hilos-agent 0.5.1 → 0.7.0

package/src/progress-emitter.mjs

@@ -21,18 +21,23 @@ import { createStepRing, sanitizeText } from "./agent-events.mjs";
 /**
  * Which parser/stream-flags a coding command wants, from its FIRST token.
  * `claude`/`claude-code` → claude_code, `codex` → codex,
- * `cursor`/`cursor-agent` → cursor, `agy`/`antigravity` → antigravity,
- * `hermes` → hermes, everything else → unknown. Handles an
- * absolute path (`/usr/local/bin/claude`) by taking the basename.
+ * `cursor`/`cursor-agent` → cursor, `opencode` → opencode,
+ * `agy`/`antigravity` → antigravity, `hermes` → hermes, everything else →
+ * unknown. Handles an absolute path (`/usr/local/bin/claude`) by taking the
+ * basename.
  * @param {string} codingCmd
- * @returns {'claude_code'|'codex'|'cursor'|'antigravity'|'hermes'|'unknown'}
+ * @returns {'claude_code'|'codex'|'cursor'|'opencode'|'antigravity'|'hermes'|'unknown'}
  */
 export function detectVendor(codingCmd) {
   const first = String(codingCmd || "").trim().split(/\s+/)[0] || "";
   const base = (first.split(/[/\\]/).pop() || "").toLowerCase();
   if (base === "claude" || base === "claude-code" || base === "claude_code") return "claude_code";
   if (base === "codex") return "codex";
-  if (base === "cursor" || base === "cursor-agent") return "cursor";
+  // `agent` is Cursor's canonical binary name since Jan 2026 (the installer
+  // symlinks both; `cursor-agent` remains an alias) — 0572.
+  if (base === "cursor" || base === "cursor-agent" || base === "agent") return "cursor";
+  // opencode installs a single `opencode` binary (~/.opencode/bin) — 0592.
+  if (base === "opencode") return "opencode";
   if (base === "agy" || base === "antigravity") return "antigravity";
   if (base === "hermes") return "hermes";
   return "unknown";
@@ -45,16 +50,21 @@ export function detectVendor(codingCmd) {
  * verified non-interactive print mode; the daemon appends the prompt as the last
  * arg. codex carries --skip-git-repo-check because chat (and the read-only
  * review sandbox) can run outside a git checkout. cursor carries
- * --output-format text because its -p default is stream-json, which would post
- * raw JSONL into the channel. Returns "" for unknown (caller falls back to
- * codingCmd).
- * @param {'claude_code'|'codex'|'cursor'|'antigravity'|'hermes'|'unknown'} vendor
+ * --output-format text (explicit, so a CLI default change can never post raw
+ * JSONL into the channel) and --trust (its Jan-2026 workspace-trust gate fails
+ * headless runs at spawn in untrusted directories — 0572; pre-2026 CLIs reject
+ * the flag and runCli retries without it). opencode carries no flags: `opencode
+ * run` IS its non-interactive mode (plain `opencode` opens the TUI), and its
+ * model comes from the user's own provider config (0592). Returns "" for
+ * unknown (caller falls back to codingCmd).
+ * @param {'claude_code'|'codex'|'cursor'|'opencode'|'antigravity'|'hermes'|'unknown'} vendor
  * @returns {string}
  */
 export function fastChatCmd(vendor) {
   if (vendor === "claude_code") return "claude -p --model claude-haiku-4-5";
   if (vendor === "codex") return "codex exec --skip-git-repo-check";
-  if (vendor === "cursor") return "cursor-agent -p --output-format text";
+  if (vendor === "cursor") return "cursor-agent -p --output-format text --trust";
+  if (vendor === "opencode") return "opencode run";
   if (vendor === "antigravity") return "agy -p";
   if (vendor === "hermes") return "hermes -z";
   return "";
@@ -62,18 +72,100 @@ export function fastChatCmd(vendor) {
 
