hilos-agent 0.4.0 → 0.6.0

package/README.md

@@ -1,6 +1,6 @@
 # hilos-agent
 
-Run **your own** coding agent — Claude Code, Codex, Cursor, or any command — as
+Run **your own** coding agent — Claude Code, Codex, Cursor, Hermes, or any command — as
 an autonomous teammate inside a [hilos](https://hilos.sh) channel.
 
 It connects to hilos over MCP, watches for `@mentions` of your agent in a
@@ -42,8 +42,9 @@ Running from elsewhere, or want to map several repos explicitly? Use a config:
   "url": "https://hilos.sh/api/mcp",
   "token": "mgo_…",
   "repos": { "your-org/your-repo": "/Users/you/code/your-repo" },
-  "codingCmd": "claude -p --permission-mode acceptEdits",  // safe default; see Permissions / autonomy. or "codex exec", "cursor-agent", any command
-  "chatCmd": "claude -p --model claude-haiku-4-5",  // FAST command for chat replies + the plan-ack (set if your stack isn't Claude)
+  "codingCmd": "claude -p --permission-mode acceptEdits",  // safe default; see Permissions / autonomy. or "codex exec", "cursor-agent -p --output-format text --trust", "agy -p", any command
+  "codingModel": "",  // model preset tier ("opus" | "sonnet" | "haiku") resolved at run time against the CLI's own model list (Cursor only today); "" = the tool's default
+  "chatCmd": "",  // FAST command for chat replies + the plan-ack. Empty = derived from codingCmd's tool (codex daemons chat with codex, etc.); set to override
   "defaultBranch": "main",
   "gate": false,               // default: open a PR directly. true = approve-before-push
   "heartbeatMs": 180000,       // long runs post one "still working…" thread reply this often (0 = off, min 15s)
@@ -60,7 +61,8 @@ then edits it in place with elapsed time + the CLI's latest line — so the chan
 shows it's alive without thread spam. When the run ends, that message is retired
 to a short "done" line. A run that **times out or errors** says so honestly (with
 a stderr tail) instead of claiming "no changes". Chat replies use the faster
-`chatCmd` (default Haiku; falls back to `codingCmd` if unset) bounded by
+`chatCmd` (when unset, derived from `codingCmd`'s tool — a Claude daemon chats
+with Haiku, a Codex daemon with `codex exec`, and so on) bounded by
 `chatTimeoutMs`. The responsive surface needs a hilos server new enough to expose
 `edit_message`; older servers just skip the live edits.
 
@@ -125,6 +127,26 @@ It's your own machine, so this is the same trust as running the CLI yourself.
   startup, so a `folders` entry added while the daemon is running needs a restart
   to appear.
 
+### Deploy the folder with your own hosting CLI
+
+Add an optional per-channel deploy target next to `folders`:
+
+```jsonc
+{
+  "folders": { "<channelId>": "/Users/you/notes-site" },
+  "deploy": { "<channelId>": { "provider": "vercel", "prod": false } }
+}
+```
+
+`prod:false` means a preview deployment; `prod:true` means production. If the
+setting is absent, the daemon detects `.vercel/` / `vercel.json` or `.netlify/`
+/ `netlify.toml`; with no marker, deploy stays off. Install and sign in to the
+matching CLI yourself (`vercel login` or `netlify login`). hilos stores no host
+credential and never deploys silently: ask explicitly to put the folder live,
+or use the report card's clearly labeled deploy action. The live URL comes back
+on the same report card. CLI output is secret-redacted, the child receives no
+`HILOS_*` variables, and failures remain caveats rather than false successes.
+
 ## Embedding the daemon
 
