@nanhara/hara 0.121.1 → 0.122.1

package/dist/profile/profile.js

@@ -30,8 +30,12 @@
 // tolerates reading it from a legacy config.json (it just maps to the migrated gateway profile).
 // ────────────────────────────────────────────────────────────────────────────────
 import { homedir } from "node:os";
+import { spawnSync } from "node:child_process";
 import { join, dirname, parse as parsePath, resolve as resolvePath } from "node:path";
-import { readFileSync, writeFileSync, existsSync, mkdirSync, chmodSync, renameSync, unlinkSync } from "node:fs";
+import { readFileSync, writeFileSync, existsSync, lstatSync, mkdirSync, chmodSync, realpathSync, renameSync } from "node:fs";
+import { readVerifiedRegularFileSnapshotSync } from "../fs-read.js";
+import { atomicWriteText, bindProfilePinWritePath, discardClaimedPath, verifyAtomicWriteBoundary, } from "../fs-write.js";
+import { projectRepositoryTrustedAtStartup } from "../security/project-trust.js";
 const PERSONAL_ID = "personal";
 const DEFAULT_ORG_ID = "default-org";
 function haraDir() {
@@ -149,6 +153,86 @@ export function listProfiles() {
 // the global default (~/.hara/profiles.json `active`).
 // ────────────────────────────────────────────────────────────────────────────────
 const PIN_FILE = ".hara-profile";
+const MAX_PIN_BYTES = 4096;
+const warnedPinFiles = new Set();
+function canonicalExistingDirectory(path) {
+    try {
+        return realpathSync.native(resolvePath(path));
+    }
+    catch {
+        return resolvePath(path);
+    }
+}
+function warnIgnoredPin(file, reason) {
+    const key = `${file}:${reason}`;
+    if (warnedPinFiles.has(key))
+        return;
+    warnedPinFiles.add(key);
+    const detail = {
+        unavailable: "names a profile that is not available",
+        tracked: "is tracked by Git and repository identity pins are untrusted by default",
+        unverified: "is inside a Git worktree but its tracked status could not be verified",
+        invalid: "has an invalid format",
+        unsafe: "failed filesystem identity checks",
+    }[reason];
+    const trustHint = reason === "tracked" || reason === "unverified"
+        ? " Set HARA_TRUST_PROJECT_CONFIG=1 before starting hara only for a repository you trust."
+        : "";
+    try {
+        // The directory path is repository input and may itself contain token-shaped text. The fixed basename
+        // is enough to identify the feature without reflecting any attacker-controlled path or file content.
+        process.stderr.write(`hara: ignored .hara-profile: it ${detail}.${trustHint} Run \`hara profile pin <id>\` or \`hara profile unpin\` to fix.\n`);
+    }
+    catch {
+        /* best effort */
+    }
+}
+function gitMarkerAbove(start) {
+    let dir = start;
+    for (let depth = 0; depth < 128; depth++) {
+        try {
+            lstatSync(join(dir, ".git"));
+            return true;
+        }
+        catch (error) {
+            if (error?.code !== "ENOENT")
+                return true; // unreadable/suspicious marker: require a successful Git check
+        }
+        const parent = dirname(dir);
+        if (parent === dir)
+            return false;
+        dir = parent;
+    }
+    return true; // fail closed on a pathological path depth
+}
+/** Check only the index, with no shell and no repository-controlled command string. Unknown/error is distinct
+ * from untracked so a missing/failed git binary can never silently bless a committed identity pin. */
+function pinTracking(file) {
+    const dir = dirname(file);
+    if (!gitMarkerAbove(dir))
+        return "outside-git";
+    const env = Object.fromEntries(Object.entries(process.env).filter(([key]) => !key.startsWith("GIT_")));
+    env.GIT_OPTIONAL_LOCKS = "0";
+    env.GIT_TERMINAL_PROMPT = "0";
+    const result = spawnSync("git", [
+        "-c", "core.fsmonitor=false",
+        "-c", "core.untrackedCache=false",
+        "-C", dir,
+        "ls-files", "--error-unmatch", "--", PIN_FILE,
+    ], {
+        env,
+        stdio: "ignore",
+        timeout: 2000,
+        windowsHide: true,
+    });
+    if (result.error || result.signal)
+        return "unknown";
+    if (result.status === 0)
+        return "tracked";
+    if (result.status === 1)
+        return "untracked";
+    return "unknown";
+}
 export function pinFilePath(dir) {
     return join(dir, PIN_FILE);
 }
@@ -157,31 +241,46 @@ export function pinFilePath(dir) {
  *  If a pin file exists but names an unknown profile, we emit a one-line stderr warn
  *  and return null (non-fatal — the active resolution falls through to the next layer). */
 export function findPinnedProfile(startDir) {
-    const home = homedir();
-    const { root } = parsePath(startDir);
-    let dir = resolvePath(startDir);
+    const home = canonicalExistingDirectory(homedir());
+    let dir = canonicalExistingDirectory(startDir);
+    const { root } = parsePath(dir);
     // Track visited to defend against pathological symlink loops (best-effort).
