@nanhara/hara 0.121.1 → 0.122.1

package/dist/mcp/client.js

@@ -2,21 +2,158 @@
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
 import { registerTool } from "../tools/registry.js";
+import { redactToolSubprocessOutput, toolSubprocessEnv } from "../security/subprocess-env.js";
+import { sensitiveStructuredInputReason } from "../security/sensitive-files.js";
 const clients = [];
+const DEFAULT_STARTUP_TIMEOUT_MS = 10_000;
+const MIN_STARTUP_TIMEOUT_MS = 50;
+const MAX_STARTUP_TIMEOUT_MS = 60_000;
+const safeDiagnosticName = (name) => name.replace(/[\u0000-\u001f\u007f]/g, "").slice(0, 128) || "server";
+function startupTimeout(value) {
+    if (value === undefined || !Number.isFinite(value))
+        return DEFAULT_STARTUP_TIMEOUT_MS;
+    return Math.max(MIN_STARTUP_TIMEOUT_MS, Math.min(MAX_STARTUP_TIMEOUT_MS, Math.floor(value)));
+}
+async function closeFailedMcp(client, transport) {
+    try {
+        if (client)
+            await client.close();
+        else if (transport)
+            await transport.close();
+    }
+    catch {
+        // Client.close normally owns the transport. If it failed part-way through, make one direct best-effort
+        // attempt so an unresponsive startup cannot leave its child process running in the background.
+        try {
+            await transport?.close();
+        }
+        catch { /* preserve the original connect/list error */ }
+    }
+}
+/** Drain MCP stderr without letting a server leak split credentials, inject terminal control bytes, or grow
+ * an unbounded no-newline buffer. Oversized lines are dropped whole so even a partial token is never emitted. */
+function mcpStderrRedactor(name, explicitEnv, log) {
+    const lineLimit = 16 * 1024;
+    const totalLimit = 64 * 1024;
+    const safeName = safeDiagnosticName(name);
+    let pending = "";
+    let droppingLine = false;
+    let emitted = 0;
+    let silenced = false;
+    const emitOmitted = () => {
+        if (silenced)
+            return;
+        const message = `mcp: ${safeName} stderr: [oversized diagnostic line omitted]`;
+        if (emitted + message.length > totalLimit) {
+            log(`mcp: ${safeName} stderr: [further diagnostics omitted]`);
+            silenced = true;
+            return;
+        }
+        emitted += message.length;
+        log(message);
+    };
+    const emit = (raw) => {
+        if (silenced)
+            return;
+        const clean = redactToolSubprocessOutput(raw, process.env, explicitEnv ?? {})
+            .replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g, "")
+            .replace(/\r?\n$/, "");
+        if (!clean)
+            return;
+        const message = `mcp: ${safeName} stderr: ${clean}`;
+        if (emitted + message.length > totalLimit) {
+            log(`mcp: ${safeName} stderr: [further diagnostics omitted]`);
+            silenced = true;
+            return;
+        }
+        emitted += message.length;
+        log(message);
+    };
+    return {
+        push(chunk) {
+            if (silenced || !chunk)
+                return;
+            let start = 0;
+            while (start < chunk.length && !silenced) {
+                const newline = chunk.indexOf("\n", start);
+                const end = newline < 0 ? chunk.length : newline + 1;
+                const length = end - start;
+                if (droppingLine) {
+                    if (newline >= 0) {
+                        droppingLine = false;
+                        emitOmitted();
+                    }
+                }
+                else if (pending.length + length > lineLimit) {
+                    pending = "";
+                    if (newline >= 0)
+                        emitOmitted();
+                    else
+                        droppingLine = true;
+                }
+                else {
+                    pending += chunk.slice(start, end);
+                    if (newline >= 0) {
+                        emit(pending);
+                        pending = "";
+                    }
+                }
+                start = end;
+            }
+        },
+        flush() {
+            if (droppingLine)
+                emitOmitted();
+            else if (pending)
+                emit(pending);
+            pending = "";
+            droppingLine = false;
+        },
+    };
+}
 /** Connect each server, register its tools as `mcp__<server>__<tool>`. Returns #tools registered. */
-export async function connectMcpServers(servers, log) {
+export async function connectMcpServers(servers, log, options = {}) {
+    // Starting a configured MCP server already executes arbitrary external code, before any MCP tool call
+    // reaches the agent approval loop. Keep that side effect behind its own explicit startup grant even when
+    // a future caller forgets to apply the CLI-level policy.
