@nanhara/hara 0.109.5 → 0.110.0

package/CHANGELOG.md

@@ -5,6 +5,32 @@ All notable changes to `@nanhara/hara`.
 > Versioning (pre-1.0, SemVer-style): the **minor** (middle) number bumps for a **new feature**; the
 > **patch** (last) number bumps for **optimizations/fixes of existing features**.
 
+## 0.110.0 — a provider registry: one key, many platforms, the right wire + thinking control for each
+
+- **hara now speaks each platform its own way, chosen from a data-driven registry (a dictionary), not
+  scattered if/else.** One row per platform declares its **wire protocol** (chat / Anthropic / Responses)
+  + how it expresses the **thinking dial** + how it **caches**. Point hara at a custom baseURL and it Just
+  Works:
+  - **Any vendor's `.../anthropic` endpoint** — DeepSeek, Kimi/Moonshot, Zhipu GLM, MiniMax, and Alibaba's
+    `…/apps/anthropic` — now routes through the **Anthropic wire** (so you get prompt caching + a native
+    thinking budget). Verified end-to-end against Alibaba's endpoint.
+  - **Local Ollama / LM Studio** (`localhost:11434` / `1234`) — `reasoning off` sends `think:false`, which
+    actually stops a local reasoning model's thinking phase (**measured: deepseek-r1:14b 17s → 0.6s**).
+  - **Alibaba DashScope** chat (coding plan / pay-as-you-go) — `reasoning off` → `enable_thinking:false`
+    (**qwen3.7-plus ~14s → ~1.6s**); works for a custom `qwen3.7-plus`/`glm-5` profile, keyed on the
+    endpoint, not the model name.
+  - OpenAI reasoning models keep `reasoning_effort`; Anthropic keeps its thinking budget. The dial **UNSET
+    leaves the request untouched** everywhere (model default, zero impact — the safe default).
+  - The Responses API (Alibaba Token Plan's newest models) is a distinct wire hara doesn't speak yet; a
+    Responses endpoint now returns a clear pointer to use the chat or `/apps/anthropic` endpoint instead
+    (rather than sending a body it would reject). Coming once there's a Token-Plan key to verify against.
+- **Windows: hara no longer hangs at startup / on the first command.** Three SYNCHRONOUS probes ran with
+  no timeout, so on Windows a slow/hung one froze the whole process (main-thread block — nothing could
+  interrupt it): the `where bash` shell probe (added in 0.109.0), `git ls-files` (the "which files exist"
+  scan), and the per-turn shadow `git add -A`. All three are now bounded (3s / 5s / 10s) and fall back
+  gracefully (cmd.exe / filesystem walk / skip the snapshot). This is the "stuck at shell/directory
+  probing, never got to the actual work" hang.
+
 ## 0.109.5 — Enter enters the conversation instantly + reasoning off truly disables DashScope thinking
 
 - **Pressing Enter now enters the conversation flow instantly — the message no longer sits stuck in the

package/dist/checkpoints.js

@@ -22,6 +22,10 @@ function git(root, gitDir, args) {
         encoding: "utf8",
         stdio: ["ignore", "pipe", "ignore"],
         maxBuffer: 64 * 1024 * 1024,
+        // Bound it: the per-turn shadow `git add -A` over a large tree (or a hung git) must never freeze a
+        // turn. On timeout execFileSync throws → checkpoint()/ensureRepo() catch it → the snapshot is just
+        // skipped (best-effort), the turn proceeds.
+        timeout: 10000,
     }).toString();
 }
 function ensureRepo(root, gitDir) {

package/dist/fs-walk.js

@@ -53,6 +53,9 @@ export function listProjectFiles(root, cap = 8000) {
             encoding: "utf8",
             maxBuffer: 32 * 1024 * 1024,
             stdio: ["ignore", "pipe", "ignore"],
+            // Bound it: a hung git (credential-helper GUI, a slow/network filesystem, a giant repo) must not
+            // freeze the "which files exist" probe — on timeout it throws → we fall through to the fs walk.
+            timeout: 5000,
         })
             .split("\n")
             .map((s) => s.trim())

