mercury-agent 0.5.1 → 0.5.6

package/README.md

@@ -18,7 +18,7 @@ Mercury is a personal AI assistant that lives where you chat. It connects to Wha
 ## Prerequisites
 
 - **[Node.js](https://nodejs.org/)** >= 18 — Required for `npm install -g mercury-agent`
-- **[Bun](https://bun.sh)** >= 1.0 — JavaScript runtime used by Mercury
+- **[Bun](https://bun.sh)** >= 1.2 — JavaScript runtime used by Mercury
 - **[Docker](https://docs.docker.com/get-docker/)** — Required for running agent containers. On Linux, also install `docker-buildx` (`apt-get install docker-buildx`) — Docker Desktop includes it, but Docker Engine on Linux does not.
 - **Windows users:** Mercury runs best under [WSL2](https://learn.microsoft.com/en-us/windows/wsl/install). Install WSL2 with `wsl --install`, then install Bun and Docker inside it.
 
@@ -66,6 +66,8 @@ mercury run
 mercury service install
 ```
 
+> `mercury run` runs in the foreground (good for a first smoke test). For anything long-running, prefer `mercury service install` — it runs in the background and auto-restarts.
+
 ### Set up spaces and conversations
 
 Mercury discovers conversations from incoming traffic. They start **unlinked** — you assign them to **spaces** (memory boundaries).
@@ -310,7 +312,7 @@ Optional project file **`mercury.yaml`** (or **`mercury.yml`**) supplies non-sec
 | Variable | Default | Description |
 |----------|---------|-------------|
 | `MERCURY_DATA_DIR` | `.mercury` | Data directory |
-| `MERCURY_MAX_CONCURRENCY` | `3` | Max concurrent runs |
+| `MERCURY_MAX_CONCURRENCY` | `2` | Max concurrent runs |
 | `MERCURY_PORT` | `8787` | API port |
 | `MERCURY_BOT_USERNAME` | `mercury` | Bot display name |
 | `MERCURY_LOG_LEVEL` | `info` | Log level |
@@ -335,7 +337,7 @@ Supported OAuth providers: Anthropic, GitHub Copilot, Google Gemini CLI, Antigra
 | Variable | Default | Description |
 |----------|---------|-------------|
 | `MERCURY_MODEL_PROVIDER` | `anthropic` | Provider |
-| `MERCURY_MODEL` | `claude-opus-4-6` | Model |
+| `MERCURY_MODEL` | `claude-opus-4-8` | Model |
 | `MERCURY_ANTHROPIC_API_KEY` | — | API key |
 | `MERCURY_ANTHROPIC_OAUTH_TOKEN` | — | OAuth token (alternative) |
 
@@ -357,7 +359,7 @@ Supported OAuth providers: Anthropic, GitHub Copilot, Google Gemini CLI, Antigra
 
 | Variable | Default | Description |
 |----------|---------|-------------|
-| `MERCURY_AGENT_CONTAINER_IMAGE` | `ghcr.io/avishai-tsabari/mercury-agent:latest` | Container image |
+| `MERCURY_AGENT_IMAGE` | `ghcr.io/avishai-tsabari/mercury-agent:latest` | Container image |
 | `MERCURY_CONTAINER_TIMEOUT_MS` | `300000` | Container timeout (5 min) |
 | `MERCURY_CONTAINER_RUNTIME` | `runc` | `runc` (default) or `runsc` ([gVisor](https://gvisor.dev)) |
 | `MERCURY_CONTAINER_BWRAP_DOCKER_COMPAT` | `false` | Set `true` on Linux Docker Engine (see note below) |
@@ -413,7 +415,6 @@ mrctl config set trigger_patterns "@Bot,Bot"
 
 ## Docs
 
-- **Remaining work:** [TODOS](docs/TODOS.md) — Security, reliability, and ops gaps
 - **Platform setup:** [WhatsApp](docs/setup-whatsapp.md) · [Discord](docs/setup-discord.md) · [Slack](docs/setup-slack.md)
 - [Configuration](docs/configuration.md) (mercury.yaml + env) · [PRD: config load](docs/prd-config-load.md)
 - [Authentication](docs/auth/overview.md)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mercury-agent",
-  "version": "0.5.1",
+  "version": "0.5.6",
   "description": "Personal AI assistant for chat platforms (WhatsApp, Slack, Discord, Telegram)",
