mercury-agent 0.4.5 → 0.4.7

package/container/agent-package.json

@@ -3,6 +3,6 @@
   "private": true,
   "type": "module",
   "dependencies": {
-    "@mariozechner/pi-coding-agent": "^0.67.2"
+    "@earendil-works/pi-coding-agent": "~0.79.6"
   }
 }

package/docs/container-lifecycle.md

@@ -228,7 +228,7 @@ You can use custom Docker images via `MERCURY_AGENT_IMAGE`.
 
 Your image **must** have:
 - `bun` runtime
-- `pi` CLI (`@mariozechner/pi-coding-agent`)
+- `pi` CLI (`@earendil-works/pi-coding-agent`)
 - `bubblewrap` (for agent sandboxing)
 - `mrctl` wrapper (copied during build)
 Extension CLIs (e.g. `pinchtab`, `napkin`, `gws`) are installed in derived images at runtime based on `.mercury/extensions/*` declarations.
@@ -279,7 +279,7 @@ RUN curl -fsSL https://bun.sh/install | bash
 ENV PATH="/home/mercury/.bun/bin:$PATH"
 
 # Install required CLIs
-RUN bun add -g @mariozechner/pi-coding-agent
+RUN bun add -g @earendil-works/pi-coding-agent
 
 # Optional: install Playwright/Chromium if your extensions need browser automation
 RUN bunx playwright install chromium

package/examples/extensions/permission-guard/index.ts

@@ -17,7 +17,7 @@
  * directly and blocks them with a message to use `mrctl` instead.
  */
 
-import type { ExtensionAPI } from "@mariozechner/pi-coding-agent";
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 
 export default function (pi: ExtensionAPI) {
   const extClisEnv = process.env.MERCURY_EXT_CLIS;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mercury-agent",
-  "version": "0.4.5",
+  "version": "0.4.7",
   "description": "Personal AI assistant for chat platforms (WhatsApp, Slack, Discord, Telegram)",
   "license": "MIT",
   "author": "Avishai Tsabari",
@@ -64,9 +64,9 @@
     "@chat-adapter/slack": "^4.14.0",
     "@chat-adapter/teams": "^4.17.0",
     "@chat-adapter/telegram": "^4.26.0",
-    "@mariozechner/pi-agent-core": "^0.65.2",
-    "@mariozechner/pi-ai": "^0.67.6",
-    "@mariozechner/pi-coding-agent": "^0.65.2",
+    "@earendil-works/pi-agent-core": "~0.79.6",
+    "@earendil-works/pi-ai": "~0.79.10",
+    "@earendil-works/pi-coding-agent": "~0.79.6",
     "@whiskeysockets/baileys": "^7.0.0-rc.9",
     "axios": "^1.15.1",
     "chat": "^4.14.0",

package/resources/pi-extensions/subagent/agents.ts

@@ -4,7 +4,7 @@
 
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { getAgentDir, parseFrontmatter } from "@mariozechner/pi-coding-agent";
+import { getAgentDir, parseFrontmatter } from "@earendil-works/pi-coding-agent";
 
 export type AgentScope = "user" | "project" | "both";
 

package/resources/pi-extensions/subagent/index.ts

@@ -16,11 +16,11 @@ import { spawn } from "node:child_process";
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
-import type { AgentToolResult } from "@mariozechner/pi-agent-core";
-import type { Message } from "@mariozechner/pi-ai";
-import { StringEnum } from "@mariozechner/pi-ai";
-import { type ExtensionAPI, getMarkdownTheme } from "@mariozechner/pi-coding-agent";
-import { Container, Markdown, Spacer, Text } from "@mariozechner/pi-tui";
+import type { AgentToolResult } from "@earendil-works/pi-agent-core";
+import type { Message } from "@earendil-works/pi-ai";
+import { StringEnum } from "@earendil-works/pi-ai";
+import { type ExtensionAPI, getMarkdownTheme } from "@earendil-works/pi-coding-agent";
+import { Container, Markdown, Spacer, Text } from "@earendil-works/pi-tui";
 import { Type } from "@sinclair/typebox";
 import { type AgentConfig, type AgentScope, discoverAgents } from "./agents.js";
 

