@nanhara/hara 0.122.3 → 0.122.4

package/dist/tools/cron.js

@@ -7,11 +7,35 @@
 import { registerTool } from "./registry.js";
 import { addJob, loadJobs, resolveJob, removeJob, setEnabled } from "../cron/store.js";
 import { parseSchedule, describeSchedule, nextRun, validTz } from "../cron/schedule.js";
-import { runJobOnce } from "../cron/runner.js";
+import { runJobTracked } from "../cron/runner.js";
 import { parseDeliver } from "../cron/deliver.js";
 import { isInstalled } from "../cron/install.js";
 import { sensitiveShellCommandReason } from "../security/sensitive-files.js";
+import { homeWorkspaceActionError, isHomeWorkspace } from "../context/workspace-scope.js";
 const fmt = (ms) => (ms ? new Date(ms).toLocaleString() : "—");
+const fmtNext = (ms, now) => (ms !== null && ms <= now ? "due now" : fmt(ms));
+const duration = (ms) => {
+    if (ms === undefined)
+        return "";
+    if (ms >= 3_600_000)
+        return ` after ${Math.round(ms / 360_000) / 10}h`;
+    if (ms >= 60_000)
+        return ` after ${Math.round(ms / 6_000) / 10}m`;
+    if (ms >= 1_000)
+        return ` after ${Math.round(ms / 1_000)}s`;
+    return ` after ${ms}ms`;
+};
+const status = (j) => {
+    if (j.lastStatus === "running")
+        return `running since ${fmt(j.runningSince ?? j.lastRunAt ?? null)}`;
+    if (j.lastStatus === "timed_out")
+        return `timed out${duration(j.lastDurationMs)}`;
+    if (j.lastStatus === "error")
+        return `error${duration(j.lastDurationMs)}`;
+    if (j.lastStatus === "ok")
+        return `ok${duration(j.lastDurationMs)}`;
+    return "—";
+};
 registerTool({
     name: "cronjob",
     description: "Manage the user's scheduled jobs (hara cron). Use when they ask to schedule, automate, or be reminded of " +
@@ -19,7 +43,8 @@ registerTool({
         "and `task`. Optional: `name`; `mode` — \"print\" (default: run task as a hara prompt), \"org\" (role-routed), or " +
         "\"command\" (run task as a plain SHELL COMMAND — deterministic, no agent, no tokens; prefer it for fixed scripts); " +
         "`tz` (IANA, e.g. Asia/Shanghai, for cron exprs); `deliver` (push each run's result: telegram:<chatId> | " +
-        "feishu:<chatId> | webhook:<url>). Other actions: list · remove · enable · disable · run (fire now), with `id`. " +
+        "feishu:<chatId> | webhook:<url>); `alertAfter` (1..1000 consecutive failures, default 3). Other actions: " +
+        "list · remove · enable · disable · run (fire now), with `id`. " +
         "Jobs fire via the OS scheduler even when hara isn't running.",
     input_schema: {
         type: "object",
@@ -31,6 +56,7 @@ registerTool({
             mode: { type: "string", enum: ["print", "org", "command"] },
             tz: { type: "string", description: "IANA timezone for cron exprs" },
             deliver: { type: "string", description: "telegram:<chatId> | feishu:<chatId> | webhook:<url>" },
+            alertAfter: { type: "integer", minimum: 1, maximum: 1000, description: "consecutive failures before 🚨 (default 3)" },
             id: { type: "string", description: "job id (or unique prefix) for remove/enable/disable/run" },
         },
         required: ["action"],
@@ -41,17 +67,28 @@ registerTool({
             return "Error: cron-run sessions cannot manage cron jobs (recursion guard — a scheduled task must not schedule more tasks).";
         const action = String(input.action ?? "");
         if (action === "list") {
-            const jobs = loadJobs();
+            let jobs;
+            try {
+                jobs = loadJobs();
+            }
+            catch (error) {
+                return `Error: ${error instanceof Error ? error.message : String(error)}`;
+            }
             if (!jobs.length)
                 return "No scheduled jobs.";
             return jobs
                 .map((j) => {
-                const next = nextRun(j, Date.now());
-                return `${j.id} · ${j.enabled ? "on " : "OFF"} · ${j.name} · ${describeSchedule(j.schedule)}${j.tz ? ` @ ${j.tz}` : ""} · mode ${j.mode}${j.deliver ? ` · → ${j.deliver}` : ""} · next ${fmt(next)} · last ${j.lastStatus ?? "—"}${j.consecutiveErrors ? ` (${j.consecutiveErrors}✗)` : ""}`;
+                const now = Date.now();
+                const next = nextRun(j, now);
+                return `${j.id} · ${j.enabled ? "on " : "OFF"} · ${j.name} · ${describeSchedule(j.schedule)}${j.tz ? ` @ ${j.tz}` : ""} · mode ${j.mode}${j.deliver ? ` · → ${j.deliver}` : ""} · next ${fmtNext(next, now)} · last ${status(j)}${j.consecutiveErrors ? ` (${j.consecutiveErrors}✗)` : ""}`;
             })
                 .join("\n");
         }
         if (action === "add") {
+            // Every new job persists ctx.cwd and later treats it as its implicit agent/shell workspace. Management
+            // of existing jobs remains available at Home, but creating a Home-root job would bypass project scope.
