@nanhara/hara 0.121.1 → 0.122.1

package/dist/agent/loop.js

@@ -17,6 +17,7 @@ import { setTurnPhase } from "./phase.js";
 import { recordTouch } from "./touched.js";
 import { resolve as resolvePath } from "node:path";
 import { redactSensitiveText } from "../security/secrets.js";
+import { redactToolSubprocessOutput } from "../security/subprocess-env.js";
 /** File tools whose `path` input marks the file as "recently worked with" (post-compaction restore). */
 const FILE_TOUCH_TOOLS = new Set(["read_file", "edit_file", "write_file"]);
 /** Stall watchdog ceiling: a model attempt that streams NOTHING for this long is treated as a dead /
@@ -72,7 +73,17 @@ source file or shell command. Reference an environment variable instead (for exa
 $API_KEY). Keep real values in the user's environment or an approved secret store; do not create/populate a
 .env file with a real secret unless the user explicitly asks and it is excluded from version control. Never
 echo credentials back. Session persistence redacts likely secrets as a last line of defense, but that does
-not make embedding credentials acceptable.
+not make embedding credentials acceptable. Built-in file, search, and context paths hard-reject protected
+files (.env/.env.*, credential stores, private keys, and private Hara state) before ordinary approval/dispatch;
+do not try to bypass that policy through shell indirection, another tool, a sub-agent, or full-auto. Safe
+templates such as .env.example may be read. Only a user who restarts Hara with
+HARA_ALLOW_SENSITIVE_FILES=1 explicitly removes the built-in deny and shell protected-read mask for that
+process. Shell subprocesses have credentials removed from their environment. macOS also applies an OS read
+mask to existing protected paths; Linux/Windows shell checks are
+static guardrails, not a kernel sandbox. MCP and external coding agents run outside this boundary: use them
+only as reviewed trusted extensions. Their tool calls require confirmation every time in interactive use and
+are disabled without an interactive approval channel unless the user launched with
+HARA_ALLOW_TRUSTED_EXTENSIONS=1.
 For broad,
 open-ended exploration (more than ~3 searches), spawn \`agent\` sub-agents — several in one response for
 independent questions (role "explore") — each returns conclusions, not dumps. Messages the user sends
@@ -96,8 +107,8 @@ site, build output), check they are newer than their sources (compare mtimes or
 the sources changed since the artifacts were built, run the project's documented build/render steps FIRST.
 When AGENTS.md / README / package.json document a command sequence (e.g. pull → render → build → preview),
 that ordering is authoritative — never skip the middle steps, or you serve stale output and the user sees
-two-day-old work. Package-manager installs auto-start as background jobs when you omit background/timeout;
-poll the returned job until it exits before depending on its packages. Before opening a public tunnel,
+two-day-old work. Package-manager installs receive a longer attached timeout by default; use background jobs
+only when explicitly appropriate, and poll a background job before depending on it. Before opening a public tunnel,
 verify that provider's authentication/config once; if it is missing, stop and ask instead of trying a chain
 of unrelated tunnel tools. After completing a task, give a one-line summary.`;
 /** When running inside `hara gateway`, tell the agent it's in a chat — so it delivers files via send_file
@@ -111,7 +122,9 @@ function gatewayNote() {
         `To send a file or image to them, call the \`send_file\` tool with an absolute path; that is the ONLY channel ` +
         `that reaches this chat. Do NOT use the \`computer\` tool, AppleScript, or any desktop/${plat}-client automation ` +
         `to deliver files — that drives a different window and silently fails to reach the user. Never tell the user a ` +
-        `file was sent unless \`send_file\` returned success. Keep replies short and chat-friendly.`);
+        `file was sent unless \`send_file\` returned success. Keep replies short and chat-friendly. ` +
+        `PLAIN TEXT ONLY: chat bubbles render markdown literally — never use **bold**, # headers, backticks, tables, ` +
+        `or [text](url); write list items as "- " lines and links as bare URLs.`);
 }
 function composeSystem(cwd, projectContext, override, memory) {
     const head = override ? `${override}\n\nWorking directory: ${cwd}` : HARA_SYSTEM(cwd);
@@ -129,6 +142,16 @@ export async function runAgent(history, opts) {
     let activeProvider = provider; // may switch to a fallback model on a recoverable error (app-failover)
     let triedFallback = false;
     let emptyRetried = false; // one-shot: a genuinely empty model turn gets a single nudge before we give up
+    const interruptedOutcome = () => {
+        const msg = "(interrupted)";
+        if (!opts.quiet) {
+            if (ctx.ui)
+                ctx.ui.notice(msg);
+            else
+                out(c.dim(`\n${msg}\n`));
+        }
+        return { status: "error", error: msg };
+    };
     // Warn at the interaction boundary without echoing the value. Headless/gateway stdout is the response
     // transport, so keep the banner to interactive surfaces; persistence is still redacted everywhere.
