@nanhara/hara 0.120.0 → 0.121.0

package/CHANGELOG.md

@@ -5,6 +5,26 @@ All notable changes to `@nanhara/hara`.
 > Versioning (pre-1.0, SemVer-style): the **minor** (middle) number bumps for a **new feature**; the
 > **patch** (last) number bumps for **optimizations/fixes of existing features**.
 
+## 0.121.0 — `hara desk` · crash-safe coding/files · bounded interactive I/O
+
+- **`hara desk` connects the CLI to the shared coordination desk.** Register an agent, post/list/
+  claim/complete/ack/cancel tasks, and persist the desk token with owner-only file permissions. The
+  client identifies itself as `hara-cli`, so mixed Codex/Claude Code/hara fleets remain legible.
+- **Coding edits are transaction-safe.** `write_file` uses same-directory atomic replacement;
+  multi-file patches validate every destination before writing and roll back already-committed
+  files if a later commit fails. Undo snapshots are captured before mutation, failed writes do not
+  create false undo history, and symlink/non-regular destinations are rejected consistently.
+- **Large files stay useful without flooding memory or context.** Slice reads stream only the
+  requested line window, `@file` mentions have explicit byte/line caps, and tool results are
+  bounded centrally (including plugin/MCP results) with clear truncation metadata.
+- **Interactive input is friendlier and bounded.** The TUI composer has shell-style up/down history
+  with draft restoration, duplicate suppression, navigation reset after edits, and a fixed maximum
+  history size. The ask-mode sentinel is also source-safe on every supported Node runtime.
+- **Faster cold start.** Unicode-width data and the write/edit tool graph are loaded only when the
+  active command needs them, reducing startup work for lightweight commands such as `--version`.
+- **Production dependency hardening.** The Lark SDK's Axios transport is pinned to a patched 1.x
+  release instead of its vulnerable `~1.13.3` range; the production npm audit is clean at release.
+
 ## 0.120.0 — `hara feedback`: one door for humans and agents
 
 - **`hara feedback "what happened"`** files a structured GitHub issue (repo hara-cli/hara,

package/dist/context/mentions.js

@@ -1,10 +1,11 @@
 // @file mentions — expand `@path` references in user input into appended file contents,
 // and provide fuzzy file candidates for REPL tab-completion.
-import { readFileSync, existsSync, statSync } from "node:fs";
+import { existsSync, statSync } from "node:fs";
 import { isAbsolute, resolve } from "node:path";
 import { listProjectFiles, dirPrefixes, walkFiles } from "../fs-walk.js";
 import { fuzzyRank } from "../fuzzy.js";
 import { mediaTypeFor } from "../images.js";
+import { readTextPrefixSync } from "../fs-read.js";
 const MAX_FILE = 50_000;
 // @ at start-of-string or after whitespace; capture a path with no spaces/@ (avoids emails like a@b.com)
 const MENTION_RE = /(?:^|\s)@([^\s@]+)/g;
@@ -53,9 +54,10 @@ function expandRef(ref, cwd) {
             // don't inline binary image bytes as text — paste with Ctrl+V (or drag the file in) to attach visually
             if (mediaTypeFor(abs))
                 return `Referenced \`${ref}\` is an image — paste it with Ctrl+V to attach it visually.`;
-            let txt = readFileSync(abs, "utf8");
-            if (txt.length > MAX_FILE)
-                txt = txt.slice(0, MAX_FILE) + "\n…[truncated]";
+            const prefix = readTextPrefixSync(abs, MAX_FILE);
+            if (prefix.binary)
+                return `Referenced \`${ref}\` appears to be binary — it was not inserted into the model context.`;
+            const txt = prefix.text + (prefix.truncated ? "\n…[truncated]" : "");
             return `\nReferenced file \`${ref}\`:\n\`\`\`\n${txt}\n\`\`\`\n`;
         }
         if (st.isDirectory()) {
@@ -73,16 +75,24 @@ function expandRef(ref, cwd) {
 const cache = new Map();
 const CACHE_MS = 5000;
 function projectEntries(cwd) {
-    const hit = cache.get(cwd);
+    const key = resolve(cwd);
+    const hit = cache.get(key);
     const now = Date.now();
     if (hit && now - hit.at < CACHE_MS)
         return hit.entries;
-    const files = listProjectFiles(cwd);
+    const files = listProjectFiles(key);
     // files + their directory prefixes (so `@src/` drills into the subtree)
     const entries = [...dirPrefixes(files), ...files];
-    cache.set(cwd, { at: now, entries });
+    cache.set(key, { at: now, entries });
     return entries;
 }
+/** Invalidate the derived @path inventory after a coding tool creates/deletes a file. */
+export function invalidateFileCandidates(cwd) {
+    if (cwd)
+        cache.delete(resolve(cwd));
+    else
+        cache.clear();
+}
 /**
  * File/dir candidates whose path matches `query`, for @ autocomplete.
  * Recurses subdirectories (git-tracked + untracked, or a filesystem walk outside git),

package/dist/desk.js

@@ -0,0 +1,64 @@
+// `hara desk` client — how a hara agent connects to the hara-desk coordination server (the closed-
+// source identity registry + task board). This is the OPEN-SOURCE side of the wire: a thin HTTP
+// client + local credential storage. The desk itself (auth, board, L2 ack) lives in hara-desk.
+//
+// Credentials live in ~/.hara/desk.json (0600): the desk URL + this agent's token, written once at
+// `hara desk register`. Every later call reads them back. The token is a bearer secret — never logged.
+import { readFileSync, writeFileSync, mkdirSync, chmodSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+const credsPath = () => join(homedir(), ".hara", "desk.json");
+export function loadCreds() {
+    try {
+        const c = JSON.parse(readFileSync(credsPath(), "utf8"));
+        return c.url && c.token ? c : null;
+    }
+    catch {
+        return null;
+    }
+}
+export function saveCreds(c) {
+    const dir = join(homedir(), ".hara");
+    mkdirSync(dir, { recursive: true });
+    const p = credsPath();
+    writeFileSync(p, JSON.stringify(c, null, 2));
+    try {
+        chmodSync(p, 0o600);
+    }
+    catch {
+        /* best-effort on non-posix */
+    }
+}
+/** One HTTP call to the desk. Auth via bearer token when creds are present. Throws on non-2xx with
+ *  the server's error message (so the CLI can surface a real reason, not "request failed"). */
+export async function deskCall(url, method, path, opts = {}) {
+    const r = await fetch(url.replace(/\/$/, "") + path, {
+        method,
+        headers: {
+            "content-type": "application/json",
+            ...(opts.token ? { authorization: `Bearer ${opts.token}` } : {}),
+        },
+        ...(opts.body !== undefined ? { body: JSON.stringify(opts.body) } : {}),
+        signal: AbortSignal.timeout(opts.timeoutMs ?? 10000),
+    });
+    const text = await r.text();
+    let data = {};
+    try {
+        data = text ? JSON.parse(text) : {};
+    }
+    catch {
+        data = { raw: text };
+    }
+    if (!r.ok)
+        throw new Error(data?.error || `desk ${r.status}: ${text.slice(0, 200)}`);
+    return data;
+}
+/** Register this machine's agent with a desk and persist the returned credentials. `client`
+ *  identifies the kind of client (defaults "hara-cli"); the desk is client-agnostic, so any agent
+ *  may pass its own label. */
+export async function registerAgent(url, enrollKey, name, owner, client = "hara-cli") {
+    const r = await deskCall(url, "POST", "/register", { body: { enrollKey, name, owner, client } });
+    const creds = { url, agentId: r.agentId, owner: r.owner, token: r.token };
+    saveCreds(creds);
+    return creds;
+}

