@nanhara/hara 0.121.1 → 0.122.1

package/dist/tools/builtin.js

@@ -1,25 +1,32 @@
-import { readFile, stat } from "node:fs/promises";
 import { existsSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { resolve, isAbsolute } from "node:path";
 import { stdout as procOut } from "node:process";
 import { registerTool } from "./registry.js";
 import { runShell } from "../sandbox.js";
-import { isProbablyBinary, nearestPaths } from "../fs-walk.js";
+import { nearestPaths } from "../fs-walk.js";
 import { emitDiff } from "../diff.js";
 import { recordEdit } from "../undo.js";
-import { atomicWriteText } from "../fs-write.js";
+import { atomicWriteText, bindAtomicWritePath } from "../fs-write.js";
 import { invalidateFileCandidates } from "../context/mentions.js";
-import { BinaryFileError, streamFileSlice } from "../fs-read.js";
+import { BinaryFileError, readVerifiedRegularFileSnapshot, resolveVerifiedModelPath, streamFileSlice } from "../fs-read.js";
 import { startJob, listJobs, tailJob, killJob } from "../exec/jobs.js";
+import { sensitiveFileError, sensitiveShellCommandReason } from "../security/sensitive-files.js";
+import { createToolOutputLineRedactor, redactToolSubprocessOutput } from "../security/subprocess-env.js";
 import { hostsInCommand, isNetworkGitOp, hostFromConnectError, isConnectFailure, markHostUnreachable, isHostUnreachable, unreachableHostsSnapshot, } from "./net-reachability.js";
 const MAX = 100_000;
-/** Package installs are network-bound and routinely exceed the foreground cap. When the model omits an
- *  explicit foreground/background choice, detach these commands into the existing job system so the UI
- *  remains responsive and the agent can poll output instead of waiting five minutes for a hard kill. */
+/** Package installs are network-bound and routinely exceed the ordinary foreground cap. */
 export function isPackageInstallCommand(command) {
     return /(?:^|[;&|]\s*)(?:npm\s+(?:i|install|ci)\b|pnpm\s+(?:i|install|add)\b|yarn(?:\s+(?:install|add))?(?:\s|$)|bun\s+(?:i|install|add)\b)/i.test(command.trim());
 }
+/** Resolve a bounded foreground timeout. Installs get a longer default, but remain attached so a headless
+ * run cannot exit, kill its background child, and leave node_modules half-written. */
+export function shellTimeoutMs(command, requested) {
+    if (Number.isFinite(requested) && requested > 0) {
+        return Math.min(Math.max(Math.trunc(requested), 1_000), 3_600_000);
+    }
+    return isPackageInstallCommand(command) ? 900_000 : 300_000;
+}
 export function isNgrokTunnelCommand(command) {
     return /(?:^|[;&|]\s*)ngrok\s+(?:http|tcp|tls|start)\b/i.test(command.trim());
 }
@@ -79,7 +86,6 @@ export function capHeadTail(s, max = MAX) {
 }
 const READ_LINES = 300; // sized to stay useful under the global 24k-char tool-result context boundary
 const LINE_CAP = 2000; // chars per line before truncation (minified bundles / data lines)
-const BUFFERED_READ_BYTES = 4 * 1024 * 1024;
 /** Render a line slice of a file, cat -n style. The old read_file dumped the WHOLE file (100K-char cap,
  *  tail simply lost) — on long files that both flooded the context (~25k tokens per read, again on every
  *  re-read) and made everything past the cap unreachable. Now: line numbers (anchor for edits and for
@@ -119,20 +125,23 @@ registerTool({
     kind: "read",
     async run(input, ctx) {
         const p = abs(input.path, ctx.cwd);
+        const denied = sensitiveFileError(p, "read");
+        if (denied)
+            return denied;
         try {
-            const info = await stat(p);
-            if (info.size > BUFFERED_READ_BYTES)
-                return cap(await streamFileSlice(p, input.offset, input.limit ?? READ_LINES, { lineCap: LINE_CAP }));
-            const buf = await readFile(p);
-            if (isProbablyBinary(buf))
-                throw new BinaryFileError(p);
-            return cap(renderFileSlice(buf.toString("utf8"), input.offset, input.limit));
+            const target = resolveVerifiedModelPath(p, "read");
+            // streamFileSlice opens O_NONBLOCK, validates the same fd as a regular file, and stops after the
+            // requested window. Using it for every size removes the path-level stat→read race entirely.