     const latestUser = [...history].reverse().find((m) => m.role === "user");
@@ -166,7 +189,7 @@ export async function runAgent(history, opts) {
         // lands as ONE wrapped user message the UI never renders. Quiet runs don't drain — a parallel
         // sub-agent must not steal the main conversation's reminders.
         if (!opts.quiet) {
-            const reminders = drainReminders();
+            const reminders = drainReminders(ctx.todoScope);
             if (reminders.length)
                 history.push({ role: "user", content: wrapReminders(reminders) });
         }
@@ -212,7 +235,12 @@ export async function runAgent(history, opts) {
         const STALL_MS = stallMs();
         const attempt = new AbortController();
         const onUserAbort = () => attempt.abort();
-        opts.signal?.addEventListener("abort", onUserAbort, { once: true });
+        // AbortSignal does not replay an already-fired event to a late listener. A serve shutdown can cancel
+        // while provider routing is still refreshing, so inherit that state synchronously before the call.
+        if (opts.signal?.aborted)
+            attempt.abort();
+        else
+            opts.signal?.addEventListener("abort", onUserAbort, { once: true });
         let lastEvent = Date.now();
         let stalled = false;
         const stallTimer = setInterval(() => {
@@ -229,17 +257,33 @@ export async function runAgent(history, opts) {
         if (!opts.quiet)
             setTurnPhase("waiting"); // request sent, nothing streamed yet — the status row shows it
         let r;
+        let removeAttemptStop = () => { };
         try {
-            r = await activeProvider.turn({
+            // AbortSignal is advisory: a custom/provider SDK can ignore it and leave its Promise pending forever.
+            // Race the attempt itself so the watchdog and user cancellation remain hard boundaries. The abandoned
+            // Promise retains a rejection handler through Promise.race, and all late stream callbacks below are muted.
+            const attemptStopped = new Promise((resolveStopped) => {
+                const onAttemptStop = () => resolveStopped({ text: "", toolUses: [], stop: "error", errorMsg: "interrupted" });
+                removeAttemptStop = () => attempt.signal.removeEventListener("abort", onAttemptStop);
+                if (attempt.signal.aborted)
+                    onAttemptStop();
+                else
+                    attempt.signal.addEventListener("abort", onAttemptStop, { once: true });
+            });
+            const providerTurn = activeProvider.turn({
                 system: composeSystem(ctx.cwd, opts.projectContext, opts.systemOverride, opts.memory),
                 history,
                 tools: specs,
                 // Any stream chunk keeps the connection considered alive — even suppressed reasoning_content, so a
                 // reasoning model thinking for a long while before its first `content` token can't be false-timed-out.
