mercury-agent 0.7.0-beta.0 → 0.7.0

package/docs/extensions.md

@@ -85,6 +85,11 @@ mercury.permission({ defaultRoles: ["admin", "member"] });
 - `defaultRoles` — roles that get this permission by default
 - `admin` always gets all permissions automatically
 - Per-space overrides in `space_config` take precedence
+- **Applicative profiles override `defaultRoles`**: when the active profile
+  defines `member_permissions`, that list is exhaustive for the `member` role —
+  an extension is only usable by members if its name appears there. Mercury logs
+  a startup warning for each loaded extension whose `defaultRoles` include
+  `member` but which the profile excludes.
 
 Can only be called once per extension.
 

package/examples/extensions/voice-transcribe/index.ts

@@ -309,6 +309,7 @@ function localTimeoutMs(): number {
 type HookCtx = {
   db: { getSpaceConfig: (spaceId: string, key: string) => string | null };
   log: {
+    debug: (msg: string, extra?: unknown) => void;
     info: (msg: string, extra?: unknown) => void;
     warn: (msg: string, extra?: unknown) => void;
     error: (msg: string, extra?: unknown) => void;
@@ -399,6 +400,11 @@ export default function (mercury: {
 
   mercury.on("before_container", async (event, ctx) => {
     if (!ctx.hasCallerPermission(event.spaceId, event.callerId, EXT)) {
+      ctx.log.debug("Skipping voice transcription: caller lacks permission", {
+        extension: EXT,
+        spaceId: event.spaceId,
+        callerId: event.callerId,
+      });
       return undefined;
     }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mercury-agent",
-  "version": "0.7.0-beta.0",
+  "version": "0.7.0",
   "description": "Personal AI assistant for chat platforms (WhatsApp, Slack, Discord, Telegram)",
   "license": "MIT",
   "author": "Avishai Tsabari",

package/resources/pi-extensions/subagent/index.ts

@@ -244,7 +244,9 @@ async function runSingleAgent(
 		};
 	}
 
-	const args: string[] = ["--mode", "json", "-p", "--no-session"];
+	// --no-approve: the trust store dir (~/.pi/agent) is mounted read-only in
+	// containers and any trust-store access acquires a lock there (EROFS crash).
+	const args: string[] = ["--mode", "json", "-p", "--no-session", "--no-approve"];
 	if (agent.model) args.push("--model", agent.model);
 	if (agent.tools && agent.tools.length > 0) args.push("--tools", agent.tools.join(","));
 

package/src/agent/container-entry.ts

@@ -835,6 +835,13 @@ function invokePiOnce(
       "--print",
       "--mode",
       "json",
+      // Skip pi's project-trust store entirely. The store lives in
+      // /home/mercury/.pi/agent (mounted :ro) and even a read locks it via
+      // proper-lockfile (mkdir trust.json.lock → EROFS). Workspaces with
+      // trust-requiring resources already resolved to "untrusted" in
+      // non-interactive mode, and without such resources nothing trust-gated
+      // loads — so --no-approve preserves behavior either way.
+      "--no-approve",
       ...sessionArgs,
       "--provider",
       provider,

package/src/core/profiles.ts

@@ -233,6 +233,31 @@ export function getActiveProfilePrompt(): string | null {
   return activeProfilePromptValue;
 }
 
+/**
+ * Warn about loaded extensions whose permission grants `member` by default but
+ * whose permission name is missing from the active profile's exhaustive
+ * `member_permissions` list. The override itself is by design (profiles scope
+ * customer-facing members to least privilege); the warning exists because the
+ * resulting per-message hook skips are otherwise invisible in the logs.
+ */
+export function logProfileMemberPermissionExclusions(
+  extensions: Array<{ name: string; permission?: { defaultRoles: string[] } }>,
+  memberPermissions: string[] | null,
+  log: { warn: (msg: string, obj?: Record<string, unknown>) => void },
+): void {
+  if (!Array.isArray(memberPermissions)) return;
+  // Match toPermissionSet's trimming so a padded entry doesn't false-positive.
+  const granted = new Set(memberPermissions.map((s) => s.trim()));
+  for (const ext of extensions) {
+    if (!ext.permission?.defaultRoles.includes("member")) continue;
+    if (granted.has(ext.name)) continue;
+    log.warn(
+      `Extension "${ext.name}" grants role "member" by default, but the active profile's member_permissions excludes it — member callers cannot use it unless a space-level permission override grants it. Add "${ext.name}" to the profile's member_permissions (or the deployed active-profile.json) to enable it.`,
+      { extension: ext.name },
+    );
+  }
+}
+
 /**
  * Throw if any of the profile's declared `capabilities` is not present as an
  * installed extension directory under `<dataDir>/extensions`. Capabilities may

package/src/main.ts

@@ -35,7 +35,11 @@ import { createChatShim } from "./chat-shim.js";
 import { loadConfig, resolveProjectPath } from "./config.js";
 import { createMessageHandler } from "./core/handler.js";
 import { setActiveProfileMemberPermissions } from "./core/permissions.js";
-import { loadActiveProfile, setActiveProfilePrompt } from "./core/profiles.js";
+import {
+  loadActiveProfile,
+  logProfileMemberPermissionExclusions,
+  setActiveProfilePrompt,
+} from "./core/profiles.js";
 import { MercuryCoreRuntime } from "./core/runtime.js";
 import { runStorageCleanup } from "./core/storage-cleanup.js";
 import { isOverQuota } from "./core/storage-guard.js";
@@ -228,6 +232,11 @@ async function main() {
       memberPermissions:
         activeProfile.memberPermissions?.join(",") ?? "(unscoped)",
     });
+    logProfileMemberPermissionExclusions(
+      registry.list(),
+      activeProfile.memberPermissions ?? null,
+      logger,
+    );
   }
 
   logExtensionCapabilityMismatches(