter((v) => typeof v === "string") } : {}),
+    ...(p?.deployment ? { deployment: p.deployment } : {}),
+    ...(typeof p?.previewUrl === "string" ? { previewUrl: p.previewUrl } : {}),
+    ...(typeof p?.pr?.url === "string" ? { prUrl: p.pr.url } : {}),
+    ...(typeof p?.pr?.number === "number" ? { prNumber: p.pr.number } : {}),
+  }).catch(() => {});
+}
+
+async function handleFolderDeploy({
+  message,
+  channelId,
+  tool,
+  cfg,
+  deps,
+  signal,
+  parentId,
+  folderPath,
+  sourceReportId,
+}) {
+  if (!deps.pathExists(folderPath)) {
+    await settleDeploySource({
+      tool,
+      channelId,
+      sourceReportId,
+      caveat: "A requested deployment didn't start: the folder wasn't found on this machine.",
+    });
+    await tool("post_message", {
+      channelId,
+      parentId,
+      body: `I couldn't find the folder \`${folderPath}\` on this machine, so nothing was deployed.`,
+    });
+    return { status: "no-path" };
+  }
+  const target = deps.resolveDeployTarget({
+    cfg,
+    channelId,
+    folderPath,
+    pathExists: deps.pathExists,
+  });
+  if (!target.enabled) {
+    await settleDeploySource({
+      tool,
+      channelId,
+      sourceReportId,
+      caveat: "A requested deployment didn't start: deployment is off for this folder.",
+    });
+    await tool("post_message", {
+      channelId,
+      parentId,
+      body:
+        "Deployment is off for this folder. Add a `deploy` entry for this channel in `hilos-agent.json`, " +
+        "or link the folder once with Vercel/Netlify so its local project marker can be detected.",
+    });
+    return { status: "deploy-off" };
+  }
+
+  const requested = message?.deployRequest;
+  if (
+    requested &&
+    (requested.provider !== target.provider || requested.prod !== target.prod)
+  ) {
+    await settleDeploySource({
+      tool,
+      channelId,
+      sourceReportId,
+      caveat: "A requested deployment didn't start: the folder's deploy target changed after this report.",
+    });
+    await tool("post_message", {
+      channelId,
+      parentId,
+      body: "The folder's deploy target changed after that report. Open the latest report and try again.",
+    });
+    return { status: "deploy-target-changed" };
+  }
+
+  const prior = sourceReportId
+    ? await tool("get_report", { messageId: sourceReportId }).catch(() => null)
+    : null;
+  const priorReport = prior?.found && prior.report ? prior.report : null;
+  const state = folderDeployState(folderPath, deps.git);
+  await tool("post_message", {
+    channelId,
+    parentId,
+    body:
+      `Deploying ${target.prod ? "to production" : "a preview"} on ` +
+      `${target.provider === "vercel" ? "Vercel" : "Netlify"} from \`${folderPath}\`. ` +
+      `${sourceReportId ? "I'll update the report when it finishes." : "I'll post the live link when it finishes."}`,
+  });
+  const result = await deps.deployFolder({ folderPath, target, signal });
+  if (result.aborted || signal?.aborted) {
+    // A stop must stick: settle the report so the pending decision can't
+    // re-trigger this deploy on the next poll or daemon restart.
+    await settleDeploySource({
+      tool,
+      channelId,
+      sourceReportId,
+      caveat: "A deployment was stopped before it finished. Use Deploy on this report to try again.",
+    });
+    await tool("post_message", { channelId, parentId, body: "Deployment was stopped." });
+    return { status: "cancelled" };
+  }
+
+  const folderName = folderPath.split("/").filter(Boolean).pop() || folderPath;
+  const stateLines = [];
+  if (state.commit) stateLines.push(`Deployed from commit \`${state.commit}\`.`);
+  if (state.changed && renderChangedList(state.changed)) {
+    stateLines.push(`Local changes included:\n${renderChangedList(state.changed)}`);
+  }
+  if (state.stat) stateLines.push("```\n" + state.stat + "\n```");
+  const priorSummary = typeof priorReport?.summary === "string" ? priorReport.summary : "";
+  const summary = result.ok
+    ? [
+        priorSummary,
+        `Deployed to ${deployLabel(target)}: ${result.url}`,
+        ...stateLines,
+      ].filter(Boolean).join("\n\n")
+    : [priorSummary, `Deployment to ${deployLabel(target)} did not finish.`, ...stateLines]
+        .filter(Boolean)
+        .join("\n\n");
+  const priorCaveats = Array.isArray(priorReport?.caveats)
+    ? priorReport.caveats.filter((value) => typeof value === "string")
+    : [];
+  const caveats = [...priorCaveats];
+  if (result.ok && !target.prod) {
+    caveats.push("Preview deployment — this is not your production domain.");
+  } else if (!result.ok && result.caveat) {
+    caveats.push(result.caveat);
+  }
+  const priorPreviewUrl =
+    typeof priorReport?.previewUrl === "string" ? priorReport.previewUrl : undefined;
+  if (!result.ok && priorPreviewUrl) {
+    caveats.push("The live link is from the previous successful deployment; this new deploy did not replace it.");
+  }
+  const report = {
+    channelId,
+    ...(sourceReportId ? { messageId: sourceReportId } : { parentId }),
+    broadcast: true,
+    title: result.ok ? `Deployed: ${folderName}` : `Deployment failed: ${folderName}`,
+    summary,
+    caveats: [...new Set(caveats)],
+    todos: Array.isArray(priorReport?.todos) ? priorReport.todos : [],
+    ...(target.available
+      ? { deployment: { provider: target.provider, prod: target.prod } }
+      : {}),
+    ...((result.ok && result.url) || priorPreviewUrl
+      ? { previewUrl: result.ok ? result.url : priorPreviewUrl }
+      : {}),
+  };
+  await tool("post_report", report);
+  return {
+    status: result.ok ? "folder-deployed" : "deploy-failed",
+    previewUrl: result.ok ? result.url : null,
+  };
+}
+
 /**
  * FOLDER MODE (0322). A channel with NO linked GitHub repo but a `folders`
  * mapping runs the coding CLI directly in that folder and applies changes in
@@ -919,6 +1157,12 @@ async function handleFolderTask({ message, channelId, tool, me, caps, cfg, deps,
     });
     return { status: "no-path" };
   }
+  const deployTarget = deps.resolveDeployTarget({
+    cfg,
+    channelId,
+    folderPath,
+    pathExists: deps.pathExists,
+  });
 