 /**
  * Extra args to make the code run EMIT a structured stream, appended to the code
- * run's argv (NOT the display string) and ONLY for the code run. Only claude_code
- * has a proven flag (`--output-format stream-json --verbose`, per lib/agent-cli.ts
- * + scripts/verify-sandbox-mcp.mjs). codex/cursor return [] — their stream flags
+ * run's argv (NOT the display string) and ONLY for the code run. claude_code:
+ * `--output-format stream-json --verbose` (per lib/agent-cli.ts +
+ * scripts/verify-sandbox-mcp.mjs). cursor (0573): `--output-format stream-json`
+ * — appended AFTER the base's `--output-format text`, and live-verified on
+ * cursor-agent 2026.07.23 that the LAST occurrence wins, so the code run
+ * streams NDJSON while chat keeps text. codex returns [] — its stream flags
  * are deferred to 0278 rather than guessed (an unproven flag could break the run).
- * @param {'claude_code'|'codex'|'cursor'|'antigravity'|'hermes'|'unknown'} vendor
+ * opencode (0608): `--format json`. 0592 left it OFF because nothing parsed its
+ * event shape and the rawTail fallback drops JSON-looking lines; the
+ * agent-events parser now reads those events (steps, the final summary, and the
+ * `sessionID` that thread pinning needs), so it's a strict upgrade, not a
+ * liveness trade. The FAST chat path stays plain `opencode run` (prose, not NDJSON).
+ * @param {'claude_code'|'codex'|'cursor'|'opencode'|'antigravity'|'hermes'|'unknown'} vendor
  * @returns {string[]}
  */
 export function codeStreamArgs(vendor) {
   if (vendor === "claude_code") return ["--output-format", "stream-json", "--verbose"];
+  if (vendor === "cursor") return ["--output-format", "stream-json"];
+  if (vendor === "opencode") return ["--format", "json"];
   return [];
 }
 
+/**
+ * The server an `opencode run --attach <url>` command targets, or null for a
+ * normal local run. Read off the TOKENIZED command (never a substring match —
+ * the prompt is a separate argv entry, but a user's own `--attach` could
+ * otherwise be faked by prompt text). Supports both `--attach <url>` and
+ * `--attach=<url>`; an `--attach` with no value still counts as attached (the
+ * mode is what matters here, not the address).
+ * @param {string} codingCmd
+ * @returns {string|null}
+ */
+export function attachTarget(codingCmd) {
+  const tokens = String(codingCmd || "").trim().split(/\s+/).filter(Boolean);
+  for (let i = 0; i < tokens.length; i++) {
+    if (tokens[i] === "--attach") return tokens[i + 1] && !tokens[i + 1].startsWith("-") ? tokens[i + 1] : "";
+    if (tokens[i].startsWith("--attach=")) return tokens[i].slice("--attach=".length);
+  }
+  return null;
+}
+
+/**
+ * Extra args that PIN the code run to a project directory, appended to the code
+ * run's argv when the vendor needs it. opencode only (0608): live-verified on
+ * opencode 1.18.5 that it resolves its project from the environment's `PWD`
+ * rather than from the spawned process's cwd, so a daemon launched anywhere
+ * else runs the CLI against the WRONG directory — and its sessions are scoped
+ * per project, so a `--session` created under another directory HANGS the CLI
+ * instead of erroring. `--dir <cwd>` makes the project deterministic and equal
+ * to the directory we actually run in, which is what makes thread-to-session
+ * pinning sound. Every other vendor honors cwd → [].
+ *
+ * 0615 made the spawned env's `PWD` match the cwd on every path, so this is no
+ * longer the only thing holding opencode to the right directory. It stays: it
+ * is the CLI's own explicit contract for the project (an env var is a side
+ * channel), and it keeps the attach-mode distinction below meaningful.
+ *
+ * EXCEPTION — `--attach`: when the command attaches to a running opencode
+ * server, `--dir` means "a path on the REMOTE server", so handing it our local
+ * repo path would point the run at a directory that may not exist there. An
+ * attached server owns its own project, so we send nothing and let it decide.
+ * @param {'claude_code'|'codex'|'cursor'|'opencode'|'antigravity'|'hermes'|'unknown'} vendor
+ * @param {string} cwd
+ * @param {string} [codingCmd] — the full coding command, for the --attach check
+ * @returns {string[]}
+ */
+export function codeDirArgs(vendor, cwd, codingCmd = "") {
+  if (vendor !== "opencode") return [];
+  if (attachTarget(codingCmd) !== null) return []; // remote project — not ours to set
+  if (typeof cwd !== "string" || !cwd.trim()) return [];
+  return ["--dir", cwd];
+}
+
+/**
+ * The identity of the PROJECT a captured session belongs to — recorded with the
+ * session (0608) and required to match before a resume, because an opencode
+ * `--session` from a different project hangs the CLI. Locally that identity is
+ * the directory we run in; under `--attach` the project lives on the remote
+ * server, so the identity is that server (`attach:<url>`) — two threads pointed
+ * at different servers still can't cross sessions, and switching a command from
+ * local to attached (or between servers) correctly refuses to resume.
+ * Non-opencode vendors just record the directory.
+ * @param {'claude_code'|'codex'|'cursor'|'opencode'|'antigravity'|'hermes'|'unknown'} vendor
+ * @param {string} cwd
+ * @param {string} [codingCmd]
+ * @returns {string}
+ */
+export function codeProjectKey(vendor, cwd, codingCmd = "") {
+  const dir = typeof cwd === "string" ? cwd : "";
+  if (vendor !== "opencode") return dir;
+  const attached = attachTarget(codingCmd);
+  return attached === null ? dir : `attach:${attached}`;
+}
+
 // A raw stdout line that starts like JSON is the structured NDJSON we already
 // parse into steps — keep it OUT of the `lastLine` text fallback (which exists
 // for text-only CLIs), so a Claude run never surfaces raw JSON as its status.