+            return cap(await streamFileSlice(target, input.offset, input.limit ?? READ_LINES, {
+                lineCap: LINE_CAP,
+                protectSensitive: true,
+            }));
         }
         catch (e) {
             if (e instanceof BinaryFileError)
                 return `Error: cannot read ${input.path}: file appears binary; use an image/media-specific tool or inspect it with \`file\`.`;
             const near = nearestPaths(ctx.cwd, input.path);
-            return `Error: cannot read ${input.path}: ${e.code ?? e.message}.` + (near.length ? ` Did you mean: ${near.join(", ")}?` : "");
+            return `Error: cannot read ${input.path}: ${e.message ?? e.code}.` + (near.length ? ` Did you mean: ${near.join(", ")}?` : "");
         }
     },
 });
@@ -150,28 +159,41 @@ registerTool({
     kind: "edit",
     async run(input, ctx) {
         const p = abs(input.path, ctx.cwd);
+        const denied = sensitiveFileError(p, "write");
+        if (denied)
+            return denied;
         if (typeof input.content !== "string")
             return "Error: write_file `content` must be a string. No changes written.";
-        let prev = null;
+        let prevSnapshot = null;
+        let boundary;
         try {
-            prev = await readFile(p, "utf8");
+            boundary = bindAtomicWritePath(p, "write");
+            prevSnapshot = await readVerifiedRegularFileSnapshot(boundary.target, undefined, "write");
         }
         catch (error) {
-            if (error?.code !== "ENOENT")
-                return `Error: cannot inspect ${input.path}: ${error?.code ?? error?.message}. No changes written.`;
+            if (error?.code !== "ENOENT" || !boundary)
+                return `Error: cannot inspect ${input.path}: ${error?.message ?? error?.code}. No changes written.`;
         }
+        if (!boundary)
+            return `Error: cannot bind ${input.path} to a stable parent. No changes written.`;
+        const prev = prevSnapshot?.text ?? null;
         if (prev === input.content)
             return `Unchanged ${p} (${input.content.length} chars already match).`;
+        let committed;
         try {
-            await atomicWriteText(p, input.content, { expected: prev });
+            committed = await atomicWriteText(boundary.target, input.content, {
+                expected: prev,
+                expectedIdentity: prevSnapshot ?? undefined,
+                boundary,
+            });
         }
         catch (error) {
             return `Error: cannot write ${input.path}: ${error?.message ?? String(error)} No changes written.`;
         }
         emitDiff(input.path, prev ?? "", input.content, ctx.ui);
-        recordEdit([{ path: input.path, absPath: p, before: prev }]);
+        recordEdit([{ path: input.path, absPath: boundary.target, before: prev, beforeMode: prevSnapshot?.mode, committed, after: input.content }]);
         invalidateFileCandidates(ctx.cwd);
-        return `Wrote ${String(input.content).length} chars to ${p}`;
+        return `Wrote ${String(input.content).length} chars to ${p}` + (committed.warnings?.length ? ` Warning: ${committed.warnings.join("; ")}` : "");
     },
 });
 registerTool({
@@ -181,21 +203,26 @@ registerTool({
         type: "object",
         properties: {
             command: { type: "string" },
-            timeout_ms: { type: "number", description: "default 300000 (5 min); set explicitly for a foreground long build/transform" },
-            background: { type: "boolean", description: "run as a background job (dev server, watcher, long task). Package installs auto-background when this field and timeout_ms are omitted. Poll with the `job` tool before depending on completion." },
