hilos-agent 0.9.1 → 0.9.2

package/src/mcp-loopback.mjs

@@ -0,0 +1,142 @@
+// Turn-scoped loopback transport for a resumed Codex session (0854).
+//
+// Codex's remote MCP auth is normally an environment variable. The daemon
+// deliberately strips HILOS_* secrets from coding children, and handing a
+// persistent workspace token to a model-visible shell would undo that safety.
+// Instead, keep the token in the daemon process and expose a random loopback
+// URL only for the lifetime of one continuation. Codex can use every tool its
+// agent identity is authorized for; it never receives the bearer credential.
+
+import { createServer } from "node:http";
+import { randomBytes } from "node:crypto";
+import { DAEMON_CLIENT } from "./mcp.mjs";
+
+const MAX_BODY_BYTES = 2 * 1024 * 1024;
+const FORWARDED_RESPONSE_HEADERS = [
+  "content-type",
+  "mcp-session-id",
+  "mcp-protocol-version",
+  "www-authenticate",
+];
+const FORWARDED_REQUEST_HEADERS = [
+  "content-type",
+  "accept",
+  "mcp-session-id",
+  "mcp-protocol-version",
+  "mcp-method",
+  "mcp-name",
+];
+const MAX_HEADER_LENGTH = 4096;
+
+function readBody(request) {
+  return new Promise((resolve, reject) => {
+    let size = 0;
+    const chunks = [];
+    request.on("data", (chunk) => {
+      size += chunk.length;
+      if (size > MAX_BODY_BYTES) {
+        reject(new Error("request body too large"));
+        request.destroy();
+        return;
+      }
+      chunks.push(chunk);
+    });
+    request.on("end", () => resolve(Buffer.concat(chunks)));
+    request.on("error", reject);
+  });
+}
+
+/**
+ * Start an unguessable, loopback-only HTTP proxy to one authenticated hilos MCP
+ * endpoint. The caller must close it in finally after the coding turn.
+ * @param {{
+ *   url?: string,
+ *   token?: string,
+ *   channelId?: string,
+ *   fetchImpl?: typeof fetch,
+ * }} [options]
+ * @returns {Promise<{url: string, close: () => Promise<void>} | null>}
+ */
+export async function startHilosMcpLoopback({ url, token, channelId = "", fetchImpl = fetch } = {}) {
+  if (!url || !token) return null;
+  const nonce = randomBytes(24).toString("hex");
+  const path = `/mcp/${nonce}`;
+  const upstream = new URL(url);
+  // Preserve the room that caused this turn as MCP's effective context. This
+  // does not widen or narrow token access, but it keeps guest-room memory gates
+  // and other context-sensitive server policy active even when the model calls
+  // a workspace-scoped tool without a channelId argument.
+  if (channelId) upstream.searchParams.set("channelId", channelId);
+  const upstreamRequests = new Set();
+
+  const server = createServer(async (request, response) => {
+    if (request.url !== path || !["POST", "GET", "DELETE"].includes(request.method || "")) {
+      response.writeHead(404).end();
+      return;
+    }
+    const controller = new AbortController();
+    upstreamRequests.add(controller);
+    const abortUpstream = () => controller.abort();
+    request.once("aborted", abortUpstream);
+    response.once("close", abortUpstream);
+    try {
+      const body = request.method === "POST" ? await readBody(request) : undefined;
+      const headers = {
+        authorization: `Bearer ${token}`,
+        // This short-lived proxy is part of the persistent daemon's return
+        // path. Marking it on-demand would temporarily relabel a live daemon
+        // and could suppress the offline/wakeup behavior after the turn.
+        "x-hilos-connection-mode": "daemon",
+        ...(DAEMON_CLIENT ? { "x-hilos-client": DAEMON_CLIENT } : {}),
+      };
+      for (const name of FORWARDED_REQUEST_HEADERS) {
+        const value = request.headers[name];
+        if (typeof value === "string" && value.length <= MAX_HEADER_LENGTH) {
+          headers[name] = value;
+        }
+      }
+      const forwarded = await fetchImpl(upstream, {
+        method: request.method,
+        headers,
+        ...(body ? { body } : {}),
+        signal: controller.signal,
+      });
+      for (const name of FORWARDED_RESPONSE_HEADERS) {
+        const value = forwarded.headers.get(name);
+        if (value) response.setHeader(name, value);
+      }
+      response.writeHead(forwarded.status);
+      response.end(Buffer.from(await forwarded.arrayBuffer()));
+    } catch {
+      if (!response.destroyed && !response.writableEnded) {
+        response.writeHead(502, { "content-type": "application/json" });
+        response.end(JSON.stringify({ error: "hilos MCP loopback unavailable" }));
+      }
+    } finally {
+      upstreamRequests.delete(controller);
+      request.removeListener("aborted", abortUpstream);
+      response.removeListener("close", abortUpstream);
+    }
+  });
+
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", resolve);
+  });
+  const address = server.address();
+  if (!address || typeof address === "string") {
+    server.close();
+    return null;
+  }
+  let closed = false;
+  return {
+    url: `http://127.0.0.1:${address.port}${path}`,
+    async close() {
+      if (closed) return;
+      closed = true;
+      for (const controller of upstreamRequests) controller.abort();
+      server.closeAllConnections?.();
+      await new Promise((resolve) => server.close(() => resolve()));
+    },
+  };
+}

package/src/mcp.mjs

@@ -3,7 +3,7 @@
 import os from "node:os";
 
 // Best-effort host label so hilos can show "whose machine" this daemon runs on.
-const CLIENT = (() => {
+export const DAEMON_CLIENT = (() => {
   try {
     return `${os.userInfo().username}@${os.hostname()}`;
   } catch {
@@ -21,7 +21,7 @@ export function makeClient({ url, token }) {
         "content-type": "application/json",
         authorization: `Bearer ${token}`,
         "x-hilos-connection-mode": "daemon",
-        ...(CLIENT ? { "x-hilos-client": CLIENT } : {}),
+        ...(DAEMON_CLIENT ? { "x-hilos-client": DAEMON_CLIENT } : {}),
       },
       body: JSON.stringify({ jsonrpc: "2.0", id: ++id, method, params }),
     });

package/src/progress-emitter.mjs

@@ -22,6 +22,7 @@ import {
   createUsageFold,
   sanitizeText,
 } from "./agent-events.mjs";
+import { commandArgv } from "./argv.mjs";
 
 /**
  * Which parser/stream-flags a coding command wants, from its FIRST token.
@@ -34,8 +35,10 @@ import {
  * @returns {'claude_code'|'codex'|'cursor'|'opencode'|'antigravity'|'hermes'|'unknown'}
  */
 export function detectVendor(codingCmd) {
-  const first = String(codingCmd || "").trim().split(/\s+/)[0] || "";
-  const base = (first.split(/[/\\]/).pop() || "").toLowerCase();
+  const first = commandArgv(codingCmd)[0] || "";
+  const base = (first.split(/[/\\]/).pop() || "")
+    .toLowerCase()
+    .replace(/\.(?:exe|cmd|bat|com)$/i, "");
   if (base === "claude" || base === "claude-code" || base === "claude_code") return "claude_code";
   if (base === "codex") return "codex";
   // `agent` is Cursor's canonical binary name since Jan 2026 (the installer