@nanhara/hara 0.121.1 → 0.122.1

package/dist/config.js

@@ -1,6 +1,9 @@
 import { homedir } from "node:os";
 import { join, dirname, resolve } from "node:path";
-import { readFileSync, writeFileSync, existsSync, mkdirSync, chmodSync } from "node:fs";
+import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from "node:fs";
+import { ensurePrivateHaraState } from "./security/private-state.js";
+import { readVerifiedRegularFileSnapshotSync } from "./fs-read.js";
+import { projectRepositoryTrustedAtStartup } from "./security/project-trust.js";
 const PROVIDER_DEFAULTS = {
     anthropic: { model: "claude-opus-4-8", envKey: "ANTHROPIC_API_KEY" },
     qwen: {
@@ -35,21 +38,90 @@ export const REASONING_EFFORTS = ["off", "low", "medium", "high", "max"];
 export const APPROVAL_MODES = ["suggest", "auto-edit", "full-auto"];
 export const SANDBOX_MODES = ["off", "workspace-write", "read-only"];
 const PROJECT_ROOT_MARKERS = [".git", "package.json", "Cargo.toml", "go.mod", "pyproject.toml", ".hg"];
+const MAX_PROJECT_CONFIG_BYTES = 256 * 1024;
+const KNOWN_CONFIG_KEYS = new Set([
+    ...CONFIG_KEYS,
+    "hooks", "mcpServers", "modelVision", "overlays", "profiles",
+]);
+/** Deliberately narrow: these keys change presentation/model preference, but cannot redirect credentials,
+ * execute code, grant tools more authority, or disable a safety layer. Everything else requires a launch-
+ * time trust decision so cloning/chdir into a repository never silently changes the process trust boundary. */
+const SAFE_PROJECT_CONFIG_KEYS = new Set(["model", "theme", "vimMode", "autoCompact", "reasoningEffort"]);
+const projectConfigWarnings = new Set();
+function printableConfigKeys(keys) {
+    // A repository controls JSON property names too. Only schema names are safe diagnostics; an unknown key
+    // may itself contain a copied token and must never be treated as printable metadata.
+    const safe = [...new Set(keys.map((key) => (KNOWN_CONFIG_KEYS.has(key) ? key : "<unknown-key>")))].sort();
+    const shown = safe.slice(0, 32);
+    return `${shown.join(", ")}${safe.length > shown.length ? `, … (+${safe.length - shown.length})` : ""}`;
+}
+function warnProjectConfig(kind, message) {
+    if (projectConfigWarnings.has(kind))
+        return;
+    projectConfigWarnings.add(kind);
+    try {
+        process.stderr.write(`hara: ${message}\n`);
+    }
+    catch { /* best effort */ }
+}
+function validSafeProjectValue(key, value) {
+    if (key === "model")
+        return typeof value === "string" && value.trim().length > 0 && value.length <= 256 && !/[\u0000-\u001f\u007f]/.test(value);
+    if (key === "theme")
+        return value === "dark" || value === "light";
+    if (key === "reasoningEffort")
+        return REASONING_EFFORTS.includes(value);
+    if (key === "vimMode" || key === "autoCompact")
+        return typeof value === "boolean" || value === "true" || value === "false";
+    return false;
+}
+function filterProjectConfig(input) {
+    const blocked = Object.keys(input).filter((key) => !SAFE_PROJECT_CONFIG_KEYS.has(key));
+    if (projectRepositoryTrustedAtStartup()) {
+        if (blocked.length) {
+            const names = printableConfigKeys(blocked);
+            warnProjectConfig(`trusted:${names}`, `trusted project config enabled for privileged key(s): ${names}.`);
+        }
+        return input;
+    }
+    if (blocked.length) {
+        const names = printableConfigKeys(blocked);
+        warnProjectConfig(`ignored:${names}`, `ignored untrusted project config key(s): ${names}. Set HARA_TRUST_PROJECT_CONFIG=1 before starting hara only for a repository you trust.`);
