@nanhara/hara 0.122.0 → 0.122.2

package/dist/gateway/serve.js

@@ -16,6 +16,8 @@ import { listSessions, loadSession } from "../session/store.js";
 import { homedir, tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 import { chmodSync, mkdirSync, writeFileSync, readFileSync, existsSync, statSync, rmSync } from "node:fs";
+import { redactToolSubprocessOutput, terminateSubprocessTree } from "../security/subprocess-env.js";
+import { cleanupOutboundSnapshot, cleanupOutboundSnapshots, consumeOutboundSnapshots, queueOutboundSnapshot, } from "./outbound-files.js";
 /** Parse a leading slash-command from a chat message (pure). null if it isn't one. */
 export function parseCommand(text) {
     const m = /^\/([a-z]+)\b\s*([\s\S]*)$/i.exec(text.trim());
@@ -45,13 +47,35 @@ export function canonicalGatewayPlatform(platform) {
 /** Strip hara's CLI chrome from captured `-p` output so a chat reply is just the answer: MCP status lines
  *  (`mcp: …`) and the token-usage footer (`… · ↑N ↓N tok`). Colors are off when piped, so no ANSI to strip. */
 export function cleanReply(raw) {
-    return raw
+    return redactToolSubprocessOutput(raw)
         .split("\n")
         .filter((ln) => !/^\s*mcp: /.test(ln) && !/·\s*↑\d+\s*↓\d+\s*tok\s*$/.test(ln))
         .join("\n")
         .trim();
 }
 let outboxSeq = 0;
+/** Snapshot and materialize a direct gateway file before an adapter sees it. This also covers TTS output, so
+ * every outbound attachment crosses the same verified-byte boundary rather than handing adapters a pathname. */
+async function deliverVerifiedLocalFile(adapter, chatId, sourcePath) {
+    const sendFile = adapter.sendFile;
+    if (!sendFile)
+        throw new Error("this platform can't send files yet");
+    const outbox = join(tmpdir(), `hara-direct-send-${process.pid}-${Date.now()}-${outboxSeq++}.txt`);
+    let payload;
+    try {
+        await queueOutboundSnapshot(sourcePath, outbox);
+        [payload] = await consumeOutboundSnapshots(outbox);
+        cleanupOutboundSnapshots(outbox, payload ? [payload.snapshotPath] : []);
+        if (!payload)
+            throw new Error("the private file snapshot could not be verified");
+        await sendFile(chatId, payload);
+    }
+    finally {
+        if (payload)
+            cleanupOutboundSnapshot(payload.snapshotPath);
+        cleanupOutboundSnapshots(outbox);
+    }
+}
 export class GatewayQueueFullError extends Error {
     key;
     limit;
@@ -234,20 +258,6 @@ function durationLabel(ms) {
         return `${ms / 60_000}m`;
     return `${Math.round(ms / 1_000)}s`;
 }
-function signalProcess(child, signal) {
-    try {
-        // A detached POSIX child leads its own process group. Kill that group so bash/tool grandchildren cannot
-        // survive a timed-out agent. Windows has no negative-pid process-group signaling; use ChildProcess.kill.
-        if (process.platform !== "win32" && child.pid) {
-            process.kill(-child.pid, signal);
-            return true;
-        }
-        return child.kill(signal);
-    }
-    catch {
-        return false;
-    }
-}
 /** Run hara headlessly on a chat's session. Returns its cleaned text reply plus any files the agent queued
  *  via send_file. The gateway env (HARA_GATEWAY + a per-message outbox file) is what makes send_file and the
  *  in-chat system context active in the subprocess; the daemon delivers the queued files after it exits. */
@@ -287,10 +297,12 @@ export function runHara(text, sessionId, cwd, platform, images, role, options =
         let exitCode = null;
         let exitSignal = null;
         let stopReason;
-        let killTimer;
         let drainTimer;
-        let forceSettleTimer;
+        let forceIssued = false;
+        let cancelTermination;
         const cap = (d) => {
+            if (settled || stopReason)
+                return;
             out = (out + d.toString().slice(-12_000)).slice(-12_000);
         };
         child.stdout?.on("data", cap);
@@ -300,17 +312,11 @@ export function runHara(text, sessionId, cwd, platform, images, role, options =
         child.unref();
         child.stdout?.unref?.();
         child.stderr?.unref?.();
-        const readOutbox = () => {
-            let files = [];
-            try {
-                if (existsSync(outbox)) {
-                    files = readFileSync(outbox, "utf8").split("\n").map((s) => s.trim()).filter(Boolean);
-                    rmSync(outbox, { force: true });
-                }
-            }
-            catch {
-                /* outbox is best-effort; a missing/unreadable file just means nothing to send */
-            }
+        const readOutbox = async () => {
+            const files = await consumeOutboundSnapshots(outbox);
+            // Remove abandoned partials and invalid queue entries, but retain accepted snapshots until the adapter
+            // has finished uploading them in the parent gateway process.
+            cleanupOutboundSnapshots(outbox, files.map((file) => file.snapshotPath));
