@nanhara/hara 0.122.0 → 0.122.2

package/dist/tools/external_agent.js

@@ -7,9 +7,11 @@
 // privileged tool — and because fan-out sub-agents only get the read-only allow-list (READONLY_TOOLS), they
 // never see this tool. Trust tiers (off|gated|full) gate the dangerous bypass/full-access sub-modes.
 import { spawn, execFileSync } from "node:child_process";
+import { platform } from "node:os";
 import { registerTool } from "./registry.js";
 import { capHeadTail } from "./builtin.js";
 import { loadConfig } from "../config.js";
+import { createToolOutputLineRedactor, redactToolSubprocessOutput, terminateSubprocessTree, toolSubprocessEnv, } from "../security/subprocess-env.js";
 /** Pure: build the spawn (cmd, args) for a backend, or null if unknown. Maps hara's sandbox/trust → the agent's
  *  own permission flags; the dangerous bypass/full-access modes are only reachable at trust "full". */
 export function buildExternalArgv(backend, task, o) {
@@ -24,6 +26,20 @@ export function buildExternalArgv(backend, task, o) {
     return null;
 }
 const BUILTIN_BACKENDS = ["claude", "codex"];
+const EXTERNAL_CAPTURE_PER_STREAM = 2 * 1024 * 1024;
+const EXTERNAL_OUTPUT_KILL_LIMIT = 4 * 1024 * 1024;
+export function appendBoundedExternalOutput(current, chunk, limit = EXTERNAL_CAPTURE_PER_STREAM) {
+    if (!Number.isSafeInteger(limit) || limit < 1)
+        return "";
+    const combined = current + chunk;
+    if (combined.length <= limit)
+        return combined;
+    const marker = "\n…[external output truncated]…\n";
+    const retained = Math.max(0, limit - marker.length);
+    const head = Math.floor(retained / 4);
+    const tail = retained - head;
+    return combined.slice(0, head) + marker.slice(0, limit - head - tail) + (tail ? combined.slice(-tail) : "");
+}
 /** Probe a CLI's availability via `<bin> --version` (cached per process). */
 const availCache = new Map();
 function available(bin) {
@@ -31,7 +47,7 @@ function available(bin) {
         return availCache.get(bin);
     let ok = false;
     try {
-        execFileSync(bin, ["--version"], { stdio: "ignore", timeout: 5000 });
+        execFileSync(bin, ["--version"], { stdio: "ignore", timeout: 5000, env: toolSubprocessEnv() });
         ok = true;
     }
     catch {
@@ -52,6 +68,7 @@ registerTool({
         "another agent to own end-to-end. It can read/write/run on the host, so it's gated by approval. " +
         "Args: task (required), backend (claude|codex; default = first installed), model (optional).",
     kind: "exec", // → approval gate; never exposed to read-only fan-out sub-agents
+    trustBoundary: "external",
     input_schema: {
         type: "object",
         properties: {
@@ -63,6 +80,10 @@ registerTool({
         required: ["task"],
     },
     async run(input, ctx) {
+        if (!ctx.ask && process.env.HARA_ALLOW_TRUSTED_EXTENSIONS !== "1") {
+            return ("Blocked: external_agent runs another host coding agent outside Hara's protected-file boundary. " +
+                "Use it interactively after approval, or restart with HARA_ALLOW_TRUSTED_EXTENSIONS=1 only after reviewing that agent.");
+        }
         const trust = resolveTrust();
         if (trust === "off")
             return "external_agent is disabled (set externalAgentTrust to gated|full, or HARA_EXTERNAL_AGENT_TRUST).";
@@ -80,37 +101,110 @@ registerTool({
             return `Unknown backend '${backend}'.`;
         const timeout = Math.min(Math.max(30_000, Number(input.timeout_ms) || 600_000), 1_800_000);
         return await new Promise((resolve) => {
-            const child = spawn(built.cmd, built.args, { cwd: ctx.cwd, env: process.env });
+            const processGroup = platform() !== "win32";
+            let child;
+            try {
+                child = spawn(built.cmd, built.args, {
+                    cwd: ctx.cwd,
+                    env: toolSubprocessEnv(),
+                    detached: processGroup,
+                });
+            }
+            catch (error) {
+                resolve(redactToolSubprocessOutput(`[${backend}] failed to start: ${error instanceof Error ? error.message : String(error)}`));
