@nanhara/hara 0.122.2 → 0.122.4

package/dist/search/semindex.js

@@ -7,10 +7,11 @@ import { createHash } from "node:crypto";
 import { homedir } from "node:os";
 import { basename, join, isAbsolute, resolve } from "node:path";
 import { findProjectRoot } from "../context/agents-md.js";
-import { listProjectFiles, walkFiles } from "../fs-walk.js";
+import { listProjectFiles, listProjectFilesAsync, walkFiles, walkFilesAsync, } from "../fs-walk.js";
 import { zvecBuild, zvecQueryIds, zvecRemove } from "./zvec-store.js";
 import { isSensitiveFilePath } from "../security/sensitive-files.js";
 import { readModelContextFileSync } from "../fs-read.js";
+import { homeWorkspaceActionError, isHomeWorkspace } from "../context/workspace-scope.js";
 import { ensurePrivateStateSubdirectory, readPrivateStateFileSnapshot, removePrivateStateFile, } from "../security/private-state.js";
 import { atomicWriteText, bindHaraPrivateStateWritePath, } from "../fs-write.js";
 // Same code/text extensions codebase_search ranks lexically — keep the two walks in sync.
@@ -51,6 +52,8 @@ async function ensurePrivateIndexState(name, cwd) {
 }
 function existingPrivateIndexPath(name, cwd) {
     try {
+        if (name === "repo" && isHomeWorkspace(cwd))
+            return null;
         const requested = indexPath(name, cwd);
         const base = realpathSync.native(indexBase(name, cwd));
         const hara = join(base, ".hara");
@@ -126,7 +129,11 @@ async function rotateLegacyIndex(name, cwd, state) {
 /** Build/refresh the index. **Incremental**: files whose content hash is unchanged keep their existing
  *  vectors (no re-embed); only new/changed files are embedded, and deleted files drop out. A changed
  *  embedding model forces a full rebuild (old vectors aren't comparable). Returns counts. */
-export async function buildIndex(name, chunks, embed, cwd, model = "embed") {
+export async function buildIndex(name, chunks, embed, cwd, model = "embed", signal) {
+    if (signal?.aborted)
+        throw new Error("semantic index build interrupted");
+    if (name === "repo" && isHomeWorkspace(cwd))
+        throw new Error(homeWorkspaceActionError("build a repository index"));
     const state = await ensurePrivateIndexState(name, cwd);
     const p = state.path;
     // Load the previous index → reuse vectors for unchanged files.
@@ -169,6 +176,8 @@ export async function buildIndex(name, chunks, embed, cwd, model = "embed") {
     const toEmbed = [];
     let reused = 0;
     for (const [file, fchunks] of byFile) {
+        if (signal?.aborted)
+            throw new Error("semantic index build interrupted");
         const currentHash = contentHash(fchunks);
         const prev = prevByFile.get(file);
         if (sameModel
@@ -183,11 +192,17 @@ export async function buildIndex(name, chunks, embed, cwd, model = "embed") {
     }
     const B = 64;
     for (let i = 0; i < toEmbed.length; i += B) {
+        if (signal?.aborted)
+            throw new Error("semantic index build interrupted");
         const batch = toEmbed.slice(i, i + B);
-        const vecs = await embed(batch.map((c) => c.text));
+        const vecs = await embed(batch.map((c) => c.text), signal);
+        if (signal?.aborted)
+            throw new Error("semantic index build interrupted");
         batch.forEach((c, j) => vecs[j] && items.push({ ...c, vec: vecs[j] }));
     }
     // The index is derived + rebuildable (and may embed file contents) — never let it be committed.
+    if (signal?.aborted)
+        throw new Error("semantic index build interrupted");
     if (!state.ignoreSnapshot || state.ignoreSnapshot.text !== "*\n") {
         await atomicWriteText(state.ignoreBoundary.target, "*\n", {
             expected: state.ignoreSnapshot?.text ?? null,
@@ -239,6 +254,8 @@ export function collectDirChunks(dir, source) {
 }
 /** Walk the repo (respecting .gitignore) and chunk every code/text file — the corpus `hara index` embeds. */
 export function collectRepoChunks(root) {
+    if (isHomeWorkspace(root))
+        throw new Error(homeWorkspaceActionError("scan the home directory for a repository index"));
     const chunks = [];
     for (const rel of listProjectFiles(root)) {
         if (!CODE_RE.test(rel) || looksSecret(rel))
@@ -255,8 +272,65 @@ export function collectRepoChunks(root) {
     }
     return chunks;
 }
+async function chunksFromInventory(root, files, source, absolutePaths, startedAt, timeoutMs, signal) {
+    const chunks = [];
+    let fileIndex = 0;
+    for (const rel of files) {
