hilos-agent 0.6.0 → 0.7.0

package/src/handler.mjs

@@ -26,11 +26,28 @@ import {
   mentionHandle,
   detectPrContinuation,
 } from "./daemon.mjs";
-import { runCli, buildHeartbeat, ackText, oneLine, fmtElapsed, minimalEnv } from "./cli.mjs";
+import {
+  runCli,
+  buildHeartbeat,
+  ackText,
+  oneLine,
+  fmtElapsed,
+  minimalEnv,
+  scrubHilosEnv,
+  envForCwd,
+} from "./cli.mjs";
 import { makeStreamParser } from "./agent-events.mjs";
-import { detectVendor, codeStreamArgs, createProgressEmitter, fastChatCmd } from "./progress-emitter.mjs";
+import {
+  detectVendor,
+  codeStreamArgs,
+  codeDirArgs,
+  codeProjectKey,
+  attachTarget,
+  createProgressEmitter,
+  fastChatCmd,
+} from "./progress-emitter.mjs";
 import { resolveFollowupMode, classifyFollowupCue, normalizeSignal } from "./followup.mjs";
-import { buildResumeArgs, readStateEntry, writeState, HILOS_DIR } from "./resume.mjs";
+import { buildResumeArgs, resumeDecision, readStateEntry, writeState, HILOS_DIR } from "./resume.mjs";
 import { createModelArgsResolver } from "./model-resolve.mjs";
 import {
   buildReviewPrompt,
@@ -40,6 +57,7 @@ import {
 } from "./review.mjs";
 import { buildMemoryBlock } from "./memory.mjs";
 import { deployFolder, resolveDeployTarget } from "./deploy.mjs";
+import { runOpenCodeHttpSession } from "./opencode-session.mjs";
 
 /**
  * The environment for a coding/chat CLI run. runCli always strips HILOS_* on top
@@ -120,14 +138,20 @@ function compactRunMarker(status, branch) {
   return `Failed:${b}`;
 }
 
+// Every helper below runs a tool in a directory we choose, so each one hands
+// the child a PWD that matches that directory instead of the daemon's launch
+// dir (0615). git and gh both use the real cwd, so this is hygiene rather than
+// a fix — but a child whose env contradicts its cwd is wrong on any tool.
+const cwdEnv = (cwd) => envForCwd(process.env, cwd);
+
 function defaultDeps() {
   return {
     git: (cwd, args) =>
-      spawnSync("git", args, { cwd, encoding: "utf8", maxBuffer: 50 * 1024 * 1024 }),
-    // The async CLI runner, injectable so folder mode (and tests) can drive the
-    // coding run without spawning a real process. The repo flow still uses the
-    // imported runCli directly (unchanged); only folder mode goes through deps.
+      spawnSync("git", args, { cwd, env: cwdEnv(cwd), encoding: "utf8", maxBuffer: 50 * 1024 * 1024 }),
+    // Async coding runners are injectable so handler-level tests can prove the
+    // selected trust boundary without spawning a real model process.
     runCli: (opts) => runCli(opts),
+    runOpenCodeHttpSession: (opts) => runOpenCodeHttpSession(opts),
     // Does a path exist on disk? Injectable so folder mode's "missing folder"
     // guard is unit-testable without touching the real filesystem.
     pathExists: (p) => existsSync(p),
@@ -137,7 +161,7 @@ function defaultDeps() {
       const r = spawnSync(
         "gh",
         ["pr", "create", "--title", title, "--body", body, "--head", branch, "--base", base],
-        { cwd, encoding: "utf8" },
+        { cwd, env: cwdEnv(cwd), encoding: "utf8" },
       );
       const url = (r.stdout || "").trim().split("\n").filter(Boolean).pop() || null;
       return { ok: r.status === 0, url, stderr: r.stderr || "" };
@@ -148,7 +172,7 @@ function defaultDeps() {
       const r = spawnSync(
         "gh",
         ["pr", "list", "--head", branch, "--state", "open", "--json", "url", "--jq", ".[0].url // empty"],
-        { cwd, encoding: "utf8" },
+        { cwd, env: cwdEnv(cwd), encoding: "utf8" },
       );
       const url = (r.stdout || "").trim();
       return r.status === 0 && url ? url : null;
@@ -160,7 +184,7 @@ function defaultDeps() {
       const r = spawnSync(
         "gh",
         ["pr", "view", String(ref), "--json", "headRefName", "--jq", ".headRefName // empty"],
-        { cwd, encoding: "utf8" },
+        { cwd, env: cwdEnv(cwd), encoding: "utf8" },
       );
       const out = (r.stdout || "").trim();
       return r.status === 0 && out ? out : null;
@@ -170,6 +194,80 @@ function defaultDeps() {
   };
 }
 
+/**
+ * Bind one OpenCode HTTP session to hilos's vendor-neutral permission tools.
