@nanhara/hara 0.122.0 → 0.122.2

package/dist/tools/search.js

@@ -1,10 +1,12 @@
 // Search/listing tools — grep (regex across files), glob (path patterns), ls (one directory).
 // All read-only (kind: "read"), so they never hit the approval gate and run in parallel.
-import { readdirSync, statSync } from "node:fs";
+import { lstatSync, readdirSync, statSync } from "node:fs";
 import { spawn } from "node:child_process";
 import { basename, dirname, isAbsolute, resolve, join, relative, sep } from "node:path";
 import { registerTool } from "./registry.js";
 import { IGNORE_DIRS, walkFiles } from "../fs-walk.js";
+import { isSensitiveFilePath, sensitiveFileError, sensitiveFilesAllowed, SENSITIVE_SEARCH_GLOBS, } from "../security/sensitive-files.js";
+import { toolSubprocessEnv } from "../security/subprocess-env.js";
 const MAX_OUT = 60_000;
 const MAX_MATCHES = 300;
 const MAX_FILE_BYTES = 2 * 1024 * 1024;
@@ -99,10 +101,16 @@ function runRipgrep(pattern, root, isFile, cwd, glob, ignoreCase) {
             args.push("--glob", `!**/${ignored}/**`);
         if (glob)
             args.push("--glob", glob);
+        // Keep protected exclusions last: ripgrep resolves overlapping globs in argument order, so a caller's
+        // positive glob must not re-include a safe-looking .env template during a broad directory search.
+        if (!isFile && !sensitiveFilesAllowed()) {
+            for (const protectedGlob of SENSITIVE_SEARCH_GLOBS)
+                args.push("--glob", `!${protectedGlob}`);
+        }
         if (ignoreCase)
             args.push("--ignore-case");
         args.push("--", pattern, target);
-        const child = spawn("rg", args, { cwd: runCwd, stdio: ["ignore", "pipe", "pipe"] });
+        const child = spawn("rg", args, { cwd: runCwd, stdio: ["ignore", "pipe", "pipe"], env: toolSubprocessEnv() });
         const lines = [];
         let matches = 0;
         let scanned = 0;
@@ -151,6 +159,8 @@ function runRipgrep(pattern, root, isFile, cwd, glob, ignoreCase) {
             if (typeof pathText !== "string" || !Number.isFinite(lineNo) || typeof content !== "string")
                 return;
             const absolute = resolve(runCwd, pathText);
+            if (isSensitiveFilePath(absolute))
+                return; // defense if a user glob overrides rg's exclusion ordering
             const shown = toPosix(relative(cwd, absolute)) || toPosix(relative(root, absolute)) || basename(absolute);
             const rendered = `${shown}:${lineNo}: ${content.replace(/\r?\n$/, "").trim().slice(0, 300)}`;
             lines.push(rendered);
@@ -212,7 +222,7 @@ const NODE_GREP_SOURCE = String.raw `
 "use strict";
 const fs = require("node:fs");
 const path = require("node:path");
-const MAX_INPUT_BYTES = 64 * 1024;
+const MAX_INPUT_BYTES = 16 * 1024 * 1024;
 let input = "";
 let inputRejected = false;
 function execute() {
@@ -272,33 +282,23 @@ function execute() {
     return patternAt === patternParts.length;
   }
 
-  const ignored = new Set(cfg.ignoreDirs);
-  const files = [];
-  if (cfg.isFile) files.push(cfg.root);
-  else {
-    const stack = [cfg.root];
-    while (stack.length && files.length < cfg.maxFiles) {
-      const dir = stack.pop();
-      let entries;
-      try { entries = fs.readdirSync(dir, { withFileTypes: true }); }
-      catch (error) { continue; }
-      for (const entry of entries) {
-        if (files.length >= cfg.maxFiles) break;
-        const absolute = path.join(dir, entry.name);
-        if (entry.isDirectory()) {
-          if (!ignored.has(entry.name)) stack.push(absolute);
-        } else if (entry.isFile()) files.push(absolute);
-      }
-    }
-  }
+  // Candidate discovery and the complete protected-file policy run in the parent process. The worker gets
+  // only paths whose exact identity was already approved, then verifies that identity again on the opened fd.
+  const files = Array.isArray(cfg.files) ? cfg.files : [];
 