+    if (!options.approved && process.env.HARA_ALLOW_TRUSTED_EXTENSIONS !== "1") {
+        if (Object.keys(servers).length) {
+            log("mcp: skipped — configured servers are trusted extensions outside Hara's file boundary; " +
+                "approve them interactively or set HARA_ALLOW_TRUSTED_EXTENSIONS=1 before launch after review");
+        }
+        return 0;
+    }
+    const timeoutMs = startupTimeout(options.timeoutMs);
+    const requestOptions = { timeout: timeoutMs, maxTotalTimeout: timeoutMs };
     let count = 0;
     for (const [name, cfg] of Object.entries(servers)) {
+        const diagnosticName = safeDiagnosticName(name);
+        let flushStderr;
+        let transport;
+        let client;
+        let stage = "connect";
         try {
-            const transport = new StdioClientTransport({
+            transport = new StdioClientTransport({
                 command: cfg.command,
                 args: cfg.args ?? [],
-                env: { ...process.env, ...(cfg.env ?? {}) },
+                // The inherited agent environment is scrubbed; server-specific cfg.env is an explicit grant.
+                env: toolSubprocessEnv(process.env, cfg.env ?? {}),
+                // The SDK default is "inherit", which would let an external server print credentials or terminal
+                // control sequences straight to Hara's stderr. Pipe it so every diagnostic crosses our redactor.
+                stderr: "pipe",
             });
-            const client = new Client({ name: "hara", version: "0.4.0" }, { capabilities: {} });
-            await client.connect(transport);
-            clients.push(client);
-            const { tools } = await client.listTools();
+            const stderrRedactor = mcpStderrRedactor(name, cfg.env, log);
+            flushStderr = () => stderrRedactor.flush();
+            // `stderr` is available before connect() when piping is requested, so early startup errors are neither
+            // lost nor inherited. Line buffering prevents a credential split across chunks from evading redaction.
+            transport.stderr?.on("data", (chunk) => stderrRedactor.push(Buffer.isBuffer(chunk) ? chunk.toString("utf8") : String(chunk)));
+            transport.stderr?.on("end", flushStderr);
+            transport.stderr?.on("close", flushStderr);
+            client = new Client({ name: "hara", version: "0.4.0" }, { capabilities: {} });
+            await client.connect(transport, requestOptions);
+            stage = "list tools";
+            const activeClient = client;
+            const { tools } = await activeClient.listTools(undefined, requestOptions);
             for (const t of tools) {
                 const schema = t.inputSchema ?? { type: "object", properties: {} };
                 registerTool({
@@ -24,19 +161,34 @@ export async function connectMcpServers(servers, log) {
                     description: t.description ?? `${name}/${t.name}`,
                     input_schema: schema,
                     kind: "exec",
-                    async run(input) {
-                        const res = await client.callTool({ name: t.name, arguments: input ?? {} });
+                    trustBoundary: "external",
+                    async run(input, ctx) {
+                        if (!ctx.ask && process.env.HARA_ALLOW_TRUSTED_EXTENSIONS !== "1") {
+                            return "Blocked: MCP is a trusted extension outside Hara's file boundary and is disabled in non-interactive runs. Set HARA_ALLOW_TRUSTED_EXTENSIONS=1 before launch only after reviewing the server.";
+                        }
+                        const protectedReason = sensitiveStructuredInputReason(input, ctx.cwd);
+                        if (protectedReason)
+                            return `Blocked: MCP input names protected ${protectedReason}.`;
+                        const res = await activeClient.callTool({ name: t.name, arguments: input ?? {} });
                         const blocks = Array.isArray(res?.content) ? res.content : [];
                         const text = blocks.map((b) => (b?.type === "text" ? b.text : JSON.stringify(b))).join("\n");
-                        return text || "(no output)";
+                        return redactToolSubprocessOutput(text || "(no output)", process.env, cfg.env ?? {});
                     },
                 });
                 count++;
             }
-            log(`mcp: ${name} → ${tools.length} tool(s)`);
+            clients.push(activeClient);
+            log(`mcp: ${diagnosticName} → ${tools.length} tool(s)`);
         }
         catch (e) {
-            log(`mcp: ${name} failed (${e?.message ?? e})`);
+            // Do this before returning/logging: a timeout is not merely a failed request; the external process
+            // must be torn down immediately and must not enter the global successful-client pool.
