@nanhara/hara 0.122.0 → 0.122.1

package/dist/cron/runner.js

@@ -3,10 +3,15 @@
 // scheduler (see install.ts). A lock file prevents overlapping ticks from double-firing a slow job.
 import { spawn } from "node:child_process";
 import { deliverResult } from "./deliver.js";
-import { existsSync, mkdirSync, writeFileSync, rmSync, statSync, appendFileSync, readFileSync } from "node:fs";
+import { appendFileSync, chmodSync, closeSync, existsSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { randomUUID } from "node:crypto";
+import { platform } from "node:os";
 import { join } from "node:path";
 import { loadJobs, recordRun, recordAlert, findJob, cronDir, logPath } from "./store.js";
 import { isDue } from "./schedule.js";
+import { shellCommand } from "../sandbox.js";
+import { sensitiveShellCommandReason } from "../security/sensitive-files.js";
+import { createToolOutputLineRedactor, redactToolSubprocessOutput, terminateSubprocessTree, toolSubprocessEnv } from "../security/subprocess-env.js";
 /** Jobs that are enabled AND due at `nowMs` (pure — for the tick and for testing). */
 export function dueJobs(jobs, nowMs) {
     return jobs.filter((j) => j.enabled && isDue(j, nowMs));
@@ -21,9 +26,166 @@ export function selfArgv() {
     return underNode && process.argv[1] ? [exec, process.argv[1]] : [exec];
 }
 const lockPath = () => join(cronDir(), ".tick.lock");
+const takeoverPath = () => join(cronDir(), ".tick.lock.takeover");
 // Generous: a live-PID owner is respected this long (so a genuinely long job isn't double-fired); past it
 // we assume PID reuse and take over. A *dead* owner is taken over within one tick regardless (see below).
 const LOCK_STALE_MS = 6 * 60 * 60_000;
+// A takeover/release guard protects only synchronous filesystem operations and should live for milliseconds.
+// Five minutes tolerates long host pauses while still recovering a guard left by a crash or PID reuse.
+const TAKEOVER_GUARD_STALE_MS = 5 * 60_000;
+const DEFAULT_JOB_TIMEOUT_MS = 30 * 60_000;
+const DEFAULT_RUN_LOG_BYTES = 1_000_000;
+const TERMINATE_GRACE_MS = 2_000;
+const MAX_LOCK_RECORD_BYTES = 512;
+function processIsAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        // EPERM means the process exists but is not signalable. Only ESRCH proves that an owner is gone.
+        return error?.code !== "ESRCH";
+    }
+}
+function readTickLockFileSnapshot(path) {
+    try {
+        const before = lstatSync(path);
+        if (!before.isFile())
+            return null;
+        const raw = before.size <= MAX_LOCK_RECORD_BYTES ? readFileSync(path, "utf8").trim() : null;
+        const after = lstatSync(path);
+        if (before.dev !== after.dev
+            || before.ino !== after.ino
+            || before.size !== after.size
+            || before.mtimeMs !== after.mtimeMs
+            || before.ctimeMs !== after.ctimeMs)
+            return null;
+        return { raw, dev: after.dev, ino: after.ino, size: after.size, mtimeMs: after.mtimeMs, ctimeMs: after.ctimeMs };
+    }
+    catch {
+        return null;
+    }
+}
+function parseTickLockSnapshot(file) {
+    if (!file?.raw)
+        return null;
+    const match = /^(\d+):([0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})$/iu.exec(file.raw);
+    const pid = Number(match?.[1]);
+    if (!match || !Number.isSafeInteger(pid) || pid <= 0)
+        return null;
+    return { ...file, raw: file.raw, pid };
+}
+function readTickLockSnapshot(path) {
+    return parseTickLockSnapshot(readTickLockFileSnapshot(path));
+}
+function sameTickLockFile(left, right) {
+    return !!right
+        && left.raw === right.raw
+        && left.dev === right.dev
+        && left.ino === right.ino
+        && left.size === right.size
+        && left.mtimeMs === right.mtimeMs
+        && left.ctimeMs === right.ctimeMs;
+}
+function sameTickLock(left, right) {