+            timeout_ms: { type: "number", description: "default 300000 (5 min), or 900000 (15 min) for package installs; bounded to 1s..1h" },
+            background: { type: "boolean", description: "run as a background job (dev server, watcher, long task); package installs stay foreground unless explicitly requested" },
         },
         required: ["command"],
     },
     kind: "exec",
     async run(input, ctx) {
+        const protectedReason = sensitiveShellCommandReason(String(input.command ?? ""), ctx.cwd);
+        if (protectedReason) {
+            return (`Blocked: shell command crosses Hara's protected secret boundary (${protectedReason}). ` +
+                "This deny is not bypassed by full-auto. Restart hara with HARA_ALLOW_SENSITIVE_FILES=1 only for an intentional, user-approved exposure.");
+        }
         if (isNgrokTunnelCommand(input.command) && !ngrokAuthConfigured()) {
             return ("Skipped ngrok tunnel: no authentication was found in NGROK_AUTHTOKEN/NGROK_API_KEY or the standard ngrok config files. " +
                 "Configure ngrok authentication first, then retry. Do not rotate through other tunnel providers blindly; ask the user which authenticated provider to use.");
         }
-        const autoPackageJob = input.background === undefined && input.timeout_ms === undefined && isPackageInstallCommand(input.command);
-        if (input.background || autoPackageJob) {
+        if (input.background) {
             const id = startJob(input.command, ctx.cwd, ctx.sandbox ?? "off");
-            return `${autoPackageJob ? "Package install auto-started" : "Started"} background job ${id}: \`${input.command}\`. Manage with the \`job\` tool — {action:"tail",id:"${id}"} for output, {action:"kill",id:"${id}"} to stop, {action:"list"} for all. Poll until it exits before running steps that depend on installed packages.`;
+            const safeCommand = redactToolSubprocessOutput(String(input.command));
+            return `Started background job ${id}: \`${safeCommand}\`. Manage with the \`job\` tool — {action:"tail",id:"${id}"} for output, {action:"kill",id:"${id}"} to stop, {action:"list"} for all. Poll until it exits before running steps that depend on it.`;
         }
         // Network fault tolerance — short-circuit if this command targets a host already found unreachable this
         // session, so a repeat doesn't burn another ~75s OS connect timeout. Only pays the git-remote lookup
@@ -213,37 +240,38 @@ registerTool({
                 return `Skipped without running: host "${blocked}" already failed to connect earlier in THIS session — hara does not retry network operations to a host known unreachable this session (a retry just hangs ~75s again). Do not swap in a public mirror (won't serve private repos) or switch protocols; diagnose instead.${proxyHint(blocked)}`;
             }
         }
-        let buf = ""; // TUI: line-buffer live output into the sink (one notice per line)
-        const live = ctx.ui
-            ? (s) => {
-                buf += s;
-                let i;
-                while ((i = buf.indexOf("\n")) >= 0) {
-                    ctx.ui.notice(buf.slice(0, i));
-                    buf = buf.slice(i + 1);
-                }
-            }
+        const liveEmit = ctx.ui
+            ? (line) => ctx.ui.notice(line.replace(/\r?\n$/, ""))
             : procOut.isTTY
-                ? (s) => procOut.write(s) // stream output in a plain terminal
-                : undefined;
+                ? (line) => procOut.write(line)
+                : null;
+        // stdout/stderr are independent byte streams. A shared partial-line buffer could splice stderr into
+        // the middle of a stdout credential and defeat exact-value redaction in the live UI.