package/dist/fs-read.js

@@ -0,0 +1,157 @@
+// Bounded streaming line reader for files too large to load as one string. It stores only the requested
+// window and a capped prefix of each line, so huge logs/JSONL and minified one-line files stay safe.
+import { closeSync, createReadStream, fstatSync, openSync, readSync } from "node:fs";
+export class BinaryFileError extends Error {
+    constructor(path) {
+        super(`${path} appears to be binary (NUL byte detected)`);
+        this.name = "BinaryFileError";
+    }
+}
+const DEFAULT_LINE_CAP = 2000;
+const DEFAULT_MAX_SCAN = 64 * 1024 * 1024;
+/** Read only enough bytes to produce a bounded UTF-8 prefix (used by synchronous @file expansion). */
+export function readTextPrefixSync(path, maxChars) {
+    const chars = Math.max(0, Math.floor(maxChars));
+    const fd = openSync(path, "r");
+    try {
+        const size = fstatSync(fd).size;
+        // Four bytes per Unicode scalar plus a small boundary cushion guarantees enough decoded input for
+        // `chars` without allocating the entire file. readSync can short-read, so fill in a loop.
+        const byteLimit = Math.min(size, chars * 4 + 4);
+        const buffer = Buffer.allocUnsafe(byteLimit);
+        let read = 0;
+        while (read < byteLimit) {
+            const n = readSync(fd, buffer, read, byteLimit - read, read);
+            if (n === 0)
+                break;
+            read += n;
+        }
+        const bytes = buffer.subarray(0, read);
+        const binary = bytes.subarray(0, Math.min(bytes.length, 4096)).includes(0);
+        const decoded = binary ? "" : bytes.toString("utf8");
+        return {
+            text: decoded.slice(0, chars),
+            truncated: size > read || decoded.length > chars,
+            binary,
+        };
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+/** Render a line slice without retaining the entire file. Total line count is shown only when EOF is reached. */
+export async function streamFileSlice(path, offset = 1, limit = 300, options = {}) {
+    const start = Math.max(1, Math.floor(offset));
+    const want = Math.max(1, Math.floor(limit));
+    const requestedEnd = start + want - 1;
+    const lineCap = Math.max(1, Math.floor(options.lineCap ?? DEFAULT_LINE_CAP));
+    const maxScan = Math.max(lineCap, Math.floor(options.maxScanChars ?? DEFAULT_MAX_SCAN));
+    const rendered = [];
+    let lineNo = 1;
+    let linePrefix = "";
+    let lineChars = 0;
+    let lineEndsWithCr = false;
+    let sawData = false;
+    let endedWithNewline = false;
+    let scanned = 0;
+    let hasMore = false;
+    let scanLimited = false;
+    let stoppedEarly = false;
+    const append = (part) => {
+        if (!part.length)
+            return;
+        sawData = true;
+        endedWithNewline = false;
+        if (lineNo > requestedEnd) {
+            hasMore = true;
+            return;
+        }
+        if (lineNo >= start) {
+            lineChars += part.length;
+            if (linePrefix.length < lineCap)
+                linePrefix += part.slice(0, lineCap - linePrefix.length);
+            lineEndsWithCr = part.endsWith("\r");
+        }
+    };
+    const finishLine = (partial = false) => {
+        const current = lineNo;
+        if (current >= start && current <= requestedEnd) {
+            let chars = lineChars;
+            let prefix = linePrefix;
+            if (!partial && lineEndsWithCr) {
+                chars = Math.max(0, chars - 1);
+                if (prefix.endsWith("\r"))
+                    prefix = prefix.slice(0, -1);
+            }
+            const omitted = Math.max(0, chars - prefix.length);
+            const tail = partial
+                ? `…[line continues; scan stopped after ${scanned} chars]`
+                : omitted
+                    ? `…[+${omitted} chars]`
+                    : "";
+            rendered.push(`${String(current).padStart(6)}\t${prefix}${tail}`);
+        }
+        lineNo++;
+        linePrefix = "";
+        lineChars = 0;
+        lineEndsWithCr = false;
+        if (current > requestedEnd)
+            hasMore = true;
+    };
+    const stream = createReadStream(path, { encoding: "utf8", highWaterMark: 64 * 1024 });
+    try {
+        for await (const raw of stream) {
+            const chunk = String(raw);
+            if (chunk.length)
+                sawData = true;
+            if (scanned < 4096 && chunk.slice(0, 4096 - scanned).includes("\0"))
+                throw new BinaryFileError(path);
+            scanned += chunk.length;
+            let at = 0;
+            while (at < chunk.length) {
+                const newline = chunk.indexOf("\n", at);
+                if (newline < 0) {
+                    append(chunk.slice(at));
+                    break;
+                }
+                append(chunk.slice(at, newline));
+                finishLine();
+                endedWithNewline = true;
+                at = newline + 1;
+                if (hasMore)
+                    break;
+            }
+            if (hasMore) {
+                stoppedEarly = true;
+                break;
+            }
+            if (scanned >= maxScan) {
+                scanLimited = true;
+                stoppedEarly = true;
+                if (lineNo >= start && lineNo <= requestedEnd)
+                    finishLine(true);
+                break;
+            }
+        }
+    }
+    finally {
+        stream.destroy();
+    }
+    if (!stoppedEarly) {
+        // A trailing newline creates no phantom line, matching String#split + trailing-empty removal.
+        if (!endedWithNewline || !sawData)
+            finishLine();
+        const total = lineNo - 1;
+        if (start > total)
+            return `(file has ${total} lines — offset ${start} is past the end)`;
+        const end = start + rendered.length - 1;
+        const sliced = start > 1 || end < total;
+        const head = sliced ? `(lines ${start}–${end} of ${total}${end < total ? ` — continue with offset:${end + 1}` : ""})\n` : "";
+        return head + rendered.join("\n");
+    }
+    const end = start + Math.max(0, rendered.length - 1);
+    if (scanLimited) {
+        return `(large file scan stopped after ${scanned} chars — use grep or bash byte-range tools for a narrower target)\n${rendered.join("\n")}`;
+    }
+    return `(lines ${start}–${end}; more lines follow — continue with offset:${end + 1})\n${rendered.join("\n")}`;
+}