+        if (signal?.aborted)
+            throw signal.reason instanceof Error ? signal.reason : new Error("index collection cancelled");
+        if (Date.now() - startedAt >= timeoutMs)
+            return { chunks, truncated: true, reason: "time_limit" };
+        if (fileIndex++ > 0 && fileIndex % 32 === 0) {
+            await new Promise((resolveTurn) => setImmediate(resolveTurn));
+            if (signal?.aborted)
+                throw signal.reason instanceof Error ? signal.reason : new Error("index collection cancelled");
+        }
+        if (!CODE_RE.test(rel) || looksSecret(rel))
+            continue;
+        const abs = join(root, rel);
+        let text;
+        try {
+            text = readModelContextFileSync(abs, 200_000);
+        }
+        catch {
+            continue;
+        }
+        chunks.push(...chunkText(text, absolutePaths ? abs : rel, source, statMtime(abs)));
+    }
+    return { chunks, truncated: false };
+}
+/** Interruptible knowledge-directory collection for the explicit index command and background callers. */
+export async function collectDirChunksAsync(dir, source, options = {}) {
+    if (!existsSync(dir))
+        return { chunks: [], truncated: false };
+    const timeoutMs = Number.isFinite(options.timeoutMs) ? Math.max(0, Math.floor(options.timeoutMs)) : 30_000;
+    const startedAt = Date.now();
+    const inventory = await walkFilesAsync(dir, { ...options, timeoutMs });
+    const collected = await chunksFromInventory(dir, inventory.files, source, true, startedAt, timeoutMs, options.signal);
+    return collected.truncated ? collected : {
+        chunks: collected.chunks,
+        truncated: inventory.truncated,
+        reason: inventory.reason,
+    };
+}
+/** Interruptible repository collection. Git discovery and file reads share one total wall budget. */
+export async function collectRepoChunksAsync(root, options = {}) {
+    if (isHomeWorkspace(root))
+        throw new Error(homeWorkspaceActionError("scan the home directory for a repository index"));
+    const timeoutMs = Number.isFinite(options.timeoutMs) ? Math.max(0, Math.floor(options.timeoutMs)) : 30_000;
+    const startedAt = Date.now();
+    const inventory = await listProjectFilesAsync(root, { ...options, timeoutMs });
+    const collected = await chunksFromInventory(root, inventory.files, "repo", false, startedAt, timeoutMs, options.signal);
+    return collected.truncated ? collected : {
+        chunks: collected.chunks,
+        truncated: inventory.truncated,
+        reason: inventory.reason,
+    };
+}
 /** Cosine-rank the index against the query embedding. Returns top-k hits (empty if no index). */
-export async function queryIndex(name, query, embed, cwd, k = 6) {
+export async function queryIndex(name, query, embed, cwd, k = 6, signal) {
+    if (signal?.aborted)
+        throw new Error("semantic query interrupted");
     if (!existingPrivateIndexPath(name, cwd))
         return [];
     let state;
@@ -291,7 +365,9 @@ export async function queryIndex(name, query, embed, cwd, k = 6) {
     });
     if (!safeItems.length)
         return [];
-    const [qv] = await embed([query]);
+    const [qv] = await embed([query], signal);
+    if (signal?.aborted)
+        throw new Error("semantic query interrupted");
     if (!qv)
         return [];
     // A format marker proves which writer created the cache, not that its source still has the same bytes.
@@ -321,6 +397,8 @@ export async function queryIndex(name, query, embed, cwd, k = 6) {
             .sort((a, b) => b.score - a.score);
         const hits = [];
         for (const { item, score } of ranked) {
+            if (signal?.aborted)
+                break;
             if (!isFresh(item))
                 continue;
             hits.push({ file: item.file, source: item.source, text: item.text, score });
@@ -332,7 +410,11 @@ export async function queryIndex(name, query, embed, cwd, k = 6) {
     // Prefer the zvec ANN index for candidate retrieval; re-rank candidates by EXACT cosine from the JSON
     // store (identical score semantics to the brute-force path). Fall back to full brute-force if zvec is
     // unavailable / has no index / errors.
+    if (signal?.aborted)
+        throw new Error("semantic query interrupted");
     const ids = await zvecQueryIds(name, qv, cwd, k);
+    if (signal?.aborted)
+        throw new Error("semantic query interrupted");
     if (ids?.length) {
         const byId = new Map(safeItems.map((it) => [it.id, it]));
         const candidates = ids

