hilos-agent 0.9.0 → 0.9.2

package/src/progress-emitter.mjs

@@ -16,7 +16,13 @@
 //   - Defense-in-depth: every string is re-sanitized here (the parser already
 //     redacts, the server will redact again) and arrays are clamped.
 
-import { createActivityFold, createStepRing, sanitizeText } from "./agent-events.mjs";
+import {
+  createActivityFold,
+  createStepRing,
+  createUsageFold,
+  sanitizeText,
+} from "./agent-events.mjs";
+import { commandArgv } from "./argv.mjs";
 
 /**
  * Which parser/stream-flags a coding command wants, from its FIRST token.
@@ -29,8 +35,10 @@ import { createActivityFold, createStepRing, sanitizeText } from "./agent-events
  * @returns {'claude_code'|'codex'|'cursor'|'opencode'|'antigravity'|'hermes'|'unknown'}
  */
 export function detectVendor(codingCmd) {
-  const first = String(codingCmd || "").trim().split(/\s+/)[0] || "";
-  const base = (first.split(/[/\\]/).pop() || "").toLowerCase();
+  const first = commandArgv(codingCmd)[0] || "";
+  const base = (first.split(/[/\\]/).pop() || "")
+    .toLowerCase()
+    .replace(/\.(?:exe|cmd|bat|com)$/i, "");
   if (base === "claude" || base === "claude-code" || base === "claude_code") return "claude_code";
   if (base === "codex") return "codex";
   // `agent` is Cursor's canonical binary name since Jan 2026 (the installer
@@ -77,8 +85,12 @@ export function fastChatCmd(vendor) {
  * scripts/verify-sandbox-mcp.mjs). cursor (0573): `--output-format stream-json`
  * — appended AFTER the base's `--output-format text`, and live-verified on
  * cursor-agent 2026.07.23 that the LAST occurrence wins, so the code run
- * streams NDJSON while chat keeps text. codex returns [] — its stream flags
- * are deferred to 0278 rather than guessed (an unproven flag could break the run).
+ * streams NDJSON while chat keeps text. codex (0783): `--json` ("Print events
+ * to stdout as JSONL", `codex exec --help`) — captured live against codex-cli
+ * 0.144.1, where a real run emitted thread/turn envelopes plus
+ * command_execution + file_change + agent_message items, which is exactly what
+ * the parser reads. Before this the flag was [] and a Codex run had no live
+ * steps at all. The FAST chat path stays plain `codex exec` (prose, not JSONL).
  * opencode (0608): `--format json`. 0592 left it OFF because nothing parsed its
  * event shape and the rawTail fallback drops JSON-looking lines; the
  * agent-events parser now reads those events (steps, the final summary, and the
@@ -90,10 +102,67 @@ export function fastChatCmd(vendor) {
 export function codeStreamArgs(vendor) {
   if (vendor === "claude_code") return ["--output-format", "stream-json", "--verbose"];
   if (vendor === "cursor") return ["--output-format", "stream-json"];
+  if (vendor === "codex") return ["--json"];
   if (vendor === "opencode") return ["--format", "json"];
   return [];
 }
 
