hilos-agent 0.9.5 → 0.10.1

package/README.md

@@ -50,6 +50,7 @@ Running from elsewhere, or want to map several repos explicitly? Use a config:
   "codingCmd": "claude -p --permission-mode acceptEdits",  // safe default; see Permissions / autonomy. or "codex exec", "cursor-agent -p --output-format text --trust", "opencode run", "agy -p", any command
   "codingModel": "",  // Codex tier ("most-capable" | "balanced" | "fastest"), resolved against this account's own model list; "" = the tool's default
   "chatCmd": "",  // FAST command for chat replies + the plan-ack. Empty = derived from codingCmd's tool (codex daemons chat with codex, etc.); set to override
+  "webSearch": true,  // native public-web tools are on by default; false stops Hilos enablement/instructions
   "defaultBranch": "main",
   "gate": false,               // default: open a PR directly. true = approve-before-push
   "heartbeatMs": 180000,       // long runs post one "still working…" thread reply this often (0 = off, min 15s)
@@ -71,10 +72,19 @@ a stderr tail) instead of claiming "no changes". Chat replies use the faster
 `chatCmd` (when unset, derived from `codingCmd`'s tool — a Claude daemon chats
 with Haiku, a Codex daemon with `codex exec`, and so on) bounded by
 `chatTimeoutMs`. The chat-vs-code pass only classifies; the separate chat
-responder keeps the CLI's normal tools. Generated Codex chat and code commands
-explicitly enable its built-in web search (an explicit operator override still
-wins), while other vendors keep their own tool configuration. The responsive
-surface needs a hilos server new enough to expose
+responder keeps the CLI's normal tools. Public web is on by default and stays
+native to the selected CLI: Hilos pre-approves Claude Code's read-only
+`WebSearch`/`WebFetch`, enables Codex search, turns on OpenCode's official Exa
+search switch, preserves Hermes's full web-capable coding toolset, and keeps
+Cursor and Antigravity's built-ins. Generated chat replies use Cursor `ask`
+with safe auto-review, OpenCode
+`plan`, Antigravity `plan`, Codex's read-only sandbox, or Hermes `safe,web`
+where available; coding runs keep their normal tool/approval policy. Run
+`hilos-agent web doctor` to inspect the configured contract. Set
+`"webSearch": false`, `HILOS_WEB_SEARCH=0`, or `--no-web-search` to stop Hilos
+from enabling or requesting web use; the CLI's own global/project tool policy
+still applies. Custom commands retain their own tools without guessed flags.
+The responsive surface needs a hilos server new enough to expose
 `edit_message`; older servers just skip the live edits.
 
 ```sh
@@ -82,6 +92,45 @@ hilos-agent          # watch every channel the agent is in
 hilos-agent --channel <id>   # scope to one channel
 ```
 
+## WebMCP site tools
+
+The local daemon can give its coding and chat agents a narrow bridge to
+third-party WebMCP sites. It is off until you name exact origins and exact read
+tools in the machine's config:
+
+```jsonc
+{
+  "webMcp": {
+    "origins": {
+      "https://docs.example.com": {
+        "readTools": ["search_docs", "read_reference"]
+      }
+    }
+  }
+}
+```
+
+The site does not authorize itself: `readOnlyHint` is informational, while this
+person-owned list decides what may run. Site descriptions are omitted, schema
+prose is stripped, results are bounded and labeled untrusted, and cookies stay
+inside a separate browser profile. The bundled browser bridge currently needs
+Node.js 24 or newer; the rest of the daemon keeps its existing Node.js support.
+
+```sh
+hilos-agent webmcp doctor
+hilos-agent webmcp login https://docs.example.com  # person signs in in the opened browser
+hilos-agent webmcp open https://docs.example.com/reference
+hilos-agent webmcp tools
+hilos-agent webmcp call search_docs '{"query":"WebMCP"}'
+hilos-agent webmcp close
+```
+
+The daemon adds this capability and its citation rules to agent prompts only
+when the config is valid. Unlisted tools — including writes — are refused with
+`human_approval_required`; there is no approval flag the agent can set. WebMCP
+can never approve or merge hilos work. See the complete contract in
+[WebMCP in hilos](https://hilos.sh/docs/webmcp).
+
 ## How it works
 
 - **Trigger** — an `@mention` of your agent in a channel that's linked to a repo,

package/bin/hilos-agent.mjs

@@ -7,6 +7,7 @@
 //   hilos-agent --join <blob>      connect with a copy-paste link from hilos
 //   hilos-agent --join-stdin       read a private link without exposing it in argv
 //   hilos-agent init               write a starter config (~/.hilos/agent.json)
+//   hilos-agent webmcp doctor      verify the local site-tool bridge
 //   hilos-agent                    run with the resolved config (default)
 //   hilos-agent run                same as above, explicit
 //
@@ -17,6 +18,7 @@
 // codingCmd in hilos-agent.json to change it and the daemon picks it up on its
 // next poll — no restart needed.
 
