@nanhara/hara 0.122.0 → 0.122.1

package/dist/config.js

@@ -1,6 +1,9 @@
 import { homedir } from "node:os";
 import { join, dirname, resolve } from "node:path";
-import { readFileSync, writeFileSync, existsSync, mkdirSync, chmodSync } from "node:fs";
+import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from "node:fs";
+import { ensurePrivateHaraState } from "./security/private-state.js";
+import { readVerifiedRegularFileSnapshotSync } from "./fs-read.js";
+import { projectRepositoryTrustedAtStartup } from "./security/project-trust.js";
 const PROVIDER_DEFAULTS = {
     anthropic: { model: "claude-opus-4-8", envKey: "ANTHROPIC_API_KEY" },
     qwen: {
@@ -35,6 +38,65 @@ export const REASONING_EFFORTS = ["off", "low", "medium", "high", "max"];
 export const APPROVAL_MODES = ["suggest", "auto-edit", "full-auto"];
 export const SANDBOX_MODES = ["off", "workspace-write", "read-only"];
 const PROJECT_ROOT_MARKERS = [".git", "package.json", "Cargo.toml", "go.mod", "pyproject.toml", ".hg"];
+const MAX_PROJECT_CONFIG_BYTES = 256 * 1024;
+const KNOWN_CONFIG_KEYS = new Set([
+    ...CONFIG_KEYS,
+    "hooks", "mcpServers", "modelVision", "overlays", "profiles",
+]);
+/** Deliberately narrow: these keys change presentation/model preference, but cannot redirect credentials,
+ * execute code, grant tools more authority, or disable a safety layer. Everything else requires a launch-
+ * time trust decision so cloning/chdir into a repository never silently changes the process trust boundary. */
+const SAFE_PROJECT_CONFIG_KEYS = new Set(["model", "theme", "vimMode", "autoCompact", "reasoningEffort"]);
+const projectConfigWarnings = new Set();
+function printableConfigKeys(keys) {
+    // A repository controls JSON property names too. Only schema names are safe diagnostics; an unknown key
+    // may itself contain a copied token and must never be treated as printable metadata.
+    const safe = [...new Set(keys.map((key) => (KNOWN_CONFIG_KEYS.has(key) ? key : "<unknown-key>")))].sort();
+    const shown = safe.slice(0, 32);
+    return `${shown.join(", ")}${safe.length > shown.length ? `, … (+${safe.length - shown.length})` : ""}`;
+}
+function warnProjectConfig(kind, message) {
+    if (projectConfigWarnings.has(kind))
+        return;
+    projectConfigWarnings.add(kind);
+    try {
+        process.stderr.write(`hara: ${message}\n`);
+    }
+    catch { /* best effort */ }
+}
+function validSafeProjectValue(key, value) {
+    if (key === "model")
+        return typeof value === "string" && value.trim().length > 0 && value.length <= 256 && !/[\u0000-\u001f\u007f]/.test(value);
+    if (key === "theme")
+        return value === "dark" || value === "light";
+    if (key === "reasoningEffort")
+        return REASONING_EFFORTS.includes(value);
+    if (key === "vimMode" || key === "autoCompact")
+        return typeof value === "boolean" || value === "true" || value === "false";
+    return false;
+}
+function filterProjectConfig(input) {
+    const blocked = Object.keys(input).filter((key) => !SAFE_PROJECT_CONFIG_KEYS.has(key));
+    if (projectRepositoryTrustedAtStartup()) {
+        if (blocked.length) {
+            const names = printableConfigKeys(blocked);
+            warnProjectConfig(`trusted:${names}`, `trusted project config enabled for privileged key(s): ${names}.`);
+        }
+        return input;
+    }
+    if (blocked.length) {
+        const names = printableConfigKeys(blocked);
+        warnProjectConfig(`ignored:${names}`, `ignored untrusted project config key(s): ${names}. Set HARA_TRUST_PROJECT_CONFIG=1 before starting hara only for a repository you trust.`);
+    }
+    const invalid = Object.entries(input)
+        .filter(([key, value]) => SAFE_PROJECT_CONFIG_KEYS.has(key) && !validSafeProjectValue(key, value))
+        .map(([key]) => key);
+    if (invalid.length) {
+        const names = printableConfigKeys(invalid);
+        warnProjectConfig(`invalid-safe:${names}`, `ignored invalid project config value(s) for key(s): ${names}.`);
+    }
+    return Object.fromEntries(Object.entries(input).filter(([key, value]) => (SAFE_PROJECT_CONFIG_KEYS.has(key) && validSafeProjectValue(key, value))));
+}
 export function configPath() {
     return join(homedir(), ".hara", "config.json");
 }
@@ -42,6 +104,7 @@ function configRecord(value) {
     return value && typeof value === "object" && !Array.isArray(value) ? value : {};
 }
 export function readRawConfig() {
+    ensurePrivateHaraState();
     const p = configPath();
     if (!existsSync(p))
         return {};
@@ -80,17 +143,78 @@ function nonBlankEnv(value) {
     const trimmed = value?.trim();
     return trimmed || undefined;
 }
-/** Nearest project override `.hara/config.json`, searching cwd up to the repo root. */
+function projectConfigReadFailure(kind) {