+                return;
+            }
             let out = "";
             let err = "";
+            let outputBytes = 0;
             let done = false;
+            let stoppingReason = null;
+            let forceIssued = false;
+            let closeBeforeForce = false;
+            let cancelTermination;
+            const liveOut = ctx.ui ? createToolOutputLineRedactor((line) => ctx.ui.notice(line.replace(/\r?\n$/, ""))) : null;
+            const liveErr = ctx.ui ? createToolOutputLineRedactor((line) => ctx.ui.notice(line.replace(/\r?\n$/, ""))) : null;
             const finish = (s) => {
                 if (done)
                     return;
                 done = true;
                 clearTimeout(timer);
-                resolve(capHeadTail(s));
+                // A stopped tree must still receive its scheduled group KILL even if the direct shell closed first.
+                // The default cancellation removes only the wall-clock fallback, not the force timer.
+                cancelTermination?.();
+                liveOut?.flush();
+                liveErr?.flush();
+                resolve(capHeadTail(redactToolSubprocessOutput(s)));
+            };
+            const stoppedText = () => {
+                const text = out.trim() || "(external agent produced no output)";
+                return `${stoppingReason}\n${text}${err ? `\n[stderr]\n${err.trim()}` : ""}`;
+            };
+            const stopTree = (reason) => {
+                if (done || stoppingReason)
+                    return;
+                stoppingReason = reason;
+                cancelTermination = terminateSubprocessTree(child, {
+                    processGroup,
+                    graceMs: 2_000,
+                    fallbackMs: 3_000,
+                    onForce: () => {
+                        forceIssued = true;
+                        if (closeBeforeForce)
+                            finish(stoppedText());
+                    },
+                    onFallback: () => {
+                        // A deliberately daemonized descendant may retain the pipes after escaping the owned group.
+                        child.stdout?.destroy();
+                        child.stderr?.destroy();
+                        finish(stoppedText());
+                    },
+                });
             };
             const timer = setTimeout(() => {
-                try {
-                    child.kill("SIGKILL");
+                stopTree(`[${backend}] timed out after ${timeout}ms`);
+            }, timeout);
+            child.stdin?.on("error", () => { });
+            child.stdin?.end(); // task is passed via argv
+            child.stdout?.on("data", (d) => {
+                if (done || stoppingReason)
+                    return;
+                const text = d.toString();
+                outputBytes += d.length;
+                out = appendBoundedExternalOutput(out, text);
+                liveOut?.push(text);
+                if (outputBytes > EXTERNAL_OUTPUT_KILL_LIMIT) {
+                    stopTree(`[${backend}] stopped after exceeding ${EXTERNAL_OUTPUT_KILL_LIMIT} output bytes`);
                 }
-                catch {
-                    /* already gone */
+            });
+            child.stderr?.on("data", (d) => {
+                if (done || stoppingReason)
+                    return;
+                const text = d.toString();
+                outputBytes += d.length;
+                err = appendBoundedExternalOutput(err, text);
+                liveErr?.push(text);
+                if (outputBytes > EXTERNAL_OUTPUT_KILL_LIMIT) {
+                    stopTree(`[${backend}] stopped after exceeding ${EXTERNAL_OUTPUT_KILL_LIMIT} output bytes`);
                 }
-                finish(`[${backend}] timed out after ${timeout}ms\n${out}`);
-            }, timeout);
-            child.stdin.end(); // task is passed via argv
-            child.stdout.on("data", (d) => {
-                out += d.toString();
-                ctx.ui?.notice?.(d.toString().trimEnd());
