hilos-agent 0.5.1 → 0.7.0

package/src/handler.mjs

@@ -26,11 +26,29 @@ import {
   mentionHandle,
   detectPrContinuation,
 } from "./daemon.mjs";
-import { runCli, buildHeartbeat, ackText, oneLine, fmtElapsed, minimalEnv } from "./cli.mjs";
+import {
+  runCli,
+  buildHeartbeat,
+  ackText,
+  oneLine,
+  fmtElapsed,
+  minimalEnv,
+  scrubHilosEnv,
+  envForCwd,
+} from "./cli.mjs";
 import { makeStreamParser } from "./agent-events.mjs";
-import { detectVendor, codeStreamArgs, createProgressEmitter, fastChatCmd } from "./progress-emitter.mjs";
+import {
+  detectVendor,
+  codeStreamArgs,
+  codeDirArgs,
+  codeProjectKey,
+  attachTarget,
+  createProgressEmitter,
+  fastChatCmd,
+} from "./progress-emitter.mjs";
 import { resolveFollowupMode, classifyFollowupCue, normalizeSignal } from "./followup.mjs";
-import { buildResumeArgs, readStateEntry, writeState, HILOS_DIR } from "./resume.mjs";
+import { buildResumeArgs, resumeDecision, readStateEntry, writeState, HILOS_DIR } from "./resume.mjs";
+import { createModelArgsResolver } from "./model-resolve.mjs";
 import {
   buildReviewPrompt,
   parseReviewOutput,
@@ -39,6 +57,7 @@ import {
 } from "./review.mjs";
 import { buildMemoryBlock } from "./memory.mjs";
 import { deployFolder, resolveDeployTarget } from "./deploy.mjs";
+import { runOpenCodeHttpSession } from "./opencode-session.mjs";
 
 /**
  * The environment for a coding/chat CLI run. runCli always strips HILOS_* on top
@@ -75,6 +94,10 @@ function prNumberFromUrl(url) {
 // human re-triggering the review is the escape hatch past the cap.
 const reviewRounds = new Map();
 
+// Tier → account-verified `--model` args for the code run (0504). Memoized per
+// (binary, tier) for the process; a failed lookup emits [] and retries later.
+const modelArgsFor = createModelArgsResolver({ run: (opts) => runCli(opts) });
+
 
 // Sentinel the router model emits (only when a thread already owns a run) to
 // classify a follow-up: change | new-scope | ambiguous. Parsed out of the router
@@ -115,14 +138,20 @@ function compactRunMarker(status, branch) {
   return `Failed:${b}`;
 }
 
+// Every helper below runs a tool in a directory we choose, so each one hands
+// the child a PWD that matches that directory instead of the daemon's launch
+// dir (0615). git and gh both use the real cwd, so this is hygiene rather than
+// a fix — but a child whose env contradicts its cwd is wrong on any tool.
+const cwdEnv = (cwd) => envForCwd(process.env, cwd);
+
 function defaultDeps() {
   return {
     git: (cwd, args) =>
-      spawnSync("git", args, { cwd, encoding: "utf8", maxBuffer: 50 * 1024 * 1024 }),
-    // The async CLI runner, injectable so folder mode (and tests) can drive the
-    // coding run without spawning a real process. The repo flow still uses the
-    // imported runCli directly (unchanged); only folder mode goes through deps.
+      spawnSync("git", args, { cwd, env: cwdEnv(cwd), encoding: "utf8", maxBuffer: 50 * 1024 * 1024 }),
+    // Async coding runners are injectable so handler-level tests can prove the
+    // selected trust boundary without spawning a real model process.
     runCli: (opts) => runCli(opts),
+    runOpenCodeHttpSession: (opts) => runOpenCodeHttpSession(opts),
     // Does a path exist on disk? Injectable so folder mode's "missing folder"
     // guard is unit-testable without touching the real filesystem.