+    }
+    const invalid = Object.entries(input)
+        .filter(([key, value]) => SAFE_PROJECT_CONFIG_KEYS.has(key) && !validSafeProjectValue(key, value))
+        .map(([key]) => key);
+    if (invalid.length) {
+        const names = printableConfigKeys(invalid);
+        warnProjectConfig(`invalid-safe:${names}`, `ignored invalid project config value(s) for key(s): ${names}.`);
+    }
+    return Object.fromEntries(Object.entries(input).filter(([key, value]) => (SAFE_PROJECT_CONFIG_KEYS.has(key) && validSafeProjectValue(key, value))));
+}
 export function configPath() {
     return join(homedir(), ".hara", "config.json");
 }
+function configRecord(value) {
+    return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
 export function readRawConfig() {
+    ensurePrivateHaraState();
     const p = configPath();
     if (!existsSync(p))
         return {};
     try {
-        return JSON.parse(readFileSync(p, "utf8"));
+        return configRecord(JSON.parse(readFileSync(p, "utf8")));
     }
     catch {
         return {};
     }
 }
-const ROUTING_CONFIG_KEYS = new Set(["provider", "apiKey", "model", "baseURL"]);
+const ROUTING_CONFIG_KEYS = new Set([
+    "provider", "apiKey", "model", "baseURL",
+    "fallbackProvider", "fallbackApiKey", "fallbackModel", "fallbackBaseURL",
+    "visionApiKey", "visionModel", "visionBaseURL",
+    "embedProvider", "embedApiKey", "embedModel", "embedBaseURL",
+    "routeApiKey", "routeModel", "routeBaseURL",
+]);
 /** Empty routing values are not meaningful credentials/endpoints. Ignore them at each precedence layer so
  *  an empty project override (or launcher-exported empty env var) cannot hide a valid global config value. */
 function withoutBlankRoutingValues(input) {
@@ -71,17 +143,78 @@ function nonBlankEnv(value) {
     const trimmed = value?.trim();
     return trimmed || undefined;
 }
-/** Nearest project override `.hara/config.json`, searching cwd up to the repo root. */
+function projectConfigReadFailure(kind) {
+    warnProjectConfig(`unsafe-file:${kind}`, `ignored an unsafe project .hara/config.json (${kind}); no project values were loaded.`);
+    return {};
+}
+/** Nearest project override `.hara/config.json`, searching a canonical cwd up to the repo root. Project
+ * configuration is repository input, not private Hara state: its `.hara` parent and final entry must remain
+ * ordinary single-link filesystem objects while a bounded O_NOFOLLOW descriptor is read. */
 function readProjectConfig(cwd) {
-    let dir = resolve(cwd);
+    let dir;
+    try {
+        dir = realpathSync.native(resolve(cwd));
+    }
+    catch {
+        dir = resolve(cwd);
+    }
     for (;;) {
-        const p = join(dir, ".hara", "config.json");
-        if (existsSync(p)) {
-            try {
-                return JSON.parse(readFileSync(p, "utf8"));
-            }
-            catch {
-                return {};
+        const hara = join(dir, ".hara");
+        const p = join(hara, "config.json");
+        let haraInfo;
+        try {
+            haraInfo = lstatSync(hara);
+        }
+        catch (error) {
+            if (error?.code !== "ENOENT")
+                return projectConfigReadFailure("unreadable parent");
+        }
+        if (haraInfo) {
+            if (haraInfo.isSymbolicLink())
+                return projectConfigReadFailure("symlink parent");
+            if (haraInfo.isDirectory()) {
+                let fileInfo;
+                try {
+                    const canonicalParent = realpathSync.native(hara);
+                    if (canonicalParent !== hara)