package/dist/security/guardian.js

@@ -17,6 +17,7 @@
 // trips a hard stop that requires explicit user confirmation to continue — a harder stop than the soft
 // stuck-guard nudge, and one that aborts safely (never hangs) when there's no interactive user.
 import { resolve, isAbsolute } from "node:path";
+import { boundedProviderTurn } from "../providers/bounded-turn.js";
 import { canonicalize, splitCompound } from "./permissions.js";
 // ── Deterministic risk classifier ────────────────────────────────────────────────────────────────────
 // The classifier is intentionally NARROW: false positives here cost latency + an LLM call + potential
@@ -208,23 +209,13 @@ export async function guardianVeto(provider, action, history, opts = {}) {
         `HIGH-RISK ACTION (flagged: ${action.classifierReason}):\n` +
         `tool: ${action.tool}\n${action.detail}\n\n` +
         `Allow or block this action? Reply with only the JSON verdict.`;
-    const ac = new AbortController();
-    const timer = setTimeout(() => ac.abort(), opts.timeoutMs ?? DEFAULT_TIMEOUT_MS);
-    // Chain the caller's interrupt signal so Esc also aborts the guardian call.
-    if (opts.signal) {
-        if (opts.signal.aborted)
-            ac.abort();
-        else
-            opts.signal.addEventListener("abort", () => ac.abort(), { once: true });
-    }
     try {
-        const r = await provider.turn({
+        const r = await boundedProviderTurn(provider, {
             system: GUARDIAN_SYSTEM,
             history: [{ role: "user", content: prompt }],
             tools: [],
             onText: () => { },
-            signal: ac.signal,
-        });
+        }, { timeoutMs: opts.timeoutMs ?? DEFAULT_TIMEOUT_MS, signal: opts.signal, label: "security guardian" });
         if (r.stop === "error")
             return { decision: "allow", reason: "" }; // fail-open on model error
         return parseVerdict(r.text);
@@ -232,9 +223,6 @@ export async function guardianVeto(provider, action, history, opts = {}) {
     catch {
         return { decision: "allow", reason: "" }; // fail-open on timeout/abort/throw
     }
-    finally {
-        clearTimeout(timer);
-    }
 }
 export function newBreaker() {
     return { blocks: 0, tripped: false };

package/dist/security/permissions.js

@@ -15,6 +15,7 @@ import { closeSync, existsSync, fstatSync, fsyncSync, linkSync, lstatSync, mkdir
 import { psArgumentsExposeEnvironment } from "./sensitive-files.js";
 import { projectRepositoryTrustedAtStartup } from "./project-trust.js";
 import { readVerifiedRegularFileSnapshotSync } from "../fs-read.js";
+import { homeWorkspaceActionError, isHomeWorkspace } from "../context/workspace-scope.js";
 const PROJECT_ROOT_MARKERS = [".git", "package.json", "Cargo.toml", "go.mod", "pyproject.toml", ".hg"];
 const MAX_PROJECT_PERMISSIONS_BYTES = 64 * 1024;
 const projectPermissionWarnings = new Set();
@@ -279,6 +280,10 @@ function readProjectRules(cwd) {
         dir = resolve(cwd);
     }
     for (;;) {
+        // ~/.hara/permissions.json is global policy, not a project policy file. Stopping before Home also
+        // prevents an unmarked child workspace from inheriting a repository marker above the user's home.
+        if (isHomeWorkspace(dir))
+            break;
         const hara = join(dir, ".hara");
         const file = join(hara, "permissions.json");
         let parentInfo;
@@ -350,6 +355,8 @@ export function globalPermissionsPath() {
 export function projectPermissionsPath(cwd) {
     let dir = resolve(cwd);
     for (;;) {
+        if (isHomeWorkspace(dir))
+            break;
         const p = join(dir, ".hara", "permissions.json");
         if (existsSync(p))
             return p;
@@ -426,6 +433,10 @@ function existingScaffoldTarget(path) {
 /** Create project permissions without following `.hara` or replacing any existing directory entry. */
 function scaffoldProjectPermissions(cwd) {
     const project = realpathSync.native(resolve(cwd));
+    // Project scaffolding at ~/ would target the same ~/.hara/permissions.json used by global policy and
+    // silently promote repository starter rules to every Hara session. Reject before creating `.hara`.
+    if (isHomeWorkspace(project))
+        throw new Error(homeWorkspaceActionError("create project permissions"));
     const projectIdentity = verifiedDirectory(project);
     const parent = join(project, ".hara");
     try {