+        const liveStdout = liveEmit ? createToolOutputLineRedactor(liveEmit) : null;
+        const liveStderr = liveEmit ? createToolOutputLineRedactor(liveEmit) : null;
+        const live = liveEmit
+            ? (s, stream) => (stream === "stdout" ? liveStdout : liveStderr).push(s)
+            : undefined;
+        const flushLive = () => { liveStdout?.flush(); liveStderr?.flush(); };
+        const timeout = shellTimeoutMs(input.command, input.timeout_ms);
         try {
             const { stdout, stderr } = await runShell(input.command, ctx.cwd, ctx.sandbox ?? "off", {
-                timeout: input.timeout_ms ?? 300_000, // was 120s — a long file transform/build legitimately runs longer
+                timeout,
                 maxBuffer: 10 * 1024 * 1024,
                 onData: live,
             });
-            if (ctx.ui && buf)
-                ctx.ui.notice(buf); // flush trailing partial line
+            flushLive();
             const combined = (stdout || "") + (stderr ? `\n[stderr]\n${stderr}` : "");
-            return capHeadTail(combined.trim() || "(no output)");
+            return capHeadTail(redactToolSubprocessOutput(combined.trim() || "(no output)"));
         }
         catch (e) {
+            flushLive();
             let base = `Command failed: ${e.message}\n${e.stdout || ""}${e.stderr || ""}`;
             // Timeout gets an ACTIONABLE next step, not just a corpse — the model (and user) should pick a
             // lane instead of blind-retrying into the same wall.
             if (/timed out after \d+ms/.test(String(e.message))) {
                 base +=
-                    `\n⏱ hara: the command hit its ${input.timeout_ms ?? 300_000}ms cap and was killed. Pick ONE: ` +
+                    `\n⏱ hara: the command hit its ${timeout}ms cap and was killed. Pick ONE: ` +
                         `a long build/transform → re-run with a larger timeout_ms; a server/watcher → background:true; ` +
                         `a network op (git/curl/npm) → do NOT just retry — check connectivity/proxy or skip this step and tell the user.`;
             }
@@ -256,10 +284,10 @@ registerTool({
                 if (host) {
                     markHostUnreachable(host);
                     ctx.ui?.notice(`↯ ${host} marked unreachable for this session — won't retry network ops to it`);
-                    return capHeadTail(base + proxyHint(host));
+                    return capHeadTail(redactToolSubprocessOutput(base + proxyHint(host)));
                 }
             }
-            return capHeadTail(base);
+            return capHeadTail(redactToolSubprocessOutput(base));
         }
     },
 });
@@ -282,14 +310,14 @@ registerTool({
             const js = listJobs();
             if (!js.length)
                 return "(no background jobs)";
-            return js.map((j) => `${j.id}  [${j.status}${j.code != null ? " " + j.code : ""}]  ${Math.round(j.ageMs / 1000)}s  ${j.command}`).join("\n");
+            return js.map((j) => `${j.id}  [${j.status}${j.code != null ? " " + j.code : ""}]  ${Math.round(j.ageMs / 1000)}s  ${redactToolSubprocessOutput(j.command)}`).join("\n");
         }
         const id = String(input.id ?? "");
         if (!id)
             return "Error: `id` is required for tail/kill.";
         if (action === "tail") {
             const t = tailJob(id, Number(input.lines) || 40);
-            return t == null ? `No job ${id}.` : t.trim() || "(no output yet)";
+            return t == null ? `No job ${id}.` : redactToolSubprocessOutput(t.trim() || "(no output yet)");
         }
         if (action === "kill")
             return killJob(id) ? `Killed ${id}.` : `No running job ${id} (already exited/killed or unknown).`;

package/dist/tools/codebase.js

@@ -72,7 +72,9 @@ registerTool({
         // to pure lexical when no index/embedder — zero behaviour change for the default install.
         const out = [];
         const seen = new Set();
-        const cfg = loadConfig();
+        // Tool execution can be dispatched to a registered agent home without changing process.cwd(). Its
+        // semantic-search provider/index settings belong to the tool context, not to the launcher directory.