+    return sameTickLockFile(left, right) && left.pid === right?.pid;
+}
+function staleTickLock(snapshot, nowMs) {
+    return nowMs - snapshot.mtimeMs >= LOCK_STALE_MS || !processIsAlive(snapshot.pid);
+}
+/** Recover only a complete, stable guard whose owner is proven dead or whose tiny synchronous lease is
+ * far past its lifetime. Recovery deliberately ends this tick: a later invocation acquires a fresh guard,
+ * keeping stale-guard deletion and new-guard creation out of the same contender's race window. */
+function prepareTakeoverGuard(path, nowMs) {
+    if (!existsSync(path))
+        return "clear";
+    const observedFile = readTickLockFileSnapshot(path);
+    if (!observedFile)
+        return "active"; // unreadable/non-regular/unstable is not evidence that deletion is safe
+    const observed = parseTickLockSnapshot(observedFile);
+    const staleRecord = (snapshot) => nowMs - snapshot.mtimeMs >= TAKEOVER_GUARD_STALE_MS || !processIsAlive(snapshot.pid);
+    const staleMalformed = (snapshot) => nowMs - snapshot.mtimeMs >= TAKEOVER_GUARD_STALE_MS;
+    if (observed ? !staleRecord(observed) : !staleMalformed(observedFile))
+        return "active";
+    const currentFile = readTickLockFileSnapshot(path);
+    if (!sameTickLockFile(observedFile, currentFile) || !currentFile)
+        return "active";
+    const current = parseTickLockSnapshot(currentFile);
+    if (observed) {
+        if (!sameTickLock(observed, current) || !current || !staleRecord(current))
+            return "active";
+    }
+    else if (current || !staleMalformed(currentFile)) {
+        return "active";
+    }
+    try {
+        rmSync(path);
+        return "recovered";
+    }
+    catch {
+        return "active";
+    }
+}
+function writeExclusive(path, token) {
+    let fd;
+    let created = false;
+    try {
+        fd = openSync(path, "wx", 0o600);
+        created = true;
+        writeFileSync(fd, token, { encoding: "utf8" });
+        fsyncSync(fd);
+        return true;
+    }
+    catch (error) {
+        if (!created && error?.code === "EEXIST")
+            return false;
+        if (fd !== undefined) {
+            try {
+                closeSync(fd);
+            }
+            catch { /* preserve the original write error */ }
+            fd = undefined;
+        }
+        if (created)
+            try {
+                rmSync(path);
+            }
+            catch { /* the incomplete record will fail closed */ }
+        throw error;
+    }
+    finally {
+        if (fd !== undefined)
+            try {
+                closeSync(fd);
+            }
+            catch { /* best effort */ }
+    }
+}
+function removeOwnedLock(path, token) {
+    try {
+        if (readTickLockSnapshot(path)?.raw === token)
+            rmSync(path);
+    }
+    catch { /* best effort */ }
+}
+/** Release the primary lock under the same guard used for stale takeover. Without this, a >6h owner could
+ * read its token, get descheduled while a reaper installs a successor, then unlink that successor by name. */
+function releasePrimaryTickLock(lock, takeover, token) {
+    const releaseToken = `${process.pid}:${randomUUID()}`;
+    if (!writeExclusive(takeover, releaseToken))
+        return; // an active reaper owns the transition
+    try {
+        const current = readTickLockSnapshot(lock);
+        if (current?.raw === token)
+            rmSync(lock);
+    }
+    catch {
+        /* best effort; leaving an uncertain lock is safer than deleting it */
+    }
+    finally {
+        removeOwnedLock(takeover, releaseToken);
+    }
+}
 /** Keep a per-job log from growing forever: once over ~1MB, retain only the last ~256KB. */
 function capLog(log) {
     try {
@@ -37,13 +199,22 @@ function capLog(log) {
 }
 /** Run one job's task in a fresh hara process (full-auto, no prompts), appending output to its log.