 `run(cfg, opts)` is the poll loop, and it's embeddable. Beyond `handler`/`log` it

package/bin/hilos-agent.mjs

@@ -31,6 +31,7 @@ function parseArgs(argv) {
     else if (a === "--url") flags.url = argv[++i];
     else if (a === "--token") flags.token = argv[++i];
     else if (a === "--coding-cmd") flags.codingCmd = argv[++i];
+    else if (a === "--coding-model") flags.codingModel = argv[++i];
     else if (a === "--chat-cmd") flags.chatCmd = argv[++i];
     else if (a === "--once") flags.once = true;
     else if (a === "--backfill") flags.backfill = true;
@@ -55,9 +56,15 @@ const HELP = `hilos-agent — your coding agent as a teammate in hilos
 Options:
   --channel <id>     watch only one channel (per-channel override)
   --config <path>    use a specific config file
-  --coding-cmd <cmd> the coding agent to run (default: "claude -p")
-  --chat-cmd <cmd>   fast command for chat replies + the plan-ack
-                     (default: "claude -p --model claude-haiku-4-5")
+  --coding-cmd <cmd> the coding agent to run — claude -p, codex exec,
+                     cursor-agent -p --trust, agy -p, hermes, or any command
+                     that takes a prompt as its last arg (default: "claude -p")
+  --coding-model <tier>  model preset tier (opus | sonnet | haiku) resolved at
+                     run time against the CLI's own model list — never a baked
+                     id (Cursor only today; default: the tool's own model)
+  --chat-cmd <cmd>   fast command for chat replies + the plan-ack (default:
+                     derived from the coding command, so a Codex or Cursor
+                     daemon chats with its own tool)
   --once             one poll then exit (cron-friendly)
   --backfill         also act on mentions that predate startup
   --no-gate          propose only; don't wait for approval / push
@@ -91,7 +98,12 @@ async function main() {
   }
 
   if (cmd === "init") {
-    const path = writeStarterConfig(joinPayload ? GLOBAL_CONFIG : flags.config, joinPayload || {});
+    // Carry an explicit --coding-cmd into the starter file so an init run from a
+    // non-Claude connect command doesn't write the Claude default over it.
+    const starter = { ...(joinPayload || {}) };
+    if (flags.codingCmd) starter.codingCmd = flags.codingCmd;
+    if (flags.codingModel) starter.codingModel = flags.codingModel;
+    const path = writeStarterConfig(joinPayload ? GLOBAL_CONFIG : flags.config, starter);
     console.log(`Wrote ${path}.`);
     console.log(joinPayload ? "Token + endpoint set from your link." : "Fill in token + repos, then run `hilos-agent`.");
     console.log('Map your repos: "repos": { "owner/name": "/abs/path/to/checkout" }');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hilos-agent",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "description": "Run your own coding agent (Claude Code / Codex / Cursor) as an autonomous teammate in a hilos channel. Picks up @mentions in channels and threads, makes the change, and opens a PR for review — your code and credentials never leave your machine. (Approve-before-push is available via gate:true.)",
   "type": "module",
   "bin": {

package/src/agent-events.mjs

@@ -1,9 +1,10 @@
 // Normalized vendor stream parser (0272). The KEYSTONE of the "Agents feel
 // alive" epic: coding CLIs each narrate their work in a different, unstable
 // wire format (Claude Code emits `--output-format stream-json` NDJSON, Codex
-// emits `--json` item events, Cursor emits unstructured text). This module turns
-// any of them into ONE small, typed `AgentEvent` stream the UI can render as a
-// live "what the agent is doing right now" card.
+// emits `--json` item events, Cursor emits its own `--output-format
+// stream-json` NDJSON — 0573). This module turns any of them into ONE small,
+// typed `AgentEvent` stream the UI can render as a live "what the agent is
+// doing right now" card.
 //
 // Design rules that make this safe to point at an untrusted, evolving CLI:
 //   - PURE + dependency-free (node builtins only) so it stands alone and is
@@ -207,12 +208,77 @@ function parseCodexLine(line) {
   }
 }
 