+        const cfg = loadConfig({ cwd: ctx.cwd });
         const embed = getEmbedder(cfg);
         if (embed && indexExists("repo", ctx.cwd)) {
             try {

package/dist/tools/computer.js

@@ -284,98 +284,104 @@ export function computerBackends() {
         return "PowerShell (built-in)";
     return `unsupported (${process.platform})`;
 }
-registerTool({
-    name: "computer",
-    description: "Control the screen to operate desktop software (not just the browser). ALWAYS `activate` the target app " +
-        "FIRST (e.g. activate WeChat) — otherwise screenshots/clicks hit the terminal hara runs in, not the app. " +
-        "Then prefer grounding over guessing pixels: pass `target` (e.g. 'the Send button') to click/move and it's " +
-        "located by a vision model; or `find` to just get coordinates. Workflow: activate → screenshot → click a " +
-        "target → re-screenshot to verify. When typing, type the ACTUAL text — never placeholders. Opt-in and " +
-        "permission-gated (tier + per-app allowlist).",
-    input_schema: {
-        type: "object",
-        properties: {
-            action: { type: "string", enum: ["screenshot", "activate", "find", "click", "move", "type", "key"] },
-            app: { type: "string", description: "app to bring to the foreground (activate) — e.g. 'WeChat'. Do this BEFORE screenshot/click so they hit the app, not the terminal." },
-            target: { type: "string", description: "describe a UI element to locate (find) or click/move to — e.g. 'the Send button'. Preferred over x,y." },
-            x: { type: "number", description: "x pixel (click/move; or use `target`)" },
-            y: { type: "number", description: "y pixel (click/move; or use `target`)" },
-            text: { type: "string", description: "text to type (type)" },
-            keys: { type: "string", description: "key or combo, e.g. 'return', 'cmd+c' (key)" },
-            focus: { type: "string", description: "screenshot only: what to look for — focuses the read" },
+// Gateway runs get NO computer tool by default (HARA_GATEWAY_COMPUTER=1 opts back in): a chat-driven, full-auto
+// agent reaching for desktop automation is how "check Feishu" turns into blindly clicking another app's windows.
+// In a gateway context the right lever is an API/skill, and send_file already covers delivery — so the safe
+// default is to not offer screen control at all rather than trust the model to decline it.
+if (!process.env.HARA_GATEWAY || process.env.HARA_GATEWAY_COMPUTER === "1") {
+    registerTool({
+        name: "computer",
+        description: "Control the screen to operate desktop software (not just the browser). ALWAYS `activate` the target app " +
+            "FIRST (e.g. activate WeChat) — otherwise screenshots/clicks hit the terminal hara runs in, not the app. " +
+            "Then prefer grounding over guessing pixels: pass `target` (e.g. 'the Send button') to click/move and it's " +
+            "located by a vision model; or `find` to just get coordinates. Workflow: activate → screenshot → click a " +
+            "target → re-screenshot to verify. When typing, type the ACTUAL text — never placeholders. Opt-in and " +
+            "permission-gated (tier + per-app allowlist).",
+        input_schema: {
+            type: "object",
+            properties: {
+                action: { type: "string", enum: ["screenshot", "activate", "find", "click", "move", "type", "key"] },
+                app: { type: "string", description: "app to bring to the foreground (activate) — e.g. 'WeChat'. Do this BEFORE screenshot/click so they hit the app, not the terminal." },
+                target: { type: "string", description: "describe a UI element to locate (find) or click/move to — e.g. 'the Send button'. Preferred over x,y." },
+                x: { type: "number", description: "x pixel (click/move; or use `target`)" },
+                y: { type: "number", description: "y pixel (click/move; or use `target`)" },
+                text: { type: "string", description: "text to type (type)" },
+                keys: { type: "string", description: "key or combo, e.g. 'return', 'cmd+c' (key)" },
+                focus: { type: "string", description: "screenshot only: what to look for — focuses the read" },
+            },
+            required: ["action"],
         },
-        required: ["action"],
-    },
-    kind: "computer",
-    async run(input, ctx) {
-        const cfg = loadConfig();
-        const tier = cfg.computerUse;
-        if (tier === "off")
-            return "Screen control is off. Enable it: `hara config set computerUse read|click|full` (and `hara config set computerApps \"App Name, …\"` for the click/type allowlist).";
-        const action = String(input.action ?? "");
-        if (!actionAllowed(tier, action))
-            return `'${action}' needs a higher tier (current computerUse=${tier}). Raise it with \`hara config set computerUse …\`.`;
-        // Bring the target app to the foreground first — without this, clicks land on the terminal hara runs in.