package/src/resume.mjs

@@ -7,7 +7,8 @@
 // with full context.
 //
 // Two pieces, both PURE where it matters + node-builtins-only:
-//   1. buildResumeArgs(vendor, sessionId) — the vendor-gated `--resume` flags.
+//   1. buildResumeArgs(vendor, sessionId) — the vendor-gated resume flags
+//      (`--resume` for claude_code/cursor, `--session` for opencode — 0608).
 //   2. a tiny best-effort state store keyed by thread_root_msg_id at
 //      ~/.hilos/state.json. The LOCAL record proves a session exists on THIS
 //      machine — the confidence signal the handler gates `--resume` on (a
@@ -17,8 +18,9 @@
 //   - The pure transforms (parse/merge/prune/serialize) take an injected clock
 //     (nowMs) and never call Date.now/os, so they unit-test with a fixed time.
 //   - Every fs read/write is guarded: a state IO failure NEVER breaks a run.
-//   - We NEVER guess a vendor's resume flag. Only claude_code has a proven one;
-//     codex/cursor degrade to today's branch+feedback iterate (deferred to 0278+).
+//   - We NEVER guess a vendor's resume flag. claude_code, cursor and opencode
+//     have proven ones (0282/0573/0608); codex degrades to today's
+//     branch+feedback iterate (deferred to 0278+).
 
 import { readFileSync, writeFileSync, mkdirSync } from "node:fs";
 import { homedir } from "node:os";
@@ -32,25 +34,95 @@ export const STATE_FILE = "state.json";
  *  and a genuinely stale session can never be resurrected for a resume. */
 export const STATE_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000;
 
+/** opencode session ids are `ses_` + an opaque id (live-captured off
+ *  `opencode run --format json`, 1.18.5). The prefix is the cheap shape guard
+ *  that keeps a foreign id (a claude/cursor uuid inherited from an older state
+ *  entry) from ever reaching `--session`. */
+const OPENCODE_SESSION_RE = /^ses_[A-Za-z0-9_-]+$/;
+
 /**
- * The `--resume` flags for a coding vendor, or [] when resume isn't safe/known.
+ * The resume flags for a coding vendor, or [] when resume isn't safe/known.
  *
- * ONLY claude_code has a proven, confirmed resume flag (`--resume <id>`, compatible
- * with `--output-format stream-json`). codex/cursor have UNCONFIRMED resume flags,
- * so we emit NOTHING rather than guess — a wrong flag could break the run; they
- * degrade to today's branch+feedback iterate (deferred to 0278/later). A falsy or
+ * claude_code: `--resume <id>`, proven and compatible with
+ * `--output-format stream-json`. cursor (0573): `--resume <chatId>` —
+ * live-verified against cursor-agent 2026.07.23 that a resumed `-p` run
+ * answers from the prior session's context; the id is the `session_id` its
+ * stream-json init/result events carry. opencode (0608): `--session <ses_…>`
+ * — live-verified against opencode 1.18.5 that `opencode run -s <id> "…"`
+ * continues the pinned session non-interactively (a follow-up recalled what
+ * the first run did); the id is the `sessionID` every `--format json` event
+ * carries. Its `--fork` twin is deliberately NOT emitted: the daemon has no
+ * thread-branching semantics to map onto it today. codex has an UNCONFIRMED
+ * resume flag, so we emit NOTHING rather than guess — a wrong flag could break
+ * the run; it degrades to today's branch+feedback iterate. A falsy or
  * non-string sessionId also returns [] (nothing to resume).
  *
- * @param {'claude_code'|'codex'|'cursor'|'hermes'|'unknown'} vendor
+ * @param {'claude_code'|'codex'|'cursor'|'opencode'|'hermes'|'unknown'} vendor
  * @param {string|null|undefined} sessionId
  * @returns {string[]}
  */
 export function buildResumeArgs(vendor, sessionId) {
-  if (vendor !== "claude_code") return [];
   if (typeof sessionId !== "string" || !sessionId.trim()) return [];
+  if (vendor === "opencode") {
+    // A wrong id is not free here: an unknown id exits 1 ("Session not found"),
+    // and an id from ANOTHER project directory HANGS the CLI — so only pass a
+    // well-shaped one. The handler's project-dir gate covers the rest (0608).
+    return OPENCODE_SESSION_RE.test(sessionId.trim()) ? ["--session", sessionId.trim()] : [];
+  }
+  if (vendor !== "claude_code" && vendor !== "cursor") return [];
   return ["--resume", sessionId];
 }
 
