@nanhara/hara 0.112.4 → 0.113.0

package/CHANGELOG.md

@@ -5,6 +5,32 @@ All notable changes to `@nanhara/hara`.
 > Versioning (pre-1.0, SemVer-style): the **minor** (middle) number bumps for a **new feature**; the
 > **patch** (last) number bumps for **optimizations/fixes of existing features**.
 
+## 0.113.0 — DeepSeek reasoning control (thinking + effort, incl. `max`) · host-unreachable memory
+
+- **DeepSeek reasoning is now a real dial.** DeepSeek's V4 models (`deepseek-v4-pro` / `deepseek-v4-flash`)
+  added a per-request thinking switch on the OpenAI-compatible chat path — `thinking: {type}` plus
+  `reasoning_effort` (native `high`|`max`; `low`/`medium` map → high server-side). hara now sends both via a
+  new `deepseek` reasoning style: **`off` → `thinking:{type:"disabled"}`** (reasoning_effort has no "off"),
+  any level → `thinking:{type:"enabled"}` + the effort. The `/model` picker's ←→ thinking dial now lights up
+  for DeepSeek. Verified against the live API: `off` emits no `reasoning_content`, `high`/`max` stream it
+  (`max` thinks measurably harder than `high`), and tool-calls work with reasoning on.
+- **New `max` reasoning level.** `hara config set reasoningEffort max` (and the picker's ←→) now accept
+  **`max`**, the top of the dial. On DeepSeek it becomes `reasoning_effort:"max"`; on OpenAI reasoning models
+  it clamps to `high` (OpenAI has no `max`, so it never 400s); on Anthropic it takes the largest thinking
+  budget. Existing `off`/`low`/`medium`/`high` are unchanged.
+- **Host-unreachable memory — stop re-hanging on a dead host.** When a network command (git clone/pull/fetch,
+  curl, …) fails to CONNECT — a TCP connect timeout or DNS failure (macOS's ~75s SYN timeout), *not* an
+  auth/404/connection-refused — hara now remembers that host for the session and **fast-fails later network
+  ops to it instantly** instead of eating another ~75s per retry. The failure output also flags that git
+  ignores the macOS system / Clash proxy unless configured (`git config --global http.proxy`). Cleared by
+  `/reset`. Paired with a system-prompt rule: reuse a local checkout before cloning, don't swap in a public
+  mirror for a private repo, and verify connectivity yourself rather than trusting "the network is fine".
+
+## 0.112.5 — single-writer session lock
+
+- **A double-resume can no longer corrupt session history.** A single-writer lock serializes session writes
+  so two processes resuming the same session don't interleave and clobber the transcript.
+
 ## 0.112.4 — reasoning models don't false-timeout · cross-provider fallback routes correctly
 
 - **A reasoning model (qwen3.7-plus / GLM / DeepSeek) thinking on a long context no longer false-times-out.**

package/README.md

@@ -127,6 +127,14 @@ hara config set visionModel qwen-vl-max   # a vision model on the same plan/key
 If a model's capability is unknown, hara **asks once and remembers**. In the TUI, `/vision <model>` sets the
 describer and `/vision main yes|no|auto` corrects a model's detected capability.
 
+**Reasoning effort** — dial how hard a thinking model reasons: `off` · `low` · `medium` · `high` · `max`.
+```bash
+hara config set reasoningEffort high     # or off / low / medium / max
+```
+hara expresses it the way each endpoint wants (OpenAI `reasoning_effort`, Anthropic thinking budget,
+DashScope `enable_thinking`, **DeepSeek** V4 `thinking` + `reasoning_effort` where `max` genuinely raises the
+effort). In the TUI, bare `/model` opens a picker — ↑↓ pick a model, **←→ set the thinking level**.
+
 Config lives in `~/.hara/config.json`. Env vars override it: `HARA_PROVIDER`, `HARA_MODEL`,
 `HARA_BASE_URL`, `HARA_API_KEY`, or the provider key (`ANTHROPIC_API_KEY` / `DASHSCOPE_API_KEY`).
 