             return files;
         };
         const finish = (reply) => {
@@ -318,18 +324,24 @@ export function runHara(text, sessionId, cwd, platform, images, role, options =
                 return;
             settled = true;
             clearTimeout(timeoutTimer);
-            if (killTimer)
-                clearTimeout(killTimer);
             if (drainTimer)
                 clearTimeout(drainTimer);
-            if (forceSettleTimer)
-                clearTimeout(forceSettleTimer);
+            // The helper deliberately keeps its force timer alive by default. When a direct child closes after
+            // TERM, that timer must still SIGKILL the owned group before this stopped run can be considered gone.
+            cancelTermination?.();
             options.signal?.removeEventListener("abort", abortRun);
             child.stdout?.destroy();
             child.stderr?.destroy();
-            res({ reply, files: readOutbox() });
+            void readOutbox().then((files) => res({ reply, files }), () => {
+                cleanupOutboundSnapshots(outbox);
+                res({ reply, files: [] });
+            });
         };
         const finishFromExit = () => {
+            // `exit`/`close` describes only the direct child. During a timeout/shutdown, wait until the forced
+            // process-group signal has been issued so a quiet TERM-resistant descendant cannot escape cleanup.
+            if (stopReason && !forceIssued)
+                return;
             if (stopReason === "timeout") {
                 finish(runFailure(`hara timed out after ${durationLabel(timeoutMs)}; the run was stopped.`, out));
             }
@@ -348,31 +360,47 @@ export function runHara(text, sessionId, cwd, platform, images, role, options =
             }
         };
         const terminate = (reason) => {
-            if (settled || exited)
+            if (settled || cancelTermination)
                 return;
             stopReason ??= reason;
-            signalProcess(child, "SIGTERM");
-            killTimer = setTimeout(() => {
-                if (settled || exited)
-                    return;
-                signalProcess(child, "SIGKILL");
-                // `exit` normally arrives immediately. This fallback releases the daemon even if a platform/runtime
-                // never reports it; the detached process and destroyed pipes cannot hold the parent open afterwards.
-                forceSettleTimer = setTimeout(finishFromExit, 250);
-            }, killGraceMs);
+            cancelTermination = terminateSubprocessTree(child, {
+                processGroup: process.platform !== "win32",
+                graceMs: killGraceMs,
+                fallbackMs: 250,
+                onForce: () => {
+                    forceIssued = true;
+                    if (exited)
+                        finishFromExit();
+                },
+                // A daemon may escape the group or a runtime may fail to emit exit/close. Destroying our pipe ends in
+                // `finish` keeps gateway shutdown and per-run timeout bounded even in that case.
+                onFallback: finishFromExit,
+            });
         };
         const abortRun = () => terminate("shutdown");
         const timeoutTimer = setTimeout(() => terminate("timeout"), timeoutMs);
         if (options.signal)
             options.signal.addEventListener("abort", abortRun, { once: true });
-        child.once("error", (error) => finish(runFailure(`couldn't start hara: ${error.message}`, out)));
+        // Close the narrow race where the signal aborts after the entry check but before the listener is attached.
+        if (options.signal?.aborted)
+            abortRun();
+        child.once("error", (error) => {
+            if (!stopReason)
+                return finish(runFailure(`couldn't start hara: ${error.message}`, out));
+            exited = true;
+            if (forceIssued)
+                finishFromExit();
+        });
         child.once("exit", (code, signal) => {
             exited = true;
             exitCode = code;
             exitSignal = signal;
             // Usually `close` follows after the final pipe data. A grandchild can retain stdout/stderr forever, so
             // cap that drain window and then destroy the pipes ourselves.
-            drainTimer = setTimeout(finishFromExit, 100);
+            if (stopReason)
+                finishFromExit();
+            else
+                drainTimer = setTimeout(finishFromExit, 100);
         });
         child.once("close", (code, signal) => {
             exited = true;
@@ -749,17 +777,26 @@ export async function runGateway(opts) {
                         const audio = await synthesize(cmd.arg);
                         if (!audio)
                             return adapter.send(m.chatId, "✗ TTS failed (check HARA_TTS_* config).");
-                        await adapter.sendFile(m.chatId, audio);
-                        rmSync(audio, { force: true });
