@nanhara/hara 0.119.1 → 0.120.0

package/CHANGELOG.md

@@ -5,6 +5,28 @@ All notable changes to `@nanhara/hara`.
 > Versioning (pre-1.0, SemVer-style): the **minor** (middle) number bumps for a **new feature**; the
 > **patch** (last) number bumps for **optimizations/fixes of existing features**.
 
+## 0.120.0 — `hara feedback`: one door for humans and agents
+
+- **`hara feedback "what happened"`** files a structured GitHub issue (repo hara-cli/hara,
+  label `feedback`) via the gh CLI, with a copy-paste fallback. Auto-collects hara version /
+  OS / Node / provider:model (never keys) and aggressively redacts credentials
+  (sk-/ghp_/AWS/Bearer/JWT/key=value families). `--session` opt-in attaches a redacted session
+  tail (issues are public); `--dry-run` prints without filing. Matching .github issue forms
+  ship in the repo — hand-filed and command-filed reports read identically.
+- **Security stance (documented)**: hara agents exchange structured data — they never accept
+  task instructions from untrusted parties. Cross-trust-boundary agent task-passing is
+  permanently out of scope; feedback/issues are the entire agent-to-agent surface.
+
+## 0.119.2 — TUI: update notices actually visible · CJK-correct input wrapping
+
+- **Update notices now render INSIDE the TUI** (yellow line under the header card). They used to
+  print to stdout before ink mounted and vanished when the TUI took the screen — which is why TUI
+  users never saw them and versions silently went stale (field report: stuck on 0.112.5).
+- **Input wrapping measures terminal CELLS, not characters.** CJK/emoji render 2 cells wide;
+  mixed 中文+ASCII prompts used to overflow the real width and get soft-wrapped a second time
+  mid-word ("output" torn into "ou/tput"). Long words hard-break per code point so a double-width
+  char never straddles the terminal edge.
+
 ## 0.119.1 — field-feedback robustness: param gate · no-hang git · actionable timeouts · stale-artifact rule
 
 - **Required-parameter gate.** A tool call arriving WITHOUT its required parameters (observed:

package/dist/feedback.js

@@ -0,0 +1,55 @@
+// `hara feedback` — the hara-hub verdict made flesh: feedback is a COMMAND, not a server.
+// Collects environment facts, redacts secrets, and builds a structured GitHub issue body that
+// humans and agents file through the same door (gh CLI when present, copy-paste text otherwise).
+// The session tail is OFF by default and explicitly opt-in (--session) because issues are public.
+import { platform, release, arch } from "node:os";
+export function collectEnv(version, model) {
+    return {
+        version,
+        os: `${platform()} ${release()} ${arch()}`,
+        node: process.version,
+        model,
+    };
+}
+/** Strip credential-looking material from text that is about to become a PUBLIC issue.
+ *  Deliberately aggressive: false positives cost a little readability, false negatives leak keys. */
+export function redact(text) {
+    return text
+        .replace(/\bsk-[A-Za-z0-9_-]{8,}/g, "sk-***")
+        .replace(/\bgh[pousr]_[A-Za-z0-9]{20,}/g, "gh*_***")
+        .replace(/\b(AKIA|ASIA)[A-Z0-9]{16}\b/g, "AWS-KEY-***")
+        .replace(/\bBearer\s+[A-Za-z0-9._~+/=-]{16,}/gi, "Bearer ***")
+        .replace(/\b(api[_-]?key|apikey|token|secret|password|passwd|authorization)(["']?\s*[:=]\s*["']?)[^\s"',;]{6,}/gi, "$1$2***")
+        .replace(/\beyJ[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g, "JWT-***");
+}
+/** The structured issue body — same shape as .github/ISSUE_TEMPLATE/bug_report.yml so hand-filed
+ *  and command-filed issues read identically to the triage side. */
+export function buildIssueBody(description, env, sessionTail) {
+    const parts = [
+        "## What happened",
+        "",
+        redact(description.trim() || "(no description provided)"),
+        "",
+        "## Environment",
+        "",
+        "| | |",
+        "|---|---|",
+        `| hara | ${env.version} |`,
+        `| os | ${env.os} |`,
+        `| node | ${env.node} |`,
+        ...(env.model ? [`| model | ${redact(env.model)} |`] : []),
+        "",
+    ];
+    if (sessionTail && sessionTail.trim()) {
+        parts.push("## Session tail (redacted, shared with --session)", "", "```", redact(sessionTail).slice(0, 4000), "```", "");
+    }
+    parts.push("---", "_filed via `hara feedback`_");
+    return parts.join("\n");
+}
+/** Issue title from the description: first line, trimmed, capped. */
+export function issueTitle(description) {
+    const first = (description.trim().split("\n")[0] || "feedback").trim();
+    return first.length > 70 ? first.slice(0, 67) + "…" : first;
+}
+export const FEEDBACK_REPO = "hara-cli/hara";
+export const NEW_ISSUE_URL = `https://github.com/${FEEDBACK_REPO}/issues/new`;

