hilos-agent 0.9.0 → 0.9.2

package/src/resume.mjs

@@ -18,9 +18,9 @@
 //   - The pure transforms (parse/merge/prune/serialize) take an injected clock
 //     (nowMs) and never call Date.now/os, so they unit-test with a fixed time.
 //   - Every fs read/write is guarded: a state IO failure NEVER breaks a run.
-//   - We NEVER guess a vendor's resume flag. claude_code, cursor and opencode
-//     have proven ones (0282/0573/0608); codex degrades to today's
-//     branch+feedback iterate (deferred to 0278+).
+//   - We NEVER guess a vendor's resume flag. claude_code, cursor, opencode and
+//     codex all have live-verified ones (0282/0573/0608/0783); anything else
+//     degrades to today's branch+feedback iterate.
 
 import { readFileSync, writeFileSync, mkdirSync } from "node:fs";
 import { homedir } from "node:os";
@@ -40,6 +40,13 @@ export const STATE_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000;
  *  entry) from ever reaching `--session`. */
 const OPENCODE_SESSION_RE = /^ses_[A-Za-z0-9_-]+$/;
 
+/** codex thread ids are UUIDs (`01a00968-4a94-7821-…`, live-captured off
+ *  `codex exec --json`'s `thread.started`). `codex exec resume` takes "a
+ *  UUID or a thread name, UUIDs take precedence" — so the shape guard keeps a
+ *  foreign id (an opencode `ses_…` inherited from an older state entry) from
+ *  ever being read as a THREAD NAME and silently resuming the wrong thing. */
+const CODEX_SESSION_RE = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
+
 /**
  * The resume flags for a coding vendor, or [] when resume isn't safe/known.
  *
@@ -52,10 +59,25 @@ const OPENCODE_SESSION_RE = /^ses_[A-Za-z0-9_-]+$/;
  * continues the pinned session non-interactively (a follow-up recalled what
  * the first run did); the id is the `sessionID` every `--format json` event
  * carries. Its `--fork` twin is deliberately NOT emitted: the daemon has no
- * thread-branching semantics to map onto it today. codex has an UNCONFIRMED
- * resume flag, so we emit NOTHING rather than guess — a wrong flag could break
- * the run; it degrades to today's branch+feedback iterate. A falsy or
- * non-string sessionId also returns [] (nothing to resume).
+ * thread-branching semantics to map onto it today.
+ *
+ * codex (0783): NOT a flag — a SUBCOMMAND, `codex exec resume <id> <prompt>`.
+ * Live-verified against codex-cli 0.144.1: the id is the `thread_id` that
+ * `exec --json`'s `thread.started` carries, and a resumed run answered from the
+ * first run's context (it recalled the file it had created and what was in it).
+ * The two argv facts that make this splice safe were verified the same way —
+ * flags BEFORE `resume` are parsed as `exec`'s own (so the user's
+ * `--sandbox`/`--skip-git-repo-check` still apply, and an `exec`-level `-m`
+ * reaches the resumed turn), and `--json` AFTER `resume` is accepted (it is on
+ * `codex exec resume --help` too). That is exactly the order the handler
+ * builds: base, model, resume, stream, prompt.
+ *
+ * `--last` is deliberately NOT a fallback here. It means "the newest recorded
+ * session" machine-wide, and the daemon runs threads concurrently, so it would
+ * happily resume ANOTHER thread's session. No recorded id, no resume — the
+ * branch+feedback iterate is only ever slower, never wrong.
+ *
+ * A falsy or non-string sessionId also returns [] (nothing to resume).
  *
  * @param {'claude_code'|'codex'|'cursor'|'opencode'|'hermes'|'unknown'} vendor
  * @param {string|null|undefined} sessionId
@@ -63,6 +85,11 @@ const OPENCODE_SESSION_RE = /^ses_[A-Za-z0-9_-]+$/;
  */
 export function buildResumeArgs(vendor, sessionId) {
   if (typeof sessionId !== "string" || !sessionId.trim()) return [];
+  if (vendor === "codex") {
+    // A thread NAME is also accepted by the CLI, so an id of any other shape
+    // wouldn't error — it would resume something else. Only pass a UUID.
+    return CODEX_SESSION_RE.test(sessionId.trim()) ? ["resume", sessionId.trim()] : [];
+  }
   if (vendor === "opencode") {
     // A wrong id is not free here: an unknown id exits 1 ("Session not found"),
     // and an id from ANOTHER project directory HANGS the CLI — so only pass a
@@ -74,7 +101,14 @@ export function buildResumeArgs(vendor, sessionId) {
 }
 