  *  Exported so `hara cron run <id>` can fire a job on demand, ignoring its schedule. */
-export function runJobOnce(job) {
+export function runJobOnce(job, options = {}) {
     return new Promise((resolve) => {
-        mkdirSync(join(cronDir(), "logs"), { recursive: true });
+        const timeoutMs = Math.min(Math.max(100, options.timeoutMs ?? DEFAULT_JOB_TIMEOUT_MS), 24 * 60 * 60_000);
+        const maxLogBytes = Math.min(Math.max(4_096, options.maxLogBytes ?? DEFAULT_RUN_LOG_BYTES), 16 * 1024 * 1024);
+        mkdirSync(join(cronDir(), "logs"), { recursive: true, mode: 0o700 });
+        try {
+            chmodSync(cronDir(), 0o700);
+            chmodSync(join(cronDir(), "logs"), 0o700);
+        }
+        catch { /* best effort */ }
         const log = logPath(job.id);
         capLog(log);
         try {
-            appendFileSync(log, `\n===== ${new Date().toISOString()} · ${job.name} (${job.mode}) =====\n`);
+            const safeName = redactToolSubprocessOutput(String(job.name).replace(/[\r\n\0]/g, " ").slice(0, 256));
+            appendFileSync(log, `\n===== ${new Date().toISOString()} · ${safeName} (${job.mode}) =====\n`, { mode: 0o600 });
+            chmodSync(log, 0o600);
         }
         catch {
             /* logging is best-effort */
@@ -52,26 +223,146 @@ export function runJobOnce(job) {
         // no agent, no tokens, exact. The other modes spawn a fresh hara session. Either way HARA_CRON=1
         // marks the child so cron-run sessions can't create more cron jobs (recursion guard).
         const self = selfArgv();
-        const [cmd, argv] = job.mode === "command"
-            ? ["bash", ["-lc", job.task]]
+        if (job.mode === "command") {
+            const denied = sensitiveShellCommandReason(job.task, job.cwd);
+            if (denied) {
+                const error = `blocked by protected secret boundary (${denied})`;
+                try {
+                    appendFileSync(log, `[blocked] ${error}\n`);
+                }
+                catch { /* best effort */ }
+                resolve({ ok: false, error, output: "" });
+                return;
+            }
+        }
+        let shell;
+        try {
+            shell = job.mode === "command" ? shellCommand(job.task, job.cwd, "off") : null;
+        }
+        catch (error) {
+            const message = `failed security preflight: ${error instanceof Error ? error.message : String(error)}`;
+            try {
+                appendFileSync(log, `[blocked] ${message}\n`, { mode: 0o600 });
+            }
+            catch { /* best effort */ }
+            resolve({ ok: false, error: message, output: "" });
+            return;
+        }
+        const [cmd, argv] = shell
+            ? [shell.cmd, shell.args]
             : [self[0], [...self.slice(1), ...(job.mode === "org" ? ["org", job.task] : ["-p", job.task, "--approval", "full-auto"])]];
         // HARA_CRON_NAME rides along so the child session's meta gets a human title ("job name · time")
         // instead of the raw prompt (session store's automated-title strategy).
-        const child = spawn(cmd, argv, { cwd: job.cwd, env: { ...process.env, HARA_CRON: "1", HARA_CRON_NAME: job.name } });
+        const env = job.mode === "command"
+            ? toolSubprocessEnv(process.env, { HARA_CRON: "1" })
+            : { ...process.env, HARA_CRON: "1", HARA_CRON_NAME: job.name };
+        const processGroup = platform() !== "win32";
+        let child;
+        try {
+            child = spawn(cmd, argv, { cwd: job.cwd, env, detached: processGroup });
+        }
+        catch (error) {
+            resolve({ ok: false, error: `failed to start: ${error instanceof Error ? error.message : String(error)}`, output: "" });
+            return;
+        }
         let tail = ""; // last few KB, for chat delivery (the full stream goes to the log file)
-        const append = (d) => {
-            tail = (tail + d.toString()).slice(-4_000);
+        let logBytes = (() => { try {
+            return statSync(log).size;
+        }
+        catch {
+            return 0;
+        } })();
+        let logCapped = false;
+        let done = false;
+        let timedOut = false;
+        let forceIssued = false;
+        let closeBeforeForce = false;
+        let cancelTermination;
+        const appendSafe = (safe) => {
+            tail = (tail + safe).slice(-4_000);
+            if (logCapped)
+                return;
             try {
-                appendFileSync(log, d);
+                const bytes = Buffer.byteLength(safe);
+                if (logBytes + bytes <= maxLogBytes) {
+                    appendFileSync(log, safe, { mode: 0o600 });
+                    logBytes += bytes;
+                }
+                else {
+                    const marker = `\n…[run log capped at ${maxLogBytes} bytes]…\n`;
+                    appendFileSync(log, marker, { mode: 0o600 });
+                    logBytes += Buffer.byteLength(marker);
+                    logCapped = true;
+                }
             }
             catch {
                 /* ignore */
             }
         };
-        child.stdout.on("data", append);
-        child.stderr.on("data", append);
-        child.on("error", (e) => resolve({ ok: false, error: String(e?.message ?? e), output: tail }));
-        child.on("close", (code) => resolve(code === 0 ? { ok: true, output: tail } : { ok: false, error: `exited ${code}`, output: tail }));
+        // stdout and stderr are separate byte streams; sharing a line buffer can splice unrelated chunks and
+        // either corrupt output or create an unsafe synthetic token. Keep an independent redactor per stream.