+import { spawnSync } from "node:child_process";
 import { readFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 
@@ -24,6 +26,9 @@ import { resolveConfig, decodeJoin, writeStarterConfig, GLOBAL_CONFIG } from "..
 import { readPrivateJoin } from "../src/join-input.mjs";
 import { run } from "../src/run.mjs";
 import { hookMain, hooksMain } from "../src/hook.mjs";
+import { runWebMcpCommand } from "../src/webmcp-bridge.mjs";
+import { detectVendor, fastChatCmd, webCapability } from "../src/progress-emitter.mjs";
+import { commandArgv } from "../src/argv.mjs";
 
 function packageVersion() {
   const pkgPath = fileURLToPath(new URL("../package.json", import.meta.url));
@@ -44,6 +49,8 @@ function parseArgs(argv) {
     else if (a === "--coding-cmd") flags.codingCmd = argv[++i];
     else if (a === "--coding-model") flags.codingModel = argv[++i];
     else if (a === "--chat-cmd") flags.chatCmd = argv[++i];
+    else if (a === "--no-web-search") flags.webSearch = false;
+    else if (a === "--web-search") flags.webSearch = true;
     else if (a === "--once") flags.once = true;
     else if (a === "--backfill") flags.backfill = true;
     else if (a === "--no-gate") flags.gate = false;
@@ -67,6 +74,13 @@ const HELP = `hilos-agent — your coding agent as a teammate in hilos
   hilos-agent --join <blob>      connect using a link copied from hilos
   hilos-agent --join-stdin       paste the private link at a no-echo prompt
   hilos-agent init               write a starter config to ~/.hilos/agent.json
+  hilos-agent webmcp doctor      verify the local WebMCP browser bridge
+  hilos-agent webmcp login <url> open the isolated profile for person sign-in
+  hilos-agent webmcp open <url>  open a person-allowlisted site for an agent
+  hilos-agent webmcp tools       list registered, person-allowlisted read tools
+  hilos-agent webmcp call <name> '<json object>'
+  hilos-agent webmcp close       close the isolated browser session
+  hilos-agent web doctor         report this CLI's native public-web capability
   hilos-agent                    run the daemon (watch @mentions, propose diffs)
   hilos-agent hooks install      stream this repo's Codex, Claude, and Cursor
                                  sessions to hilos and continue replies in the same
@@ -90,6 +104,7 @@ Options:
   --chat-cmd <cmd>   fast command for chat replies + the plan-ack (default:
                      derived from the coding command, so a Codex or Cursor
                      daemon chats with its own tool)
+  --no-web-search    stop hilos from enabling/requesting native public web
   --once             one poll then exit (cron-friendly)
   --backfill         also act on mentions that predate startup
   --no-gate          propose only; don't wait for approval / push
@@ -150,6 +165,57 @@ async function main() {
     return;
   }
 