package/dist/agent/loop.js

@@ -67,8 +67,15 @@ memory: use memory_search before answering about prior decisions,
 conventions, or the user's preferences, and memory_write to proactively save durable facts you learn.
 When a task matches one of the Skills listed below, call the \`skill\` tool to load its full instructions
 before acting; save a reusable how-to as a new skill with skill_create. If you discover a durable project
-convention, you may propose an edit to AGENTS.md via edit_file (the user reviews the diff). After completing
-a task, give a one-line summary.`;
+convention, you may propose an edit to AGENTS.md via edit_file (the user reviews the diff).
+Network resilience: before \`git clone\`, check the target dir isn't already present (ls / test -d) and
+reuse a local checkout instead of re-cloning. If a network command fails to CONNECT (timeout or DNS — not
+auth/404), treat that host as down for the session: don't retry it, don't swap in a public mirror (mirrors
+can't serve private repos), don't switch protocols — hara already fast-fails repeats to a dead host, so
+diagnose instead. git ignores the macOS system / Clash proxy unless configured (git config --global
+http.proxy), so a browser that reaches a site doesn't mean the terminal does — verify connectivity yourself
+rather than trusting "the network is fine". If a step's output artifact already exists and is newer than its
+inputs, skip re-running it. After completing a task, give a one-line summary.`;
 /** When running inside `hara gateway`, tell the agent it's in a chat — so it delivers files via send_file
  *  (the only channel that reaches the peer) and never reaches for the desktop client / computer tool. */
 function gatewayNote() {

package/dist/config.js

@@ -31,7 +31,7 @@ const PROVIDER_DEFAULTS = {
     "hara-gateway": { model: "", envKey: "HARA_GATEWAY_TOKEN" }, // B-end: enrolled device → token in ~/.hara/org.json, routed by the gateway
 };
 export const CONFIG_KEYS = ["provider", "apiKey", "model", "baseURL", "approval", "sandbox", "theme", "evolve", "assetCapture", "computerUse", "computerApps", "visionModel", "visionBaseURL", "visionApiKey", "embedProvider", "embedModel", "embedBaseURL", "embedApiKey", "routeModel", "routeBaseURL", "routeApiKey", "guardian", "notify", "vimMode", "autoCompact", "fileCheckpoints", "updateCheck", "fallbackModel", "fallbackProvider", "fallbackBaseURL", "fallbackApiKey", "reasoningEffort"];
-export const REASONING_EFFORTS = ["off", "low", "medium", "high"];
+export const REASONING_EFFORTS = ["off", "low", "medium", "high", "max"];
 export const APPROVAL_MODES = ["suggest", "auto-edit", "full-auto"];
 export const SANDBOX_MODES = ["off", "workspace-write", "read-only"];
 const PROJECT_ROOT_MARKERS = [".git", "package.json", "Cargo.toml", "go.mod", "pyproject.toml", ".hg"];
@@ -164,7 +164,7 @@ export function loadConfig(opts = {}) {
     const fallbackBaseURL = process.env.HARA_FALLBACK_BASE_URL ?? merged.fallbackBaseURL;
     const fallbackApiKey = process.env.HARA_FALLBACK_API_KEY ?? merged.fallbackApiKey;
     const reasoningRaw = process.env.HARA_REASONING_EFFORT ?? merged.reasoningEffort;
-    const reasoningEffort = reasoningRaw && ["off", "low", "medium", "high"].includes(reasoningRaw)
+    const reasoningEffort = reasoningRaw && ["off", "low", "medium", "high", "max"].includes(reasoningRaw)
         ? reasoningRaw
         : undefined;
     return { provider, apiKey, model, baseURL, approval, sandbox, theme, evolve, assetCapture, computerUse, computerApps, visionModel, visionBaseURL, visionApiKey, modelVision, embedProvider, embedModel, embedBaseURL, embedApiKey, routeModel, routeBaseURL, routeApiKey, guardian, hooks, notify, vimMode, autoCompact, fileCheckpoints, updateCheck, fallbackModel, fallbackProvider, fallbackBaseURL, fallbackApiKey, reasoningEffort, mcpServers, cwd: process.cwd() };