             });
-            child.stderr.on("data", (d) => {
-                err += d.toString();
+            child.on("error", (e) => {
+                if (stoppingReason && !forceIssued) {
+                    closeBeforeForce = true;
+                    return;
+                }
+                finish(stoppingReason ? stoppedText() : `[${backend}] failed to start: ${e.message} (is it installed?)`);
             });
-            child.on("error", (e) => finish(`[${backend}] failed to start: ${e.message} (is it installed?)`));
             child.on("close", (code) => {
                 const text = out.trim() || "(external agent produced no output)";
+                if (stoppingReason) {
+                    if (!forceIssued) {
+                        closeBeforeForce = true;
+                        return;
+                    }
+                    finish(stoppedText());
+                    return;
+                }
                 finish(code === 0 ? text : `[${backend} exit ${code}]\n${text}${err ? `\n[stderr]\n${err.trim()}` : ""}`);
             });
         });

package/dist/tools/memory.js

@@ -1,13 +1,16 @@
 // Memory tools — the agent's interface to durable memory. memory_search/get are read-only
 // (parallel-safe, never prompt); memory_write/forget are edits (gated by the approval mode).
-import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs";
-import { isAbsolute, resolve, join } from "node:path";
+import { existsSync } from "node:fs";
+import { isAbsolute, resolve, join, relative, sep } from "node:path";
 import { registerTool } from "./registry.js";
 import { searchAssets, assetSearchRoots } from "../recall.js";
 import { searchHybrid } from "../search/hybrid.js";
 import { memoryRoots, appendMemory, replaceMemory, forgetMemory } from "../memory/store.js";
 import { scanMemory, redactSecrets, scrubLocal } from "../memory/guard.js";
 import { globalSkillsDir, skillsDir, invalidateSkillsCache } from "../skills/skills.js";
+import { sensitiveFileError } from "../security/sensitive-files.js";
+import { readModelContextFileSync, readVerifiedRegularFileSnapshot } from "../fs-read.js";
+import { atomicWriteText, bindAtomicWritePath } from "../fs-write.js";
 const asTarget = (v) => (["memory", "user", "log"].includes(v) ? v : "memory");
 const asScope = (v) => (v === "global" ? "global" : "project");
 registerTool({
@@ -34,12 +37,18 @@ registerTool({
     kind: "read",
     async run(input, ctx) {
         const p = isAbsolute(String(input.path)) ? String(input.path) : resolve(ctx.cwd, String(input.path));
-        if (!memoryRoots(ctx.cwd).some((r) => p.startsWith(r)))
+        if (!memoryRoots(ctx.cwd).some((root) => {
+            const rel = relative(resolve(root), p);
+            return rel === "" || (rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel));
+        }))
             return `Error: ${input.path} is outside the memory store.`;
+        const denied = sensitiveFileError(p, "read");
+        if (denied)
+            return denied;
         if (!existsSync(p))
             return `Error: no memory file at ${p}.`;
         try {
-            return readFileSync(p, "utf8").slice(0, 50_000);
+            return readModelContextFileSync(p, 64 * 1024).slice(0, 50_000);
         }
         catch (e) {
             return `Error: ${e.message}`;
@@ -70,7 +79,9 @@ registerTool({
             return `Blocked: this looks unsafe to store (${scan.hits.join(", ")}). Rephrase without secrets/injection text.`;
         const scope = asScope(input.scope);
         const target = asTarget(input.target);
-        const f = input.mode === "replace" ? replaceMemory(scope, target, content, ctx.cwd) : appendMemory(scope, target, content, ctx.cwd);
+        const f = input.mode === "replace"
+            ? await replaceMemory(scope, target, content, ctx.cwd)
+            : await appendMemory(scope, target, content, ctx.cwd);
         return `Saved to ${f}`;
     },
 });
@@ -117,8 +128,27 @@ registerTool({
         const f = join(dir, "SKILL.md");