+    warnProjectConfig(`unsafe-file:${kind}`, `ignored an unsafe project .hara/config.json (${kind}); no project values were loaded.`);
+    return {};
+}
+/** Nearest project override `.hara/config.json`, searching a canonical cwd up to the repo root. Project
+ * configuration is repository input, not private Hara state: its `.hara` parent and final entry must remain
+ * ordinary single-link filesystem objects while a bounded O_NOFOLLOW descriptor is read. */
 function readProjectConfig(cwd) {
-    let dir = resolve(cwd);
+    let dir;
+    try {
+        dir = realpathSync.native(resolve(cwd));
+    }
+    catch {
+        dir = resolve(cwd);
+    }
     for (;;) {
-        const p = join(dir, ".hara", "config.json");
-        if (existsSync(p)) {
-            try {
-                return configRecord(JSON.parse(readFileSync(p, "utf8")));
-            }
-            catch {
-                return {};
+        const hara = join(dir, ".hara");
+        const p = join(hara, "config.json");
+        let haraInfo;
+        try {
+            haraInfo = lstatSync(hara);
+        }
+        catch (error) {
+            if (error?.code !== "ENOENT")
+                return projectConfigReadFailure("unreadable parent");
+        }
+        if (haraInfo) {
+            if (haraInfo.isSymbolicLink())
+                return projectConfigReadFailure("symlink parent");
+            if (haraInfo.isDirectory()) {
+                let fileInfo;
+                try {
+                    const canonicalParent = realpathSync.native(hara);
+                    if (canonicalParent !== hara)
+                        return projectConfigReadFailure("non-canonical parent");
+                    fileInfo = lstatSync(p);
+                }
+                catch (error) {
+                    if (error?.code !== "ENOENT")
+                        return projectConfigReadFailure("unreadable file");
+                }
+                if (fileInfo) {
+                    if (fileInfo.isSymbolicLink())
+                        return projectConfigReadFailure("symlink file");
+                    if (!fileInfo.isFile())
+                        return projectConfigReadFailure("non-regular file");
+                    try {
+                        const snapshot = readVerifiedRegularFileSnapshotSync(p, MAX_PROJECT_CONFIG_BYTES, {
+                            action: "read project config",
+                            protectSensitive: false,
+                            rejectHardLinks: true,
+                        });
+                        const parentAfter = lstatSync(hara);
+                        if (!parentAfter.isDirectory()
+                            || parentAfter.isSymbolicLink()
+                            || parentAfter.dev !== haraInfo.dev
+                            || parentAfter.ino !== haraInfo.ino
+                            || realpathSync.native(hara) !== hara)
+                            return projectConfigReadFailure("changed parent");
+                        return filterProjectConfig(configRecord(JSON.parse(snapshot.text)));
+                    }
+                    catch (error) {
+                        if (error?.code === "HARA_HARD_LINKED_FILE")
+                            return projectConfigReadFailure("hard-linked file");
+                        if (error?.code === "HARA_FILE_TOO_LARGE")
+                            return projectConfigReadFailure("oversized file");
+                        if (/changed while (?:opening|reading)|File changed/i.test(error?.message ?? "")) {
+                            return projectConfigReadFailure("changed file");
+                        }
+                        return projectConfigReadFailure("invalid file");
+                    }
+                }
             }
         }
         if (PROJECT_ROOT_MARKERS.some((m) => existsSync(join(dir, m))))
@@ -104,7 +228,12 @@ function readProjectConfig(cwd) {
 }
 /** Write the config 0600 (it can hold `apiKey`) + tighten an existing file. */
 function persistConfig(p, cfg) {
-    mkdirSync(dirname(p), { recursive: true });
+    ensurePrivateHaraState();
+    mkdirSync(dirname(p), { recursive: true, mode: 0o700 });
+    try {
+        chmodSync(dirname(p), 0o700);
+    }
+    catch { /* best effort */ }
     writeFileSync(p, JSON.stringify(cfg, null, 2) + "\n", { encoding: "utf8", mode: 0o600 });
     try {
         chmodSync(p, 0o600);
@@ -132,7 +261,7 @@ export function setModelVisionOverride(model, cap) {
     persistConfig(p, cfg);
 }
 /**
- * Effective config. Precedence (high→low): env vars > project `.hara/config.json` >
+ * Effective config. Precedence (high→low): env vars > allowed/trusted project `.hara/config.json` >
  * named overlay (`overlays.<name>` in global config) > global `~/.hara/config.json`
  * > provider defaults.
  *