     pathExists: (p) => existsSync(p),
@@ -132,7 +161,7 @@ function defaultDeps() {
       const r = spawnSync(
         "gh",
         ["pr", "create", "--title", title, "--body", body, "--head", branch, "--base", base],
-        { cwd, encoding: "utf8" },
+        { cwd, env: cwdEnv(cwd), encoding: "utf8" },
       );
       const url = (r.stdout || "").trim().split("\n").filter(Boolean).pop() || null;
       return { ok: r.status === 0, url, stderr: r.stderr || "" };
@@ -143,7 +172,7 @@ function defaultDeps() {
       const r = spawnSync(
         "gh",
         ["pr", "list", "--head", branch, "--state", "open", "--json", "url", "--jq", ".[0].url // empty"],
-        { cwd, encoding: "utf8" },
+        { cwd, env: cwdEnv(cwd), encoding: "utf8" },
       );
       const url = (r.stdout || "").trim();
       return r.status === 0 && url ? url : null;
@@ -155,7 +184,7 @@ function defaultDeps() {
       const r = spawnSync(
         "gh",
         ["pr", "view", String(ref), "--json", "headRefName", "--jq", ".headRefName // empty"],
-        { cwd, encoding: "utf8" },
+        { cwd, env: cwdEnv(cwd), encoding: "utf8" },
       );
       const out = (r.stdout || "").trim();
       return r.status === 0 && out ? out : null;
@@ -165,6 +194,80 @@ function defaultDeps() {
   };
 }
 
+/**
+ * Bind one OpenCode HTTP session to hilos's vendor-neutral permission tools.
+ * Both repo and direct-folder runs use this exact callback contract so neither
+ * path can accidentally become the ungated exception.
+ */
+function openCodePermissionCallbacks({ tool, channelId, threadRoot, runId = null }) {
+  return {
+    requestPermission: async (request) => {
+      const detail =
+        request.metadata && typeof request.metadata === "object"
+          ? request.metadata
+          : {};
+      const title = [
+        detail.title,
+        detail.description,
+        detail.command,
+        request.resources?.[0],
+      ].find((value) => typeof value === "string" && value.trim());
+      return tool("request_permission", {
+        channelId,
+        threadRootId: threadRoot,
+        ...(runId ? { runId } : {}),
+        provider: "opencode",
+        vendorSessionId: request.sessionId,
+        vendorRequestId: request.vendorRequestId,
+        action: request.action,
+        title: title || `${request.action} permission`,
+        resources: request.resources,
+        suggestedSave: request.suggestedSave,
+        metadata: detail,
+        ...(request.source ? { source: request.source } : {}),
+      });
+    },
+    getPermissionDecision: async (handle, { request, failClosed = false }) => {
+      const requestId =
+        handle &&
+        typeof handle === "object" &&
+        typeof handle.requestId === "string"
+          ? handle.requestId
+          : null;
+      if (!requestId) {
+        throw new Error(
+          "hilos returned a pending permission without a request id",
+        );
+      }
+      return tool("get_permission_decision", {
+        requestId,
+        provider: "opencode",
+        vendorSessionId: request.sessionId,
+        vendorRequestId: request.vendorRequestId,
+        ...(failClosed ? { failClosed: true } : {}),
+      });
+    },
+  };
+}
+
+/** The local HTTP bridge can own only a local OpenCode server. An explicit
+ * `--attach` remains on OpenCode's CLI responder, which rejects unanswered asks
+ * fail closed; taking over a remote server requires a separate authenticated
+ * transport contract. Shared by repo and direct-folder runs. */
+export function shouldUseRuntimePermissionBridge({
+  vendor,
+  runtimePermissions,
+  codeArgs,
+  codingCmd,
+}) {
+  return (
+    vendor === "opencode" &&
+    runtimePermissions === true &&
+    !codeArgs.includes("--auto") &&
+    attachTarget(codingCmd) === null
+  );
+}
+
 async function awaitDecision({ tool, channelId, reportMessageId, cfg, deps, parentId, signal }) {
   if (!reportMessageId) return { kind: "timeout" };
   const deadline = deps.now() + cfg.decisionTimeoutMs;
@@ -1272,34 +1375,74 @@ async function handleFolderTask({ message, channelId, tool, me, caps, cfg, deps,
       };
     }
     let run;
+    // Model preset (0504): same run-time resolution as the repo path.