   const readBuffer = Buffer.allocUnsafe(cfg.maxFileBytes + 1);
-  function safeReadText(absolute) {
+  function sameIdentity(info, candidate) {
+    return String(info.dev) === candidate.dev && String(info.ino) === candidate.ino;
+  }
+  function safeReadText(candidate) {
+    const absolute = candidate.path;
     let fd;
     try {
-      fd = fs.openSync(absolute, fs.constants.O_RDONLY | (fs.constants.O_NONBLOCK || 0));
-      const info = fs.fstatSync(fd);
-      if (!info.isFile() || info.size > cfg.maxFileBytes) return null;
+      const before = fs.lstatSync(absolute, { bigint: true });
+      if (!before.isFile() || before.nlink !== 1n || !sameIdentity(before, candidate)) return null;
+      fd = fs.openSync(absolute, fs.constants.O_RDONLY | (fs.constants.O_NONBLOCK || 0) | (fs.constants.O_NOFOLLOW || 0));
+      const info = fs.fstatSync(fd, { bigint: true });
+      if (!info.isFile() || info.nlink !== 1n || !sameIdentity(info, candidate) || info.size > BigInt(cfg.maxFileBytes)) return null;
       let total = 0;
       while (total <= cfg.maxFileBytes) {
         const count = fs.readSync(fd, readBuffer, total, cfg.maxFileBytes + 1 - total, total);
@@ -306,6 +306,10 @@ function execute() {
         total += count;
       }
       if (total > cfg.maxFileBytes) return null;
+      const latest = fs.fstatSync(fd, { bigint: true });
+      const current = fs.lstatSync(absolute, { bigint: true });
+      if (!latest.isFile() || latest.nlink !== 1n || !sameIdentity(latest, candidate) || !sameIdentity(current, candidate)) return null;
+      if (latest.size !== info.size || latest.mtimeNs !== info.mtimeNs || latest.ctimeNs !== info.ctimeNs) return null;
       const bytes = readBuffer.subarray(0, total);
       if (bytes.subarray(0, Math.min(bytes.length, 4096)).includes(0)) return null;
       return bytes.toString("utf8");
@@ -320,12 +324,13 @@ function execute() {
   let matches = 0;
   let scanned = 0;
   let outputChars = 0;
-  let truncated = files.length >= cfg.maxFiles;
-  for (const absolute of files) {
+  let truncated = cfg.candidatesTruncated === true;
+  for (const candidate of files) {
+    const absolute = candidate.path;
     if (matches >= cfg.maxMatches || outputChars >= cfg.maxOutputChars) { truncated = true; break; }
     const relativeForGlob = path.relative(cfg.isFile ? cfg.cwd : cfg.root, absolute).split(path.sep).join("/");
     if (cfg.glob && !matchesGlob(cfg.glob, relativeForGlob)) continue;
-    const text = safeReadText(absolute);
+    const text = safeReadText(candidate);
     if (text === null) continue;
     scanned++;
     const fileLines = text.split("\n");
@@ -364,6 +369,30 @@ function normalizeGrepWorkerResult(parsed) {
     };
 }
 function runNodeGrep(pattern, root, isFile, cwd, glob, ignoreCase) {
+    const allowSensitive = sensitiveFilesAllowed();
+    const discovered = isFile ? [root] : walkFiles(root, 8_001).map((path) => join(root, path));
+    const candidatesTruncated = !isFile && discovered.length > 8_000;
+    const files = [];
+    for (const path of discovered.slice(0, 8_000)) {
+        // Broad searches intentionally omit every .env variant, including safe templates. Explicitly searching
+        // one safe template remains supported, matching the ripgrep branch.
+        const securityBase = basename(path).replace(/:.*$/u, "").replace(/[. ]+$/u, "").toLowerCase();
+        if (!allowSensitive && !isFile && (securityBase === ".env" || securityBase.startsWith(".env.")))
+            continue;
+        if (sensitiveFileError(path, "search"))
+            continue;
+        try {
+            const info = lstatSync(path, { bigint: true });
+            // A hard-linked safe alias cannot prove where its other name lives. Reject every multi-link candidate
+            // before it can cross into the isolated regex worker.
+            if (!info.isFile() || info.nlink !== 1n || info.size > BigInt(MAX_FILE_BYTES))
+                continue;
+            files.push({ path, dev: String(info.dev), ino: String(info.ino) });
+        }
+        catch {
+            // Raced, unreadable, symlink, FIFO, or device: omit it rather than weakening the read boundary.
+        }
+    }
     const payload = JSON.stringify({
         pattern,
         root,
@@ -371,13 +400,14 @@ function runNodeGrep(pattern, root, isFile, cwd, glob, ignoreCase) {
         cwd,
         glob,
         ignoreCase,
-        ignoreDirs: [...IGNORE_DIRS],
+        files,
+        candidatesTruncated,
         maxFiles: 8_000,
         maxFileBytes: MAX_FILE_BYTES,
         maxMatches: MAX_MATCHES,
         maxOutputChars: MAX_OUT,
     });
-    if (Buffer.byteLength(payload, "utf8") > 64 * 1024) {
+    if (Buffer.byteLength(payload, "utf8") > 16 * 1024 * 1024) {
         return Promise.resolve({ kind: "error", lines: [], matches: 0, scanned: 0, truncated: false, error: "grep input exceeds its safety limit" });
     }
     return new Promise((resolveResult) => {
@@ -385,7 +415,7 @@ function runNodeGrep(pattern, root, isFile, cwd, glob, ignoreCase) {
         const args = isBun ? ["-e", NODE_GREP_SOURCE] : ["--max-old-space-size=128", "-e", NODE_GREP_SOURCE];
         // In a Bun --compile build process.execPath is the hara executable. BUN_BE_BUN makes that embedded
         // runtime act as the Bun CLI for this isolated eval subprocess instead of recursively launching hara.
-        const env = isBun ? { ...process.env, BUN_BE_BUN: "1" } : process.env;
+        const env = toolSubprocessEnv(process.env, isBun ? { BUN_BE_BUN: "1" } : {});