+                        try {
+                            await deliverVerifiedLocalFile(adapter, m.chatId, audio);
+                        }
+                        finally {
+                            rmSync(audio, { force: true });
+                        }
                         return;
                     }
                     if (cmd.cmd === "send") {
                         if (!adapter.sendFile)
                             return adapter.send(m.chatId, "this platform can't send files yet.");
                         const p = cmd.arg ? resolve(ctx.cwd, cmd.arg.replace(/^~(?=\/|$)/, homedir())) : "";
-                        if (!p || !existsSync(p) || !statSync(p).isFile())
-                            return adapter.send(m.chatId, `✗ not a file: ${p || "(none)"}\nusage: /send <path> (abs, ~, or relative to current dir)`);
-                        await adapter.sendFile(m.chatId, p);
+                        if (!p)
+                            return adapter.send(m.chatId, "usage: /send <path> (abs, ~, or relative to current dir)");
+                        try {
+                            await deliverVerifiedLocalFile(adapter, m.chatId, p);
+                        }
+                        catch (error) {
+                            return adapter.send(m.chatId, `✗ couldn't send ${p}: ${error instanceof Error ? error.message : String(error)}`);
+                        }
                         return;
                     }
                     // any other slash word → treat as a normal task
@@ -791,33 +828,44 @@ export async function runGateway(opts) {
                     if (workingId && adapter.recall)
                         await adapter.recall(m.chatId, workingId).catch(() => { });
                 }
-                if (ac.signal.aborted)
-                    return;
                 const { reply, files } = result;
-                const hasReply = Boolean(reply);
-                if (hasReply)
-                    await adapter.send(m.chatId, plainChat(reply)); // chat bubbles are plain text — flatten markdown
-                else if (files.length)
-                    await adapter.send(m.chatId, "📎");
-                // Deliver any files the agent queued via send_file (images inline, others as attachments).
-                for (const f of files) {
-                    if (!adapter.sendFile) {
-                        await adapter.send(m.chatId, "(this platform can't send files yet)");
-                        break;
-                    }
-                    try {
-                        await adapter.sendFile(m.chatId, f);
+                try {
+                    if (ac.signal.aborted)
+                        return;
+                    const hasReply = Boolean(reply);
+                    if (hasReply)
+                        await adapter.send(m.chatId, plainChat(reply)); // chat bubbles are plain text — flatten markdown
+                    else if (files.length)
+                        await adapter.send(m.chatId, "📎");
+                    // Deliver only immutable private snapshots produced by send_file.
+                    for (const f of files) {
+                        if (!adapter.sendFile) {
+                            await adapter.send(m.chatId, "(this platform can't send files yet)");
+                            break;
+                        }
+                        try {
+                            await adapter.sendFile(m.chatId, f);
+                        }
+                        catch (e) {
+                            await adapter.send(m.chatId, `✗ couldn't send attachment: ${e.message}`);
+                        }
                     }
-                    catch (e) {
-                        await adapter.send(m.chatId, `✗ couldn't send ${f}: ${e.message}`);
+                    if (hasReply && ctx.voice && adapter.sendFile) {
+                        const audio = await synthesize(reply);
+                        if (audio) {
+                            try {
+                                await deliverVerifiedLocalFile(adapter, m.chatId, audio);
+                            }
+                            finally {
+                                rmSync(audio, { force: true });
+                            }
+                        }
                     }
                 }
-                if (hasReply && ctx.voice && adapter.sendFile) {
-                    const audio = await synthesize(reply);
-                    if (audio) {
-                        await adapter.sendFile(m.chatId, audio);
-                        rmSync(audio, { force: true });
-                    }
+                finally {
+                    // Text-send failures, shutdown races, unsupported adapters, and upload failures all remove snapshots.
+                    for (const f of files)
+                        cleanupOutboundSnapshot(f.snapshotPath);
                 }
             }
             finally {

