@nanhara/hara 0.122.0 → 0.122.2

package/dist/security/subprocess-env.js

@@ -0,0 +1,210 @@
+// Environment boundary for model-controlled subprocesses. Provider credentials stay in the Hara process;
+// Bash/jobs/hooks/MCP/external agents receive ordinary build/runtime variables but not secret-shaped values.
+// A user can explicitly pass selected names with HARA_SUBPROCESS_ENV_ALLOW=NAME,OTHER before launching Hara.
+import { redactSensitiveText } from "./secrets.js";
+import { spawn } from "node:child_process";
+import { platform } from "node:os";
+const SECRET_NAME = /(?:^|_)(?:API_?KEY|KEY|SECRET|TOKEN|PASSWORD|PASSWD|CREDENTIALS?|COOKIE|JWT|AUTH)(?:_|$)/i;
+const SECRET_EXACT = new Set([
+    "DATABASE_URL",
+    "REDIS_URL",
+    "MONGODB_URI",
+    "MONGO_URL",
+    "PGPASSWORD",
+]);
+const INJECTION_NAME = /^(?:BASH_ENV|ENV|NODE_OPTIONS|NODE_PATH|PYTHONPATH|PYTHONHOME|PYTHONSTARTUP|RUBYOPT|RUBYLIB|PERL5OPT|PERL5LIB|JAVA_TOOL_OPTIONS|_JAVA_OPTIONS|LD_PRELOAD|LD_LIBRARY_PATH|DYLD_.*|GIT_ASKPASS|SSH_ASKPASS|SUDO_ASKPASS|GIT_SSH_COMMAND|GIT_CONFIG(?:_.*)?|GIT_EXEC_PATH|GIT_EXTERNAL_DIFF|GIT_EDITOR|GIT_SEQUENCE_EDITOR|GIT_PAGER|PAGER|MANPAGER|EDITOR|VISUAL|LESSOPEN|LESSCLOSE|NPM_CONFIG_SCRIPT_SHELL|NPM_CONFIG_NODE_GYP|NPM_CONFIG_USERCONFIG|PIP_CONFIG_FILE|AWS_SHARED_CREDENTIALS_FILE|AWS_CONFIG_FILE|DOCKER_CONFIG|KUBECONFIG|NETRC|AZURE_CONFIG_DIR)$/;
+const SAFE_EXCEPTIONS = new Set(["SSH_AUTH_SOCK"]); // socket path, not the credential itself
+export function isSecretEnvironmentName(name) {
+    const normalized = name.toUpperCase(); // Windows environment names are case-insensitive
+    if (SAFE_EXCEPTIONS.has(normalized))
+        return false;
+    return SECRET_EXACT.has(normalized) || SECRET_NAME.test(normalized) || INJECTION_NAME.test(normalized);
+}
+function explicitAllow(env) {
+    return new Set(String(env.HARA_SUBPROCESS_ENV_ALLOW ?? "")
+        .split(",")
+        .map((name) => name.trim())
+        .filter((name) => /^[A-Za-z_][A-Za-z0-9_]*$/.test(name))
+        .map((name) => name.toUpperCase()));
+}
+/** Build an own copy so callers never mutate process.env. Explicit overrides (for example an MCP server's
+ * configured env) are intentional and win after the inherited environment has been scrubbed. */
+export function toolSubprocessEnv(source = process.env, overrides = {}) {
+    const allow = explicitAllow(source);
+    const out = {};
+    for (const [name, value] of Object.entries(source)) {
+        if (value === undefined)
+            continue;
+        const normalized = name.toUpperCase();
+        if (normalized === "HARA_SUBPROCESS_ENV_ALLOW")
+            continue;
+        if (isSecretEnvironmentName(normalized) && !allow.has(normalized))
+            continue;
+        out[name] = value;
+    }
+    for (const [name, value] of Object.entries(overrides)) {
+        if (value === undefined)
+            delete out[name];
+        else
+            out[name] = value;
+    }
+    return out;
+}
+/** Redact both recognizable credential syntax and the exact values of secret-named environment variables.