+            if (isHomeWorkspace(ctx.cwd))
+                return `Error: ${homeWorkspaceActionError("schedule a job")}`;
             const scheduleStr = String(input.schedule ?? "").trim();
             const task = String(input.task ?? "").trim();
             if (!scheduleStr || !task)
@@ -70,30 +107,47 @@ registerTool({
                 if ("error" in d)
                     return `Error: ${d.error}`;
             }
+            const alertAfter = input.alertAfter === undefined ? undefined : Number(input.alertAfter);
+            if (alertAfter !== undefined && (!Number.isInteger(alertAfter) || alertAfter < 1 || alertAfter > 1_000)) {
+                return "Error: `alertAfter` must be an integer from 1 to 1000.";
+            }
             const mode = input.mode === "org" || input.mode === "command" ? input.mode : "print";
             if (mode === "command") {
                 const denied = sensitiveShellCommandReason(task, ctx.cwd);
                 if (denied)
                     return `Error: scheduled shell command crosses Hara's protected secret boundary (${denied}).`;
             }
-            const job = addJob({
-                name: input.name ? String(input.name) : task.slice(0, 48),
-                schedule: sched,
-                task,
-                mode,
-                cwd: ctx.cwd,
-                ...(tz ? { tz } : {}),
-                ...(deliver ? { deliver } : {}),
-                createdAt: Date.now(),
-            });
+            let job;
+            try {
+                job = addJob({
+                    name: input.name ? String(input.name) : task.slice(0, 48),
+                    schedule: sched,
+                    task,
+                    mode,
+                    cwd: ctx.cwd,
+                    ...(tz ? { tz } : {}),
+                    ...(deliver ? { deliver } : {}),
+                    ...(alertAfter !== undefined ? { alertAfter } : {}),
+                    createdAt: Date.now(),
+                });
+            }
+            catch (error) {
+                return `Error: ${error instanceof Error ? error.message : String(error)}`;
+            }
             const warn = isInstalled() ? "" : "\n⚠ The OS scheduler isn't installed yet — tell the user to run `hara cron install` once, or jobs won't fire.";
-            return `✓ scheduled ${job.id} · ${describeSchedule(sched)}${tz ? ` @ ${tz}` : ""} · mode ${mode}${deliver ? ` · → ${deliver}` : ""} · next ${fmt(nextRun(job, Date.now()))}${warn}`;
+            return `✓ scheduled ${job.id} · ${describeSchedule(sched)}${tz ? ` @ ${tz}` : ""} · mode ${mode}${deliver ? ` · → ${deliver}` : ""}${alertAfter !== undefined ? ` · alert ≥${alertAfter}` : ""} · next ${fmt(nextRun(job, Date.now()))}${warn}`;
         }
         // id-based actions
         const idArg = String(input.id ?? "").trim();
         if (!idArg)
             return `Error: ${action} needs \`id\`.`;
-        const j = resolveJob(idArg);
+        let j;
+        try {
+            j = resolveJob(idArg);
+        }
+        catch (error) {
+            return `Error: ${error instanceof Error ? error.message : String(error)}`;
+        }
         if (j === "ambiguous")
             return `Error: id "${idArg}" matches multiple jobs — use more characters.`;
         if (!j)
@@ -105,7 +159,7 @@ registerTool({
             return `✓ ${j.id} ${action}d`;
         }
         if (action === "run") {
-            const r = await runJobOnce(j);
+            const r = await runJobTracked(j, { signal: ctx.signal });
