hilos-agent 0.6.0 → 0.7.0

package/README.md

@@ -1,6 +1,6 @@
 # hilos-agent
 
-Run **your own** coding agent — Claude Code, Codex, Cursor, Hermes, or any command — as
+Run **your own** coding agent — Claude Code, Codex, Cursor, opencode, Hermes, or any command — as
 an autonomous teammate inside a [hilos](https://hilos.sh) channel.
 
 It connects to hilos over MCP, watches for `@mentions` of your agent in a
@@ -42,7 +42,7 @@ Running from elsewhere, or want to map several repos explicitly? Use a config:
   "url": "https://hilos.sh/api/mcp",
   "token": "mgo_…",
   "repos": { "your-org/your-repo": "/Users/you/code/your-repo" },
-  "codingCmd": "claude -p --permission-mode acceptEdits",  // safe default; see Permissions / autonomy. or "codex exec", "cursor-agent -p --output-format text --trust", "agy -p", any command
+  "codingCmd": "claude -p --permission-mode acceptEdits",  // safe default; see Permissions / autonomy. or "codex exec", "cursor-agent -p --output-format text --trust", "opencode run", "agy -p", any command
   "codingModel": "",  // model preset tier ("opus" | "sonnet" | "haiku") resolved at run time against the CLI's own model list (Cursor only today); "" = the tool's default
   "chatCmd": "",  // FAST command for chat replies + the plan-ack. Empty = derived from codingCmd's tool (codex daemons chat with codex, etc.); set to override
   "defaultBranch": "main",
@@ -187,6 +187,14 @@ explains what each permission level means.
 `codingCmd` decides how much the coding agent can do on its own. Three levels,
 safest first:
 
+- **`opencode run` (runtime-gated).** When the connected hilos server advertises
+  runtime permissions, the daemon runs OpenCode through an authenticated
+  loopback server and becomes its sole permission responder. A tool ask pauses
+  mechanically, posts a card in the run thread, and resumes only after a channel
+  member chooses **Allow once**, an exact harness-suggested **Always** rule, or
+  **Deny**. Missing transport, expiry, and cancellation all reject the tool
+  call. `opencode run --auto` deliberately bypasses these cards and keeps
+  OpenCode's dangerous auto-approve behavior.
 - **`--permission-mode acceptEdits` (default).** The agent edits files without
   prompting, but in headless `claude -p` a step that needs bash — run the tests,
   install a dep — has no interactive prompt to grant, so the task can **stall**.
@@ -208,7 +216,10 @@ safest first:
 
 The default stays `acceptEdits`. Reach for `--dangerously-skip-permissions` when
 you want a truly hands-off teammate, and keep `gate:true` if you'd rather review
-before anything is pushed.
+before anything is pushed. OpenCode is the first harness with the runtime-card
+bridge; Claude Code, Codex, Cursor, and other adapters still follow their own
+CLI permission modes until their native approval hooks join the same
+vendor-neutral hilos substrate.
 
 ## Hooks — stream a raw Claude Code session
 

package/bin/hilos-agent.mjs

@@ -16,10 +16,18 @@
 // codingCmd in hilos-agent.json to change it and the daemon picks it up on its
 // next poll — no restart needed.
 
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+
 import { resolveConfig, decodeJoin, writeStarterConfig, GLOBAL_CONFIG } from "../src/config.mjs";
 import { run } from "../src/run.mjs";
 import { hookMain, hooksMain } from "../src/hook.mjs";
 