   "license": "MIT",
   "author": "Avishai Tsabari",

package/resources/profiles/coding/mercury-profile.yaml

@@ -10,6 +10,6 @@ env: []
 
 defaults:
   model_provider: anthropic
-  model: claude-sonnet-4-20250514
+  model: claude-opus-4-8
   trigger_patterns: "@Mercury,Mercury"
   bot_username: mercury

package/resources/profiles/general/mercury-profile.yaml

@@ -10,6 +10,6 @@ env: []
 
 defaults:
   model_provider: anthropic
-  model: claude-sonnet-4-20250514
+  model: claude-opus-4-8
   trigger_patterns: "@Mercury,Mercury"
   bot_username: mercury

package/resources/profiles/research/mercury-profile.yaml

@@ -10,6 +10,6 @@ env: []
 
 defaults:
   model_provider: anthropic
-  model: claude-sonnet-4-20250514
+  model: claude-opus-4-8
   trigger_patterns: "@Mercury,Mercury"
   bot_username: mercury

package/resources/templates/mercury.example.yaml

@@ -9,10 +9,10 @@
 # model:
 #   chain:
 #     - provider: anthropic
-#       model: claude-sonnet-4-20250514
+#       model: claude-opus-4-8
 #   # Legacy single primary + optional fallback (when chain is omitted):
 #   # provider: anthropic
-#   # model: claude-sonnet-4-20250514
+#   # model: claude-opus-4-8
 #   # fallback_provider: openai
 #   # fallback: gpt-4o-mini
 #   # max_retries_per_leg: 2

package/src/agent/container-entry.ts

@@ -132,7 +132,7 @@ function parseModelLegsFromEnv(): ModelLeg[] {
   return [
     {
       provider: process.env.MODEL_PROVIDER || "anthropic",
-      model: process.env.MODEL || "claude-opus-4-6",
+      model: process.env.MODEL || "claude-opus-4-8",
     },
   ];
 }

package/src/agent/container-runner.ts

@@ -29,8 +29,7 @@ import { ContainerError } from "./container-error.js";
  * launching the inner container detached (`docker create` + `docker start`, no
  * attach) is the only pattern that works through the Bun `fetch()`-based body-proxy
  * the cloud agent lane goes through — the proxy cannot carry Docker's hijacked
- * attach connection, so an attached run hangs to its idleTimeout (see
- * docs/debug/major/2026-05-25-agent-lane-docker-run-wait-hang-no-chat-response.md).
+ * attach connection, so an attached run hangs to its idleTimeout.
  */
 const INNER_IO_DIR = "/run/mercury-io";
 

package/src/cli/mercury.ts

@@ -721,7 +721,7 @@ program
       anthropic: {
         envKey: "MERCURY_ANTHROPIC_API_KEY",
         label: "Anthropic API key",
-        defaultModel: "claude-sonnet-4-20250514",
+        defaultModel: "claude-opus-4-8",
       },
       openai: {
         envKey: "MERCURY_OPENAI_API_KEY",

package/src/config.ts

@@ -62,7 +62,7 @@ const schema = z.object({
 
   // ─── AI Model ───────────────────────────────────────────────────────
   modelProvider: z.string().default("anthropic"),
-  model: z.string().default("claude-opus-4-6"),
+  model: z.string().default("claude-opus-4-8"),
   modelFallbackProvider: z.string().optional(),
   modelFallback: z.string().optional(),
   /** JSON array of `{ provider, model }`. When set, overrides legacy primary+fallback pair. */

package/src/main.ts

@@ -90,7 +90,7 @@ async function main() {
   // ─── Normalize data dir ownership ───────────────────────────────────────
   // Host base image's default user has drifted historically; if the volume
   // was written by a previous uid, SQLite can't reopen state.db for writes.
-  // Idempotent on matching ownership. See docs/debug/major/2026-04-16-host-base-image-user-drift.md.