         const child = spawn(process.execPath, args, { stdio: ["pipe", "pipe", "pipe"], env });
         let stdout = "";
         let stderr = "";
@@ -460,6 +490,9 @@ registerTool({
         if (typeof input.glob === "string" && input.glob.length > MAX_GLOB_CHARS)
             return `Error: grep glob exceeds ${MAX_GLOB_CHARS} characters.`;
         const root = absOf(input.path, ctx.cwd);
+        const denied = sensitiveFileError(root, "search");
+        if (denied)
+            return denied;
         let isFile = false;
         try {
             const info = statSync(root);
@@ -470,19 +503,35 @@ registerTool({
         catch {
             return `Error: no such path: ${input.path ?? "."}`;
         }
-        const rg = await runRipgrep(pattern, root, isFile, ctx.cwd, typeof input.glob === "string" ? input.glob : undefined, input.ignore_case === true);
-        if (rg.kind === "timeout")
+        const searchArgs = [
+            pattern,
+            root,
+            isFile,
+            ctx.cwd,
+            typeof input.glob === "string" ? input.glob : undefined,
+            input.ignore_case === true,
+        ];
+        // ripgrep opens pathnames itself, so a cooperating background process could exchange a candidate after
+        // discovery and restore it before the post-filter. While the protected-file policy is active, use the
+        // hardened worker that binds device+inode and reads through O_NOFOLLOW fds. The faster rg path is safe to
+        // opt back into only with the explicit one-process sensitive-file waiver.
+        const primary = sensitiveFilesAllowed()
+            ? await runRipgrep(...searchArgs)
+            : await runNodeGrep(...searchArgs);
+        if (primary.kind === "timeout")
             return `Error: grep exceeded its ${GREP_TIMEOUT_MS}ms safety timeout and was stopped.`;
-        let { lines, matches, scanned } = rg;
-        let truncated = rg.truncated;
-        if (rg.kind === "missing" || rg.kind === "error") {
+        if (primary.kind === "invalid")
+            return `Error: invalid regex: ${primary.error ?? "invalid pattern"}`;
+        let { lines, matches, scanned } = primary;
+        let truncated = primary.truncated;
+        if (sensitiveFilesAllowed() && (primary.kind === "missing" || primary.kind === "error")) {
             const fallback = await runNodeGrep(pattern, root, isFile, ctx.cwd, typeof input.glob === "string" ? input.glob : undefined, input.ignore_case === true);
             if (fallback.kind === "timeout")
                 return `Error: grep exceeded its ${GREP_TIMEOUT_MS}ms safety timeout and was stopped.`;
             if (fallback.kind === "invalid")
                 return `Error: invalid regex: ${fallback.error ?? "invalid pattern"}`;
             if (fallback.kind !== "ok") {
-                const rgDetail = rg.kind === "error" && rg.error ? `; ripgrep: ${rg.error}` : "";
+                const rgDetail = primary.kind === "error" && primary.error ? `; ripgrep: ${primary.error}` : "";
                 return `Error: grep regex failed safely: ${fallback.error ?? "unknown worker error"}${rgDetail}`;
             }
             lines = fallback.lines;
@@ -490,6 +539,9 @@ registerTool({
             scanned = fallback.scanned;
             truncated = fallback.truncated;
         }
+        else if (primary.kind !== "ok") {
+            return `Error: grep regex failed safely: ${primary.error ?? "unknown worker error"}`;
+        }
         if (!lines.length)
             return `No matches for /${input.pattern}/ (scanned ${scanned} files).`;
         let body = lines.join("\n");
@@ -513,6 +565,9 @@ registerTool({
     kind: "read",
     async run(input, ctx) {
         const root = absOf(input.path, ctx.cwd);
+        const denied = sensitiveFileError(root, "search");
+        if (denied)
+            return denied;
         const pattern = typeof input.pattern === "string" ? input.pattern : "";
         if (pattern.length > MAX_GLOB_CHARS)
             return `Error: glob pattern exceeds ${MAX_GLOB_CHARS} characters.`;
@@ -552,6 +607,9 @@ registerTool({
     kind: "read",
     async run(input, ctx) {
         const dir = absOf(input.path, ctx.cwd);
+        const denied = sensitiveFileError(dir, "list");
+        if (denied)
+            return denied;
         let entries;
         try {
             entries = readdirSync(dir, { withFileTypes: true });
@@ -559,8 +617,9 @@ registerTool({
         catch (e) {
             return `Error: cannot list ${input.path ?? "."}: ${e.message}`;
         }
+        const protectedCount = entries.filter((entry) => !entry.isDirectory() && isSensitiveFilePath(join(dir, entry.name))).length;
         const rows = entries
-            .filter((e) => !(e.isDirectory() && e.name === ".git"))
+            .filter((e) => !(e.isDirectory() && e.name === ".git") && (e.isDirectory() || !isSensitiveFilePath(join(dir, e.name))))
             .sort((a, b) => Number(b.isDirectory()) - Number(a.isDirectory()) || a.name.localeCompare(b.name))
             .map((e) => {
             if (e.isDirectory())
@@ -574,7 +633,8 @@ registerTool({
             }
             return `  ${e.name}  ${c_size(size)}`;
         });
-        return rows.length ? rows.join("\n") : "(empty directory)";
+        const note = protectedCount ? `(${protectedCount} protected file${protectedCount === 1 ? "" : "s"} hidden)` : "";
+        return rows.length ? rows.join("\n") + (note ? `\n${note}` : "") : note || "(empty directory)";
     },
 });
 function c_size(n) {