         // dedup: surface a near-duplicate so the agent updates instead of piling up (lexical signal, not a block)
         const dups = searchAssets(`${slug} ${description}`, 3, assetSearchRoots(ctx.cwd)).filter((h) => h.path !== f && h.score >= 2);
-        mkdirSync(dir, { recursive: true });
-        writeFileSync(f, `---\nname: ${slug}\ndescription: ${description}\n---\n\n${body.trim()}\n`, "utf8");
+        const skillText = `---\nname: ${slug}\ndescription: ${description}\n---\n\n${body.trim()}\n`;
+        let boundary;
+        let snapshot = null;
+        try {
+            boundary = bindAtomicWritePath(f, "create skill");
+            try {
+                snapshot = await readVerifiedRegularFileSnapshot(boundary.target, undefined, "create skill");
+            }
+            catch (error) {
+                if (error?.code !== "ENOENT")
+                    throw error;
+            }
+            await atomicWriteText(boundary.target, skillText, {
+                expected: snapshot?.text ?? null,
+                expectedIdentity: snapshot ?? undefined,
+                boundary,
+            });
+        }
+        catch (error) {
+            return `Error: cannot save skill ${slug}: ${error?.message ?? String(error)} No changes written.`;
+        }
         invalidateSkillsCache();
         const notes = [
             redactions.length ? `redacted ${redactions.length} secret(s)` : "",
@@ -141,7 +171,7 @@ registerTool({
     },
     kind: "edit",
     async run(input, ctx) {
-        const n = forgetMemory(asScope(input.scope), asTarget(input.target), String(input.match ?? ""), ctx.cwd);
+        const n = await forgetMemory(asScope(input.scope), asTarget(input.target), String(input.match ?? ""), ctx.cwd);
         return n ? `Removed ${n} line(s).` : "(no matching lines)";
     },
 });

package/dist/tools/patch.js

@@ -1,6 +1,6 @@
 // apply_patch — change MULTIPLE files atomically (all-or-nothing). Everything is validated and
 // computed in memory first; nothing is written unless every change applies cleanly.
-import { linkSync, lstatSync, readlinkSync, symlinkSync } from "node:fs";
+import { linkSync, lstatSync, readlinkSync, renameSync, symlinkSync } from "node:fs";
 import { lstat, readlink, rename } from "node:fs/promises";
 import { randomUUID } from "node:crypto";
 import { dirname, isAbsolute, join, resolve } from "node:path";
@@ -8,9 +8,10 @@ import { registerTool } from "./registry.js";
 import { applyEdits } from "./apply-core.js";
 import { emitDiff } from "../diff.js";
 import { recordEdit } from "../undo.js";
-import { atomicWriteText, discardClaimedPath, FileChangedError, removeCreatedDirectories } from "../fs-write.js";
+import { atomicWriteText, bindAtomicParentEntryPath, bindAtomicWritePath, discardClaimedPath, FileChangedError, removeCreatedDirectories, verifyAtomicWriteBoundary, } from "../fs-write.js";
 import { invalidateFileCandidates } from "../context/mentions.js";
-import { readRegularFileSnapshot, readRegularFileSnapshotNoFollow } from "../fs-read.js";
+import { readRegularFileSnapshot, readRegularFileSnapshotNoFollow, readVerifiedRegularFileSnapshot, resolveVerifiedModelPath, } from "../fs-read.js";
+import { sensitiveFileError } from "../security/sensitive-files.js";
 async function restoreMovedFile(quarantine, target) {
     let identity;
     try {
@@ -88,12 +89,15 @@ async function rollbackWrittenPlan(plan) {
 async function quarantineExpectedDelete(plan) {
     if (!plan.beforeIdentity || !plan.beforePathIdentity || plan.beforeMode === undefined)
         throw new Error(`missing preflight identity for ${plan.path}`);
+    if (!plan.writeBoundary)
+        throw new Error(`missing parent boundary for ${plan.path}`);
     // Keep the initially moved path private until it has been verified. A directory watcher must not be able
     // to mistake an unverified staging entry for the durable delete quarantine used by the commit/cleanup
     // phases. Recording it immediately also lets the outer rollback recover (or accurately report) a failure
     // that happens after rename but before verification completes.