package/dist/fs-write.js

@@ -0,0 +1,105 @@
+// Crash-safe UTF-8 writes for coding tools. Content is staged beside the destination, fsynced, then
+// renamed into place so a killed process never leaves a half-written source file.
+import { dirname, join } from "node:path";
+import { link, lstat, mkdir, open, readFile, realpath, rename, stat, unlink } from "node:fs/promises";
+export class FileChangedError extends Error {
+    code = "HARA_FILE_CHANGED";
+    constructor(path) {
+        super(`File changed while the edit was being prepared: ${path}. Re-read it and retry the edit.`);
+        this.name = "FileChangedError";
+    }
+}
+let tempSequence = 0;
+async function writeTarget(path) {
+    try {
+        const info = await lstat(path);
+        // Replacing a symlink would silently break it. Stage beside the real target instead so edits retain
+        // the link (common in dotfile repos and generated workspace layouts).
+        if (info.isSymbolicLink())
+            return await realpath(path);
+    }
+    catch (error) {
+        if (error?.code !== "ENOENT")
+            throw error;
+    }
+    return path;
+}
+async function syncDirectory(path) {
+    // Directory fsync makes the rename durable across a power loss on POSIX. Some filesystems/platforms
+    // reject opening directories, so durability degrades gracefully after the file itself was synced.
+    try {
+        const handle = await open(path, "r");
+        try {
+            await handle.sync();
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    catch {
+        /* best effort */
+    }
+}
+/** Atomically replace/create a UTF-8 file, optionally refusing to overwrite a newer disk version. */
+export async function atomicWriteText(path, content, options = {}) {
+    const target = await writeTarget(path);
+    const dir = dirname(target);
+    await mkdir(dir, { recursive: true });
+    let mode = 0o666;
+    try {
+        mode = (await stat(target)).mode & 0o777;
+    }
+    catch (error) {
+        if (error?.code !== "ENOENT")
+            throw error;
+    }
+    // Keep the staging basename fixed-size: prefixing the destination's full basename would make a
+    // perfectly valid near-NAME_MAX file impossible to edit because the temporary name becomes longer.
+    const temp = join(dir, `.hara-${process.pid}-${Date.now().toString(36)}-${tempSequence++}.tmp`);
+    let staged = false;
+    try {
+        const handle = await open(temp, "wx", mode);
+        staged = true;
+        try {
+            await handle.writeFile(content, "utf8");
+            await handle.sync();
+        }
+        finally {
+            await handle.close();
+        }
+        if (options.expected === null) {
+            // link(2) is an atomic create-if-absent operation. A plain rename would overwrite a file that
+            // appeared after validation, defeating create's no-clobber contract.
+            try {
+                await link(temp, target);
+            }
+            catch (error) {
+                if (error?.code === "EEXIST")
+                    throw new FileChangedError(path);
+                throw error;
+            }
+            await unlink(temp);
+            staged = false;
+        }
+        else {
+            if (typeof options.expected === "string") {
+                let current;
+                try {
+                    current = await readFile(target, "utf8");
+                }
+                catch {
+                    throw new FileChangedError(path);
+                }
+                if (current !== options.expected)
+                    throw new FileChangedError(path);
+            }
+            await rename(temp, target);
+            staged = false;
+        }
+        await syncDirectory(dir);
+    }
+    finally {
+        if (staged)
+            await unlink(temp).catch(() => { });
+    }
+}

package/dist/index.js

@@ -2036,6 +2036,94 @@ program
         out(`\n(gh CLI unavailable or filing failed — copy everything below into ${NEW_ISSUE_URL})\n\n# ${issueTitle(desc)}\n\n${body}\n`);
     }
 });
+// `hara desk` — connect to a hara-desk coordination server (identity registry + task board).
+// The desk is the closed-source enterprise piece; this is the open-source client side.
+const deskCmd = program.command("desk").description("coordinate with a hara-desk server (register · post · board · claim · complete)");
+deskCmd
+    .command("register")
+    .description("register this agent with a desk and save credentials to ~/.hara/desk.json")
+    .requiredOption("--url <url>", "desk base URL (e.g. http://127.0.0.1:4200)")
+    .requiredOption("--key <enrollKey>", "the desk's enroll key")
+    .option("--name <name>", "agent name shown in the registry", "hara-cli")
+    .option("--owner <owner>", "the human this agent belongs to", "me")
+    .action(async (o) => {
+    const { registerAgent } = await import("./desk.js");
+    try {
+        const creds = await registerAgent(o.url, o.key, o.name, o.owner);
+        out(c.green("✓ registered ") + `${creds.agentId} (owner ${creds.owner}) → ${creds.url}\n`);
+    }
+    catch (e) {
+        out(c.red(`register failed: ${e.message}\n`));
+    }
+});
+deskCmd
+    .command("post [title...]")
+    .description("post a task or feedback report to the board")
+    .option("--dispatch", "a dispatch task (someone does work) instead of a feedback report")
+    .option("--high", "high-risk dispatch (needs an owner ack before it can complete)")
+    .option("--body <text>", "task body / details", "")
+    .action(async (parts, o) => {
+    const { loadCreds, deskCall } = await import("./desk.js");
+    const creds = loadCreds();
+    if (!creds)
+        return void out(c.red("not registered — run `hara desk register --url … --key …` first\n"));
+    const title = (parts ?? []).join(" ").trim();
+    if (!title)
+        return void out("Usage: hara desk post <title> [--dispatch] [--high] [--body …]\n");
+    try {
+        const r = await deskCall(creds.url, "POST", "/tasks", { token: creds.token, body: { kind: o.dispatch ? "dispatch" : "feedback", risk: o.high ? "high" : "low", title, body: o.body } });
+        out(c.green("✓ posted ") + `${r.task.id} (${r.task.kind}/${r.task.state})\n`);
+    }
+    catch (e) {
+        out(c.red(`post failed: ${e.message}\n`));
+    }
+});
+deskCmd
+    .command("board")
+    .description("list the board (default: open tasks)")
+    .option("--state <state>", "open | claimed | done | cancelled", "open")
+    .option("--kind <kind>", "feedback | dispatch")
+    .action(async (o) => {
+    const { loadCreds, deskCall } = await import("./desk.js");
+    const creds = loadCreds();
+    if (!creds)
+        return void out(c.red("not registered — run `hara desk register` first\n"));
+    try {
+        const q = `/tasks?state=${encodeURIComponent(o.state)}${o.kind ? `&kind=${encodeURIComponent(o.kind)}` : ""}`;
+        const r = await deskCall(creds.url, "GET", q, { token: creds.token });
+        if (!r.tasks.length)
+            return void out(c.dim("(board empty)\n"));
+        for (const t of r.tasks)
+            out(`${t.id}  ${c.bold(t.kind)}${t.risk === "high" ? c.red("!") : " "} ${t.state.padEnd(8)} ${t.title}\n`);
+    }
+    catch (e) {
+        out(c.red(`board failed: ${e.message}\n`));
+    }
+});
+for (const [verb, path, ok] of [
+    ["claim", "claim", "claimed"],
+    ["complete", "complete", "completed"],
+    ["ack", "ack", "acked"],
+    ["cancel", "cancel", "cancelled"],
+]) {
+    deskCmd
+        .command(`${verb} <taskId>`)
+        .description(`${verb} a task`)
+        .option("--detail <text>", "note (complete)", "")
+        .action(async (taskId, o) => {
+        const { loadCreds, deskCall } = await import("./desk.js");
+        const creds = loadCreds();
+        if (!creds)
+            return void out(c.red("not registered — run `hara desk register` first\n"));
+        try {
+            const r = await deskCall(creds.url, "POST", `/tasks/${taskId}/${path}`, { token: creds.token, body: verb === "complete" ? { detail: o.detail } : {} });
+            out(c.green(`✓ ${ok} `) + `${r.task?.id ?? taskId}${r.task ? ` (${r.task.state})` : ""}\n`);
+        }
+        catch (e) {
+            out(c.red(`${verb} failed: ${e.message}\n`));
+        }
+    });
+}
 const skillsCmd = program.command("skills").description("manage skills (.hara/skills/<name>/SKILL.md)");
 skillsCmd
     .command("init")