                 onActivity: () => {
+                    if (attempt.signal.aborted)
+                        return;
                     lastEvent = Date.now();
                 },
                 onText: (d) => {
+                    if (attempt.signal.aborted)
+                        return;
                     alive();
                     if (opts.quiet)
                         return;
@@ -256,6 +300,8 @@ export async function runAgent(history, opts) {
                 },
                 onReasoning: sink || tty
                     ? (d) => {
+                        if (attempt.signal.aborted)
+                            return;
                         alive();
                         if (opts.quiet)
                             return;
@@ -281,12 +327,23 @@ export async function runAgent(history, opts) {
                             }
                         }
                     }
-                    : (d) => alive(), // quiet runs still feed the watchdog (reasoning-only stretches are progress)
+                    : () => {
+                        if (!attempt.signal.aborted)
+                            alive();
+                    }, // quiet runs still feed the watchdog (reasoning-only stretches are progress)
                 signal: attempt.signal,
             });
+            opts.onProviderTurn?.(providerTurn);
+            r = await Promise.race([providerTurn, attemptStopped]);
+        }
+        catch (error) {
+            if (!opts.signal?.aborted)
+                throw error;
+            r = { text: "", toolUses: [], stop: "error", errorMsg: "interrupted" };
         }
         finally {
             clearInterval(stallTimer);
+            removeAttemptStop();
             opts.signal?.removeEventListener("abort", onUserAbort);
         }
         // A watchdog abort surfaces from the provider as "interrupted" — rewrite it to a timeout-class
@@ -304,6 +361,10 @@ export async function runAgent(history, opts) {
             opts.stats.output += r.usage.output;
             opts.stats.lastInput = r.usage.input;
         }
+        // A provider may ignore AbortSignal and return a perfectly valid-looking tool_use after cancellation.
+        // The original run signal is authoritative: do not append/approve/execute any late response.
+        if (opts.signal?.aborted)
+            return interruptedOutcome();
         history.push({ role: "assistant", text: r.text, toolUses: r.toolUses });
         if (r.stop === "error") {
             const kind = classifyError(r.errorMsg ?? "");
@@ -321,13 +382,26 @@ export async function runAgent(history, opts) {
                 continue; // retry once on the fallback model (guarded by triedFallback)
             }
             const msg = kind === "interrupted" ? "(interrupted)" : `[${activeProvider.id} error] ${r.errorMsg ?? "unknown"}${errorHint(kind)}`;
+            if (r.toolUses.length) {
+                // A provider can fail after partially assembling tool calls. The assistant turn is already persisted;
+                // close every call explicitly so the next request is valid, while never executing partial work.
+                history.push({
+                    role: "tool",
+                    results: r.toolUses.map((toolUse) => ({
+                        id: toolUse.id,
+                        name: toolUse.name,
+                        content: `Error: provider failed before this tool call could be executed. ${r.errorMsg ?? "unknown provider error"}`,
+                        isError: true,
+                    })),
+                });
+            }
             if (!opts.quiet) {
                 if (sink)
                     sink.notice(msg);
                 else
                     out(kind === "interrupted" ? c.dim(`\n${msg}\n`) : c.red(`${msg}\n`));
             }
-            return;
+            return { status: "error", error: msg };
         }
         // Empty-turn guard. The model returned nothing actionable — no text AND no tool calls (a blank
         // completion, or a "tool_use" stop with an empty tool list). Silently returning here leaves the
@@ -355,16 +429,37 @@ export async function runAgent(history, opts) {
                 else
                     out(c.dim(`${note}\n`));
             }
-            return;
+            return { status: "empty" };
         }
         // A "tool_use" stop with text but no tools (rare) has nothing to execute — end after showing the text
         // rather than pushing an empty tool round and re-requesting in a loop.
         if (r.stop !== "tool_use" || r.toolUses.length === 0)
-            return;
+            return { status: "completed" };
+        // Once an assistant tool_use turn enters history, every tool_use MUST receive a matching tool result.
+        // OpenAI/Anthropic both reject a later user turn after an unclosed tool round. Cancellation can happen
+        // while planning, approving, or executing, so finalize the round with real results for work that already
+        // completed and explicit interruption errors for everything else before persisting the session.
+        const results = new Array(r.toolUses.length);
+        const finalizeInterruptedToolRound = () => {
+            history.push({
+                role: "tool",
+                results: r.toolUses.map((tu, idx) => results[idx] ?? ({
+                    id: tu.id,
+                    name: tu.name,
+                    content: "Error: interrupted before this tool call completed.",
+                    isError: true,
+                })),
+            });
+            return interruptedOutcome();
+        };
+        if (opts.signal?.aborted)
+            return finalizeInterruptedToolRound();
         const plans = [];
         // Extra (per-run) tools win over the registry so a run-scoped tool can't be shadowed by a global one.
         const resolveTool = (name) => opts.extraTools?.find((t) => t.name === name) ?? getTool(name);
         for (const tu of r.toolUses) {
+            if (opts.signal?.aborted)
+                return finalizeInterruptedToolRound();
             if (breakerHalt) {
                 // Circuit-breaker halted the run: refuse every remaining call in this round with a clear message
                 // (no hang, no further tools) so the model + user get a definitive stop.