+ * Exact-value matching closes the gap for opaque provider tokens that have no standard prefix. */
+export function redactToolSubprocessOutput(text, source = process.env, explicit = {}) {
+    let out = redactSensitiveText(text).text;
+    const values = new Set();
+    for (const env of [source, explicit]) {
+        for (const [name, value] of Object.entries(env)) {
+            if (!value || value.length < 6 || !isSecretEnvironmentName(name))
+                continue;
+            values.add(value);
+        }
+    }
+    for (const value of [...values].sort((a, b) => b.length - a.length)) {
+        if (out.includes(value))
+            out = out.split(value).join("***");
+    }
+    return out;
+}
+/** Line-buffered streaming redactor. Redacting each transport chunk independently is unsafe because a token
+ * may be split between two chunks. Holding the partial line until the next newline/end closes that gap. */
+export function createToolOutputLineRedactor(emit, source = process.env, explicit = {}, maxPendingCharacters = 64 * 1024) {
+    if (!Number.isSafeInteger(maxPendingCharacters) || maxPendingCharacters < 1024) {
+        throw new Error("streaming redactor maxPendingCharacters must be an integer >= 1024");
+    }
+    let pending = "";
+    let droppingLongLine = false;
+    const feed = (piece, endsLine) => {
+        if (droppingLongLine) {
+            if (endsLine)
+                droppingLongLine = false;
+            return;
+        }
+        if (pending.length + piece.length > maxPendingCharacters) {
+            // Never release a prefix of an overlong line: a credential could straddle that release boundary.
+            // Drop through the newline instead, keeping memory fixed and preserving only a safe diagnostic.
+            pending = "";
+            droppingLongLine = !endsLine;
+            emit(`[output line omitted — exceeded ${maxPendingCharacters} characters]\n`);
+            return;
+        }
+        pending += piece;
+        if (endsLine) {
+            emit(redactToolSubprocessOutput(pending, source, explicit));
+            pending = "";
+        }
+    };
+    return {
+        push(chunk) {
+            let start = 0;
+            let newline;
+            while ((newline = chunk.indexOf("\n", start)) >= 0) {
+                feed(chunk.slice(start, newline + 1), true);
+                start = newline + 1;
+            }
+            if (start < chunk.length)
+                feed(chunk.slice(start), false);
+        },
+        flush() {
+            if (pending)
+                emit(redactToolSubprocessOutput(pending, source, explicit));
+            pending = "";
+            droppingLongLine = false;
+        },
+    };
+}
+/** Terminate a spawned tool and, when it owns a POSIX process group, all descendants. On Windows,
+ * taskkill /T is the supported process-tree primitive. Callers should spawn with `detached: true` on POSIX
+ * and pass `processGroup: true`; the explicit flag avoids ever signaling Hara's own process group. */
+export function terminateSubprocessTree(child, options = {}) {
+    const force = options.force === true;
+    const pid = child.pid;
+    if (!pid)
+        return () => { };
+    const signal = (hard) => {
+        const direct = () => {
+            try {
+                child.kill(hard ? "SIGKILL" : "SIGTERM");
+            }
+            catch { /* already gone */ }
+        };
+        if (platform() === "win32") {
+            try {
+                // Asynchronous taskkill preserves the caller's wall-clock fallback; a synchronous 5s taskkill
+                // timeout here could itself make a 200ms tool timeout take ten seconds across TERM + force passes.
+                const killer = spawn("taskkill", ["/pid", String(pid), "/t", ...(hard ? ["/f"] : [])], {
+                    stdio: "ignore",
+                    windowsHide: true,
+                    env: toolSubprocessEnv(),
+                });
+                killer.once("error", direct);
+                killer.once("close", (code) => { if (code !== 0)
+                    direct(); });
+                killer.unref();
+                return;
+            }
+            catch {
+                // Fall back to Node's direct-child signal below.
+            }
+        }
+        else if (options.processGroup) {
+            try {
+                process.kill(-pid, hard ? "SIGKILL" : "SIGTERM");
+                return;
+            }
+            catch {
+                // The group may have exited between the check and signal; direct-child kill is a safe fallback.
