hilos-agent 0.9.0 → 0.9.2

package/README.md

@@ -236,46 +236,87 @@ bridge; Claude Code, Codex, Cursor, and other adapters still follow their own
 CLI permission modes until their native approval hooks join the same
 vendor-neutral hilos substrate.
 
-## Hooks — stream a raw Claude Code session
+## Hooks — keep a raw Codex, Claude Code, or Cursor session in the room
 
-Don't want to run a persistent daemon? You can still make your Claude Code CLI
-sessions visible to your team in real time. **Claude Code hooks** (shipped in
-0448) let every tool call your session makes stream directly into your agent's
-live status card in hilos — no daemon, no extra process.
+Keep working in the interactive coding tool you already use. Project hooks make
+Codex, Claude Code, or Cursor visible on the agent's live card and bind a successful
+hilos `post_message` / `post_report` to that exact provider session. With the
+normal `hilos-agent` process running, a person's reply in the bound hilos thread
+becomes the next turn in the same local session and checkout.
 
 ```sh
 # Inside the repo you want to stream:
 npx hilos-agent hooks install
 
-# Or stream all your Claude Code sessions, everywhere:
+# Install only one provider, if you prefer:
+npx hilos-agent hooks install --codex
+npx hilos-agent hooks install --claude
+npx hilos-agent hooks install --cursor
+
+# Or opt in every repo on this machine:
 npx hilos-agent hooks install --global
 ```
 
-This writes `PostToolUse`, `Stop`, and `SessionEnd` hook entries into
-`.claude/settings.json` (project) or `~/.claude/settings.json` (global),
-preserving any hooks you already have. Preview the block without writing anything:
+Claude Code and Cursor write lifecycle entries into this repo. Codex needs one
+entry in `~/.codex/hooks.json` because `codex exec` does not run repository
+hooks. hilos keeps that entry project-scoped with a 0600 allowlist at
+`~/.hilos/codex-hook-scope.json`, so other repos stay untouched unless you use
+`--global`. Launching Codex below the opted-in repository root still works, but
+a nested repository needs its own opt-in. If the allowlist is lost or malformed,
+new installs fail closed instead of reporting from every repo.
+
+Any hooks you already have are preserved. A pre-existing project-level hilos
+Codex entry is moved out, with a `.bak` beside the changed file. Codex asks you
+to review the home-level hilos hook once; open `/hooks` and trust the entry.
+The installer copies the dependency-free hook code into a private, versioned
+`~/.hilos/hook-runtime` and records its absolute entrypoint. A one-off npx run
+therefore remains usable offline; no global install or PATH change is required.
+Preview all three blocks without writing anything:
 
 ```sh
 npx hilos-agent hooks print
 ```
 
 **Requirements:**
-- `npm i -g hilos-agent` so the `hilos-agent hook` command resolves at hook time.
-- A `~/.hilos/agent.json` with `url`, `token`, and `channelId`. Generate these in
-  the agent's **Connect via MCP** panel in hilos (same panel as `--join`).
+- For live progress from every tool event, a `~/.hilos/agent.json` with `url`
+  and the owned agent's `token`; `channelId` is needed only for the fallback
+  live card. The normal one-line `--join` flow does not need that file for
+  replies: its token stays in daemon memory, and Hilos signs each session
+  binding so the daemon can verify it before resuming local code.
+- Keep `hilos-agent` running to pick replies up. Hooks alone still stream live
+  steps, but MCP has no server-push channel that can wake an idle local client.
 
 **What you get:**
 - Team members see "Editing lib/x.ts" or "Running pnpm test" on the agent's live
   card as each tool fires — without you doing anything beyond the install.
+- A successful hilos post binds its returned message to this provider session.
+  A person's later reply to that exact thread resumes the same session while
+  `hilos-agent` is running. Ambient messages, older thread history, and agent
+  replies do not wake it. Current workspace roles are checked at pickup: guests,
+  removed people, and unknown authors remain advisory and cannot start code.
+- The resumed turn receives bounded thread, room, and member context. Codex also
+  gets a random loopback-only Hilos MCP URL for that turn, so it can search any
+  room its linked owner can access when that owner minted the current key,
+  without receiving the bearer token. Regenerate an older key from Connect to
+  enable that inheritance. Admin-issued keys and other people's private rooms
+  stay outside the context.
+- The room's normal execution gate still applies; a chat-only guest room cannot
+  resume local code.
 - Steps are coalesced into ~2s batches to keep traffic light.
 - When a turn ends (`Stop`), the card settles to done. The next turn revives the
   same card — one card per session, not one per turn.
 - Up to 20 unique files touched are surfaced so reviewers can glance at the scope
   before the report card arrives.
 