+    const modelArgs = await modelArgsFor(cfg, vendor);
+    // Project pin (0608): opencode reads its project from PWD, so without this
+    // a folder run could edit the daemon's launch directory instead of the
+    // folder the channel is linked to. [] for every other vendor.
+    const dirArgs = codeDirArgs(vendor, folderPath, cfg.codingCmd);
+    const codeArgs = [
+      ...parts.slice(1),
+      ...modelArgs,
+      ...dirArgs,
+      ...streamArgs,
+    ];
+    const handleCliData = (c) => {
+      const lines = String(c).split("\n").map((s) => s.trim()).filter(Boolean);
+      if (lines.length) lastLine = lines[lines.length - 1];
+      if (resultParser) {
+        try {
+          foldResultEvents(resultParser.push(String(c)));
+        } catch {
+          /* result extraction must never break the run */
+        }
+      }
+      if (emitter) {
+        try {
+          emitter.feed(c);
+        } catch {
+          /* a progress fold must never break the run */
+        }
+      }
+    };
     try {
-      run = await deps.runCli({
-        cmd: parts[0],
-        args: [...parts.slice(1), ...streamArgs, memoryPreamble(workspaceMemory) + promptText],
-        cwd: folderPath,
-        timeoutMs: cfg.runTimeoutMs,
-        label: "coding",
-        signal,
-        env: codingChildEnv(cfg),
-        onData: (c) => {
-          const lines = String(c).split("\n").map((s) => s.trim()).filter(Boolean);
-          if (lines.length) lastLine = lines[lines.length - 1];
-          if (resultParser) {
-            try {
-              foldResultEvents(resultParser.push(String(c)));
-            } catch {
-              /* result extraction must never break the run */
-            }
-          }
-          if (emitter) {
-            try {
-              emitter.feed(c);
-            } catch {
-              /* a progress fold must never break the run */
-            }
-          }
-        },
+      const useRuntimePermissionBridge = shouldUseRuntimePermissionBridge({
+        vendor,
+        runtimePermissions: caps.runtimePermissions,
+        codeArgs,
+        codingCmd: cfg.codingCmd,
       });
+      if (useRuntimePermissionBridge) {
+        run = await deps.runOpenCodeHttpSession({
+          cmd: parts[0],
+          args: codeArgs,
+          cwd: folderPath,
+          prompt: memoryPreamble(workspaceMemory) + promptText,
+          timeoutMs: cfg.runTimeoutMs,
+          signal,
+          env: scrubHilosEnv(codingChildEnv(cfg) || process.env),
+          onData: handleCliData,
+          ...openCodePermissionCallbacks({
+            tool,
+            channelId,
+            threadRoot,
+          }),
+        });
+      } else {
+        run = await deps.runCli({
+          cmd: parts[0],
+          args: [
+            ...codeArgs,
+            memoryPreamble(workspaceMemory) + promptText,
+          ],
+          cwd: folderPath,
+          timeoutMs: cfg.runTimeoutMs,
+          label: "coding",
+          signal,
+          env: codingChildEnv(cfg),
+          onData: handleCliData,
+        });
+      }
     } finally {
       stopHeartbeat();
       if (emitter) {
@@ -2030,7 +2173,7 @@ export async function handleTask({ message, channelId, tool, me, caps = {} }, cf
         branch,
         // Map an unrecognized command to null rather than the off-vocabulary
         // "unknown" — provider is documented as
-        // claude_code|codex|cursor|antigravity|hermes|hilos.
+        // claude_code|codex|cursor|opencode|antigravity|hermes|hilos.
         provider: (() => {
           const v = detectVendor(cfg.codingCmd);
           return v === "unknown" ? null : v;
@@ -2078,9 +2221,13 @@ export async function handleTask({ message, channelId, tool, me, caps = {} }, cf
   // (get_active_run) with no local match means the session likely lives on another
   // machine/instance — a bad `--resume` id makes claude error → empty diff → a failed
   // run, so we DON'T resume and degrade to today's branch+feedback (never worse).