+                        return projectConfigReadFailure("non-canonical parent");
+                    fileInfo = lstatSync(p);
+                }
+                catch (error) {
+                    if (error?.code !== "ENOENT")
+                        return projectConfigReadFailure("unreadable file");
+                }
+                if (fileInfo) {
+                    if (fileInfo.isSymbolicLink())
+                        return projectConfigReadFailure("symlink file");
+                    if (!fileInfo.isFile())
+                        return projectConfigReadFailure("non-regular file");
+                    try {
+                        const snapshot = readVerifiedRegularFileSnapshotSync(p, MAX_PROJECT_CONFIG_BYTES, {
+                            action: "read project config",
+                            protectSensitive: false,
+                            rejectHardLinks: true,
+                        });
+                        const parentAfter = lstatSync(hara);
+                        if (!parentAfter.isDirectory()
+                            || parentAfter.isSymbolicLink()
+                            || parentAfter.dev !== haraInfo.dev
+                            || parentAfter.ino !== haraInfo.ino
+                            || realpathSync.native(hara) !== hara)
+                            return projectConfigReadFailure("changed parent");
+                        return filterProjectConfig(configRecord(JSON.parse(snapshot.text)));
+                    }
+                    catch (error) {
+                        if (error?.code === "HARA_HARD_LINKED_FILE")
+                            return projectConfigReadFailure("hard-linked file");
+                        if (error?.code === "HARA_FILE_TOO_LARGE")
+                            return projectConfigReadFailure("oversized file");
+                        if (/changed while (?:opening|reading)|File changed/i.test(error?.message ?? "")) {
+                            return projectConfigReadFailure("changed file");
+                        }
+                        return projectConfigReadFailure("invalid file");
+                    }
+                }
             }
         }
         if (PROJECT_ROOT_MARKERS.some((m) => existsSync(join(dir, m))))
@@ -95,7 +228,12 @@ function readProjectConfig(cwd) {
 }
 /** Write the config 0600 (it can hold `apiKey`) + tighten an existing file. */
 function persistConfig(p, cfg) {
-    mkdirSync(dirname(p), { recursive: true });
+    ensurePrivateHaraState();
+    mkdirSync(dirname(p), { recursive: true, mode: 0o700 });
+    try {
+        chmodSync(dirname(p), 0o700);
+    }
+    catch { /* best effort */ }
     writeFileSync(p, JSON.stringify(cfg, null, 2) + "\n", { encoding: "utf8", mode: 0o600 });
     try {
         chmodSync(p, 0o600);
@@ -123,7 +261,7 @@ export function setModelVisionOverride(model, cap) {
     persistConfig(p, cfg);
 }
 /**
- * Effective config. Precedence (high→low): env vars > project `.hara/config.json` >
+ * Effective config. Precedence (high→low): env vars > allowed/trusted project `.hara/config.json` >
  * named overlay (`overlays.<name>` in global config) > global `~/.hara/config.json`
  * > provider defaults.
  *
@@ -139,14 +277,15 @@ export function loadConfig(opts = {}) {
     // Strip both the new (`overlays`) and legacy (`profiles`) overlay containers from the base merge.
     // The legacy `profiles` key is kept readable for back-compat with users who already have it.
     const { overlays, profiles, ...globalBase } = global;
-    const project = readProjectConfig(process.cwd());