+            }
+        }
+        direct();
+    };
+    signal(force);
+    if (force)
+        options.onForce?.();
+    const graceMs = options.graceMs;
+    if (force || graceMs === undefined)
+        return () => { };
+    const grace = Math.max(0, Math.min(graceMs, 30_000));
+    const fallback = Math.max(0, Math.min(options.fallbackMs ?? 1_000, 30_000));
+    let fallbackActive = true;
+    let forceTimer;
+    let fallbackTimer;
+    const cancelFallback = () => {
+        if (!fallbackActive)
+            return;
+        fallbackActive = false;
+        if (fallbackTimer)
+            clearTimeout(fallbackTimer);
+        child.off("close", cancelFallback);
+        child.off("error", cancelFallback);
+    };
+    // `close` only proves the direct child's stdio is closed. A grandchild can redirect stdio, ignore TERM,
+    // and remain in the owned process group, so the forced group kill MUST NOT be cancelled by child close.
+    // We cancel only the API hard-settle fallback; the short force timer is intentionally kept referenced so
+    // natural process exit cannot orphan a resistant descendant before escalation runs.
+    child.once("close", cancelFallback);
+    child.once("error", cancelFallback);
+    forceTimer = setTimeout(() => {
+        forceTimer = undefined;
+        signal(true);
+        options.onForce?.();
+    }, grace);
+    if (options.onFallback) {
+        fallbackTimer = setTimeout(() => {
+            if (!fallbackActive)
+                return;
+            const callback = options.onFallback;
+            cancelFallback();
+            callback?.();
+        }, grace + fallback);
+    }
+    return (cancelForce = false) => {
+        cancelFallback();
+        if (cancelForce && forceTimer) {
+            clearTimeout(forceTimer);
+            forceTimer = undefined;
+        }
+    };
+}

package/dist/serve/server.js

@@ -31,6 +31,7 @@ import { disposeTodoScope, restoreTodos, serializeTodos } from "../tools/todo.js
 import { disposeReminderScope } from "../agent/reminders.js";
 import { SessionHub, realStore } from "./sessions.js";
 import { parseFrame, rpcResult, rpcError, rpcNotify, ERR, PROTOCOL_VERSION } from "./protocol.js";
+import { readModelContextFileSync } from "../fs-read.js";
 const APPROVAL_TIMEOUT_MS = 300_000; // an unanswered approval denies after 5 min (never hangs a turn)
 const COMPACT_TIMEOUT_MS = 60_000;
 const SHUTDOWN_GRACE_MS = 2_000;
@@ -465,7 +466,7 @@ export async function startServe(opts, deps) {
         }).slice(0, 5);
         const restore = buildFileRestore(touched, (f) => {
             try {
-                return readFileSync(f, "utf8");
+                return readModelContextFileSync(f, 32 * 1024);
             }
             catch {
                 return null;

package/dist/skills/skills.js

@@ -2,12 +2,15 @@
 // ~/.hara/skills). Frontmatter: name, description (required) + when_to_use / allowed-tools /
 // context inline|fork / model / paths / user-invocable / disable-model-invocation. The body is the
 // instructions, loaded ON DEMAND (progressive disclosure) — only the frontmatter index sits in context.
