@nanhara/hara 0.119.2 → 0.120.0

package/CHANGELOG.md

@@ -5,6 +5,18 @@ All notable changes to `@nanhara/hara`.
 > Versioning (pre-1.0, SemVer-style): the **minor** (middle) number bumps for a **new feature**; the
 > **patch** (last) number bumps for **optimizations/fixes of existing features**.
 
+## 0.120.0 — `hara feedback`: one door for humans and agents
+
+- **`hara feedback "what happened"`** files a structured GitHub issue (repo hara-cli/hara,
+  label `feedback`) via the gh CLI, with a copy-paste fallback. Auto-collects hara version /
+  OS / Node / provider:model (never keys) and aggressively redacts credentials
+  (sk-/ghp_/AWS/Bearer/JWT/key=value families). `--session` opt-in attaches a redacted session
+  tail (issues are public); `--dry-run` prints without filing. Matching .github issue forms
+  ship in the repo — hand-filed and command-filed reports read identically.
+- **Security stance (documented)**: hara agents exchange structured data — they never accept
+  task instructions from untrusted parties. Cross-trust-boundary agent task-passing is
+  permanently out of scope; feedback/issues are the entire agent-to-agent surface.
+
 ## 0.119.2 — TUI: update notices actually visible · CJK-correct input wrapping
 
 - **Update notices now render INSIDE the TUI** (yellow line under the header card). They used to

package/dist/feedback.js

@@ -0,0 +1,55 @@
+// `hara feedback` — the hara-hub verdict made flesh: feedback is a COMMAND, not a server.
+// Collects environment facts, redacts secrets, and builds a structured GitHub issue body that
+// humans and agents file through the same door (gh CLI when present, copy-paste text otherwise).
+// The session tail is OFF by default and explicitly opt-in (--session) because issues are public.
+import { platform, release, arch } from "node:os";
+export function collectEnv(version, model) {
+    return {
+        version,
+        os: `${platform()} ${release()} ${arch()}`,
+        node: process.version,
+        model,
+    };
+}
+/** Strip credential-looking material from text that is about to become a PUBLIC issue.
+ *  Deliberately aggressive: false positives cost a little readability, false negatives leak keys. */
+export function redact(text) {
+    return text
+        .replace(/\bsk-[A-Za-z0-9_-]{8,}/g, "sk-***")
+        .replace(/\bgh[pousr]_[A-Za-z0-9]{20,}/g, "gh*_***")
+        .replace(/\b(AKIA|ASIA)[A-Z0-9]{16}\b/g, "AWS-KEY-***")
+        .replace(/\bBearer\s+[A-Za-z0-9._~+/=-]{16,}/gi, "Bearer ***")
+        .replace(/\b(api[_-]?key|apikey|token|secret|password|passwd|authorization)(["']?\s*[:=]\s*["']?)[^\s"',;]{6,}/gi, "$1$2***")
+        .replace(/\beyJ[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g, "JWT-***");
+}
+/** The structured issue body — same shape as .github/ISSUE_TEMPLATE/bug_report.yml so hand-filed
+ *  and command-filed issues read identically to the triage side. */
+export function buildIssueBody(description, env, sessionTail) {
+    const parts = [
+        "## What happened",
+        "",
+        redact(description.trim() || "(no description provided)"),
+        "",
+        "## Environment",
+        "",
+        "| | |",
+        "|---|---|",
+        `| hara | ${env.version} |`,
+        `| os | ${env.os} |`,
+        `| node | ${env.node} |`,
+        ...(env.model ? [`| model | ${redact(env.model)} |`] : []),
+        "",
+    ];
+    if (sessionTail && sessionTail.trim()) {
+        parts.push("## Session tail (redacted, shared with --session)", "", "```", redact(sessionTail).slice(0, 4000), "```", "");
+    }
+    parts.push("---", "_filed via `hara feedback`_");
+    return parts.join("\n");
+}
+/** Issue title from the description: first line, trimmed, capped. */
+export function issueTitle(description) {
+    const first = (description.trim().split("\n")[0] || "feedback").trim();
+    return first.length > 70 ? first.slice(0, 67) + "…" : first;
+}
+export const FEEDBACK_REPO = "hara-cli/hara";
+export const NEW_ISSUE_URL = `https://github.com/${FEEDBACK_REPO}/issues/new`;

package/dist/index.js

@@ -1990,6 +1990,52 @@ rolesCmd.action(() => {
         out(`${c.bold(r.id)}${r.model ? c.dim(` (${r.model})`) : ""}  ${c.dim("owns: " + r.owns.join(", "))}\n  ${r.description}\n`);
     }
 });
+program
+    .command("feedback [description...]")
+    .description("file a structured bug/feature report to GitHub (hara-cli/hara) — humans and agents use the same door")
+    .option("--session", "append a REDACTED tail of the most recent session (the issue is PUBLIC)")
+    .option("--dry-run", "print the issue body without filing")
+    .action(async (parts, o) => {
+    // the hara-hub verdict: feedback is a command, not a server — GitHub Issues is the bus
+    const { collectEnv, buildIssueBody, issueTitle, FEEDBACK_REPO, NEW_ISSUE_URL } = await import("./feedback.js");
+    const desc = (parts ?? []).join(" ").trim();
+    if (!desc) {
+        out(`Usage: hara feedback "what happened…" [--session] [--dry-run] — files a structured issue to ${FEEDBACK_REPO}\n`);
+        return;
+    }
+    let tail;
+    if (o.session) {
+        const { listSessions, loadSession } = await import("./session/store.js");
+        const metas = listSessions();
+        const last = metas[0] ? loadSession(metas[0].id) : null;
+        if (last) {
+            tail = last.history
+                .slice(-8)
+                .map((m) => (m.role === "user" ? `user: ${m.content}` : m.role === "assistant" && m.text ? `assistant: ${m.text}` : ""))
+                .filter(Boolean)
+                .join("\n")
+                .slice(-3000);
+            out(c.yellow("⚠ --session attaches a redacted tail of your last session to a PUBLIC issue.\n"));
+        }
+    }
+    const { readRawConfig } = await import("./config.js");
+    const raw = readRawConfig();
+    const modelLabel = raw.provider && raw.model ? `${raw.provider}:${raw.model}` : undefined;
+    const body = buildIssueBody(desc, collectEnv(pkg.version, modelLabel), tail);
+    if (o.dryRun) {
+        out(body + "\n");
+        return;
+    }
+    const { execFileSync } = await import("node:child_process");
+    try {
+        execFileSync("gh", ["--version"], { stdio: "ignore" });
+        const url = execFileSync("gh", ["issue", "create", "--repo", FEEDBACK_REPO, "--title", issueTitle(desc), "--body", body, "--label", "feedback"], { encoding: "utf8" });
+        out(c.green("✓ filed: ") + url.trim() + "\n");
+    }
+    catch {
+        out(`\n(gh CLI unavailable or filing failed — copy everything below into ${NEW_ISSUE_URL})\n\n# ${issueTitle(desc)}\n\n${body}\n`);
+    }
+});
 const skillsCmd = program.command("skills").description("manage skills (.hara/skills/<name>/SKILL.md)");
 skillsCmd
     .command("init")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanhara/hara",
-  "version": "0.119.2",
+  "version": "0.120.0",
   "description": "hara — a coding agent CLI that runs like an engineering org.",
   "bin": {
     "hara": "dist/index.js"