     const staging = join(dirname(plan.abs), `.hara-stage-delete-${process.pid}-${randomUUID()}.tmp`);
-    await rename(plan.abs, staging);
+    verifyAtomicWriteBoundary(plan.writeBoundary);
+    renameSync(plan.abs, staging);
     plan.quarantine = staging;
     const movedPath = await lstat(staging);
     const samePath = movedPath.dev === plan.beforePathIdentity.dev && movedPath.ino === plan.beforePathIdentity.ino && (movedPath.mode & 0o777) === plan.beforePathIdentity.mode && movedPath.nlink === plan.beforePathIdentity.nlink;
@@ -108,17 +112,19 @@ async function quarantineExpectedDelete(plan) {
         throw new FileChangedError(plan.path);
     }
     const quarantine = join(dirname(plan.abs), `.hara-delete-${process.pid}-${randomUUID()}.tmp`);
-    await rename(staging, quarantine);
+    verifyAtomicWriteBoundary(plan.writeBoundary);
+    renameSync(staging, quarantine);
     plan.quarantine = quarantine;
 }
 /** Move a delete quarantine to a fresh name and verify that exact moved path before restore/cleanup. If a
  * concurrent process replaced the known quarantine name, preserve the unexpected inode and fail closed. */
 async function claimDeleteQuarantine(plan, purpose) {
-    if (!plan.quarantine || !plan.beforePathIdentity || !plan.beforeIdentity || plan.beforeMode === undefined) {
+    if (!plan.quarantine || !plan.beforePathIdentity || !plan.beforeIdentity || plan.beforeMode === undefined || !plan.writeBoundary) {
         throw new Error(`missing delete quarantine identity for ${plan.path}`);
     }
     const claimed = join(dirname(plan.quarantine), `.hara-${purpose}-${process.pid}-${randomUUID()}.tmp`);
-    await rename(plan.quarantine, claimed);
+    verifyAtomicWriteBoundary(plan.writeBoundary);
+    renameSync(plan.quarantine, claimed);
     try {
         const pathInfo = await lstat(claimed);
         const expectedPath = plan.beforePathIdentity;
@@ -205,6 +211,9 @@ registerTool({
             if (typeof ch.path !== "string" || !ch.path)
                 return `Error: ${tag} is missing a path. Nothing written.`;
             const p = abs(ch.path);
+            const denied = sensitiveFileError(p, "patch");
+            if (denied)
+                return `Error: ${tag}: ${denied} Nothing written.`;
             if (plannedPaths.has(p))
                 return `Error: ${tag} repeats path ${ch.path}. Combine edits for one file into a single change. Nothing written.`;
             plannedPaths.add(p);
@@ -225,24 +234,28 @@ registerTool({
                 let before;
                 let pathInfo;
                 let beforeLinkTarget;
+                let writeBoundary;
                 try {
-                    pathInfo = await lstat(p);
+                    writeBoundary = bindAtomicParentEntryPath(p, "patch");
+                    pathInfo = await lstat(writeBoundary.target);
                     if (pathInfo.isSymbolicLink())
-                        beforeLinkTarget = await readlink(p);
-                    before = await readRegularFileSnapshot(p);
+                        beforeLinkTarget = await readlink(writeBoundary.target);
+                    const target = resolveVerifiedModelPath(writeBoundary.target, "patch");
+                    before = await readVerifiedRegularFileSnapshot(target, undefined, "patch");
                 }
                 catch (error) {
                     return `Error: ${tag} delete ${ch.path}: ${error?.message ?? "file not found"}. Nothing written.`;
                 }
                 plans.push({
                     path: ch.path,
-                    abs: p,
+                    abs: writeBoundary.target,
                     type,
                     before: before.text,
                     beforeMode: before.mode,
                     beforeIdentity: { dev: before.dev, ino: before.ino, mode: before.mode, nlink: before.nlink },
                     beforePathIdentity: { dev: pathInfo.dev, ino: pathInfo.ino, mode: pathInfo.mode & 0o777, nlink: pathInfo.nlink },