package/dist/serve/server.js

@@ -16,14 +16,14 @@ import { analyzeContext } from "../agent/context-report.js";
 import { clearTouched, recentTouched } from "../agent/touched.js";
 import { resetRepeatGuard } from "../agent/repeat-guard.js";
 import { contextWindow, ctxPctFor } from "../statusbar.js";
-import { listProjectFiles } from "../fs-walk.js";
+import { listProjectFilesAsync } from "../fs-walk.js";
 import { fuzzyRank } from "../fuzzy.js";
-import { loadAgentsMd } from "../context/agents-md.js";
-import { expandMentions } from "../context/mentions.js";
+import { loadAgentContext } from "../context/agents-md.js";
+import { expandMentionsAsync } from "../context/mentions.js";
 import { memoryDigest } from "../memory/store.js";
 import { listInstalled, enabledPlugins, setPluginEnabled, panelsForProject } from "../plugins/plugins.js";
 import { loadSkillIndex, loadSkillBody } from "../skills/skills.js";
-import { loadJobs, saveJobs, addJob } from "../cron/store.js";
+import { loadJobs, addJob, removeJob, setEnabled } from "../cron/store.js";
 import { parseSchedule, describeSchedule } from "../cron/schedule.js";
 import { loadTasks } from "../tools/task.js";
 import { listPending, resolvePending } from "../gateway/flows-pending.js";
@@ -315,7 +315,7 @@ export async function startServe(opts, deps) {
             diff: (t) => broadcast("event.diff", { sessionId, text: t }),
             notice: (t) => broadcast("event.notice", { sessionId, text: t }),
         };
-        const confirm = (q) => new Promise((resolve) => {
+        const confirm = (q, signal = turnAbort.signal) => new Promise((resolve) => {
             const approvalId = randomUUID();
             let settled = false;
             let timer;
@@ -325,16 +325,18 @@ export async function startServe(opts, deps) {
                 settled = true;
                 clearTimeout(timer);
                 pendingApprovals.delete(approvalId);
-                turnAbort.signal.removeEventListener("abort", onAbort);
+                signal.removeEventListener("abort", onAbort);
                 resolve(v);
             };
             const onAbort = () => finish(false);
             timer = setTimeout(() => finish(false), APPROVAL_TIMEOUT_MS); // unanswered → deny, turn continues
             pendingApprovals.set(approvalId, finish);
-            if (turnAbort.signal.aborted)
+            if (signal.aborted)
                 finish(false);
             else {
-                turnAbort.signal.addEventListener("abort", onAbort, { once: true });
+                // `signal` is runAgent's combined Esc + total-deadline signal. Listening only to turnAbort would
+                // leave the approval map and Desktop prompt stale when the internal lifecycle deadline fires.
+                signal.addEventListener("abort", onAbort, { once: true });
                 broadcast("approval.request", { sessionId, approvalId, question: q });
             }
         });
@@ -358,14 +360,14 @@ export async function startServe(opts, deps) {
             }
             // @file mentions expand to file contents, same as the CLI (`@src/foo.ts` in the composer works).
             // Pasted images ride along as NeutralMsg.images — a vision-capable model sees them inline.
-            s.history.push({ role: "user", content: expandMentions(content, s.meta.cwd), ...(images && images.length ? { images } : {}) });
+            s.history.push({ role: "user", content: await expandMentionsAsync(content, s.meta.cwd, { signal: turnAbort.signal }), ...(images && images.length ? { images } : {}) });
             const outcome = await runAgent(s.history, {
                 provider: s.provider,
                 ctx: {
                     cwd: s.meta.cwd,
                     sandbox: deps.sandbox,
                     todoScope: sessionId,
-                    spawn: (t, role) => deps.spawnSubagent(s.provider, s.meta.cwd, s.projectContext, s.stats, t, role),
+                    spawn: (t, role, signal) => deps.spawnSubagent(s.provider, s.meta.cwd, s.projectContext, s.stats, t, role, signal),
                     ui: sink,
                 },
                 approval: s.approval,
@@ -384,7 +386,21 @@ export async function startServe(opts, deps) {
                     };
                     void turn.then(settled, settled);
                 },
+                onToolRun: (toolRun) => {
+                    s.pendingToolRuns += 1;
+                    const settled = () => {
+                        s.pendingToolRuns = Math.max(0, s.pendingToolRuns - 1);
+                        // `abort === null` means the logical turn already returned. Keep the session busy/locked until
+                        // every late side-effect-capable Promise has physically stopped.
+                        if (s.pendingToolRuns === 0 && s.abort === null)
+                            s.busy = false;
+                        if (closing)
+                            hub.releaseIdle();
+                    };
+                    void toolRun.then(settled, settled);
+                },
                 guardian: turnGuardian,
+                ...(deps.runLimits?.(s.meta.cwd) ?? {}),
             });
             s.meta.todos = serializeTodos(sessionId);
             hub.save(s);
@@ -393,11 +409,11 @@ export async function startServe(opts, deps) {
             // clients render a meter without an extra round-trip.