             return r.ok ? `✓ ran ${j.id} — ok\n${(r.output ?? "").trim().slice(-800)}` : `✗ ${j.id} failed: ${r.error}\n${(r.output ?? "").trim().slice(-800)}`;
         }
         return `Error: unknown action "${action}".`;

package/dist/tools/edit.js

@@ -1,6 +1,6 @@
 import { isAbsolute, resolve } from "node:path";
 import { registerTool } from "./registry.js";
-import { nearestPaths } from "../fs-walk.js";
+import { nearestPathsAsync } from "../fs-walk.js";
 import { emitDiff } from "../diff.js";
 import { applyEdits } from "./apply-core.js";
 import { recordEdit } from "../undo.js";
@@ -55,7 +55,7 @@ registerTool({
             snapshot = await readVerifiedRegularFileSnapshot(boundary.target, undefined, "edit");
         }
         catch (error) {
-            const near = nearestPaths(ctx.cwd, input.path);
+            const near = await nearestPathsAsync(ctx.cwd, input.path, 3, { timeoutMs: 1_000, signal: ctx.signal });
             return `Error: cannot read ${input.path}: ${error?.message ?? "unknown error"} (use write_file to create a new file).` + (near.length ? ` Did you mean: ${near.join(", ")}?` : "");
         }
         const text = snapshot.text;
@@ -68,6 +68,7 @@ registerTool({
                 expected: text,
                 expectedIdentity: snapshot,
                 boundary,
+                signal: ctx.signal,
             });
         }
         catch (error) {

package/dist/tools/external_agent.js

@@ -6,7 +6,7 @@
 // Safety: kind:"exec" → inherits the loop's approval gate. It can read/write/run on the host, so it is the most
 // privileged tool — and because fan-out sub-agents only get the read-only allow-list (READONLY_TOOLS), they
 // never see this tool. Trust tiers (off|gated|full) gate the dangerous bypass/full-access sub-modes.
-import { spawn, execFileSync } from "node:child_process";
+import { spawn } from "node:child_process";
 import { platform } from "node:os";
 import { registerTool } from "./registry.js";
 import { capHeadTail } from "./builtin.js";
@@ -42,17 +42,58 @@ export function appendBoundedExternalOutput(current, chunk, limit = EXTERNAL_CAP
 }
 /** Probe a CLI's availability via `<bin> --version` (cached per process). */
 const availCache = new Map();
-function available(bin) {
+async function available(bin, signal) {
     if (availCache.has(bin))
         return availCache.get(bin);
-    let ok = false;
-    try {
-        execFileSync(bin, ["--version"], { stdio: "ignore", timeout: 5000, env: toolSubprocessEnv() });
-        ok = true;
-    }
-    catch {
-        ok = false;
-    }
+    if (signal?.aborted)
+        throw new Error("external agent interrupted before availability probe");
+    const ok = await new Promise((resolve, reject) => {
+        const processGroup = platform() !== "win32";
+        let child;
+        try {
+            child = spawn(bin, ["--version"], {
+                stdio: "ignore",
+                env: toolSubprocessEnv(),
+                detached: processGroup,
+            });
+        }
+        catch {
+            resolve(false);
+            return;
+        }
+        let done = false;
+        let aborted = false;
+        let stopping = false;
+        let fallback;
+        const settle = (value) => {
+            if (done)
+                return;
+            done = true;
+            clearTimeout(timer);
+            if (fallback)
+                clearTimeout(fallback);
+            signal?.removeEventListener("abort", abortProbe);
+            if (aborted)
+                reject(new Error("external agent interrupted during availability probe"));
+            else
+                resolve(value);
+        };