package/dist/tools/send.js

@@ -1,6 +1,6 @@
 import { registerTool } from "./registry.js";
-import { appendFileSync, existsSync, statSync } from "node:fs";
 import { resolve } from "node:path";
+import { queueOutboundSnapshot } from "../gateway/outbound-files.js";
 // `send_file` — the agent's ONLY way to push a file/image to the user when running inside `hara gateway`
 // (Telegram / WeChat). The gateway sets HARA_GATEWAY_OUTBOX to a per-message temp file; this tool appends the
 // path there, and after the headless run ends the daemon delivers each queued file to the chat via the platform
@@ -26,10 +26,16 @@ if (process.env.HARA_GATEWAY) {
             if (!outbox)
                 return "send_file only works inside `hara gateway` — there is no chat to send to here.";
             const p = resolve(ctx.cwd, String(input.path ?? ""));
-            if (!existsSync(p) || !statSync(p).isFile())
-                return `No such file: ${p || "(none)"} — create the file first, then call send_file with its absolute path.`;
-            appendFileSync(outbox, p + "\n");
-            return `Queued for delivery to the user in this chat: ${p}`;
+            try {
+                await queueOutboundSnapshot(p, outbox);
+                return `Queued a private snapshot for delivery to the user in this chat: ${p}`;
+            }
+            catch (error) {
+                if (error?.code === "ENOENT") {
+                    return `No such file: ${p || "(none)"} — create the file first, then call send_file with its absolute path.`;
+                }
+                return error instanceof Error ? error.message : `Unable to queue ${p} for delivery.`;
+            }
         },
     });
 }