+  if (cmd === "webmcp") {
+    const cliFlags = { ...flags };
+    delete cliFlags.help;
+    const cfg = resolveConfig({ flags: cliFlags });
+    const operation = positional[1] || "doctor";
+    const result = await runWebMcpCommand(cfg, operation, positional.slice(2));
+    console.log(JSON.stringify(result, null, 2));
+    if (!result.ok) process.exitCode = 1;
+    return;
+  }
+
+  if (cmd === "web") {
+    const operation = positional[1] || "doctor";
+    if (operation !== "doctor") {
+      throw new Error(`Unknown web command: ${operation}. Try \`hilos-agent web doctor\`.`);
+    }
+    const cliFlags = { ...flags };
+    delete cliFlags.help;
+    const cfg = resolveConfig({ flags: cliFlags });
+    const codingCommand = cfg.codingCmd;
+    const chatCommand = cfg.chatCmd || fastChatCmd(detectVendor(codingCommand)) || codingCommand;
+    const describe = (command) => {
+      const argv = commandArgv(command);
+      const vendor = detectVendor(command);
+      const capability = webCapability(vendor, {
+        enabled: cfg.webSearch !== false,
+        args: argv.slice(1),
+      });
+      const binary = argv[0] || "";
+      const probed = binary
+        ? spawnSync(binary, ["--version"], { encoding: "utf8", timeout: 5_000 })
+        : null;
+      const binaryAvailable = Boolean(binary) && !probed?.error;
+      const version = String(probed?.stdout || probed?.stderr || "").trim().split("\n")[0] || null;
+      return { vendor, binary, binaryAvailable, version, command, ...capability };
+    };
+    const chat = describe(chatCommand);
+    const code = codingCommand === chatCommand ? chat : describe(codingCommand);
+    console.log(JSON.stringify({
+      ok: [chat, code].every((lane) => lane.status === "enabled" && lane.binaryAvailable),
+      chat,
+      code,
+      note: !chat.binaryAvailable || !code.binaryAvailable
+        ? "One or more selected CLI binaries are not installed or not on PATH."
+        : chat.verified && code.verified
+          ? "Configured by hilos-agent; this does not spend a model call or test provider credentials."
+          : "Custom commands keep their own tool configuration; hilos-agent does not guess flags.",
+    }, null, 2));
+    return;
+  }
+
   // run (default) — when --join is passed without init, connect straight away.
   const cliFlags = { ...flags };
   delete cliFlags.join;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hilos-agent",
-  "version": "0.9.5",
+  "version": "0.10.1",
   "description": "Run your own coding agent (Claude Code / Codex / Cursor) as an autonomous teammate in a hilos channel. Picks up @mentions in channels and threads, makes the change, and opens a PR for review — your code and credentials never leave your machine. (Approve-before-push is available via gate:true.)",
   "type": "module",
   "bin": {
@@ -32,5 +32,8 @@
     "cursor",
     "coding-agent"
   ],
-  "license": "MIT"
+  "license": "MIT",
+  "dependencies": {
+    "agent-browser": "^0.35.0"
+  }
 }

package/src/cli.mjs

@@ -332,6 +332,13 @@ function runCliOnce(opts) {
 // inside runCli (not a wrapper) so every call site, present and future, gets it.
 const UNKNOWN_TRUST_RE = /unknown option '--trust'/;
 
+// Compat retry (0974): --auto-review is the current Cursor CLI's safe,
+// server-classified approval mode, which lets read-only Web calls run in the
+// conversational `ask` profile. Older Cursor CLIs do not know that flag. On
+// the exact commander error, retry without it so upgrading Hilos cannot make
+// an otherwise-working older local CLI fail before it sees the prompt.
+const UNKNOWN_CURSOR_AUTO_REVIEW_RE = /unknown option '--auto-review'/;
+
 // Compat retry (0777): the permission gate adds `--permission-prompt-tool` (and
 // the `--mcp-config` that serves it) to claude runs. The flag is real but
 // undocumented on 2.1.233, so a Claude Code old enough not to know it would
@@ -373,7 +380,28 @@ export async function runCli(opts) {
     args.includes("--trust") &&
     UNKNOWN_TRUST_RE.test(first.stderr || "")
   ) {
-    return runCliOnce({ ...opts, args: args.filter((a) => a !== "--trust") });
+    const withoutTrust = args.filter((a) => a !== "--trust");
+    const retried = await runCliOnce({ ...opts, args: withoutTrust });
+    if (
+      retried.status !== 0 &&
+      !retried.aborted &&
+      withoutTrust.includes("--auto-review") &&
+      UNKNOWN_CURSOR_AUTO_REVIEW_RE.test(retried.stderr || "")
+    ) {
+      return runCliOnce({
+        ...opts,
+        args: withoutTrust.filter((a) => a !== "--auto-review"),
+      });
+    }
+    return retried;
+  }
+  if (
+    first.status !== 0 &&
+    !first.aborted &&
+    args.includes("--auto-review") &&
+    UNKNOWN_CURSOR_AUTO_REVIEW_RE.test(first.stderr || "")
+  ) {
+    return runCliOnce({ ...opts, args: args.filter((a) => a !== "--auto-review") });
   }
   if (
     first.status !== 0 &&