@@ -377,11 +472,21 @@ export async function runAgent(history, opts) {
                 continue;
             }
             const input = tu.input;
-            const preview = String(input.path ?? input.command ?? input.pattern ?? input.url ?? input.task ?? "")
+            const preview = redactToolSubprocessOutput(String(input.path ?? input.command ?? input.pattern ?? input.url ?? input.task ?? "")
                 .replace(/\s+/g, " ")
-                .trim();
-            // Screen control is gated on EVERY action — a prior "don't ask again" must never satisfy it.
-            const alwaysGate = tool.kind === "computer";
+                .trim());
+            // Screen control and opaque host extensions are gated on EVERY action — a prior "don't ask again"
+            // and even full-auto must never silently turn them into a side channel.
+            const alwaysGate = tool.kind === "computer" || tool.trustBoundary === "external";
+            if (tool.trustBoundary === "external" && !ctx.ask && process.env.HARA_ALLOW_TRUSTED_EXTENSIONS !== "1") {
+                plans.push({
+                    tu,
+                    tool,
+                    denied: "Trusted extension blocked in this non-interactive run. MCP and external coding agents run outside Hara's file boundary; " +
+                        "restart with HARA_ALLOW_TRUSTED_EXTENSIONS=1 only after reviewing that extension.",
+                });
+                continue;
+            }
             // Command-level policy for shell commands: a deny rule blocks even in full-auto; an allow rule (or a
             // read-only command) auto-runs even in suggest mode. Composes with, doesn't replace, the approval mode.
             const cmdDecision = tool.kind === "exec" && typeof input.command === "string" ? decideCommand(input.command, permRules) : null;
@@ -396,17 +501,20 @@ export async function runAgent(history, opts) {
             if (guardianOn && !breakerHalt) {
                 const risk = classifyRisk(tu.name, tool.kind, input, ctx.cwd);
                 if (risk.level === "high") {
-                    const detail = String(input.command ?? input.path ?? "").replace(/\s+/g, " ").trim().slice(0, 400);
-                    const verdict = await guardianVeto(opts.guardian.provider, { tool: tu.name, detail, classifierReason: risk.reason }, history, { signal: opts.signal });
+                    const safeRiskReason = redactToolSubprocessOutput(risk.reason);
+                    const detail = redactToolSubprocessOutput(String(input.command ?? input.path ?? "").replace(/\s+/g, " ").trim().slice(0, 400));
+                    const verdict = await guardianVeto(opts.guardian.provider, { tool: tu.name, detail, classifierReason: safeRiskReason }, history, { signal: opts.signal });
+                    if (opts.signal?.aborted)
+                        return finalizeInterruptedToolRound();
                     if (verdict.decision === "block") {
                         const tripped = recordBlock(breaker); // deterministic circuit-breaker: N blocks → hard stop
                         plans.push({
                             tu,
                             tool,
-                            denied: `Guardian blocked this high-risk action: ${verdict.reason || risk.reason}. Reconsider — take a safer, in-scope step, or ask the user before doing this.`,
+                            denied: `Guardian blocked this high-risk action: ${verdict.reason || safeRiskReason}. Reconsider — take a safer, in-scope step, or ask the user before doing this.`,
                         });
                         if (!opts.quiet) {
-                            const note = `⛔ guardian blocked ${tu.name} — ${verdict.reason || risk.reason}`;
+                            const note = `⛔ guardian blocked ${tu.name} — ${verdict.reason || safeRiskReason}`;
                             if (sink)
                                 sink.notice(note);
                             else
@@ -421,6 +529,8 @@ export async function runAgent(history, opts) {
                             const cont = interactive
                                 ? await opts.confirm(`${c.red("⛔ guardian circuit-breaker")} — ${breaker.blocks} high-risk actions blocked this turn. Continue anyway?`)
                                 : false;
+                            if (opts.signal?.aborted)
+                                return finalizeInterruptedToolRound();