   // 2. Is it a git repo? If so, snapshot the pre-run status so we can (a) report
   // exactly what the run changed and (b) revert precisely on reject. We NEVER touch
@@ -1036,6 +1280,7 @@ async function handleFolderTask({ message, channelId, tool, me, caps, cfg, deps,
         timeoutMs: cfg.runTimeoutMs,
         label: "coding",
         signal,
+        env: codingChildEnv(cfg),
         onData: (c) => {
           const lines = String(c).split("\n").map((s) => s.trim()).filter(Boolean);
           if (lines.length) lastLine = lines[lines.length - 1];
@@ -1129,7 +1374,15 @@ async function handleFolderTask({ message, channelId, tool, me, caps, cfg, deps,
       caveats.push(`The coding agent didn't exit cleanly${why} — review the changes carefully.`);
     }
     const folderName = folderPath.split("/").filter(Boolean).pop() || folderPath;
-    return { title: `Folder run: ${folderName}`, summary: parts.join("\n\n"), caveats, todos: [] };
+    return {
+      title: `Folder run: ${folderName}`,
+      summary: parts.join("\n\n"),
+      caveats,
+      todos: [],
+      ...(deployTarget.enabled && deployTarget.available
+        ? { deployment: { provider: deployTarget.provider, prod: deployTarget.prod } }
+        : {}),
+    };
   };
 