+        const stdout = createToolOutputLineRedactor(appendSafe);
+        const stderr = createToolOutputLineRedactor(appendSafe);
+        const flush = () => { stdout.flush(); stderr.flush(); };
+        const settle = (result) => {
+            if (done)
+                return;
+            done = true;
+            clearTimeout(timeoutTimer);
+            // Keep a timeout-triggered group KILL scheduled even if the direct child closed on TERM. The default
+            // cancellation removes only the hard-settle fallback; it deliberately does not cancel escalation.
+            cancelTermination?.();
+            flush();
+            capLog(log);
+            resolve({
+                ...result,
+                error: result.error ? redactToolSubprocessOutput(result.error) : undefined,
+                output: tail,
+            });
+        };
+        const timeoutTimer = setTimeout(() => {
+            if (done)
+                return;
+            timedOut = true;
+            cancelTermination = terminateSubprocessTree(child, {
+                processGroup,
+                graceMs: TERMINATE_GRACE_MS,
+                fallbackMs: 3_000,
+                onForce: () => {
+                    forceIssued = true;
+                    if (closeBeforeForce)
+                        settle({ ok: false, error: `timed out after ${timeoutMs}ms`, output: tail });
+                },
+                onFallback: () => {
+                    child.stdout?.destroy();
+                    child.stderr?.destroy();
+                    settle({ ok: false, error: `timed out after ${timeoutMs}ms`, output: tail });
+                },
+            });
+        }, timeoutMs);
+        child.stdout?.on("data", (d) => { if (!done && !timedOut)
+            stdout.push(d.toString()); });
+        child.stderr?.on("data", (d) => { if (!done && !timedOut)
+            stderr.push(d.toString()); });
+        child.on("error", (e) => {
+            if (timedOut && !forceIssued) {
+                closeBeforeForce = true;
+                return;
+            }
+            settle(timedOut
+                ? { ok: false, error: `timed out after ${timeoutMs}ms`, output: tail }
+                : { ok: false, error: String(e?.message ?? e), output: tail });
+        });
+        child.on("close", (code) => {
+            if (timedOut && !forceIssued) {
+                closeBeforeForce = true;
+                return;
+            }
+            if (timedOut)
+                settle({ ok: false, error: `timed out after ${timeoutMs}ms`, output: tail });
+            else
+                settle(code === 0 ? { ok: true, output: tail } : { ok: false, error: `exited ${code}`, output: tail });
+        });
     });
 }
 /** After a run: push the outcome to the job's deliver channel, and — on repeated failures — a 🚨 alert
@@ -106,29 +397,77 @@ export async function deliverOutcome(job, r, deliver = deliverResult, nowMs = Da
  *  overlapping tick (launchd fires every 60s; a job may run longer) skips instead of double-firing.