 /** Vendors whose resume flag is proven (see buildResumeArgs). */
-const RESUMABLE_VENDORS = new Set(["claude_code", "cursor", "opencode"]);
+const RESUMABLE_VENDORS = new Set(["claude_code", "cursor", "opencode", "codex"]);
+
+/** Vendors whose sessions belong to a WORKSPACE, so a resume must run in the
+ *  same one. opencode: a `--session` from another project hangs its CLI (0608).
+ *  codex: `exec resume` is cwd-filtered by design (its own `--all` exists to
+ *  disable that filtering), and a session carries the first run's file context,
+ *  so resuming it somewhere else would be quietly wrong rather than loud. */
+const PROJECT_SCOPED_VENDORS = new Set(["opencode", "codex"]);
 
 /**
  * Should this iterate resume a recorded session? PURE — the handler passes what
@@ -93,8 +127,11 @@ const RESUMABLE_VENDORS = new Set(["claude_code", "cursor", "opencode"]);
  *   invocation. An entry written before 0608 has no vendor → degrade once, then
  *   the next capture rewrites the entry with one.
  * - project: opencode sessions are scoped per project, and a `--session` from
- *   another project HANGS its CLI rather than erroring (0608). Only enforced
- *   for opencode, whose entries carry the key; other vendors resume as before.
+ *   another project HANGS its CLI rather than erroring (0608); codex filters
+ *   its recorded sessions by cwd for the same reason (0783). Enforced for those
+ *   two (PROJECT_SCOPED_VENDORS); other vendors resume as before. An entry
+ *   written before its vendor joined the set has no key → degrade once, then
+ *   the next capture rewrites the entry with one.
  *
  * @param {object} o
  * @param {string} o.vendor — the CURRENT command's vendor
@@ -114,7 +151,7 @@ export function resumeDecision({ vendor, entry, serverSessionId = null, machine,
   if (local.vendor !== vendor) {
     return { sessionId: null, reason: local.vendor ? "recorded-by-another-vendor" : "vendor-not-recorded" };
   }
-  if (vendor === "opencode" && local.cwd !== projectKey) {
+  if (PROJECT_SCOPED_VENDORS.has(vendor) && local.cwd !== projectKey) {
     return { sessionId: null, reason: local.cwd ? "recorded-in-another-project" : "project-not-recorded" };
   }
   if (serverSessionId && serverSessionId !== local.sessionId) {

package/src/run.mjs

@@ -8,7 +8,9 @@ import { makeClient } from "./mcp.mjs";
 import { mentionHandle } from "./daemon.mjs";
 import { handleTask } from "./handler.mjs";
 import { createQueue, looksLikeCancel, dedupeKey } from "./queue.mjs";
+import { cleanupImages, fetchMentionImages } from "./attachments.mjs";
 import { reloadConfig } from "./config.mjs";
+import { scanReplyBridge, handleReplyBridgeJob } from "./reply-bridge.mjs";
 
 /**
  * The poll loop. Embeddable: pass a `signal` to stop it cleanly (interrupts the
@@ -109,6 +111,10 @@ export async function run(cfg, { handler = handleTask, log = console, signal, on
     runtimePermissions:
       toolNames.includes("request_permission") &&
       toolNames.includes("get_permission_decision"),
+    // Opt-in run transcripts (0792). Two gates, and BOTH must say yes: the
+    // server has to offer the tool, and the operator has to have turned
+    // `uploadTranscripts` on. Older servers simply never see the call.
+    uploadTranscript: toolNames.includes("upload_run_transcript"),
   };
 