package/dist/index.js

@@ -39,6 +39,7 @@ import { addJob, removeJob, setEnabled, resolveJob, loadJobs, recordRun, logPath
 import { runTick, runJobOnce, selfArgv } from "./cron/runner.js";
 import { installScheduler, uninstallScheduler, isInstalled } from "./cron/install.js";
 import { getTools } from "./tools/registry.js";
+import { resetReachability } from "./tools/net-reachability.js";
 import { EXPLORE_SYSTEM } from "./tools/agent.js";
 import { createAnthropicProvider } from "./providers/anthropic.js";
 import { createOpenAIProvider } from "./providers/openai.js";
@@ -65,7 +66,7 @@ import { getEmbedder } from "./search/embed.js";
 import { collectRepoChunks, collectDirChunks, buildIndex, indexPath, indexExists } from "./search/semindex.js";
 import { searchHybrid } from "./search/hybrid.js";
 import { expandMentions, fileCandidates, isSlashCommand, inlineLeadingPath } from "./context/mentions.js";
-import { newSessionId, shortId, resolveSessionId, saveSession, loadSession, listSessions, latestForCwd, titleFrom, slugify, } from "./session/store.js";
+import { newSessionId, shortId, resolveSessionId, saveSession, loadSession, acquireSessionLock, releaseSessionLock, listSessions, latestForCwd, titleFrom, slugify, } from "./session/store.js";
 import { setSessionForceModel, isSessionForceModel, effectiveRoleModel } from "./session/session-model.js";
 import { loadRoles, scaffoldRoles, subagentToolFilter } from "./org/roles.js";
 import { loadSkillIndex, loadSkillBody, scaffoldSkills, globalSkillsDir } from "./skills/skills.js";
@@ -2392,6 +2393,16 @@ program.action(async (opts) => {
         createdAt: new Date().toISOString(),
         updatedAt: "",
     };
+    // Single-writer guard: two hara processes on the SAME session race writes to its append-only history and
+    // corrupt it. Lock it here (a brand-new session's id is unique, so this only ever blocks a DOUBLE-resume
+    // of a session already open elsewhere). Released on exit.
+    const lock = acquireSessionLock(meta.id);
+    if (!lock.ok) {
+        out(c.red(`Session ${shortId(meta.id)} is already open in another hara process (pid ${lock.pid}).`) +
+            c.dim(` Resuming the same session twice races writes and can corrupt its history. Close that one, or run \`hara\` for a new session. (Override: rm ~/.hara/sessions/${meta.id}.lock)\n`));
+        process.exit(1);
+    }
+    process.on("exit", () => releaseSessionLock(meta.id));
     // Per-session model precedence on resume:
     //   1. --model flag (already applied to cfg.model up-top) → wins and is written back to meta.model.
     //   2. resumed meta.model → restored into cfg.model (the user's last /model choice).
@@ -2916,6 +2927,7 @@ program.action(async (opts) => {
                     if (nm === "reset" || nm === "clear") {
                         history.length = 0;
                         recalledContext = "";
+                        resetReachability(); // fresh start — drop any "host unreachable" marks (network may be fixed)
                         return void h.sink.notice("(context cleared)");
                     }
                     if (nm === "undo") {

package/dist/providers/anthropic.js

@@ -106,6 +106,8 @@ export function buildThinkingParam(model, effort) {
         return { type: "enabled", budget_tokens: 4096 };
     if (effort === "medium")
         return { type: "adaptive" };
+    if (effort === "max")
+        return { type: "enabled", budget_tokens: 32000 }; // top of the dial — biggest budget
     // high
     return { type: "enabled", budget_tokens: 24000 };
 }