-  // Only claude_code has a proven resume flag; codex/cursor/unknown → [] anyway.
+  // claude_code + cursor + opencode have proven resume flags (0282/0573/0608);
+  // codex/unknown → []. The gate itself is pure (resumeDecision in resume.mjs):
+  // vendor, machine, project and server agreement all have to line up, and any
+  // "no" degrades to the branch+feedback iterate rather than risking a bad id.
+  const projectKey = codeProjectKey(vendor, repoPath, cfg.codingCmd);
   let resumeSessionId = null;
-  if (effectiveMode === "iterate" && vendor === "claude_code") {
+  if (effectiveMode === "iterate") {
     const local = (() => {
       try {
         return readStateEntry(HILOS_DIR, threadRoot);
@@ -2089,14 +2236,18 @@ export async function handleTask({ message, channelId, tool, me, caps = {} }, cf
       }
     })();
     const serverSid = activeRun?.providerSessionId || null;
-    // Confidence = a local record, for THIS machine, with a session id. If the server
-    // also has one it must AGREE (a mismatch means the run moved — don't resume a
-    // stale/foreign id). A server-only id (no local record) is never resumed.
-    if (local && local.machine === machine && local.sessionId && (!serverSid || serverSid === local.sessionId)) {
-      resumeSessionId = local.sessionId;
-      console.log(`  code → resuming session ${local.sessionId} for this iterate (local + machine match)`);
-    } else if (serverSid) {
-      console.log("  code → not resuming (session recorded on another machine or unverified locally); using branch + feedback");
+    const decision = resumeDecision({
+      vendor,
+      entry: local,
+      serverSessionId: serverSid,
+      machine,
+      projectKey,
+    });
+    if (decision.sessionId) {
+      resumeSessionId = decision.sessionId;
+      console.log(`  code → resuming session ${decision.sessionId} for this iterate (local + machine match)`);
+    } else if (local?.sessionId || serverSid) {
+      console.log(`  code → not resuming (${decision.reason}); using branch + feedback`);
     }
   }
 
@@ -2209,34 +2360,79 @@ export async function handleTask({ message, channelId, tool, me, caps = {} }, cf
     // fallback) suppresses it. buildResumeArgs is [] unless vendor+session make
     // resume safe, so a non-resume run is byte-identical to the pre-0282 ARGV.
     const resumeArgs = resume ? buildResumeArgs(vendor, resumeSessionId) : [];
+    // Model preset (0504): resolved at run time against the CLI's own model
+    // list (cursor only today) — [] when unset/unresolvable, so the tool's
+    // default stands. Inserted before resume/stream flags, after the base.
+    const modelArgs = await modelArgsFor(cfg, vendor);
+    // Project pin (0608, opencode only): the CLI resolves its project from PWD,
+    // not the spawn cwd, and its sessions are per project — `--dir` makes both
+    // deterministic. [] for every other vendor (and for an `--attach`ed run,
+    // where the project lives on the remote server), so their ARGV is unchanged.
+    // The spawned PWD now matches the cwd too (0615); `--dir` stays as the
+    // CLI's own explicit contract, and to keep attach runs off our local path.
+    const dirArgs = codeDirArgs(vendor, repoPath, cfg.codingCmd);
     const codeArgs = streamOn
-      ? [...parts.slice(1), ...resumeArgs, ...streamArgs]
-      : [...parts.slice(1), ...resumeArgs];
+      ? [...parts.slice(1), ...modelArgs, ...dirArgs, ...resumeArgs, ...streamArgs]
+      : [...parts.slice(1), ...modelArgs, ...dirArgs, ...resumeArgs];
+    const handleCliData = (c) => {
+      // Keep tracking lastLine as a fallback (legacy heartbeat / honesty).