   // --- Run ---
@@ -1206,6 +1459,27 @@ async function handleFolderTask({ message, channelId, tool, me, caps, cfg, deps,
     round += 1;
   }
 
+  if (decision.kind === "deploy") {
+    return await handleFolderDeploy({
+      message: {
+        ...message,
+        deployRequest: {
+          reportMessageId,
+          provider: decision.provider,
+          prod: decision.prod,
+        },
+      },
+      channelId,
+      tool,
+      cfg,
+      deps,
+      signal,
+      parentId: threadRoot,
+      folderPath,
+      sourceReportId: reportMessageId,
+    });
+  }
+
   // --- Terminal ---
   if (decision.kind === "approved") {
     await tool("post_message", {
@@ -1268,7 +1542,10 @@ async function handleFolderTask({ message, channelId, tool, me, caps, cfg, deps,
 /** Handle one task. cfg/deps injectable for tests. `opts.signal` (AbortSignal)
  *  cancels an in-flight run — the queue fires it when a human says "stop". */
 export async function handleTask({ message, channelId, tool, me, caps = {} }, cfg, depsOverride, opts = {}) {
-  const deps = depsOverride || defaultDeps();
+  if (message.dispatch?.briefMarkdown) {
+    message = { ...message, body: `${message.body}\n\n${message.dispatch.briefMarkdown}` };
+  }
+  const deps = depsOverride ? { ...defaultDeps(), ...depsOverride } : defaultDeps();
   const git = deps.git;
   const signal = opts.signal;
   // When the mention was a thread reply, keep the whole exchange in that thread.
@@ -1324,15 +1601,102 @@ export async function handleTask({ message, channelId, tool, me, caps = {} }, cf
   if (!repoLink) {
     const folderPath = resolveFolderPath(cfg, channelId);
     if (folderPath) {
+      // Durable report-card fallback: list_mentions projects a still-pending
+      // in-place decision into the queue. Deploy only while that decision
+      // remains pending; a settled report is a silent no-op, which prevents a
+      // race with the active folder run from deploying twice.
+      if (message.deployRequest && typeof message.deployRequest.reportMessageId === "string") {
+        if (message.authorRole === "guest") {
+          await tool("post_message", {
+            channelId,
+            parentId,
+            body: "A workspace member needs to request that deployment.",
+          });
+          return { status: "chat" };
+        }
+        const sourceReportId = message.deployRequest.reportMessageId;
+        const current = await tool("get_report", { messageId: sourceReportId }).catch(() => null);
+        if (current?.found && current.report?.decision?.kind !== "deploy") {
+          return { status: "deploy-already-handled" };
+        }
+        return await handleFolderDeploy({
+          message,
+          channelId,
+          tool,
+          cfg,
+          deps,
+          signal,
+          parentId,
+          folderPath,
+          sourceReportId,
+        });
+      }
+
       // Same chat-vs-code decision the repo path uses: mode 'ask'/'ship' short-
       // circuit exactly as in the repo flow, otherwise the LLM router judges intent
       // (its CLI call goes through deps.runCli so folder mode is unit-testable).
-      const routed =
-        mode === "ask"
-          ? { code: false, reply: null }
-          : mode === "ship"
-            ? { code: true, task: message.body }
-            : await routeIntent({
+      let routed;
+      if (mode === "ask") {
+        routed = { code: false, reply: null };
+      } else if (mode === "ship") {
+        routed = { code: true, task: message.body };
+      } else if (caps.agentIntent) {
+        const classifierDeployTarget = deps.resolveDeployTarget({
+          cfg,
+          channelId,
+          folderPath,
+          pathExists: deps.pathExists,
+        });
+        const semantic = await tool("classify_agent_intent", {
+          latestMessage: message.body,
+          transcript: context.transcript,
+          project: folderPath,
+          channelId,
+          allowDeploy: classifierDeployTarget.enabled === true,
+        }).catch(() => null);
+        if (semantic?.reason === "execution-disabled") {
+          await tool("post_message", {
+            channelId,
+            parentId,
+            body: "I can chat here, but agent execution is disabled in this channel.",
+          });
+          return { status: "chat" };
+        }
+        if (
+          semantic?.ok &&
+          message.authorRole === "guest" &&
+          (semantic.mode === "ship" || semantic.mode === "deploy")
+        ) {
+          await tool("post_message", {
+            channelId,
+            parentId,
+            body: "A workspace member needs to confirm that request before I can act on it.",
+          });
+          return { status: "chat" };
+        }
+        if (semantic?.ok && semantic.mode === "deploy") {
+          return await handleFolderDeploy({
+            message,
+            channelId,
+            tool,
+            cfg,
+            deps,
+            signal,
+            parentId,
+            folderPath,