+/** Vendors whose resume flag is proven (see buildResumeArgs). */
+const RESUMABLE_VENDORS = new Set(["claude_code", "cursor", "opencode"]);
+
+/**
+ * Should this iterate resume a recorded session? PURE — the handler passes what
+ * it read, this decides, so the whole gate is unit-testable.
+ *
+ * Confidence, in order: a resumable vendor, a LOCAL record (the proof the
+ * session lives on this machine — a providerSessionId that came only from the
+ * server likely belongs to another machine/instance), the same hostname, the
+ * same VENDOR, the same PROJECT, an id, and agreement with any server-side id.
+ * Anything short of that degrades to the branch+feedback iterate, which is only
+ * ever slower — never wrong.
+ *
+ * - vendor: an entry written by a different CLI holds a foreign id shape. Swap
+ *   `codingCmd` from opencode to claude between runs (the daemon hot-reloads
+ *   config) and a `ses_…` would reach `--resume`: a guaranteed failed
+ *   invocation. An entry written before 0608 has no vendor → degrade once, then
+ *   the next capture rewrites the entry with one.
+ * - project: opencode sessions are scoped per project, and a `--session` from
+ *   another project HANGS its CLI rather than erroring (0608). Only enforced
+ *   for opencode, whose entries carry the key; other vendors resume as before.
+ *
+ * @param {object} o
+ * @param {string} o.vendor — the CURRENT command's vendor
+ * @param {object|null} o.entry — the local state entry for this thread root
+ * @param {string|null} [o.serverSessionId] — activeRun.providerSessionId
+ * @param {string} o.machine — this hostname
+ * @param {string} [o.projectKey] — codeProjectKey() for the run we're about to do
+ * @returns {{ sessionId: string|null, reason: string }}
+ */
+export function resumeDecision({ vendor, entry, serverSessionId = null, machine, projectKey = "" }) {
+  if (!RESUMABLE_VENDORS.has(vendor)) return { sessionId: null, reason: "vendor-has-no-resume-flag" };
+  const local = entry && typeof entry === "object" ? entry : null;
+  if (!local || !local.sessionId) {
+    return { sessionId: null, reason: serverSessionId ? "no-local-record" : "nothing-recorded" };
+  }
+  if (local.machine !== machine) return { sessionId: null, reason: "recorded-on-another-machine" };
+  if (local.vendor !== vendor) {
+    return { sessionId: null, reason: local.vendor ? "recorded-by-another-vendor" : "vendor-not-recorded" };
+  }
+  if (vendor === "opencode" && local.cwd !== projectKey) {
+    return { sessionId: null, reason: local.cwd ? "recorded-in-another-project" : "project-not-recorded" };
+  }
+  if (serverSessionId && serverSessionId !== local.sessionId) {
+    return { sessionId: null, reason: "server-records-a-different-session" };
+  }
+  return { sessionId: local.sessionId, reason: "ok" };
+}
+
 // ---------------------------------------------------------------------------
 // Pure state transforms (no fs, no clock, no os — the caller injects nowMs).
 // ---------------------------------------------------------------------------
@@ -119,8 +191,12 @@ export function readStateEntry(dir, threadRoot) {
 /**
  * Write/overwrite the entry for `threadRoot`, pruning stale entries. Best-effort:
  * returns true on success, false on any failure (a state write NEVER breaks a run).
- * `entry` should carry { runId, branch, prUrl, sessionId, machine, updatedAt }; the
- * prune clock derives from entry.updatedAt (falling back to the injected now()).
+ * `entry` should carry { runId, branch, prUrl, sessionId, machine, vendor, cwd,
+ * updatedAt }; `vendor` is the CLI that created the session (an id is only valid
+ * for its own vendor) and `cwd` is the project key it belongs to — opencode
+ * sessions are scoped to a project, so its resume gate requires the match
+ * (0608). Both are read back by resumeDecision(). The prune clock derives from
+ * entry.updatedAt (falling back to the injected now()).
  *
  * @param {string} dir
  * @param {string} threadRoot

package/src/run.mjs

@@ -99,6 +99,11 @@ export async function run(cfg, { handler = handleTask, log = console, signal, on
     // Semantic local-folder intent (0515): the server guarantees a forced-tool
     // ask/ship/deploy decision. Older servers fall back to the local router.
     agentIntent: toolNames.includes("classify_agent_intent"),
+    // Harness-enforced runtime permission bridge (0593). Both tools are
+    // required: a request without a durable reply path must fail closed.
+    runtimePermissions:
+      toolNames.includes("request_permission") &&
+      toolNames.includes("get_permission_decision"),
   };
 
   // Register local folders (0324/0325): a folder-mode daemon announces each