                             if (cont === false) {
                                 breakerHalt = true;
                             }
@@ -433,8 +543,11 @@ export async function runAgent(history, opts) {
                     }
                 }
             }
-            if (cmdDecision !== "allow" && needsConfirm(tool.kind, opts.approval) && (alwaysGate || !opts.autoApprove?.has(tu.name))) {
+            const shouldConfirm = alwaysGate || (cmdDecision !== "allow" && needsConfirm(tool.kind, opts.approval) && !opts.autoApprove?.has(tu.name));
+            if (shouldConfirm) {
                 const reply = await opts.confirm(`${c.yellow("⚠")}  ${c.bold(tu.name)} ${c.dim(preview)} — run?`);
+                if (opts.signal?.aborted)
+                    return finalizeInterruptedToolRound();
                 if (reply === false) {
                     plans.push({ tu, tool, denied: "User denied this action." });
                     continue;
@@ -452,8 +565,11 @@ export async function runAgent(history, opts) {
             }
         }
         // Execute: read-only tools run concurrently; edit/exec run alone, in order.
-        const results = new Array(plans.length);
+        if (opts.signal?.aborted)
+            return finalizeInterruptedToolRound();
         const runOne = async (idx, p) => {
+            if (opts.signal?.aborted)
+                return;
             if (p.denied !== undefined) {
                 results[idx] = { id: p.tu.id, name: p.tu.name, content: p.denied, isError: true };
                 return;
@@ -467,28 +583,42 @@ export async function runAgent(history, opts) {
                 if (missing.length) {
                     const msg = `Error: tool call NOT executed — missing required parameter${missing.length > 1 ? "s" : ""}: ` +
                         `${missing.join(", ")}. Send the call again with ALL required parameters (${(p.tool.input_schema.required ?? []).join(", ")}) present and complete.`;
-                    results[idx] = { id: p.tu.id, name: p.tu.name, content: msg + recordCall(p.tu.name, p.tu.input, msg, true), isError: true };
+                    results[idx] = { id: p.tu.id, name: p.tu.name, content: msg + recordCall(p.tu.name, p.tu.input, msg, true, ctx.todoScope), isError: true };
                     return;
                 }
-                const pre = runHooks("PreToolUse", p.tu.name, p.tu.input, ctx.cwd); // a hook may veto the call
+                if (opts.signal?.aborted)
+                    return;
+                const pre = opts.hooks === false
+                    ? { block: false, message: "" }
+                    : runHooks("PreToolUse", p.tu.name, p.tu.input, ctx.cwd); // a hook may veto the call
                 if (pre.block) {
                     results[idx] = { id: p.tu.id, name: p.tu.name, content: pre.message, isError: true };
                     return;
                 }
+                if (opts.signal?.aborted)
+                    return;
                 // Track the MAIN conversation's working files for post-compaction restore (quiet fan-out
                 // sub-agents read broadly — their files aren't "what the user was working on").
                 if (!opts.quiet && FILE_TOUCH_TOOLS.has(p.tu.name) && typeof p.tu.input?.path === "string") {
-                    recordTouch(resolvePath(ctx.cwd, String(p.tu.input.path)));
+                    recordTouch(resolvePath(ctx.cwd, String(p.tu.input.path)), ctx.todoScope);
                 }
                 const res = await p.tool.run(p.tu.input, ctx);
                 // append any not-yet-seen subdirectory AGENTS.md/CLAUDE.md this call touched (monorepo-local conventions)
                 // + the repeat-guard's anti-spinning note when this exact call keeps failing (repeat-guard.ts)
-                results[idx] = { id: p.tu.id, name: p.tu.name, content: res + subdirHint(p.tu.input, ctx.cwd) + recordCall(p.tu.name, p.tu.input, res) };
-                runHooks("PostToolUse", p.tu.name, { input: p.tu.input, result: res }, ctx.cwd); // observe-only
+                results[idx] = { id: p.tu.id, name: p.tu.name, content: res + subdirHint(p.tu.input, ctx.cwd) + recordCall(p.tu.name, p.tu.input, res, false, ctx.todoScope) };
+                // The tool may have completed a side effect and then triggered/observed cancellation. Preserve its
+                // actual result in the closing tool round, but do not run any post hook or later tool afterward.