-    const overlayName = process.env.HARA_OVERLAY ?? opts.overlay;
+    const effectiveCwd = resolve(opts.cwd ?? process.cwd());
+    const project = readProjectConfig(effectiveCwd);
+    const overlayName = nonBlankEnv(process.env.HARA_OVERLAY) ?? nonBlankEnv(opts.overlay);
     const overlayMap = overlays && typeof overlays === "object" ? overlays : profiles && typeof profiles === "object" ? profiles : null;
-    const overlay = overlayName && overlayMap && overlayMap[overlayName] ? overlayMap[overlayName] : {};
+    const overlay = configRecord(overlayName && overlayMap ? overlayMap[overlayName] : undefined);
     const merged = {
         ...withoutBlankRoutingValues(globalBase),
-        ...withoutBlankRoutingValues(project),
         ...withoutBlankRoutingValues(overlay),
+        ...withoutBlankRoutingValues(project),
     };
     const provider = (nonBlankEnv(process.env.HARA_PROVIDER) ?? merged.provider ?? "anthropic");
     const d = PROVIDER_DEFAULTS[provider] ?? PROVIDER_DEFAULTS.anthropic;
@@ -160,21 +299,21 @@ export function loadConfig(opts = {}) {
     const assetCapture = (process.env.HARA_ASSET_CAPTURE ?? merged.assetCapture ?? "ask");
     const computerUse = (process.env.HARA_COMPUTER_USE ?? merged.computerUse ?? "off");
     const computerApps = String(process.env.HARA_COMPUTER_APPS ?? merged.computerApps ?? "").split(",").map((s) => s.trim()).filter(Boolean);
-    const visionModel = process.env.HARA_VISION_MODEL ?? merged.visionModel;
-    const visionBaseURL = process.env.HARA_VISION_BASE_URL ?? merged.visionBaseURL;
-    const visionApiKey = process.env.HARA_VISION_API_KEY ?? merged.visionApiKey;
+    const visionModel = nonBlankEnv(process.env.HARA_VISION_MODEL) ?? merged.visionModel;
+    const visionBaseURL = nonBlankEnv(process.env.HARA_VISION_BASE_URL) ?? merged.visionBaseURL;
+    const visionApiKey = nonBlankEnv(process.env.HARA_VISION_API_KEY) ?? merged.visionApiKey;
     const modelVision = merged.modelVision && typeof merged.modelVision === "object" ? merged.modelVision : {};
-    const embedProvider = (process.env.HARA_EMBED_PROVIDER ?? merged.embedProvider ?? "off");
-    const embedModel = process.env.HARA_EMBED_MODEL ?? merged.embedModel;
-    const embedBaseURL = process.env.HARA_EMBED_BASE_URL ?? merged.embedBaseURL;
-    const embedApiKey = process.env.HARA_EMBED_API_KEY ?? merged.embedApiKey;
-    const routeModel = process.env.HARA_ROUTE_MODEL ?? merged.routeModel;
-    const routeBaseURL = process.env.HARA_ROUTE_BASE_URL ?? merged.routeBaseURL;
-    const routeApiKey = process.env.HARA_ROUTE_API_KEY ?? merged.routeApiKey;
+    const embedProvider = (nonBlankEnv(process.env.HARA_EMBED_PROVIDER) ?? merged.embedProvider ?? "off");
+    const embedModel = nonBlankEnv(process.env.HARA_EMBED_MODEL) ?? merged.embedModel;
+    const embedBaseURL = nonBlankEnv(process.env.HARA_EMBED_BASE_URL) ?? merged.embedBaseURL;
+    const embedApiKey = nonBlankEnv(process.env.HARA_EMBED_API_KEY) ?? merged.embedApiKey;
+    const routeModel = nonBlankEnv(process.env.HARA_ROUTE_MODEL) ?? merged.routeModel;
+    const routeBaseURL = nonBlankEnv(process.env.HARA_ROUTE_BASE_URL) ?? merged.routeBaseURL;
+    const routeApiKey = nonBlankEnv(process.env.HARA_ROUTE_API_KEY) ?? merged.routeApiKey;
     const mcpServers = {
         ...(globalBase.mcpServers ?? {}),
-        ...(project.mcpServers ?? {}),
         ...(overlay.mcpServers ?? {}),
+        ...(project.mcpServers ?? {}),
     };
     const hooks = (merged.hooks && typeof merged.hooks === "object" ? merged.hooks : {});
     // Guardian: default ON; env HARA_GUARDIAN=0/off/false or config guardian:"off" disables it.