             const ctx = ctxOf(s);
             if (outcome.status !== "completed") {
-                const failure = outcome.status === "error"
-                    ? (outcome.error ?? "agent turn failed")
-                    : outcome.status === "empty"
-                        ? "the model returned an empty response after retrying"
-                        : "agent turn halted by the safety circuit-breaker";
+                const failure = outcome.error ?? (outcome.status === "empty"
+                    ? "the model returned an empty response after retrying"
+                    : outcome.status === "halted"
+                        ? "agent turn halted by a safety control"
+                        : "agent turn failed");
                 broadcast("event.turn_end", { sessionId, reply: "", error: failure, status: outcome.status, usage, ctx });
                 throw new Error(failure);
             }
@@ -408,8 +424,8 @@ export async function startServe(opts, deps) {
             return { reply, usage, ctx };
         }
         finally {
-            s.busy = false;
             s.abort = null;
+            s.busy = s.pendingToolRuns > 0;
         }
     };
     /** Context watermark for a session: how full the model's window was on the last turn. */
@@ -444,27 +460,33 @@ export async function startServe(opts, deps) {
             if (controller.signal.aborted)
                 return onAbort();
             // Promise.resolve protects this boundary even if a non-conforming provider throws synchronously.
-            void Promise.resolve().then(() => s.provider.turn({
-                system: COMPACT_SYSTEM,
-                history: [...s.history, { role: "user", content: "Summarize our conversation so far per the instructions." }],
-                tools: [],
-                onText: () => { },
-                signal: controller.signal,
-            })).then((result) => finish(() => resolve(result)), (error) => finish(() => reject(error)));
+            void Promise.resolve().then(() => {
+                // The abort can fire after scheduling this microtask but before it runs. Gate the provider call at
+                // the actual invocation boundary so an interrupted/expired compact cannot start a late request.
+                if (controller.signal.aborted)
+                    throw new Error(timedOut ? "compaction timed out" : "compaction interrupted");
+                return s.provider.turn({
+                    system: COMPACT_SYSTEM,
+                    history: [...s.history, { role: "user", content: "Summarize our conversation so far per the instructions." }],
+                    tools: [],
+                    onText: () => { },
+                    signal: controller.signal,
+                });
+            }).then((result) => finish(() => resolve(result)), (error) => finish(() => reject(error)));
         });
-        if (r.stop === "error")
+        if (controller.signal.aborted || r.stop === "error")
             return null;
         const summary = r.text.trim();
         if (!summary)
             return null;
-        s.meta.workingSet = workingSetFromSummary(summary);
-        s.history.length = 0;
-        s.history.push({ role: "user", content: `Summary of our conversation so far (continue from here):\n\n${summary}` });
+        const workingSet = workingSetFromSummary(summary);
         const touched = recentTouched(20, s.meta.id).filter((file) => {
             const rel = relative(s.meta.cwd, file);
             return !!rel && rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel);
         }).slice(0, 5);
         const restore = buildFileRestore(touched, (f) => {
+            if (controller.signal.aborted)
+                return null;
             try {
                 return readModelContextFileSync(f, 32 * 1024);
             }
@@ -472,6 +494,11 @@ export async function startServe(opts, deps) {
                 return null;
             }
         });
+        if (controller.signal.aborted)
+            return null;
+        s.meta.workingSet = workingSet;
+        s.history.length = 0;
+        s.history.push({ role: "user", content: `Summary of our conversation so far (continue from here):\n\n${summary}` });
         if (restore)
             s.history.push({ role: "user", content: restore });
         s.stats.input += r.usage?.input ?? 0;
@@ -530,7 +557,7 @@ export async function startServe(opts, deps) {
                             if (!provider)
                                 return reply(rpcError(id, ERR.INTERNAL, "provider not authenticated — check the active profile and ~/.hara/config.json"));
                             const approval = ["suggest", "auto-edit", "full-auto"].includes(p.approval) ? p.approval : deps.approval;
-                            const s = hub.create({ cwd, provider, providerId: provider.id, model: provider.model, approval, projectContext: loadAgentsMd(cwd) || undefined });
+                            const s = hub.create({ cwd, provider, providerId: provider.id, model: provider.model, approval, projectContext: loadAgentContext(cwd) || undefined });
                             return reply(rpcResult(id, { sessionId: s.meta.id, model: s.meta.model }));
                         }
                         case "session.resume": {
@@ -566,7 +593,7 @@ export async function startServe(opts, deps) {
