hilos-agent 0.9.0 → 0.9.2

package/src/config.mjs

@@ -57,12 +57,42 @@ const DEFAULTS = {
   // it still won't run arbitrary commands. Override in hilos-agent.json if you
   // want a stricter (or `--dangerously-skip-permissions`) command.
   codingCmd: "claude -p --permission-mode acceptEdits",
-  // ACP transport opt-in (0759): drive the coding CLI over the Agent Client
-  // Protocol (JSON-RPC on stdio) instead of argv + stdout scraping. Covers
-  // opencode (`opencode acp`) and cursor (`cursor-agent acp`), and only for
-  // runs the workspace already gates with runtime permissions; every other
-  // run keeps the existing paths. Also enabled by HILOS_ACP=1.
-  acpTransport: false,
+  // ACP transport (0759): drive the coding CLI over the Agent Client Protocol
+  // (JSON-RPC on stdio) instead of argv + stdout scraping. Covers opencode
+  // (`opencode acp`) and cursor (`cursor-agent acp`), and only for runs the
+  // workspace already gates with runtime permissions; every other run keeps
+  // the existing paths.
+  //
+  // ON by default since 0778. Both vendors' adapters are proven live (0759
+  // slices 1–2, `scripts/verify-acp.mjs`), and leaving it off meant a
+  // workspace that had explicitly granted runtime permissions still got no
+  // approval card — the gate existed and nobody was behind it. Resume no
+  // longer disqualifies a run either (both agents advertise ACP `loadSession`).
+  // Set `acpTransport: false` in hilos-agent.json to opt a machine back out;
+  // HILOS_ACP=0 does the same from the environment.
+  acpTransport: true,
+  // Run transcripts (0792): after a coding run reports, upload the tail of the
+  // CLI's own stream so the room keeps a record of what the agent did — the
+  // same redacted-NDJSON-in-a-private-bucket a hosted run gets, read only
+  // through /api/run-transcript and never by workspace guests.
+  //
+  // OFF by default, and it stays off until the operator says otherwise. Every
+  // other flag here changes how work is DONE on this machine; this one moves
+  // bytes off it. Whatever the CLI printed — file paths, command output, the
+  // shape of a private codebase — is the operator's, and the honest default for
+  // "may I keep a copy of your terminal" is no. The daemon redacts before
+  // sending and the server redacts again, but neither is a substitute for
+  // being asked.
+  //
+  // Set `uploadTranscripts: true` in hilos-agent.json to turn it on;
+  // HILOS_UPLOAD_TRANSCRIPTS=1 does the same from the environment (=0 forces it
+  // back off). Live-reloadable, so it can be revoked without a restart.
+  uploadTranscripts: false,
+  // Replies in an exact thread bound by an opted-in local-session hook resume
+  // that same provider session (0847). The hook install is the consent gate;
+  // this switch lets an operator pause inbound pickup without uninstalling it.
+  // No transcript is read or uploaded by this path.
+  replyBridge: true,
   // Environment handed to the coding/chat CLI. hilos's own token (HILOS_*) is
   // ALWAYS stripped either way. "inherit" (default) passes the rest of your
   // shell env so the coding tool behaves exactly as if you ran it yourself.
@@ -130,7 +160,24 @@ export function resolveConfig({ flags = {}, join: joinPayload } = {}) {
     chatTimeoutMs: process.env.HILOS_CHAT_TIMEOUT_MS ? Number(process.env.HILOS_CHAT_TIMEOUT_MS) : undefined,
     backfill: process.env.HILOS_BACKFILL === "1" ? true : undefined,
     once: process.env.HILOS_ONCE === "1" ? true : undefined,
-    acpTransport: process.env.HILOS_ACP === "1" ? true : undefined,
+    // Now that the default is ON (0778), the env var has to be able to say NO
+    // as well as yes — otherwise a machine could only opt out by editing a file.
+    acpTransport:
+      process.env.HILOS_ACP === "1" ? true : process.env.HILOS_ACP === "0" ? false : undefined,
+    // Both directions for the same reason acpTransport has both: a machine
+    // whose config file says yes must be able to say no from the environment.
+    uploadTranscripts:
+      process.env.HILOS_UPLOAD_TRANSCRIPTS === "1"
+        ? true
+        : process.env.HILOS_UPLOAD_TRANSCRIPTS === "0"
+          ? false
+          : undefined,
+    replyBridge:
+      /^(1|on|true)$/i.test(process.env.HILOS_REPLY_BRIDGE || "")
+        ? true
+        : /^(0|off|false)$/i.test(process.env.HILOS_REPLY_BRIDGE || "")
+          ? false
+          : undefined,
   };
   const merged = { ...DEFAULTS, ...file };
   for (const [k, v] of Object.entries(env)) if (v !== undefined && v !== "") merged[k] = v;
@@ -163,6 +210,11 @@ export function resolveConfig({ flags = {}, join: joinPayload } = {}) {
 const LIVE_FIELDS = [
   "codingCmd",
   "acpTransport",
+  // Consent must be revocable without a restart: edit the file, and the next
+  // run stops uploading. Listed here for the record — the actual live merge is
+  // special-cased below, because for this field a DELETED key has to mean no.
+  "uploadTranscripts",
+  "replyBridge",
   "codingModel",
   "chatCmd",
   "codingEnv",
@@ -210,6 +262,30 @@ export function reloadConfig(prev) {
   const changed = (k) => JSON.stringify(file[k]) !== JSON.stringify(snap[k]);
   for (const k of LIVE_FIELDS) if (file[k] !== undefined && changed(k)) next[k] = file[k];
   next.fileSnapshot = file;
+  // Consent is the one field where ABSENCE is an answer. Every other live field
+  // follows the 0576 rule — only a CHANGED key is applied, so a value that
+  // merely pre-existed can't claw back a launch flag — and under that rule
+  // DELETING `uploadTranscripts: true` did nothing at all: the key is gone, so
+  // `file[k] !== undefined` is false, so the old `true` survived forever. The
+  // one way to withdraw permission was to kill the daemon.
+  //
+  // So this field is recomputed from the file every reload: opted in only while
+  // the file still says so. Nothing is lost by the special case — no CLI flag
+  // sets it, so the file and the environment are its only sources, and the
+  // environment still wins below.
+  next.uploadTranscripts = file.uploadTranscripts === true;
+  // The reply bridge is safe-on only after the user has installed hooks. A
+  // live file edit may pause it with false; removing that edited key returns to
+  // the normal on state. An explicit launch flag remains pinned when the file
+  // was never changed, preserving the 0576 precedence rule above.
+  if (changed("replyBridge")) next.replyBridge = file.replyBridge !== false;
+  // The environment stays the operator's override on reload, in both
+  // directions — a machine that opted out with =0 must not be opted back in by
+  // a file edit (0792).
+  if (process.env.HILOS_UPLOAD_TRANSCRIPTS === "1") next.uploadTranscripts = true;
+  if (process.env.HILOS_UPLOAD_TRANSCRIPTS === "0") next.uploadTranscripts = false;
+  if (/^(1|on|true)$/i.test(process.env.HILOS_REPLY_BRIDGE || "")) next.replyBridge = true;
+  if (/^(0|off|false)$/i.test(process.env.HILOS_REPLY_BRIDGE || "")) next.replyBridge = false;
   if (process.env.CODING_CMD) next.codingCmd = process.env.CODING_CMD;
   if (process.env.HILOS_CODING_MODEL) next.codingModel = process.env.HILOS_CODING_MODEL;
   if (process.env.HILOS_CHAT_CMD) next.chatCmd = process.env.HILOS_CHAT_CMD;