  *  `run` is injectable for tests. Returns the job ids that ran. */
 export async function runTick(nowMs, run = runJobOnce) {
-    mkdirSync(cronDir(), { recursive: true });
+    mkdirSync(cronDir(), { recursive: true, mode: 0o700 });
+    try {
+        chmodSync(cronDir(), 0o700);
+    }
+    catch { /* best effort */ }
     const lock = lockPath();
-    if (existsSync(lock)) {
-        let held = false;
+    const token = `${process.pid}:${randomUUID()}`;
+    const takeover = takeoverPath();
+    let acquired = false;
+    const guardState = prepareTakeoverGuard(takeover, nowMs);
+    if (guardState === "recovered")
+        return { ran: [], skipped: "cleared a stale tick takeover guard; retry on the next tick" };
+    if (guardState === "active")
+        return { ran: [], skipped: "another tick is taking over a stale lock" };
+    // Every ordinary contender checks the takeover guard both before and after O_EXCL creation. The second
+    // check covers a contender that was descheduled between its first check and open(2).
+    if (!existsSync(takeover) && writeExclusive(lock, token)) {
+        if (!existsSync(takeover))
+            acquired = true;
+        else
+            removeOwnedLock(lock, token);
+    }
+    else if (!existsSync(lock)) {
+        // A lock owner may have released between our failed preflight and O_EXCL attempt. Missing a single
+        // minute is safer than guessing through an active takeover; the next scheduler tick retries.
+        return { ran: [], skipped: "another tick is acquiring the lock" };
+    }
+    else {
+        const observedFile = readTickLockFileSnapshot(lock);
+        if (!observedFile)
+            return { ran: [], skipped: "another tick is in progress" };
+        const observed = parseTickLockSnapshot(observedFile);
+        const malformedStale = (snapshot) => nowMs - snapshot.mtimeMs >= LOCK_STALE_MS;
+        if (observed ? !staleTickLock(observed, nowMs) : !malformedStale(observedFile)) {
+            return { ran: [], skipped: "another tick is in progress" };
+        }
+        const takeoverToken = `${process.pid}:${randomUUID()}`;
+        if (!writeExclusive(takeover, takeoverToken))
+            return { ran: [], skipped: "another tick is taking over a stale lock" };
         try {
-            const fresh = nowMs - statSync(lock).mtimeMs < LOCK_STALE_MS;
-            const pid = Number(readFileSync(lock, "utf8").trim());
-            let alive = false;
-            try {
-                alive = pid > 0 && (process.kill(pid, 0), true); // signal 0 = liveness probe
-            }
-            catch {
-                alive = false; // ESRCH → the tick that wrote this lock is gone
+            // Re-read under the exclusive guard and require the exact content/inode/size/mtime/ctime diagnosed.
+            // A fresh malformed record stays fail-closed; only an unchanged record past the 6h poison window is
+            // removable. Never unlink a successor merely because it occupies the same pathname.
+            const currentFile = readTickLockFileSnapshot(lock);
+            if (currentFile) {
+                if (!sameTickLockFile(observedFile, currentFile)) {
+                    return { ran: [], skipped: "the tick lock changed during stale takeover" };
+                }
+                const current = parseTickLockSnapshot(currentFile);
+                if (observed) {
+                    if (!sameTickLock(observed, current) || !current || !staleTickLock(current, nowMs)) {
+                        return { ran: [], skipped: "the tick lock changed during stale takeover" };
+                    }
+                }
+                else if (current || !malformedStale(currentFile)) {
+                    return { ran: [], skipped: "the tick lock changed during stale takeover" };
+                }
+                rmSync(lock);
             }
-            held = fresh && alive; // respect a lock only if it's recent AND owned by a live process (no crash-poison)
+            acquired = writeExclusive(lock, token);
         }
-        catch {
-            held = false; // unreadable lock → proceed
+        finally {
+            removeOwnedLock(takeover, takeoverToken);
         }
-        if (held)
-            return { ran: [], skipped: "another tick is in progress" };
     }
-    writeFileSync(lock, String(process.pid));
+    if (!acquired)
+        return { ran: [], skipped: "another tick is acquiring the lock" };
+    try {
+        chmodSync(lock, 0o600);
+    }
+    catch { /* best effort */ }
     try {
         const due = dueJobs(loadJobs(), nowMs);
         const ran = [];
@@ -141,11 +480,7 @@ export async function runTick(nowMs, run = runJobOnce) {
         return { ran };
     }
     finally {
-        try {
-            rmSync(lock);
-        }
-        catch {
-            /* best-effort */
-        }
+        // Remove only the lock instance we created; never unlink a successor after a stale-lock takeover.