+        const stop = (fromAbort) => {
+            if (done || stopping)
+                return;
+            stopping = true;
+            aborted = fromAbort;
+            terminateSubprocessTree(child, { force: true, processGroup });
+            fallback = setTimeout(() => settle(false), 750);
+        };
+        const abortProbe = () => stop(true);
+        const timer = setTimeout(() => stop(false), 5_000);
+        signal?.addEventListener("abort", abortProbe, { once: true });
+        if (signal?.aborted)
+            abortProbe();
+        child.once("error", () => settle(false));
+        child.once("close", (code) => settle(code === 0));
+    });
     availCache.set(bin, ok);
     return ok;
 }
@@ -68,6 +109,7 @@ registerTool({
         "another agent to own end-to-end. It can read/write/run on the host, so it's gated by approval. " +
         "Args: task (required), backend (claude|codex; default = first installed), model (optional).",
     kind: "exec", // → approval gate; never exposed to read-only fan-out sub-agents
+    requiresProjectWorkspace: true,
     trustBoundary: "external",
     input_schema: {
         type: "object",
@@ -80,6 +122,8 @@ registerTool({
         required: ["task"],
     },
     async run(input, ctx) {
+        if (ctx.signal?.aborted)
+            return "[external agent] interrupted before start by agent run deadline or cancellation";
         if (!ctx.ask && process.env.HARA_ALLOW_TRUSTED_EXTENSIONS !== "1") {
             return ("Blocked: external_agent runs another host coding agent outside Hara's protected-file boundary. " +
                 "Use it interactively after approval, or restart with HARA_ALLOW_TRUSTED_EXTENSIONS=1 only after reviewing that agent.");
@@ -90,12 +134,17 @@ registerTool({
         const task = typeof input.task === "string" ? input.task.trim() : "";
         if (!task)
             return "external_agent needs a non-empty `task`.";
-        const installed = BUILTIN_BACKENDS.filter((b) => available(b));
+        const availability = await Promise.all(BUILTIN_BACKENDS.map((candidate) => available(candidate, ctx.signal)));
+        if (ctx.signal?.aborted)
+            return "[external agent] interrupted before start by agent run deadline or cancellation";
+        const installed = BUILTIN_BACKENDS.filter((_candidate, index) => availability[index]);
         const backend = String(input.backend ?? "").trim() || installed[0] || "";
         if (!BUILTIN_BACKENDS.includes(backend))
             return `Unknown backend '${backend || "(none)"}'. Supported: ${BUILTIN_BACKENDS.join(", ")}.`;
-        if (!available(backend))
+        if (!(await available(backend, ctx.signal)))
             return `'${backend}' CLI not found on PATH. Installed external agents: ${installed.join(", ") || "none"}.`;
+        if (ctx.signal?.aborted)
+            return "[external agent] interrupted before start by agent run deadline or cancellation";
         const built = buildExternalArgv(backend, task, { cwd: ctx.cwd, model: input.model ? String(input.model) : undefined, sandbox: ctx.sandbox ?? "off", trust });
         if (!built)
             return `Unknown backend '${backend}'.`;
@@ -129,6 +178,7 @@ registerTool({
                     return;
                 done = true;
                 clearTimeout(timer);
+                ctx.signal?.removeEventListener("abort", abortRun);
                 // A stopped tree must still receive its scheduled group KILL even if the direct shell closed first.
                 // The default cancellation removes only the wall-clock fallback, not the force timer.