package/dist/tools/builtin.js

@@ -1,11 +1,14 @@
-import { readFile, writeFile, mkdir } from "node:fs/promises";
-import { dirname, resolve, isAbsolute } from "node:path";
+import { readFile, stat } from "node:fs/promises";
+import { resolve, isAbsolute } from "node:path";
 import { stdout as procOut } from "node:process";
 import { registerTool } from "./registry.js";
 import { runShell } from "../sandbox.js";
-import { nearestPaths } from "../fs-walk.js";
+import { isProbablyBinary, nearestPaths } from "../fs-walk.js";
 import { emitDiff } from "../diff.js";
 import { recordEdit } from "../undo.js";
+import { atomicWriteText } from "../fs-write.js";
+import { invalidateFileCandidates } from "../context/mentions.js";
+import { BinaryFileError, streamFileSlice } from "../fs-read.js";
 import { startJob, listJobs, tailJob, killJob } from "../exec/jobs.js";
 import { hostsInCommand, isNetworkGitOp, hostFromConnectError, isConnectFailure, markHostUnreachable, isHostUnreachable, unreachableHostsSnapshot, } from "./net-reachability.js";
 const MAX = 100_000;
@@ -43,8 +46,9 @@ export function capHeadTail(s, max = MAX) {
     const head = Math.floor(max * 0.6);
     return s.slice(0, head) + `\n…[${s.length - max} chars truncated]…\n` + s.slice(s.length - (max - head));
 }
-const READ_LINES = 2000; // default lines per read_file call (a long file is read in slices, not dumped whole)
+const READ_LINES = 300; // sized to stay useful under the global 24k-char tool-result context boundary
 const LINE_CAP = 2000; // chars per line before truncation (minified bundles / data lines)
+const BUFFERED_READ_BYTES = 4 * 1024 * 1024;
 /** Render a line slice of a file, cat -n style. The old read_file dumped the WHOLE file (100K-char cap,
  *  tail simply lost) — on long files that both flooded the context (~25k tokens per read, again on every
  *  re-read) and made everything past the cap unreachable. Now: line numbers (anchor for edits and for
@@ -71,22 +75,31 @@ export function renderFileSlice(text, offset, limit) {
 }
 registerTool({
     name: "read_file",
-    description: "Read a UTF-8 text file; returns cat -n style numbered lines. Reads up to 2000 lines by default — for a longer file pass offset/limit to read the next slice (the output header tells you the total and where to continue). Prefer grep to locate, then read just that region.",
+    description: "Read a UTF-8 text file; returns cat -n style numbered lines. Reads up to 300 lines by default — for a longer file pass offset/limit to read the next slice (the header tells you where to continue). Large files are streamed instead of loaded whole. Prefer grep to locate, then read just that region.",
     input_schema: {
         type: "object",
         properties: {
             path: { type: "string", description: "File path, relative to cwd or absolute" },
             offset: { type: "number", description: "1-based line number to start from (for long files)" },
-            limit: { type: "number", description: "max lines to return (default 2000)" },
+            limit: { type: "number", description: "max lines to return (default 300)" },
         },
         required: ["path"],
     },
     kind: "read",
     async run(input, ctx) {
+        const p = abs(input.path, ctx.cwd);
         try {
-            return cap(renderFileSlice(await readFile(abs(input.path, ctx.cwd), "utf8"), input.offset, input.limit));
+            const info = await stat(p);
+            if (info.size > BUFFERED_READ_BYTES)
+                return cap(await streamFileSlice(p, input.offset, input.limit ?? READ_LINES, { lineCap: LINE_CAP }));
+            const buf = await readFile(p);
+            if (isProbablyBinary(buf))
+                throw new BinaryFileError(p);
+            return cap(renderFileSlice(buf.toString("utf8"), input.offset, input.limit));
         }
         catch (e) {
+            if (e instanceof BinaryFileError)
+                return `Error: cannot read ${input.path}: file appears binary; use an image/media-specific tool or inspect it with \`file\`.`;
             const near = nearestPaths(ctx.cwd, input.path);
             return `Error: cannot read ${input.path}: ${e.code ?? e.message}.` + (near.length ? ` Did you mean: ${near.join(", ")}?` : "");
         }
@@ -106,17 +119,27 @@ registerTool({
     kind: "edit",
     async run(input, ctx) {
         const p = abs(input.path, ctx.cwd);
+        if (typeof input.content !== "string")
+            return "Error: write_file `content` must be a string. No changes written.";
         let prev = null;
         try {
             prev = await readFile(p, "utf8");
         }
-        catch {
-            /* new file */
+        catch (error) {
+            if (error?.code !== "ENOENT")
+                return `Error: cannot inspect ${input.path}: ${error?.code ?? error?.message}. No changes written.`;
+        }
+        if (prev === input.content)
+            return `Unchanged ${p} (${input.content.length} chars already match).`;
+        try {
+            await atomicWriteText(p, input.content, { expected: prev });
+        }
+        catch (error) {
+            return `Error: cannot write ${input.path}: ${error?.message ?? String(error)} No changes written.`;
         }
-        await mkdir(dirname(p), { recursive: true });
-        await writeFile(p, input.content, "utf8");
         emitDiff(input.path, prev ?? "", input.content, ctx.ui);
         recordEdit([{ path: input.path, absPath: p, before: prev }]);
+        invalidateFileCandidates(ctx.cwd);
         return `Wrote ${String(input.content).length} chars to ${p}`;
     },
 });