-**Privacy:** project-level by default (only repos you opt into stream). Global
-kill switch: `HILOS_HOOKS=off`. The hook always exits 0 — it will never interrupt
-or break your CLI session.
+**Privacy:** project-level by default (only repos you opt into stream, including
+Codex through its local allowlist). Hook state stays in
+`~/.hilos/hook-state` and contains session ids, checkout paths,
+hilos message ids, an opaque server-signed binding proof, a one-way credential
+scope after verification, progress steps, and any completed result waiting for
+a delivery retry — never the bearer token or coding transcript. Kill
+switches: `HILOS_HOOKS=off` pauses streaming and new bindings;
+`HILOS_REPLY_BRIDGE=off` pauses inbound replies. The hook always exits 0 — it
+will never interrupt or break your CLI session.
 
 ## Security
 
@@ -286,10 +327,33 @@ hilos's GitHub App only for workspace owners/admins). Want a human checkpoint
 before anything is pushed? Set `"gate": true`. Keep your token in the config file
 or `HILOS_TOKEN`, never in shared shell history.
 
+### Run transcripts are opt-in
+
+The room gets what a teammate needs to see: a plan, live progress, a report, a
+PR. The coding tool's own stream is **not** part of that by default — the live
+card is an eight-step window and nothing keeps it after the run.
+
+Set `"uploadTranscripts": true` and the daemon, after posting its report, sends
+the tail of that run's stream to hilos, where it becomes the same transcript a
+hosted run gets: openable from the report card, readable only by workspace
+members, never by guests.
+
+It is off until you turn it on, because every other option here changes how work
+happens on your machine and this one moves bytes off it. When on: the last ~1 MB
+of the run, cut at a whole record; credentials redacted here before sending and
+again on arrival; a permission-gated run records its tool calls too, not just
+the assistant's prose; each round of an iterate appends to the previous round
+rather than replacing it; and the upload is never able to fail your run,
+whatever goes wrong with it.
+
+`HILOS_UPLOAD_TRANSCRIPTS=1` turns it on, `=0` forces it off, and either
+overrides the config file. Turning it off takes effect on the next run, with no
+restart — and **deleting** the key counts as off, not as "leave it as it was".
+
 ## Flags
 
 `--join <blob>` · `--channel <id>` · `--config <path>` · `--coding-cmd <cmd>` ·
 `--chat-cmd <cmd>` · `--once` · `--backfill` · `--no-gate` · `--help`
 
 Env: `HILOS_TOKEN`, `HILOS_URL`, `HILOS_CHANNEL`, `CODING_CMD`, `HILOS_ONCE=1`,
-`HILOS_BACKFILL=1`.
+`HILOS_BACKFILL=1`, `HILOS_UPLOAD_TRANSCRIPTS=1|0`.

package/bin/hilos-agent.mjs

@@ -44,7 +44,14 @@ function parseArgs(argv) {
     else if (a === "--once") flags.once = true;
     else if (a === "--backfill") flags.backfill = true;
     else if (a === "--no-gate") flags.gate = false;
+    else if (a === "--no-reply-bridge") flags.replyBridge = false;
     else if (a === "--global") flags.global = true;
+    else if (a === "--claude") flags.hookClient = "claude";
+    else if (a === "--codex") flags.hookClient = "codex";
+    else if (a === "--cursor") flags.hookClient = "cursor";
+    else if (a === "--vendor") flags.vendor = argv[++i];
+    else if (a === "--scope-managed") flags.scopeManaged = true;
+    else if (a === "--managed-runtime") flags.managedRuntime = true;
     else if (a === "-h" || a === "--help") flags.help = true;
     else if (a === "-v" || a === "--version") flags.version = true;
     else positional.push(a);
@@ -57,10 +64,12 @@ const HELP = `hilos-agent — your coding agent as a teammate in hilos
   hilos-agent --join <blob>      connect using a link copied from hilos
   hilos-agent init               write a starter config to ~/.hilos/agent.json
   hilos-agent                    run the daemon (watch @mentions, propose diffs)
-  hilos-agent hooks install      stream this repo's Claude Code sessions to your
-                                 hilos channel (writes .claude/settings.json;
-                                 --global for every repo). "hooks print" shows
-                                 the snippet; HILOS_HOOKS=off pauses streaming.
+  hilos-agent hooks install      stream this repo's Codex, Claude, and Cursor
+                                 sessions to hilos and continue replies in the same
+                                 local session. Installs all three hook formats;
+                                 use --codex, --claude, or --cursor to choose, and
+                                 --global for every repo. HILOS_HOOKS=off pauses
+                                 streaming; HILOS_REPLY_BRIDGE=off pauses pickup.
 
