hilos-agent 0.9.1 → 0.9.3

package/src/mcp-loopback.mjs

@@ -0,0 +1,142 @@
+// Turn-scoped loopback transport for a resumed Codex session (0854).
+//
+// Codex's remote MCP auth is normally an environment variable. The daemon
+// deliberately strips HILOS_* secrets from coding children, and handing a
+// persistent workspace token to a model-visible shell would undo that safety.
+// Instead, keep the token in the daemon process and expose a random loopback
+// URL only for the lifetime of one continuation. Codex can use every tool its
+// agent identity is authorized for; it never receives the bearer credential.
+
+import { createServer } from "node:http";
+import { randomBytes } from "node:crypto";
+import { DAEMON_CLIENT } from "./mcp.mjs";
+
+const MAX_BODY_BYTES = 2 * 1024 * 1024;
+const FORWARDED_RESPONSE_HEADERS = [
+  "content-type",
+  "mcp-session-id",
+  "mcp-protocol-version",
+  "www-authenticate",
+];
+const FORWARDED_REQUEST_HEADERS = [
+  "content-type",
+  "accept",
+  "mcp-session-id",
+  "mcp-protocol-version",
+  "mcp-method",
+  "mcp-name",
+];
+const MAX_HEADER_LENGTH = 4096;
+
+function readBody(request) {
+  return new Promise((resolve, reject) => {
+    let size = 0;
+    const chunks = [];
+    request.on("data", (chunk) => {
+      size += chunk.length;
+      if (size > MAX_BODY_BYTES) {
+        reject(new Error("request body too large"));
+        request.destroy();
+        return;
+      }
+      chunks.push(chunk);
+    });
+    request.on("end", () => resolve(Buffer.concat(chunks)));
+    request.on("error", reject);
+  });
+}
+
+/**
+ * Start an unguessable, loopback-only HTTP proxy to one authenticated hilos MCP
+ * endpoint. The caller must close it in finally after the coding turn.
+ * @param {{
+ *   url?: string,
+ *   token?: string,
+ *   channelId?: string,
+ *   fetchImpl?: typeof fetch,
+ * }} [options]
+ * @returns {Promise<{url: string, close: () => Promise<void>} | null>}
+ */
+export async function startHilosMcpLoopback({ url, token, channelId = "", fetchImpl = fetch } = {}) {
+  if (!url || !token) return null;
+  const nonce = randomBytes(24).toString("hex");
+  const path = `/mcp/${nonce}`;
+  const upstream = new URL(url);
+  // Preserve the room that caused this turn as MCP's effective context. This
+  // does not widen or narrow token access, but it keeps guest-room memory gates
+  // and other context-sensitive server policy active even when the model calls
+  // a workspace-scoped tool without a channelId argument.
+  if (channelId) upstream.searchParams.set("channelId", channelId);
+  const upstreamRequests = new Set();
+
+  const server = createServer(async (request, response) => {
+    if (request.url !== path || !["POST", "GET", "DELETE"].includes(request.method || "")) {
+      response.writeHead(404).end();
+      return;
+    }
+    const controller = new AbortController();
+    upstreamRequests.add(controller);
+    const abortUpstream = () => controller.abort();
+    request.once("aborted", abortUpstream);
+    response.once("close", abortUpstream);
+    try {
+      const body = request.method === "POST" ? await readBody(request) : undefined;
+      const headers = {
+        authorization: `Bearer ${token}`,
+        // This short-lived proxy is part of the persistent daemon's return
+        // path. Marking it on-demand would temporarily relabel a live daemon
+        // and could suppress the offline/wakeup behavior after the turn.
+        "x-hilos-connection-mode": "daemon",
+        ...(DAEMON_CLIENT ? { "x-hilos-client": DAEMON_CLIENT } : {}),
+      };
+      for (const name of FORWARDED_REQUEST_HEADERS) {
+        const value = request.headers[name];
+        if (typeof value === "string" && value.length <= MAX_HEADER_LENGTH) {
+          headers[name] = value;
+        }
+      }
+      const forwarded = await fetchImpl(upstream, {
+        method: request.method,
+        headers,
+        ...(body ? { body } : {}),
+        signal: controller.signal,
+      });
+      for (const name of FORWARDED_RESPONSE_HEADERS) {
+        const value = forwarded.headers.get(name);
+        if (value) response.setHeader(name, value);
+      }
+      response.writeHead(forwarded.status);
+      response.end(Buffer.from(await forwarded.arrayBuffer()));
+    } catch {
+      if (!response.destroyed && !response.writableEnded) {
+        response.writeHead(502, { "content-type": "application/json" });
+        response.end(JSON.stringify({ error: "hilos MCP loopback unavailable" }));
+      }
+    } finally {
+      upstreamRequests.delete(controller);
+      request.removeListener("aborted", abortUpstream);
+      response.removeListener("close", abortUpstream);
+    }
+  });
+
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", resolve);
+  });
+  const address = server.address();
+  if (!address || typeof address === "string") {
+    server.close();
+    return null;
+  }
+  let closed = false;
+  return {
+    url: `http://127.0.0.1:${address.port}${path}`,
+    async close() {
+      if (closed) return;
+      closed = true;
+      for (const controller of upstreamRequests) controller.abort();
+      server.closeAllConnections?.();
+      await new Promise((resolve) => server.close(() => resolve()));
+    },
+  };
+}