                 cancelTermination?.();
@@ -164,6 +214,10 @@ registerTool({
             const timer = setTimeout(() => {
                 stopTree(`[${backend}] timed out after ${timeout}ms`);
             }, timeout);
+            const abortRun = () => stopTree(`[${backend}] interrupted by agent run deadline or cancellation`);
+            ctx.signal?.addEventListener("abort", abortRun, { once: true });
+            if (ctx.signal?.aborted)
+                abortRun();
             child.stdin?.on("error", () => { });
             child.stdin?.end(); // task is passed via argv
             child.stdout?.on("data", (d) => {

package/dist/tools/memory.js

@@ -3,7 +3,7 @@
 import { existsSync } from "node:fs";
 import { isAbsolute, resolve, join, relative, sep } from "node:path";
 import { registerTool } from "./registry.js";
-import { searchAssets, assetSearchRoots } from "../recall.js";
+import { searchAssetsAsync, assetSearchRoots } from "../recall.js";
 import { searchHybrid } from "../search/hybrid.js";
 import { memoryRoots, appendMemory, replaceMemory, forgetMemory } from "../memory/store.js";
 import { scanMemory, redactSecrets, scrubLocal } from "../memory/guard.js";
@@ -24,7 +24,7 @@ registerTool({
     },
     kind: "read",
     async run(input, ctx) {
-        const hits = await searchHybrid(String(input.query ?? ""), ctx.cwd, { indexName: "memory", roots: memoryRoots(ctx.cwd), limit: Math.min(Number(input.limit) || 5, 10) });
+        const hits = await searchHybrid(String(input.query ?? ""), ctx.cwd, { indexName: "memory", roots: memoryRoots(ctx.cwd), limit: Math.min(Number(input.limit) || 5, 10), signal: ctx.signal });
         if (!hits.length)
             return "(no memory matches)";
         return hits.map((h) => `${h.path} — ${h.title}\n${h.snippet}`).join("\n\n");
@@ -80,8 +80,8 @@ registerTool({
         const scope = asScope(input.scope);
         const target = asTarget(input.target);
         const f = input.mode === "replace"
-            ? await replaceMemory(scope, target, content, ctx.cwd)
-            : await appendMemory(scope, target, content, ctx.cwd);
+            ? await replaceMemory(scope, target, content, ctx.cwd, ctx.signal)
+            : await appendMemory(scope, target, content, ctx.cwd, ctx.signal);
         return `Saved to ${f}`;
     },
 });
@@ -126,13 +126,30 @@ registerTool({
         const scope = input.scope === "project" ? "project" : "personal";
         const dir = join(scope === "project" ? skillsDir(ctx.cwd) : globalSkillsDir(), slug);
         const f = join(dir, "SKILL.md");
-        // dedup: surface a near-duplicate so the agent updates instead of piling up (lexical signal, not a block)
-        const dups = searchAssets(`${slug} ${description}`, 3, assetSearchRoots(ctx.cwd)).filter((h) => h.path !== f && h.score >= 2);
         const skillText = `---\nname: ${slug}\ndescription: ${description}\n---\n\n${body.trim()}\n`;
         let boundary;
         let snapshot = null;
+        // Bind the destination before the first await. A project skills symlink can otherwise be retargeted
+        // while the asynchronous duplicate scan yields, changing where this write lands.
         try {
             boundary = bindAtomicWritePath(f, "create skill");
+        }
+        catch (error) {
+            return `Error: cannot save skill ${slug}: ${error?.message ?? String(error)} No changes written.`;
+        }
+        let dups = [];
+        try {
+            // dedup: surface a near-duplicate so the agent updates instead of piling up (lexical signal, not a block)
+            dups = (await searchAssetsAsync(`${slug} ${description}`, 3, assetSearchRoots(ctx.cwd), { signal: ctx.signal }))
+                .filter((h) => h.path !== f && h.score >= 2);
+        }
+        catch (error) {
+            if (ctx.signal?.aborted) {
+                return `Error: cannot save skill ${slug}: cancelled before commit. No changes written.`;
+            }
+            // Duplicate detection is advisory; an unreadable optional asset root must not prevent a safe write.
+        }
+        try {
             try {
                 snapshot = await readVerifiedRegularFileSnapshot(boundary.target, undefined, "create skill");
             }
@@ -144,6 +161,7 @@ registerTool({
                 expected: snapshot?.text ?? null,
                 expectedIdentity: snapshot ?? undefined,
                 boundary,
+                signal: ctx.signal,
             });
         }
         catch (error) {
@@ -171,7 +189,7 @@ registerTool({
     },
     kind: "edit",
     async run(input, ctx) {
-        const n = await forgetMemory(asScope(input.scope), asTarget(input.target), String(input.match ?? ""), ctx.cwd);
+        const n = await forgetMemory(asScope(input.scope), asTarget(input.target), String(input.match ?? ""), ctx.cwd, ctx.signal);
         return n ? `Removed ${n} line(s).` : "(no matching lines)";
     },
 });

package/dist/tools/patch.js

@@ -86,7 +86,7 @@ async function rollbackWrittenPlan(plan) {
     }
     discardClaimedPath(quarantine, plan.committed);
 }
-async function quarantineExpectedDelete(plan) {
+async function quarantineExpectedDelete(plan, signal) {
     if (!plan.beforeIdentity || !plan.beforePathIdentity || plan.beforeMode === undefined)
         throw new Error(`missing preflight identity for ${plan.path}`);
     if (!plan.writeBoundary)
@@ -96,6 +96,8 @@ async function quarantineExpectedDelete(plan) {
     // phases. Recording it immediately also lets the outer rollback recover (or accurately report) a failure
     // that happens after rename but before verification completes.