-import { readFileSync, writeFileSync, existsSync, mkdirSync, readdirSync } from "node:fs";
+import { existsSync, readdirSync } from "node:fs";
 import { join } from "node:path";
 import { homedir } from "node:os";
 import { findProjectRoot } from "../context/agents-md.js";
 import { scanMemory } from "../memory/guard.js";
 import { pluginSkillDirs } from "../plugins/plugins.js";
+import { readModelContextFileSync, readVerifiedRegularFileSnapshot } from "../fs-read.js";
+import { atomicWriteText, bindAtomicWritePath } from "../fs-write.js";
+const MAX_SKILL_BYTES = 512 * 1024;
 export function skillsDir(cwd) {
     return join(findProjectRoot(cwd), ".hara", "skills");
 }
@@ -60,7 +63,7 @@ export function loadSkillIndex(cwd) {
             if (!existsSync(file))
                 continue;
             try {
-                const { fm } = parseFrontmatter(readFileSync(file, "utf8"));
+                const { fm } = parseFrontmatter(readModelContextFileSync(file, MAX_SKILL_BYTES));
                 const id = fm.name || entry;
                 byId.set(id, {
                     id,
@@ -86,7 +89,7 @@ export function loadSkillIndex(cwd) {
 /** Read a skill's instruction body (progressive disclosure — only when the model/user opens it). */
 export function loadSkillBody(skill) {
     try {
-        return parseFrontmatter(readFileSync(skill.file, "utf8")).body;
+        return parseFrontmatter(readModelContextFileSync(skill.file, MAX_SKILL_BYTES)).body;
     }
     catch {
         return "";
@@ -129,13 +132,19 @@ when_to_use: after editing code, before declaring a task done
 4. Summarize: what you ran, pass/fail, and anything still unverified.
 `;
 /** Create ~/.hara/skills/verify-change/SKILL.md as a starter example. Returns the paths written. */
-export function scaffoldSkills(cwd) {
+export async function scaffoldSkills(cwd) {
     const dir = join(skillsDir(cwd), "verify-change");
-    mkdirSync(dir, { recursive: true });
     const p = join(dir, "SKILL.md");
-    if (existsSync(p))
+    const boundary = bindAtomicWritePath(p, "scaffold skill");
+    try {
+        await readVerifiedRegularFileSnapshot(boundary.target, undefined, "scaffold skill");
         return [];
-    writeFileSync(p, SCAFFOLD, "utf8");
+    }
+    catch (error) {
+        if (error?.code !== "ENOENT")
+            throw error;
+    }
+    await atomicWriteText(boundary.target, SCAFFOLD, { expected: null, boundary });
     invalidateSkillsCache();
     return [p];
 }

package/dist/tools/builtin.js

@@ -7,10 +7,12 @@ import { runShell } from "../sandbox.js";
 import { nearestPaths } from "../fs-walk.js";
 import { emitDiff } from "../diff.js";
 import { recordEdit } from "../undo.js";
-import { atomicWriteText } from "../fs-write.js";
+import { atomicWriteText, bindAtomicWritePath } from "../fs-write.js";
 import { invalidateFileCandidates } from "../context/mentions.js";
-import { BinaryFileError, readRegularFileSnapshot, streamFileSlice } from "../fs-read.js";
+import { BinaryFileError, readVerifiedRegularFileSnapshot, resolveVerifiedModelPath, streamFileSlice } from "../fs-read.js";
 import { startJob, listJobs, tailJob, killJob } from "../exec/jobs.js";
+import { sensitiveFileError, sensitiveShellCommandReason } from "../security/sensitive-files.js";
+import { createToolOutputLineRedactor, redactToolSubprocessOutput } from "../security/subprocess-env.js";
 import { hostsInCommand, isNetworkGitOp, hostFromConnectError, isConnectFailure, markHostUnreachable, isHostUnreachable, unreachableHostsSnapshot, } from "./net-reachability.js";
 const MAX = 100_000;
 /** Package installs are network-bound and routinely exceed the ordinary foreground cap. */
@@ -123,10 +125,17 @@ registerTool({
     kind: "read",
     async run(input, ctx) {
         const p = abs(input.path, ctx.cwd);
+        const denied = sensitiveFileError(p, "read");
+        if (denied)
+            return denied;
         try {
+            const target = resolveVerifiedModelPath(p, "read");
             // streamFileSlice opens O_NONBLOCK, validates the same fd as a regular file, and stops after the
             // requested window. Using it for every size removes the path-level stat→read race entirely.