package/src/mcp.mjs

@@ -3,7 +3,7 @@
 import os from "node:os";
 
 // Best-effort host label so hilos can show "whose machine" this daemon runs on.
-const CLIENT = (() => {
+export const DAEMON_CLIENT = (() => {
   try {
     return `${os.userInfo().username}@${os.hostname()}`;
   } catch {
@@ -21,7 +21,7 @@ export function makeClient({ url, token }) {
         "content-type": "application/json",
         authorization: `Bearer ${token}`,
         "x-hilos-connection-mode": "daemon",
-        ...(CLIENT ? { "x-hilos-client": CLIENT } : {}),
+        ...(DAEMON_CLIENT ? { "x-hilos-client": DAEMON_CLIENT } : {}),
       },
       body: JSON.stringify({ jsonrpc: "2.0", id: ++id, method, params }),
     });

package/src/model-resolve.mjs

@@ -1,23 +1,20 @@
-// Runtime model-preset resolution (0504). The connect UI offers capability
-// TIERS (Most capable / Balanced / Fastest), but Cursor's model ids are
-// account- and plan-specific and churn weekly — a baked id that works for one
-// user 404s for another, which is why VENDOR_CLI.cursor.model stayed empty for
-// months. So the tier resolves HERE, at run time, against the account's OWN
-// `cursor-agent --list-models` output: we only ever emit an id the CLI itself
-// just listed, and when nothing matches we emit no flag at all (the tool's
-// default — `auto` routing — stands). Never a guessed id, never a wrong flag.
-//
-// Design rules (mirror the .mjs siblings): the parse/resolve transforms are
-// PURE + node-builtins-only; the resolver takes an injected `run` (runCli) so
-// tests drive it with no CLI; a resolution failure NEVER breaks a run ([]).
-//
-// codex joined in 0783 on the SAME terms: `codex debug models` ("Render the raw
+// Runtime model-preset resolution (0504). Codex gets provider-neutral tiers in
+// new commands: `codex debug models` ("Render the raw
 // model catalog as JSON") is its `--list-models`, so its tier also resolves at
 // run time against the account's own catalog and never against a baked slug.
 // That matters more for codex than for anyone: its slugs are codenames that rev
 // (`gpt-5.6-sol`, `gpt-5.6-terra`, `gpt-5.6-luna` in the live catalog) and are
 // plan-gated — a run on a ChatGPT account rejects `gpt-5` outright with "The
 // 'gpt-5' model is not supported when using Codex with a ChatGPT account".
+//
+// Cursor remains below only as a compatibility reader for existing 0.9.2
+// configs that stored the old Anthropic-shaped tier names. New Hilos commands
+// do not set a Cursor tier: Cursor's catalog mixes providers and account-only
+// ids, so its own `auto` model choice is the only honest default.
+//
+// Design rules (mirror the .mjs siblings): the parse/resolve transforms are
+// PURE + node-builtins-only; the resolver takes an injected `run` (runCli) so
+// tests drive it with no CLI; a resolution failure NEVER breaks a run ([]).
 