+/**
+ * Parse ONE Cursor `--output-format stream-json` NDJSON line → AgentEvent[].
+ * Shapes captured LIVE against cursor-agent 2026.07.23 (ticket 0572's audit):
+ * a `system`/`init` envelope with `session_id` (the `--resume` id — 0573),
+ * `assistant` turns whose message.content carries text blocks (tool calls
+ * arrive as separate events, unlike Claude's inline tool_use), `tool_call`
+ * started/completed envelopes keyed by kind (`editToolCall`/`readToolCall`/
+ * `shellToolCall`, each with an `args` object), and a terminal `result` with
+ * `is_error` + the full text in `result`. `thinking` deltas, the `user` echo,
+ * and `tool_call` completions are deliberately not steps.
+ */
+function parseCursorLine(line) {
+  const obj = tryParse(line);
+  if (!obj) return [];
+  if (obj.type === "system" && typeof obj.session_id === "string") {
+    return [{ t: "session", sessionId: sanitizeText(obj.session_id) }];
+  }
+  if (obj.type === "result") {
+    const ok = obj.is_error !== true && obj.subtype !== "error";
+    const summary = typeof obj.result === "string" ? sanitizeText(obj.result) : undefined;
+    return [summary ? { t: "result", ok, summary } : { t: "result", ok }];
+  }
+  // Only `started` — the `completed` twin repeats the same call and would
+  // double every step.
+  if (obj.type === "tool_call" && obj.subtype === "started") {
+    const ev = cursorToolEvent(obj.tool_call);
+    return ev ? [ev] : [];
+  }
+  if (obj.type === "assistant" && obj.message && Array.isArray(obj.message.content)) {
+    const out = [];
+    for (const block of obj.message.content) {
+      if (block && block.type === "text" && typeof block.text === "string") {
+        const text = sanitizeText(block.text.replace(/\s+/g, " ").trim());
+        if (text) out.push({ t: "note", text });
+      }
+    }
+    return out;
+  }
+  return [];
+}
+
+/** One Cursor tool_call envelope → an AgentEvent, or null. The envelope holds a
+ *  single `<kind>ToolCall` key; grep/ls/etc. carry less "alive" signal and are
+ *  skipped, mirroring toolKind()'s v1 restraint — an unknown kind never crashes. */
+function cursorToolEvent(toolCall) {
+  if (!toolCall || typeof toolCall !== "object") return null;
+  for (const [key, val] of Object.entries(toolCall)) {
+    if (!key.endsWith("ToolCall") || !val || typeof val !== "object") continue;
+    const args = val.args && typeof val.args === "object" ? val.args : {};
+    if (key === "shellToolCall" || key === "terminalToolCall") {
+      const cmd = typeof args.command === "string" ? args.command.replace(/\s+/g, " ").trim() : "";
+      return { t: "run", cmd: sanitizeText(cmd) };
+    }
+    if (key === "editToolCall" || key === "writeToolCall") {
+      return { t: "edit", path: typeof args.path === "string" ? sanitizeText(args.path) : "" };
+    }
+    if (key === "readToolCall") {
+      return { t: "read", path: typeof args.path === "string" ? sanitizeText(args.path) : "" };
+    }
+    return null;
+  }
+  return null;
+}
+
 /** claude / claude_code / claude-code all mean the Claude parser. */
 function normalizeVendor(vendor) {
   const v = String(vendor || "").toLowerCase();
   if (v === "claude" || v === "claude_code" || v === "claude-code") return "claude";
   if (v === "codex") return "codex";
-  return "cursor"; // cursor + ANY unknown vendor → lastLine fallback
+  if (v === "cursor") return "cursor"; // structured stream-json since 0573
+  return "text"; // ANY unknown vendor → lastLine text-tail fallback
 }
 
 // --- Streaming parsers -----------------------------------------------------
@@ -249,12 +315,13 @@ function makeLineBufferedParser(parseLine) {
 }
 
 /**
- * Fallback for Cursor and any vendor with no structured stream. There's nothing
- * to parse, so we only remember the last non-empty line seen — matching exactly
- * what the daemon does today (handler.mjs onData) so we NEVER regress below it —
- * and emit at most one sparse note on flush.
+ * Fallback for any vendor with no structured stream (cursor graduated to a
+ * real parser in 0573). There's nothing to parse, so we only remember the last
+ * non-empty line seen — matching exactly what the daemon does today
+ * (handler.mjs onData) so we NEVER regress below it — and emit at most one
+ * sparse note on flush.
  */
-function makeCursorParser() {
+function makeTextTailParser() {
   let lastLine = "";
   return {
     /** @returns {AgentEvent[]} */
@@ -285,7 +352,8 @@ export function makeStreamParser(vendor) {
   const v = normalizeVendor(vendor);
   if (v === "claude") return makeLineBufferedParser(parseClaudeLine);
   if (v === "codex") return makeLineBufferedParser(parseCodexLine);
-  return makeCursorParser();
+  if (v === "cursor") return makeLineBufferedParser(parseCursorLine);
+  return makeTextTailParser();
 }
 