package/src/adapters/whatsapp.ts

@@ -147,7 +147,7 @@ export class WhatsAppBaileysAdapter
   private readonly outgoingQueue: Array<{ jid: string; text: string }> = [];
   private flushing = false;
   private connectedAtMs = 0;
-  private readonly seenMessageIds = new Set<string>();
+  private seenMessageIds = new Set<string>();
   private reconnectAttempt = 0;
   private readonly pushNames = new Map<string, string>();
   private currentQr: string | null = null;
@@ -474,7 +474,10 @@ export class WhatsAppBaileysAdapter
     if (messageId) {
       if (this.seenMessageIds.has(messageId)) return;
       this.seenMessageIds.add(messageId);
-      if (this.seenMessageIds.size > 5000) this.seenMessageIds.clear();
+      if (this.seenMessageIds.size > 5000) {
+        const ids = [...this.seenMessageIds];
+        this.seenMessageIds = new Set(ids.slice(ids.length - 2500));
+      }
     }
 
     const tsMs = Number(msg.messageTimestamp ?? 0) * 1000;

package/src/agent/model-capabilities.ts

@@ -4,7 +4,7 @@
 
 import { existsSync, readFileSync } from "node:fs";
 import path from "node:path";
-import { getModels, type KnownProvider } from "@mariozechner/pi-ai";
+import { getModels, type KnownProvider } from "@earendil-works/pi-ai";
 import { parse as parseYaml } from "yaml";
 import { z } from "zod";
 import type { ModelLeg } from "../config.js";

package/src/bridges/discord.ts

@@ -62,18 +62,25 @@ export class DiscordBridge implements PlatformBridge {
         const inboxDir = path.join(workspace, "inbox");
         for (const att of rawAttachments) {
           if (!att.url) continue;
-          const type = mimeToMediaType(
-            att.mimeType || "application/octet-stream",
-          );
-          const result = await downloadMediaFromUrl(att.url, {
-            type,
-            mimeType: att.mimeType || "application/octet-stream",
-            filename: att.name,
-            expectedSizeBytes: att.size,
-            maxSizeBytes: ctx.media.maxSizeBytes,
-            outputDir: inboxDir,
-          });
-          if (result) attachments.push(result);
+          try {
+            const type = mimeToMediaType(
+              att.mimeType || "application/octet-stream",
+            );
+            const result = await downloadMediaFromUrl(att.url, {
+              type,
+              mimeType: att.mimeType || "application/octet-stream",
+              filename: att.name,
+              expectedSizeBytes: att.size,
+              maxSizeBytes: ctx.media.maxSizeBytes,
+              outputDir: inboxDir,
+            });
+            if (result) attachments.push(result);
+          } catch (err) {
+            logger.warn("Discord attachment download failed", {
+              filename: att.name,
+              error: err instanceof Error ? err.message : String(err),
+            });
+          }
         }
       }
     }

package/src/bridges/slack.ts

@@ -133,12 +133,14 @@ export class SlackBridge implements PlatformBridge {
   ): Promise<void> {
     const parts = threadId.split(":");
     const channelId = parts.length >= 2 ? parts[1] : threadId;
+    const threadTs = parts.length >= 3 ? parts[2] : undefined;
 
     for (const file of files) {
       try {
         const buffer = fs.readFileSync(file.path);
         const form = new FormData();
         form.append("channel_id", channelId);
+        if (threadTs) form.append("thread_ts", threadTs);
         form.append("filename", file.filename);
         form.append(
           "file",

package/src/bridges/teams.ts

@@ -73,9 +73,11 @@ export class TeamsBridge implements PlatformBridge {
 
     const { externalId, isDM } = this.parseThread(threadId);
 