package/dist/gateway/signal.js

@@ -138,7 +138,7 @@ export function signalAdapter(rpcUrl, selfNumber) {
             return null;
         }
     }
-    /** Recipient/group routing shared by send + sendFile (mirrors hermes). */
+    /** Recipient/group routing for outbound text sends (mirrors hermes). */
     const target = (chatId) => {
         const id = String(chatId);
         return id.startsWith("group:") ? { groupId: id.slice(6) } : { recipient: [id] };
@@ -169,11 +169,9 @@ export function signalAdapter(rpcUrl, selfNumber) {
                 await rpc("send", { account: selfNumber, message: part, ...target(chatId) });
             }
         },
-        async sendFile(chatId, filePath) {
-            // Signal has no separate photo/document endpoints — everything is an `attachments` path on `send`.
-            // signal-cli reads the file off the local disk by path, so we just hand it the path (no upload step).
-            await rpc("send", { account: selfNumber, message: "", attachments: [filePath], ...target(chatId) }).catch(() => { });
-        },
+        // signal-cli's JSON-RPC attachment API accepts only a server-side pathname. Exposing sendFile here would
+        // reopen the verified snapshot after the security boundary, so outbound files stay disabled for Signal
+        // until its daemon offers a byte-oriented upload API.
         async start(onMessage, signal, shouldDownload) {
             console.error(`hara gateway[signal]: polling signal-cli daemon at ${base} as ${redactPhone(selfNumber)} (ensure \`signal-cli -a <number> daemon --http\` is running).`);
             while (!signal.aborted) {

package/dist/gateway/slack.js

@@ -4,8 +4,6 @@
 // API (bot token, xoxb-). Same ChatAdapter shape as Discord/Telegram, so all cross-platform gateway plumbing
 // (send_file, in-chat system context, stuck-guard, image attach/describe) works unchanged. Two tokens are
 // required because Socket Mode (xapp-) and the Web API (xoxb-) are separate auth scopes.
-import { readFileSync } from "node:fs";
-import { basename } from "node:path";
 import { InboundMediaBudget, savePrivateResponse } from "./media.js";
 import { chunkText } from "./telegram.js";
 const WEB = "https://slack.com/api";
@@ -93,16 +91,16 @@ export function slackAdapter(appToken, botToken) {
                 await slackApi("chat.postMessage", botToken, { channel: chatId, text: part });
             }
         },
-        async sendFile(chatId, filePath) {
+        async sendFile(chatId, file) {
             // 3-step external-upload flow (getUploadURLExternal → PUT bytes → completeUploadExternal): the current,
             // non-deprecated path that works with just files:write (the old files.upload can 404/missing_scope).
             try {
-                const bytes = readFileSync(filePath);
-                const name = basename(filePath);
+                const bytes = file.bytes;
+                const name = file.safeName;
                 const url = await slackApi("files.getUploadURLExternal", botToken, { filename: name, length: bytes.length });
                 if (!url?.ok || !url.upload_url || !url.file_id)
                     return;
-                const up = await fetch(url.upload_url, { method: "POST", body: new Blob([bytes]) }); // presigned URL: no auth header
+                const up = await fetch(url.upload_url, { method: "POST", body: new Blob([new Uint8Array(bytes)]) }); // presigned URL: no auth header
                 if (!up.ok)
                     return;
                 await slackApi("files.completeUploadExternal", botToken, { files: [{ id: url.file_id, title: name }], channel_id: String(chatId) });