package/src/codex-mcp-session.mjs

@@ -149,6 +149,7 @@ export function mapCodexDecision(reply, availableDecisions) {
  *   prompt?: string,
  *   env?: Record<string, string | undefined>,
  *   model?: string | null,
+ *   webSearch?: boolean,
  *   sandbox?: string,
  *   approvalPolicy?: string,
  *   resumeThreadId?: string | null,
@@ -173,6 +174,7 @@ export async function runCodexMcpSession({
   prompt = "",
   env,
   model = null,
+  webSearch = true,
   sandbox = "workspace-write",
   approvalPolicy = "untrusted",
   resumeThreadId = null,
@@ -464,7 +466,7 @@ export async function runCodexMcpSession({
             // The gated transport cannot inherit `codex exec` argv. Carry the
             // same public web-search capability through the MCP tool's config;
             // permission policy and sandboxing remain unchanged.
-            config: { tools: { web_search: true } },
+            ...(webSearch ? { config: { tools: { web_search: true } } } : {}),
             ...(model ? { model } : {}),
           },
         };

package/src/config.mjs

@@ -53,6 +53,16 @@ const DEFAULTS = {
   // and preview (default) vs production. Shape:
   // { "<channelId>": { provider: "vercel" | "netlify", prod: false } }.
   deploy: {},
+  // Local WebMCP consumer (0959). Disabled until the person names exact site
+  // origins and exact read-only tools. A site's readOnlyHint is never an
+  // authorization signal. Shape:
+  // { origins: { "https://example.com": { readTools: ["search_docs"] } },
+  //   profile?: "/absolute/private/browser/profile" }
+  webMcp: null,
+  // Public web is a baseline agent capability. Supported local CLIs use their
+  // own search/fetch tools; false stops Hilos from enabling or requesting it.
+  // The CLI's own global/project policy remains the ultimate authority.
+  webSearch: true,
   // acceptEdits lets the CLI make file edits without prompting (bias to action);
   // it still won't run arbitrary commands. Override in hilos-agent.json if you
   // want a stricter (or `--dangerously-skip-permissions`) command.
@@ -167,6 +177,12 @@ export function resolveConfig({ flags = {}, join: joinPayload } = {}) {
     codingCmd: process.env.CODING_CMD,
     codingModel: process.env.HILOS_CODING_MODEL,
     chatCmd: process.env.HILOS_CHAT_CMD,
+    webSearch:
+      /^(1|on|true)$/i.test(process.env.HILOS_WEB_SEARCH || "")
+        ? true
+        : /^(0|off|false)$/i.test(process.env.HILOS_WEB_SEARCH || "")
+          ? false
+          : undefined,
     heartbeatMs: process.env.HILOS_HEARTBEAT_MS ? Number(process.env.HILOS_HEARTBEAT_MS) : undefined,
     progressMs: process.env.HILOS_PROGRESS_MS ? Number(process.env.HILOS_PROGRESS_MS) : undefined,
     chatTimeoutMs: process.env.HILOS_CHAT_TIMEOUT_MS ? Number(process.env.HILOS_CHAT_TIMEOUT_MS) : undefined,
@@ -251,6 +267,8 @@ const LIVE_FIELDS = [
   // like `repos`, so a partial edit doesn't drop the defaults.
   "folders",
   "deploy",
+  "webMcp",
+  "webSearch",
 ];
 