-    // Check reply-to-bot via raw activity
+    // Reply-to-bot detection: in DMs every reply is to the bot;
+    // in channels we cannot reliably determine the target, so default to false
+    // to avoid responding to conversations not directed at us.
     const raw = msg.raw as { replyToId?: string; id?: string } | undefined;
-    const isReplyToBot = Boolean(raw?.replyToId);
+    const isReplyToBot = isDM && Boolean(raw?.replyToId);
 
     return {
       platform: "teams",

package/src/bridges/telegram.ts

@@ -479,13 +479,21 @@ export class TelegramBridge implements PlatformBridge {
     const { chatId } = this.parseThreadId(threadId);
     const apiUrl = `${TELEGRAM_API_BASE}/bot${this.botToken}/editMessageText`;
     try {
+      let formatted: string;
+      try {
+        formatted = markdownToTelegramHtml(text);
+      } catch {
+        formatted = escapeHtml(text);
+      }
+      const truncated = truncateTelegramHtml(formatted, TELEGRAM_MESSAGE_LIMIT);
       const resp = await fetch(apiUrl, {
         method: "POST",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({
           chat_id: chatId,
           message_id: Number(messageId),
-          text: applyRtlDirection(normalizeChatMarkdown(text)),
+          text: applyRtlDirection(truncated),
+          parse_mode: "HTML",
         }),
       });
       if (!resp.ok) return false;

package/src/cli/mercury.ts

@@ -70,7 +70,14 @@ function loadEnvFile(envPath: string): Record<string, string> {
     if (!trimmed || trimmed.startsWith("#")) continue;
     const match = trimmed.match(/^([^=]+)=(.*)$/);
     if (match) {
-      vars[match[1]] = match[2];
+      let value = match[2];
+      if (
+        (value.startsWith('"') && value.endsWith('"')) ||
+        (value.startsWith("'") && value.endsWith("'"))
+      ) {
+        value = value.slice(1, -1);
+      }
+      vars[match[1]] = value;
     }
   }
   return vars;
@@ -266,16 +273,14 @@ function statusAction(): void {
     `Configuration:   ${hasEnv ? "✓ .env exists" : "✗ .env missing (run 'mercury init')"}`,
   );
 
-  const imageCheck = spawnSync(
-    "docker",
-    ["image", "inspect", "mercury-agent:latest"],
-    {
-      stdio: "pipe",
-    },
-  );
+  const cfg = loadConfig();
+  const imageName = cfg.agentContainerImage;
+  const imageCheck = spawnSync("docker", ["image", "inspect", imageName], {
+    stdio: "pipe",
+  });
   const hasImage = imageCheck.status === 0;
   console.log(
-    `Container image: ${hasImage ? "✓ mercury-agent:latest" : "✗ not built (run 'mercury build')"}`,
+    `Container image: ${hasImage ? `✓ ${imageName}` : `✗ not available (run 'mercury build' or pull '${imageName}')`}`,
   );
 
   if (hasEnv) {
@@ -820,7 +825,7 @@ authCommand
   )
   .action(async (providerArg?: string) => {
     const { getOAuthProviders, getOAuthProvider } = await import(
-      "@mariozechner/pi-ai/oauth"
+      "@earendil-works/pi-ai/oauth"
     );
     const readline = await import("node:readline");
     const { exec } = await import("node:child_process");
@@ -913,6 +918,12 @@ authCommand
                 : "xdg-open";
           exec(`${openCmd} "${info.url}"`);
         },
+        onDeviceCode: (info: { userCode: string; verificationUri: string }) => {
+          console.log(
+            `\nOpen this URL in your browser:\n  ${info.verificationUri}`,
+          );
+          console.log(`Enter code: ${info.userCode}\n`);
+        },
         onPrompt: async (prompt: { message: string; placeholder?: string }) => {
           const answer = await new Promise<string>((resolve) => {
             rl.question(
@@ -922,6 +933,23 @@ authCommand
           });
           return answer;
         },
+        onSelect: async (prompt: {
+          message: string;
+          options: Array<{ id: string; label: string }>;
+        }) => {
+          console.log(`\n${prompt.message}`);
+          for (let i = 0; i < prompt.options.length; i++) {
+            console.log(`  ${i + 1}. ${prompt.options[i].label}`);
+          }
+          const answer = await new Promise<string>((resolve) => {
+            rl.question("Choose (number): ", resolve);
+          });
+          const idx = Number.parseInt(answer, 10) - 1;
+          if (idx >= 0 && idx < prompt.options.length) {
+            return prompt.options[idx].id;
+          }
+          return undefined;
+        },
         onProgress: (message: string) => {
           console.log(message);
         },
@@ -999,7 +1027,7 @@ authCommand
   .command("status")
   .description("Show authentication status for all providers")
   .action(async () => {
-    const { getOAuthProviders } = await import("@mariozechner/pi-ai/oauth");
+    const { getOAuthProviders } = await import("@earendil-works/pi-ai/oauth");
 
