@nanhara/hara 0.115.0 → 0.116.0

package/CHANGELOG.md

@@ -5,6 +5,22 @@ All notable changes to `@nanhara/hara`.
 > Versioning (pre-1.0, SemVer-style): the **minor** (middle) number bumps for a **new feature**; the
 > **patch** (last) number bumps for **optimizations/fixes of existing features**.
 
+## 0.116.0 — the desktop-grade serve protocol (models · automation · rename/archive · capabilities)
+
+- **Session source stamping.** Sessions now record WHO created them (`interactive` / `gateway` / `cron`,
+  env-derived; the cron runner passes the job name along) — and automated sessions get a
+  **"name · MM-DD HH:mm" title at creation**, so a cron prompt never becomes a session title again.
+- **`hara serve` protocol, batch 2** (everything the Hara desktop app drives):
+  - `models.list` (endpoint model catalog + thinking-effort levels) and `session.set-model`
+    (per-session model/effort switch, applies next turn)
+  - `automation.list` — cron jobs with last outcome + automated sessions, for the desktop's
+    automation timeline
+  - `session.rename` + `session.archive` (archived sessions hidden from lists, kept on disk)
+  - `initialize` now advertises `capabilities.methods` — clients feature-detect instead of
+    probing for method-not-found
+  - `session.send` expands `@file` mentions (CLI parity)
+  - `session.list` carries `source` / `sourceName` / `archived`
+
 ## 0.115.0 — serve exposes plugins & skills (desktop plugin panel)
 
 - **`hara serve` protocol grows a plugin surface**: `plugins.list` (installed plugins with enabled state +

package/dist/cron/runner.js

@@ -55,7 +55,9 @@ export function runJobOnce(job) {
         const [cmd, argv] = job.mode === "command"
             ? ["bash", ["-lc", job.task]]
             : [self[0], [...self.slice(1), ...(job.mode === "org" ? ["org", job.task] : ["-p", job.task, "--approval", "full-auto"])]];
-        const child = spawn(cmd, argv, { cwd: job.cwd, env: { ...process.env, HARA_CRON: "1" } });
+        // HARA_CRON_NAME rides along so the child session's meta gets a human title ("job name · time")
+        // instead of the raw prompt (session store's automated-title strategy).
+        const child = spawn(cmd, argv, { cwd: job.cwd, env: { ...process.env, HARA_CRON: "1", HARA_CRON_NAME: job.name } });
         let tail = ""; // last few KB, for chat delivery (the full stream goes to the log file)
         const append = (d) => {
             tail = (tail + d.toString()).slice(-4_000);