package/dist/gateway/telegram.js

@@ -1,8 +1,6 @@
 // Telegram adapter for `hara gateway` — long-poll getUpdates + sendMessage over the Bot API (built-in
 // fetch, zero new dep). Token from HARA_TELEGRAM_TOKEN. The generic `ChatAdapter` shape is what WeChat(iLink)
 // / Feishu plug into next.
-import { readFileSync } from "node:fs";
-import { basename } from "node:path";
 import { InboundMediaBudget, savePrivateResponse } from "./media.js";
 const API = "https://api.telegram.org";
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
@@ -82,13 +80,13 @@ export function telegramAdapter(token) {
                 });
             }
         },
-        async sendFile(chatId, filePath) {
+        async sendFile(chatId, file) {
             // images → sendPhoto (inline preview); everything else → sendDocument (keeps the filename)
-            const name = basename(filePath);
+            const name = file.safeName;
             const isImg = /\.(png|jpe?g|gif|webp)$/i.test(name);
             const form = new FormData();
             form.append("chat_id", String(chatId));
-            form.append(isImg ? "photo" : "document", new Blob([readFileSync(filePath)]), name);
+            form.append(isImg ? "photo" : "document", new Blob([new Uint8Array(file.bytes)]), name);
             await request(isImg ? "sendPhoto" : "sendDocument", { method: "POST", body: form });
         },
         async start(onMessage, signal, shouldDownload) {

package/dist/gateway/tmux-routes.js

@@ -6,7 +6,7 @@
 //
 // Safety: the daemon only reaches this AFTER its allow-list gate (so only the owner can trigger it), and it
 // ONLY injects into panes that opted in by registering — never an arbitrary pane.
-import { readFileSync, writeFileSync, mkdirSync } from "node:fs";
+import { chmodSync, readFileSync, writeFileSync, mkdirSync } from "node:fs";
 import { execFileSync } from "node:child_process";
 import { join } from "node:path";
 import { homedir } from "node:os";
@@ -26,8 +26,16 @@ function load() {
     }
 }
 function save(routes) {
-    mkdirSync(dir(), { recursive: true });
-    writeFileSync(storePath(), JSON.stringify({ routes }, null, 2));
+    mkdirSync(dir(), { recursive: true, mode: 0o700 });
+    try {
+        chmodSync(dir(), 0o700);
+    }
+    catch { /* best effort */ }
+    writeFileSync(storePath(), JSON.stringify({ routes }, null, 2), { mode: 0o600 });
+    try {
+        chmodSync(storePath(), 0o600);
+    }
+    catch { /* best effort */ }
 }
 /** Register (or refresh) a pane as awaiting a reply. De-dups by pane. mode "once" (default) = consumed after one
  *  reply; "bind" = persistent (every reply injects until unbound). */

package/dist/gateway/wecom.js

@@ -10,7 +10,6 @@
 // chunked protocol → AES-256-CBC decrypt inbound media that carries an `aeskey`. Every request frame carries a
 // `headers.req_id` and the server echoes it back so request/response are correlated. v1 limitations are documented
 // at the bottom of this file (the public spec is thin — fields are best-effort and tolerant of shape drift).
-import { readFileSync } from "node:fs";
 import { basename, extname } from "node:path";
 import { randomUUID, createDecipheriv, createHash } from "node:crypto";
 import { chunkText } from "./telegram.js";
@@ -204,17 +203,17 @@ export function wecomAdapter(botId, secret, wsUrl = DEFAULT_WS_URL) {
     // per-connection request/response correlation lives inside connectOnce; send/sendFile use the live socket handle
     // it publishes through `conn`.
     const conn = { send: null };
-    // Upload a local file to WeCom via the 3-step chunked protocol → its media_id. Throws on any step error.
-    async function uploadMedia(filePath, mediaType) {
+    // Upload already-verified bytes to WeCom via the 3-step chunked protocol → its media_id.
+    async function uploadMedia(file, mediaType) {
         if (!conn.send)
             throw new Error("WeCom socket not connected");
-        const data = readFileSync(filePath);
+        const data = file.bytes;
         if (data.length > ABSOLUTE_MAX_BYTES)
             throw new Error(`file exceeds WeCom 20MB limit: ${data.length} bytes`);
         const totalChunks = Math.max(1, Math.ceil(data.length / UPLOAD_CHUNK_SIZE));
         const init = await conn.send(CMD_UPLOAD_INIT, {
             type: mediaType,
-            filename: basename(filePath),
+            filename: file.safeName,
             total_size: data.length,
             total_chunks: totalChunks,
             md5: createHash("md5").update(data).digest("hex"),
@@ -245,12 +244,12 @@ export function wecomAdapter(botId, secret, wsUrl = DEFAULT_WS_URL) {
                     .catch(() => { });
             }
         },
-        async sendFile(chatId, filePath) {
+        async sendFile(chatId, file) {
             if (!conn.send)
                 return;
-            const mediaType = isImageName(filePath) ? "image" : "file";
+            const mediaType = isImageName(file.safeName) ? "image" : "file";
             try {
-                const mediaId = await uploadMedia(filePath, mediaType);
+                const mediaId = await uploadMedia(file, mediaType);
                 await conn.send(CMD_SEND, { chatid: String(chatId), msgtype: mediaType, [mediaType]: { media_id: mediaId } });
             }
             catch {