package/dist/index.js

@@ -1990,6 +1990,52 @@ rolesCmd.action(() => {
         out(`${c.bold(r.id)}${r.model ? c.dim(` (${r.model})`) : ""}  ${c.dim("owns: " + r.owns.join(", "))}\n  ${r.description}\n`);
     }
 });
+program
+    .command("feedback [description...]")
+    .description("file a structured bug/feature report to GitHub (hara-cli/hara) — humans and agents use the same door")
+    .option("--session", "append a REDACTED tail of the most recent session (the issue is PUBLIC)")
+    .option("--dry-run", "print the issue body without filing")
+    .action(async (parts, o) => {
+    // the hara-hub verdict: feedback is a command, not a server — GitHub Issues is the bus
+    const { collectEnv, buildIssueBody, issueTitle, FEEDBACK_REPO, NEW_ISSUE_URL } = await import("./feedback.js");
+    const desc = (parts ?? []).join(" ").trim();
+    if (!desc) {
+        out(`Usage: hara feedback "what happened…" [--session] [--dry-run] — files a structured issue to ${FEEDBACK_REPO}\n`);
+        return;
+    }
+    let tail;
+    if (o.session) {
+        const { listSessions, loadSession } = await import("./session/store.js");
+        const metas = listSessions();
+        const last = metas[0] ? loadSession(metas[0].id) : null;
+        if (last) {
+            tail = last.history
+                .slice(-8)
+                .map((m) => (m.role === "user" ? `user: ${m.content}` : m.role === "assistant" && m.text ? `assistant: ${m.text}` : ""))
+                .filter(Boolean)
+                .join("\n")
+                .slice(-3000);
+            out(c.yellow("⚠ --session attaches a redacted tail of your last session to a PUBLIC issue.\n"));
+        }
+    }
+    const { readRawConfig } = await import("./config.js");
+    const raw = readRawConfig();
+    const modelLabel = raw.provider && raw.model ? `${raw.provider}:${raw.model}` : undefined;
+    const body = buildIssueBody(desc, collectEnv(pkg.version, modelLabel), tail);
+    if (o.dryRun) {
+        out(body + "\n");
+        return;
+    }
+    const { execFileSync } = await import("node:child_process");
+    try {
+        execFileSync("gh", ["--version"], { stdio: "ignore" });
+        const url = execFileSync("gh", ["issue", "create", "--repo", FEEDBACK_REPO, "--title", issueTitle(desc), "--body", body, "--label", "feedback"], { encoding: "utf8" });
+        out(c.green("✓ filed: ") + url.trim() + "\n");
+    }
+    catch {
+        out(`\n(gh CLI unavailable or filing failed — copy everything below into ${NEW_ISSUE_URL})\n\n# ${issueTitle(desc)}\n\n${body}\n`);
+    }
+});
 const skillsCmd = program.command("skills").description("manage skills (.hara/skills/<name>/SKILL.md)");
 skillsCmd
     .command("init")
@@ -2937,6 +2983,9 @@ program.action(async (opts) => {
                 routeHost: __routeForHeader?.host,
                 modelSource: __modelSource,
                 visionModel: cfg.visionModel,
+                // the pre-mount stdout notice (line ~2497) doesn't survive ink taking the screen — TUI users
+                // never saw update notices and versions silently went stale (field report: stuck on 0.112.5)
+                updateNotice: cfg.updateCheck ? (checkForUpdate(pkg.version) ?? undefined) : undefined,
             },
             visionNotice: __visionNotice,
             cycleApproval: (m) => cycleMode(m),

package/dist/tui/App.js

@@ -231,7 +231,7 @@ function HeaderCard(props) {
         : row("profile", _jsx(Text, { children: props.profileId ? `personal:${props.profileId}` : "personal" }));
     return (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Box, { flexDirection: "column", borderStyle: "round", borderColor: "gray", borderDimColor: true, paddingX: 1, alignSelf: "flex-start", marginBottom: 1, children: [_jsxs(Text, { children: [_jsx(Text, { color: accent(), bold: true, children: "◆ hara" }), _jsx(Text, { dimColor: true, children: `   v${version} · the agent that runs like an org` })] }), _jsx(Text, { children: " " }), identityRow, row("model", (_jsxs(Text, { children: [_jsx(Text, { children: modelLabel }), isOrg
                                 ? props.modelSource ? _jsx(Text, { dimColor: true, children: ` · from ${props.modelSource}` }) : null
-                                : props.visionModel ? _jsx(Text, { dimColor: true, children: modelLineSuffix(props.visionModel) }) : null, _jsx(Text, { children: "   " }), _jsx(Text, { color: "green", children: "/model ↹" })] }))), row("cwd", (_jsxs(Text, { children: [_jsx(Text, { children: cwdShort }), agentsMdLoaded ? _jsx(Text, { dimColor: true, children: " · AGENTS.md" }) : null] }))), sessionShort ? row("session", _jsx(Text, { children: sessionShort })) : null] }), _jsx(Text, { dimColor: true, children: "  Tip: @ attach file · ctrl+t transcript · ctrl+r reasoning · shift+tab approval · esc interrupt" })] }));
+                                : props.visionModel ? _jsx(Text, { dimColor: true, children: modelLineSuffix(props.visionModel) }) : null, _jsx(Text, { children: "   " }), _jsx(Text, { color: "green", children: "/model ↹" })] }))), row("cwd", (_jsxs(Text, { children: [_jsx(Text, { children: cwdShort }), agentsMdLoaded ? _jsx(Text, { dimColor: true, children: " · AGENTS.md" }) : null] }))), sessionShort ? row("session", _jsx(Text, { children: sessionShort })) : null] }), _jsx(Text, { dimColor: true, children: "  Tip: @ attach file · ctrl+t transcript · ctrl+r reasoning · shift+tab approval · esc interrupt" }), props.updateNotice ? _jsx(Text, { color: "yellow", children: `  ⬆ ${props.updateNotice}` }) : null] }));
 }
 // Spinner verb: while a turn is running, prefer the in_progress todo's activeForm (or its text),
 // so the bottom line reads "▶ updating tests…" instead of an abstract "working". Falls back to