-        if (action === "activate") {
-            const app = String(input.app ?? input.target ?? "");
-            if (!app)
-                return "activate needs an `app` name (e.g. 'WeChat').";
-            if (!cfg.computerApps.some((a) => a.toLowerCase() === app.toLowerCase()))
-                return `Refused: "${app}" isn't in your allowlist (${cfg.computerApps.join(", ") || "empty"}). Add it: \`hara config set computerApps "${app}"\`.`;
-            const r = activateApp(app);
-            return r.ok ? ok(`✓ ${r.msg} — now screenshot/find/click to act on it`) : fail(r.msg);
-        }
-        if (action !== "screenshot" && action !== "find") {
-            // per-app allowlist: only act when an allowlisted app is frontmost (the key guard against wrong-window clicks)
-            if (!cfg.computerApps.length)
-                return "No apps allowlisted — set `hara config set computerApps \"App Name, …\"` before clicking/typing.";
-            const app = frontmostApp();
-            const allowed = cfg.computerApps.some((a) => a.toLowerCase() === app.toLowerCase());
-            if (!allowed)
-                return `Refused: frontmost app "${app || "unknown"}" isn't in your allowlist (${cfg.computerApps.join(", ")}). Switch to an allowed app or update computerApps.`;
-        }
-        if (action === "screenshot") {
-            const s = screenshot();
-            if (s.error)
-                return fail(`screenshot — ${s.error}`);
-            if (ctx.describeImage) {
-                try {
-                    const desc = await ctx.describeImage(s.path, input.focus ? String(input.focus) : undefined);
-                    if (desc)
-                        return ok(`Screenshot (read via vision):\n${desc}`);
-                }
-                catch {
-                    /* fall through to path */
+        kind: "computer",
+        async run(input, ctx) {
+            const cfg = loadConfig();
+            const tier = cfg.computerUse;
+            if (tier === "off")
+                return "Screen control is off. Enable it: `hara config set computerUse read|click|full` (and `hara config set computerApps \"App Name, …\"` for the click/type allowlist).";
+            const action = String(input.action ?? "");
+            if (!actionAllowed(tier, action))
+                return `'${action}' needs a higher tier (current computerUse=${tier}). Raise it with \`hara config set computerUse …\`.`;
+            // Bring the target app to the foreground first — without this, clicks land on the terminal hara runs in.
+            if (action === "activate") {
+                const app = String(input.app ?? input.target ?? "");
+                if (!app)
+                    return "activate needs an `app` name (e.g. 'WeChat').";
+                if (!cfg.computerApps.some((a) => a.toLowerCase() === app.toLowerCase()))
+                    return `Refused: "${app}" isn't in your allowlist (${cfg.computerApps.join(", ") || "empty"}). Add it: \`hara config set computerApps "${app}"\`.`;
+                const r = activateApp(app);
+                return r.ok ? ok(`✓ ${r.msg} — now screenshot/find/click to act on it`) : fail(r.msg);
+            }
+            if (action !== "screenshot" && action !== "find") {
+                // per-app allowlist: only act when an allowlisted app is frontmost (the key guard against wrong-window clicks)
+                if (!cfg.computerApps.length)
+                    return "No apps allowlisted — set `hara config set computerApps \"App Name, …\"` before clicking/typing.";
+                const app = frontmostApp();
+                const allowed = cfg.computerApps.some((a) => a.toLowerCase() === app.toLowerCase());
+                if (!allowed)
+                    return `Refused: frontmost app "${app || "unknown"}" isn't in your allowlist (${cfg.computerApps.join(", ")}). Switch to an allowed app or update computerApps.`;
+            }
+            if (action === "screenshot") {
+                const s = screenshot();
+                if (s.error)
+                    return fail(`screenshot — ${s.error}`);
+                if (ctx.describeImage) {
+                    try {
+                        const desc = await ctx.describeImage(s.path, input.focus ? String(input.focus) : undefined);
+                        if (desc)
+                            return ok(`Screenshot (read via vision):\n${desc}`);
+                    }
+                    catch {
+                        /* fall through to path */
+                    }
                 }
+                return ok(`Screenshot saved to ${s.path}. Configure a vision model so I can read it: \`hara config set visionModel <model>\`.`);
             }
-            return ok(`Screenshot saved to ${s.path}. Configure a vision model so I can read it: \`hara config set visionModel <model>\`.`);
-        }
-        // Grounding: locate a described element and turn it into screen coordinates (more reliable than guessing
-        // pixels from a text description). Used for `find`, and for click/move when given a `target` and no x,y.