+ * Both repo and direct-folder runs use this exact callback contract so neither
+ * path can accidentally become the ungated exception.
+ */
+function openCodePermissionCallbacks({ tool, channelId, threadRoot, runId = null }) {
+  return {
+    requestPermission: async (request) => {
+      const detail =
+        request.metadata && typeof request.metadata === "object"
+          ? request.metadata
+          : {};
+      const title = [
+        detail.title,
+        detail.description,
+        detail.command,
+        request.resources?.[0],
+      ].find((value) => typeof value === "string" && value.trim());
+      return tool("request_permission", {
+        channelId,
+        threadRootId: threadRoot,
+        ...(runId ? { runId } : {}),
+        provider: "opencode",
+        vendorSessionId: request.sessionId,
+        vendorRequestId: request.vendorRequestId,
+        action: request.action,
+        title: title || `${request.action} permission`,
+        resources: request.resources,
+        suggestedSave: request.suggestedSave,
+        metadata: detail,
+        ...(request.source ? { source: request.source } : {}),
+      });
+    },
+    getPermissionDecision: async (handle, { request, failClosed = false }) => {
+      const requestId =
+        handle &&
+        typeof handle === "object" &&
+        typeof handle.requestId === "string"
+          ? handle.requestId
+          : null;
+      if (!requestId) {
+        throw new Error(
+          "hilos returned a pending permission without a request id",
+        );
+      }
+      return tool("get_permission_decision", {
+        requestId,
+        provider: "opencode",
+        vendorSessionId: request.sessionId,
+        vendorRequestId: request.vendorRequestId,
+        ...(failClosed ? { failClosed: true } : {}),
+      });
+    },
+  };
+}
+
+/** The local HTTP bridge can own only a local OpenCode server. An explicit
+ * `--attach` remains on OpenCode's CLI responder, which rejects unanswered asks
+ * fail closed; taking over a remote server requires a separate authenticated
+ * transport contract. Shared by repo and direct-folder runs. */
+export function shouldUseRuntimePermissionBridge({
+  vendor,
+  runtimePermissions,
+  codeArgs,
+  codingCmd,
+}) {
+  return (
+    vendor === "opencode" &&
+    runtimePermissions === true &&
+    !codeArgs.includes("--auto") &&
+    attachTarget(codingCmd) === null
+  );
+}
+
 async function awaitDecision({ tool, channelId, reportMessageId, cfg, deps, parentId, signal }) {
   if (!reportMessageId) return { kind: "timeout" };
   const deadline = deps.now() + cfg.decisionTimeoutMs;
@@ -1279,34 +1377,72 @@ async function handleFolderTask({ message, channelId, tool, me, caps, cfg, deps,
     let run;
     // Model preset (0504): same run-time resolution as the repo path.
     const modelArgs = await modelArgsFor(cfg, vendor);
+    // Project pin (0608): opencode reads its project from PWD, so without this
+    // a folder run could edit the daemon's launch directory instead of the
+    // folder the channel is linked to. [] for every other vendor.
+    const dirArgs = codeDirArgs(vendor, folderPath, cfg.codingCmd);
+    const codeArgs = [
+      ...parts.slice(1),
+      ...modelArgs,
+      ...dirArgs,
+      ...streamArgs,
+    ];
+    const handleCliData = (c) => {
+      const lines = String(c).split("\n").map((s) => s.trim()).filter(Boolean);
+      if (lines.length) lastLine = lines[lines.length - 1];
+      if (resultParser) {
+        try {
+          foldResultEvents(resultParser.push(String(c)));
+        } catch {
+          /* result extraction must never break the run */
+        }
+      }
+      if (emitter) {
+        try {
+          emitter.feed(c);
+        } catch {
+          /* a progress fold must never break the run */
+        }
+      }
+    };
     try {
-      run = await deps.runCli({
-        cmd: parts[0],
-        args: [...parts.slice(1), ...modelArgs, ...streamArgs, memoryPreamble(workspaceMemory) + promptText],
-        cwd: folderPath,
-        timeoutMs: cfg.runTimeoutMs,
-        label: "coding",
-        signal,
-        env: codingChildEnv(cfg),
-        onData: (c) => {
-          const lines = String(c).split("\n").map((s) => s.trim()).filter(Boolean);
-          if (lines.length) lastLine = lines[lines.length - 1];
-          if (resultParser) {
-            try {
-              foldResultEvents(resultParser.push(String(c)));
-            } catch {
-              /* result extraction must never break the run */
-            }
-          }
-          if (emitter) {
-            try {
-              emitter.feed(c);
-            } catch {
-              /* a progress fold must never break the run */
-            }
-          }
-        },