   // Register local folders (0324/0325): a folder-mode daemon announces each
@@ -123,8 +129,22 @@ export async function run(cfg, { handler = handleTask, log = console, signal, on
       if (!channelId || !path) continue;
       const title = basename(path);
       try {
-        await tool("link_folder", { channelId, path, title, hostname: hostname() });
-        emit({ type: "status", text: `linked folder ${title} to its channel` });
+        // ifVacant (0546): startup is an IMPLICIT link — a stale folders entry in
+        // this machine's config must never replace a source the team connected
+        // deliberately. A refusal logs; a person can re-point the channel on
+        // purpose from the UI or by asking the agent in-channel.
+        const res = await tool("link_folder", { channelId, path, title, hostname: hostname(), ifVacant: true });
+        // 0546 — a channel has ONE code source, so registering this folder may
+        // have replaced a repo or another folder. The server says which; repeat
+        // it rather than report a plain "linked" over someone else's binding.
+        if (res && res.ok === false) {
+          log.error(`link_folder refused for ${path}: ${res.error}`);
+        } else {
+          emit({
+            type: "status",
+            text: res?.message || `linked folder ${title} to its channel`,
+          });
+        }
       } catch (e) {
         log.error(`link_folder failed for ${path}: ${e?.message || e}`);
       }
@@ -151,9 +171,15 @@ export async function run(cfg, { handler = handleTask, log = console, signal, on
   // lets a "stop" (and new mentions) be picked up while a task is still running.
   const queue = createQueue({
     concurrency: cfg.queueConcurrency || 1,
-    runJob: (job, { signal: jobSignal }) => safeHandle(job.message, job.channelId, jobSignal),
+    runJob: (job, { signal: jobSignal }) =>
+      job.kind === "reply-bridge"
+        ? safeBridgeHandle(job.bridge, jobSignal)
+        : safeHandle(job.message, job.channelId, jobSignal),
   });
 
+  let boundThreadRoots = new Set();
+  let replyScanOffset = 0;
+
   // Stopping the embedded daemon: the moment the caller aborts, cancel the active
   // job (via the queue's existing cancel path — it aborts the in-flight job's
   // signal) so a multi-minute run is torn down promptly, and emit a stopping
@@ -172,10 +198,43 @@ export async function run(cfg, { handler = handleTask, log = console, signal, on
 