@@ -185,15 +324,15 @@ export function loadConfig(opts = {}) {
     const autoCompact = !(process.env.HARA_AUTO_COMPACT === "0" || merged.autoCompact === false || merged.autoCompact === "false"); // default ON
     const fileCheckpoints = !(process.env.HARA_CHECKPOINTS === "0" || merged.fileCheckpoints === false || merged.fileCheckpoints === "false"); // default ON
     const updateCheck = !(process.env.HARA_UPDATE_CHECK === "0" || merged.updateCheck === false || merged.updateCheck === "false"); // default ON
-    const fallbackModel = process.env.HARA_FALLBACK_MODEL ?? merged.fallbackModel;
-    const fallbackProvider = (process.env.HARA_FALLBACK_PROVIDER ?? merged.fallbackProvider);
-    const fallbackBaseURL = process.env.HARA_FALLBACK_BASE_URL ?? merged.fallbackBaseURL;
-    const fallbackApiKey = process.env.HARA_FALLBACK_API_KEY ?? merged.fallbackApiKey;
+    const fallbackModel = nonBlankEnv(process.env.HARA_FALLBACK_MODEL) ?? merged.fallbackModel;
+    const fallbackProvider = (nonBlankEnv(process.env.HARA_FALLBACK_PROVIDER) ?? merged.fallbackProvider);
+    const fallbackBaseURL = nonBlankEnv(process.env.HARA_FALLBACK_BASE_URL) ?? merged.fallbackBaseURL;
+    const fallbackApiKey = nonBlankEnv(process.env.HARA_FALLBACK_API_KEY) ?? merged.fallbackApiKey;
     const reasoningRaw = process.env.HARA_REASONING_EFFORT ?? merged.reasoningEffort;
     const reasoningEffort = reasoningRaw && ["off", "low", "medium", "high", "max"].includes(reasoningRaw)
         ? reasoningRaw
         : undefined;
-    return { provider, apiKey, model, baseURL, approval, sandbox, theme, evolve, assetCapture, computerUse, computerApps, visionModel, visionBaseURL, visionApiKey, modelVision, embedProvider, embedModel, embedBaseURL, embedApiKey, routeModel, routeBaseURL, routeApiKey, guardian, hooks, notify, vimMode, autoCompact, fileCheckpoints, updateCheck, fallbackModel, fallbackProvider, fallbackBaseURL, fallbackApiKey, reasoningEffort, mcpServers, cwd: process.cwd() };
+    return { provider, apiKey, model, baseURL, approval, sandbox, theme, evolve, assetCapture, computerUse, computerApps, visionModel, visionBaseURL, visionApiKey, modelVision, embedProvider, embedModel, embedBaseURL, embedApiKey, routeModel, routeBaseURL, routeApiKey, guardian, hooks, notify, vimMode, autoCompact, fileCheckpoints, updateCheck, fallbackModel, fallbackProvider, fallbackBaseURL, fallbackApiKey, reasoningEffort, mcpServers, cwd: effectiveCwd };
 }
 export function providerEnvKey(provider) {
     return (PROVIDER_DEFAULTS[provider] ?? PROVIDER_DEFAULTS.anthropic).envKey;

package/dist/context/agents-md.js

@@ -1,10 +1,36 @@
 // Project-context loading (AGENTS.md) — the cross-tool standard read by Codex/Claude Code/OpenClaw.
 // Walks up from cwd to the project root, concatenates AGENTS.md files, caps total size.
-import { readFileSync, existsSync } from "node:fs";
+import { existsSync } from "node:fs";
 import { join, dirname, resolve } from "node:path";
+import { readModelContextBytePrefixSync } from "../fs-read.js";
 const FILENAMES = ["AGENTS.override.md", "AGENTS.md"];
 const ROOT_MARKERS = [".git", "package.json", "Cargo.toml", "go.mod", "pyproject.toml", ".hg"];
 const MAX_BYTES = 32 * 1024;
+const SEPARATOR = "\n\n--- project-doc ---\n\n";
+const TRUNCATED = "\n…[truncated to project-context budget]";
+function byteLength(value) {
+    return Buffer.byteLength(value, "utf8");
+}
+/** Retain only whole Unicode code points whose UTF-8 encoding fits the remaining byte budget. */
+function utf8Prefix(value, maxBytes) {
+    if (maxBytes <= 0)
+        return "";
+    if (byteLength(value) <= maxBytes)
+        return value;
+    let used = 0;
+    let out = "";
+    for (const char of value) {
+        const bytes = byteLength(char);
+        if (used + bytes > maxBytes)
+            break;
+        out += char;
+        used += bytes;
+    }
+    return out;
+}
+function markBudgetTruncation(value) {
+    return utf8Prefix(value, MAX_BYTES - byteLength(TRUNCATED)) + TRUNCATED;
+}
 export function findProjectRoot(cwd) {
     let dir = resolve(cwd);
     for (;;) {
@@ -30,15 +56,28 @@ export function loadAgentsMd(cwd) {
             break;
         dir = parent;
     }
-    const parts = [];
+    let combined = "";
     for (const d of chain) {