 Options:
   --channel <id>     watch only one channel (per-channel override)
@@ -78,6 +87,7 @@ Options:
   --once             one poll then exit (cron-friendly)
   --backfill         also act on mentions that predate startup
   --no-gate          propose only; don't wait for approval / push
+  --no-reply-bridge  don't resume local sessions from replies in bound threads
   -v, --version      print the installed version
   -h, --help         this help
 
@@ -98,11 +108,11 @@ async function main() {
   // fast, silent, and always exit 0, so it short-circuits before any daemon
   // machinery.
   if (cmd === "hook") {
-    await hookMain();
+    await hookMain({ vendor: flags.vendor || "unknown", scopeManaged: Boolean(flags.scopeManaged) });
     return;
   }
   if (cmd === "hooks") {
-    hooksMain(positional[1], { global: Boolean(flags.global) });
+    hooksMain(positional[1], { global: Boolean(flags.global), client: flags.hookClient || "all" });
     return;
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hilos-agent",
-  "version": "0.9.0",
+  "version": "0.9.2",
   "description": "Run your own coding agent (Claude Code / Codex / Cursor) as an autonomous teammate in a hilos channel. Picks up @mentions in channels and threads, makes the change, and opens a PR for review — your code and credentials never leave your machine. (Approve-before-push is available via gate:true.)",
   "type": "module",
   "bin": {

package/src/acp-session.mjs

@@ -17,7 +17,8 @@
 //   { status, stdout, stderr, error?, sessionId?, aborted? }
 
 import { spawn } from "node:child_process";
-import { mapOpenCodePermissionDecision } from "./opencode-permissions.mjs";
+import { createAcpEventMapper } from "./agent-events.mjs";
+import { resolveHilosPermissionReply } from "./permission-gate.mjs";
 
 const DEFAULT_TIMEOUT_MS = 30 * 60_000;
 const DEFAULT_POLL_MS = 1_000;
@@ -186,6 +187,7 @@ export function createNdjsonParser() {
  *   pollIntervalMs?: number,
  *   signal?: AbortSignal,
  *   onData?: (chunk: string) => void,
+ *   onEvent?: (event: object) => void,
  *   requestPermission?: (request: object, context: object) => Promise<unknown>,
  *   getPermissionDecision?: (handle: unknown, context: object) => Promise<unknown>,
  *   mcpServers?: object[],
@@ -209,8 +211,11 @@ export async function runAcpSession({
   pollIntervalMs = DEFAULT_POLL_MS,
   signal,
   onData,
+  onEvent,
   requestPermission,
   getPermissionDecision,
+  /** Session to continue (0778); null starts a fresh one. */
+  resumeSessionId = null,
   mcpServers = [],
   spawnImpl = spawn,
   setTimer = setTimeout,
@@ -258,6 +263,7 @@ export async function runAcpSession({
   const permissionTasks = new Set();
   let currentMessageId = null;
   let messageBuffer = "";
+  const eventMapper = createAcpEventMapper();
 
