mercury-agent 0.5.10 → 0.5.11

package/README.md

@@ -218,7 +218,7 @@ mercury setup              # Interactive guided setup (recommended for new proje
 mercury setup --profile <name>   # Create from a profile (general, coding, research, or path/URL)
 mercury init               # Manual init (creates .env, .mercury structure)
 mercury run
-mercury build              # only needed when developing the base image from source
+mercury build              # rebuild agent container image (required after updates)
 mercury status
 mercury doctor             # preflight check — validates Docker, Bun, credentials, adapters
 
@@ -256,7 +256,7 @@ mercury ext create <name>   # Scaffold a new extension
 mercury ext validate <name> # Validate extension structure and load
 mercury ext test <name>     # Dry-run load extension
 
-# service (recommended for background)
+# service (macOS/Linux only — uses launchd/systemd)
 mercury service install
 mercury service uninstall
 mercury service status

package/docs/container-lifecycle.md

@@ -4,7 +4,7 @@ Mercury runs agent code inside Docker containers. This document covers how conta
 
 ## Deployment Topology
 
-Mercury uses a two-layer container model. The layers differ between local and production (Hetzner) deployments.
+Mercury uses a two-layer container model. The layers differ between local and production deployments.
 
 ### Local (`mercury run`)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mercury-agent",
-  "version": "0.5.10",
+  "version": "0.5.11",
   "description": "Personal AI assistant for chat platforms (WhatsApp, Slack, Discord, Telegram)",
   "license": "MIT",
   "author": "Avishai Tsabari",

package/src/core/permissions.ts

@@ -89,8 +89,9 @@ export function resetPermissions(): void {
  * Project-wide (one profile per deployment): set once at startup from the
  * persisted profile activation. When non-null it is the EXHAUSTIVE member
  * permission set — no extension defaults are merged — so raw capabilities stay
- * admin-only unless the profile lists them. A per-space
- * `role.member.permissions` override still takes precedence over this.
+ * admin-only unless the profile lists them. An explicit per-space
+ * `role.member.permissions` override (set by an admin, dashboard, or console)
+ * still takes precedence, but dm-auto-space seeded defaults do not.
  */
 let activeProfileMemberPermissions: string[] | null = null;
 
@@ -182,15 +183,21 @@ export function getRolePermissions(
   const key = `role.${role}.permissions`;
   const stored = db.getSpaceConfig(spaceId, key);
 
-  // Explicit per-space override wins over everything.
   if (stored !== null) {
-    return toPermissionSet(stored.split(","));
+    // dm-auto-space seeded defaults yield to the active profile — they are
+    // deployment defaults, not intentional admin overrides. Any other source
+    // (admin, dashboard, console) is an explicit override and wins.
+    const isSeededDefault =
+      role === "member" &&
+      Array.isArray(activeProfileMemberPermissions) &&
+      db.getSpaceConfigUpdatedBy(spaceId, key) === "dm-auto-space";
+
+    if (!isSeededDefault) {
+      return toPermissionSet(stored.split(","));
+    }
+    // Fall through to profile check below.
   }
 
-  // An active profile sets the exhaustive member permission set (project-wide),
-  // ahead of built-in/extension defaults. Members only; profiles never widen
-  // admin/system. Guard with Array.isArray so a malformed persisted activation
-  // (missing/non-array value) falls back to defaults instead of throwing here.
   if (role === "member" && Array.isArray(activeProfileMemberPermissions)) {
     return toPermissionSet(activeProfileMemberPermissions);
   }

package/src/storage/db.ts

@@ -1276,6 +1276,15 @@ export class Db {
     return row?.value ?? null;
   }
 
+  getSpaceConfigUpdatedBy(spaceId: string, key: string): string | null {
+    const row = this.db
+      .query(
+        "SELECT updated_by FROM space_config WHERE space_id = ? AND key = ?",
+      )
+      .get(spaceId, key) as { updated_by: string } | null;
+    return row?.updated_by ?? null;
+  }
+
   setSpaceConfig(
     spaceId: string,
     key: string,