+            sourceReportId: null,
+          });
+        }
+        if (semantic?.ok && semantic.mode === "ship") {
+          routed = { code: true, task: semantic.brief || message.body };
+        } else if (semantic?.ok && semantic.mode === "ask") {
+          routed = { code: false, reply: null };
+        }
+      }
+      // Capability or classifier failure: preserve the previous semantic local
+      // CLI router. There is still no keyword/regex intent list.
+      if (!routed) {
+        routed = await routeIntent({
                 name: me?.agentName || "an assistant",
                 repoFullName: folderPath,
                 transcript: context.transcript,
@@ -1341,6 +1705,7 @@ export async function handleTask({ message, channelId, tool, me, caps = {} }, cf
                 signal,
                 runCliFn: deps.runCli,
               });
+      }
       if (routed.aborted || signal?.aborted) {
         await tool("post_message", { channelId, parentId, body: "Stopped." });
         return { status: "chat" };
@@ -1426,7 +1791,7 @@ export async function handleTask({ message, channelId, tool, me, caps = {} }, cf
     if (!body) {
       body =
         routed.error?.code === "ENOENT"
-          ? `(my chat command \`${cfg.chatCmd || cfg.codingCmd}\` isn't installed or on PATH.)`
+          ? `(my chat command \`${chatCmdFor(cfg)}\` isn't installed or on PATH.)`
           : `Still thinking on this — it's taking longer than usual. I'll follow up shortly.`;
     }
     await tool("post_message", { channelId, parentId, body });
@@ -1632,8 +1997,28 @@ export async function handleTask({ message, channelId, tool, me, caps = {} }, cf
   //   new      → record a fresh run, exactly as before.
   // Best-effort throughout — a bookkeeping failure (or an older server without the
   // runs tools) must NEVER break the run, so it proceeds without a runId.
-  let runId = effectiveMode === "iterate" ? activeRun?.runId ?? null : null;
-  if (caps.runs && threadRoot && effectiveMode !== "iterate") {
+  let runId = message.dispatch?.runId ?? (effectiveMode === "iterate" ? activeRun?.runId ?? null : null);
+  if (message.dispatch?.runId && caps.runs) {
+    // Adopt the dispatch's canonical run. If the server already SETTLED it (the
+    // reaper/outbox closed a dispatch we were slow to pick up), leave it alone
+    // and skip the coding run — resurrecting it would ship work no one is
+    // waiting on. Any OTHER failure (network, an older server without the guard)
+    // keeps today's best-effort behavior: proceed with the run.
+    try {
+      await tool("update_run", { runId: message.dispatch.runId, status: "running" });
+    } catch (e) {
+      if (String(e?.message || "").includes("already settled")) {
+        await tool("post_message", {
+          channelId,
+          parentId,
+          body: "This dispatch was already closed on the server, so I left it alone. Approve it again if it's still wanted.",
+        }).catch(() => {});
+        return { status: "dispatch-settled" };
+      }
+      /* older server or a transient error — proceed best-effort */
+    }
+  }
+  if (caps.runs && threadRoot && effectiveMode !== "iterate" && !message.dispatch?.runId) {
     try {
       if (effectiveMode === "redirect" && activeRun?.runId) {
         await tool("update_run", { runId: activeRun.runId, status: "superseded" }).catch(() => {});
@@ -1644,7 +2029,8 @@ export async function handleTask({ message, channelId, tool, me, caps = {} }, cf
         taskText: message.body,
         branch,
         // Map an unrecognized command to null rather than the off-vocabulary
-        // "unknown" — provider is documented as claude_code|codex|cursor|hilos.
+        // "unknown" — provider is documented as
+        // claude_code|codex|cursor|antigravity|hermes|hilos.
         provider: (() => {
           const v = detectVendor(cfg.codingCmd);
           return v === "unknown" ? null : v;
@@ -1657,7 +2043,7 @@ export async function handleTask({ message, channelId, tool, me, caps = {} }, cf
   }
   // Keep the inspectable continuation/redirect statement (don't overwrite it with
   // an LLM plan) so a human can correct the routing before code lands.
-  if (ackId && caps.editMessage && cfg.chatCmd && !continuingPrUrl && effectiveMode !== "redirect") {
+  if (ackId && caps.editMessage && chatCmdFor(cfg) && !continuingPrUrl && effectiveMode !== "redirect") {
     // Feed the ack the router's distilled brief AND the conversation — not the raw
     // mention — so it states a real plan instead of "what's the task?".
     const plan = await proposePlanAck({
@@ -1835,6 +2221,7 @@ export async function handleTask({ message, channelId, tool, me, caps = {} }, cf
         timeoutMs: cfg.runTimeoutMs,
         label: "coding",
         signal,
+        env: codingChildEnv(cfg),
         onData: (c) => {
           // Keep tracking lastLine as a fallback (legacy heartbeat / honesty).
           const lines = String(c).split("\n").map((s) => s.trim()).filter(Boolean);