                                 hub.detach(r.session.meta.id);
                                 return reply(rpcError(id, ERR.INTERNAL, `provider not authenticated for pinned model '${r.session.meta.model}'`));
                             }
-                            r.session.projectContext = loadAgentsMd(r.session.meta.cwd) || undefined;
+                            r.session.projectContext = loadAgentContext(r.session.meta.cwd) || undefined;
                             return reply(rpcResult(id, { sessionId: r.session.meta.id, model: r.session.meta.model, history: historyForClient(r.session.history) }));
                         }
                         case "session.send": {
@@ -660,7 +687,7 @@ export async function startServe(opts, deps) {
                                 hub.delete(r.session.meta.id);
                                 return reply(rpcError(id, ERR.INTERNAL, `provider not authenticated for pinned model '${r.session.meta.model}'`));
                             }
-                            r.session.projectContext = loadAgentsMd(r.session.meta.cwd) || undefined;
+                            r.session.projectContext = loadAgentContext(r.session.meta.cwd) || undefined;
                             return reply(rpcResult(id, { sessionId: r.session.meta.id, title: r.session.meta.title, model: r.session.meta.model, history: historyForClient(r.session.history) }));
                         }
                         case "session.delete": {
@@ -770,21 +797,15 @@ export async function startServe(opts, deps) {
                         case "automation.toggle": {
                             if (typeof p.id !== "string" || typeof p.enabled !== "boolean")
                                 return reply(rpcError(id, ERR.PARAMS, "id + enabled required"));
-                            const jobs = loadJobs();
-                            const job = jobs.find((j) => j.id === p.id);
-                            if (!job)
+                            if (!setEnabled(p.id, p.enabled))
                                 return reply(rpcError(id, ERR.PARAMS, `no job ${p.id}`));
-                            job.enabled = p.enabled;
-                            saveJobs(jobs);
-                            return reply(rpcResult(id, { id: job.id, enabled: job.enabled }));
+                            return reply(rpcResult(id, { id: p.id, enabled: p.enabled }));
                         }
                         case "automation.delete": {
                             if (typeof p.id !== "string")
                                 return reply(rpcError(id, ERR.PARAMS, "id required"));
-                            const jobs = loadJobs();
-                            if (!jobs.some((j) => j.id === p.id))
+                            if (!removeJob(p.id))
                                 return reply(rpcError(id, ERR.PARAMS, `no job ${p.id}`));
-                            saveJobs(jobs.filter((j) => j.id !== p.id));
                             return reply(rpcResult(id, { id: p.id, deleted: true }));
                         }
                         case "skills.list": {
@@ -805,10 +826,17 @@ export async function startServe(opts, deps) {
                             const sess = typeof p.sessionId === "string" ? hub.get(p.sessionId) : undefined;
                             const cwd = typeof p.cwd === "string" && p.cwd ? p.cwd : (sess?.meta.cwd ?? opts.cwd);
                             const limit = Math.min(Math.max(Math.trunc(Number(p.limit) || 20), 1), 50);
-                            const all = listProjectFiles(cwd);
+                            const inventory = await listProjectFilesAsync(cwd, {
+                                maxFiles: 8_000,
+                                maxDirectories: 20_000,
+                                maxEntries: 100_000,
+                                timeoutMs: 1_000,
+                                yieldEvery: 64,
+                            });
+                            const all = inventory.files;
                             const query = typeof p.query === "string" ? p.query : "";
                             const files = query ? fuzzyRank(query, all, (f) => f).slice(0, limit).map((r) => r.item) : all.slice(0, limit);
-                            return reply(rpcResult(id, { files, cwd }));
+                            return reply(rpcResult(id, { files, cwd, truncated: inventory.truncated, reason: inventory.reason }));
                         }
                         case "session.context": {
                             // context-spend breakdown + watermark on demand (codex thread/tokenUsage + /context).
@@ -934,7 +962,7 @@ export async function startServe(opts, deps) {
                 await removeOwnedDiscovery(discoveryDir, discoveryPath, discovery).catch(() => { });
             let quiet = false;
             while (Date.now() < deadline) {
-                if (inFlightRequests.size === 0 && hub.active().every((session) => !session.busy && !session.configuring && session.pendingProviderTurns === 0)) {
+                if (inFlightRequests.size === 0 && hub.active().every((session) => !session.busy && !session.configuring && session.pendingProviderTurns === 0 && session.pendingToolRuns === 0)) {
                     quiet = true;
                     break;
                 }