     const seen = new Set();
     while (!seen.has(dir)) {
         seen.add(dir);
         const file = pinFilePath(dir);
-        if (existsSync(file)) {
-            try {
-                const id = readFileSync(file, "utf8").split(/\r?\n/)[0].trim();
-                if (id && getProfile(id))
-                    return { id, file };
-                if (id) {
-                    // pin points to a profile that no longer exists — warn once, fall through.
-                    try {
-                        process.stderr.write(`hara: ${file} pins profile '${id}', but it doesn't exist — falling back. Run \`hara profile pin <id>\` or \`hara profile unpin\` to fix.\n`);
-                    }
-                    catch {
-                        /* ignore */
-                    }
+        try {
+            const snapshot = readVerifiedRegularFileSnapshotSync(file, MAX_PIN_BYTES, {
+                action: "read profile pin",
+                protectSensitive: false,
+                rejectHardLinks: true,
+            });
+            if (snapshot.text.includes("\0")) {
+                warnIgnoredPin(file, "invalid");
+                return null;
+            }
+            if (!projectRepositoryTrustedAtStartup()) {
+                const tracking = pinTracking(file);
+                if (tracking === "tracked") {
+                    warnIgnoredPin(file, "tracked");
+                    return null;
+                }
+                if (tracking === "unknown") {
+                    warnIgnoredPin(file, "unverified");
+                    return null;
                 }
             }
-            catch {
-                /* unreadable pin — skip */
+            const id = snapshot.text.split(/\r?\n/)[0].trim();
+            if (id && getProfile(id))
+                return { id, file };
+            if (id)
+                warnIgnoredPin(file, "unavailable");
+            return null;
+        }
+        catch (error) {
+            if (error?.code !== "ENOENT") {
+                warnIgnoredPin(file, error?.code === "HARA_FILE_TOO_LARGE" ? "invalid" : "unsafe");
+                return null;
             }
         }
         // Stop walking once we're at $HOME or the fs root (don't escape into shared parent dirs).
@@ -194,24 +293,50 @@ export function findPinnedProfile(startDir) {
     }
     return null;
 }
-/** Write `.hara-profile` in the given dir with `id` as the only line. */
-export function writePin(dir, id) {
+/** Atomically write `.hara-profile` in the given dir with `id` as the only line. */
+export async function writePin(dir, id) {
     if (!getProfile(id))
         throw new Error(`no profile '${id}' — list with \`hara profile list\``);
     const file = pinFilePath(dir);
-    writeFileSync(file, id + "\n", "utf8");
-    return { file };
+    const boundary = bindProfilePinWritePath(file);
+    let snapshot = null;
+    try {
+        snapshot = readVerifiedRegularFileSnapshotSync(boundary.target, MAX_PIN_BYTES, {
+            action: "write profile pin",
+            protectSensitive: false,
+            rejectHardLinks: true,
+        });
+    }
+    catch (error) {
+        if (error?.code !== "ENOENT")
+            throw new Error("refusing to replace an unsafe profile pin");
+    }
+    await atomicWriteText(boundary.target, id + "\n", {
+        expected: snapshot?.text ?? null,
+        expectedIdentity: snapshot ?? undefined,
+        boundary,
+        mode: 0o600,
+    });
+    return { file: boundary.target };
 }
 /** Remove `.hara-profile` from the given dir. Returns true if it was there. */
 export function removePin(dir) {
     const file = pinFilePath(dir);
-    if (!existsSync(file))
-        return false;
+    let boundary;
     try {
-        unlinkSync(file);
+        boundary = bindProfilePinWritePath(file, "remove profile pin");
+        const snapshot = readVerifiedRegularFileSnapshotSync(boundary.target, MAX_PIN_BYTES, {
+            action: "remove profile pin",
+            protectSensitive: false,
+            rejectHardLinks: true,
+        });
+        verifyAtomicWriteBoundary(boundary);
+        discardClaimedPath(boundary.target, snapshot);
         return true;
     }
-    catch {
+    catch (error) {
+        if (error?.code !== "ENOENT")
+            warnIgnoredPin(boundary?.target ?? file, "unsafe");
         return false;
     }
 }

package/dist/recall.js

@@ -3,9 +3,11 @@
 // Phase-C v0: lexical-first (no embeddings); reuses the shared filesystem walker.