package/dist/index.js

@@ -42,6 +42,7 @@ import { getTools } from "./tools/registry.js";
 import { EXPLORE_SYSTEM } from "./tools/agent.js";
 import { createAnthropicProvider } from "./providers/anthropic.js";
 import { createOpenAIProvider } from "./providers/openai.js";
+import { resolvePlatform } from "./providers/registry.js";
 import { qwenDeviceLogin, getValidQwenAuth } from "./providers/qwen-oauth.js";
 import { loadAgentsMd, hasAgentsMd, INIT_PROMPT, findProjectRoot } from "./context/agents-md.js";
 import { getEmbedder } from "./search/embed.js";
@@ -127,9 +128,25 @@ async function buildProvider(cfg) {
     }
     if (!apiKey)
         return null;
-    if (provider === "anthropic") {
+    // Transport is chosen from the provider REGISTRY (the dictionary) by wire protocol — so a custom
+    // baseURL Just Works: a vendor's `.../anthropic` endpoint (DeepSeek/Kimi/GLM/MiniMax/Aliyun) speaks the
+    // Anthropic wire (gets cache_control + thinking budget), DashScope/Ollama/OpenAI speak chat, etc.
+    const wire = resolvePlatform(provider, baseURL).wireApi;
+    if (wire === "anthropic") {
         return createAnthropicProvider({ apiKey, model, baseURL, reasoningEffort: cfg.reasoningEffort });
     }
+    if (wire === "responses") {
+        // The OpenAI Responses API (e.g. Aliyun Token Plan's newest models) — a distinct wire hara doesn't
+        // speak yet. Fail with guidance instead of sending a chat body it will reject. (Tracked for when a
+        // Token-Plan key is available to build + verify against; the chat + anthropic endpoints work today.)
+        return {
+            id: provider,
+            model,
+            async turn() {
+                return { text: "", toolUses: [], stop: "error", errorMsg: `This endpoint uses the OpenAI Responses API, which hara doesn't speak yet. Point hara at the plan's OpenAI-compatible chat endpoint (…/compatible-mode/v1 or …/v1) or its Anthropic-compatible endpoint (…/apps/anthropic) instead.` };
+            },
+        };
+    }
     return createOpenAIProvider({ apiKey, model, baseURL, label: provider, reasoningEffort: cfg.reasoningEffort });
 }
 /** Wrap the main provider with per-turn model routing when `routeModel` is configured: trivial/non-coding