package/dist/providers/reasoning.js

@@ -26,11 +26,19 @@ export function reasoningParams(style, effort, model = "") {
         case "reasoning_effort":
             if (!isReasoningModel(model))
                 return {};
-            return { reasoning_effort: effort === "off" ? "minimal" : effort };
+            // OpenAI's ceiling is "high"; there's no "max" — clamp so the global `max` dial never 400s here.
+            return { reasoning_effort: effort === "off" ? "minimal" : effort === "max" ? "high" : effort };
         case "reasoning_object":
             if (!isReasoningModel(model))
                 return {};
-            return { reasoning: { effort: effort === "off" ? "minimal" : effort } };
+            return { reasoning: { effort: effort === "off" ? "minimal" : effort === "max" ? "high" : effort } };
+        case "deepseek":
+            // off → turn thinking OFF via the object (reasoning_effort can't say "off"). Any level → thinking ON
+            // + the effort enum; DeepSeek natively honors high|max and maps low/medium→high server-side, so we
+            // pass the dial through as-is (forward-compatible if DeepSeek later distinguishes low/medium).
+            if (effort === "off")
+                return { thinking: { type: "disabled" } };
+            return { thinking: { type: "enabled" }, reasoning_effort: effort };
         case "thinking_budget": // Anthropic — applied by anthropic.ts, not on a chat/responses merge body
         case "none":
         default:

package/dist/providers/registry.js

@@ -20,9 +20,9 @@ const BY_BASEURL = [
     // GLM, MiniMax, Aliyun apps/anthropic … all expose `.../anthropic` with thinking + explicit cache. One
     // row covers the whole ecosystem — talk to it with the anthropic transport.
     { test: /\/anthropic\/?($|\?)/i, caps: { wireApi: "anthropic", reasoning: "thinking_budget", cache: "cache_control" } },
-    // DeepSeek OpenAI-compatible (chat): the model id picks reasoning (deepseek-reasoner reasons, -chat
-    // doesn't); there's no per-request toggle on this path → leave it alone.
-    { test: /api\.deepseek\.com/i, caps: { wireApi: "chat", reasoning: "none", cache: "auto" } },
+    // DeepSeek OpenAI-compatible (chat): DeepSeek V4 (v4-pro/v4-flash) exposes a per-request thinking switch
+    // (`thinking: {type}`) + `reasoning_effort` (high|max) on this path — the `deepseek` style sends both.
+    { test: /api\.deepseek\.com/i, caps: { wireApi: "chat", reasoning: "deepseek", cache: "auto" } },
 ];
 /** Per-provider-id overrides (built-in providers whose id alone fixes the shape). */
 const BY_PROVIDER = {
@@ -30,7 +30,7 @@ const BY_PROVIDER = {
     qwen: { wireApi: "chat", reasoning: "enable_thinking", cache: "auto" }, // DashScope
     "qwen-oauth": { wireApi: "chat", reasoning: "enable_thinking", cache: "auto" },
     glm: { wireApi: "chat", reasoning: "none", cache: "auto" }, // Zhipu native /paas/v4 — different thinking param; leave alone (its /anthropic endpoint resolves via baseURL)
-    deepseek: { wireApi: "chat", reasoning: "none", cache: "auto" },
+    deepseek: { wireApi: "chat", reasoning: "deepseek", cache: "auto" }, // V4: thinking:{type} + reasoning_effort(high|max)
     ollama: { wireApi: "chat", reasoning: "ollama_think", cache: "none" }, // local; `think` toggles reasoning
     openai: { wireApi: "chat", reasoning: "reasoning_effort", cache: "auto" },
     openrouter: { wireApi: "chat", reasoning: "none", cache: "auto" },