+  // Idempotent on matching ownership.
   if (process.platform === "linux" && process.getuid?.() === 0) {
     const dataDirPath = resolveProjectPath(config.dataDir);
     if (existsSync(dataDirPath)) {

package/docs/ARCHITECTURE.md

@@ -1,34 +0,0 @@
-# {Project Name} — Architecture Reference
-
-> On-demand reference. Do not auto-load. Read when a task is cross-cutting or you need to understand inter-package data flow.
-
-## Packages
-
-| Package | Purpose | Stack | Runs On |
-|---------|---------|-------|---------|
-| `{package}/` | {purpose} | {stack} | {where it runs} |
-
-## Deployment Topology
-
-```
-{ASCII diagram of your deployment — servers, services, databases, CDNs, etc.}
-```
-
-## Data Flow
-
-> How data moves between packages, services, and external systems. Include request paths, event flows, and storage interactions.
-
-## Key Invariants
-
-> Rules that must always hold true across the system. Breaking these causes cascading failures.
-
-- {Invariant 1}
-- {Invariant 2}
-
-## Extension Points
-
-> Where the system is designed to be extended — plugin interfaces, hook points, configuration surfaces.
-
-- **Applicative profiles** (`src/core/profiles.ts`) — a `mercury-profile.yaml` declares `capabilities`, an exhaustive `member_permissions` set, and a `system_prompt`. `applyProfile` validates capabilities and persists `.mercury/active-profile.json`; `main.ts` activates it at startup (project-wide). Member permission scoping is in `getRolePermissions` (`src/core/permissions.ts`). Authoring contract: `docs/authoring-profiles.md`.
-- **Host-side capability broker** — extensions register `mercury.capability(name, handler)` (`src/extensions/types.ts`, `api.ts`); the agent invokes them from the container via `mrctl capability <name> <action>` → `POST /api/capability/:name/:action` (`src/core/routes/capability.ts`). Handlers run on the host with credentials that never enter the container; identity is the token-derived caller.
-- **Caller-bound capability token** (`src/core/caller-token.ts`) — per-turn HMAC token minted at container spawn, made authoritative over spoofable identity headers in the control-plane API auth middleware (`src/core/api.ts`).

package/docs/DESIGN.md

@@ -1,42 +0,0 @@
-# {Project Name} — Design System
-
-> Fill this in if your project has a UI. Skip if it's a backend-only project.
-
-## 1. Visual Theme
-
-> Design principles — what the UI should feel like.
-
-## 2. Color Roles
-
-> CSS variable inventory. All colors must be defined as variables — never hardcode hex in component files.
-
-| Token | Dark Value | Light Value | Role |
-|-------|-----------|-------------|------|
-| `--bg` | {hex} | {hex} | Page background |
-| `--surface` | {hex} | {hex} | Card/panel background |
-| `--text` | {hex} | {hex} | Primary text |
-| `--muted` | {hex} | {hex} | Secondary text |
-| `--accent` | {hex} | {hex} | Interactive elements |
-| `--border` | {hex} | {hex} | Borders and dividers |
-| `--color-success` | {hex} | {hex} | Success states |
-| `--color-error` | {hex} | {hex} | Error states |
-| `--color-warning` | {hex} | {hex} | Warning states |
-
-## 3. Typography
-
-> Font families, sizes, weights. Which fonts for which contexts.
-
-## 4. Layout & Spacing
-
-> Grid system, breakpoints, spacing scale. Include RTL/logical property conventions if applicable.
-
-## 5. Components
-
-> Component conventions — buttons, inputs, cards, modals, status indicators, etc.
-
-## 6. Hard Rules
-
-> Violations block merge. Examples:
-> - No hardcoded hex colors in component files — use CSS variables
-> - No physical CSS properties (`left`/`right`) — use logical properties
-> - All interactive elements must have visible focus rings

package/docs/ROADMAP.md

@@ -1,43 +0,0 @@
-# {Project Name} — Roadmap
-
-Single source of truth for priority. Rule: ≤15 min/week to maintain.
-
----
-
-## Inbox
-
-> Uncategorized ideas. Triage into Now / Next / Later or drop.
-
-| Item | Doc | Notes |
-|------|-----|-------|
-| — | — | — |
-
-## Now
-
-> Max 2 items. What you're actively working on.