+function packageVersion() {
+  const pkgPath = fileURLToPath(new URL("../package.json", import.meta.url));
+  return JSON.parse(readFileSync(pkgPath, "utf8")).version;
+}
+
 function parseArgs(argv) {
   const flags = {};
   const positional = [];
@@ -38,6 +46,7 @@ function parseArgs(argv) {
     else if (a === "--no-gate") flags.gate = false;
     else if (a === "--global") flags.global = true;
     else if (a === "-h" || a === "--help") flags.help = true;
+    else if (a === "-v" || a === "--version") flags.version = true;
     else positional.push(a);
   }
   return { cmd: positional[0] || "run", flags, positional };
@@ -57,7 +66,8 @@ Options:
   --channel <id>     watch only one channel (per-channel override)
   --config <path>    use a specific config file
   --coding-cmd <cmd> the coding agent to run — claude -p, codex exec,
-                     cursor-agent -p --trust, agy -p, hermes, or any command
+                     cursor-agent -p --trust, opencode run, agy -p, hermes,
+                     or any command
                      that takes a prompt as its last arg (default: "claude -p")
   --coding-model <tier>  model preset tier (opus | sonnet | haiku) resolved at
                      run time against the CLI's own model list — never a baked
@@ -68,12 +78,17 @@ Options:
   --once             one poll then exit (cron-friendly)
   --backfill         also act on mentions that predate startup
   --no-gate          propose only; don't wait for approval / push
+  -v, --version      print the installed version
   -h, --help         this help
 
 Docs: https://hilos.sh  ·  https://www.npmjs.com/package/hilos-agent`;
 
 async function main() {
   const { cmd, flags, positional } = parseArgs(process.argv.slice(2));
+  if (flags.version || cmd === "version") {
+    console.log(packageVersion());
+    return;
+  }
   if (flags.help || cmd === "help") {
     console.log(HELP);
     return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hilos-agent",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "Run your own coding agent (Claude Code / Codex / Cursor) as an autonomous teammate in a hilos channel. Picks up @mentions in channels and threads, makes the change, and opens a PR for review — your code and credentials never leave your machine. (Approve-before-push is available via gate:true.)",
   "type": "module",
   "bin": {

package/src/agent-events.mjs

@@ -2,7 +2,8 @@
 // alive" epic: coding CLIs each narrate their work in a different, unstable
 // wire format (Claude Code emits `--output-format stream-json` NDJSON, Codex
 // emits `--json` item events, Cursor emits its own `--output-format
-// stream-json` NDJSON — 0573). This module turns any of them into ONE small,
+// stream-json` NDJSON — 0573, opencode emits `--format json` part events —
+// 0608). This module turns any of them into ONE small,
 // typed `AgentEvent` stream the UI can render as a live "what the agent is
 // doing right now" card.
 //
@@ -272,12 +273,119 @@ function cursorToolEvent(toolCall) {
   return null;
 }
 