     const staging = join(dirname(plan.abs), `.hara-stage-delete-${process.pid}-${randomUUID()}.tmp`);
+    if (signal?.aborted)
+        throw new Error("apply_patch delete cancelled before commit");
     verifyAtomicWriteBoundary(plan.writeBoundary);
     renameSync(plan.abs, staging);
     plan.quarantine = staging;
@@ -112,6 +114,8 @@ async function quarantineExpectedDelete(plan) {
         throw new FileChangedError(plan.path);
     }
     const quarantine = join(dirname(plan.abs), `.hara-delete-${process.pid}-${randomUUID()}.tmp`);
+    if (signal?.aborted)
+        throw new Error("apply_patch delete cancelled during verification");
     verifyAtomicWriteBoundary(plan.writeBoundary);
     renameSync(staging, quarantine);
     plan.quarantine = quarantine;
@@ -304,19 +308,24 @@ registerTool({
         const applied = [];
         try {
             for (const pl of plans) {
+                if (ctx.signal?.aborted)
+                    throw new Error("apply_patch cancelled before commit");
                 if (pl.type === "delete") {
                     // Atomic move-then-inspect: a replacement inode is moved aside and restored, never unlinked.
                     // The expected inode remains quarantined until every other patch step has committed.
-                    await quarantineExpectedDelete(pl);
+                    await quarantineExpectedDelete(pl, ctx.signal);
                 }
                 else {
                     pl.committed = await atomicWriteText(pl.abs, pl.after, {
                         expected: pl.existed ? pl.before : null,
                         expectedIdentity: pl.existed ? pl.beforeIdentity : undefined,
                         boundary: pl.writeBoundary,
+                        signal: ctx.signal,
                     });
                 }
                 applied.push(pl);
+                if (ctx.signal?.aborted)
+                    throw new Error("apply_patch cancelled during commit; rolling back");
             }
         }
         catch (e) {

package/dist/tools/registry.js

@@ -1,4 +1,5 @@
 import { limitToolResult } from "./result-limit.js";
+import { homeWorkspaceActionError, isHomeWorkspace } from "../context/workspace-scope.js";
 /** Names of required parameters that are ABSENT (undefined/null) in a tool call's input. Defends
  *  against models that drop parameters outright (observed: qwen3.7-plus losing write_file's
  *  path/content mid-stream) — the loop rejects the call with a precise error instead of executing
@@ -17,7 +18,21 @@ export function registerTool(t) {
         ...t,
         // Apply the context boundary at registration so every caller (main loop, tests, embedders) gets
         // identical behavior instead of relying on one orchestration path to remember the cap.
-        run: async (input, ctx) => limitToolResult(await run(input, ctx)),
+        run: async (input, ctx) => {
+            // A tool reference can be retained by a non-cooperative wrapper and invoked after runAgent has already
+            // returned its deadline outcome. Gate at the registered call boundary (not just in the agent loop) so
+            // delayed getTool(...).run(...) calls never start fresh work after cancellation.
+            if (ctx.signal?.aborted) {
+                return `Error: ${t.name} cancelled before execution because the agent run has ended.`;
+            }
+            // Only explicitly project-scoped executable tools are blocked. `kind:"exec"` is also used for safe
+            // management/delivery side effects, so it must not itself imply a project workspace requirement.
+            // Canonical comparison closes Home symlink aliases.