package/dist/context/agents-md.js

@@ -1,10 +1,36 @@
 // Project-context loading (AGENTS.md) — the cross-tool standard read by Codex/Claude Code/OpenClaw.
 // Walks up from cwd to the project root, concatenates AGENTS.md files, caps total size.
-import { readFileSync, existsSync } from "node:fs";
+import { existsSync } from "node:fs";
 import { join, dirname, resolve } from "node:path";
+import { readModelContextBytePrefixSync } from "../fs-read.js";
 const FILENAMES = ["AGENTS.override.md", "AGENTS.md"];
 const ROOT_MARKERS = [".git", "package.json", "Cargo.toml", "go.mod", "pyproject.toml", ".hg"];
 const MAX_BYTES = 32 * 1024;
+const SEPARATOR = "\n\n--- project-doc ---\n\n";
+const TRUNCATED = "\n…[truncated to project-context budget]";
+function byteLength(value) {
+    return Buffer.byteLength(value, "utf8");
+}
+/** Retain only whole Unicode code points whose UTF-8 encoding fits the remaining byte budget. */
+function utf8Prefix(value, maxBytes) {
+    if (maxBytes <= 0)
+        return "";
+    if (byteLength(value) <= maxBytes)
+        return value;
+    let used = 0;
+    let out = "";
+    for (const char of value) {
+        const bytes = byteLength(char);
+        if (used + bytes > maxBytes)
+            break;
+        out += char;
+        used += bytes;
+    }
+    return out;
+}
+function markBudgetTruncation(value) {
+    return utf8Prefix(value, MAX_BYTES - byteLength(TRUNCATED)) + TRUNCATED;
+}
 export function findProjectRoot(cwd) {
     let dir = resolve(cwd);
     for (;;) {
@@ -30,15 +56,28 @@ export function loadAgentsMd(cwd) {
             break;
         dir = parent;
     }
-    const parts = [];
+    let combined = "";
     for (const d of chain) {
         for (const name of FILENAMES) {
             const p = join(d, name);
             if (existsSync(p)) {
                 try {
-                    const txt = readFileSync(p, "utf8").trim();
-                    if (txt)
-                        parts.push(`<!-- ${name} @ ${d} -->\n${txt}`);
+                    const separator = combined ? SEPARATOR : "";
+                    const header = `<!-- ${name} @ ${d} -->\n`;
+                    const fixedBytes = byteLength(separator + header);
+                    const remaining = MAX_BYTES - byteLength(combined) - fixedBytes;
+                    if (remaining <= byteLength(TRUNCATED))
+                        return markBudgetTruncation(combined);
+                    const read = readModelContextBytePrefixSync(p, remaining);
+                    if (read.binary)
+                        continue;
+                    let txt = read.text.trim();
+                    if (!txt)
+                        continue;
+                    if (read.truncated) {
+                        txt = utf8Prefix(txt, Math.max(0, remaining - byteLength(TRUNCATED))) + TRUNCATED;
+                    }
+                    combined += separator + header + utf8Prefix(txt, remaining);
                 }
                 catch {
                     /* ignore unreadable */
@@ -46,10 +85,6 @@ export function loadAgentsMd(cwd) {
             }
         }
     }
-    let combined = parts.join("\n\n--- project-doc ---\n\n");
-    if (Buffer.byteLength(combined, "utf8") > MAX_BYTES) {
-        combined = Buffer.from(combined, "utf8").subarray(0, MAX_BYTES).toString("utf8") + "\n…[truncated]";
-    }
     return combined;
 }
 export function hasAgentsMd(cwd) {