   async function safeHandle(message, channelId, jobSignal) {
     emit({ type: "task-start", channelId, messageId: message.id, text: (message.body || "").slice(0, 200) });
+    // 0779 — pull this mention's images to disk HERE, as the job starts, not
+    // when it was enqueued. Downloading at enqueue meant a burst of image
+    // mentions held every job's bytes (up to 4 x 10MB each) on the user's disk
+    // while one long job ran; this way at most one temp dir exists at a time.
+    // The url is signed for an hour, which covers any normal queue wait — and a
+    // job that waits longer than that simply runs text-only, which the
+    // transcript already accounts for. Fail-soft: never blocks the run.
+    let images = { dir: null, files: [] };
+    try {
+      images = await fetchMentionImages(message, { log });
+    } catch {
+      /* an attachment is never the reason a run doesn't happen */
+    }
+    const withImages = images.files.length
+      ? { ...message, imageDir: images.dir, images: images.files }
+      : message;
+    // 0782 — a person pressed Stop on this run's live card. The server already
+    // settled the run row (status canceled); this end says so in the room and
+    // tears the work down through the SAME cancel path a chat "stop" uses, so a
+    // stopped run leaves a process group killed and a card that isn't working.
+    // Once per job: the signal stays set on the row until the run ends.
+    let stopNoticed = false;
+    const onStopRequested = ({ by } = {}) => {
+      if (stopNoticed) return;
+      stopNoticed = true;
+      const who = typeof by === "string" && by.trim() ? by.trim() : null;
+      void tool("post_message", {
+        channelId,
+        parentId: message.parentId ?? null,
+        body: who ? `Stopped by ${who} from the room.` : "Stopped from the room.",
+      }).catch(() => {});
+      queue.cancelActive("stopped from the room");
+    };
     try {
       log.log(`→ task in ${channelId}: "${(message.body || "").slice(0, 80)}"`);
       // liveCfg so a job uses the latest model/permission/codingCmd at run time.
-      const result = await handler({ message, channelId, tool, me, caps }, liveCfg, undefined, { signal: jobSignal });
+      const result = await handler({ message: withImages, channelId, tool, me, caps }, liveCfg, undefined, { signal: jobSignal, onStopRequested });
       emit({ type: "task-done", channelId, status: result && result.status });
     } catch (e) {
       emit({ type: "task-error", channelId, error: e?.message || String(e) });
@@ -184,6 +243,34 @@ export async function run(cfg, { handler = handleTask, log = console, signal, on
         channelId,
         body: `Hit an error working on that: ${e.message}`,
       }).catch(() => {});
+    } finally {
+      // 0779 — the downloaded screenshots die with the run, success or not.
+      // They are a person's files, and nothing after this run has any use for
+      // them. Downloading at execution time means this always pairs with the
+      // fetch above: there is no path that leaves a dir behind.
+      await cleanupImages(images.dir);
+    }
+  }
+
+  async function safeBridgeHandle(bridge, jobSignal) {
+    const { binding, replies } = bridge;
+    emit({
+      type: "task-start",
+      channelId: binding.channelId,
+      messageId: replies[0]?.id,
+      text: (replies[0]?.body || "").slice(0, 200),
+      source: "reply-bridge",
+    });
+    try {
+      const result = await handleReplyBridgeJob(bridge, liveCfg, {
+        tool,
+        log,
+        signal: jobSignal,
+      });
+      emit({ type: "task-done", channelId: binding.channelId, status: result?.status, source: "reply-bridge" });
+    } catch (e) {
+      emit({ type: "task-error", channelId: binding.channelId, error: e?.message || String(e), source: "reply-bridge" });
+      log.error(`reply bridge error: ${e?.message || e}`);
     }
   }
 
@@ -229,6 +316,16 @@ export async function run(cfg, { handler = handleTask, log = console, signal, on
     for (const m of mentions) {
       if (seen.has(m.id)) continue;
       seen.add(m.id);
+      // A human reply in a locally-bound thread belongs to the provider
+      // session that created that anchor — even when the person also typed an
+      // @mention. Let the bridge take it; starting a fresh repo task here would
+      // duplicate work and lose the session context this feature exists for.
+      if (m.parentId && boundThreadRoots.has(m.parentId)) {
+        if (!cursor.value || new Date(m.created_at).getTime() > new Date(cursor.value).getTime()) {
+          cursor.value = m.created_at;
+        }
+        continue;
+      }
       await intake(m, m.channelId);
       // Compare numerically — created_at formats differ (Z vs +00:00 offset),
       // so a lexicographic string compare can fail to advance the cursor.
@@ -238,6 +335,34 @@ export async function run(cfg, { handler = handleTask, log = console, signal, on
     }
   }
 