package/dist/providers/openai.js

@@ -1,5 +1,9 @@
 import OpenAI from "openai";
 import { imageToBase64 } from "../images.js";
+import { reasoningParams } from "./reasoning.js";
+import { resolvePlatform } from "./registry.js";
+// Re-exported for callers that still import it from here (the reasoning-family check now lives in reasoning.ts).
+export { isReasoningModel } from "./reasoning.js";
 /** Build OpenAI chat-completions messages from neutral history. */
 export function toOpenAI(system, history) {
     const msgs = [{ role: "system", content: system }];
@@ -45,27 +49,6 @@ export function toOpenAI(system, history) {
     }
     return msgs;
 }
-/** Reasoning models on OpenAI (o-series + gpt-5) accept `reasoning_effort` on chat-completions.
- *  Non-reasoning models reject it. We only attach the param when the model id matches a known
- *  reasoning family — keeps DeepSeek/GLM/Qwen requests clean. Exported for tests. */
-export function isReasoningModel(model) {
-    return /^(o1|o3|o4|gpt-5)/i.test(model);
-}
-/** DashScope (Alibaba — serves Qwen, GLM, …) runs a "thinking" phase that streams reasoning BEFORE the
- *  answer — the main latency there (measured: qwen3.7-plus ~14s thinking vs ~1.6s without). It can be
- *  silenced SERVER-SIDE with `enable_thinking:false` (actually stops generating the reasoning, not just
- *  hides it). So map hara's reasoning dial onto it: an explicit **off** → thinking off (fast);
- *  low/medium/high → on. Returns the flag to send, or `undefined` = leave the request UNTOUCHED — when
- *  the dial is UNSET (keep the model's own default; zero impact — the safe default the user asked for)
- *  or the endpoint isn't DashScope. Detected by the DashScope ENDPOINT (built-in qwen/qwen-oauth
- *  providers, OR a custom baseURL on dashscope — which is how the reporter's `custom:qwen3.7-plus`
- *  profile is set up), NOT the model name, so it covers custom Qwen/GLM profiles too. Exported for tests. */
-export function dashscopeThinking(effort, baseURL, label) {
-    const isDashscope = /dashscope\.aliyuncs\.com/i.test(baseURL ?? "") || label === "qwen" || label === "qwen-oauth";
-    if (!isDashscope || effort === undefined)
-        return undefined;
-    return effort !== "off";
-}
 /** OpenAI-compatible provider (works with OpenAI, Qwen/DashScope, GLM, Kimi, …). */
 export function createOpenAIProvider(opts) {
     const client = new OpenAI({ apiKey: opts.apiKey, maxRetries: 4, ...(opts.baseURL ? { baseURL: opts.baseURL } : {}) });
@@ -86,18 +69,12 @@ export function createOpenAIProvider(opts) {
             };
             if (oaiTools.length)
                 params.tools = oaiTools;
-            // reasoning_effort: only attach for OpenAI reasoning models, and only when the user picked a
-            // non-default level. "off" means "don't ask the model to reason" — for reasoning models we
-            // pass "minimal" (gpt-5 / o-series accept it); on chat-style models that put reasoning in
-            // the stream (DeepSeek/GLM) we can't silence it server-side, so the UI just won't render.
-            if (opts.reasoningEffort && opts.reasoningEffort !== undefined && isReasoningModel(opts.model)) {
-                params.reasoning_effort = opts.reasoningEffort === "off" ? "minimal" : opts.reasoningEffort;
-            }
-            // DashScope: reasoning "off" REALLY disables the thinking phase (big speedup), not just hides it.
-            // Only fires on the DashScope endpoint + when the dial is set — UNSET stays untouched (zero impact).
-            const dsThink = dashscopeThinking(opts.reasoningEffort, opts.baseURL, opts.label);
-            if (dsThink !== undefined)
-                params.enable_thinking = dsThink;
+            // Reasoning: the registry says HOW this platform expresses the thinking dial (DashScope →
+            // enable_thinking, OpenAI reasoning models → reasoning_effort, …); the applier turns hara's dial
+            // into the params to merge. UNSET → {} (model default, zero impact). One data-driven line replaces
+            // the old per-platform if/else — a new platform is a registry row, not code here.
+            const caps = resolvePlatform(opts.label, opts.baseURL);
+            Object.assign(params, reasoningParams(caps.reasoning, opts.reasoningEffort, opts.model));
             // Stream: emit text deltas live; accumulate tool-call args by index; grab usage from the tail chunk.
             let text = "";
             const acc = new Map();