package/dist/gateway/weixin.js

@@ -6,7 +6,6 @@
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { chmodSync, readFileSync, writeFileSync, existsSync, mkdirSync, renameSync, rmSync } from "node:fs";
-import { basename } from "node:path";
 import { randomBytes, randomUUID, createHash, createCipheriv, createDecipheriv } from "node:crypto";
 import { chunkText } from "./telegram.js";
 import { INBOUND_MEDIA_MAX_BYTES, INBOUND_MEDIA_TIMEOUT_MS, InboundMediaBudget, cleanupTransientMedia, readResponseBytesLimited, savePrivateMediaBytes, } from "./media.js";
@@ -198,8 +197,16 @@ export function loadWeixinCreds() {
     }
 }
 function saveWeixinCreds(c) {
-    mkdirSync(weixinDir(), { recursive: true });
+    mkdirSync(weixinDir(), { recursive: true, mode: 0o700 });
+    try {
+        chmodSync(weixinDir(), 0o700);
+    }
+    catch { /* best effort */ }
     writeFileSync(credsFile(), JSON.stringify(c, null, 2), { mode: 0o600 });
+    try {
+        chmodSync(credsFile(), 0o600);
+    }
+    catch { /* best effort */ }
 }
 // get_updates_buf cursor — persisted so a restart resumes the message stream where it left off.
 function loadCursor(accountId) {
@@ -213,8 +220,11 @@ function loadCursor(accountId) {
 }
 function saveCursor(accountId, buf) {
     try {
-        mkdirSync(weixinDir(), { recursive: true });
-        writeFileSync(join(weixinDir(), `${accountId}.cursor`), buf);
+        mkdirSync(weixinDir(), { recursive: true, mode: 0o700 });
+        chmodSync(weixinDir(), 0o700);
+        const file = join(weixinDir(), `${accountId}.cursor`);
+        writeFileSync(file, buf, { mode: 0o600 });
+        chmodSync(file, 0o600);
     }
     catch {
         /* best-effort */
@@ -501,14 +511,14 @@ async function cdnUpload(uploadUrl, ciphertext) {
         throw new Error("CDN upload missing x-encrypted-param header");
     return ep;
 }
-/** Send a local file to a peer. Images go inline (image_item); everything else (audio/zip/pdf/doc/…) goes as a
+/** Send already-verified bytes to a peer. Images go inline (image_item); everything else (audio/zip/pdf/doc/…) goes as a
  *  file attachment (file_item) carrying the filename. Ported byte-exact from iLink's media protocol:
  *  getuploadurl → AES-128-ECB encrypt → CDN POST → sendmessage(item). */
-export async function sendMediaFile(creds, tokenStore, peer, filePath) {
+export async function sendMediaFile(creds, tokenStore, peer, file) {
     try {
-        const plaintext = readFileSync(filePath);
+        const plaintext = file.bytes;
         const rawsize = plaintext.length;
-        const isImage = IMAGE_EXTS.has((filePath.split(".").pop() || "").toLowerCase());
+        const isImage = IMAGE_EXTS.has((file.safeName.split(".").pop() || "").toLowerCase());
         const rawfilemd5 = createHash("md5").update(plaintext).digest("hex");
         const filekey = randomBytes(16).toString("hex");
         const key = randomBytes(16);
@@ -524,7 +534,7 @@ export async function sendMediaFile(creds, tokenStore, peer, filePath) {
         const encryptedParam = await cdnUpload(uploadUrl, ciphertext);
         const item = isImage
             ? imageInlineItem(encryptedParam, apiAesKey(keyHex), ciphertext.length)
-            : audioFileItem(encryptedParam, apiAesKey(keyHex), rawsize, basename(filePath));
+            : audioFileItem(encryptedParam, apiAesKey(keyHex), rawsize, file.safeName);
         const clientId = `hara-weixin-${randomUUID().replace(/-/g, "")}`; // reused across the -14 retry for dedup
         const send = (ctx) => {
             const msg = { from_user_id: "", to_user_id: peer, client_id: clientId, message_type: MSG_TYPE_BOT, message_state: MSG_STATE_FINISH, item_list: [item] };
@@ -623,9 +633,9 @@ export function weixinAdapter(creds) {
             for (const part of chunkText(text || "(empty)"))
                 await sendChunk(creds, tokenStore, peer, part);
         },
-        async sendFile(chatId, filePath) {
-            if (!(await sendMediaFile(creds, tokenStore, String(chatId), filePath)))
-                throw new Error(`weixin file delivery failed: ${filePath}`);
+        async sendFile(chatId, file) {
+            if (!(await sendMediaFile(creds, tokenStore, String(chatId), file)))
+                throw new Error(`weixin file delivery failed: ${file.safeName}`);
         },
         async start(onMessage, signal, shouldDownload) {
             let buf = loadCursor(creds.account_id);