package/dist/index.js

@@ -45,6 +45,7 @@ import { EXPLORE_SYSTEM } from "./tools/agent.js";
 import { createAnthropicProvider } from "./providers/anthropic.js";
 import { createOpenAIProvider } from "./providers/openai.js";
 import { resolvePlatform } from "./providers/registry.js";
+import { levelsFor } from "./tui/model-picker.js";
 import { listModels } from "./providers/models.js";
 import { listJobs, tailJob, killJob } from "./exec/jobs.js";
 /** Render the background-job list for /jobs (user-facing view of what the agent has running in the
@@ -67,7 +68,7 @@ import { getEmbedder } from "./search/embed.js";
 import { collectRepoChunks, collectDirChunks, buildIndex, indexPath, indexExists } from "./search/semindex.js";
 import { searchHybrid } from "./search/hybrid.js";
 import { expandMentions, fileCandidates, isSlashCommand, inlineLeadingPath } from "./context/mentions.js";
-import { newSessionId, shortId, resolveSessionId, saveSession, loadSession, acquireSessionLock, releaseSessionLock, listSessions, latestForCwd, titleFrom, slugify, } from "./session/store.js";
+import { newSessionId, shortId, resolveSessionId, saveSession, loadSession, acquireSessionLock, releaseSessionLock, listSessions, latestForCwd, titleFrom, sessionSourceFromEnv, automatedTitle, slugify, } from "./session/store.js";
 import { setSessionForceModel, isSessionForceModel, effectiveRoleModel } from "./session/session-model.js";
 import { loadRoles, scaffoldRoles, subagentToolFilter } from "./org/roles.js";
 import { loadSkillIndex, loadSkillBody, scaffoldSkills, globalSkillsDir } from "./skills/skills.js";
@@ -1579,6 +1580,9 @@ program
         providerId: cfg.provider,
         model: cfg.model,
         buildSessionProvider: async () => withRouting(await buildProvider(cfg), cfg),
+        buildProviderFor: async (model, effort) => withRouting(await buildProvider({ ...cfg, model, reasoningEffort: effort ?? cfg.reasoningEffort }), cfg),
+        listModels: () => listModels(cfg.baseURL ?? providerDefaultBaseURL(cfg.provider), cfg.apiKey ?? ""),
+        effortLevels: levelsFor(resolvePlatform(cfg.provider, cfg.baseURL ?? providerDefaultBaseURL(cfg.provider)).reasoning).filter((e) => !!e),
         spawnSubagent: (provider, scwd, projectContext, stats, task, role) => runSubagent(cfg, provider, scwd, sandbox, projectContext, stats, task, role),
         guardian: guardianOpt,
         sandbox,
@@ -2251,7 +2255,19 @@ program.action(async (opts) => {
             const prior = rid ? loadSession(rid) : null;
             if (prior?.history)
                 history.push(...prior.history);
-            meta = prior?.meta ?? { id: rid ?? newSessionId(), cwd, provider: cfg.provider, model: cfg.model, title: "", createdAt: new Date().toISOString(), updatedAt: "" };
+            // Stamp who created this session (cron runner sets HARA_CRON, gateway sets HARA_GATEWAY) and give
+            // automated sessions a "name · time" title UP FRONT — the raw prompt must never become the title.
+            const src = sessionSourceFromEnv();
+            meta = prior?.meta ?? {
+                id: rid ?? newSessionId(),
+                cwd,
+                provider: cfg.provider,
+                model: cfg.model,
+                title: src.source === "interactive" ? "" : automatedTitle(src.source, src.sourceName),
+                createdAt: new Date().toISOString(),
+                updatedAt: "",
+                ...(src.source !== "interactive" ? { source: src.source, sourceName: src.sourceName } : { source: "interactive" }),
+            };
             // Apply per-session pinned model on headless resume (mirrors the interactive path).
             // --model flag wins (already on cfg.model) and is written back; otherwise restore meta.model.
             if (prior) {
@@ -2431,6 +2447,7 @@ program.action(async (opts) => {
         title: "",
         createdAt: new Date().toISOString(),
         updatedAt: "",
+        source: "interactive",
     };
     // Single-writer guard: two hara processes on the SAME session race writes to its append-only history and
     // corrupt it. Lock it here (a brand-new session's id is unique, so this only ever blocks a DOUBLE-resume

package/dist/serve/protocol.js

@@ -3,7 +3,8 @@
 // Everything here is PURE (parse + frame builders + error codes) and unit-tested.
 //
 // Client → server requests:
-//   initialize        {token}                    → {name,version,protocol,cwd,provider,model}
+//   initialize        {token,capabilities?}      → {name,version,protocol,cwd,provider,model,
+//                                                   capabilities:{methods:[…]}}  (feature detection)
 //   session.list      {cwd?}                     → {sessions:[{id,title,cwd,model,updatedAt}]}
 //   session.create    {cwd?,approval?}           → {sessionId,model}
 //   session.resume    {sessionId}                → {sessionId,model,history:[{role,text}]}
@@ -13,6 +14,12 @@
 //   plugins.list      {}                          → {plugins:[{name,version,description,enabled,skills,agents,mcpServers}]}
 //   plugins.set       {name,enabled}              → {name,enabled}   (applies to future sessions/turns)
 //   skills.list       {cwd?}                      → {skills:[{id,description,source}]}
+//   automation.list   {}                          → {jobs:[{id,name,mode,enabled,lastRunAt,lastStatus,…}],
+//                                                    sessions:[{id,title,source,sourceName,updatedAt,…}]}
+//   models.list       {}                          → {models:[…], current, effortLevels:[…]}
+//   session.rename    {sessionId,title}           → {sessionId,title}
+//   session.archive   {sessionId,archived}        → {sessionId,archived}   (list hides archived unless {archived:true})
+//   session.set-model {sessionId,model?,effort?}  → {sessionId,model,effort} (next turn; refused mid-turn)
 // Server → client notifications (all carry sessionId):
 //   event.text / event.reasoning {delta} · event.tool {name,preview} · event.diff {text}
 //   event.notice {text} · event.turn_end {reply,usage,error?} · approval.request {approvalId,question}