 // --- Human step labels (what the LiveRunCard shows) ------------------------

package/src/cli.mjs

@@ -7,6 +7,88 @@
 
 import { spawn } from "node:child_process";
 
+// ── Environment isolation ────────────────────────────────────────────────────
+// The coding/chat CLI we spawn (`claude -p`, `codex`, …) is a model with tool
+// use: it can run `env`/`printenv` and echo whatever it sees into the channel.
+// So hilos's OWN workspace bearer token (HILOS_TOKEN and the rest of the HILOS_*
+// connection vars) must NEVER be in the child's environment — the coding tool
+// never needs it (the DAEMON talks to hilos, the child only edits files), and
+// leaking it would hand a reader the keys to the workspace. We strip HILOS_* by
+// default on every spawn. Note the common `--join` paste-one-command flow keeps
+// the token in daemon memory (never in env), so this is a no-op there and only
+// bites the env-auth path (`HILOS_TOKEN=… hilos-agent`) — which is exactly where
+// the leak was. Hooks read the token from the config file, so they're unaffected.
+
+// Control flags (not secrets) that must survive the scrub: the documented
+// HILOS_HOOKS=off kill switch is read by the hook helper INSIDE the spawned
+// CLI's process tree, so stripping it would silently re-enable hook sends
+// from daemon-spawned sessions. Nothing here carries workspace access.
+const HILOS_CONTROL_KEYS = new Set(["HILOS_HOOKS"]);
+
+/**
+ * True for a hilos-owned connection var the coding tool must never inherit.
+ * @param {string} key
+ */
+function isHilosSecretKey(key) {
+  return /^HILOS_/i.test(key) && !HILOS_CONTROL_KEYS.has(key.toUpperCase());
+}
+
+/**
+ * A shallow copy of `base` (default `process.env`) with every hilos-owned env
+ * var (HILOS_*) removed. Applied to every child by runCli so the model can't
+ * read — and therefore can't echo — hilos's workspace token.
+ * @param {Record<string, string | undefined>} [base]
+ * @returns {Record<string, string>}
+ */
+export function scrubHilosEnv(base = process.env) {
+  const out = {};
+  for (const [k, v] of Object.entries(base)) {
+    if (v === undefined) continue;
+    if (isHilosSecretKey(k)) continue;
+    out[k] = v;
+  }
+  return out;
+}
+
+// Strict-isolation allowlist: what a coding CLI genuinely needs to start and
+// authenticate to ITS OWN provider — nothing else. Everything outside this list
+// (AWS/GCP/DB creds, PATs, SSH-agent sockets, arbitrary secrets in the user's
+// shell) is dropped so a task can't sweep them up. Opt-in via `codingEnv:
+// "minimal"`; users can widen it with `codingEnvAllow: ["FOO", …]`.
+const MINIMAL_ENV_EXACT = new Set([
+  "PATH", "HOME", "USER", "LOGNAME", "SHELL", "TERM", "TMPDIR", "TMP", "TEMP",
+  "TZ", "PWD", "LANG", "LC_ALL", "LC_CTYPE", "COLUMNS", "LINES", "COLORTERM",
+]);
+// Prefixes the coding tools use for their own config/auth (never hilos's).
+const MINIMAL_ENV_PREFIXES = [
+  "LC_", "XDG_", "NODE_", "NPM_", "npm_", "NVM_", "VOLTA_", "FNM_",
+  "ANTHROPIC_", "CLAUDE_", "OPENAI_", "CODEX_", "CURSOR_", "QWEN_", "DASHSCOPE_",
+  "SSL_", "NODE_EXTRA_CA_",
+];
+
+/**
+ * A curated child environment for strict isolation: only the vars a coding CLI
+ * needs to run and reach its own model provider, plus any `extraAllow` names the
+ * user opted into. HILOS_* is always excluded. Use for `codingEnv: "minimal"`.
+ * @param {Record<string, string | undefined>} [base]
+ * @param {string[]} [extraAllow]
+ * @returns {Record<string, string>}
+ */
+export function minimalEnv(base = process.env, extraAllow = []) {
+  const allowExtra = new Set(extraAllow || []);
+  const out = {};
+  for (const [k, v] of Object.entries(base)) {
+    if (v === undefined || isHilosSecretKey(k)) continue;
+    const ok =
+      MINIMAL_ENV_EXACT.has(k) ||
+      HILOS_CONTROL_KEYS.has(k.toUpperCase()) ||
+      allowExtra.has(k) ||
+      MINIMAL_ENV_PREFIXES.some((p) => k.startsWith(p));
+    if (ok) out[k] = v;
+  }
+  return out;
+}
+
 /** Human-readable elapsed time: "45s", "2m 3s". */
 export function fmtElapsed(ms) {
   const total = Math.max(0, Math.round(ms / 1000));
@@ -62,6 +144,9 @@ const MAX_CAPTURE_BYTES = 50 * 1024 * 1024;
  *   whole process group: SIGTERM, then SIGKILL after a short grace)
  * @property {(chunk: string) => void} [onData] - called with each stdout chunk as
  *   it arrives (lets a caller track the latest output line for a heartbeat)
+ * @property {Record<string, string>} [env] - base environment for the child. Any
+ *   hilos-owned var (HILOS_*) is stripped from it regardless. Omit to inherit the
+ *   daemon's environment minus HILOS_* (the safe default).
  */
 