+  async function passViaReplyBridge() {
+    if (liveCfg.replyBridge === false) {
+      boundThreadRoots = new Set();
+      return;
+    }
+    const scanned = await scanReplyBridge({
+      tool,
+      token: liveCfg.token,
+      agentId: me.agentId,
+      offset: replyScanOffset,
+    });
+    replyScanOffset = scanned.nextOffset;
+    boundThreadRoots = scanned.boundThreadRoots;
+    for (const bridge of scanned.jobs) {
+      const ids = bridge.replies.map((reply) => reply.id).filter(Boolean);
+      const key = `reply-bridge:${bridge.binding.threadRootId}:${ids.join(",")}`;
+      const queued = queue.enqueue({ kind: "reply-bridge", bridge, key });
+      if (queued.deduped) continue;
+      if (liveCfg.queueAcks && !queued.startedImmediately) {
+        await tool("post_message", {
+          channelId: bridge.binding.channelId,
+          parentId: bridge.binding.threadRootId,
+          body: "Got it — this will continue in the same local session after the current task.",
+        }).catch(() => {});
+      }
+    }
+  }
+
   async function passViaScan() {
     for (const channelId of channelIds) {
       const out = await tool("read_channel", { channelId, limit: 30 });
@@ -266,6 +391,7 @@ export async function run(cfg, { handler = handleTask, log = console, signal, on
       log.error(`config reload error (keeping previous): ${e.message}`);
     }
     try {
+      await passViaReplyBridge();
       if (useMentions) await passViaMentions();
       else await passViaScan();
     } catch (e) {