 /**
@@ -293,6 +311,14 @@ export function reloadConfig(prev) {
   // the normal on state. An explicit launch flag remains pinned when the file
   // was never changed, preserving the 0576 precedence rule above.
   if (changed("replyBridge")) next.replyBridge = file.replyBridge !== false;
+  // WebMCP is an authorization allowlist. Removing it must revoke the browser
+  // bridge on the next poll rather than preserving stale origins/tools until a
+  // restart. An explicit null and a deleted edited key both mean disabled.
+  if (changed("webMcp")) next.webMcp = file.webMcp ?? null;
+  // Native web is safe-on by default. Removing an edited `webSearch:false`
+  // returns to that default on the next poll instead of pinning a stale opt-out
+  // until restart; the environment override below still wins.
+  if (changed("webSearch")) next.webSearch = file.webSearch !== false;
   // The environment stays the operator's override on reload, in both
   // directions — a machine that opted out with =0 must not be opted back in by
   // a file edit (0792).
@@ -303,6 +329,8 @@ export function reloadConfig(prev) {
   if (process.env.CODING_CMD) next.codingCmd = process.env.CODING_CMD;
   if (process.env.HILOS_CODING_MODEL) next.codingModel = process.env.HILOS_CODING_MODEL;
   if (process.env.HILOS_CHAT_CMD) next.chatCmd = process.env.HILOS_CHAT_CMD;
+  if (/^(1|on|true)$/i.test(process.env.HILOS_WEB_SEARCH || "")) next.webSearch = true;
+  if (/^(0|off|false)$/i.test(process.env.HILOS_WEB_SEARCH || "")) next.webSearch = false;
   if (process.env.HILOS_HEARTBEAT_MS) next.heartbeatMs = Number(process.env.HILOS_HEARTBEAT_MS);
   if (process.env.HILOS_PROGRESS_MS) next.progressMs = Number(process.env.HILOS_PROGRESS_MS);
   if (process.env.HILOS_CHAT_TIMEOUT_MS) next.chatTimeoutMs = Number(process.env.HILOS_CHAT_TIMEOUT_MS);
@@ -327,6 +355,7 @@ export function writeStarterConfig(path, partial = {}) {
     repos: partial.repos || { "owner/name": "/absolute/path/to/checkout" },
     codingCmd: partial.codingCmd || DEFAULTS.codingCmd,
     ...(partial.codingModel ? { codingModel: partial.codingModel } : {}),
+    webSearch: partial.webSearch !== false,
     defaultBranch: DEFAULTS.defaultBranch,
     // false = open a PR directly (bias to action); true = approve-before-push.
     gate: false,

package/src/handler.mjs

@@ -40,6 +40,7 @@ import {
 import { makeStreamParser, createUsageFold } from "./agent-events.mjs";
 import {
   detectVendor,
+  chatWebArgs,
   codeStreamArgs,
   codeWebArgs,
   codeDirArgs,
@@ -49,6 +50,8 @@ import {
   attachTarget,
   createProgressEmitter,
   fastChatCmd,
+  nativeWebPrompt,
+  webToolEnv,
 } from "./progress-emitter.mjs";
 import { createTranscriptTap } from "./transcript.mjs";
 import { imagePromptNote, renderAttachmentLine } from "./attachments.mjs";
@@ -83,6 +86,7 @@ import {
   shouldGateCodexPermissions,
 } from "./codex-mcp-session.mjs";
 import { createUngatedRunNotice } from "./permission-gate.mjs";
+import { webMcpAgentPrompt } from "./webmcp-bridge.mjs";
 
 /**
  * The environment for a coding/chat CLI run. runCli always strips HILOS_* on top
@@ -97,6 +101,15 @@ function codingChildEnv(cfg) {
     : undefined;
 }
 
+/** Add only the selected CLI's public-web enablement to its already-isolated
+ * child environment. Today this changes OpenCode only; keeping it shared makes
+ * argv, ACP, HTTP, gated, and conversational runs follow one contract. */
+function codingChildWebEnv(cfg, vendor) {
+  return webToolEnv(vendor, codingChildEnv(cfg), {
+    enabled: cfg?.webSearch !== false,
+  });
+}
+
 /**
  * The fast chat command for this config: an explicit chatCmd wins, else the
  * coding vendor's verified non-interactive print mode (fastChatCmd), else the
@@ -693,6 +706,7 @@ async function runCodexGatedSession({
     // took the account default before this, so a preset was silently ignored
     // exactly where the operator was most likely to have set one.
     model: model || null,
+    webSearch: cfg.webSearch !== false,
     resumeThreadId,
     timeoutMs: cfg.runTimeoutMs,
     signal,
@@ -1263,6 +1277,15 @@ function memoryPreamble(workspaceMemory) {
   return m ? `Workspace context (the project's soul):\n${m}\n\n` : "";
 }
 
+/** Shared context for a model that may act, not the read-only intent router. */
+function agentPreamble(workspaceMemory, cfg) {
+  return (
+    memoryPreamble(workspaceMemory) +
+    nativeWebPrompt(cfg?.webSearch !== false) +
+    webMcpAgentPrompt(cfg)
+  );
+}
+
 /**
  * Recent conversation the agent should reply within: the thread it was pinged in
  * (threads are where conversations live), else the channel tail. Returns the raw
@@ -1368,7 +1391,7 @@ async function respondConversationally({ message, channelId, tool, me, cfg, repo
     `concisely and directly as a single chat message — no preamble, no headings. ` +
     `${repoLine}` +
     `${dmJudgmentBlock(implicitDm)}\n\n` +
-    `${memoryPreamble(workspaceMemory)}` +
+    `${agentPreamble(workspaceMemory, cfg)}` +
     `Conversation so far:\n${transcript}`;
 