 /**
@@ -74,7 +159,7 @@ const MAX_CAPTURE_BYTES = 50 * 1024 * 1024;
  *
  * @param {RunCliOptions} opts
  */
-export function runCli(opts) {
+function runCliOnce(opts) {
   const {
     cmd,
     args = [],
@@ -86,6 +171,7 @@ export function runCli(opts) {
     log = console,
     signal,
     onData,
+    env,
   } = opts || {};
   return new Promise((resolve) => {
     // Already cancelled before we even start.
@@ -98,7 +184,17 @@ export function runCli(opts) {
       // detached:true makes the child its own process-group leader, so we can
       // kill the WHOLE tree (claude → node → git …) with process.kill(-pid) on
       // cancel/timeout instead of orphaning its subprocesses.
-      child = spawn(cmd, args, { cwd, detached: true });
+      // stdin MUST be 'ignore' (/dev/null → instant EOF), never a dangling pipe:
+      // `codex exec` appends piped stdin to its prompt and blocks until EOF, so
+      // an open pipe hangs it until the run timeout ("Reading additional input
+      // from stdin…"). Nothing we spawn is ever fed via stdin.
+      // Always strip hilos's own token from the child's env (see scrubHilosEnv).
+      child = spawn(cmd, args, {
+        cwd,
+        detached: true,
+        stdio: ["ignore", "pipe", "pipe"],
+        env: scrubHilosEnv(env || process.env),
+      });
     } catch (error) {
       resolve({ status: null, stdout: "", stderr: "", error });
       return;
@@ -193,3 +289,27 @@ export function runCli(opts) {
     child.on("close", (code) => finish(code, null));
   });
 }
+
+// Compat retry (0572): Cursor CLIs older than Jan 2026 predate the workspace-
+// trust gate and reject the `--trust` flag we now bake into cursor commands
+// (`error: unknown option '--trust'`). Those CLIs don't NEED the flag (no gate
+// existed), so on that exact failure runCli retries ONCE with it stripped. The
+// failed attempt writes only the commander error to stderr — stdout stays
+// empty — so progress streaming (onData) never sees the false start. Lives
+// inside runCli (not a wrapper) so every call site, present and future, gets it.
+const UNKNOWN_TRUST_RE = /unknown option '--trust'/;
+
+/** @param {RunCliOptions} opts */
+export async function runCli(opts) {
+  const first = await runCliOnce(opts);
+  const args = Array.isArray(opts?.args) ? opts.args : [];
+  if (
+    first.status !== 0 &&
+    !first.aborted &&
+    args.includes("--trust") &&
+    UNKNOWN_TRUST_RE.test(first.stderr || "")
+  ) {
+    return runCliOnce({ ...opts, args: args.filter((a) => a !== "--trust") });
+  }
+  return first;
+}