         for (const name of FILENAMES) {
             const p = join(d, name);
             if (existsSync(p)) {
                 try {
-                    const txt = readFileSync(p, "utf8").trim();
-                    if (txt)
-                        parts.push(`<!-- ${name} @ ${d} -->\n${txt}`);
+                    const separator = combined ? SEPARATOR : "";
+                    const header = `<!-- ${name} @ ${d} -->\n`;
+                    const fixedBytes = byteLength(separator + header);
+                    const remaining = MAX_BYTES - byteLength(combined) - fixedBytes;
+                    if (remaining <= byteLength(TRUNCATED))
+                        return markBudgetTruncation(combined);
+                    const read = readModelContextBytePrefixSync(p, remaining);
+                    if (read.binary)
+                        continue;
+                    let txt = read.text.trim();
+                    if (!txt)
+                        continue;
+                    if (read.truncated) {
+                        txt = utf8Prefix(txt, Math.max(0, remaining - byteLength(TRUNCATED))) + TRUNCATED;
+                    }
+                    combined += separator + header + utf8Prefix(txt, remaining);
                 }
                 catch {
                     /* ignore unreadable */
@@ -46,10 +85,6 @@ export function loadAgentsMd(cwd) {
             }
         }
     }
-    let combined = parts.join("\n\n--- project-doc ---\n\n");
-    if (Buffer.byteLength(combined, "utf8") > MAX_BYTES) {
-        combined = Buffer.from(combined, "utf8").subarray(0, MAX_BYTES).toString("utf8") + "\n…[truncated]";
-    }
     return combined;
 }
 export function hasAgentsMd(cwd) {

package/dist/context/mentions.js

@@ -1,11 +1,12 @@
 // @file mentions — expand `@path` references in user input into appended file contents,
 // and provide fuzzy file candidates for REPL tab-completion.
-import { existsSync, statSync } from "node:fs";
+import { existsSync, lstatSync } from "node:fs";
 import { isAbsolute, resolve } from "node:path";
 import { listProjectFiles, dirPrefixes, walkFiles } from "../fs-walk.js";
 import { fuzzyRank } from "../fuzzy.js";
 import { mediaTypeFor } from "../images.js";
-import { readTextPrefixSync } from "../fs-read.js";
+import { readModelContextPrefixSync } from "../fs-read.js";
+import { sensitiveFileError } from "../security/sensitive-files.js";
 const MAX_FILE = 50_000;
 // @ at start-of-string or after whitespace; capture a path with no spaces/@ (avoids emails like a@b.com)
 const MENTION_RE = /(?:^|\s)@([^\s@]+)/g;
@@ -46,15 +47,20 @@ export function expandMentions(input, cwd) {
 /** Render one mention as an inline block, or null if it isn't a readable file/dir. */
 function expandRef(ref, cwd) {
     const abs = isAbsolute(ref) ? ref : resolve(cwd, ref);
+    const denied = sensitiveFileError(abs, "attach");
+    if (denied)
+        return `\nProtected file \`${ref}\` was not inserted into model context. ${denied}\n`;
     try {
         if (!existsSync(abs))
             return null;
-        const st = statSync(abs);
+        const st = lstatSync(abs);
+        if (st.isSymbolicLink())
+            return `Referenced \`${ref}\` is a symbolic link — it was not inserted into model context.`;
         if (st.isFile()) {
             // don't inline binary image bytes as text — paste with Ctrl+V (or drag the file in) to attach visually
             if (mediaTypeFor(abs))
                 return `Referenced \`${ref}\` is an image — paste it with Ctrl+V to attach it visually.`;
-            const prefix = readTextPrefixSync(abs, MAX_FILE);
+            const prefix = readModelContextPrefixSync(abs, MAX_FILE);
             if (prefix.binary)
                 return `Referenced \`${ref}\` appears to be binary — it was not inserted into the model context.`;
             const txt = prefix.text + (prefix.truncated ? "\n…[truncated]" : "");

package/dist/context/subdir-hints.js

@@ -2,12 +2,36 @@
 // AGENTS.md / CLAUDE.md (the local conventions for that package) by appending it to the tool result, so a
 // monorepo's per-package rules reach the model exactly when work moves into that package. Startup already
 // loads root→cwd (agents-md.ts); this covers the subdirs the agent navigates INTO. Each dir loaded once.