package/src/progress-emitter.mjs

@@ -21,10 +21,11 @@ import { createStepRing, sanitizeText } from "./agent-events.mjs";
 /**
  * Which parser/stream-flags a coding command wants, from its FIRST token.
  * `claude`/`claude-code` → claude_code, `codex` → codex,
- * `cursor`/`cursor-agent` → cursor, everything else → unknown. Handles an
+ * `cursor`/`cursor-agent` → cursor, `agy`/`antigravity` → antigravity,
+ * `hermes` → hermes, everything else → unknown. Handles an
  * absolute path (`/usr/local/bin/claude`) by taking the basename.
  * @param {string} codingCmd
- * @returns {'claude_code'|'codex'|'cursor'|'unknown'}
+ * @returns {'claude_code'|'codex'|'cursor'|'antigravity'|'hermes'|'unknown'}
  */
 export function detectVendor(codingCmd) {
   const first = String(codingCmd || "").trim().split(/\s+/)[0] || "";
@@ -32,16 +33,40 @@ export function detectVendor(codingCmd) {
   if (base === "claude" || base === "claude-code" || base === "claude_code") return "claude_code";
   if (base === "codex") return "codex";
   if (base === "cursor" || base === "cursor-agent") return "cursor";
+  if (base === "agy" || base === "antigravity") return "antigravity";
+  if (base === "hermes") return "hermes";
   return "unknown";
 }
 