package/dist/tui/InputBox.js

@@ -110,6 +110,35 @@ function segmentize(value) {
         parts.push({ text: value.slice(last), token: false });
     return parts;
 }
+/** Terminal cell width of one code point: CJK/fullwidth/emoji render 2 cells, combining marks and
+ *  joiners 0, everything else 1. Wrapping used to count `.length` (1 per char) — mixed CJK+ASCII
+ *  input then overflowed the real terminal width and ink soft-wrapped a second time mid-word
+ *  (field report: "output" torn into "ou/tput" while typing a URL + 中文 prompt). */
+export function charCells(ch) {
+    const cp = ch.codePointAt(0);
+    if ((cp >= 0x300 && cp <= 0x36f) || cp === 0x200d || (cp >= 0xfe00 && cp <= 0xfe0f))
+        return 0; // combining/ZWJ/VS
+    if ((cp >= 0x1100 && cp <= 0x115f) || // Hangul Jamo
+        (cp >= 0x2e80 && cp <= 0xa4cf) || // CJK radicals … Yi
+        (cp >= 0xa960 && cp <= 0xa97f) ||
+        (cp >= 0xac00 && cp <= 0xd7a3) || // Hangul syllables
+        (cp >= 0xf900 && cp <= 0xfaff) || // CJK compatibility ideographs
+        (cp >= 0xfe30 && cp <= 0xfe4f) || // CJK compatibility forms
+        (cp >= 0xff00 && cp <= 0xff60) || // fullwidth forms
+        (cp >= 0xffe0 && cp <= 0xffe6) ||
+        (cp >= 0x1f300 && cp <= 0x1faff) || // emoji
+        (cp >= 0x20000 && cp <= 0x3fffd) // CJK extension planes
+    )
+        return 2;
+    return 1;
+}
+/** Display width of a string in terminal cells (sum of charCells over code points). */
+export function cells(s) {
+    let n = 0;
+    for (const ch of s)
+        n += charCells(ch);
+    return n;
+}
 /** Wrap `value` into rows that each fit within `cols` cells, breaking on spaces where possible but
  *  never inside an `[Image #N]` token. Deterministic (no reliance on ink's soft-wrap) so wrapped rows
  *  align under a stable gutter and the cursor position is exact. Always returns at least one row. */
@@ -154,25 +183,28 @@ export function wrapRows(value, cols) {
             flush(aEnd);
             continue;
         }
-        if (a.atomic || a.text.length <= width) {
+        const aCells = cells(a.text);
+        if (a.atomic || aCells <= width) {
             // A whole unit (image token OR a word chunk that fits within a full row): if it doesn't fit in
             // the remaining room and the row already has content, wrap to a fresh row FIRST — never split it.
-            if (a.text.length > width - col && col > 0)
+            if (aCells > width - col && col > 0)
                 flush(a.start);
-            col += a.text.length; // an oversized atomic token may exceed width — acceptable (rare, kept whole)
+            col += aCells; // an oversized atomic token may exceed width — acceptable (rare, kept whole)
             if (col >= width)
                 flush(aEnd);
         }
         else {
-            // A single word longer than the whole width: hard-break it across rows.
+            // A single word longer than the whole width: hard-break it across rows — walking CODE POINTS
+            // and accumulating CELLS, so a double-width char never straddles the terminal edge.
             let s = a.start;
             if (col > 0)
                 flush(s); // start the long word on a fresh row
-            while (s < aEnd) {
-                const room = width - col;
-                const take = Math.min(room, aEnd - s);
-                col += take;
-                s += take;
+            for (const ch of a.text) {
+                const w = charCells(ch);
+                if (col + w > width && col > 0)
+                    flush(s);
+                col += w;
+                s += ch.length;
                 if (col >= width)
                     flush(s);
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanhara/hara",
-  "version": "0.119.1",
+  "version": "0.120.0",
   "description": "hara — a coding agent CLI that runs like an engineering org.",
   "bin": {
     "hara": "dist/index.js"