package/dist/tools/edit.js

@@ -1,10 +1,12 @@
-import { readFile, writeFile } from "node:fs/promises";
+import { readFile } from "node:fs/promises";
 import { isAbsolute, resolve } from "node:path";
 import { registerTool } from "./registry.js";
 import { nearestPaths } from "../fs-walk.js";
 import { emitDiff } from "../diff.js";
 import { applyEdits } from "./apply-core.js";
 import { recordEdit } from "../undo.js";
+import { atomicWriteText } from "../fs-write.js";
+import { invalidateFileCandidates } from "../context/mentions.js";
 registerTool({
     name: "edit_file",
     description: "Edit an existing file by replacing exact strings. Provide a single `old_string`/`new_string`, " +
@@ -53,9 +55,15 @@ registerTool({
         const res = applyEdits(text, edits);
         if ("error" in res)
             return `Error: ${res.error} in ${input.path}. No changes written.`;
-        await writeFile(p, res.text, "utf8");
+        try {
+            await atomicWriteText(p, res.text, { expected: text });
+        }
+        catch (error) {
+            return `Error: cannot edit ${input.path}: ${error?.message ?? String(error)} No changes written.`;
+        }
         emitDiff(input.path, text, res.text, ctx.ui);
         recordEdit([{ path: input.path, absPath: p, before: text }]);
+        invalidateFileCandidates(ctx.cwd);
         const note = res.fuzzy ? " (quote-normalized)" : "";
         const plural = (n, w) => `${n} ${w}${n === 1 ? "" : "s"}`;
         return `Edited ${input.path}: ${plural(edits.length, "edit")}, ${plural(res.total, "replacement")}${note}.`;

package/dist/tools/patch.js

@@ -1,11 +1,13 @@
 // apply_patch — change MULTIPLE files atomically (all-or-nothing). Everything is validated and
 // computed in memory first; nothing is written unless every change applies cleanly.
-import { readFile, writeFile, mkdir, unlink } from "node:fs/promises";
-import { isAbsolute, resolve, dirname } from "node:path";
+import { lstat, readFile, unlink } from "node:fs/promises";
+import { isAbsolute, resolve } from "node:path";
 import { registerTool } from "./registry.js";
 import { applyEdits } from "./apply-core.js";
 import { emitDiff } from "../diff.js";
 import { recordEdit } from "../undo.js";
+import { atomicWriteText, FileChangedError } from "../fs-write.js";
+import { invalidateFileCandidates } from "../context/mentions.js";
 registerTool({
     name: "apply_patch",
     description: "Change SEVERAL files in one atomic step (all-or-nothing). `changes` is an array of " +
@@ -51,13 +53,29 @@ registerTool({
         const abs = (pth) => (isAbsolute(pth) ? pth : resolve(ctx.cwd, pth));
         // PHASE 1 — validate + compute every change in memory; bail before writing anything.
         const plans = [];
+        const plannedPaths = new Set();
         for (let i = 0; i < changes.length; i++) {
             const ch = changes[i];
             const tag = `change ${i + 1}/${changes.length}`;
             if (typeof ch.path !== "string" || !ch.path)
                 return `Error: ${tag} is missing a path. Nothing written.`;
             const p = abs(ch.path);
-            const type = ch.type ?? (ch.edits ? "update" : "create");
+            if (plannedPaths.has(p))
+                return `Error: ${tag} repeats path ${ch.path}. Combine edits for one file into a single change. Nothing written.`;
+            plannedPaths.add(p);
+            let type = ch.type ?? (ch.edits ? "update" : "create");
+            // Backward-compatible shorthand: {path, content} updates an existing file and creates a missing
+            // one. An EXPLICIT type:create is stricter and never clobbers an existing path.
+            if (!ch.type && !ch.edits) {
+                try {
+                    await lstat(p);
+                    type = "update";
+                }
+                catch (error) {
+                    if (error?.code !== "ENOENT")
+                        return `Error: ${tag} cannot inspect ${ch.path}: ${error?.message ?? String(error)}. Nothing written.`;
+                }
+            }
             if (type === "delete") {
                 let before;
                 try {
@@ -71,16 +89,15 @@ registerTool({
             else if (type === "create") {
                 if (typeof ch.content !== "string")
                     return `Error: ${tag} create ${ch.path} needs \`content\`. Nothing written.`;
-                let before = "";
-                let existed = false;
                 try {
-                    before = await readFile(p, "utf8");
-                    existed = true;
+                    await lstat(p);
+                    return `Error: ${tag} create ${ch.path}: path already exists (use type:update to replace it). Nothing written.`;
                 }
-                catch {
-                    /* new file */
+                catch (error) {
+                    if (error?.code !== "ENOENT")
+                        return `Error: ${tag} create ${ch.path}: ${error?.message ?? String(error)}. Nothing written.`;
                 }
-                plans.push({ path: ch.path, abs: p, type, before, after: ch.content, existed });
+                plans.push({ path: ch.path, abs: p, type, before: "", after: ch.content, existed: false });
             }
             else {
                 // update
@@ -108,27 +125,39 @@ registerTool({
         try {
             for (const pl of plans) {
                 if (pl.type === "delete") {
+                    let current;
+                    try {
+                        current = await readFile(pl.abs, "utf8");
+                    }
+                    catch {
+                        throw new FileChangedError(pl.path);
+                    }
+                    if (current !== pl.before)
+                        throw new FileChangedError(pl.path);
                     await unlink(pl.abs);
                 }
                 else {
-                    await mkdir(dirname(pl.abs), { recursive: true });
-                    await writeFile(pl.abs, pl.after, "utf8");
+                    await atomicWriteText(pl.abs, pl.after, { expected: pl.existed ? pl.before : null });
                 }
                 applied.push(pl);
             }
         }
         catch (e) {
+            const rollbackFailures = [];
             for (const pl of applied.reverse()) {
                 try {
                     if (pl.type === "create" && !pl.existed)
                         await unlink(pl.abs); // remove a file we created
                     else
-                        await writeFile(pl.abs, pl.before, "utf8"); // restore an updated/deleted file's prior content
+                        await atomicWriteText(pl.abs, pl.before); // restore an updated/deleted file's prior content
                 }
-                catch {
-                    /* best-effort rollback */
+                catch (rollbackError) {
+                    rollbackFailures.push(`${pl.path}: ${rollbackError?.message ?? String(rollbackError)}`);
                 }
             }
+            if (rollbackFailures.length) {
+                return `Error: apply_patch failed (${e instanceof Error ? e.message : String(e)}); rollback was INCOMPLETE: ${rollbackFailures.join("; ")}. Inspect these files before continuing.`;
+            }
             return `Error: apply_patch failed writing a file (${e instanceof Error ? e.message : String(e)}) — rolled back, nothing left changed.`;
         }
         // All writes succeeded → now show diffs + record the undo snapshot.
@@ -137,6 +166,7 @@ registerTool({
             return pl.type === "delete" ? `deleted ${pl.path}` : `${pl.type === "create" ? "created" : "updated"} ${pl.path}`;
         });
         recordEdit(plans.map((pl) => ({ path: pl.path, absPath: pl.abs, before: pl.existed ? pl.before : null })));
+        invalidateFileCandidates(ctx.cwd);
         return `apply_patch: ${plans.length} file(s) — ${summary.join("; ")}.`;
     },
 });