+/**
+ * Extra args that hand the code run an IMAGE, appended to the code run's argv
+ * (0779). Verified against the installed binaries, per the 0521 rule — never
+ * guessed from docs:
+ *
+ *   - codex: `--image=<FILE>`, one arg per file. The flag is `-i, --image
+ *     <FILE>...` ("Optional image(s) to attach to the initial prompt", `codex
+ *     exec --help`, codex-cli 0.144.x) — and it is VARIADIC, which is the whole
+ *     reason for the `=` form: the daemon puts the prompt LAST in the argv, and
+ *     a live run of `codex exec -i shot.png "<prompt>"` swallowed the prompt as
+ *     a second image and died with "no prompt provided via stdin". `--image=`
+ *     binds exactly one value, so the trailing prompt survives. Verified live
+ *     against the installed binary, both ways.
+ *   - claude_code: NOTHING. Claude Code has no local-image flag — `claude
+ *     --help` documents `--file <specs...>` as `file_id:relative_path`, a
+ *     REMOTE file-resource download, so passing a local path there is wrong.
+ *     Its handoff is the file on disk plus a prompt line naming it, which its
+ *     read tool opens as an image (see imagePromptNote's `readable` mode).
+ *   - cursor / opencode / antigravity / hermes: no verified image flag →
+ *     nothing. They still get the prompt note naming the local file, which is
+ *     strictly better than the pre-0779 silence.
+ *
+ * @param {'claude_code'|'codex'|'cursor'|'opencode'|'antigravity'|'hermes'|'unknown'} vendor
+ * @param {{path: string}[]} files
+ * @returns {string[]}
+ */
+export function codeImageArgs(vendor, files) {
+  const paths = (files || []).map((f) => (f && typeof f.path === "string" ? f.path : "")).filter(Boolean);
+  if (!paths.length) return [];
+  if (vendor === "codex") return paths.map((p) => `--image=${p}`);
+  return [];
+}
+
+/**
+ * True when the prompt must tell the agent to open the image file itself,
+ * because nothing put the bytes in front of it.
+ *
+ * Claude Code (and everyone else without a verified flag) reads images through
+ * its own file-read tool, so the prompt always has to say so. Codex is the one
+ * vendor that takes the bytes on its argv (`--image=`) — but ONLY on the exec
+ * transport. A GATED codex run goes through `codex mcp-server`, whose tool
+ * schema has no image field at all (0785, live: the server rejects one and
+ * lists its nine accepted fields), so the argv never happens and the exec
+ * wording — "they are attached to this prompt" — would be a lie. Gated codex
+ * therefore reads its images the way claude does, off disk, which it really
+ * does do: given a path in the prompt it calls its own `view_image` tool.
+ *
+ * @param {'claude_code'|'codex'|'cursor'|'opencode'|'antigravity'|'hermes'|'unknown'} vendor
+ * @param {{ gated?: boolean }} [opts] `gated:true` when this run takes a
+ *   permission-gated transport rather than the plain argv one
+ */
+export function imagesNeedReading(vendor, { gated = false } = {}) {
+  if (vendor !== "codex") return true;
+  return gated === true;
+}
+
 /**
  * The server an `opencode run --attach <url>` command targets, or null for a
  * normal local run. Read off the TOKENIZED command (never a substring match —
@@ -228,6 +297,11 @@ export function createProgressEmitter({
   // The ring's richer sibling (0750): structured rows for the activity feed.
   // Older servers drop the unknown field; newer ones render it (0537).
   const activity = createActivityFold();
+  // What the run cost (0787). Deliberately NOT part of `snapshot()`: the live
+  // card is about what the agent is doing, and the wire payload stays exactly
+  // what every deployed server already accepts. The daemon reads it once the
+  // run settles and sends it with the report instead.
+  const usage = createUsageFold();
   const files = [];
   const fileSet = new Set();
   const startedAt = now();
@@ -252,6 +326,11 @@ export function createProgressEmitter({
 