+      const lines = String(c).split("\n").map((s) => s.trim()).filter(Boolean);
+      if (lines.length) lastLine = lines[lines.length - 1];
+      if (emitter) {
+        try {
+          emitter.feed(c);
+        } catch {
+          /* a progress fold must never break the run */
+        }
+      }
+    };
     let run;
     try {
-      run = await runCli({
-        cmd: parts[0],
-        args: [...codeArgs, memoryPreamble(workspaceMemory) + promptText],
-        cwd: repoPath,
-        timeoutMs: cfg.runTimeoutMs,
-        label: "coding",
-        signal,
-        env: codingChildEnv(cfg),
-        onData: (c) => {
-          // Keep tracking lastLine as a fallback (legacy heartbeat / honesty).
-          const lines = String(c).split("\n").map((s) => s.trim()).filter(Boolean);
-          if (lines.length) lastLine = lines[lines.length - 1];
-          if (emitter) {
-            try {
-              emitter.feed(c);
-            } catch {
-              /* a progress fold must never break the run */
-            }
-          }
-        },
+      // OpenCode's own non-interactive CLI auto-rejects every permission ask
+      // unless --auto is present. For the gated tiers, bypass that responder
+      // and own the authenticated HTTP session + SSE stream directly so hilos
+      // is the sole authority answering the paused tool call (0593).
+      const useRuntimePermissionBridge = shouldUseRuntimePermissionBridge({
+        vendor,
+        runtimePermissions: caps.runtimePermissions,
+        codeArgs,
+        codingCmd: cfg.codingCmd,
       });
+      if (useRuntimePermissionBridge) {
+        run = await deps.runOpenCodeHttpSession({
+          cmd: parts[0],
+          args: codeArgs,
+          cwd: repoPath,
+          prompt: memoryPreamble(workspaceMemory) + promptText,
+          timeoutMs: cfg.runTimeoutMs,
+          signal,
+          // A model running inside the server must never inherit the daemon's
+          // hilos bearer token. The bridge's random loopback password is added
+          // after this scrub and dies with the process group.
+          env: scrubHilosEnv(codingChildEnv(cfg) || process.env),
+          onData: handleCliData,
+          ...openCodePermissionCallbacks({
+            tool,
+            channelId,
+            threadRoot,
+            runId,
+          }),
+        });
+      } else {
+        run = await runCli({
+          cmd: parts[0],
+          args: [...codeArgs, memoryPreamble(workspaceMemory) + promptText],
+          cwd: repoPath,
+          timeoutMs: cfg.runTimeoutMs,
+          label: "coding",
+          signal,
+          env: codingChildEnv(cfg),
+          onData: handleCliData,
+        });
+      }
     } finally {
       stopHeartbeat();
+      if (run?.sessionId) runSessionId = run.sessionId;
       if (emitter) {
         // Terminal state: flip the status card off "working" (state 'done'/'error')
         // so it stops claiming the agent is alive. For a run that produced work,
@@ -2344,6 +2540,11 @@ export async function handleTask({ message, channelId, tool, me, caps = {} }, cf
           prUrl: prUrl || continuingPrUrl || null,
           sessionId: sid,
           machine,
+          // The CLI that created the session (a `ses_…` is meaningless to
+          // claude's `--resume`) and the project it belongs to — opencode
+          // scopes sessions per project. The gate above requires both (0608).
+          vendor,
+          cwd: projectKey,
           updatedAt: new Date().toISOString(),
         });
       }

package/src/model-resolve.mjs

@@ -0,0 +1,99 @@
+// Runtime model-preset resolution (0504). The connect UI offers capability
+// TIERS (Most capable / Balanced / Fastest), but Cursor's model ids are
+// account- and plan-specific and churn weekly — a baked id that works for one
+// user 404s for another, which is why VENDOR_CLI.cursor.model stayed empty for
+// months. So the tier resolves HERE, at run time, against the account's OWN
+// `cursor-agent --list-models` output: we only ever emit an id the CLI itself
+// just listed, and when nothing matches we emit no flag at all (the tool's
+// default — `auto` routing — stands). Never a guessed id, never a wrong flag.
+//
+// Design rules (mirror the .mjs siblings): the parse/resolve transforms are
+// PURE + node-builtins-only; the resolver takes an injected `run` (runCli) so
+// tests drive it with no CLI; a resolution failure NEVER breaks a run ([]).
+//
+// codex stays out: its CLI has no verified model-list command (0504 notes).