 import { homedir } from "node:os";
 import { join } from "node:path";
-import { readFileSync, mkdirSync, writeFileSync, existsSync } from "node:fs";
+import { mkdirSync, writeFileSync, existsSync } from "node:fs";
 import { walkFiles } from "./fs-walk.js";
 import { skillsDirs } from "./skills/skills.js";
+import { readModelContextFileSync } from "./fs-read.js";
+const MAX_RECALL_SOURCE_BYTES = 256 * 1024;
 export function assetsDir() {
     return process.env.HARA_ASSETS || join(homedir(), ".hara", "code-assets");
 }
@@ -56,7 +58,7 @@ export function searchAssets(query, limit = 5, roots) {
         for (const rel of walkFiles(dir).filter((f) => f.endsWith(".md"))) {
             let text;
             try {
-                text = readFileSync(join(dir, rel), "utf8");
+                text = readModelContextFileSync(join(dir, rel), MAX_RECALL_SOURCE_BYTES);
             }
             catch {
                 continue;

package/dist/runtime.js

@@ -0,0 +1,37 @@
+export const MIN_NODE_MAJOR = 22;
+// Commander 15 (a direct runtime dependency) requires this exact floor. Keep package engines, startup,
+// doctor, and docs aligned so an early Node 22 release gets an upgrade hint before dependencies load.
+export const MIN_NODE_VERSION = "22.12.0";
+function supportedNodeVersion(version) {
+    const match = /^(\d+)\.(\d+)\.(\d+)$/.exec(version);
+    if (!match)
+        return false;
+    const current = match.slice(1).map(Number);
+    const minimum = MIN_NODE_VERSION.split(".").map(Number);
+    for (let index = 0; index < minimum.length; index++) {
+        if (current[index] > minimum[index])
+            return true;
+        if (current[index] < minimum[index])
+            return false;
+    }
+    return true;
+}
+/** Bun powers Hara's standalone binaries and does not require a host Node installation. */
+export function unsupportedNodeMessage(versions = process.versions) {
+    if (versions.bun)
+        return null;
+    const version = String(versions.node ?? "unknown");
+    if (supportedNodeVersion(version))
+        return null;
+    const major = Number.parseInt(version, 10);
+    const detail = major === MIN_NODE_MAJOR
+        ? `This Node.js ${MIN_NODE_MAJOR} release is below Hara's supported ${MIN_NODE_VERSION} floor.`
+        : `This Node.js release is below Hara's supported ${MIN_NODE_VERSION} floor.`;
+    return [
+        `Hara requires Node.js ${MIN_NODE_VERSION} or newer (detected ${version}).`,
+        detail,
+        `Upgrade with: nvm install ${MIN_NODE_MAJOR} && nvm use ${MIN_NODE_MAJOR}`,
+        "Or install the standalone Hara binary, which does not require Node.js:",
+        "  curl -fsSL https://raw.githubusercontent.com/hara-cli/hara/main/install.sh | sh",
+    ].join("\n");
+}

package/dist/sandbox.js

@@ -1,4 +1,6 @@
-// OS sandboxing for the bash tool — WRITE CONFINEMENT, not a security jail. macOS = Seatbelt
+// OS sandboxing for the bash tool. macOS Seatbelt provides write confinement plus a narrow protected-file
+// read mask. Other reads, network, and process exec are not generally confined; non-macOS shells have only
+// Hara's command preflight and must not be described as a kernel-enforced read sandbox.