-        const needsLocate = action === "find" || ((action === "click" || action === "move") && input.target != null && (input.x == null || input.y == null));
-        if (needsLocate) {
-            const target = String(input.target ?? "");
-            if (!target)
-                return action === "find" ? "find needs a `target` (what to locate)." : "click/move needs `x,y` or a `target`.";
-            if (!ctx.locate)
-                return "Grounding needs a vision model that can see images — set one: `hara config set visionModel <model>`.";
-            const s = screenshot();
-            if (s.error)
-                return fail(`screenshot — ${s.error}`);
-            const loc = await ctx.locate(s.path, target);
-            if (!loc)
-                return fail(`couldn't locate "${target}" on screen — try a screenshot first, or rephrase the target`);
-            const size = screenSize();
-            if (!size)
-                return fail(`located "${target}" but couldn't read the screen size to convert coordinates`);
-            const gx = Math.round(loc.x * size.w);
-            const gy = Math.round(loc.y * size.h);
-            if (action === "find")
-                return ok(`"${target}" is at ~${gx},${gy} (${Math.round(loc.x * 100)}% across, ${Math.round(loc.y * 100)}% down).`);
-            input.x = gx;
-            input.y = gy;
-        }
-        const r = pointerOrKeyboard(action, input);
-        return r.ok ? ok(`✓ ${r.msg}${needsLocate ? ` (located "${input.target}")` : ""}`) : fail(r.msg);
-    },
-});
+            // Grounding: locate a described element and turn it into screen coordinates (more reliable than guessing
+            // pixels from a text description). Used for `find`, and for click/move when given a `target` and no x,y.
+            const needsLocate = action === "find" || ((action === "click" || action === "move") && input.target != null && (input.x == null || input.y == null));
+            if (needsLocate) {
+                const target = String(input.target ?? "");
+                if (!target)
+                    return action === "find" ? "find needs a `target` (what to locate)." : "click/move needs `x,y` or a `target`.";
+                if (!ctx.locate)
+                    return "Grounding needs a vision model that can see images — set one: `hara config set visionModel <model>`.";
+                const s = screenshot();
+                if (s.error)
+                    return fail(`screenshot — ${s.error}`);
+                const loc = await ctx.locate(s.path, target);
+                if (!loc)
+                    return fail(`couldn't locate "${target}" on screen — try a screenshot first, or rephrase the target`);
+                const size = screenSize();
+                if (!size)
+                    return fail(`located "${target}" but couldn't read the screen size to convert coordinates`);
+                const gx = Math.round(loc.x * size.w);
+                const gy = Math.round(loc.y * size.h);
+                if (action === "find")
+                    return ok(`"${target}" is at ~${gx},${gy} (${Math.round(loc.x * 100)}% across, ${Math.round(loc.y * 100)}% down).`);
+                input.x = gx;
+                input.y = gy;
+            }
+            const r = pointerOrKeyboard(action, input);
+            return r.ok ? ok(`✓ ${r.msg}${needsLocate ? ` (located "${input.target}")` : ""}`) : fail(r.msg);
+        },
+    });
+}

package/dist/tools/cron.js

@@ -10,6 +10,7 @@ import { parseSchedule, describeSchedule, nextRun, validTz } from "../cron/sched
 import { runJobOnce } from "../cron/runner.js";
 import { parseDeliver } from "../cron/deliver.js";
 import { isInstalled } from "../cron/install.js";
+import { sensitiveShellCommandReason } from "../security/sensitive-files.js";
 const fmt = (ms) => (ms ? new Date(ms).toLocaleString() : "—");
 registerTool({
     name: "cronjob",
@@ -70,6 +71,11 @@ registerTool({
                     return `Error: ${d.error}`;
             }