package/dist/serve/server.js

@@ -11,9 +11,11 @@ import { join } from "node:path";
 import "../tools/all.js"; // register the full built-in toolset — serve must work as a standalone entry
 import { runAgent } from "../agent/loop.js";
 import { loadAgentsMd } from "../context/agents-md.js";
+import { expandMentions } from "../context/mentions.js";
 import { memoryDigest } from "../memory/store.js";
 import { listInstalled, enabledPlugins, setPluginEnabled } from "../plugins/plugins.js";
 import { loadSkillIndex } from "../skills/skills.js";
+import { loadJobs } from "../cron/store.js";
 import { SessionHub, realStore } from "./sessions.js";
 import { parseFrame, rpcResult, rpcError, rpcNotify, ERR, PROTOCOL_VERSION } from "./protocol.js";
 const APPROVAL_TIMEOUT_MS = 300_000; // an unanswered approval denies after 5 min (never hangs a turn)
@@ -94,7 +96,8 @@ export async function startServe(opts, deps) {
             broadcast("approval.request", { sessionId, approvalId, question: q });
         });
         try {
-            s.history.push({ role: "user", content: text });
+            // @file mentions expand to file contents, same as the CLI (`@src/foo.ts` in the composer works)
+            s.history.push({ role: "user", content: expandMentions(text, s.meta.cwd) });
             await runAgent(s.history, {
                 provider: s.provider,
                 ctx: {
@@ -137,13 +140,20 @@ export async function startServe(opts, deps) {
                     if (typeof p.token !== "string" || !sameToken(p.token, token))
                         return reply(rpcError(id, ERR.UNAUTHORIZED, "bad token"));
                     authed.add(ws);
-                    return reply(rpcResult(id, { name: "hara", version: deps.version, protocol: PROTOCOL_VERSION, cwd: opts.cwd, provider: deps.providerId, model: deps.model }));
+                    // capability negotiation (codex app-server pattern): the server ADVERTISES its method set so
+                    // clients feature-detect up front instead of probing for -32601 per call. `p.capabilities`
+                    // (client-declared) is accepted and currently unused — reserved for opt-outs/experimental gating.
+                    const methods = [
+                        "session.list", "session.create", "session.resume", "session.send", "session.interrupt", "session.set-model",
+                        "approval.reply", "plugins.list", "plugins.set", "skills.list", "automation.list", "models.list",
+                    ];
+                    return reply(rpcResult(id, { name: "hara", version: deps.version, protocol: PROTOCOL_VERSION, cwd: opts.cwd, provider: deps.providerId, model: deps.model, capabilities: { methods } }));
                 }
                 if (!authed.has(ws))
                     return reply(rpcError(id, ERR.UNAUTHORIZED, "initialize first"));
                 switch (req.method) {
                     case "session.list":
-                        return reply(rpcResult(id, { sessions: hub.list(typeof p.cwd === "string" ? p.cwd : undefined).map((m) => ({ id: m.id, title: m.title, cwd: m.cwd, model: m.model, updatedAt: m.updatedAt })) }));
+                        return reply(rpcResult(id, { sessions: hub.list(typeof p.cwd === "string" ? p.cwd : undefined).filter((m) => !m.archived || p.archived === true).map((m) => ({ id: m.id, title: m.title, cwd: m.cwd, model: m.model, updatedAt: m.updatedAt, source: m.source ?? "interactive", sourceName: m.sourceName, archived: m.archived ?? false })) }));
                     case "session.create": {
                         const provider = await deps.buildSessionProvider();
                         if (!provider)
@@ -195,7 +205,7 @@ export async function startServe(opts, deps) {
                     }
                     case "plugins.list": {
                         const on = new Set(enabledPlugins().map((pl) => pl.name));
-                        return reply(rpcResult(id, { plugins: listInstalled().map((pl) => ({ name: pl.name, version: pl.version, description: pl.manifest.description ?? "", enabled: on.has(pl.name), skills: (pl.manifest.skills ?? []).length, agents: (pl.manifest.agents ?? []).length, mcpServers: Object.keys(pl.manifest.mcpServers ?? {}).length })) }));
+                        return reply(rpcResult(id, { plugins: listInstalled().map((pl) => ({ name: pl.name, version: pl.version, description: pl.manifest.description ?? "", enabled: on.has(pl.name), skills: (pl.manifest.skills ?? []).length, agents: (pl.manifest.agents ?? []).length, mcpServers: Object.keys(pl.manifest.mcpServers ?? {}).length, panels: pl.manifest.panels ?? [] })) }));
                     }