package/dist/context/mentions.js

@@ -1,11 +1,12 @@
 // @file mentions — expand `@path` references in user input into appended file contents,
 // and provide fuzzy file candidates for REPL tab-completion.
-import { existsSync, statSync } from "node:fs";
+import { existsSync, lstatSync } from "node:fs";
 import { isAbsolute, resolve } from "node:path";
 import { listProjectFiles, dirPrefixes, walkFiles } from "../fs-walk.js";
 import { fuzzyRank } from "../fuzzy.js";
 import { mediaTypeFor } from "../images.js";
-import { readTextPrefixSync } from "../fs-read.js";
+import { readModelContextPrefixSync } from "../fs-read.js";
+import { sensitiveFileError } from "../security/sensitive-files.js";
 const MAX_FILE = 50_000;
 // @ at start-of-string or after whitespace; capture a path with no spaces/@ (avoids emails like a@b.com)
 const MENTION_RE = /(?:^|\s)@([^\s@]+)/g;
@@ -46,15 +47,20 @@ export function expandMentions(input, cwd) {
 /** Render one mention as an inline block, or null if it isn't a readable file/dir. */
 function expandRef(ref, cwd) {
     const abs = isAbsolute(ref) ? ref : resolve(cwd, ref);
+    const denied = sensitiveFileError(abs, "attach");
+    if (denied)
+        return `\nProtected file \`${ref}\` was not inserted into model context. ${denied}\n`;
     try {
         if (!existsSync(abs))
             return null;
-        const st = statSync(abs);
+        const st = lstatSync(abs);
+        if (st.isSymbolicLink())
+            return `Referenced \`${ref}\` is a symbolic link — it was not inserted into model context.`;
         if (st.isFile()) {
             // don't inline binary image bytes as text — paste with Ctrl+V (or drag the file in) to attach visually
             if (mediaTypeFor(abs))
                 return `Referenced \`${ref}\` is an image — paste it with Ctrl+V to attach it visually.`;
-            const prefix = readTextPrefixSync(abs, MAX_FILE);
+            const prefix = readModelContextPrefixSync(abs, MAX_FILE);
             if (prefix.binary)
                 return `Referenced \`${ref}\` appears to be binary — it was not inserted into the model context.`;
             const txt = prefix.text + (prefix.truncated ? "\n…[truncated]" : "");

package/dist/context/subdir-hints.js

@@ -2,12 +2,36 @@
 // AGENTS.md / CLAUDE.md (the local conventions for that package) by appending it to the tool result, so a
 // monorepo's per-package rules reach the model exactly when work moves into that package. Startup already
 // loads root→cwd (agents-md.ts); this covers the subdirs the agent navigates INTO. Each dir loaded once.
-import { readFileSync, existsSync, statSync } from "node:fs";
+import { existsSync, statSync } from "node:fs";
 import { join, dirname, resolve, relative, isAbsolute } from "node:path";
 import { findProjectRoot } from "./agents-md.js";
+import { readModelContextBytePrefixSync } from "../fs-read.js";
 const FILENAMES = ["AGENTS.override.md", "AGENTS.md", "CLAUDE.md"];
 const MAX = 8 * 1024;
+const TRUNCATED = "\n…[truncated to subdirectory-context budget]";
 const loaded = new Set(); // dirs whose local doc we've already injected (per process / session)
+function byteLength(value) {
+    return Buffer.byteLength(value, "utf8");
+}
+function utf8Prefix(value, maxBytes) {
+    if (maxBytes <= 0)
+        return "";
+    if (byteLength(value) <= maxBytes)
+        return value;
+    let used = 0;
+    let out = "";
+    for (const char of value) {
+        const bytes = byteLength(char);
+        if (used + bytes > maxBytes)
+            break;
+        out += char;
+        used += bytes;
+    }
+    return out;
+}
+function markBudgetTruncation(value) {
+    return utf8Prefix(value, MAX - byteLength(TRUNCATED)) + TRUNCATED;
+}
 function isDir(p) {
     try {
         return statSync(p).isDirectory();
@@ -31,7 +55,7 @@ function pathsFrom(input) {
 export function subdirHint(input, cwd) {
     const base = resolve(cwd);
     const root = findProjectRoot(cwd);
-    const parts = [];
+    let hint = "";
     for (const raw of pathsFrom(input)) {
         const absPath = isAbsolute(raw) ? resolve(raw) : resolve(cwd, raw);
         const startDir = isDir(absPath) ? absPath : dirname(absPath);
@@ -58,12 +82,21 @@ export function subdirHint(input, cwd) {
                 if (!existsSync(fp))
                     continue;
                 try {
-                    let txt = readFileSync(fp, "utf8").trim();
+                    const separator = "\n\n";
+                    const header = `<!-- ${name} @ ${cd} — local conventions for this directory -->\n`;
+                    const remaining = MAX - byteLength(hint) - byteLength(separator + header);
+                    if (remaining <= byteLength(TRUNCATED))
+                        return markBudgetTruncation(hint);
+                    const read = readModelContextBytePrefixSync(fp, remaining);
+                    if (read.binary)
+                        break;
+                    let txt = read.text.trim();
                     if (!txt)
                         break;
-                    if (Buffer.byteLength(txt, "utf8") > MAX)
-                        txt = txt.slice(0, MAX) + "\n…[truncated]";
-                    parts.push(`<!-- ${name} @ ${cd} — local conventions for this directory -->\n${txt}`);
+                    if (read.truncated) {
+                        txt = utf8Prefix(txt, Math.max(0, remaining - byteLength(TRUNCATED))) + TRUNCATED;
+                    }
+                    hint += separator + header + utf8Prefix(txt, remaining);
                 }
                 catch {
                     /* ignore unreadable */
@@ -72,5 +105,5 @@ export function subdirHint(input, cwd) {
             }
         }
     }
-    return parts.length ? "\n\n" + parts.join("\n\n") : "";
+    return hint;
 }