 // (sandbox-exec) restricting `file-write*` to the workspace (workspace-write) or to nothing outside
 // temp (read-only). Reads, network, and process exec are NOT restricted, and /private/tmp +
 // /private/var/folders stay writable in every mode — so this stops a stray `rm`/overwrite escaping the
@@ -6,9 +8,9 @@
 // emitted from runShell so every entry point — REPL, -p, org, cron — surfaces it). Only the `bash`
 // shell is sandboxed; hara's own file tools are in-process, explicit, and gated by the approval flow.
 import { spawn, spawnSync } from "node:child_process";
-import { writeFileSync, mkdtempSync } from "node:fs";
-import { tmpdir, platform } from "node:os";
-import { join } from "node:path";
+import { platform } from "node:os";
+import { existingSensitiveSeatbeltMasks, sensitiveFilesAllowed, sensitiveShellCommandReason, } from "./security/sensitive-files.js";
+import { terminateSubprocessTree, toolSubprocessEnv } from "./security/subprocess-env.js";
 // Windows shell resolution. hara (and the model) speak POSIX shell — the agent writes `ls`, `grep`,
 // `cat`, pipes, `&&`. So on Windows we PREFER a real bash (Git Bash or WSL, which most Windows devs
 // have) and only fall back to cmd.exe when none is found. Memoized: the PATH probe runs at most once.
@@ -34,8 +36,15 @@ export function resolveShellArgv(command, plat, bash) {
     }
     return { cmd: "/bin/sh", args: ["-c", command] };
 }
-const sbQuote = (s) => '"' + s.replace(/\\/g, "\\\\").replace(/"/g, '\\"') + '"';
+const MAX_INLINE_SEATBELT_PROFILE_BYTES = 96 * 1024;
+const sbQuote = (s) => {
+    if (/[\u0000-\u001f\u007f]/u.test(s)) {
+        throw new Error("cannot safely encode a protected path containing control characters in a Seatbelt profile");
+    }
+    return '"' + s.replace(/\\/g, "\\\\").replace(/"/g, '\\"') + '"';
+};
 function seatbeltProfile(cwd, mode) {
+    const rules = ["(version 1)", "(allow default)"];
     const writable = [
         '(literal "/dev/null")',
         '(literal "/dev/stdout")',
@@ -45,9 +54,38 @@ function seatbeltProfile(cwd, mode) {
         '(subpath "/private/tmp")',
         '(subpath "/private/var/folders")',
     ];
-    if (mode === "workspace-write")
-        writable.push(`(subpath ${sbQuote(cwd)})`);
-    return `(version 1)\n(allow default)\n(deny file-write*)\n(allow file-write*\n  ${writable.join("\n  ")})\n`;
+    if (mode !== "off") {
+        if (mode === "workspace-write")
+            writable.push(`(subpath ${sbQuote(cwd)})`);
+        rules.push(`(deny file-write*)\n(allow file-write*\n  ${writable.join("\n  ")})`);
+    }
+    const masks = existingSensitiveSeatbeltMasks(cwd);
+    const unreadable = masks.files;
+    if (unreadable.length) {
+        const literals = unreadable.map((path) => `(literal ${sbQuote(path)})`).join("\n  ");
+        rules.push(`(deny file-read*\n  ${literals})`);
+        // Protect metadata mutations too: unlink/rename/link/chmod all sit under file-write* in Seatbelt.
+        // This remains active in sandbox=off; the opt-out is the explicit launch-time secret-file waiver.
+        rules.push(`(deny file-write*\n  ${literals})`);
+    }
+    const unreadableDirs = masks.directories;
+    if (unreadableDirs.length) {
+        // `subpath` masks descendants; the paired `literal` masks rename/unlink of the directory entry itself.