+            if (t.requiresProjectWorkspace && isHomeWorkspace(ctx.cwd)) {
+                return `Error: ${homeWorkspaceActionError(`run ${t.name}`)}`;
+            }
+            return limitToolResult(await run(input, ctx));
+        },
     });
     specsCache = null;
 }

package/dist/tools/search.js

@@ -4,15 +4,17 @@ import { lstatSync, readdirSync, statSync } from "node:fs";
 import { spawn } from "node:child_process";
 import { basename, dirname, isAbsolute, resolve, join, relative, sep } from "node:path";
 import { registerTool } from "./registry.js";
-import { IGNORE_DIRS, walkFiles } from "../fs-walk.js";
+import { IGNORE_DIRS, walkFilesAsync } from "../fs-walk.js";
 import { isSensitiveFilePath, sensitiveFileError, sensitiveFilesAllowed, SENSITIVE_SEARCH_GLOBS, } from "../security/sensitive-files.js";
 import { toolSubprocessEnv } from "../security/subprocess-env.js";
+import { recursiveRootContainsHome, recursiveHomeSearchError } from "../context/workspace-scope.js";
 const MAX_OUT = 60_000;
 const MAX_MATCHES = 300;
 const MAX_FILE_BYTES = 2 * 1024 * 1024;
 const GREP_TIMEOUT_MS = 5_000;
 const MAX_PATTERN_CHARS = 4_096;
 const MAX_GLOB_CHARS = 256;
+const GLOB_SCAN_BUDGET_MS = 1_000;
 const GLOB_MATCH_BUDGET_MS = 250;
 const toPosix = (p) => (sep === "/" ? p : p.split(sep).join("/"));
 const absOf = (p, cwd) => (p ? (isAbsolute(p) ? p : resolve(cwd, p)) : cwd);
@@ -368,12 +370,32 @@ function normalizeGrepWorkerResult(parsed) {
         error: typeof parsed.error === "string" ? parsed.error : undefined,
     };
 }
-function runNodeGrep(pattern, root, isFile, cwd, glob, ignoreCase) {
+async function runNodeGrep(pattern, root, isFile, cwd, glob, ignoreCase, signal) {
     const allowSensitive = sensitiveFilesAllowed();
-    const discovered = isFile ? [root] : walkFiles(root, 8_001).map((path) => join(root, path));
-    const candidatesTruncated = !isFile && discovered.length > 8_000;
+    if (signal?.aborted)
+        throw signal.reason instanceof Error ? signal.reason : new Error("grep cancelled");
+    const inventory = isFile
+        ? undefined
+        : await walkFilesAsync(root, {
+            maxFiles: 8_001,
+            maxDirectories: 20_000,
+            maxEntries: 100_000,
+            timeoutMs: GREP_TIMEOUT_MS,
+            signal,
+            yieldEvery: 64,
+        });
+    const discovered = isFile ? [root] : inventory.files.map((path) => join(root, path));
+    const candidatesTruncated = !isFile && (inventory.truncated || discovered.length > 8_000);
     const files = [];
+    let candidateIndex = 0;
     for (const path of discovered.slice(0, 8_000)) {
+        if (signal?.aborted)
+            throw signal.reason instanceof Error ? signal.reason : new Error("grep cancelled");
+        if (candidateIndex++ > 0 && candidateIndex % 64 === 0) {
+            await new Promise((resolveTurn) => setImmediate(resolveTurn));
+            if (signal?.aborted)
+                throw signal.reason instanceof Error ? signal.reason : new Error("grep cancelled");
+        }
         // Broad searches intentionally omit every .env variant, including safe templates. Explicitly searching
         // one safe template remains supported, matching the ripgrep branch.