                     beforeLinkTarget,
+                    writeBoundary,
                     after: null,
                     existed: true,
                 });
@@ -250,33 +263,39 @@ registerTool({
             else if (type === "create") {
                 if (typeof ch.content !== "string")
                     return `Error: ${tag} create ${ch.path} needs \`content\`. Nothing written.`;
+                let writeBoundary;
                 try {
-                    await lstat(p);
+                    writeBoundary = bindAtomicWritePath(p, "patch");
+                    await lstat(writeBoundary.target);
                     return `Error: ${tag} create ${ch.path}: path already exists (use type:update to replace it). Nothing written.`;
                 }
                 catch (error) {
-                    if (error?.code !== "ENOENT")
+                    if (error?.code !== "ENOENT" || !writeBoundary)
                         return `Error: ${tag} create ${ch.path}: ${error?.message ?? String(error)}. Nothing written.`;
                 }
-                plans.push({ path: ch.path, abs: p, type, before: "", after: ch.content, existed: false });
+                if (!writeBoundary)
+                    return `Error: ${tag} create ${ch.path}: cannot bind a stable parent. Nothing written.`;
+                plans.push({ path: ch.path, abs: writeBoundary.target, type, before: "", after: ch.content, existed: false, writeBoundary });
             }
             else {
                 // update
                 let before;
+                let writeBoundary;
                 try {
-                    before = await readRegularFileSnapshot(p);
+                    writeBoundary = bindAtomicWritePath(p, "patch");
+                    before = await readVerifiedRegularFileSnapshot(writeBoundary.target, undefined, "patch");
                 }
                 catch (error) {
                     return `Error: ${tag} update ${ch.path}: cannot read (${error?.message ?? "unknown error"}; use type:create for a new file). Nothing written.`;
                 }
                 if (typeof ch.content === "string" && !ch.edits) {
-                    plans.push({ path: ch.path, abs: p, type, before: before.text, beforeMode: before.mode, beforeIdentity: { dev: before.dev, ino: before.ino, mode: before.mode, nlink: before.nlink }, after: ch.content, existed: true });
+                    plans.push({ path: ch.path, abs: writeBoundary.target, type, before: before.text, beforeMode: before.mode, beforeIdentity: { dev: before.dev, ino: before.ino, mode: before.mode, nlink: before.nlink }, after: ch.content, existed: true, writeBoundary });
                 }
                 else {
                     const res = applyEdits(before.text, ch.edits ?? []);
                     if ("error" in res)
                         return `Error: ${tag} ${ch.path} — ${res.error}. Nothing written.`;
-                    plans.push({ path: ch.path, abs: p, type, before: before.text, beforeMode: before.mode, beforeIdentity: { dev: before.dev, ino: before.ino, mode: before.mode, nlink: before.nlink }, after: res.text, existed: true });
+                    plans.push({ path: ch.path, abs: writeBoundary.target, type, before: before.text, beforeMode: before.mode, beforeIdentity: { dev: before.dev, ino: before.ino, mode: before.mode, nlink: before.nlink }, after: res.text, existed: true, writeBoundary });
                 }
             }
         }
@@ -294,6 +313,7 @@ registerTool({
                     pl.committed = await atomicWriteText(pl.abs, pl.after, {
                         expected: pl.existed ? pl.before : null,
                         expectedIdentity: pl.existed ? pl.beforeIdentity : undefined,
+                        boundary: pl.writeBoundary,
                     });
                 }
                 applied.push(pl);