+            await closeFailedMcp(client, transport);
+            flushStderr?.();
+            const error = redactToolSubprocessOutput(String(e?.message ?? e), process.env, cfg.env ?? {})
+                .replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g, " ")
+                .trim();
+            log(`mcp: ${diagnosticName} failed during ${stage} (${error})`);
         }
     }
     return count;

package/dist/memory/store.js

@@ -2,14 +2,17 @@
 // File-backed Markdown (git-versionable, human-readable), two scopes: global ~/.hara/memory and
 // project <root>/.hara/memory. Lexical search reuses recall.ts; no embeddings (local-first).
 import { homedir } from "node:os";
-import { join, dirname } from "node:path";
-import { readFileSync, writeFileSync, appendFileSync, mkdirSync, existsSync, readdirSync } from "node:fs";
+import { join } from "node:path";
+import { existsSync, readdirSync } from "node:fs";
 import { findProjectRoot } from "../context/agents-md.js";
+import { readModelContextFileSync, readVerifiedRegularFileSnapshot } from "../fs-read.js";
+import { atomicWriteText, bindAtomicWritePath } from "../fs-write.js";
 // Per-source budgets for the frozen-snapshot digest (chars). Each source gets its own cap so a large
 // project MEMORY can't crowd out the (smaller but high-value) USER prefs — and each is cut at a line
 // boundary, never mid-entry. Anything beyond these is still reachable via memory_search. (hermes-style
 // per-file budgets; both PAI and hermes confirm lexical injection + capped snapshot beats a vector store.)
 const SOURCE_CAP = { memory: 2000, user: 1200, log: 0 };
+const MAX_MEMORY_SOURCE_BYTES = 256 * 1024;
 /** Truncate at a line boundary at/under `cap` (never mid-entry), with a pointer to search for the rest. */
 function capAtLine(text, cap) {
     if (text.length <= cap)
@@ -40,26 +43,62 @@ function targetFile(scope, target, cwd) {
         return join(dir, "log", `${today()}.md`);
     return join(dir, "MEMORY.md");
 }
-export function appendMemory(scope, target, content, cwd) {
+async function inspectMemoryWrite(path, action) {
+    const boundary = bindAtomicWritePath(path, action);
+    try {
+        return {
+            boundary,
+            snapshot: await readVerifiedRegularFileSnapshot(boundary.target, MAX_MEMORY_SOURCE_BYTES, action),
+        };
+    }
+    catch (error) {
+        if (error?.code === "ENOENT")
+            return { boundary, snapshot: null };
+        throw error;
+    }
+}
+async function commitMemoryText(path, text, action) {
+    const { boundary, snapshot } = await inspectMemoryWrite(path, action);
+    await atomicWriteText(boundary.target, text, {
+        expected: snapshot?.text ?? null,
+        expectedIdentity: snapshot ?? undefined,
+        boundary,
+    });
+}
+export async function appendMemory(scope, target, content, cwd) {
     const f = targetFile(scope, target, cwd);
-    mkdirSync(dirname(f), { recursive: true });
-    appendFileSync(f, (existsSync(f) ? "\n" : "") + content.trim() + "\n", "utf8");
+    const { boundary, snapshot } = await inspectMemoryWrite(f, "append memory");
+    const text = (snapshot ? `${snapshot.text}\n` : "") + content.trim() + "\n";
+    await atomicWriteText(boundary.target, text, {
+        expected: snapshot?.text ?? null,
+        expectedIdentity: snapshot ?? undefined,
+        boundary,
+    });
     return f;
 }
-export function replaceMemory(scope, target, content, cwd) {
+export async function replaceMemory(scope, target, content, cwd) {
     const f = targetFile(scope, target, cwd);
-    mkdirSync(dirname(f), { recursive: true });
-    writeFileSync(f, content.trim() + "\n", "utf8");
+    await commitMemoryText(f, content.trim() + "\n", "replace memory");
     return f;
 }
-export function forgetMemory(scope, target, match, cwd) {
+export async function forgetMemory(scope, target, match, cwd) {