package/dist/tools/registry.js

@@ -1,3 +1,4 @@
+import { limitToolResult } from "./result-limit.js";
 /** Names of required parameters that are ABSENT (undefined/null) in a tool call's input. Defends
  *  against models that drop parameters outright (observed: qwen3.7-plus losing write_file's
  *  path/content mid-stream) — the loop rejects the call with a precise error instead of executing
@@ -9,8 +10,16 @@ export function missingRequired(tool, input) {
     return req.filter((k) => obj[k] === undefined || obj[k] === null);
 }
 const registry = new Map();
+let specsCache = null;
 export function registerTool(t) {
-    registry.set(t.name, t);
+    const run = t.run;
+    registry.set(t.name, {
+        ...t,
+        // Apply the context boundary at registration so every caller (main loop, tests, embedders) gets
+        // identical behavior instead of relying on one orchestration path to remember the cap.
+        run: async (input, ctx) => limitToolResult(await run(input, ctx)),
+    });
+    specsCache = null;
 }
 export function getTool(name) {
     return registry.get(name);
@@ -20,9 +29,14 @@ export function getTools() {
 }
 /** Provider-neutral tool specs derived from the registry. */
 export function toolSpecs() {
-    return getTools().map((t) => ({
-        name: t.name,
-        description: t.description,
-        input_schema: t.input_schema,
-    }));
+    if (!specsCache) {
+        specsCache = getTools().map((t) => ({
+            name: t.name,
+            description: t.description,
+            input_schema: t.input_schema,
+        }));
+    }
+    // Callers commonly filter the array for a role. Return a shallow copy so that never mutates the
+    // stable cached snapshot shared by subsequent agent rounds.
+    return specsCache.slice();
 }

package/dist/tools/result-limit.js

@@ -0,0 +1,37 @@
+// One invariant for every registered tool: no single result may monopolize the model context. Individual
+// tools can use tighter domain-specific limits, but this final boundary also covers plugins/new tools.
+export const MAX_TOOL_RESULT_CHARS = 24_000;
+function safeHead(value, end) {
+    let at = Math.max(0, Math.min(value.length, end));
+    if (at > 0 && /[\uD800-\uDBFF]/.test(value[at - 1] ?? ""))
+        at--;
+    return value.slice(0, at);
+}
+function safeTail(value, start) {
+    let at = Math.max(0, Math.min(value.length, start));
+    if (at < value.length && /[\uDC00-\uDFFF]/.test(value[at] ?? ""))
+        at++;
+    return value.slice(at);
+}
+/** Keep actionable beginnings and endings while bounding the exact string persisted in history. */
+export function limitToolResult(value, max = MAX_TOOL_RESULT_CHARS) {
+    const text = typeof value === "string" ? value : String(value ?? "");
+    const cap = Math.max(0, Math.floor(max));
+    if (text.length <= cap)
+        return text;
+    if (cap === 0)
+        return "";
+    let omitted = text.length - cap;
+    let fullMarker = "";
+    // The marker consumes part of the budget too. Iterate twice so its count reflects the actual payload
+    // removed rather than understating it by roughly the marker's own length.
+    for (let i = 0; i < 2; i++) {
+        fullMarker = `\n…[hara: ${omitted} chars omitted; narrow the query or continue read_file with offset/limit]…\n`;
+        omitted = text.length - Math.max(0, cap - fullMarker.length);
+    }
+    const marker = fullMarker.length < cap ? fullMarker : "…[truncated]…".slice(0, cap);
+    const room = cap - marker.length;
+    const headChars = Math.floor(room * 0.6);
+    const tailChars = room - headChars;
+    return safeHead(text, headChars) + marker + safeTail(text, text.length - tailChars);
+}

package/dist/tui/App.js

@@ -516,7 +516,7 @@ export function App({ initialStatus, model, cwd, header, onSubmit, cycleApproval
         const askTextFn = (title) => new Promise((resolve) => setAskText({ title, resolve }));
         // ask_user: when options are given, offer them as a select + a "type my own" escape hatch; otherwise (or
         // when the user chooses to type their own) capture a free-text line. Returns the chosen/typed answer.
-        const OTHER = "__ask_other__"; // sentinel value for the "type my own" option
+        const OTHER = "\\0__ask_other__"; // escaped sentinel keeps this TypeScript file text-only
         const askFn = async (question, options) => {
             if (options && options.length) {
                 const choice = await openPrompt(question, [