+                if (opts.signal?.aborted)
+                    return;
+                if (opts.hooks !== false) {
+                    runHooks("PostToolUse", p.tu.name, { input: p.tu.input, result: res }, ctx.cwd); // observe-only
+                }
             }
             catch (e) {
                 const msg = `Error: ${e.message}`;
-                results[idx] = { id: p.tu.id, name: p.tu.name, content: msg + recordCall(p.tu.name, p.tu.input, msg, true), isError: true };
+                results[idx] = { id: p.tu.id, name: p.tu.name, content: msg + recordCall(p.tu.name, p.tu.input, msg, true, ctx.todoScope), isError: true };
+                if (opts.signal?.aborted)
+                    return;
             }
             finally {
                 activity.dec();
@@ -503,16 +633,24 @@ export async function runAgent(history, opts) {
             await mapLimit(idx, maxParallel(), (i) => runOne(i, plans[i])); // bounded fan-out (e.g. 20 parallel agents → 8 at a time)
         };
         for (let i = 0; i < plans.length; i++) {
+            if (opts.signal?.aborted)
+                return finalizeInterruptedToolRound();
             const p = plans[i];
             if (p.denied === undefined && p.tool?.kind === "read") {
                 batch.push(i); // safe → accumulate to run concurrently
             }
             else {
                 await flush(); // flush pending reads before an edit/exec
+                if (opts.signal?.aborted)
+                    return finalizeInterruptedToolRound();
                 await runOne(i, p);
+                if (opts.signal?.aborted)
+                    return finalizeInterruptedToolRound();
             }
         }
         await flush();
+        if (opts.signal?.aborted)
+            return finalizeInterruptedToolRound();
         history.push({ role: "tool", results });
         // Synthesis nudge (CC's KN5, hara-shaped): a round that fanned out to several parallel agents just
         // produced N independent reports — remind the model to merge/reconcile them before acting, instead
@@ -520,7 +658,7 @@ export async function runAgent(history, opts) {
         if (!opts.quiet) {
             const fanout = r.toolUses.filter((tu) => tu.name === "agent").length;
             if (fanout >= SYNTHESIS_MIN_AGENTS)
-                pushReminder(synthesisReminder(fanout));
+                pushReminder(synthesisReminder(fanout), ctx.todoScope);
         }
         // Todo attention-refresh: a round that touched the checklist resets the clock; rounds that leave
         // unfinished items untouched accumulate, and at TODO_STALE_ROUNDS the model gets a system-reminder
@@ -529,10 +667,10 @@ export async function runAgent(history, opts) {
             if (r.toolUses.some((tu) => tu.name === "todo_write")) {
                 todoIdleRounds = 0;
             }
-            else if (currentTodos().some((t) => t.status !== "done")) {
+            else if (currentTodos(ctx.todoScope).some((t) => t.status !== "done")) {
                 todoIdleRounds++;
                 if (todoIdleRounds >= TODO_STALE_ROUNDS) {
-                    pushReminder(todoStaleReminder(renderTodos(currentTodos())));
+                    pushReminder(todoStaleReminder(renderTodos(currentTodos(ctx.todoScope))), ctx.todoScope);
                     todoIdleRounds = 0;
                 }
             }
@@ -547,7 +685,7 @@ export async function runAgent(history, opts) {
                 else
                     out(c.red(`${note}\n`));
             }
-            return;
+            return { status: "halted" };
         }
         if (guard && !nudged) {
             for (const p of plans)

package/dist/agent/reminders.js

@@ -6,19 +6,34 @@
 //
 // Claude Code's disclaimer is preserved: the model is told the context may be irrelevant, so an
 // injected nudge never derails an unrelated task.