+
+/** Strip ANSI SGR color codes (`--list-models` output is colorized). */
+export function stripAnsi(s) {
+  // eslint-disable-next-line no-control-regex
+  return String(s || "").replace(/\x1b\[[0-9;]*m/g, "");
+}
+
+/**
+ * Parse `cursor-agent --list-models` stdout → model ids, in list order.
+ * Wire shape captured live on 2026.07.23: a header line, then one
+ * `<id> - <Label>` line per model, colorized. Anything that doesn't match the
+ * `id - label` shape (headers, blanks) is skipped — a format drift degrades to
+ * [] and the preset silently falls back to the tool default.
+ * @param {string} stdout
+ * @returns {string[]}
+ */
+export function parseCursorModels(stdout) {
+  const ids = [];
+  for (const raw of String(stdout || "").split("\n")) {
+    const m = stripAnsi(raw).trim().match(/^(\S+)\s+-\s+\S/);
+    if (m) ids.push(m[1]);
+  }
+  return ids;
+}
+
+// Ranked preferences per tier, scanned in order — the first pattern with any
+// match wins, then the FIRST id in the account's list-order that matches it.
+// opus = the strongest reasoning family; sonnet ("Balanced") = Cursor's own
+// composer flagship (its default agent model) before a Claude sonnet;
+// haiku ("Fastest") = the -fast variants, composer first. `auto` never
+// matches (tier "default" emits no flag long before this table is consulted).
+const TIER_PREFS = {
+  opus: [/^claude-opus[\w.-]*thinking(?!.*fast)/, /^claude-opus(?!.*fast)/, /opus(?!.*fast)/],
+  sonnet: [/^composer(?!.*fast)/, /^claude-sonnet(?!.*fast)/, /sonnet(?!.*fast)/],
+  haiku: [/^composer.*fast/, /-fast$/],
+};
+
+/**
+ * Pick the account's model id for a tier, or null when nothing fits.
+ * @param {'opus'|'sonnet'|'haiku'|string} tier
+ * @param {string[]} ids
+ * @returns {string|null}
+ */
+export function resolveCursorModel(tier, ids) {
+  const prefs = TIER_PREFS[tier];
+  if (!prefs || !Array.isArray(ids)) return null;
+  for (const re of prefs) {
+    const hit = ids.find((id) => typeof id === "string" && re.test(id));
+    if (hit) return hit;
+  }
+  return null;
+}
+
+/**
+ * Build a memoized `modelArgsFor(cfg, vendor)` → `["--model", id]` or [].
+ * Emits [] (tool default) when: the vendor isn't cursor, no/default tier is
+ * configured, the user already pinned `--model` by hand in codingCmd, the
+ * list command fails, or nothing matches. Successful lookups are cached per
+ * (binary, tier) for the process lifetime; failures are NOT cached so a
+ * transient hiccup (offline, auth) retries on the next run.
+ *
+ * @param {{ run: (opts: object) => Promise<{status: number|null, stdout: string}> }} o
+ */
+export function createModelArgsResolver({ run } = {}) {
+  const cache = new Map();
+  return async function modelArgsFor(cfg, vendor) {
+    try {
+      const tier = String(cfg?.codingModel || "").trim();
+      if (vendor !== "cursor" || !tier || tier === "default") return [];
+      const cmd = String(cfg?.codingCmd || "");
+      if (/(^|\s)--model(\s|=)/.test(cmd + " ")) return []; // hand-pinned wins
+      const bin = cmd.trim().split(/\s+/)[0] || "cursor-agent";
+      const key = `${bin} ${tier}`;
+      if (cache.has(key)) return cache.get(key);
+      const r = await run({ cmd: bin, args: ["--list-models"], timeoutMs: 30000, heartbeatMs: 0 });
+      if (!r || r.status !== 0) return [];
+      const id = resolveCursorModel(tier, parseCursorModels(r.stdout));
+      const args = id ? ["--model", id] : [];
+      cache.set(key, args);
+      return args;
+    } catch {
+      return []; // resolution must never break a run
+    }
+  };
+}