package/src/config.mjs

@@ -48,15 +48,36 @@ const DEFAULTS = {
   // folder on this machine. Changes apply directly (no branch/PR). Live-reloadable
   // like `repos`. Shape: { "<channelId>": "/abs/path" }.
   folders: {},
+  // Optional local-folder deploy target. Outward deploys are always triggered
+  // explicitly by a request or report-card action; this only chooses provider
+  // and preview (default) vs production. Shape:
+  // { "<channelId>": { provider: "vercel" | "netlify", prod: false } }.
+  deploy: {},
   // acceptEdits lets the CLI make file edits without prompting (bias to action);
   // it still won't run arbitrary commands. Override in hilos-agent.json if you
   // want a stricter (or `--dangerously-skip-permissions`) command.
   codingCmd: "claude -p --permission-mode acceptEdits",
-  // Chat replies + the code-task plan-ack use a FAST one-shot model so a casual
+  // Environment handed to the coding/chat CLI. hilos's own token (HILOS_*) is
+  // ALWAYS stripped either way. "inherit" (default) passes the rest of your
+  // shell env so the coding tool behaves exactly as if you ran it yourself.
+  // "minimal" hands the child only what it needs to run + reach its own model
+  // provider (PATH/HOME/locale + ANTHROPIC_*/OPENAI_*/… ), dropping unrelated
+  // secrets (AWS/DB/SSH-agent/etc.) so a task can't sweep them up. Widen minimal
+  // mode with codingEnvAllow: ["MY_VAR", …].
+  codingEnv: "inherit",
+  codingEnvAllow: [],
+  // Model preset TIER for the coding run ("" / "default" = the tool's own
+  // default). "opus" | "sonnet" | "haiku" resolve at RUN time against the
+  // CLI's own model list — never a baked id that could 404 on another account
+  // (0504; cursor only today, see model-resolve.mjs).
+  codingModel: "",
+  // Chat replies + the code-task plan-ack use a FAST one-shot command so a casual
   // reply (or "I see it, here's my plan") comes back in seconds, not minutes.
   // Bounded by chatTimeoutMs with a template fallback so it can never dead-air.
-  // If your coding stack isn't Claude, set this to your own fast reply command.
-  chatCmd: "claude -p --model claude-haiku-4-5",
+  // Empty = derive from codingCmd's vendor (fastChatCmd in progress-emitter.mjs),
+  // so a Codex/Cursor daemon chats with ITS OWN tool — Claude Code is never
+  // required just because it's hilos's default. Set explicitly to override.
+  chatCmd: "",
   defaultBranch: "main",
   // Bias to action: open a PR directly for review (approve = merge on the card).
   // Set gate:true for the older approve-before-push flow (propose a diff, wait).
@@ -96,6 +117,7 @@ export function resolveConfig({ flags = {}, join: joinPayload } = {}) {
     token: process.env.HILOS_TOKEN,
     channelId: process.env.HILOS_CHANNEL,
     codingCmd: process.env.CODING_CMD,
+    codingModel: process.env.HILOS_CODING_MODEL,
     chatCmd: process.env.HILOS_CHAT_CMD,
     heartbeatMs: process.env.HILOS_HEARTBEAT_MS ? Number(process.env.HILOS_HEARTBEAT_MS) : undefined,
     progressMs: process.env.HILOS_PROGRESS_MS ? Number(process.env.HILOS_PROGRESS_MS) : undefined,
@@ -118,8 +140,13 @@ export function resolveConfig({ flags = {}, join: joinPayload } = {}) {
   merged.repos = { ...DEFAULTS.repos, ...(file.repos || {}) };
   // Local-folder map, merged like `repos` (an object, not a scalar overlay).
   merged.folders = { ...DEFAULTS.folders, ...(file.folders || {}) };
-  // Remember where the file lives so reloadConfig can re-read it live.
+  merged.deploy = { ...DEFAULTS.deploy, ...(file.deploy || {}) };
+  // Remember where the file lives so reloadConfig can re-read it live, and
+  // what it said AT LAUNCH so reload only applies fields the user actually
+  // edited afterwards (0576) — a pre-existing file value must not claw back
+  // an explicit launch flag (--coding-cmd / --coding-model) on the first poll.
   merged.configPath = findConfigPath(flags.config) || null;
+  merged.fileSnapshot = file;
   return merged;
 }
 