-            return cap(await streamFileSlice(p, input.offset, input.limit ?? READ_LINES, { lineCap: LINE_CAP }));
+            return cap(await streamFileSlice(target, input.offset, input.limit ?? READ_LINES, {
+                lineCap: LINE_CAP,
+                protectSensitive: true,
+            }));
         }
         catch (e) {
             if (e instanceof BinaryFileError)
@@ -150,28 +159,39 @@ registerTool({
     kind: "edit",
     async run(input, ctx) {
         const p = abs(input.path, ctx.cwd);
+        const denied = sensitiveFileError(p, "write");
+        if (denied)
+            return denied;
         if (typeof input.content !== "string")
             return "Error: write_file `content` must be a string. No changes written.";
         let prevSnapshot = null;
+        let boundary;
         try {
-            prevSnapshot = await readRegularFileSnapshot(p);
+            boundary = bindAtomicWritePath(p, "write");
+            prevSnapshot = await readVerifiedRegularFileSnapshot(boundary.target, undefined, "write");
         }
         catch (error) {
-            if (error?.code !== "ENOENT")
+            if (error?.code !== "ENOENT" || !boundary)
                 return `Error: cannot inspect ${input.path}: ${error?.message ?? error?.code}. No changes written.`;
         }
+        if (!boundary)
+            return `Error: cannot bind ${input.path} to a stable parent. No changes written.`;
         const prev = prevSnapshot?.text ?? null;
         if (prev === input.content)
             return `Unchanged ${p} (${input.content.length} chars already match).`;
         let committed;
         try {
-            committed = await atomicWriteText(p, input.content, { expected: prev, expectedIdentity: prevSnapshot ?? undefined });
+            committed = await atomicWriteText(boundary.target, input.content, {
+                expected: prev,
+                expectedIdentity: prevSnapshot ?? undefined,
+                boundary,
+            });
         }
         catch (error) {
             return `Error: cannot write ${input.path}: ${error?.message ?? String(error)} No changes written.`;
         }
         emitDiff(input.path, prev ?? "", input.content, ctx.ui);
-        recordEdit([{ path: input.path, absPath: p, before: prev, beforeMode: prevSnapshot?.mode, committed, after: input.content }]);
+        recordEdit([{ path: input.path, absPath: boundary.target, before: prev, beforeMode: prevSnapshot?.mode, committed, after: input.content }]);
         invalidateFileCandidates(ctx.cwd);
         return `Wrote ${String(input.content).length} chars to ${p}` + (committed.warnings?.length ? ` Warning: ${committed.warnings.join("; ")}` : "");
     },
@@ -190,13 +210,19 @@ registerTool({
     },
     kind: "exec",
     async run(input, ctx) {
+        const protectedReason = sensitiveShellCommandReason(String(input.command ?? ""), ctx.cwd);
+        if (protectedReason) {
+            return (`Blocked: shell command crosses Hara's protected secret boundary (${protectedReason}). ` +
+                "This deny is not bypassed by full-auto. Restart hara with HARA_ALLOW_SENSITIVE_FILES=1 only for an intentional, user-approved exposure.");
+        }
         if (isNgrokTunnelCommand(input.command) && !ngrokAuthConfigured()) {
             return ("Skipped ngrok tunnel: no authentication was found in NGROK_AUTHTOKEN/NGROK_API_KEY or the standard ngrok config files. " +
                 "Configure ngrok authentication first, then retry. Do not rotate through other tunnel providers blindly; ask the user which authenticated provider to use.");
         }
         if (input.background) {
             const id = startJob(input.command, ctx.cwd, ctx.sandbox ?? "off");
-            return `Started background job ${id}: \`${input.command}\`. Manage with the \`job\` tool — {action:"tail",id:"${id}"} for output, {action:"kill",id:"${id}"} to stop, {action:"list"} for all. Poll until it exits before running steps that depend on it.`;
+            const safeCommand = redactToolSubprocessOutput(String(input.command));
+            return `Started background job ${id}: \`${safeCommand}\`. Manage with the \`job\` tool — {action:"tail",id:"${id}"} for output, {action:"kill",id:"${id}"} to stop, {action:"list"} for all. Poll until it exits before running steps that depend on it.`;