package/dist/serve/sessions.js

@@ -47,7 +47,7 @@ export class SessionHub {
         const lock = this.store.acquire(meta.id); // fresh UUID, but filesystem errors must still fail closed
         if (!lock.ok)
             throw new Error(`could not acquire session lock for ${meta.id}${lock.pid ? ` (held by pid ${lock.pid})` : ""}`);
-        const s = { meta, history: [], provider: o.provider, approval: o.approval, autoApprove: new Set(), stats: { input: 0, output: 0 }, projectContext: o.projectContext, busy: false, configuring: false, pendingProviderTurns: 0, abort: null };
+        const s = { meta, history: [], provider: o.provider, approval: o.approval, autoApprove: new Set(), stats: { input: 0, output: 0 }, projectContext: o.projectContext, busy: false, configuring: false, pendingProviderTurns: 0, pendingToolRuns: 0, abort: null };
         try {
             this.sessions.set(meta.id, s);
             this.store.save(meta, []); // an empty newly-created thread must survive restart and appear in lists
@@ -76,7 +76,7 @@ export class SessionHub {
                 return { missing: true };
             // Credential/provider routing is live, while the model remains the session's explicit pin.
             prior.meta.provider = o.provider.id;
-            const s = { meta: prior.meta, history: [...prior.history], provider: o.provider, approval: o.approval, autoApprove: new Set(), stats: { input: 0, output: 0 }, projectContext: o.projectContext, busy: false, configuring: false, pendingProviderTurns: 0, abort: null, effort: prior.meta.effort };
+            const s = { meta: prior.meta, history: [...prior.history], provider: o.provider, approval: o.approval, autoApprove: new Set(), stats: { input: 0, output: 0 }, projectContext: o.projectContext, busy: false, configuring: false, pendingProviderTurns: 0, pendingToolRuns: 0, abort: null, effort: prior.meta.effort };
             this.sessions.set(id, s);
             keepLock = true; // live session owns it until delete/releaseAll
             return { session: s };
@@ -180,6 +180,7 @@ export class SessionHub {
             busy: false,
             configuring: false,
             pendingProviderTurns: 0,
+            pendingToolRuns: 0,
             abort: null,
             effort: src.meta.effort,
         };
@@ -221,7 +222,7 @@ export class SessionHub {
     /** Release only idle sessions; logical work and abandoned-but-physical provider turns retain their locks. */
     releaseIdle() {
         for (const [id, session] of this.sessions) {
-            if (session.busy || session.configuring || session.pendingProviderTurns > 0)
+            if (session.busy || session.configuring || session.pendingProviderTurns > 0 || session.pendingToolRuns > 0)
                 continue;
             this.store.release(id);
             this.sessions.delete(id);