package/package.json

@@ -1,14 +1,15 @@
 {
   "name": "@nanhara/hara",
-  "version": "0.122.0",
+  "version": "0.122.2",
   "description": "hara — a coding agent CLI that runs like an engineering org.",
   "bin": {
-    "hara": "dist/index.js"
+    "hara": "runtime-bootstrap.cjs"
   },
   "type": "module",
   "files": [
     "dist",
     "!dist/bin",
+    "runtime-bootstrap.cjs",
     "README.md",
     "CHANGELOG.md",
     "SECURITY.md",
@@ -35,16 +36,16 @@
     "url": "git+https://github.com/hara-cli/hara.git"
   },
   "engines": {
-    "node": ">=20"
+    "node": ">=22.12.0"
   },
   "scripts": {
-    "build": "tsc",
-    "prepare": "tsc",
-    "dev": "tsx src/index.ts",
-    "start": "node dist/index.js",
-    "test": "tsc && node --test test/*.test.mjs",
-    "build:binary": "tsc && bun scripts/build-binary.ts dist/bin/hara",
-    "build:binaries": "tsc && bun scripts/build-binary.ts dist/bin/hara-darwin-arm64 bun-darwin-arm64 && bun scripts/build-binary.ts dist/bin/hara-darwin-x64 bun-darwin-x64 && bun scripts/build-binary.ts dist/bin/hara-linux-x64 bun-linux-x64 && bun scripts/build-binary.ts dist/bin/hara-linux-arm64 bun-linux-arm64"
+    "build": "tsc && node scripts/normalize-dist-modes.mjs",
+    "prepare": "npm run build",
+    "dev": "tsx src/cli.ts",
+    "start": "node runtime-bootstrap.cjs",
+    "test": "npm run build && node --test test/*.test.mjs",
+    "build:binary": "npm run build && bun scripts/build-binary.ts dist/bin/hara",
+    "build:binaries": "npm run build && bun scripts/build-binary.ts dist/bin/hara-darwin-arm64 bun-darwin-arm64 && bun scripts/build-binary.ts dist/bin/hara-darwin-x64 bun-darwin-x64 && bun scripts/build-binary.ts dist/bin/hara-linux-x64 bun-linux-x64 && bun scripts/build-binary.ts dist/bin/hara-linux-arm64 bun-linux-arm64"
   },
   "publishConfig": {
     "access": "public"

package/runtime-bootstrap.cjs

@@ -0,0 +1,72 @@
+#!/usr/bin/env node
+"use strict";
+
+// This file is the npm/Docker entry point. Keep it dependency-free and parseable by old Node releases so
+// users get an upgrade instruction instead of a SyntaxError from Hara's ESM output or its dependencies.
+var MIN_NODE_MAJOR = 22;
+var MIN_NODE_VERSION = "22.12.0";
+
+function supportedNodeVersion(version) {
+  var match = /^(\d+)\.(\d+)\.(\d+)$/.exec(version);
+  if (!match) return false;
+  var current = [Number(match[1]), Number(match[2]), Number(match[3])];
+  var minimum = MIN_NODE_VERSION.split(".").map(Number);
+  for (var index = 0; index < minimum.length; index += 1) {
+    if (current[index] > minimum[index]) return true;
+    if (current[index] < minimum[index]) return false;
+  }
+  return true;
+}
+
+function unsupportedNodeMessage(versions) {
+  versions = versions || process.versions;
+  if (versions.bun) return null;
+
+  var version = String(versions.node || "unknown");
+  if (supportedNodeVersion(version)) return null;
+  var major = Number.parseInt(version, 10);
+  var detail = major === MIN_NODE_MAJOR
+    ? "This Node.js 22 release is below Hara's supported " + MIN_NODE_VERSION + " floor."
+    : "This Node.js release is below Hara's supported " + MIN_NODE_VERSION + " floor.";
+  return [
+    "Hara requires Node.js " + MIN_NODE_VERSION + " or newer (detected " + version + ").",
+    detail,
+    "Upgrade with: nvm install " + MIN_NODE_MAJOR + " && nvm use " + MIN_NODE_MAJOR,
+    "Or install the standalone Hara binary, which does not require Node.js:",
+    "  curl -fsSL https://raw.githubusercontent.com/hara-cli/hara/main/install.sh | sh",
+  ].join("\n");
+}
+
+function failStart(error) {
+  var message = error && error.message ? error.message : String(error);
+  process.stderr.write("hara: failed to start: " + message + "\n");
+  process.exitCode = 1;
+}
+
+function main() {
+  var runtimeError = unsupportedNodeMessage(process.versions);
+  if (runtimeError) {
+    process.stderr.write(runtimeError + "\n");
+    process.exitCode = 1;
+    return;
+  }
+
+  try {
+    // Keeping import() inside a string prevents legacy parsers from seeing unsupported ESM syntax. This
+    // branch is reached only on the supported Node floor (or Bun when used as a script runtime).
+    var load = Function("specifier", "return import(specifier)");
+    var entry = require("url").pathToFileURL(require("path").join(__dirname, "dist", "index.js")).href;
+    load(entry).catch(failStart);
+  } catch (error) {
+    failStart(error);
+  }
+}
+
+module.exports = {
+  MIN_NODE_MAJOR: MIN_NODE_MAJOR,
+  MIN_NODE_VERSION: MIN_NODE_VERSION,
+  supportedNodeVersion: supportedNodeVersion,
+  unsupportedNodeMessage: unsupportedNodeMessage,
+};
+
+if (require.main === module) main();