         }
         // Network fault tolerance — short-circuit if this command targets a host already found unreachable this
         // session, so a repeat doesn't burn another ~75s OS connect timeout. Only pays the git-remote lookup
@@ -214,19 +240,19 @@ registerTool({
                 return `Skipped without running: host "${blocked}" already failed to connect earlier in THIS session — hara does not retry network operations to a host known unreachable this session (a retry just hangs ~75s again). Do not swap in a public mirror (won't serve private repos) or switch protocols; diagnose instead.${proxyHint(blocked)}`;
             }
         }
-        let buf = ""; // TUI: line-buffer live output into the sink (one notice per line)
-        const live = ctx.ui
-            ? (s) => {
-                buf += s;
-                let i;
-                while ((i = buf.indexOf("\n")) >= 0) {
-                    ctx.ui.notice(buf.slice(0, i));
-                    buf = buf.slice(i + 1);
-                }
-            }
+        const liveEmit = ctx.ui
+            ? (line) => ctx.ui.notice(line.replace(/\r?\n$/, ""))
             : procOut.isTTY
-                ? (s) => procOut.write(s) // stream output in a plain terminal
-                : undefined;
+                ? (line) => procOut.write(line)
+                : null;
+        // stdout/stderr are independent byte streams. A shared partial-line buffer could splice stderr into
+        // the middle of a stdout credential and defeat exact-value redaction in the live UI.
+        const liveStdout = liveEmit ? createToolOutputLineRedactor(liveEmit) : null;
+        const liveStderr = liveEmit ? createToolOutputLineRedactor(liveEmit) : null;
+        const live = liveEmit
+            ? (s, stream) => (stream === "stdout" ? liveStdout : liveStderr).push(s)
+            : undefined;
+        const flushLive = () => { liveStdout?.flush(); liveStderr?.flush(); };
         const timeout = shellTimeoutMs(input.command, input.timeout_ms);
         try {
             const { stdout, stderr } = await runShell(input.command, ctx.cwd, ctx.sandbox ?? "off", {
@@ -234,12 +260,12 @@ registerTool({
                 maxBuffer: 10 * 1024 * 1024,
                 onData: live,
             });
-            if (ctx.ui && buf)
-                ctx.ui.notice(buf); // flush trailing partial line
+            flushLive();
             const combined = (stdout || "") + (stderr ? `\n[stderr]\n${stderr}` : "");
-            return capHeadTail(combined.trim() || "(no output)");
+            return capHeadTail(redactToolSubprocessOutput(combined.trim() || "(no output)"));
         }
         catch (e) {
+            flushLive();
             let base = `Command failed: ${e.message}\n${e.stdout || ""}${e.stderr || ""}`;
             // Timeout gets an ACTIONABLE next step, not just a corpse — the model (and user) should pick a
             // lane instead of blind-retrying into the same wall.
@@ -258,10 +284,10 @@ registerTool({
                 if (host) {
                     markHostUnreachable(host);
                     ctx.ui?.notice(`↯ ${host} marked unreachable for this session — won't retry network ops to it`);
-                    return capHeadTail(base + proxyHint(host));
+                    return capHeadTail(redactToolSubprocessOutput(base + proxyHint(host)));
                 }
             }
-            return capHeadTail(base);
+            return capHeadTail(redactToolSubprocessOutput(base));
         }
     },
 });
@@ -284,14 +310,14 @@ registerTool({
             const js = listJobs();
             if (!js.length)
                 return "(no background jobs)";
-            return js.map((j) => `${j.id}  [${j.status}${j.code != null ? " " + j.code : ""}]  ${Math.round(j.ageMs / 1000)}s  ${j.command}`).join("\n");
+            return js.map((j) => `${j.id}  [${j.status}${j.code != null ? " " + j.code : ""}]  ${Math.round(j.ageMs / 1000)}s  ${redactToolSubprocessOutput(j.command)}`).join("\n");
         }
         const id = String(input.id ?? "");
         if (!id)
             return "Error: `id` is required for tail/kill.";