   // Chat uses the FAST one-shot command (the coding vendor's own print mode when
@@ -1376,6 +1399,10 @@ async function respondConversationally({ message, channelId, tool, me, cfg, repo
   // and a stalled model can't dead-air the channel for the full coding timeout.
   const cmd = chatCmdFor(cfg);
   const parts = cmd.split(" ").filter(Boolean);
+  const chatVendor = detectVendor(cmd);
+  const webArgs = chatWebArgs(chatVendor, parts.slice(1), {
+    enabled: cfg.webSearch !== false,
+  });
   console.log(`  chat → running \`${cmd}\` (output appears when it finishes)…`);
 
   // If the reply is slow, post ONE "still thinking…" ping and then edit it into
@@ -1406,11 +1433,11 @@ async function respondConversationally({ message, channelId, tool, me, cfg, repo
   try {
     run = await runCli({
       cmd: parts[0],
-      args: [...parts.slice(1), prompt],
+      args: [...parts.slice(1), ...webArgs, prompt],
       timeoutMs: cfg.chatTimeoutMs || cfg.runTimeoutMs,
       label: "thinking",
       signal,
-      env: codingChildEnv(cfg),
+      env: codingChildWebEnv(cfg, chatVendor),
     });
   } finally {
     beatStopped = true;
@@ -2090,7 +2117,9 @@ async function handleFolderTask({ message, channelId, tool, me, caps, cfg, deps,
     // 0779: [] for every vendor without a verified image flag — their argv is
     // byte-identical to before, and the prompt note still names the files.
     const imageArgs = codeImageArgs(vendor, localImages);
-    const webArgs = codeWebArgs(vendor, parts.slice(1));
+    const webArgs = codeWebArgs(vendor, parts.slice(1), {
+      enabled: cfg.webSearch !== false,
+    });
     const codeArgs = [
       ...parts.slice(1),
       ...webArgs,
@@ -2175,10 +2204,10 @@ async function handleFolderTask({ message, channelId, tool, me, caps, cfg, deps,
           cmd: parts[0],
           vendor,
           cwd: folderPath,
-          prompt: memoryPreamble(workspaceMemory) + promptText,
+          prompt: agentPreamble(workspaceMemory, cfg) + promptText,
           timeoutMs: cfg.runTimeoutMs,
           signal,
-          env: scrubHilosEnv(codingChildEnv(cfg) || process.env),
+          env: scrubHilosEnv(codingChildWebEnv(cfg, vendor) || process.env),
           onData: handleCliData,
           onEvent: handleCliEvent,
           ...openCodePermissionCallbacks({
@@ -2194,10 +2223,10 @@ async function handleFolderTask({ message, channelId, tool, me, caps, cfg, deps,
           cmd: parts[0],
           args: codeArgs,
           cwd: folderPath,
-          prompt: memoryPreamble(workspaceMemory) + promptText,
+          prompt: agentPreamble(workspaceMemory, cfg) + promptText,
           timeoutMs: cfg.runTimeoutMs,
           signal,
-          env: scrubHilosEnv(codingChildEnv(cfg) || process.env),
+          env: scrubHilosEnv(codingChildWebEnv(cfg, vendor) || process.env),
           onData: handleCliData,
           ...openCodePermissionCallbacks({
             tool,
@@ -2214,7 +2243,7 @@ async function handleFolderTask({ message, channelId, tool, me, caps, cfg, deps,
           cmd: parts[0],
           codeArgs,
           cwd: folderPath,
-          prompt: memoryPreamble(workspaceMemory) + promptText,
+          prompt: agentPreamble(workspaceMemory, cfg) + promptText,
           model: resolvedModelId,
           signal,
           onData: handleCliData,
@@ -2234,7 +2263,7 @@ async function handleFolderTask({ message, channelId, tool, me, caps, cfg, deps,
           onGateDropped: () => noticeUngatedRun(parts[0]),
           cmd: parts[0],
           codeArgs,
-          prompt: memoryPreamble(workspaceMemory) + promptText,
+          prompt: agentPreamble(workspaceMemory, cfg) + promptText,
           cwd: folderPath,
           signal,
           onData: handleCliData,
@@ -2252,13 +2281,13 @@ async function handleFolderTask({ message, channelId, tool, me, caps, cfg, deps,
           cmd: parts[0],
           args: [
             ...codeArgs,
-            memoryPreamble(workspaceMemory) + promptText,
+            agentPreamble(workspaceMemory, cfg) + promptText,
           ],
           cwd: folderPath,
           timeoutMs: cfg.runTimeoutMs,
           label: "coding",