   function fold(ev) {
     if (!ev || typeof ev !== "object") return;
+    // Accounting, not narration — it never becomes a step or a feed row.
+    if (ev.t === "usage") {
+      usage.push(ev);
+      return;
+    }
     ring.push(ev); // steps[] (coalesces same-file edits + dup labels)
     activity.push(ev); // feed rows (tense follows status; server re-validates)
     switch (ev.t) {
@@ -362,6 +441,15 @@ export function createProgressEmitter({
       for (const ev of events) fold(ev); // a clean note/summary overrides the tail
       scheduleSend();
     },
+    /** Fold one already-normalized AgentEvent → (throttled) send. The ACP
+     * transports (0759) produce structured events directly — there is no raw
+     * stdout stream to parse, so this is their entry into the same ring,
+     * activity fold, and file list that feed() populates. */
+    foldEvent(ev) {
+      if (!ev || typeof ev !== "object") return;
+      fold(ev);
+      scheduleSend();
+    },
     /** Force-send the current snapshot now (bypasses the throttle). */
     flush() {
       doSend();
@@ -393,5 +481,12 @@ export function createProgressEmitter({
       emit();
     },
     snapshot,
+    /**
+     * What this run cost, as the CLI itself reported it (0787), or null when it
+     * reported nothing. Read AFTER `done()` — the terminal usage frame usually
+     * arrives in the flush. Non-consuming: reading it twice returns the same
+     * totals, and it is the caller's fold that owns the delta contract.
+     */
+    usage: () => usage.total(),
   };
 }

package/src/queue.mjs

@@ -17,15 +17,31 @@ export function normalizeTask(text) {
     .trim();
 }
 
+/** Which attachments a mention carries, as a stable key fragment. 0779: "fix
+ *  this" + screenshot A and "fix this" + screenshot B are DIFFERENT asks — the
+ *  picture is half the request — and folding only the body collapsed them into
+ *  one job, silently dropping the second image. Ids (falling back to name+type)
+ *  are enough; the signed url changes every poll and would break dedupe the
+ *  other way. */
+function attachmentKey(message) {
+  const list = message && Array.isArray(message.attachments) ? message.attachments : [];
+  if (!list.length) return "";
+  return list
+    .map((a) => (a && (a.id || `${a.name || ""}:${a.type || ""}`)) || "")
+    .join(",");
+}
+
 /** Burst-dedupe key: same requester + same thread (or channel) + same normalized
- *  ask. A burst of identical pings from ONE person collapses to one job (one ask
- *  never spawns N branches), but two different people asking the same thing stay
- *  distinct. `author` is a display name (not a stable id), so same-named users can
- *  still collide — acceptable until the mention payload carries a user id. */
+ *  ask + the same attachments. A burst of identical pings from ONE person
+ *  collapses to one job (one ask never spawns N branches), but two different
+ *  people asking the same thing — or the same person asking the same words about
+ *  a different screenshot — stay distinct. `author` is a display name (not a
+ *  stable id), so same-named users can still collide — acceptable until the
+ *  mention payload carries a user id. */
 export function dedupeKey(message, channelId) {
   const scope = (message && message.parentId) || channelId || "";
   const who = (message && message.author) || "";
-  return `${scope}::${who}::${normalizeTask(message && message.body)}`;
+  return `${scope}::${who}::${normalizeTask(message && message.body)}::${attachmentKey(message)}`;
 }
 
 const CANCEL_LEADING =

package/src/redact.mjs

@@ -44,11 +44,21 @@ export function redactSecrets(text) {
     });
 }
 
+/**
+ * The record that says a transcript lost its front. It is a real NDJSON line so
+ * the digest can render it, and it is exported because more than one place has
+ * to cut a tail now — the daemon trims its buffer as a run streams, long before
+ * anything reaches `truncateTranscriptTail`. Two copies of this literal would
+ * be two chances for a marker to go missing.
+ */
+export const TRANSCRIPT_TRUNCATED_LINE =
+  '{"type":"hilos_truncated","note":"earlier transcript trimmed to fit the storage cap"}';
+
 /** Keep the transcript tail at a whole-line boundary. */
 export function truncateTranscriptTail(text, maxChars) {
   if (text.length <= maxChars) return text;
   const tail = text.slice(text.length - maxChars);
   const newline = tail.indexOf("\n");
   const clean = newline >= 0 ? tail.slice(newline + 1) : tail;
-  return `{"type":"hilos_truncated","note":"earlier transcript trimmed to fit the storage cap"}\n${clean}`;
+  return `${TRANSCRIPT_TRUNCATED_LINE}\n${clean}`;
 }