package/dist/session/store.js

@@ -1,7 +1,7 @@
 // Session persistence — conversations saved as JSON under ~/.hara/sessions, resumable.
 import { homedir } from "node:os";
 import { join } from "node:path";
-import { readFileSync, writeFileSync, existsSync, mkdirSync, readdirSync } from "node:fs";
+import { readFileSync, writeFileSync, existsSync, mkdirSync, readdirSync, rmSync } from "node:fs";
 import { randomUUID } from "node:crypto";
 function sessionsDir() {
     const d = join(homedir(), ".hara", "sessions");
@@ -9,6 +9,54 @@ function sessionsDir() {
     return d;
 }
 const sessionFile = (id) => join(sessionsDir(), `${id}.json`);
+const lockFile = (id) => join(sessionsDir(), `${id}.lock`);
+/** Is a process with this pid alive? `process.kill(pid, 0)` sends no signal — it just probes: throws
+ *  ESRCH if dead, EPERM if alive-but-not-ours (still alive). Best-effort across platforms. */
+function pidAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (e) {
+        return e?.code === "EPERM";
+    }
+}
+/** Take an exclusive lock on a session so two hara processes can't resume the SAME session and corrupt
+ *  its append-only history by racing writes. Returns `{ ok: true }` if acquired (or the previous holder
+ *  is dead → we take over), or `{ ok: false, pid }` if a LIVE process already holds it. Best-effort: any
+ *  filesystem hiccup resolves to `ok:true` so a lock problem never blocks the user. Pair with
+ *  `releaseSessionLock` on exit. */
+export function acquireSessionLock(id) {
+    const f = lockFile(id);
+    try {
+        if (existsSync(f)) {
+            const held = JSON.parse(readFileSync(f, "utf8"));
+            if (typeof held.pid === "number" && held.pid !== process.pid && pidAlive(held.pid)) {
+                return { ok: false, pid: held.pid };
+            }
+            // stale (dead pid) or already ours → fall through and (re)claim it
+        }
+        writeFileSync(f, JSON.stringify({ pid: process.pid, startedAt: Date.now() }));
+        return { ok: true };
+    }
+    catch {
+        return { ok: true };
+    }
+}
+/** Release a session lock we hold (only removes it if the pid matches ours — never steals another's). */
+export function releaseSessionLock(id) {
+    try {
+        const f = lockFile(id);
+        if (!existsSync(f))
+            return;
+        const held = JSON.parse(readFileSync(f, "utf8"));
+        if (held?.pid === process.pid)
+            rmSync(f);
+    }
+    catch {
+        /* best-effort */
+    }
+}
 /** A full UUID per session (the stable identity). */
 export const newSessionId = () => randomUUID();
 /** First segment of the UUID — a compact label for the status bar / `/sessions`. */