+      const useRuntimePermissionBridge = shouldUseRuntimePermissionBridge({
+        vendor,
+        runtimePermissions: caps.runtimePermissions,
+        codeArgs,
+        codingCmd: cfg.codingCmd,
       });
+      if (useRuntimePermissionBridge) {
+        run = await deps.runOpenCodeHttpSession({
+          cmd: parts[0],
+          args: codeArgs,
+          cwd: folderPath,
+          prompt: memoryPreamble(workspaceMemory) + promptText,
+          timeoutMs: cfg.runTimeoutMs,
+          signal,
+          env: scrubHilosEnv(codingChildEnv(cfg) || process.env),
+          onData: handleCliData,
+          ...openCodePermissionCallbacks({
+            tool,
+            channelId,
+            threadRoot,
+          }),
+        });
+      } else {
+        run = await deps.runCli({
+          cmd: parts[0],
+          args: [
+            ...codeArgs,
+            memoryPreamble(workspaceMemory) + promptText,
+          ],
+          cwd: folderPath,
+          timeoutMs: cfg.runTimeoutMs,
+          label: "coding",
+          signal,
+          env: codingChildEnv(cfg),
+          onData: handleCliData,
+        });
+      }
     } finally {
       stopHeartbeat();
       if (emitter) {
@@ -2037,7 +2173,7 @@ export async function handleTask({ message, channelId, tool, me, caps = {} }, cf
         branch,
         // Map an unrecognized command to null rather than the off-vocabulary
         // "unknown" — provider is documented as
-        // claude_code|codex|cursor|antigravity|hermes|hilos.
+        // claude_code|codex|cursor|opencode|antigravity|hermes|hilos.
         provider: (() => {
           const v = detectVendor(cfg.codingCmd);
           return v === "unknown" ? null : v;
@@ -2085,9 +2221,13 @@ export async function handleTask({ message, channelId, tool, me, caps = {} }, cf
   // (get_active_run) with no local match means the session likely lives on another
   // machine/instance — a bad `--resume` id makes claude error → empty diff → a failed
   // run, so we DON'T resume and degrade to today's branch+feedback (never worse).
-  // claude_code + cursor have proven resume flags (0282/0573); codex/unknown → [].
+  // claude_code + cursor + opencode have proven resume flags (0282/0573/0608);
+  // codex/unknown → []. The gate itself is pure (resumeDecision in resume.mjs):
+  // vendor, machine, project and server agreement all have to line up, and any
+  // "no" degrades to the branch+feedback iterate rather than risking a bad id.
+  const projectKey = codeProjectKey(vendor, repoPath, cfg.codingCmd);
   let resumeSessionId = null;
-  if (effectiveMode === "iterate" && (vendor === "claude_code" || vendor === "cursor")) {
+  if (effectiveMode === "iterate") {
     const local = (() => {
       try {
         return readStateEntry(HILOS_DIR, threadRoot);
@@ -2096,14 +2236,18 @@ export async function handleTask({ message, channelId, tool, me, caps = {} }, cf
       }
     })();
     const serverSid = activeRun?.providerSessionId || null;
-    // Confidence = a local record, for THIS machine, with a session id. If the server
-    // also has one it must AGREE (a mismatch means the run moved — don't resume a
-    // stale/foreign id). A server-only id (no local record) is never resumed.
-    if (local && local.machine === machine && local.sessionId && (!serverSid || serverSid === local.sessionId)) {
-      resumeSessionId = local.sessionId;
-      console.log(`  code → resuming session ${local.sessionId} for this iterate (local + machine match)`);
-    } else if (serverSid) {
-      console.log("  code → not resuming (session recorded on another machine or unverified locally); using branch + feedback");
+    const decision = resumeDecision({
+      vendor,
+      entry: local,
+      serverSessionId: serverSid,
+      machine,
+      projectKey,
+    });
+    if (decision.sessionId) {
+      resumeSessionId = decision.sessionId;
+      console.log(`  code → resuming session ${decision.sessionId} for this iterate (local + machine match)`);
+    } else if (local?.sessionId || serverSid) {
+      console.log(`  code → not resuming (${decision.reason}); using branch + feedback`);
     }
   }
 
@@ -2220,34 +2364,75 @@ export async function handleTask({ message, channelId, tool, me, caps = {} }, cf
     // list (cursor only today) — [] when unset/unresolvable, so the tool's
     // default stands. Inserted before resume/stream flags, after the base.
     const modelArgs = await modelArgsFor(cfg, vendor);
+    // Project pin (0608, opencode only): the CLI resolves its project from PWD,
+    // not the spawn cwd, and its sessions are per project — `--dir` makes both
+    // deterministic. [] for every other vendor (and for an `--attach`ed run,
+    // where the project lives on the remote server), so their ARGV is unchanged.