+/** One opencode `tool_use` part → an AgentEvent, or null. Tool names are
+ *  lowercase (`read`/`write`/`edit`/`patch`/`bash`); the arguments live under
+ *  `state.input` (`filePath` for file tools, `command` for bash). Anything else
+ *  (glob/grep/webfetch/task) carries less "alive" signal and is skipped, mirroring
+ *  toolKind()'s v1 restraint — an unknown tool never crashes the parser. */
+function opencodeToolEvent(part) {
+  if (!part || typeof part !== "object") return null;
+  const tool = typeof part.tool === "string" ? part.tool.toLowerCase() : "";
+  const state = part.state && typeof part.state === "object" ? part.state : {};
+  const input = state.input && typeof state.input === "object" ? state.input : {};
+  if (tool === "bash") {
+    const raw = input.command;
+    const cmd = typeof raw === "string" ? raw.replace(/\s+/g, " ").trim() : "";
+    return { t: "run", cmd: sanitizeText(cmd) };
+  }
+  if (tool === "write" || tool === "edit" || tool === "patch" || tool === "multiedit") {
+    const raw = input.filePath ?? input.file_path ?? input.path;
+    return { t: "edit", path: typeof raw === "string" ? sanitizeText(raw) : "" };
+  }
+  if (tool === "read") {
+    const raw = input.filePath ?? input.file_path ?? input.path;
+    return { t: "read", path: typeof raw === "string" ? sanitizeText(raw) : "" };
+  }
+  return null;
+}
+
+/**
+ * A stateful line parser for opencode `run --format json` NDJSON (0608).
+ *
+ * Shapes captured LIVE against opencode 1.18.5: EVERY event carries a top-level
+ * `sessionID` (`ses_…`) — including the very first `step_start` and the terminal
+ * `error` — which is exactly the id `--session` resumes. `text` events carry a
+ * WHOLE text part (`part.text`), not a delta, so a part is emitted once and a
+ * repeat of the same `part.id` with identical text is dropped (a growing part
+ * re-emits, so the room still sees the latest wording). `tool_use` events carry
+ * the tool + its input; they're deduped by `callID` so a state update can't
+ * double a step. `step_finish` closes an assistant turn (`part.reason`): `stop`
+ * ends the run, so it becomes the `result` carrying the last text as the summary
+ * (opencode has no separate result event, and the folder-run report reads that
+ * summary). `error` (`{ error: { name, data: { message } } }`) → a failed result.
+ *
+ * Stateful (last text, seen part/call ids) — hence a factory, not a bare fn.
+ */
+function makeOpencodeLineParser() {
+  const seenText = new Map(); // part.id → last emitted text
+  const seenCalls = new Set(); // tool callID
+  let sessionSeen = false;
+  let lastText = "";
+  return function parseOpencodeLine(line) {
+    const obj = tryParse(line);
+    if (!obj) return [];
+    const out = [];
+    // The session id rides on every event; emit it once, off whichever lands first.
+    if (!sessionSeen && typeof obj.sessionID === "string" && obj.sessionID) {
+      sessionSeen = true;
+      out.push({ t: "session", sessionId: sanitizeText(obj.sessionID) });
+    }
+    const part = obj.part && typeof obj.part === "object" ? obj.part : {};
+    switch (obj.type) {
+      case "text": {
+        const text = typeof part.text === "string" ? sanitizeText(part.text.replace(/\s+/g, " ").trim()) : "";
+        if (!text) break;
+        const id = typeof part.id === "string" ? part.id : "";
+        if (id && seenText.get(id) === text) break; // same part, same text → not news
+        if (id) {
+          seenText.set(id, text);
+          if (seenText.size > 200) seenText.delete(seenText.keys().next().value); // bound
+        }
+        lastText = text;
+        out.push({ t: "note", text });
+        break;
+      }
+      case "tool_use": {
+        const callId = typeof part.callID === "string" ? part.callID : "";
+        if (callId && seenCalls.has(callId)) break; // status updates repeat the call
+        if (callId) {
+          seenCalls.add(callId);
+          if (seenCalls.size > 500) seenCalls.delete(seenCalls.values().next().value); // bound
+        }
+        const ev = opencodeToolEvent(part);
+        if (ev) out.push(ev);
+        break;
+      }
+      case "step_finish": {
+        // Only the turn that stops ends the RUN; `tool-calls` means another
+        // assistant turn follows.
+        if (part.reason === "stop") {
+          out.push(lastText ? { t: "result", ok: true, summary: lastText } : { t: "result", ok: true });
+        }
+        break;
+      }
+      case "error": {
+        const err = obj.error && typeof obj.error === "object" ? obj.error : {};
+        const data = err.data && typeof err.data === "object" ? err.data : {};
+        const raw = typeof data.message === "string" ? data.message : typeof err.name === "string" ? err.name : "";
+        const summary = sanitizeText(raw);
+        out.push(summary ? { t: "result", ok: false, summary } : { t: "result", ok: false });
+        break;
+      }
+      default:
+        break;
+    }
+    return out;
+  };
+}
+
 /** claude / claude_code / claude-code all mean the Claude parser. */
 function normalizeVendor(vendor) {
   const v = String(vendor || "").toLowerCase();
   if (v === "claude" || v === "claude_code" || v === "claude-code") return "claude";
   if (v === "codex") return "codex";
   if (v === "cursor") return "cursor"; // structured stream-json since 0573
+  if (v === "opencode") return "opencode"; // structured `--format json` since 0608
   return "text"; // ANY unknown vendor → lastLine text-tail fallback
 }
 