     const f = targetFile(scope, target, cwd);
-    if (!existsSync(f) || !match)
+    if (!match)
+        return 0;
+    const { boundary, snapshot } = await inspectMemoryWrite(f, "forget memory");
+    if (!snapshot)
         return 0;
-    const lines = readFileSync(f, "utf8").split("\n");
+    const lines = snapshot.text.split("\n");
     const kept = lines.filter((l) => !l.includes(match));
-    writeFileSync(f, kept.join("\n"), "utf8");
-    return lines.length - kept.length;
+    const removed = lines.length - kept.length;
+    if (!removed)
+        return 0;
+    await atomicWriteText(boundary.target, kept.join("\n"), {
+        expected: snapshot.text,
+        expectedIdentity: snapshot,
+        boundary,
+    });
+    return removed;
 }
 /** MEMORY + USER digest (project + global) for frozen-snapshot injection at session start. Each source is
  *  capped independently (SOURCE_CAP) at a line boundary, so every source is represented (project memory
@@ -76,7 +115,7 @@ export function memoryDigest(cwd) {
         if (!existsSync(f))
             continue;
         try {
-            const t = readFileSync(f, "utf8").trim();
+            const t = readModelContextFileSync(f, MAX_MEMORY_SOURCE_BYTES).trim();
             if (t)
                 parts.push(`## ${label}\n${capAtLine(t, SOURCE_CAP[target])}`);
         }
@@ -101,7 +140,7 @@ export function readRecentLogs(scope, cwd, days) {
         if (m && new Date(Number(m[1]), Number(m[2]) - 1, Number(m[3])).getTime() < cutoff)
             continue;
         try {
-            const t = readFileSync(join(dir, f), "utf8").trim();
+            const t = readModelContextFileSync(join(dir, f), MAX_MEMORY_SOURCE_BYTES).trim();
             if (t)
                 out.push(`### ${f}\n${t}`);
         }
@@ -111,20 +150,27 @@ export function readRecentLogs(scope, cwd, days) {
     }
     return out.join("\n\n");
 }
-/** Create memory dirs + seed files (global + project). Returns files written. */
-export function scaffoldMemory(cwd) {
+/** Seed the memory files (their parents are created by the atomic writer; log is created on first append). */
+export async function scaffoldMemory(cwd) {
     const written = [];
     for (const scope of ["global", "project"]) {
-        mkdirSync(join(memoryDir(scope, cwd), "log"), { recursive: true });
         const mem = join(memoryDir(scope, cwd), "MEMORY.md");
-        if (!existsSync(mem)) {
-            writeFileSync(mem, `# hara ${scope} memory\n\nDurable facts & decisions hara records and recalls across sessions. Git-versionable — edit freely.\n`, "utf8");
+        const { boundary, snapshot } = await inspectMemoryWrite(mem, "scaffold memory");
+        if (!snapshot) {
+            await atomicWriteText(boundary.target, `# hara ${scope} memory\n\nDurable facts & decisions hara records and recalls across sessions. Git-versionable — edit freely.\n`, {
+                expected: null,
+                boundary,
+            });
             written.push(mem);
         }
     }
     const user = join(memoryDir("global", cwd), "USER.md");
-    if (!existsSync(user)) {
-        writeFileSync(user, "# User preferences\n\nHow you like hara to work — voice, conventions, do/don't.\n", "utf8");
+    const { boundary, snapshot } = await inspectMemoryWrite(user, "scaffold memory");
+    if (!snapshot) {
+        await atomicWriteText(boundary.target, "# User preferences\n\nHow you like hara to work — voice, conventions, do/don't.\n", {
+            expected: null,
+            boundary,
+        });
         written.push(user);
     }
     return written;

package/dist/org/planner.js

@@ -2,9 +2,11 @@
 // FRAME the task → ATOMIZE into smallest verifiable steps → SEQUENCE as a DAG →
 // execute each atom (optionally routed to a role) → VERIFY gate. State is the SSOT
 // at .hara/org/plan.json. This is hara's differentiator: not one agent, an org that plans.