+        releasePrimaryTickLock(lock, takeover, token);
     }
 }

package/dist/cron/store.js

@@ -3,7 +3,7 @@
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { randomUUID } from "node:crypto";
-import { readFileSync, writeFileSync, existsSync, mkdirSync, renameSync } from "node:fs";
+import { chmodSync, readFileSync, writeFileSync, existsSync, mkdirSync, renameSync } from "node:fs";
 export function cronDir() {
     return join(homedir(), ".hara", "cron");
 }
@@ -27,11 +27,19 @@ export function loadJobs() {
 }
 /** Persist the job list with an atomic temp-write + rename (never leaves a half-written jobs.json). */
 export function saveJobs(jobs) {
-    mkdirSync(cronDir(), { recursive: true });
+    mkdirSync(cronDir(), { recursive: true, mode: 0o700 });
+    try {
+        chmodSync(cronDir(), 0o700);
+    }
+    catch { /* best effort */ }
     const p = jobsPath();
     const tmp = `${p}.${process.pid}.tmp`;
-    writeFileSync(tmp, JSON.stringify(jobs, null, 2) + "\n", "utf8");
+    writeFileSync(tmp, JSON.stringify(jobs, null, 2) + "\n", { encoding: "utf8", mode: 0o600 });
     renameSync(tmp, p);
+    try {
+        chmodSync(p, 0o600);
+    }
+    catch { /* best effort */ }
 }
 export function addJob(j) {
     const jobs = loadJobs();

package/dist/exec/jobs.js

@@ -3,10 +3,25 @@
 // optional dep). Same sandbox write-confinement as runShell (shared `shellCommand`). Jobs are the agent's
 // own child processes and are terminated when hara exits.
 import { spawn } from "node:child_process";
+import { platform } from "node:os";
 import { shellCommand } from "../sandbox.js";
+import { createToolOutputLineRedactor, redactToolSubprocessOutput, terminateSubprocessTree, toolSubprocessEnv, } from "../security/subprocess-env.js";
 const MAX_BUF = 64 * 1024; // retain only the tail of each job's combined output
+const MAX_RUNNING_JOBS = 32;
+const MAX_RETAINED_JOBS = 200;
 const jobs = new Map();
 let seq = 0;
+function pruneFinishedJobs(reserve = 0) {
+    const target = Math.max(0, MAX_RETAINED_JOBS - reserve);
+    if (jobs.size <= target)
+        return;
+    for (const [id, job] of jobs) {
+        if (jobs.size <= target)
+            break;
+        if (job.status !== "running" && !job.terminationPending)
+            jobs.delete(id);
+    }
+}
 const jobsListeners = new Set();
 /** Subscribe to job start/exit/kill. Lets the UI show "a background task is running" LIVE — crucially at
  *  IDLE too: a turn ending doesn't mean the background work did, and without this the user reads the idle
@@ -37,15 +52,52 @@ function ensureExitCleanup() {
 /** Start a background shell job; returns its id immediately. Output is captured to a capped tail buffer. */
 export function startJob(command, cwd, mode) {
     ensureExitCleanup();
+    const running = [...jobs.values()].filter((job) => job.status === "running" || job.terminationPending).length;
+    if (running >= MAX_RUNNING_JOBS) {
+        throw new Error(`too many background jobs (${MAX_RUNNING_JOBS}); stop or wait for an existing job before starting another`);
+    }
+    pruneFinishedJobs(1);
     const { cmd, args } = shellCommand(command, cwd, mode);
-    const child = spawn(cmd, args, { cwd });
-    const job = { id: "j" + ++seq, command, child, status: "running", code: null, startedAt: Date.now(), buf: "" };
-    const onData = (d) => {
-        job.buf = (job.buf + d.toString()).slice(-MAX_BUF);
+    const processGroup = platform() !== "win32";
+    const child = spawn(cmd, args, { cwd, env: toolSubprocessEnv(), detached: processGroup });
+    const job = {
+        id: "j" + ++seq,
+        // The raw command may contain an inline --token/KEY=value. It is used only for spawning above; every
+        // stored/listed copy is redacted so /jobs, TUI state, and tool results cannot replay it.