   const emitOutput = (text) => {
     try {
@@ -310,51 +316,21 @@ export async function runAcpSession({
     const request = normalizeAcpPermissionRequest(msg.params, msg.id, vendor);
     const receivedAt = now();
     const deadlineAt = receivedAt + Math.max(1, timeoutMs || DEFAULT_TIMEOUT_MS);
-    let reply = "reject";
-    let handle = null;
-    try {
-      if (controller.signal.aborted) throw abortError(controller.signal.reason);
-      handle = await raceWithAbort(
-        requestPermission(request, { signal: controller.signal, deadlineAt }),
-        controller.signal,
-      );
-      let decision = handle;
-      let mapped = mapOpenCodePermissionDecision(decision);
-      while (!mapped) {
-        if (now() >= deadlineAt) throw abortError("timeout");
-        decision = await raceWithAbort(
-          getPermissionDecision(handle, {
-            request,
-            signal: controller.signal,
-            deadlineAt,
-          }),
-          controller.signal,
-        );
-        mapped = mapOpenCodePermissionDecision(decision);
-        if (mapped) break;
-        const waitMs = Math.min(Math.max(1, pollIntervalMs), Math.max(1, deadlineAt - now()));
-        await raceWithAbort(sleep(waitMs), controller.signal);
-      }
-      reply = mapped;
-    } catch (error) {
-      reply = "reject";
-      log?.error?.(`acp permission decision: ${error?.message ?? error}`);
-      // The agent is about to be failed closed. Settle the durable hilos card
-      // too, on a bounded one-shot call — the run signal may already be gone.
-      if (handle) {
-        try {
-          await getPermissionDecision(handle, {
-            request,
-            deadlineAt,
-            failClosed: true,
-          });
-        } catch (settlementError) {
-          log?.error?.(
-            `acp permission settlement: ${settlementError?.message ?? settlementError}`,
-          );
-        }
-      }
-    }
+    // The shared gate (0777): the identical raise → poll → fail-closed loop
+    // claude_code and codex now run, so no transport can drift into being the
+    // lenient one.
+    const { reply } = await resolveHilosPermissionReply({
+      request,
+      requestPermission,
+      getPermissionDecision,
+      signal: controller.signal,
+      deadlineAt,
+      pollIntervalMs,
+      sleep,
+      now,
+      log,
+      label: "acp permission",
+    });
     const option = pickAcpPermissionOption(msg.params?.options, reply);
     if (option && (reply !== "reject" || option.kind?.startsWith("reject"))) {
       respond(msg.id, { outcome: { outcome: "selected", optionId: option.optionId } });
@@ -383,8 +359,18 @@ export async function runAcpSession({
       messageBuffer += text;
       return;
     }
-    // Thoughts, tool calls, usage, command lists: structurally received, not
-    // part of slice 1's transcript (parity with the HTTP runner's text mode).
+    // Tool calls narrate the activity feed (0759 slice 3): the mapper's
+    // emit-once discipline turns the raw update stream into AgentEvents.
+    if (onEvent && (kind === "tool_call" || kind === "tool_call_update")) {
+      try {
+        const event = eventMapper.push(update);
+        if (event) onEvent(event);
+      } catch {
+        // Narration must never break the run.
+      }
+      return;
+    }
+    // Thoughts, usage, command lists: structurally received, not activity.
   }
 
   function handleMessage(msg) {
@@ -463,12 +449,41 @@ export async function runAcpSession({
       throw new Error(`ACP agent speaks protocol ${init.protocolVersion}, expected ${PROTOCOL_VERSION}`);
     }
 
-    const session = await raceWithAbort(
-      rpc("session/new", { cwd, mcpServers }),
-      controller.signal,
-    );
-    sessionId = isObject(session) && typeof session.sessionId === "string" ? session.sessionId : null;
-    if (!sessionId) throw new Error("ACP agent created a session without an id");
+    // Resume over ACP (0778). The 0759 slice-1 exclusion — ACP runs could never
+    // be resumed runs — was deferred work, not an incompatibility: BOTH live
+    // vendors advertise `loadSession: true` in this very handshake (verified
+    // against opencode 1.18.5 and cursor-agent). So a resumed run now loads its
+    // session and keeps raising cards, instead of trading approvals for
+    // continuity. A load that fails (an id from another machine, vendor, or
+    // transport) falls back to a fresh session — never-worse, the same rule the
+    // argv `--resume` retry follows — and says so.
+    const canLoad = isObject(init) && init.agentCapabilities?.loadSession === true;
+    if (resumeSessionId && canLoad) {
+      try {
+        await raceWithAbort(
+          rpc("session/load", { sessionId: resumeSessionId, cwd, mcpServers }),
+          controller.signal,
+        );
+        sessionId = resumeSessionId;
+      } catch (error) {
+        if (controller.signal.aborted) throw error;
+        log?.error?.(
+          `acp session/load failed for ${resumeSessionId}; starting a fresh session: ${error?.message ?? error}`,
+        );
+      }
+    } else if (resumeSessionId) {
+      log?.error?.(
+        `acp agent does not advertise loadSession; starting a fresh session instead of resuming ${resumeSessionId}`,
+      );
+    }
+    if (!sessionId) {
+      const session = await raceWithAbort(
+        rpc("session/new", { cwd, mcpServers }),
+        controller.signal,
+      );
+      sessionId = isObject(session) && typeof session.sessionId === "string" ? session.sessionId : null;
+      if (!sessionId) throw new Error("ACP agent created a session without an id");
+    }
 
     const turn = await raceWithAbort(
       rpc("session/prompt", {