package/src/transcript.mjs

@@ -0,0 +1,153 @@
+// The daemon's half of the run transcript.
+//
+// The progress emitter reads the coding CLI's stream and throws the bytes away:
+// what survives is an eight-step ring, twenty file names, and thirty activity
+// rows, overwritten in place. That is the right shape for a LIVE card and the
+// wrong shape for a record — once the run settles, the only account of what the
+// agent actually did is gone.
+//
+// This is a tap on the same run, kept beside the parser rather than inside it:
+// a bounded tail, redacted with the package's own pass before it leaves the
+// machine. The server redacts and caps it again on arrival either way.
+//
+// CONSENT: nothing here runs unless the operator set `uploadTranscripts: true`.
+// This is their machine.
+//
+// WHAT GOES IN. A run reaches the daemon over one of two kinds of transport,
+// and the tap has to keep both honest:
+//
+//   - **Raw NDJSON** (an argv `claude -p --output-format stream-json`, a gated
+//     claude run, opencode's JSON bridge). stdout IS the record; lines pass
+//     through untouched.
+//   - **Structured sessions** (ACP, `codex mcp-server`). stdout carries only
+//     the assistant's PROSE — every tool call travels beside it as a normalized
+//     event. Keeping stdout alone would ship a transcript with no execution in
+//     it at all, which is the worst of both: bytes uploaded, nothing learned.
+//     So events are recorded too, one `hilos_event` line each, and prose lines
+//     are wrapped into the same shape so the whole file is one readable NDJSON
+//     record rather than a mix of frames and loose text.
+//
+// `lib/transcript-digest.ts` reads `hilos_event`, which is why the shape is
+// worth the wrapping.
+
+import { redactSecrets, truncateTranscriptTail, TRANSCRIPT_TRUNCATED_LINE } from "./redact.mjs";
+
+/**
+ * How much of the stream a run may ship. A 25-minute Claude run writes a few MB
+ * of stream-json; this keeps the upload to one ordinary request body instead of
+ * a surprise multi-megabyte POST off someone's laptop. The tail is what matters
+ * (the run's payoff is at the end), so the front is what gets cut.
+ *
+ * The server caps at its own, higher ceiling as well — this one exists so the
+ * bytes never leave the machine, not to be the enforcement point.
+ */
+export const DAEMON_TRANSCRIPT_MAX_CHARS = 1_000_000;
+
+/** No single event line may dominate the tail. */
+const MAX_EVENT_LINE = 2_000;
+
+/** Accounting and bookkeeping, not narration — these never become a record. */
+const UNRECORDED_EVENTS = new Set(["usage", "session"]);
+
+/**
+ * A bounded, whole-line NDJSON record of a run.
+ *
+ * @param {object} [o]
+ * @param {number} [o.maxChars] — ceiling for the retained tail.
+ * @returns {{ push: (chunk: string) => void, pushEvent: (ev: object) => void,
+ *   text: () => string, chars: () => number }}
+ */
+export function createTranscriptTap({ maxChars = DAEMON_TRANSCRIPT_MAX_CHARS } = {}) {
+  // Trim lazily, at roughly double the ceiling: a per-chunk cut on a long run
+  // would copy the whole buffer thousands of times for no benefit.
+  const slack = Math.max(maxChars, 1) * 2;
+  let buf = "";
+  // An unterminated stdout line, held until its newline arrives. A chunk
+  // boundary is not a record boundary — codex feeds token deltas, so without
+  // this the file would be one wrapped line per delta.
+  let partial = "";
+  // Whether anything has been cut off the front. It has to be REMEMBERED rather
+  // than inferred at the end: a trim that lands exactly on the ceiling leaves a
+  // buffer `truncateTranscriptTail` considers already short enough, so the cut
+  // would ship unmarked with a half record on top of it.
+  let truncated = false;
+
+  function trim() {
+    const cut = buf.slice(buf.length - maxChars);
+    const newline = cut.indexOf("\n");
+    // Drop the partial record the cut opened on — never ship a fragment.
+    buf = newline >= 0 ? cut.slice(newline + 1) : "";
+    truncated = true;
+  }
+
+  function append(line) {
+    buf += line + "\n";
+    if (buf.length > slack) trim();
+  }
+
+  /** One line of the run's own output: a frame as-is, or prose wrapped. */
+  function record(line) {
+    const text = line.trim();
+    if (!text) return;
+    // A frame speaks for itself. Anything else is the assistant talking, and it
+    // becomes a note so the record stays one parseable shape end to end.
+    append(text.startsWith("{") ? text : event({ t: "note", text }));
+  }
+
+  function event(ev) {
+    const line = JSON.stringify({ type: "hilos_event", ...ev });
+    return line.length > MAX_EVENT_LINE ? line.slice(0, MAX_EVENT_LINE) + '"}' : line;
+  }
+
+  return {
+    /** Feed a raw stdout chunk. */
+    push(chunk) {
+      const text = String(chunk ?? "");
+      if (!text) return;
+      partial += text;
+      const lines = partial.split("\n");
+      partial = lines.pop() ?? ""; // the tail may be half a line
+      for (const line of lines) record(line);
+      // A transport that never sends a newline would otherwise buffer forever.
+      if (partial.length > MAX_EVENT_LINE * 4) {
+        record(partial);
+        partial = "";
+      }
+    },
+    /**
+     * Fold one normalized AgentEvent into the record. This is how a structured
+     * session's execution — the edits, reads, and commands that never touch
+     * stdout — reaches the transcript at all.
+     */
+    pushEvent(ev) {
+      if (!ev || typeof ev !== "object") return;
+      const t = typeof ev.t === "string" ? ev.t : "";
+      if (!t || UNRECORDED_EVENTS.has(t)) return;
+      append(event(ev));
+    },
+    /**
+     * The transcript to upload: the held partial line flushed, the whole cut to
+     * the ceiling at a line boundary, then redacted — cap before redact, so
+     * every surviving line is whole and no secret can be halved into something
+     * the redactor no longer recognizes. The same order `lib/run-transcripts.ts`
+     * uses server-side, for the same reason.
+     *
+     * Returns "" when the run produced nothing at all: an empty transcript is an
+     * honest omission, and the caller uploads nothing.
+     */
+    text() {
+      if (partial.trim()) {
+        record(partial);
+        partial = "";
+      }
+      if (!buf.trim()) return "";
+      const body = redactSecrets(truncateTranscriptTail(buf, maxChars));
+      if (!truncated || body.startsWith(TRANSCRIPT_TRUNCATED_LINE)) return body;
+      return `${TRANSCRIPT_TRUNCATED_LINE}\n${body}`;
+    },
+    /** Characters held right now — for the daemon's own log line. */
+    chars() {
+      return buf.length + partial.length;
+    },
+  };
+}