         if (action === "tail") {
             const t = tailJob(id, Number(input.lines) || 40);
-            return t == null ? `No job ${id}.` : t.trim() || "(no output yet)";
+            return t == null ? `No job ${id}.` : redactToolSubprocessOutput(t.trim() || "(no output yet)");
         }
         if (action === "kill")
             return killJob(id) ? `Killed ${id}.` : `No running job ${id} (already exited/killed or unknown).`;

package/dist/tools/cron.js

@@ -10,6 +10,7 @@ import { parseSchedule, describeSchedule, nextRun, validTz } from "../cron/sched
 import { runJobOnce } from "../cron/runner.js";
 import { parseDeliver } from "../cron/deliver.js";
 import { isInstalled } from "../cron/install.js";
+import { sensitiveShellCommandReason } from "../security/sensitive-files.js";
 const fmt = (ms) => (ms ? new Date(ms).toLocaleString() : "—");
 registerTool({
     name: "cronjob",
@@ -70,6 +71,11 @@ registerTool({
                     return `Error: ${d.error}`;
             }
             const mode = input.mode === "org" || input.mode === "command" ? input.mode : "print";
+            if (mode === "command") {
+                const denied = sensitiveShellCommandReason(task, ctx.cwd);
+                if (denied)
+                    return `Error: scheduled shell command crosses Hara's protected secret boundary (${denied}).`;
+            }
             const job = addJob({
                 name: input.name ? String(input.name) : task.slice(0, 48),
                 schedule: sched,

package/dist/tools/edit.js

@@ -4,9 +4,10 @@ import { nearestPaths } from "../fs-walk.js";
 import { emitDiff } from "../diff.js";
 import { applyEdits } from "./apply-core.js";
 import { recordEdit } from "../undo.js";
-import { atomicWriteText } from "../fs-write.js";
+import { atomicWriteText, bindAtomicWritePath } from "../fs-write.js";
 import { invalidateFileCandidates } from "../context/mentions.js";
-import { readRegularFileSnapshot } from "../fs-read.js";
+import { readVerifiedRegularFileSnapshot } from "../fs-read.js";
+import { sensitiveFileError } from "../security/sensitive-files.js";
 registerTool({
     name: "edit_file",
     description: "Edit an existing file by replacing exact strings. Provide a single `old_string`/`new_string`, " +
@@ -41,12 +42,17 @@ registerTool({
     kind: "edit",
     async run(input, ctx) {
         const p = isAbsolute(input.path) ? input.path : resolve(ctx.cwd, input.path);
+        const denied = sensitiveFileError(p, "edit");
+        if (denied)
+            return denied;
         const edits = Array.isArray(input.edits) && input.edits.length
             ? input.edits
             : [{ old_string: input.old_string, new_string: input.new_string, replace_all: input.replace_all }];
         let snapshot;
+        let boundary;
         try {
-            snapshot = await readRegularFileSnapshot(p);
+            boundary = bindAtomicWritePath(p, "edit");
+            snapshot = await readVerifiedRegularFileSnapshot(boundary.target, undefined, "edit");
         }
         catch (error) {
             const near = nearestPaths(ctx.cwd, input.path);
@@ -58,13 +64,17 @@ registerTool({
             return `Error: ${res.error} in ${input.path}. No changes written.`;
         let committed;
         try {
-            committed = await atomicWriteText(p, res.text, { expected: text, expectedIdentity: snapshot });
+            committed = await atomicWriteText(boundary.target, res.text, {
+                expected: text,
+                expectedIdentity: snapshot,
+                boundary,
+            });
         }
         catch (error) {
             return `Error: cannot edit ${input.path}: ${error?.message ?? String(error)} No changes written.`;
         }
         emitDiff(input.path, text, res.text, ctx.ui);
-        recordEdit([{ path: input.path, absPath: p, before: text, beforeMode: snapshot.mode, committed, after: res.text }]);
+        recordEdit([{ path: input.path, absPath: boundary.target, before: text, beforeMode: snapshot.mode, committed, after: res.text }]);
         invalidateFileCandidates(ctx.cwd);
         const note = res.fuzzy ? " (quote-normalized)" : "";
         const plural = (n, w) => `${n} ${w}${n === 1 ? "" : "s"}`;