+/**
+ * The FAST one-shot chat command for a coding vendor — used when the user didn't
+ * set chatCmd explicitly, so a Codex/Cursor/Antigravity daemon never needs Claude
+ * Code installed just to answer chat (0521). Every command is the vendor's
+ * verified non-interactive print mode; the daemon appends the prompt as the last
+ * arg. codex carries --skip-git-repo-check because chat (and the read-only
+ * review sandbox) can run outside a git checkout. cursor carries
+ * --output-format text because its -p default is stream-json, which would post
+ * raw JSONL into the channel. Returns "" for unknown (caller falls back to
+ * codingCmd).
+ * @param {'claude_code'|'codex'|'cursor'|'antigravity'|'hermes'|'unknown'} vendor
+ * @returns {string}
+ */
+export function fastChatCmd(vendor) {
+  if (vendor === "claude_code") return "claude -p --model claude-haiku-4-5";
+  if (vendor === "codex") return "codex exec --skip-git-repo-check";
+  if (vendor === "cursor") return "cursor-agent -p --output-format text";
+  if (vendor === "antigravity") return "agy -p";
+  if (vendor === "hermes") return "hermes -z";
+  return "";
+}
+
 /**
  * Extra args to make the code run EMIT a structured stream, appended to the code
  * run's argv (NOT the display string) and ONLY for the code run. Only claude_code
  * has a proven flag (`--output-format stream-json --verbose`, per lib/agent-cli.ts
  * + scripts/verify-sandbox-mcp.mjs). codex/cursor return [] — their stream flags
  * are deferred to 0278 rather than guessed (an unproven flag could break the run).
- * @param {'claude_code'|'codex'|'cursor'|'unknown'} vendor
+ * @param {'claude_code'|'codex'|'cursor'|'antigravity'|'hermes'|'unknown'} vendor
  * @returns {string[]}
  */
 export function codeStreamArgs(vendor) {

package/src/redact.mjs

@@ -0,0 +1,54 @@
+// Credential redaction shared by hosted transcript persistence and local deploy
+// output. Keep this dependency-free so the published hilos-agent package can
+// redact CLI output before it is returned, logged, or attached to a report.
+
+const PEM_BLOCK = /-----BEGIN [A-Z0-9 ]*?(?:PRIVATE KEY|PRIVATE KEY BLOCK)-----[\s\S]*?-----END [A-Z0-9 ]*?(?:PRIVATE KEY|PRIVATE KEY BLOCK)-----/g;
+const JWT = /\beyJ[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}(?:\.[A-Za-z0-9_-]{6,})?\b/g;
+const URL_CREDENTIALS = /(\b[a-z][a-z0-9+.-]*:\/\/)([^\/\s:@"']+):([^\/\s@"']+)@/gi;
+const PROVIDER_TOKENS = new RegExp(
+  [
+    "sk-ant-[A-Za-z0-9_-]{8,}",
+    "sk-proj-[A-Za-z0-9_-]{8,}",
+    "sk-ws-[A-Za-z0-9._-]{16,}",
+    "sk-[A-Za-z0-9]{20,}",
+    "gh[pousr]_[A-Za-z0-9]{20,}",
+    "github_pat_[A-Za-z0-9_]{20,}",
+    "xox[baprs]-[A-Za-z0-9-]{10,}",
+    "sbp_[A-Za-z0-9]{20,}",
+    "sb_secret_[A-Za-z0-9_-]{10,}",
+    "AKIA[0-9A-Z]{16}",
+    "ASIA[0-9A-Z]{16}",
+    "AIza[A-Za-z0-9_-]{30,}",
+    "hilos_live_[A-Za-z0-9_-]{8,}",
+    "vercel_[A-Za-z0-9]{20,}",
+    "re_[A-Za-z0-9]{20,}",
+  ].join("|"),
+  "g",
+);
+const BEARER = /(\b[Bb]earer["']?[\s:=]+["']?)[A-Za-z0-9._~+/=-]{12,}/g;
+const ASSIGNMENT =
+  /((?:api[_-]?key|access[_-]?key|secret[_-]?access[_-]?key|client[_-]?secret|private[_-]?key|service[_-]?role[_-]?key|auth[_-]?token|refresh[_-]?token|session[_-]?token|apikey|token|secret|password|passwd|credential)["']?\s*[:=]+\s*["']?)(?!\[redacted:)([A-Za-z0-9_~.+/-]{8,})/gi;
+
+/** Replace credential-shaped content with typed markers. Idempotent. */
+export function redactSecrets(text) {
+  if (!text) return text;
+  return text
+    .replace(PEM_BLOCK, "[redacted:pem]")
+    .replace(JWT, "[redacted:jwt]")
+    .replace(URL_CREDENTIALS, "$1[redacted:url-credentials]@")
+    .replace(PROVIDER_TOKENS, "[redacted:token]")
+    .replace(BEARER, "$1[redacted:token]")
+    .replace(ASSIGNMENT, (match, prefix, _value, offset, source) => {
+      if (source[offset + match.length] === "(") return match;
+      return `${prefix}[redacted:value]`;
+    });
+}
+
+/** Keep the transcript tail at a whole-line boundary. */
+export function truncateTranscriptTail(text, maxChars) {
+  if (text.length <= maxChars) return text;
+  const tail = text.slice(text.length - maxChars);
+  const newline = tail.indexOf("\n");
+  const clean = newline >= 0 ? tail.slice(newline + 1) : tail;
+  return `{"type":"hilos_truncated","note":"earlier transcript trimmed to fit the storage cap"}\n${clean}`;
+}