                     case "plugins.set": {
                         if (typeof p.name !== "string" || typeof p.enabled !== "boolean")
@@ -205,6 +215,54 @@ export async function startServe(opts, deps) {
                         setPluginEnabled(p.name, p.enabled);
                         return reply(rpcResult(id, { name: p.name, enabled: p.enabled })); // takes effect on the next session/turn (loaders re-read)
                     }
+                    case "session.rename": {
+                        if (typeof p.sessionId !== "string" || typeof p.title !== "string")
+                            return reply(rpcError(id, ERR.PARAMS, "sessionId + title required"));
+                        if (!hub.rename(p.sessionId, p.title.slice(0, 120)))
+                            return reply(rpcError(id, ERR.NO_SESSION, `no session ${p.sessionId}`));
+                        return reply(rpcResult(id, { sessionId: p.sessionId, title: p.title.slice(0, 120) }));
+                    }
+                    case "session.archive": {
+                        if (typeof p.sessionId !== "string" || typeof p.archived !== "boolean")
+                            return reply(rpcError(id, ERR.PARAMS, "sessionId + archived required"));
+                        if (!hub.setArchived(p.sessionId, p.archived))
+                            return reply(rpcError(id, ERR.NO_SESSION, `no session ${p.sessionId}`));
+                        return reply(rpcResult(id, { sessionId: p.sessionId, archived: p.archived }));
+                    }
+                    case "models.list": {
+                        const models = deps.listModels ? await deps.listModels().catch(() => []) : [];
+                        return reply(rpcResult(id, { models, current: deps.model, effortLevels: deps.effortLevels ?? [] }));
+                    }
+                    case "session.set-model": {
+                        // per-session model / thinking-effort switch (the composer picker). Rebuilds the session's
+                        // provider; takes effect on the NEXT turn. Refused mid-turn.
+                        if (typeof p.sessionId !== "string")
+                            return reply(rpcError(id, ERR.PARAMS, "sessionId required"));
+                        const s = hub.get(p.sessionId);
+                        if (!s)
+                            return reply(rpcError(id, ERR.NO_SESSION, `no live session ${p.sessionId}`));
+                        if (s.busy)
+                            return reply(rpcError(id, ERR.BUSY, "a turn is running — switch after it finishes"));
+                        const model = typeof p.model === "string" && p.model ? p.model : s.meta.model;
+                        const effort = typeof p.effort === "string" && p.effort ? p.effort : undefined;
+                        if (!deps.buildProviderFor)
+                            return reply(rpcError(id, ERR.METHOD, "model switching not supported by this server"));
+                        const provider = await deps.buildProviderFor(model, effort);
+                        if (!provider)
+                            return reply(rpcError(id, ERR.INTERNAL, `could not build provider for ${model}`));
+                        s.provider = provider;
+                        s.meta.model = model;
+                        s.effort = effort;
+                        return reply(rpcResult(id, { sessionId: s.meta.id, model, effort: effort ?? null }));
+                    }
+                    case "automation.list": {
+                        // The automation timeline's data: cron jobs with their last outcome, plus this machine's
+                        // automated sessions (source=cron/gateway) so the desktop can render results and "continue
+                        // as conversation". Read-only.
+                        const jobs = loadJobs().map((j) => ({ id: j.id, name: j.name, mode: j.mode, cwd: j.cwd, enabled: j.enabled, deliver: j.deliver, lastRunAt: j.lastRunAt, lastStatus: j.lastStatus, lastError: j.lastError }));
+                        const automated = hub.list().filter((m) => m.source === "cron" || m.source === "gateway").map((m) => ({ id: m.id, title: m.title, cwd: m.cwd, source: m.source, sourceName: m.sourceName, updatedAt: m.updatedAt }));
+                        return reply(rpcResult(id, { jobs, sessions: automated }));
+                    }
                     case "skills.list": {
                         const cwd = typeof p.cwd === "string" && p.cwd ? p.cwd : opts.cwd;
                         return reply(rpcResult(id, { skills: loadSkillIndex(cwd).map((s) => ({ id: s.id, description: s.description, source: s.source })) }));