-
-| Item | Doc | Started | Notes |
-|------|-----|---------|-------|
-| — | — | — | — |
-
-## Next
-
-| # | Item | Doc | Depends on | Why now |
-|---|------|-----|-----------|---------|
-| 1 | **autonomous-planning-tier** | [doc](backlog/autonomous-planning-tier.md) | — | Let agents decompose ideas, keep human gate |
-
-## Later
-
-| Item | Doc | Notes |
-|------|-----|-------|
-| — | — | — |
-
----
-
-## Shipped
-
-| Item | Shipped | What |
-|------|---------|------|
-| **applicative-profiles** | 2026-07-01 | Generic profile layer: manifest schema, exhaustive member scoping, host-side capability broker |
-| **caller-bound-capability-token** | 2026-07-01 | Per-turn unspoofable caller token for host API auth; also hardens TradeStation |
-| **dm-auto-space** | 2026-07-01 | Auto-create space per customer DM with rate limits and dashboard controls |

package/docs/TODOS.md

@@ -1,147 +0,0 @@
-# Mercury — Remaining TODOs
-
-This document tracks gaps identified in the comprehensive code review that are not yet addressed. Items are ordered by priority (security first, then reliability, then polish).
-
----
-
-## Security
-
-### TODO-1: Protect dashboard root routes
-
-**Status:** Open  
-**Priority:** Medium  
-**Files:** `src/server.ts`
-
-**Issue:** `GET /` and `GET /dashboard` serve the dashboard HTML without authentication. Only `/dashboard/*` (htmx partials, API, SSE) is protected. Users can load the HTML shell without a token.
-
-**Fix:** Apply the same auth middleware to `/` and `/dashboard`, or redirect unauthenticated requests to a login page. When `MERCURY_API_SECRET` is set, require Bearer token or `mercury_token` cookie for these routes.
-
----
-
-### TODO-2: Harden permission guard
-
-**Status:** Open  
-**Priority:** Medium  
-**Files:** `src/extensions/permission-guard.ts`
-
-**Issue:** The permission guard blocks CLI names via regex on bash commands. It can be bypassed by:
-- `env napkin search "query"`
-- `` `which napkin` search "query" ``
-- `python3 -c "import subprocess; subprocess.run(['napkin', ...])"`
-- Path-based execution: `/root/.bun/bin/napkin`
-
-**Fix options:**
-1. Run denied CLIs through an allowlist/blocklist at the pi tool-call layer (if the pi API supports it)
-2. Use a wrapper script that validates the command before execution
-3. Document that this is defense-in-depth only; rely on extension trust model
-4. Consider seccomp or additional bwrap restrictions to limit subprocess execution
-
-**Note:** Bubblewrap limits filesystem access but does not prevent the agent from invoking allowed binaries. The permission guard remains the primary control for which CLIs run.
-
----
-
-### TODO-3: Sanitize extension install commands
-
-**Status:** Open  
-**Priority:** Low  
-**Files:** `src/extensions/image-builder.ts`
-
-**Issue:** Extension `install` commands are interpolated directly into Dockerfile `RUN` statements. A malicious extension could inject shell commands that exfiltrate secrets or modify the image.
-
-**Fix options:**
-1. Validate install commands against an allowlist (e.g. `bun add -g X`, `npm install -g X`)
-2. Run install commands in a sandboxed build step
-3. Document that extensions are trusted by design (operator installs them); recommend auditing before `mercury add`
-
----
-
-## Reliability
-
-### TODO-4: Database migration system
-
-**Status:** Open  
-**Priority:** Medium  
-**Files:** `src/storage/db.ts`, new `src/storage/migrations/`
-
-**Issue:** Schema evolution uses `CREATE TABLE IF NOT EXISTS` only. Adding columns, changing types, or renaming tables has no migration path.
-
-**Fix:** Implement a simple migration system:
-1. Create `migrations/` directory with sequential SQL files (`001_initial.sql`, `002_add_mutes.sql`, …)
-2. Add `schema_migrations` table to track applied migrations
-3. On startup, run any migrations not yet applied
-4. Document migration authoring in `docs/`
-
----
-
-### TODO-5: Outbox scan race condition
-
-**Status:** Open  
-**Priority:** Low  
-**Files:** `src/core/outbox.ts`, `src/agent/container-runner.ts`
-
-**Issue:** Outbox scanning uses mtime comparison against `startTime`. Files written at exactly `startTime` or during clock skew could be missed or incorrectly included.