@@ -128,7 +155,10 @@ export function resolveConfig({ flags = {}, join: joinPayload } = {}) {
 // edited file can NEVER drop the daemon's connection.
 const LIVE_FIELDS = [
   "codingCmd",
+  "codingModel",
   "chatCmd",
+  "codingEnv",
+  "codingEnvAllow",
   "defaultBranch",
   "gate",
   "maxRounds",
@@ -146,6 +176,7 @@ const LIVE_FIELDS = [
   // live merge (with DEFAULTS) happens in the special-cased block below, exactly
   // like `repos`, so a partial edit doesn't drop the defaults.
   "folders",
+  "deploy",
 ];
 
 /**
@@ -162,8 +193,17 @@ export function reloadConfig(prev) {
   const path = prev.configPath;
   const file = (path && readJson(path)) || {};
   const next = { ...prev };
-  for (const k of LIVE_FIELDS) if (file[k] !== undefined) next[k] = file[k];
+  // Apply only fields that CHANGED since the launch snapshot (or the last
+  // reload): an EDIT to hilos-agent.json wins live, as documented, but a value
+  // that merely pre-existed at launch can't override the flags the user just
+  // pasted (`--coding-cmd`/`--coding-model` on a machine with an older config
+  // silently flipped back on the first poll — 0576 review finding).
+  const snap = prev.fileSnapshot || {};
+  const changed = (k) => JSON.stringify(file[k]) !== JSON.stringify(snap[k]);
+  for (const k of LIVE_FIELDS) if (file[k] !== undefined && changed(k)) next[k] = file[k];
+  next.fileSnapshot = file;
   if (process.env.CODING_CMD) next.codingCmd = process.env.CODING_CMD;
+  if (process.env.HILOS_CODING_MODEL) next.codingModel = process.env.HILOS_CODING_MODEL;
   if (process.env.HILOS_CHAT_CMD) next.chatCmd = process.env.HILOS_CHAT_CMD;
   if (process.env.HILOS_HEARTBEAT_MS) next.heartbeatMs = Number(process.env.HILOS_HEARTBEAT_MS);
   if (process.env.HILOS_PROGRESS_MS) next.progressMs = Number(process.env.HILOS_PROGRESS_MS);
@@ -174,6 +214,7 @@ export function reloadConfig(prev) {
   // Merge the folder map like repos (overriding the raw scalar-loop assignment
   // above with a proper DEFAULTS-merged object).
   if (file.folders) next.folders = { ...DEFAULTS.folders, ...file.folders };
+  if (file.deploy) next.deploy = { ...DEFAULTS.deploy, ...file.deploy };
   return next;
 }
 
@@ -187,6 +228,7 @@ export function writeStarterConfig(path, partial = {}) {
     channelId: partial.channelId || "",
     repos: partial.repos || { "owner/name": "/absolute/path/to/checkout" },
     codingCmd: partial.codingCmd || DEFAULTS.codingCmd,
+    ...(partial.codingModel ? { codingModel: partial.codingModel } : {}),
     defaultBranch: DEFAULTS.defaultBranch,
     // false = open a PR directly (bias to action); true = approve-before-push.
     gate: false,