     const dataDir = getProjectDataDir(CWD);
     const authPath = join(CWD, dataDir, "global", "auth.json");
@@ -1724,7 +1752,7 @@ async function addAction(source: string): Promise<void> {
     }
 
     console.log("\nRestart mercury to activate:");
-    console.log("  mercury service restart");
+    console.log("  mercury service uninstall && mercury service install");
   } finally {
     cleanup();
   }
@@ -1739,7 +1767,7 @@ function removeAction(name: string): void {
 
   console.log(`✓ Extension "${name}" removed`);
   console.log("\nRestart mercury to apply:");
-  console.log("  mercury service restart");
+  console.log("  mercury service uninstall && mercury service install");
 }
 
 function extensionsListAction(): void {

package/src/core/permissions.ts

@@ -30,6 +30,10 @@ const BUILT_IN_PERMISSIONS = new Set([
   "media.purge",
   /** Host Text-to-Speech (/api/tts); admin-only by default. */
   "tts.synthesize",
+  /** Mute/unmute users and list mutes; admin-only by default. */
+  "mutes.list",
+  "mutes.mute",
+  "mutes.unmute",
 ]);
 
 // ---------------------------------------------------------------------------

package/src/core/router.ts

@@ -106,7 +106,7 @@ export function routeInput(input: {
       .split(/\s+/);
     const category = rawCategory.toLowerCase();
     const verb = rawVerb?.toLowerCase() || undefined;
-    const arg = argParts.join(" ").trim().toLowerCase() || undefined;
+    const arg = argParts.join(" ").trim() || undefined;
     if (SLASH_COMMANDS.some((c) => c.name === category)) {
       return gateSlashCommand(
         input.db,

package/src/core/routes/chat.ts

@@ -62,9 +62,16 @@ export function createChatRoute(core: MercuryCoreRuntime): Hono {
     const authorName =
       typeof body.authorName === "string" ? body.authorName.trim() : undefined;
 
+    if (!core.db.getSpace(spaceId)) {
+      return c.json({ error: "Space not found" }, 404);
+    }
+
     // Save incoming files to inbox/
     const attachments: MessageAttachment[] = [];
     if (Array.isArray(body.files)) {
+      if (body.files.length > 20) {
+        return c.json({ error: "Too many files (max 20)" }, 400);
+      }
       if (await isOverQuota(core.config)) {
         return c.json({ error: "Storage quota exceeded" }, 413);
       }
@@ -100,10 +107,6 @@ export function createChatRoute(core: MercuryCoreRuntime): Hono {
       }
     }
 
-    if (!core.db.getSpace(spaceId)) {
-      return c.json({ error: "Space not found" }, 404);
-    }
-
     if (authenticated) {
       core.db.seedAdmins(spaceId, [callerId]);
     }

package/src/core/routes/messages.ts

@@ -22,7 +22,7 @@ messages.get("/search", (c) => {
     if (!Number.isFinite(n) || n < 1) {
       return c.json({ error: "Invalid limit" }, 400);
     }
-    limit = n;
+    limit = Math.min(n, 200);
   }
 
   const found = db.searchMessages(spaceId, q, limit);

package/src/core/routes/mutes.ts

@@ -1,6 +1,6 @@
 import { Hono } from "hono";
 import type { Env } from "../api-types.js";
-import { getApiCtx, getAuth } from "../api-types.js";
+import { checkPerm, getApiCtx, getAuth } from "../api-types.js";
 import { parseMuteDuration } from "../mute-duration.js";
 
 export const mutes = new Hono<Env>();
@@ -8,6 +8,8 @@ export const mutes = new Hono<Env>();
 // ─── List mutes ─────────────────────────────────────────────────────────
 