+        command: redactToolSubprocessOutput(command),
+        child,
+        status: "running",
+        code: null,
+        startedAt: Date.now(),
+        buf: "",
+        processGroup,
+        flushOutput: () => { },
+        terminationPending: false,
+        closed: false,
+    };
+    const appendSafe = (safe) => {
+        job.buf = (job.buf + safe).slice(-MAX_BUF);
     };
-    child.stdout?.on("data", onData);
-    child.stderr?.on("data", onData);
+    // Separate buffers avoid stitching an stdout token prefix to an unrelated stderr suffix. Only redacted
+    // text reaches Job.buf; later callers never need access to the raw subprocess stream.
+    const stdout = createToolOutputLineRedactor(appendSafe);
+    const stderr = createToolOutputLineRedactor(appendSafe);
+    let flushed = false;
+    job.flushOutput = () => {
+        if (flushed)
+            return;
+        flushed = true;
+        stdout.flush();
+        stderr.flush();
+    };
+    child.stdout?.on("data", (d) => stdout.push(d.toString()));
+    child.stderr?.on("data", (d) => stderr.push(d.toString()));
     child.on("close", (code) => {
+        job.closed = true;
+        job.cancelTermination?.();
+        if (!job.terminationPending)
+            job.cancelTermination = undefined;
+        job.flushOutput();
         if (job.status === "running") {
             job.status = "exited";
             job.code = code;
@@ -53,10 +105,13 @@ export function startJob(command, cwd, mode) {
         }
     });
     child.on("error", (e) => {
+        job.cancelTermination?.();
+        job.cancelTermination = undefined;
         if (job.status === "running") {
             job.status = "exited";
             job.code = -1;
-            job.buf = (job.buf + `\n[spawn error] ${e.message}`).slice(-MAX_BUF);
+            appendSafe(`\n[spawn error] ${redactToolSubprocessOutput(e.message)}`);
+            job.flushOutput();
             emitJobsChange();
         }
     });
@@ -80,26 +135,39 @@ export function killJob(id) {
     const j = jobs.get(id);
     if (!j || j.status !== "running")
         return false;
-    try {
-        j.child.kill("SIGTERM");
-    }
-    catch {
-        /* already gone */
-    }
     j.status = "killed";
+    j.terminationPending = true;
+    j.cancelTermination = terminateSubprocessTree(j.child, {
+        processGroup: j.processGroup,
+        graceMs: 250,
+        fallbackMs: 1_000,
+        onForce: () => {
+            j.terminationPending = false;
+            if (j.closed)
+                j.cancelTermination = undefined;
+        },
+        onFallback: () => {
+            // An intentionally daemonized descendant can escape its original process group while retaining a
+            // pipe. Destroy our ends so it cannot keep Hara alive; normal descendants were already group-killed.
+            j.child.stdout?.destroy();
+            j.child.stderr?.destroy();
+            j.flushOutput();
+            j.cancelTermination = undefined;
+        },
+    });
     emitJobsChange();
     return true;
 }
 /** Terminate every running job — registered on process exit so dev servers don't outlive hara. */
 export function killAllJobs() {
     for (const j of jobs.values()) {
-        if (j.status === "running") {
-            try {
-                j.child.kill("SIGTERM");
-            }
-            catch {
-                /* ignore */
-            }
+        if (j.status === "running" || j.terminationPending) {
+            j.cancelTermination?.(true);
+            j.cancelTermination = undefined;
+            // `exit` handlers cannot wait for a grace timer. Force the whole owned tree synchronously so normal
+            // quit does not orphan a dev server or worker; Windows taskkill /T supplies the equivalent tree kill.
+            terminateSubprocessTree(j.child, { force: true, processGroup: j.processGroup });
+            j.terminationPending = false;
             j.status = "killed";
         }
     }