hilos-agent 0.9.1 → 0.9.2

package/README.md

@@ -257,21 +257,32 @@ npx hilos-agent hooks install --cursor
 npx hilos-agent hooks install --global
 ```
 
-This writes lifecycle entries into `.codex/hooks.json`, `.claude/settings.json`,
-and `.cursor/hooks.json` (or their home-directory equivalents with `--global`),
-preserving any hooks you already have. Codex asks you to review new project
-hooks once; open `/hooks` and trust the hilos entries. Preview all three blocks
-without writing anything:
+Claude Code and Cursor write lifecycle entries into this repo. Codex needs one
+entry in `~/.codex/hooks.json` because `codex exec` does not run repository
+hooks. hilos keeps that entry project-scoped with a 0600 allowlist at
+`~/.hilos/codex-hook-scope.json`, so other repos stay untouched unless you use
+`--global`. Launching Codex below the opted-in repository root still works, but
+a nested repository needs its own opt-in. If the allowlist is lost or malformed,
+new installs fail closed instead of reporting from every repo.
+
+Any hooks you already have are preserved. A pre-existing project-level hilos
+Codex entry is moved out, with a `.bak` beside the changed file. Codex asks you
+to review the home-level hilos hook once; open `/hooks` and trust the entry.
+The installer copies the dependency-free hook code into a private, versioned
+`~/.hilos/hook-runtime` and records its absolute entrypoint. A one-off npx run
+therefore remains usable offline; no global install or PATH change is required.
+Preview all three blocks without writing anything:
 
 ```sh
 npx hilos-agent hooks print
 ```
 
 **Requirements:**
-- `npm i -g hilos-agent` so the `hilos-agent hook` command resolves at hook time.
-- A `~/.hilos/agent.json` with `url` and the owned agent's `token`; `channelId`
-  is needed only for the fallback live card. Generate these in the agent's
-  **Connect via MCP** panel in hilos (same panel as `--join`).
+- For live progress from every tool event, a `~/.hilos/agent.json` with `url`
+  and the owned agent's `token`; `channelId` is needed only for the fallback
+  live card. The normal one-line `--join` flow does not need that file for
+  replies: its token stays in daemon memory, and Hilos signs each session
+  binding so the daemon can verify it before resuming local code.
 - Keep `hilos-agent` running to pick replies up. Hooks alone still stream live
   steps, but MCP has no server-push channel that can wake an idle local client.
 
@@ -281,7 +292,14 @@ npx hilos-agent hooks print
 - A successful hilos post binds its returned message to this provider session.
   A person's later reply to that exact thread resumes the same session while
   `hilos-agent` is running. Ambient messages, older thread history, and agent
-  replies do not wake it.
+  replies do not wake it. Current workspace roles are checked at pickup: guests,
+  removed people, and unknown authors remain advisory and cannot start code.
+- The resumed turn receives bounded thread, room, and member context. Codex also
+  gets a random loopback-only Hilos MCP URL for that turn, so it can search any
+  room its linked owner can access when that owner minted the current key,
+  without receiving the bearer token. Regenerate an older key from Connect to
+  enable that inheritance. Admin-issued keys and other people's private rooms
+  stay outside the context.
 - The room's normal execution gate still applies; a chat-only guest room cannot
   resume local code.
 - Steps are coalesced into ~2s batches to keep traffic light.
@@ -290,10 +308,12 @@ npx hilos-agent hooks print
 - Up to 20 unique files touched are surfaced so reviewers can glance at the scope
   before the report card arrives.
 
-**Privacy:** project-level by default (only repos you opt into stream). Hook
-state stays in `~/.hilos/hook-state` and contains session ids, checkout paths,
-hilos message ids, progress steps, and any completed result waiting for a
-delivery retry — never the coding transcript. Kill
+**Privacy:** project-level by default (only repos you opt into stream, including
+Codex through its local allowlist). Hook state stays in
+`~/.hilos/hook-state` and contains session ids, checkout paths,
+hilos message ids, an opaque server-signed binding proof, a one-way credential
+scope after verification, progress steps, and any completed result waiting for
+a delivery retry — never the bearer token or coding transcript. Kill
 switches: `HILOS_HOOKS=off` pauses streaming and new bindings;
 `HILOS_REPLY_BRIDGE=off` pauses inbound replies. The hook always exits 0 — it
 will never interrupt or break your CLI session.

package/bin/hilos-agent.mjs

@@ -50,6 +50,8 @@ function parseArgs(argv) {
     else if (a === "--codex") flags.hookClient = "codex";
     else if (a === "--cursor") flags.hookClient = "cursor";
     else if (a === "--vendor") flags.vendor = argv[++i];
+    else if (a === "--scope-managed") flags.scopeManaged = true;
+    else if (a === "--managed-runtime") flags.managedRuntime = true;
     else if (a === "-h" || a === "--help") flags.help = true;
     else if (a === "-v" || a === "--version") flags.version = true;
     else positional.push(a);
@@ -106,7 +108,7 @@ async function main() {
   // fast, silent, and always exit 0, so it short-circuits before any daemon
   // machinery.
   if (cmd === "hook") {
-    await hookMain({ vendor: flags.vendor || "unknown" });
+    await hookMain({ vendor: flags.vendor || "unknown", scopeManaged: Boolean(flags.scopeManaged) });
     return;
   }
   if (cmd === "hooks") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hilos-agent",
-  "version": "0.9.1",
+  "version": "0.9.2",
   "description": "Run your own coding agent (Claude Code / Codex / Cursor) as an autonomous teammate in a hilos channel. Picks up @mentions in channels and threads, makes the change, and opens a PR for review — your code and credentials never leave your machine. (Approve-before-push is available via gate:true.)",
   "type": "module",
   "bin": {

package/src/argv.mjs

@@ -0,0 +1,61 @@
+// Small shell-word parser for configured CLI commands. hilos never runs these
+// strings through a shell; this preserves quoted paths/values while keeping the
+// spawn boundary injection-safe. It intentionally supports words, single and
+// double quotes, and backslash-escaped whitespace/quotes—not expansions, pipes,
+// or redirects. Other backslashes stay literal so Windows and UNC paths work.
+
+export function commandArgv(command) {
+  const input = String(command || "");
+  const out = [];
+  let word = "";
+  let quote = "";
+  let started = false;
+  for (let index = 0; index < input.length; index += 1) {
+    const char = input[index];
+    if (char === "\\" && quote !== "'") {
+      const next = input[index + 1];
+      const escapesQuote = next === '"' || (!quote && next === "'");
+      const escapesWhitespace = !quote && typeof next === "string" && /\s/.test(next);
+      if (escapesQuote || escapesWhitespace) {
+        word += next;
+        index += 1;
+      } else {
+        word += "\\";
+      }
+      started = true;
+      continue;
+    }
+    if (quote) {
+      if (char === quote) quote = "";
+      else word += char;
+      started = true;
+      continue;
+    }
+    if (char === "'" || char === '"') {
+      quote = char;
+      started = true;
+      continue;
+    }
+    if (/\s/.test(char)) {
+      if (started) {
+        out.push(word);
+        word = "";
+        started = false;
+      }
+      continue;
+    }
+    word += char;
+    started = true;
+  }
+  if (started) out.push(word);
+  return out;
+}
+
+/**
+ * Encode one literal argument for `commandArgv`'s small command grammar.
+ * Single-quoted spans preserve whitespace and backslashes verbatim; an
+ * embedded apostrophe is represented as an adjacent double-quoted span.
+ */
+export function quoteCommandArg(value) {
+  return `'${String(value).replaceAll("'", `'"'"'`)}'`;
+}