             const mode = input.mode === "org" || input.mode === "command" ? input.mode : "print";
+            if (mode === "command") {
+                const denied = sensitiveShellCommandReason(task, ctx.cwd);
+                if (denied)
+                    return `Error: scheduled shell command crosses Hara's protected secret boundary (${denied}).`;
+            }
             const job = addJob({
                 name: input.name ? String(input.name) : task.slice(0, 48),
                 schedule: sched,

package/dist/tools/edit.js

@@ -1,12 +1,13 @@
-import { readFile } from "node:fs/promises";
 import { isAbsolute, resolve } from "node:path";
 import { registerTool } from "./registry.js";
 import { nearestPaths } from "../fs-walk.js";
 import { emitDiff } from "../diff.js";
 import { applyEdits } from "./apply-core.js";
 import { recordEdit } from "../undo.js";
-import { atomicWriteText } from "../fs-write.js";
+import { atomicWriteText, bindAtomicWritePath } from "../fs-write.js";
 import { invalidateFileCandidates } from "../context/mentions.js";
+import { readVerifiedRegularFileSnapshot } from "../fs-read.js";
+import { sensitiveFileError } from "../security/sensitive-files.js";
 registerTool({
     name: "edit_file",
     description: "Edit an existing file by replacing exact strings. Provide a single `old_string`/`new_string`, " +
@@ -41,31 +42,43 @@ registerTool({
     kind: "edit",
     async run(input, ctx) {
         const p = isAbsolute(input.path) ? input.path : resolve(ctx.cwd, input.path);
+        const denied = sensitiveFileError(p, "edit");
+        if (denied)
+            return denied;
         const edits = Array.isArray(input.edits) && input.edits.length
             ? input.edits
             : [{ old_string: input.old_string, new_string: input.new_string, replace_all: input.replace_all }];
-        let text;
+        let snapshot;
+        let boundary;
         try {
-            text = await readFile(p, "utf8");
+            boundary = bindAtomicWritePath(p, "edit");
+            snapshot = await readVerifiedRegularFileSnapshot(boundary.target, undefined, "edit");
         }
-        catch {
+        catch (error) {
             const near = nearestPaths(ctx.cwd, input.path);
-            return `Error: cannot read ${input.path} (use write_file to create a new file).` + (near.length ? ` Did you mean: ${near.join(", ")}?` : "");
+            return `Error: cannot read ${input.path}: ${error?.message ?? "unknown error"} (use write_file to create a new file).` + (near.length ? ` Did you mean: ${near.join(", ")}?` : "");
         }
+        const text = snapshot.text;
         const res = applyEdits(text, edits);
         if ("error" in res)
             return `Error: ${res.error} in ${input.path}. No changes written.`;
+        let committed;
         try {
-            await atomicWriteText(p, res.text, { expected: text });
+            committed = await atomicWriteText(boundary.target, res.text, {
+                expected: text,
+                expectedIdentity: snapshot,
+                boundary,
+            });
         }
         catch (error) {
             return `Error: cannot edit ${input.path}: ${error?.message ?? String(error)} No changes written.`;
         }
         emitDiff(input.path, text, res.text, ctx.ui);
-        recordEdit([{ path: input.path, absPath: p, before: text }]);
+        recordEdit([{ path: input.path, absPath: boundary.target, before: text, beforeMode: snapshot.mode, committed, after: res.text }]);
         invalidateFileCandidates(ctx.cwd);
         const note = res.fuzzy ? " (quote-normalized)" : "";
         const plural = (n, w) => `${n} ${w}${n === 1 ? "" : "s"}`;
-        return `Edited ${input.path}: ${plural(edits.length, "edit")}, ${plural(res.total, "replacement")}${note}.`;
+        return `Edited ${input.path}: ${plural(edits.length, "edit")}, ${plural(res.total, "replacement")}${note}.` +
+            (committed.warnings?.length ? ` Warning: ${committed.warnings.join("; ")}` : "");
     },
 });