package/dist/providers/reasoning.js

@@ -0,0 +1,39 @@
+// Reasoning control — data-driven. Every platform in the provider registry declares a reasoning STYLE
+// (how it wants the thinking dial expressed on the wire); this module owns the small set of styles and
+// maps hara's dial (off/low/medium/high, or UNSET) onto the request params each style needs. Adding a
+// platform that reuses a style is pure data in the registry — no new code here. New code only when a
+// genuinely new style appears (a new provider param shape).
+/** OpenAI reasoning families that accept `reasoning_effort` / `reasoning.effort`. Others reject it, so the
+ *  `reasoning_effort` / `reasoning_object` styles no-op on non-reasoning models. */
+export function isReasoningModel(model) {
+    return /^(o1|o3|o4|gpt-5)/i.test(model);
+}
+/** Translate the dial into request params to MERGE into the wire body (chat/responses styles). Returns an
+ *  empty object — leave the request untouched — when the dial is UNSET (keep the model's own default; zero
+ *  impact, the safe default) or the style/model has nothing to add. Anthropic's `thinking_budget` is built
+ *  in anthropic.ts (buildThinkingParam) and not covered here. Pure — exported for tests. */
+export function reasoningParams(style, effort, model = "") {
+    if (effort === undefined)
+        return {};
+    switch (style) {
+        case "enable_thinking":
+            // off → false (stop the thinking phase, fast); any explicit level → true (keep it on).
+            return { enable_thinking: effort !== "off" };
+        case "ollama_think":
+            // Ollama's `think` boolean — off stops a local reasoning model's thinking (safe: non-thinking
+            // models ignore it). Same shape as enable_thinking, different param name.
+            return { think: effort !== "off" };
+        case "reasoning_effort":
+            if (!isReasoningModel(model))
+                return {};
+            return { reasoning_effort: effort === "off" ? "minimal" : effort };
+        case "reasoning_object":
+            if (!isReasoningModel(model))
+                return {};
+            return { reasoning: { effort: effort === "off" ? "minimal" : effort } };
+        case "thinking_budget": // Anthropic — applied by anthropic.ts, not on a chat/responses merge body
+        case "none":
+        default:
+            return {};
+    }
+}