 /** Strip ANSI SGR color codes (`--list-models` output is colorized). */
 export function stripAnsi(s) {
@@ -55,6 +52,24 @@ const TIER_PREFS = {
   haiku: [/^composer.*fast/, /-fast$/],
 };
 
+/**
+ * Public tier names are provider-neutral. Keep the original Anthropic-shaped
+ * values as read aliases so existing hilos-agent.json files and already-copied
+ * commands continue to work after 0.9.3.
+ */
+export function normalizeModelTier(tier) {
+  const value = String(tier || "").trim().toLowerCase();
+  return ({
+    "most-capable": "opus",
+    balanced: "sonnet",
+    fastest: "haiku",
+    opus: "opus",
+    sonnet: "sonnet",
+    haiku: "haiku",
+    default: "default",
+  })[value] || "";
+}
+
 /**
  * Pick the account's model id for a tier, or null when nothing fits.
  * @param {'opus'|'sonnet'|'haiku'|string} tier
@@ -62,7 +77,7 @@ const TIER_PREFS = {
  * @returns {string|null}
  */
 export function resolveCursorModel(tier, ids) {
-  const prefs = TIER_PREFS[tier];
+  const prefs = TIER_PREFS[normalizeModelTier(tier)];
   if (!prefs || !Array.isArray(ids)) return null;
   for (const re of prefs) {
     const hit = ids.find((id) => typeof id === "string" && re.test(id));
@@ -181,13 +196,14 @@ const CODEX_TIER_PREFS = {
  * @returns {string|null}
  */
 export function resolveCodexModel(tier, models) {
-  const prefs = CODEX_TIER_PREFS[tier];
+  const normalized = normalizeModelTier(tier);
+  const prefs = CODEX_TIER_PREFS[normalized];
   if (!prefs || !Array.isArray(models) || models.length === 0) return null;
   for (const re of prefs) {
     const hit = models.find((m) => m && typeof m.text === "string" && re.test(m.text));
     if (hit) return hit.slug;
   }
-  if (tier === "haiku") return models[models.length - 1].slug;
+  if (normalized === "haiku") return models[models.length - 1].slug;
   return models[0].slug;
 }
 
@@ -231,7 +247,7 @@ export function createModelArgsResolver({ run } = {}) {
   return async function modelArgsFor(cfg, vendor) {
     try {
       const spec = LIST_MODELS[vendor];
-      const tier = String(cfg?.codingModel || "").trim();
+      const tier = normalizeModelTier(cfg?.codingModel);
       if (!spec || !tier || tier === "default") return [];
       const cmd = String(cfg?.codingCmd || "");
       // Hand-pinned wins — including codex's short spelling (`-m gpt-5.6-sol`),

package/src/progress-emitter.mjs

@@ -22,6 +22,7 @@ import {
   createUsageFold,
   sanitizeText,
 } from "./agent-events.mjs";
+import { commandArgv } from "./argv.mjs";
 
 /**
  * Which parser/stream-flags a coding command wants, from its FIRST token.
@@ -34,8 +35,10 @@ import {
  * @returns {'claude_code'|'codex'|'cursor'|'opencode'|'antigravity'|'hermes'|'unknown'}
  */
 export function detectVendor(codingCmd) {
-  const first = String(codingCmd || "").trim().split(/\s+/)[0] || "";
-  const base = (first.split(/[/\\]/).pop() || "").toLowerCase();
+  const first = commandArgv(codingCmd)[0] || "";
+  const base = (first.split(/[/\\]/).pop() || "")
+    .toLowerCase()
+    .replace(/\.(?:exe|cmd|bat|com)$/i, "");
   if (base === "claude" || base === "claude-code" || base === "claude_code") return "claude_code";
   if (base === "codex") return "codex";
   // `agent` is Cursor's canonical binary name since Jan 2026 (the installer
@@ -66,7 +69,7 @@ export function detectVendor(codingCmd) {
  * @returns {string}
  */
 export function fastChatCmd(vendor) {
-  if (vendor === "claude_code") return "claude -p --model claude-haiku-4-5";
+  if (vendor === "claude_code") return "claude -p --model haiku";
   if (vendor === "codex") return "codex exec --skip-git-repo-check";
   if (vendor === "cursor") return "cursor-agent -p --output-format text --trust";
   if (vendor === "opencode") return "opencode run";