-const queue = [];
+const DEFAULT_SCOPE = "default";
+const queues = new Map();
+function scopeKey(scope) {
+    return scope?.trim() || DEFAULT_SCOPE;
+}
 /** Queue a reminder for injection before the next model call (main loop only — quiet/sub-agent runs
  *  neither push nor drain, so a parallel fan-out can't steal the main conversation's reminders). */
-export function pushReminder(text) {
+export function pushReminder(text, scope) {
     const t = text.trim();
-    if (t)
-        queue.push(t);
+    if (!t)
+        return;
+    const key = scopeKey(scope);
+    const queue = queues.get(key) ?? [];
+    queue.push(t);
+    queues.set(key, queue);
 }
 /** Take everything queued (FIFO), clearing the queue. */
-export function drainReminders() {
-    if (!queue.length)
+export function drainReminders(scope) {
+    const key = scopeKey(scope);
+    const queue = queues.get(key);
+    if (!queue?.length)
         return [];
-    return queue.splice(0, queue.length);
+    queues.delete(key);
+    return queue;
+}
+/** Drop an ephemeral session's pending reminders without exposing them to another run. */
+export function disposeReminderScope(scope) {
+    queues.delete(scopeKey(scope));
 }
 /** Merge queued reminders into the single injected message. */
 export function wrapReminders(items) {

package/dist/agent/repeat-guard.js

@@ -4,8 +4,16 @@
 // covers FAILED ones. Deterministic and session-scoped (module state, same pattern as net-reachability):
 // when an identical (tool, args) call fails twice in a row, the tool result gets an explicit "stop
 // repeating this" note the model can't miss. Successful repeats are NOT flagged — a re-read after an edit
-// or a re-run after a fix is legitimate, and a success resets the failure streak.
-const seen = new Map();
+// or a re-run after a fix is legitimate, and a success resets the failure streak. Serve can run several
+// sessions in one process, so streaks are keyed by the same run scope as todo/reminder state.
+const DEFAULT_SCOPE = "default";
+const seenByScope = new Map();
+function scopedSeen(scope) {
+    const key = scope?.trim() || DEFAULT_SCOPE;
+    const seen = seenByScope.get(key) ?? new Map();
+    seenByScope.set(key, seen);
+    return seen;
+}
 /** Identity of a call = tool name + exact JSON of its arguments (tool names contain no spaces,
  *  so a space separator is unambiguous). */
 export function keyOf(name, input) {
@@ -24,12 +32,20 @@ export function looksFailed(content) {
 }
 /** Record a completed call; returns a warning to APPEND to the tool result when the same call has now
  *  failed >=2x in a row (empty string otherwise). Pure aside from the session-scoped map. */
-export function recordCall(name, input, content, isError = false) {
+export function recordCall(name, input, content, isError = false, scope) {
     const k = keyOf(name, input);
     const failed = isError || looksFailed(content);
+    const seen = scopedSeen(scope);
     const s = seen.get(k) ?? { fails: 0 };
-    s.fails = failed ? s.fails + 1 : 0; // success resets the streak
-    seen.set(k, s);
+    if (!failed) {
+        seen.delete(k); // successes have no useful state; don't leak every unique tool call in a long-lived server
+        return "";
+    }
+    s.fails++;
+    seen.delete(k);
+    seen.set(k, s); // refresh insertion order for the bounded per-scope LRU
+    if (seen.size > 500)
+        seen.delete(seen.keys().next().value);
     if (s.fails < 2)
         return "";
     return (`\n\n⟳ hara: this exact ${name} call has now FAILED ${s.fails}× with identical arguments — ` +
@@ -37,6 +53,9 @@ export function recordCall(name, input, content, isError = false) {
         `or step back and re-plan; if you're out of ideas, ask the user and say what you tried.`);
 }
 /** Clear the streaks — /reset (fresh start) and tests. */
-export function resetRepeatGuard() {
-    seen.clear();
+export function resetRepeatGuard(scope) {
+    if (scope)
+        seenByScope.delete(scope.trim() || DEFAULT_SCOPE);
+    else
+        seenByScope.clear();
 }