package/dist/serve/sessions.js

@@ -22,6 +22,7 @@ export class SessionHub {
             title: "",
             createdAt: new Date().toISOString(),
             updatedAt: "",
+            source: "interactive", // serve sessions are user-driven (desktop/IDE clients)
         };
         this.store.acquire(meta.id); // fresh id — always ours; registers the single-writer claim
         const s = { meta, history: [], provider: o.provider, approval: o.approval, autoApprove: new Set(), stats: { input: 0, output: 0 }, projectContext: o.projectContext, busy: false, abort: null };
@@ -58,6 +59,36 @@ export class SessionHub {
         }
         this.store.save(s.meta, s.history);
     }
+    /** Rename a session (live or on-disk). Returns false when the id is unknown. */
+    rename(id, title) {
+        const live = this.sessions.get(id);
+        if (live) {
+            live.meta.title = title;
+            this.store.save(live.meta, live.history);
+            return true;
+        }
+        const prior = this.store.load(id);
+        if (!prior)
+            return false;
+        prior.meta.title = title;
+        this.store.save(prior.meta, prior.history);
+        return true;
+    }
+    /** Archive/unarchive (hidden from lists, kept on disk). Returns false when unknown. */
+    setArchived(id, on) {
+        const live = this.sessions.get(id);
+        if (live) {
+            live.meta.archived = on;
+            this.store.save(live.meta, live.history);
+            return true;
+        }
+        const prior = this.store.load(id);
+        if (!prior)
+            return false;
+        prior.meta.archived = on;
+        this.store.save(prior.meta, prior.history);
+        return true;
+    }
     /** Release all locks (server shutdown). In-flight turns are aborted by the caller first. */
     releaseAll() {
         for (const id of this.sessions.keys())

package/dist/session/store.js

@@ -3,6 +3,21 @@ import { homedir } from "node:os";
 import { join } from "node:path";
 import { readFileSync, writeFileSync, existsSync, mkdirSync, readdirSync, rmSync } from "node:fs";
 import { randomUUID } from "node:crypto";
+/** Derive the session source from the spawn environment — the gateway subprocess runs with
+ *  HARA_GATEWAY=<platform>, the cron runner with HARA_CRON=1 (+ HARA_CRON_NAME=<job name>). */
+export function sessionSourceFromEnv() {
+    if (process.env.HARA_CRON)
+        return { source: "cron", sourceName: process.env.HARA_CRON_NAME || undefined };
+    if (process.env.HARA_GATEWAY)
+        return { source: "gateway", sourceName: process.env.HARA_GATEWAY };
+    return { source: "interactive" };
+}
+/** Title for a NON-interactive session: "name · MM-DD HH:mm" — the raw prompt never becomes a title. */
+export function automatedTitle(source, sourceName, at = new Date()) {
+    const pad = (n) => String(n).padStart(2, "0");
+    const stamp = `${pad(at.getMonth() + 1)}-${pad(at.getDate())} ${pad(at.getHours())}:${pad(at.getMinutes())}`;
+    return `${sourceName || source} · ${stamp}`;
+}
 function sessionsDir() {
     const d = join(homedir(), ".hara", "sessions");
     mkdirSync(d, { recursive: true });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanhara/hara",
-  "version": "0.115.0",
+  "version": "0.116.0",
   "description": "hara — a coding agent CLI that runs like an engineering org.",
   "bin": {
     "hara": "dist/index.js"