package/dist/tui/InputBox.js

@@ -14,10 +14,11 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 //      of leaning on ink's soft-wrap of a single <Text>, which mis-aligns wrapped rows against the
 //      "› " prompt gutter and reflows unpredictably as you type.
 import { Box, Text, useInput, useStdout } from "ink";
-import { memo, useMemo, useState } from "react";
+import { memo, useMemo, useRef, useState } from "react";
 import { fileCandidates } from "../context/mentions.js";
 import { imagePathFromPaste } from "../images.js";
 import { vimNormal } from "./vim.js";
+import { ComposerHistory, moveCursorLine, nextGraphemeIndex, previousGraphemeIndex, previousWordIndex, } from "./input-history.js";
 export const MODES = ["suggest", "auto-edit", "full-auto", "plan"];
 export const nextMode = (m) => MODES[(MODES.indexOf(m) + 1) % MODES.length];
 const tok = (n) => (n >= 1000 ? `${(n / 1000).toFixed(1)}k` : `${n}`);
@@ -312,15 +313,30 @@ export function InputBox({ status, cwd, model, route, width, onSubmit, onClipboa
     const [mode, setMode] = useState("insert"); // vim only
     const [pending, setPending] = useState(""); // vim operator-pending (d/c/g)
     const [register, setRegister] = useState(""); // vim yank/delete register
+    const historyRef = useRef(null);
+    if (!historyRef.current)
+        historyRef.current = new ComposerHistory();
+    const inputHistory = historyRef.current;
     const set = (v, c) => {
+        inputHistory.abandonNavigation();
         setValue(v);
         setCursor(c);
         setSel(0);
         setDismissed(false);
     };
+    const snapshot = () => ({ value, attachments: images, pastes });
+    const restore = (draft) => {
+        setValue(draft.value);
+        setCursor(draft.value.length);
+        setImages(draft.attachments);
+        setPastes(draft.pastes);
+        setSel(0);
+        setDismissed(false);
+    };
     // Attach an image: drop a highlighted `[Image #N]` token inline at the cursor and track the file
     // (codex / Claude-Code style). Backspace over the token removes both.
     const addImage = (img) => {
+        inputHistory.abandonNavigation();
         const tok = `[Image #${images.length + 1}]`;
         const before = value.slice(0, cursor);
         const ins = (before && !/\s$/.test(before) ? " " : "") + tok + " ";
@@ -334,6 +350,7 @@ export function InputBox({ status, cwd, model, route, width, onSubmit, onClipboa
     // the box: typing stays smooth (the VALUE stays short), the box stays small, and a multi-line paste
     // can no longer fire the newline-submit path mid-paste. Expanded back to the full text on submit.
     const addPaste = (text) => {
+        inputHistory.abandonNavigation();
         const lines = text.split("\n").length;
         const tok = `[Paste #${pastes.length + 1} +${lines} lines]`;
         const before = value.slice(0, cursor);
@@ -348,6 +365,7 @@ export function InputBox({ status, cwd, model, route, width, onSubmit, onClipboa
     const submit = (text) => {
         if (!text.trim() && images.length === 0)
             return; // nothing to send
+        inputHistory.record(snapshot());
         onSubmit?.(expandPastes(text), images.length ? images : undefined);
         set("", 0);
         setImages([]);
@@ -365,6 +383,7 @@ export function InputBox({ status, cwd, model, route, width, onSubmit, onClipboa
     const complete = (cand) => {
         if (!mention)
             return;
+        inputHistory.abandonNavigation();
         const before = value.slice(0, mention.start); // includes the leading '@'
         const after = value.slice(cursor);
         const insert = cand.endsWith("/") ? cand : cand + " "; // dirs keep drilling; files end the mention
@@ -406,6 +425,8 @@ export function InputBox({ status, cwd, model, route, width, onSubmit, onClipboa
                 return setCursor((c) => Math.max(0, c - 1));
             if (input && !key.ctrl && !key.meta) {
                 const st = vimNormal({ value, cursor, mode, pending, register }, input);
+                if (st.value !== value)
+                    inputHistory.abandonNavigation();
                 setValue(st.value);
                 setCursor(st.cursor);
                 setMode(st.mode);
@@ -416,20 +437,54 @@ export function InputBox({ status, cwd, model, route, width, onSubmit, onClipboa
             }
             return;
         }
+        if (key.upArrow) {
+            const onFirstLine = cursor === 0 || value.lastIndexOf("\n", cursor - 1) < 0;
+            if (onFirstLine) {
+                const draft = inputHistory.older(snapshot());
+                if (draft)
+                    restore(draft);
+            }
+            else {
+                setCursor(moveCursorLine(value, cursor, -1));
+            }
+            return;
+        }
+        if (key.downArrow) {
+            const onLastLine = value.indexOf("\n", cursor) < 0;
+            if (onLastLine) {
+                const draft = inputHistory.newer();
+                if (draft)
+                    restore(draft);
+            }
+            else {
+                setCursor(moveCursorLine(value, cursor, 1));
+            }
+            return;
+        }
         if (key.return) {
+            if (key.shift || key.meta) {
+                set(value.slice(0, cursor) + "\n" + value.slice(cursor), cursor + 1);
+                return;
+            }
             submit(value);
             return;
         }
         if (key.leftArrow)
-            return setCursor((c) => Math.max(0, c - 1));
+            return setCursor((c) => previousGraphemeIndex(value, c));
         if (key.rightArrow)
-            return setCursor((c) => Math.min(value.length, c + 1));
+            return setCursor((c) => nextGraphemeIndex(value, c));
         if (key.ctrl && input === "a")
             return setCursor(0);
         if (key.ctrl && input === "e")
             return setCursor(value.length);
         if (key.ctrl && input === "u")
             return set(value.slice(cursor), 0);
+        if (key.ctrl && input === "w") {
+            const start = previousWordIndex(value, cursor);
+            return set(value.slice(0, start) + value.slice(cursor), start);
+        }
+        if (key.ctrl && input === "k")
+            return set(value.slice(0, cursor), cursor);
         if (key.ctrl && input === "v") {
             // paste a screenshot / image from the OS clipboard
             const img = onClipboardImage?.();
@@ -442,6 +497,7 @@ export function InputBox({ status, cwd, model, route, width, onSubmit, onClipboa
                 const head = value.slice(0, cursor);
                 const pm = /\[Paste #(\d+) \+\d+ lines\]\s?$/.exec(head); // paste token deletes whole + renumbers
                 if (pm) {
+                    inputHistory.abandonNavigation();
                     const n = Number(pm[1]);
                     const kept = head.slice(0, pm.index) + value.slice(cursor);
                     const renumbered = kept.replace(/\[Paste #(\d+)( \+\d+ lines\])/g, (m2, d, tail) => (Number(d) > n ? `[Paste #${Number(d) - 1}${tail}` : m2));
@@ -454,6 +510,7 @@ export function InputBox({ status, cwd, model, route, width, onSubmit, onClipboa
                 }
                 const tm = /\[Image #(\d+)\]\s?$/.exec(head); // backspacing over an attachment token removes it whole
                 if (tm) {
+                    inputHistory.abandonNavigation();
                     const n = Number(tm[1]);
                     const kept = head.slice(0, tm.index) + value.slice(cursor);
                     const renumbered = kept.replace(/\[Image #(\d+)\]/g, (m2, d) => (Number(d) > n ? `[Image #${Number(d) - 1}]` : m2));
@@ -464,7 +521,8 @@ export function InputBox({ status, cwd, model, route, width, onSubmit, onClipboa
                     setDismissed(false);
                     return;
                 }
-                set(value.slice(0, cursor - 1) + value.slice(cursor), cursor - 1);
+                const previous = previousGraphemeIndex(value, cursor);
+                set(value.slice(0, previous) + value.slice(cursor), previous);
             }
             return;
         }