           signal,
-          env: codingChildEnv(cfg),
+          env: codingChildWebEnv(cfg, vendor),
           onData: handleCliData,
         });
       }
@@ -3431,7 +3460,9 @@ export async function handleTask({ message, channelId, tool, me, caps = {} }, cf
     // `exec`, so it has to sit ahead of it. [] for every vendor without a
     // verified flag, leaving their argv byte-identical to before.
     const imageArgs = codeImageArgs(vendor, localImages);
-    const webArgs = codeWebArgs(vendor, parts.slice(1));
+    const webArgs = codeWebArgs(vendor, parts.slice(1), {
+      enabled: cfg.webSearch !== false,
+    });
     const codeArgs = streamOn
       ? [...parts.slice(1), ...webArgs, ...modelArgs, ...dirArgs, ...imageArgs, ...resumeArgs, ...streamArgs]
       : [...parts.slice(1), ...webArgs, ...modelArgs, ...dirArgs, ...imageArgs, ...resumeArgs];
@@ -3526,13 +3557,13 @@ export async function handleTask({ message, channelId, tool, me, caps = {} }, cf
           cmd: parts[0],
           vendor,
           cwd: repoPath,
-          prompt: memoryPreamble(workspaceMemory) + promptText,
+          prompt: agentPreamble(workspaceMemory, cfg) + promptText,
           // 0778: approvals AND continuity. `resume:false` (the never-worse
           // retry) drops it exactly like buildResumeArgs does.
           resumeSessionId: resume ? resumeSessionId : null,
           timeoutMs: cfg.runTimeoutMs,
           signal,
-          env: scrubHilosEnv(codingChildEnv(cfg) || process.env),
+          env: scrubHilosEnv(codingChildWebEnv(cfg, vendor) || process.env),
           onData: handleCliData,
           onEvent: handleCliEvent,
           ...openCodePermissionCallbacks({
@@ -3549,13 +3580,13 @@ export async function handleTask({ message, channelId, tool, me, caps = {} }, cf
           cmd: parts[0],
           args: codeArgs,
           cwd: repoPath,
-          prompt: memoryPreamble(workspaceMemory) + promptText,
+          prompt: agentPreamble(workspaceMemory, cfg) + promptText,
           timeoutMs: cfg.runTimeoutMs,
           signal,
           // A model running inside the server must never inherit the daemon's
           // hilos bearer token. The bridge's random loopback password is added
           // after this scrub and dies with the process group.
-          env: scrubHilosEnv(codingChildEnv(cfg) || process.env),
+          env: scrubHilosEnv(codingChildWebEnv(cfg, vendor) || process.env),
           onData: handleCliData,
           ...openCodePermissionCallbacks({
             tool,
@@ -3573,7 +3604,7 @@ export async function handleTask({ message, channelId, tool, me, caps = {} }, cf
           cmd: parts[0],
           codeArgs,
           cwd: repoPath,
-          prompt: memoryPreamble(workspaceMemory) + promptText,
+          prompt: agentPreamble(workspaceMemory, cfg) + promptText,
           model: resolvedModelId,
           // Codex's own resume over this transport. `resume:false` (the
           // never-worse retry) drops it exactly like buildResumeArgs does.
@@ -3599,7 +3630,7 @@ export async function handleTask({ message, channelId, tool, me, caps = {} }, cf
           // codeArgs already carries this run's resume flags, so a gated
           // iterate resumes AND raises cards — the two never traded off.
           codeArgs,
-          prompt: memoryPreamble(workspaceMemory) + promptText,
+          prompt: agentPreamble(workspaceMemory, cfg) + promptText,
           cwd: repoPath,
           signal,
           onData: handleCliData,
@@ -3621,12 +3652,12 @@ export async function handleTask({ message, channelId, tool, me, caps = {} }, cf
         // why nothing above the unit tests could ever drive it (0787).
         run = await deps.runCli({
           cmd: parts[0],
-          args: [...codeArgs, memoryPreamble(workspaceMemory) + promptText],
+          args: [...codeArgs, agentPreamble(workspaceMemory, cfg) + promptText],
           cwd: repoPath,
           timeoutMs: cfg.runTimeoutMs,
           label: "coding",
           signal,
-          env: codingChildEnv(cfg),
+          env: codingChildWebEnv(cfg, vendor),
           onData: handleCliData,
         });
       }