package/dist/providers/registry.js

@@ -0,0 +1,54 @@
+/** Base capabilities per wire protocol (the sensible default before per-platform overrides). */
+const BY_WIRE = {
+    chat: { wireApi: "chat", reasoning: "reasoning_effort", cache: "auto" },
+    responses: { wireApi: "responses", reasoning: "reasoning_object", cache: "auto" },
+    anthropic: { wireApi: "anthropic", reasoning: "thinking_budget", cache: "cache_control" },
+};
+/** Endpoint-shape rules, matched against the baseURL. FIRST match wins — most specific first. This is what
+ *  makes a *custom* profile (e.g. `custom:qwen3.7-plus` pointing at coding.dashscope) resolve correctly
+ *  without the user declaring a provider id: the DashScope host implies chat + enable_thinking. */
+const BY_BASEURL = [
+    // Alibaba Token Plan — OpenAI-compatible; new models use the Responses API.
+    { test: /token-plan.*maas\.aliyuncs\.com\/compatible-mode/i, caps: { wireApi: "responses", reasoning: "reasoning_object", cache: "auto" } },
+    // Alibaba DashScope — OpenAI-compatible chat (coding plan /v1, pay-as-you-go /compatible-mode): the key
+    // difference is `enable_thinking`, which actually turns Qwen/GLM thinking off (the DashScope speedup).
+    { test: /dashscope\.aliyuncs\.com\/(v1|compatible-mode)|maas\.aliyuncs\.com\/compatible-mode/i, caps: { wireApi: "chat", reasoning: "enable_thinking", cache: "auto" } },
+    // Local Ollama (OpenAI-compat, default port 11434): `think` toggles a local reasoning model's thinking
+    // (measured deepseek-r1:14b 17s → 0.6s); no cache. LM Studio (1234) is the same shape.
+    { test: /(localhost|127\.0\.0\.1|0\.0\.0\.0):(11434|1234)/i, caps: { wireApi: "chat", reasoning: "ollama_think", cache: "none" } },
+    // ANY vendor's Anthropic-compatible endpoint (path ends in /anthropic): DeepSeek, Kimi/Moonshot, Zhipu
+    // GLM, MiniMax, Aliyun apps/anthropic … all expose `.../anthropic` with thinking + explicit cache. One
+    // row covers the whole ecosystem — talk to it with the anthropic transport.
+    { test: /\/anthropic\/?($|\?)/i, caps: { wireApi: "anthropic", reasoning: "thinking_budget", cache: "cache_control" } },
+    // DeepSeek OpenAI-compatible (chat): the model id picks reasoning (deepseek-reasoner reasons, -chat
+    // doesn't); there's no per-request toggle on this path → leave it alone.
+    { test: /api\.deepseek\.com/i, caps: { wireApi: "chat", reasoning: "none", cache: "auto" } },
+];
+/** Per-provider-id overrides (built-in providers whose id alone fixes the shape). */
+const BY_PROVIDER = {
+    anthropic: { wireApi: "anthropic", reasoning: "thinking_budget", cache: "cache_control" },
+    qwen: { wireApi: "chat", reasoning: "enable_thinking", cache: "auto" }, // DashScope
+    "qwen-oauth": { wireApi: "chat", reasoning: "enable_thinking", cache: "auto" },
+    glm: { wireApi: "chat", reasoning: "none", cache: "auto" }, // Zhipu native /paas/v4 — different thinking param; leave alone (its /anthropic endpoint resolves via baseURL)
+    deepseek: { wireApi: "chat", reasoning: "none", cache: "auto" },
+    ollama: { wireApi: "chat", reasoning: "ollama_think", cache: "none" }, // local; `think` toggles reasoning
+    openai: { wireApi: "chat", reasoning: "reasoning_effort", cache: "auto" },
+    openrouter: { wireApi: "chat", reasoning: "none", cache: "auto" },
+    "hara-gateway": { wireApi: "chat", reasoning: "none", cache: "auto" },
+};
+/** Resolve a platform's capabilities from (provider id, baseURL, explicit wireApi override). Precedence:
+ *  an explicit `wireApi` from config wins the transport; then the baseURL shape (so custom DashScope/
+ *  token-plan/anthropic endpoints Just Work); then the provider-id override; else the wire default. */
+export function resolvePlatform(providerId, baseURL, wireApiOverride) {
+    // baseURL shape is the strongest signal for a custom profile; else the provider-id override; else chat.
+    const byUrl = baseURL ? BY_BASEURL.find((r) => r.test.test(baseURL))?.caps : undefined;
+    const byProv = providerId ? BY_PROVIDER[providerId] : undefined;
+    const resolved = byUrl ?? { ...BY_WIRE.chat, ...(byProv ?? {}) };
+    // An explicit wireApi from config wins the transport. When it changes the wire, the reasoning style
+    // follows that wire's default (reasoning is wire-dependent — reasoning_effort on chat vs reasoning_object
+    // on responses); cache is kept from the resolved row (it tracks the endpoint, not the wire).
+    if (wireApiOverride && wireApiOverride !== resolved.wireApi) {
+        return { ...resolved, wireApi: wireApiOverride, reasoning: BY_WIRE[wireApiOverride].reasoning };
+    }
+    return resolved;
+}

package/dist/sandbox.js

@@ -17,7 +17,9 @@ function findWindowsBash() {
     if (_winBash !== undefined)
         return _winBash;
     // `where bash` finds Git Bash / WSL bash on PATH; also probe the default Git-for-Windows location.
-    const onPath = spawnSync("where", ["bash"], { encoding: "utf8" });
+    // `timeout` is CRITICAL: this is a SYNCHRONOUS probe on the main thread — without it a slow `where`
+    // (a huge PATH, a dead network drive on PATH) hangs hara at startup with nothing able to interrupt it.
+    const onPath = spawnSync("where", ["bash"], { encoding: "utf8", timeout: 3000 });
     const hit = onPath.status === 0 ? String(onPath.stdout).split(/\r?\n/).find((l) => l.trim()) : "";
     _winBash = (hit && hit.trim()) || null;
     return _winBash;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanhara/hara",
-  "version": "0.109.5",
+  "version": "0.110.0",
   "description": "hara — a coding agent CLI that runs like an engineering org.",
   "bin": {
     "hara": "dist/index.js"