-import { writeFileSync, readFileSync, existsSync, mkdirSync } from "node:fs";
+import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { runShell } from "../sandbox.js";
+import { readModelContextFileSync, readVerifiedRegularFileSnapshot } from "../fs-read.js";
+import { atomicWriteText, bindAtomicWritePath } from "../fs-write.js";
 const PLAN_SYSTEM = `You are hara's planner. Decompose a coding task using this method:
 1) FRAME the goal in one sentence.
 2) ATOMIZE into the smallest independently-verifiable steps.
@@ -151,22 +153,46 @@ export async function runCheck(cmd, cwd, sandbox) {
         return { ok: false, reason: (out.split("\n").pop() || `exit ${e?.code ?? "?"}`).slice(0, 200) };
     }
 }
-function planDir(cwd) {
-    const d = join(cwd, ".hara", "org");
-    mkdirSync(d, { recursive: true });
-    return d;
-}
-const planFile = (cwd) => join(planDir(cwd), "plan.json");
+const planFile = (cwd) => join(cwd, ".hara", "org", "plan.json");
+const planWriteTails = new Map();
 /** SSOT: persist plan state so it's inspectable / resumable. */
-export function savePlan(cwd, plan) {
-    writeFileSync(planFile(cwd), JSON.stringify(plan, null, 2), "utf8");
+export async function savePlan(cwd, plan) {
+    const p = planFile(cwd);
+    const previous = planWriteTails.get(p) ?? Promise.resolve();
+    const operation = previous.catch(() => { }).then(async () => {
+        // Serialize the live shared plan inside the per-path queue so parallel atoms cannot overwrite a newer
+        // sibling state with an older snapshot. The atomic writer binds parent identity and rejects links.
+        const text = JSON.stringify(plan, null, 2);
+        const boundary = bindAtomicWritePath(p, "save plan");
+        let snapshot = null;
+        try {
+            snapshot = await readVerifiedRegularFileSnapshot(boundary.target, undefined, "save plan");
+        }
+        catch (error) {
+            if (error?.code !== "ENOENT")
+                throw error;
+        }
+        await atomicWriteText(boundary.target, text, {
+            expected: snapshot?.text ?? null,
+            expectedIdentity: snapshot ?? undefined,
+            boundary,
+        });
+    });
+    planWriteTails.set(p, operation);
+    try {
+        await operation;
+    }
+    finally {
+        if (planWriteTails.get(p) === operation)
+            planWriteTails.delete(p);
+    }
 }
 export function loadPlan(cwd) {
     const p = planFile(cwd);
     if (!existsSync(p))
         return null;
     try {
-        return JSON.parse(readFileSync(p, "utf8"));
+        return JSON.parse(readModelContextFileSync(p, 64 * 1024 * 1024));
     }
     catch {
         return null;