package/src/resume.mjs

@@ -41,7 +41,7 @@ export const STATE_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000;
  * degrade to today's branch+feedback iterate (deferred to 0278/later). A falsy or
  * non-string sessionId also returns [] (nothing to resume).
  *
- * @param {'claude_code'|'codex'|'cursor'|'unknown'} vendor
+ * @param {'claude_code'|'codex'|'cursor'|'hermes'|'unknown'} vendor
  * @param {string|null|undefined} sessionId
  * @returns {string[]}
  */

package/src/run.mjs

@@ -78,7 +78,7 @@ export async function run(cfg, { handler = handleTask, log = console, signal, on
 
   const since = cfg.backfill ? 0 : Date.now();
   const toolNames = await listToolNames();
-  const useMentions = !cfg.channelId && toolNames.includes("list_mentions");
+  const useMentions = toolNames.includes("list_mentions");
   // Capabilities of THIS server, so the handler degrades gracefully on older
   // deploys (e.g. no edit_message → no live heartbeat, rather than erroring).
   const caps = {
@@ -96,6 +96,9 @@ export async function run(cfg, { handler = handleTask, log = console, signal, on
     // coding agent has the workspace's conventions and gotchas from the start.
     // Absent on older servers → silently skipped, no change in behavior.
     recall: toolNames.includes("recall"),
+    // Semantic local-folder intent (0515): the server guarantees a forced-tool
+    // ask/ship/deploy decision. Older servers fall back to the local router.
+    agentIntent: toolNames.includes("classify_agent_intent"),
   };
 
   // Register local folders (0324/0325): a folder-mode daemon announces each
@@ -194,7 +197,10 @@ export async function run(cfg, { handler = handleTask, log = console, signal, on
       log.log("  (deduped a repeat of an in-flight/queued ask)");
       return;
     }
-    if (liveCfg.queueAcks && !r.startedImmediately) {
+    // A report-card deploy decision is already visible in place. list_mentions
+    // projects the pending decision into this structured event, so don't add a
+    // misleading "queued" chat line while the active run settles it.
+    if (liveCfg.queueAcks && !r.startedImmediately && !m.deployRequest) {
       await tool("post_message", {
         channelId,
         parentId: m.parentId ?? null,
@@ -204,7 +210,11 @@ export async function run(cfg, { handler = handleTask, log = console, signal, on
   }
 
   async function passViaMentions() {
-    const out = await tool("list_mentions", cursor.value ? { since: cursor.value } : {});
+    const mentionArgs = {
+      ...(cursor.value ? { since: cursor.value } : {}),
+      ...(cfg.channelId ? { channelId: cfg.channelId } : {}),
+    };
+    const out = await tool("list_mentions", mentionArgs);
     const mentions = (out?.mentions ?? []).slice().reverse();
     for (const m of mentions) {
       if (seen.has(m.id)) continue;