package/src/progress-emitter.mjs

@@ -23,6 +23,13 @@ import {
   sanitizeText,
 } from "./agent-events.mjs";
 import { commandArgv } from "./argv.mjs";
+export {
+  chatWebArgs,
+  codeWebArgs,
+  nativeWebPrompt,
+  webCapability,
+  webToolEnv,
+} from "./web-tools.mjs";
 
 /**
  * Which parser/stream-flags a coding command wants, from its FIRST token.
@@ -57,8 +64,9 @@ export function detectVendor(codingCmd) {
  * Code installed just to answer chat (0521). Every command is the vendor's
  * verified non-interactive print mode; the daemon appends the prompt as the last
  * arg. codex carries --skip-git-repo-check because chat (and the read-only
- * review sandbox) can run outside a git checkout, plus the explicit web-search
- * config because `codex exec` otherwise leaves that tool off. cursor carries
+ * review sandbox) can run outside a git checkout; the responder adds its
+ * read-only/web profile separately so this same command stays cheap for the
+ * no-tools classifier and plan acknowledgement. cursor carries
  * --output-format text (explicit, so a CLI default change can never post raw
  * JSONL into the channel) and --trust (its Jan-2026 workspace-trust gate fails
  * headless runs at spawn in untrusted directories — 0572; pre-2026 CLIs reject
@@ -71,13 +79,14 @@ export function detectVendor(codingCmd) {
  */
 export function fastChatCmd(vendor) {
   if (vendor === "claude_code") return "claude -p --model haiku";
-  if (vendor === "codex") {
-    return "codex exec --skip-git-repo-check -c tools.web_search=true";
-  }
+  if (vendor === "codex") return "codex exec --skip-git-repo-check";
   if (vendor === "cursor") return "cursor-agent -p --output-format text --trust";
   if (vendor === "opencode") return "opencode run";
-  if (vendor === "antigravity") return "agy -p";
-  if (vendor === "hermes") return "hermes -z";
+  // Antigravity's -p consumes the NEXT argv as its prompt, so every option must
+  // sit before it. Hermes's -q has the same shape. Keep their complete generated
+  // read-only/web profile in the base command rather than appending after it.
+  if (vendor === "antigravity") return "agy --mode plan -p";
+  if (vendor === "hermes") return "hermes chat --toolsets safe,web -q";
   return "";
 }
 
@@ -110,31 +119,6 @@ export function codeStreamArgs(vendor) {
   return [];
 }
 
-/**
- * Make Codex's built-in public web search available to code runs. This is a
- * capability flag, not an instruction to browse; Codex decides whether the
- * task needs it. An operator's explicit true/false override wins unchanged.
- * Other vendors already expose their own web tools and receive no guessed
- * flags.
- * @param {'claude_code'|'codex'|'cursor'|'opencode'|'antigravity'|'hermes'|'unknown'} vendor
- * @param {string[]} baseArgs
- * @returns {string[]}
- */
-export function codeWebArgs(vendor, baseArgs = []) {
-  if (vendor !== "codex") return [];
-  const hasOverride = baseArgs.some((arg, index) => {
-    if (/^tools\.web_search=/.test(arg)) return true;
-    if (
-      (baseArgs[index - 1] === "-c" || baseArgs[index - 1] === "--config") &&
-      /^tools\.web_search=/.test(arg)
-    ) {
-      return true;
-    }
-    return /^--config=tools\.web_search=/.test(arg);
-  });
-  return hasOverride ? [] : ["-c", "tools.web_search=true"];
-}
-
 /**
  * Extra args that hand the code run an IMAGE, appended to the code run's argv
  * (0779). Verified against the installed binaries, per the 0521 rule — never