package/dist/tools/builtin.js

@@ -7,7 +7,28 @@ import { nearestPaths } from "../fs-walk.js";
 import { emitDiff } from "../diff.js";
 import { recordEdit } from "../undo.js";
 import { startJob, listJobs, tailJob, killJob } from "../exec/jobs.js";
+import { hostsInCommand, isNetworkGitOp, hostFromConnectError, isConnectFailure, markHostUnreachable, isHostUnreachable, unreachableHostsSnapshot, } from "./net-reachability.js";
 const MAX = 100_000;
+/** Resolve the remote HOST a bare `git pull/fetch/push` targets (no URL in the command → host lives in the
+ *  repo's remote config). Local + fast (no network); best-effort — returns "" on any hiccup. Only ever
+ *  called after a host has already been marked unreachable, so it adds zero overhead on the happy path. */
+async function gitRemoteHost(command, cwd, sandbox) {
+    const m = command.match(/\bgit\b[^\n]*\b(?:fetch|pull|push)\b\s+(?!-)(\S+)/);
+    const remote = m && /^[\w./-]+$/.test(m[1]) ? m[1] : "origin";
+    try {
+        const { stdout } = await runShell(`git remote get-url ${remote}`, cwd, sandbox, { timeout: 5000, maxBuffer: 65536 });
+        return hostsInCommand(stdout.trim())[0] ?? "";
+    }
+    catch {
+        return "";
+    }
+}
+/** git ignores the macOS system / Clash proxy unless told to — so a browser that reaches GitHub doesn't
+ *  mean the terminal does. Appended to connectivity-failure output so the agent diagnoses instead of retrying. */
+function proxyHint(host) {
+    const h = host || "the remote host";
+    return `\n\n↯ hara: this is a CONNECTIVITY failure to ${h} (timeout/DNS), not an auth error — I will NOT retry network ops to ${h} for the rest of this session (a repeat just hangs ~75s again). git does NOT use the macOS system/Clash proxy unless configured; check \`git config --global http.proxy\` and \`echo $https_proxy $ALL_PROXY\`. If you've since started a VPN/proxy or fixed DNS, tell me and I'll clear the mark and retry.`;
+}
 function abs(p, cwd) {
     return isAbsolute(p) ? p : resolve(cwd, p);
 }
@@ -89,6 +110,22 @@ registerTool({
             const id = startJob(input.command, ctx.cwd, ctx.sandbox ?? "off");
             return `Started background job ${id}: \`${input.command}\`. Manage with the \`job\` tool — {action:"tail",id:"${id}"} for output, {action:"kill",id:"${id}"} to stop, {action:"list"} for all.`;
         }
+        // Network fault tolerance — short-circuit if this command targets a host already found unreachable this
+        // session, so a repeat doesn't burn another ~75s OS connect timeout. Only pays the git-remote lookup
+        // once something is actually marked (unreachableHostsSnapshot empty ⇒ zero overhead on the happy path).
+        if (unreachableHostsSnapshot().length) {
+            const explicit = hostsInCommand(input.command);
+            let blocked = explicit.find(isHostUnreachable) ?? "";
+            if (!blocked && !explicit.length && isNetworkGitOp(input.command)) {
+                const h = await gitRemoteHost(input.command, ctx.cwd, ctx.sandbox ?? "off");
+                if (h && isHostUnreachable(h))
+                    blocked = h;
+            }
+            if (blocked) {
+                ctx.ui?.notice(`↯ skipping — ${blocked} was unreachable earlier this session`);
+                return `Skipped without running: host "${blocked}" already failed to connect earlier in THIS session — hara does not retry network operations to a host known unreachable this session (a retry just hangs ~75s again). Do not swap in a public mirror (won't serve private repos) or switch protocols; diagnose instead.${proxyHint(blocked)}`;
+            }
+        }
         let buf = ""; // TUI: line-buffer live output into the sink (one notice per line)
         const live = ctx.ui
             ? (s) => {
@@ -114,7 +151,20 @@ registerTool({
             return capHeadTail(combined.trim() || "(no output)");
         }
         catch (e) {
-            return capHeadTail(`Command failed: ${e.message}\n${e.stdout || ""}${e.stderr || ""}`);
+            const base = `Command failed: ${e.message}\n${e.stdout || ""}${e.stderr || ""}`;
+            // Network fault tolerance — if this was a genuine host-unreachability (connect timeout / DNS, NOT
+            // auth / 404 / connection-refused), remember the host so we fast-fail future ops to it this session.
+            if (isConnectFailure(base)) {
+                let host = hostFromConnectError(base) || hostsInCommand(input.command)[0] || "";
+                if (!host && isNetworkGitOp(input.command))
+                    host = await gitRemoteHost(input.command, ctx.cwd, ctx.sandbox ?? "off");
+                if (host) {
+                    markHostUnreachable(host);
+                    ctx.ui?.notice(`↯ ${host} marked unreachable for this session — won't retry network ops to it`);
+                    return capHeadTail(base + proxyHint(host));
+                }
+            }
+            return capHeadTail(base);
         }
     },
 });