package/dist/hooks.js

@@ -6,6 +6,8 @@ import { spawnSync } from "node:child_process";
 import { resolve } from "node:path";
 import { loadConfig } from "./config.js";
 import { pluginHooks } from "./plugins/plugins.js";
+import { redactToolSubprocessOutput, toolSubprocessEnv } from "./security/subprocess-env.js";
+import { shellCommand } from "./sandbox.js";
 const cache = new Map();
 export function resetHooksCache() {
     cache.clear();
@@ -47,28 +49,32 @@ export function runHooks(event, toolName, payload, cwd, timeoutMs = 30_000) {
             continue;
         let r;
         try {
-            r = spawnSync(h.command, {
-                shell: true,
+            // Hooks are user/plugin-configured external code. Route them through the same command preflight and
+            // macOS protected-read mask as Bash, even though hooks remain observe-only after a tool has run.
+            const shell = shellCommand(h.command, cwd, "off");
+            r = spawnSync(shell.cmd, shell.args, {
                 cwd,
                 input: JSON.stringify({ tool: toolName, payload }),
                 encoding: "utf8",
                 timeout: timeoutMs,
-                env: { ...process.env, HARA_TOOL_NAME: toolName },
+                env: toolSubprocessEnv(process.env, { HARA_TOOL_NAME: toolName }),
             });
         }
         catch (error) {
             if (event === "PreToolUse") {
-                const detail = error instanceof Error ? error.message : String(error);
+                const detail = redactToolSubprocessOutput(error instanceof Error ? error.message : String(error));
                 return { block: true, message: `⛔ blocked because a PreToolUse hook could not start${detail ? `: ${detail}` : ""}` };
             }
+            // PostToolUse is best-effort: a policy-blocked or broken observer must never rewrite the result of a
+            // tool that already completed. In particular, do not retry it through an unsandboxed fallback shell.
             continue;
         }
         // A hook is allowed to ignore stdin. On Linux, a command that exits successfully before Node finishes
         // writing `input` can report EPIPE in r.error *alongside status=0*. The wait status is authoritative in
         // that case; true launch/write failures still have status=null, while timeouts/signals remain blocked.
         if (event === "PreToolUse" && (r.status !== 0 || !!r.signal)) {
-            const output = (String(r.stdout ?? "") + String(r.stderr ?? "")).trim();
-            const failure = r.error?.message || (r.signal ? `terminated by ${r.signal}` : `exit ${r.status ?? "unknown"}`);
+            const output = redactToolSubprocessOutput((String(r.stdout ?? "") + String(r.stderr ?? "")).trim());
+            const failure = redactToolSubprocessOutput(r.error?.message || (r.signal ? `terminated by ${r.signal}` : `exit ${r.status ?? "unknown"}`));
             return { block: true, message: `⛔ blocked by a PreToolUse hook${output ? `: ${output}` : ` (${failure})`}` };
         }
     }