-import { readFileSync, existsSync, statSync } from "node:fs";
+import { existsSync, statSync } from "node:fs";
 import { join, dirname, resolve, relative, isAbsolute } from "node:path";
 import { findProjectRoot } from "./agents-md.js";
+import { readModelContextBytePrefixSync } from "../fs-read.js";
 const FILENAMES = ["AGENTS.override.md", "AGENTS.md", "CLAUDE.md"];
 const MAX = 8 * 1024;
+const TRUNCATED = "\n…[truncated to subdirectory-context budget]";
 const loaded = new Set(); // dirs whose local doc we've already injected (per process / session)
+function byteLength(value) {
+    return Buffer.byteLength(value, "utf8");
+}
+function utf8Prefix(value, maxBytes) {
+    if (maxBytes <= 0)
+        return "";
+    if (byteLength(value) <= maxBytes)
+        return value;
+    let used = 0;
+    let out = "";
+    for (const char of value) {
+        const bytes = byteLength(char);
+        if (used + bytes > maxBytes)
+            break;
+        out += char;
+        used += bytes;
+    }
+    return out;
+}
+function markBudgetTruncation(value) {
+    return utf8Prefix(value, MAX - byteLength(TRUNCATED)) + TRUNCATED;
+}
 function isDir(p) {
     try {
         return statSync(p).isDirectory();
@@ -31,7 +55,7 @@ function pathsFrom(input) {
 export function subdirHint(input, cwd) {
     const base = resolve(cwd);
     const root = findProjectRoot(cwd);
-    const parts = [];
+    let hint = "";
     for (const raw of pathsFrom(input)) {
         const absPath = isAbsolute(raw) ? resolve(raw) : resolve(cwd, raw);
         const startDir = isDir(absPath) ? absPath : dirname(absPath);
@@ -58,12 +82,21 @@ export function subdirHint(input, cwd) {
                 if (!existsSync(fp))
                     continue;
                 try {
-                    let txt = readFileSync(fp, "utf8").trim();
+                    const separator = "\n\n";
+                    const header = `<!-- ${name} @ ${cd} — local conventions for this directory -->\n`;
+                    const remaining = MAX - byteLength(hint) - byteLength(separator + header);
+                    if (remaining <= byteLength(TRUNCATED))
+                        return markBudgetTruncation(hint);
+                    const read = readModelContextBytePrefixSync(fp, remaining);
+                    if (read.binary)
+                        break;
+                    let txt = read.text.trim();
                     if (!txt)
                         break;
-                    if (Buffer.byteLength(txt, "utf8") > MAX)
-                        txt = txt.slice(0, MAX) + "\n…[truncated]";
-                    parts.push(`<!-- ${name} @ ${cd} — local conventions for this directory -->\n${txt}`);
+                    if (read.truncated) {
+                        txt = utf8Prefix(txt, Math.max(0, remaining - byteLength(TRUNCATED))) + TRUNCATED;
+                    }
+                    hint += separator + header + utf8Prefix(txt, remaining);
                 }
                 catch {
                     /* ignore unreadable */
@@ -72,5 +105,5 @@ export function subdirHint(input, cwd) {
             }
         }
     }
-    return parts.length ? "\n\n" + parts.join("\n\n") : "";
+    return hint;
 }

package/dist/cron/deliver.js

@@ -1,15 +1,39 @@
+// Cron result delivery — push a finished job's output to a chat channel (openclaw/hermes parity),
+// WITHOUT needing the gateway process: adapters are constructed one-shot from the same env vars the
+// gateway uses, send once, and are dropped. Spec format: "<target>:<id>" —
+//   telegram:<chatId>   (HARA_TELEGRAM_TOKEN)
+//   feishu:<chatId>     (HARA_FEISHU_APP_ID + HARA_FEISHU_APP_SECRET)
+//   webhook:<url>       (plain POST {name,status,text} JSON — for anything else)
+//   weixin:<peerId>     (sends over stored ~/.hara/weixin creds — explicit peer required; guessing the
+//                        "owner" from a multi-DM context-token cache can deliver private results to the wrong person)
+// Adapters are imported LAZILY so the (heavy) SDKs never load unless a job actually delivers.