+        const subpaths = unreadableDirs
+            .flatMap((path) => [`(literal ${sbQuote(path)})`, `(subpath ${sbQuote(path)})`])
+            .join("\n  ");
+        rules.push(`(deny file-read*\n  ${subpaths})`);
+        rules.push(`(deny file-write*\n  ${subpaths})`);
+    }
+    const writeContainers = masks.writeContainers;
+    if (writeContainers.length) {
+        rules.push(`(deny file-write*\n  ${writeContainers.map((path) => `(literal ${sbQuote(path)})`).join("\n  ")})`);
+    }
+    const profile = rules.join("\n") + "\n";
+    if (Buffer.byteLength(profile) > MAX_INLINE_SEATBELT_PROFILE_BYTES) {
+        throw new Error(`protected-file Seatbelt profile exceeds ${MAX_INLINE_SEATBELT_PROFILE_BYTES} bytes; refusing an incomplete or unlaunchable mask`);
+    }
+    return profile;
 }
 export function sandboxSupported() {
     return platform() === "darwin";
@@ -61,11 +99,17 @@ let warnedUnsandboxed = false; // emit the "macOS-only" notice at most once per
 /** Build the (sandboxed, when supported) argv for a shell command — shared by runShell + background jobs
  *  so the seatbelt write-confinement is identical for both. */
 export function shellCommand(command, cwd, mode) {
-    if (mode !== "off" && platform() === "darwin") {
-        const dir = mkdtempSync(join(tmpdir(), "hara-sb-"));
-        const profileFile = join(dir, "policy.sb");
-        writeFileSync(profileFile, seatbeltProfile(cwd, mode));
-        return { cmd: "sandbox-exec", args: ["-f", profileFile, "/bin/bash", "-lc", command] };
+    const protectedReason = sensitiveShellCommandReason(command, cwd);
+    if (protectedReason) {
+        throw new Error(`shell command crosses Hara's protected secret boundary (${protectedReason}). ` +
+            "Restart hara with HARA_ALLOW_SENSITIVE_FILES=1 only for an intentional, user-approved exposure.");
+    }
+    // sandbox=off still retains the narrow secret-file read mask on macOS. It places no restriction on
+    // ordinary reads/writes/network and is removed only by the explicit launch-time sensitive-file opt-in.
+    if ((mode !== "off" || !sensitiveFilesAllowed()) && platform() === "darwin") {
+        // Non-login shell: inheriting the already-scrubbed PATH is sufficient, while -l would source the
+        // user's profile again and silently re-introduce credentials we deliberately removed from env.
+        return { cmd: "sandbox-exec", args: ["-p", seatbeltProfile(cwd, mode), "/bin/bash", "-c", command] };
     }
     maybeWarnUnsandboxed(mode);
     const plat = platform();
@@ -97,54 +141,119 @@ export function runShell(command, cwd, mode, opts) {
         // https op against a private repo would otherwise sit silently until the timeout (observed as
         // "git hangs 5 minutes"). With prompts disabled it fails in seconds with a real auth error.
         // Users' credential helpers (keychain/GCM store) still work — only interactive PROMPTS are off.
-        const env = {
-            ...process.env,
+        const env = toolSubprocessEnv(process.env, {
             GIT_TERMINAL_PROMPT: process.env.GIT_TERMINAL_PROMPT ?? "0",
             GCM_INTERACTIVE: process.env.GCM_INTERACTIVE ?? "never",
-        };
-        const child = spawn(cmd, args, { cwd, env });
+        });
+        // A dedicated POSIX process group lets timeout/output-cap termination reach grandchildren (shell →
+        // node/npm → worker). Windows uses taskkill /T in terminateSubprocessTree instead.
+        const processGroup = platform() !== "win32";
+        const child = spawn(cmd, args, { cwd, env, detached: processGroup });
         let stdout = "";
         let stderr = "";
         let timedOut = false;
         let killedForSize = false;
-        const grow = (cur, add) => (cur.length < opts.maxBuffer ? cur + add : cur);
+        let done = false;
+        let receivedBytes = 0;
+        let forceIssued = false;
+        let closeBeforeForce = false;
+        let closeBeforeForceCode = null;
+        let cancelTermination;
+        const grow = (cur, add) => {
+            const remaining = opts.maxBuffer - stdout.length - stderr.length;
+            if (remaining <= 0)
+                return cur;
+            return cur + add.slice(0, remaining);
+        };
+        const hardSettle = () => {
+            // A daemon can intentionally create a new process group while retaining our pipes. We cannot signal
+            // that unknown group safely, but we can destroy our pipe ends and guarantee the API settles on time.