-
-**Fix:** Use a more robust approach (e.g. track written files explicitly, or use a small time buffer). Document the current behavior and edge cases.
-
----
-
-## Operations
-
-### TODO-6: Run containers as non-root
-
-**Status:** Open  
-**Priority:** Low  
-**Files:** `container/Dockerfile`, `container/Dockerfile.minimal`, `src/agent/container-runner.ts`
-
-**Issue:** Containers run as root. Chromium uses `--no-sandbox` because it runs as root. This increases blast radius if the container is compromised.
-
-**Fix:**
-1. Create a non-root user in the Dockerfile
-2. Run the entrypoint as that user (`USER mercury` or similar)
-3. Ensure Chromium can run without `--no-sandbox` (may require `--user-data-dir` and other flags, or use a different approach)
-4. Update `container-runner.ts` if `docker run` needs `--user` override
-
-**Note:** Bubblewrap runs as the same user as the parent process. Moving the container to non-root would also make bwrap run as non-root, reducing privilege further.
-
----
-
-### TODO-7: CORS configuration
-
-**Status:** Open  
-**Priority:** Low  
-**Files:** `src/server.ts`
-
-**Issue:** No CORS headers are set. When Mercury is behind a reverse proxy or accessed from a browser on another origin, cross-origin requests may fail or behave unexpectedly.
-
-**Fix:** Add configurable CORS middleware (e.g. `MERCURY_CORS_ORIGINS`). Default to restrictive (same-origin or empty) for security.
-
----
-
-## In-Memory State (Deferred)
-
-### TODO-8: Crash-safe rate limiter and queue
-
-**Status:** Deferred  
-**Priority:** Low  
-**Files:** `src/core/rate-limiter.ts`, `src/core/space-queue.ts`
-
-**Issue:** Rate limiter and queue are in-memory. On crash, rate limit windows reset (allowing burst abuse) and queued work is lost.
-
-**Fix:** Persist rate limit state and queue to SQLite or Redis. Adds complexity; may be acceptable for single-node deployments. Revisit if multi-instance or high-availability is required.
-
----
-
-## Bubblewrap — What It Mitigates
-
-Bubblewrap adds **defense-in-depth** inside the container:
-
-| Risk | Mitigated by bubblewrap? |
-|------|--------------------------|
-| **Cross-space data access** | Partially — with per-space mount, `/spaces` only has one space. Bwrap further restricts the pi process to a minimal mount set. |
-| **Arbitrary filesystem access** | Yes — pi only sees `/usr`, `/app`, `/etc`, `/docs`, `/spaces`, `/root`, `/proc`, `/dev`, `/tmp`. Cannot access other paths. |
-| **Process isolation** | Yes — `--unshare-pid`, `--new-session`, `--die-with-parent` limit process visibility and lifecycle. |
-| **Permission guard bypass** | No — bwrap limits *what* the agent can access, not *which commands* it runs. A bypassed guard could still invoke allowed binaries. |
-| **Extension install injection** | No — that happens at image build time, before bwrap runs. |
-| **Container non-root** | No — bwrap runs as the same user (root) as the container. Moving to non-root would improve both. |
-
-**Summary:** Bubblewrap reduces blast radius if the agent is compromised. It does not replace the permission guard, API auth, or other controls. It is a valuable additional layer.

package/docs/VISION.md

@@ -1,32 +0,0 @@
-# {Project Name} — Product Vision
-
-## What {Project Name} Is
-
-> One-sentence pitch.
-
-## Target User
-
-> Who is this for? Be specific — role, context, what they're trying to accomplish.
-
-## What Makes {Project Name} Different
-
-| Differentiator | Why it matters |
-|---------------|----------------|
-| {differentiator} | {why} |
-
-## Non-Goals
-
-> Explicit list of what this project does NOT try to be. Helps filter feature requests.
-
-- {Non-goal 1}
-- {Non-goal 2}
-
-## Guiding Questions for New Ideas
-
-> Use these to evaluate whether a feature idea fits the product:
-
-1. Does this serve the target user directly?
-2. Does this align with the differentiators above?
-3. Does this conflict with any non-goal?
-4. Can the user benefit from this without configuration or documentation?
-5. Would removing this make the product worse for the target user?