package/dist/tools/net-reachability.js

@@ -0,0 +1,67 @@
+// Session-scoped "host unreachable" memory. When a network command (git / curl / …) fails because the
+// HOST could not be reached — a TCP connect timeout or a DNS failure, NOT an auth/404/protocol error on a
+// host that's actually up — we remember that host for the rest of this hara process. A later command aimed
+// at the same host is then short-circuited INSTANTLY (see builtin.ts bash tool) instead of eating another
+// ~75s OS-level connect timeout. This is the deterministic half of hara's network fault-tolerance: the
+// model can't "forget" it the way a system-prompt rule can be ignored under pressure.
+//
+// One hara process == one session (same process-local pattern as session-model.ts's force-model flag), so
+// a module-local Set is exactly session scope — no need to thread state through ~17 runAgent call sites.
+// This module is PURE + fully unit-tested; the only impure step (resolving a bare `git pull`'s remote host
+// with a local `git remote get-url`) lives in the bash tool, keeping the classification logic deterministic.
+const unreachable = new Set();
+/** Remember a host as unreachable for the rest of this session. */
+export function markHostUnreachable(host) {
+    if (host)
+        unreachable.add(host.toLowerCase());
+}
+/** Has this host already failed to connect this session? */
+export function isHostUnreachable(host) {
+    return !!host && unreachable.has(host.toLowerCase());
+}
+/** Snapshot of the hosts marked unreachable (for the pre-check fast path + tests). */
+export function unreachableHostsSnapshot() {
+    return [...unreachable];
+}
+/** Clear the memory — called on /reset (network may have been fixed) and between tests. */
+export function resetReachability() {
+    unreachable.clear();
+}
+/** Explicit hosts a command references: URLs (http/https/git/ssh/ftp) + scp/ssh `user@host:path` specs.
+ *  Pure. A bare `git pull origin main` yields [] — its host lives in the repo's remote config, resolved
+ *  separately by the bash tool. */
+export function hostsInCommand(command) {
+    const hosts = new Set();
+    // scheme://[user@]host[:port]/…   (github.com from https://github.com/owner/repo.git)
+    for (const m of command.matchAll(/\b(?:https?|ssh|git|ftp):\/\/(?:[^/\s'"@]+@)?([^/\s:'"]+)/gi)) {
+        hosts.add(m[1].toLowerCase());
+    }
+    // scp/ssh syntax:  user@host:path   (github.com from git@github.com:owner/repo.git)
+    for (const m of command.matchAll(/(?:^|\s)[A-Za-z0-9._-]+@([A-Za-z0-9.-]+):/g)) {
+        hosts.add(m[1].toLowerCase());
+    }
+    return [...hosts];
+}
+/** Does this command reach out over the network for git? Catches the bare forms (`git pull`, `git fetch`)
+ *  that carry no URL, so the tool knows to resolve their remote host before deciding to short-circuit. */
+export function isNetworkGitOp(command) {
+    return /\bgit\b[^\n]*\b(?:clone|fetch|pull|push|ls-remote|remote\s+(?:update|show)|submodule\s+update)\b/.test(command);
+}
+/** Pull the connect/DNS-failure HOST out of a command's error text — the deterministic signal for WHICH
+ *  host is down. Returns "" if the text names no host. Pure. */
+export function hostFromConnectError(errText) {
+    const m = errText.match(/Failed to connect to ([^\s:]+)\s+port/i) || // git/curl: Failed to connect to github.com port 443
+        errText.match(/Could not resolve host:?\s*([^\s'"]+)/i) || // git/curl DNS: Could not resolve host: github.com
+        errText.match(/Resolving [^\s]*?\(?([A-Za-z0-9.-]+?)\)? timed out/i) || // curl (28) Resolving api.x.com timed out
+        errText.match(/unable to access '[a-z]+:\/\/([^/'"]+)/i); // git: unable to access 'https://github.com/…'
+    return m ? m[1].toLowerCase().replace(/[.,]+$/, "") : "";
+}
+/** Is this error a genuine host-unreachability — a connect TIMEOUT / DNS failure / no-route, the kind that
+ *  burns ~75s — as opposed to (a) auth/404/protocol errors on a host that IS up, or (b) "connection
+ *  refused", which is a host that's up and fast-rejecting (a dev server not started yet), NOT the slow
+ *  waste we're guarding against. We cache ONLY genuine unreachability. Pure. */
+export function isConnectFailure(errText) {
+    if (/Connection refused|ECONNREFUSED/i.test(errText))
+        return false; // host is UP (fast reject) — never cache
+    return /(?:Failed to connect to [^\n]*port|Could not resolve host|Couldn't connect to server|Connection timed out|Resolving [^\n]*timed out|Operation timed out|[Nn]etwork is unreachable|[Nn]o route to host|ETIMEDOUT|ENETUNREACH|EHOSTUNREACH|EAI_AGAIN)/.test(errText);
+}

package/dist/tui/model-picker.js

@@ -12,6 +12,8 @@ export function levelsFor(style) {
         return [];
     if (style === "enable_thinking" || style === "ollama_think")
         return ["off", "high"]; // "high" renders as "on"
+    if (style === "deepseek")
+        return ["off", "low", "medium", "high", "max"]; // DeepSeek V4 honors a real "max"
     return ["off", "low", "medium", "high"];
 }
 /** Label a level for display — binary styles read as on/off, graded ones as the level name. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanhara/hara",
-  "version": "0.112.4",
+  "version": "0.113.0",
   "description": "hara — a coding agent CLI that runs like an engineering org.",
   "bin": {
     "hara": "dist/index.js"