+            child.stdout.destroy();
+            child.stderr.destroy();
+            settle(null);
+        };
+        const stopTree = () => {
+            if (cancelTermination)
+                return;
+            cancelTermination = terminateSubprocessTree(child, {
+                processGroup,
+                graceMs: 250,
+                fallbackMs: 1_000,
+                onFallback: hardSettle,
+                onForce: () => {
+                    forceIssued = true;
+                    // A quiet descendant can let the direct shell close after TERM while remaining alive itself.
+                    // Do not claim the timed-out/capped tree is gone until the forced group kill has been issued.
+                    if (closeBeforeForce)
+                        settle(closeBeforeForceCode);
+                },
+            });
+        };
+        const settle = (code, error) => {
+            if (done)
+                return;
+            done = true;
+            clearTimeout(timer);
+            cancelTermination?.();
+            if (error) {
+                reject(Object.assign(error, { stdout, stderr }));
+                return;
+            }
+            if (killedForSize) {
+                resolve({ stdout, stderr: stderr + `\n[output truncated — exceeded ${opts.maxBuffer} bytes; process tree killed]` });
+            }
+            else if (timedOut) {
+                reject(Object.assign(new Error(`timed out after ${opts.timeout}ms`), { stdout, stderr }));
+            }
+            else if (code !== 0) {
+                reject(Object.assign(new Error(`exit code ${code}`), { stdout, stderr, code }));
+            }
+            else {
+                resolve({ stdout, stderr });
+            }
+        };
         const timer = setTimeout(() => {
             timedOut = true;
-            child.kill("SIGKILL");
+            stopTree();
         }, opts.timeout);
         // Kill a runaway command once its total output passes maxBuffer — don't let it stream GBs to the UI
         // until the timeout just because we stopped retaining the bytes.
         const checkOverflow = () => {
-            if (!killedForSize && stdout.length + stderr.length >= opts.maxBuffer) {
+            if (!killedForSize && receivedBytes > opts.maxBuffer) {
                 killedForSize = true;
-                child.kill("SIGKILL");
+                stopTree();
             }
         };
         child.stdout.on("data", (d) => {
+            if (done || timedOut || killedForSize)
+                return;
             const s = d.toString();
+            receivedBytes += d.length;
             stdout = grow(stdout, s);
-            opts.onData?.(s);
+            if (receivedBytes <= opts.maxBuffer)
+                opts.onData?.(s, "stdout");
             checkOverflow();
         });
         child.stderr.on("data", (d) => {
+            if (done || timedOut || killedForSize)
+                return;
             const s = d.toString();
+            receivedBytes += d.length;
             stderr = grow(stderr, s);
-            opts.onData?.(s);
+            if (receivedBytes <= opts.maxBuffer)
+                opts.onData?.(s, "stderr");
             checkOverflow();
         });
         child.on("error", (e) => {
-            clearTimeout(timer);
-            reject(Object.assign(e, { stdout, stderr }));
+            settle(null, e);
         });
         child.on("close", (code) => {
-            clearTimeout(timer);
-            if (killedForSize)
-                return resolve({ stdout, stderr: stderr + `\n[output truncated — exceeded ${opts.maxBuffer} bytes; process killed]` });
-            if (timedOut)
-                return reject(Object.assign(new Error(`timed out after ${opts.timeout}ms`), { stdout, stderr }));
-            if (code !== 0)
-                return reject(Object.assign(new Error(`exit code ${code}`), { stdout, stderr, code }));
-            resolve({ stdout, stderr });
+            if ((timedOut || killedForSize) && !forceIssued) {
+                closeBeforeForce = true;
+                closeBeforeForceCode = code;
+                return;
+            }
+            settle(code);
         });
     });
 }