package/dist/sync-sleep.js

@@ -0,0 +1,46 @@
+// Cross-runtime synchronous short wait for the tiny retry delays used by file locks.
+//
+// Bun standalone binaries do not guarantee that SharedArrayBuffer exists, so never construct one at
+// module evaluation time. Prefer Bun's native primitive, use Atomics only in Node, and retain a bounded
+// last resort so a missing/disabled runtime primitive cannot make lock acquisition crash or spin forever.
+const MAX_SHORT_WAIT_MS = 100;
+const MAX_FALLBACK_SPINS = 5_000_000;
+let nodeWaitCell;
+function boundedDelay(milliseconds) {
+    if (!Number.isFinite(milliseconds) || milliseconds <= 0)
+        return 0;
+    return Math.min(MAX_SHORT_WAIT_MS, Math.ceil(milliseconds));
+}
+/** Block for a small, bounded retry delay without assuming SharedArrayBuffer is available. */
+export function sleepSync(milliseconds) {
+    const delay = boundedDelay(milliseconds);
+    if (delay === 0)
+        return;
+    const runtime = globalThis;
+    if (typeof runtime.Bun?.sleepSync === "function") {
+        try {
+            runtime.Bun.sleepSync(delay);
+            return;
+        }
+        catch {
+            // A partially implemented Bun runtime still gets the bounded fallback below.
+        }
+    }
+    // Atomics.wait is a dependable synchronous sleep on Node's main thread. Do not use this branch in
+    // Bun: a compiled Bun executable may expose part of the Node compatibility surface without SAB.
+    if (!runtime.Bun && typeof runtime.SharedArrayBuffer === "function" && typeof runtime.Atomics?.wait === "function") {
+        try {
+            nodeWaitCell ??= new Int32Array(new runtime.SharedArrayBuffer(4));
+            runtime.Atomics.wait(nodeWaitCell, 0, 0, delay);
+            return;
+        }
+        catch {
+            nodeWaitCell = undefined;
+            // Some embedders disable blocking Atomics even when the globals exist. Fall through safely.
+        }
+    }
+    const deadline = Date.now() + delay;
+    for (let spins = 0; spins < MAX_FALLBACK_SPINS && Date.now() < deadline; spins++) {
+        // Intentionally empty: both time and iteration ceilings bound this compatibility fallback.
+    }
+}

package/dist/tools/agent.js

@@ -34,6 +34,6 @@ registerTool({
             return "Error: sub-agents are not available in this context.";
         if (typeof input.task !== "string" || !input.task.trim())
             return "Error: agent needs a `task`.";
-        return await ctx.spawn(input.task, input.role ? String(input.role) : undefined);
+        return await ctx.spawn(input.task, input.role ? String(input.role) : undefined, ctx.signal);
     },
 });

package/dist/tools/ask_user.js

@@ -52,11 +52,15 @@ registerTool({
         // Compose a compact prompt: [header] (context) question — the channel renders it.
         const prompt = [header ? `[${header}] ` : "", context ? `${context}\n` : "", question].join("");
         try {
-            const answer = await ctx.ask(prompt, options && options.length ? options : undefined);
+            const answer = await ctx.ask(prompt, options && options.length ? options : undefined, ctx.signal);
             const text = typeof answer === "string" ? answer.trim() : "";
             return text || "(the user gave an empty answer)";
         }
         catch (e) {
+            // Cancellation is authoritative. Let the agent loop close the open tool round as interrupted/deadline;
+            // converting it into an ordinary "no user" result would let the model continue after Esc.
+            if (ctx.signal?.aborted)
+                throw e;
             // If the interactive prompt fails for any reason, degrade gracefully rather than crash the turn.
             return `${NO_INTERACTIVE_USER} (ask failed: ${e?.message ?? e})`;
         }