 /** Parse a `--deliver` spec; error string on anything unsupported (listing what IS supported). */
 export function parseDeliver(spec) {
     const i = spec.indexOf(":");
     if (i <= 0)
-        return { error: `bad deliver spec "${spec}" — use telegram:<chatId>, feishu:<chatId>, or webhook:<url>` };
+        return { error: `bad deliver spec "${spec}" — use telegram:<chatId>, feishu:<chatId>, weixin:<peerId>, or webhook:<url>` };
     const platform = spec.slice(0, i).toLowerCase();
     const to = spec.slice(i + 1).trim();
     if (!to)
         return { error: `deliver spec "${spec}" is missing a target after ":"` };
-    if (platform === "telegram" || platform === "feishu" || platform === "webhook")
+    if (platform === "weixin" && to.toLowerCase() === "owner") {
+        return { error: "weixin:owner is ambiguous when several people have messaged the bot — use an explicit weixin:<peerId>" };
+    }
+    if (platform === "telegram" || platform === "feishu" || platform === "webhook" || platform === "weixin")
         return { platform, to };
-    return { error: `unsupported deliver platform "${platform}" — supported: telegram, feishu, webhook (WeChat needs the live gateway)` };
+    return { error: `unsupported deliver platform "${platform}" — supported: telegram, feishu, weixin, webhook` };
+}
+/** Flatten markdown for plain-text chat surfaces (Feishu/WeChat/Telegram text messages render syntax
+ *  literally): drop code fences/inline backticks/bold/headers, turn [text](url) into "text (url)". */
+export function plainChat(text) {
+    return text
+        .replace(/```[a-zA-Z0-9_-]*\n?/g, "")
+        .replace(/```/g, "")
+        .replace(/\*\*([^*]+)\*\*/g, "$1")
+        .replace(/__([^_]+)__/g, "$1")
+        .replace(/`([^`]+)`/g, "$1")
+        .replace(/^#{1,6}\s+/gm, "")
+        .replace(/\[([^\]]+)\]\(([^)]+)\)/g, "$1 ($2)");
 }
 /** Send `text` to the target. Returns null on success, or an error string (never throws — cron
  *  delivery is best-effort and must not kill the tick). */
@@ -17,6 +41,8 @@ export async function deliverResult(spec, text) {
     const t = parseDeliver(spec);
     if ("error" in t)
         return t.error;
+    if (t.platform !== "webhook")
+        text = plainChat(text); // chat surfaces are plain text; webhooks get raw payload
     try {
         if (t.platform === "webhook") {
             const r = await fetch(t.to, {
@@ -35,6 +61,14 @@ export async function deliverResult(spec, text) {
             await telegramAdapter(token).send(t.to, text);
             return null;
         }
+        if (t.platform === "weixin") {
+            const { loadWeixinCreds, weixinAdapter } = await import("../gateway/weixin.js");
+            const creds = loadWeixinCreds();
+            if (!creds)
+                return "hara weixin not logged in (~/.hara/weixin/creds.json missing)";
+            await weixinAdapter(creds).send(t.to, text);
+            return null;
+        }
         // feishu
         const appId = process.env.HARA_FEISHU_APP_ID;
         const appSecret = process.env.HARA_FEISHU_APP_SECRET;