+    // The spawned PWD now matches the cwd too (0615); `--dir` stays as the
+    // CLI's own explicit contract, and to keep attach runs off our local path.
+    const dirArgs = codeDirArgs(vendor, repoPath, cfg.codingCmd);
     const codeArgs = streamOn
-      ? [...parts.slice(1), ...modelArgs, ...resumeArgs, ...streamArgs]
-      : [...parts.slice(1), ...modelArgs, ...resumeArgs];
+      ? [...parts.slice(1), ...modelArgs, ...dirArgs, ...resumeArgs, ...streamArgs]
+      : [...parts.slice(1), ...modelArgs, ...dirArgs, ...resumeArgs];
+    const handleCliData = (c) => {
+      // Keep tracking lastLine as a fallback (legacy heartbeat / honesty).
+      const lines = String(c).split("\n").map((s) => s.trim()).filter(Boolean);
+      if (lines.length) lastLine = lines[lines.length - 1];
+      if (emitter) {
+        try {
+          emitter.feed(c);
+        } catch {
+          /* a progress fold must never break the run */
+        }
+      }
+    };
     let run;
     try {
-      run = await runCli({
-        cmd: parts[0],
-        args: [...codeArgs, memoryPreamble(workspaceMemory) + promptText],
-        cwd: repoPath,
-        timeoutMs: cfg.runTimeoutMs,
-        label: "coding",
-        signal,
-        env: codingChildEnv(cfg),
-        onData: (c) => {
-          // Keep tracking lastLine as a fallback (legacy heartbeat / honesty).
-          const lines = String(c).split("\n").map((s) => s.trim()).filter(Boolean);
-          if (lines.length) lastLine = lines[lines.length - 1];
-          if (emitter) {
-            try {
-              emitter.feed(c);
-            } catch {
-              /* a progress fold must never break the run */
-            }
-          }
-        },
+      // OpenCode's own non-interactive CLI auto-rejects every permission ask
+      // unless --auto is present. For the gated tiers, bypass that responder
+      // and own the authenticated HTTP session + SSE stream directly so hilos
+      // is the sole authority answering the paused tool call (0593).
+      const useRuntimePermissionBridge = shouldUseRuntimePermissionBridge({
+        vendor,
+        runtimePermissions: caps.runtimePermissions,
+        codeArgs,
+        codingCmd: cfg.codingCmd,
       });
+      if (useRuntimePermissionBridge) {
+        run = await deps.runOpenCodeHttpSession({
+          cmd: parts[0],
+          args: codeArgs,
+          cwd: repoPath,
+          prompt: memoryPreamble(workspaceMemory) + promptText,
+          timeoutMs: cfg.runTimeoutMs,
+          signal,
+          // A model running inside the server must never inherit the daemon's
+          // hilos bearer token. The bridge's random loopback password is added
+          // after this scrub and dies with the process group.
+          env: scrubHilosEnv(codingChildEnv(cfg) || process.env),
+          onData: handleCliData,
+          ...openCodePermissionCallbacks({
+            tool,
+            channelId,
+            threadRoot,
+            runId,
+          }),
+        });
+      } else {
+        run = await runCli({
+          cmd: parts[0],
+          args: [...codeArgs, memoryPreamble(workspaceMemory) + promptText],
+          cwd: repoPath,
+          timeoutMs: cfg.runTimeoutMs,
+          label: "coding",
+          signal,
+          env: codingChildEnv(cfg),
+          onData: handleCliData,
+        });
+      }
     } finally {
       stopHeartbeat();
+      if (run?.sessionId) runSessionId = run.sessionId;
       if (emitter) {
         // Terminal state: flip the status card off "working" (state 'done'/'error')
         // so it stops claiming the agent is alive. For a run that produced work,
@@ -2355,6 +2540,11 @@ export async function handleTask({ message, channelId, tool, me, caps = {} }, cf
           prUrl: prUrl || continuingPrUrl || null,
           sessionId: sid,
           machine,
+          // The CLI that created the session (a `ses_…` is meaningless to
+          // claude's `--resume`) and the project it belongs to — opencode
+          // scopes sessions per project. The gate above requires both (0608).
+          vendor,
+          cwd: projectKey,
           updatedAt: new Date().toISOString(),
         });
       }