@@ -345,7 +453,7 @@ function makeTextTailParser() {
 
 /**
  * Build a stateful stream parser for `vendor`.
- * @param {'claude'|'claude_code'|'codex'|'cursor'|string} vendor
+ * @param {'claude'|'claude_code'|'codex'|'cursor'|'opencode'|string} vendor
  * @returns {{ push: (chunk: string) => AgentEvent[], flush: () => AgentEvent[] }}
  */
 export function makeStreamParser(vendor) {
@@ -353,6 +461,9 @@ export function makeStreamParser(vendor) {
   if (v === "claude") return makeLineBufferedParser(parseClaudeLine);
   if (v === "codex") return makeLineBufferedParser(parseCodexLine);
   if (v === "cursor") return makeLineBufferedParser(parseCursorLine);
+  // opencode's line parser carries per-stream state (dedupe + last text), so
+  // each parser instance gets its own.
+  if (v === "opencode") return makeLineBufferedParser(makeOpencodeLineParser());
   return makeTextTailParser();
 }
 

package/src/cli.mjs

@@ -89,6 +89,33 @@ export function minimalEnv(base = process.env, extraAllow = []) {
   return out;
 }
 
+// ── PWD must match the directory we actually run in (0615) ───────────────────
+// A child spawned with `cwd` still inherits the PARENT's `PWD`, which names
+// wherever the daemon was launched. Most tools call getcwd() and never notice,
+// but some resolve their working project from the environment instead: live-
+// verified on opencode 1.18.5, which read, edited, and shelled in the daemon's
+// launch directory while hilos staged the diff in the repo clone ("no changes
+// produced"). An env that contradicts the real cwd is simply wrong, so every
+// spawn that sets `cwd` also sets `PWD` to it — and drops the inherited
+// `OLDPWD`, which is both meaningless to the child and a leak of where the
+// daemon lives. No cwd means the child inherits ours, so PWD is left alone.
+
+/**
+ * `base` with `PWD` pinned to `cwd` (and any inherited `OLDPWD` removed).
+ * Returns a copy; `base` is never mutated. A missing/blank `cwd` is a no-op.
+ * @param {Record<string, string | undefined>} base
+ * @param {string} [cwd]
+ * @returns {Record<string, string>}
+ */
+export function envForCwd(base, cwd) {
+  const out = { ...(base || {}) };
+  if (typeof cwd === "string" && cwd.trim()) {
+    out.PWD = cwd;
+    delete out.OLDPWD;
+  }
+  return out;
+}
+
 /** Human-readable elapsed time: "45s", "2m 3s". */
 export function fmtElapsed(ms) {
   const total = Math.max(0, Math.round(ms / 1000));
@@ -145,8 +172,9 @@ const MAX_CAPTURE_BYTES = 50 * 1024 * 1024;
  * @property {(chunk: string) => void} [onData] - called with each stdout chunk as
  *   it arrives (lets a caller track the latest output line for a heartbeat)
  * @property {Record<string, string>} [env] - base environment for the child. Any
- *   hilos-owned var (HILOS_*) is stripped from it regardless. Omit to inherit the
- *   daemon's environment minus HILOS_* (the safe default).
+ *   hilos-owned var (HILOS_*) is stripped from it regardless, and `PWD` is pinned
+ *   to `cwd` when one is set (0615). Omit to inherit the daemon's environment
+ *   minus HILOS_* (the safe default).
  */
 
 /**
@@ -188,12 +216,13 @@ function runCliOnce(opts) {
       // `codex exec` appends piped stdin to its prompt and blocks until EOF, so
       // an open pipe hangs it until the run timeout ("Reading additional input
       // from stdin…"). Nothing we spawn is ever fed via stdin.
-      // Always strip hilos's own token from the child's env (see scrubHilosEnv).
+      // Always strip hilos's own token from the child's env (see scrubHilosEnv),
+      // and keep PWD honest about the directory we run in (see envForCwd).
       child = spawn(cmd, args, {
         cwd,
         detached: true,
         stdio: ["ignore", "pipe", "pipe"],
-        env: scrubHilosEnv(env || process.env),
+        env: envForCwd(scrubHilosEnv(env || process.env), cwd),
       });
     } catch (error) {
       resolve({ status: null, stdout: "", stderr: "", error });