 mutes.get("/", (c) => {
+  const denied = checkPerm(c, "mutes.list");
+  if (denied) return denied;
   const { spaceId } = getAuth(c);
   const { db } = getApiCtx(c);
   return c.json({ mutes: db.listMutes(spaceId) });
@@ -16,6 +18,8 @@ mutes.get("/", (c) => {
 // ─── Mute a user ────────────────────────────────────────────────────────
 
 mutes.post("/", async (c) => {
+  const denied = checkPerm(c, "mutes.mute");
+  if (denied) return denied;
   const { spaceId, callerId } = getAuth(c);
   const { db } = getApiCtx(c);
   const body = await c.req.json<{
@@ -76,6 +80,8 @@ mutes.post("/", async (c) => {
 // ─── Unmute a user ──────────────────────────────────────────────────────
 
 mutes.delete("/:userId", (c) => {
+  const denied = checkPerm(c, "mutes.unmute");
+  if (denied) return denied;
   const { spaceId } = getAuth(c);
   const { db } = getApiCtx(c);
   const targetUserId = decodeURIComponent(c.req.param("userId"));

package/src/core/routes/roles.ts

@@ -33,6 +33,16 @@ roles.post("/", async (c) => {
   }
 
   const targetRole = body.role ?? "admin";
+  const VALID_ROLES = /^[a-z][a-z0-9_-]{0,31}$/;
+  if (!VALID_ROLES.test(targetRole)) {
+    return c.json(
+      {
+        error:
+          "Invalid role name. Use lowercase alphanumeric, hyphens, underscores (max 32 chars).",
+      },
+      400,
+    );
+  }
   db.setRole(spaceId, body.platformUserId, targetRole, callerId);
 
   return c.json({

package/src/core/task-scheduler.ts

@@ -101,10 +101,17 @@ export class TaskScheduler {
     let updated = 0;
     for (const task of tasks) {
       if (!task.active || !task.cron) continue;
-      const correct = this.computeNextRun(
-        task.cron,
-        task.timezone ?? undefined,
-      );
+      let correct: number;
+      try {
+        correct = this.computeNextRun(task.cron, task.timezone ?? undefined);
+      } catch (err) {
+        logger.warn("Skipping task with invalid cron expression", {
+          taskId: task.id,
+          cron: task.cron,
+          error: err instanceof Error ? err.message : String(err),
+        });
+        continue;
+      }
       if (correct !== task.nextRunAt) {
         this.db.updateTaskNextRun(task.id, correct);
         updated++;

package/src/extensions/hooks.ts

@@ -86,6 +86,11 @@ export class HookDispatcher {
         this.log.error(
           `Hook "before_container" handler failed: ${err instanceof Error ? err.message : String(err)}`,
         );
+        return {
+          block: {
+            reason: `Extension hook failed: ${err instanceof Error ? err.message : String(err)}`,
+          },
+        };
       }
     }
 

package/src/extensions/loader.ts

@@ -242,7 +242,7 @@ async function loadExtension(
   }
 
   const api = new MercuryExtensionAPIImpl(name, extDir, db);
-  setup(api);
+  await setup(api);
   const meta = api.getMeta();
 
   if (meta.connection) {

package/src/extensions/permission-guard.ts

@@ -11,7 +11,7 @@
  * Set automatically by Mercury's runtime based on caller permissions.
  */
 
-import type { ExtensionAPI } from "@mariozechner/pi-coding-agent";
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 
 export default function (pi: ExtensionAPI) {
   const deniedEnv = process.env.MERCURY_DENIED_CLIS;

package/src/storage/db.ts

@@ -55,6 +55,7 @@ export class Db {
     this.db = new Database(dbPath, { create: true });
     this.db.exec("PRAGMA journal_mode = WAL;");
     this.db.exec("PRAGMA foreign_keys = ON;");
+    this.db.exec("PRAGMA busy_timeout = 5000;");
     this.migrate();
   }
 

package/src/storage/pi-auth.ts

@@ -4,7 +4,7 @@ import {
   getOAuthApiKey,
   type OAuthCredentials,
   type OAuthProviderId,
-} from "@mariozechner/pi-ai/oauth";
+} from "@earendil-works/pi-ai/oauth";
 import { logger } from "../logger.js";
 
 type AuthEntry =