package/dist/tui/input-history.js

@@ -0,0 +1,167 @@
+// Pure composer state: bounded shell-style history plus Unicode-safe cursor helpers. Keeping this out
+// of the Ink component makes navigation deterministic and avoids copying a growing history on each key.
+const cloneDraft = (draft) => ({
+    value: draft.value,
+    attachments: [...draft.attachments],
+    pastes: [...draft.pastes],
+});
+const draftChars = (draft) => draft.value.length + draft.pastes.reduce((sum, paste) => sum + paste.length, 0) + draft.attachments.length * 128;
+/** Bounded in-process history. The draft that existed before Up is restored after navigating Down. */
+export class ComposerHistory {
+    maxEntries;
+    maxChars;
+    entries = [];
+    cursor = null;
+    scratch = null;
+    totalChars = 0;
+    constructor(maxEntries = 100, maxChars = 2_000_000) {
+        this.maxEntries = maxEntries;
+        this.maxChars = maxChars;
+    }
+    get browsing() {
+        return this.cursor !== null;
+    }
+    get length() {
+        return this.entries.length;
+    }
+    record(draft) {
+        this.abandonNavigation();
+        const chars = draftChars(draft);
+        // A giant paste is already retained by the conversation history. Do not duplicate an entry larger
+        // than the entire composer-history budget just to support Up-arrow recall.
+        if (chars > this.maxChars || this.maxEntries <= 0)
+            return;
+        this.entries.push({ draft: cloneDraft(draft), chars });
+        this.totalChars += chars;
+        while (this.entries.length > this.maxEntries || this.totalChars > this.maxChars) {
+            this.totalChars -= this.entries.shift().chars;
+        }
+    }
+    older(current) {
+        if (!this.entries.length)
+            return null;
+        if (this.cursor === null) {
+            this.scratch = cloneDraft(current);
+            this.cursor = this.entries.length - 1;
+        }
+        else if (this.cursor > 0) {
+            this.cursor--;
+        }
+        return cloneDraft(this.entries[this.cursor].draft);
+    }
+    newer() {
+        if (this.cursor === null)
+            return null;
+        if (this.cursor < this.entries.length - 1) {
+            this.cursor++;
+            return cloneDraft(this.entries[this.cursor].draft);
+        }
+        const draft = this.scratch ?? { value: "", attachments: [], pastes: [] };
+        this.cursor = null;
+        this.scratch = null;
+        return cloneDraft(draft);
+    }
+    abandonNavigation() {
+        this.cursor = null;
+        this.scratch = null;
+    }
+}
+let segmenter;
+function graphemeSegmenter() {
+    // Constructing Intl.Segmenter loads ICU data. Defer that cost until the first actual cursor edit so
+    // lightweight commands such as `hara --version` do not pay for TUI Unicode support.
+    if (segmenter === undefined)
+        segmenter = typeof Intl.Segmenter === "function" ? new Intl.Segmenter(undefined, { granularity: "grapheme" }) : null;
+    return segmenter;
+}
+/** Previous user-perceived character boundary (keeps emoji ZWJ sequences/combining marks intact). */
+export function previousGraphemeIndex(value, cursor) {
+    const at = Math.max(0, Math.min(value.length, cursor));
+    if (at === 0)
+        return 0;
+    const segments = graphemeSegmenter();
+    if (!segments) {
+        const low = value.charCodeAt(at - 1);
+        const paired = low >= 0xdc00 && low <= 0xdfff && at > 1 && value.charCodeAt(at - 2) >= 0xd800 && value.charCodeAt(at - 2) <= 0xdbff;
+        return Math.max(0, at - (paired ? 2 : 1));
+    }
+    let previous = 0;
+    for (const part of segments.segment(value)) {
+        if (part.index >= at)
+            break;
+        previous = part.index;
+    }
+    return previous;
+}
+/** Next user-perceived character boundary. */
+export function nextGraphemeIndex(value, cursor) {
+    const at = Math.max(0, Math.min(value.length, cursor));
+    if (at >= value.length)
+        return value.length;
+    const segments = graphemeSegmenter();
+    if (!segments) {
+        const cp = value.codePointAt(at);
+        return Math.min(value.length, at + (cp !== undefined && cp > 0xffff ? 2 : 1));
+    }
+    for (const part of segments.segment(value)) {
+        const end = part.index + part.segment.length;
+        if (end > at)
+            return end;
+    }
+    return value.length;
+}
+/** Start of the previous shell-style word, used by Ctrl+W. */
+export function previousWordIndex(value, cursor) {
+    let at = Math.max(0, Math.min(value.length, cursor));
+    while (at > 0) {
+        const previous = previousGraphemeIndex(value, at);
+        if (!/\s/u.test(value.slice(previous, at)))
+            break;
+        at = previous;
+    }
+    while (at > 0) {
+        const previous = previousGraphemeIndex(value, at);
+        if (/\s/u.test(value.slice(previous, at)))
+            break;
+        at = previous;
+    }
+    return at;
+}
+function graphemeFloor(value, cursor) {
+    const at = Math.max(0, Math.min(value.length, cursor));
+    if (at === value.length)
+        return at;
+    const segments = graphemeSegmenter();
+    if (!segments)
+        return at > 0 && /[\uDC00-\uDFFF]/.test(value[at]) ? at - 1 : at;
+    let floor = 0;
+    for (const part of segments.segment(value)) {
+        if (part.index > at)
+            break;
+        floor = part.index;
+        if (part.index + part.segment.length === at)
+            return at;
+    }
+    return floor;
+}
+/** Move between logical pasted/typed lines while retaining the closest possible column. */
+export function moveCursorLine(value, cursor, direction) {
+    const at = Math.max(0, Math.min(value.length, cursor));
+    const lineStart = (at === 0 ? -1 : value.lastIndexOf("\n", at - 1)) + 1;
+    const lineEndAt = value.indexOf("\n", at);
+    const lineEnd = lineEndAt < 0 ? value.length : lineEndAt;
+    const column = Math.min(at - lineStart, lineEnd - lineStart);
+    if (direction < 0) {
+        if (lineStart === 0)
+            return at;
+        const previousEnd = lineStart - 1;
+        const previousStart = value.lastIndexOf("\n", Math.max(0, previousEnd - 1)) + 1;
+        return graphemeFloor(value, previousStart + Math.min(column, previousEnd - previousStart));
+    }
+    if (lineEnd === value.length)
+        return at;
+    const nextStart = lineEnd + 1;
+    const nextEndAt = value.indexOf("\n", nextStart);
+    const nextEnd = nextEndAt < 0 ? value.length : nextEndAt;
+    return graphemeFloor(value, nextStart + Math.min(column, nextEnd - nextStart));
+}

package/dist/undo.js

@@ -1,7 +1,8 @@
 // In-session undo stack for file changes. Each edit tool records the prior state of the files it
 // touched; `/undo` pops the last group and restores it. Process-scoped (one REPL session).
-import { writeFile, unlink, mkdir } from "node:fs/promises";
-import { dirname } from "node:path";
+import { unlink } from "node:fs/promises";
+import { atomicWriteText } from "./fs-write.js";
+import { invalidateFileCandidates } from "./context/mentions.js";
 const stack = [];
 const MAX = 50;
 /** Record a group of file changes (one tool call = one undo step). */
@@ -27,8 +28,7 @@ export async function undoLast() {
                 await unlink(s.absPath).catch(() => { }); // was newly created → remove
             }
             else {
-                await mkdir(dirname(s.absPath), { recursive: true });
-                await writeFile(s.absPath, s.before, "utf8");
+                await atomicWriteText(s.absPath, s.before);
             }
             files.push(s.path);
         }
@@ -36,5 +36,7 @@ export async function undoLast() {
             /* skip a file we can't restore */
         }
     }
+    if (files.length)
+        invalidateFileCandidates();
     return { files };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanhara/hara",
-  "version": "0.120.0",
+  "version": "0.121.0",
   "description": "hara — a coding agent CLI that runs like an engineering org.",
   "bin": {
     "hara": "dist/index.js"
@@ -70,5 +70,10 @@
   "optionalDependencies": {
     "@zvec/zvec": "^0.5.0",
     "qrcode-terminal": "^0.12.0"
+  },
+  "overrides": {
+    "@larksuiteoapi/node-sdk": {
+      "axios": "1.18.1"
+    }
   }
 }