         const securityBase = basename(path).replace(/:.*$/u, "").replace(/[. ]+$/u, "").toLowerCase();
@@ -410,7 +432,7 @@ function runNodeGrep(pattern, root, isFile, cwd, glob, ignoreCase) {
     if (Buffer.byteLength(payload, "utf8") > 16 * 1024 * 1024) {
         return Promise.resolve({ kind: "error", lines: [], matches: 0, scanned: 0, truncated: false, error: "grep input exceeds its safety limit" });
     }
-    return new Promise((resolveResult) => {
+    return new Promise((resolveResult, rejectResult) => {
         const isBun = typeof process.versions.bun === "string";
         const args = isBun ? ["-e", NODE_GREP_SOURCE] : ["--max-old-space-size=128", "-e", NODE_GREP_SOURCE];
         // In a Bun --compile build process.execPath is the hara executable. BUN_BE_BUN makes that embedded
@@ -422,14 +444,27 @@ function runNodeGrep(pattern, root, isFile, cwd, glob, ignoreCase) {
         let settled = false;
         let timedOut = false;
         let timer;
+        const onAbort = () => {
+            child.kill("SIGKILL");
+            if (settled)
+                return;
+            settled = true;
+            if (timer)
+                clearTimeout(timer);
+            rejectResult(signal?.reason instanceof Error ? signal.reason : new Error("grep cancelled"));
+        };
         const finish = (result) => {
             if (settled)
                 return;
             settled = true;
             if (timer)
                 clearTimeout(timer);
+            signal?.removeEventListener("abort", onAbort);
             resolveResult(result);
         };
+        signal?.addEventListener("abort", onAbort, { once: true });
+        if (signal?.aborted)
+            return onAbort();
         child.stdout.setEncoding("utf8");
         child.stdout.on("data", (chunk) => {
             stdout += chunk;
@@ -503,6 +538,8 @@ registerTool({
         catch {
             return `Error: no such path: ${input.path ?? "."}`;
         }
+        if (!isFile && recursiveRootContainsHome(root))
+            return recursiveHomeSearchError("grep");
         const searchArgs = [
             pattern,
             root,
@@ -517,7 +554,7 @@ registerTool({
         // opt back into only with the explicit one-process sensitive-file waiver.
         const primary = sensitiveFilesAllowed()
             ? await runRipgrep(...searchArgs)
-            : await runNodeGrep(...searchArgs);
+            : await runNodeGrep(...searchArgs, ctx.signal);
         if (primary.kind === "timeout")
             return `Error: grep exceeded its ${GREP_TIMEOUT_MS}ms safety timeout and was stopped.`;
         if (primary.kind === "invalid")
@@ -525,7 +562,7 @@ registerTool({
         let { lines, matches, scanned } = primary;
         let truncated = primary.truncated;
         if (sensitiveFilesAllowed() && (primary.kind === "missing" || primary.kind === "error")) {
-            const fallback = await runNodeGrep(pattern, root, isFile, ctx.cwd, typeof input.glob === "string" ? input.glob : undefined, input.ignore_case === true);
+            const fallback = await runNodeGrep(pattern, root, isFile, ctx.cwd, typeof input.glob === "string" ? input.glob : undefined, input.ignore_case === true, ctx.signal);
             if (fallback.kind === "timeout")
                 return `Error: grep exceeded its ${GREP_TIMEOUT_MS}ms safety timeout and was stopped.`;
             if (fallback.kind === "invalid")
@@ -568,15 +605,30 @@ registerTool({
         const denied = sensitiveFileError(root, "search");
         if (denied)
             return denied;
+        if (recursiveRootContainsHome(root))
+            return recursiveHomeSearchError("glob");
         const pattern = typeof input.pattern === "string" ? input.pattern : "";
         if (pattern.length > MAX_GLOB_CHARS)
             return `Error: glob pattern exceeds ${MAX_GLOB_CHARS} characters.`;
-        const files = walkFiles(root);
+        const inventory = await walkFilesAsync(root, {
+            maxFiles: 8_000,
+            maxDirectories: 20_000,
+            maxEntries: 100_000,
+            timeoutMs: GLOB_SCAN_BUDGET_MS,
+            signal: ctx.signal,
+            yieldEvery: 64,
+        });
+        const files = inventory.files;
         const hits = [];
         const started = Date.now();
         let examined = 0;
         let budgetReached = false;
         for (const file of files) {
+            if ((examined & 31) === 0) {
+                await new Promise((resolveTurn) => setImmediate(resolveTurn));
+                if (ctx.signal?.aborted)
+                    throw ctx.signal.reason instanceof Error ? ctx.signal.reason : new Error("glob cancelled");
+            }
             if ((examined & 31) === 0 && Date.now() - started >= GLOB_MATCH_BUDGET_MS) {
                 budgetReached = true;
                 break;
@@ -585,7 +637,12 @@ registerTool({
             if (matchesGlob(pattern, file))
                 hits.push(file);
         }
+        const scanNote = inventory.truncated
+            ? `scan stopped at its ${inventory.reason?.replace("_", " ") ?? "safety limit"}`
+            : "";
         if (!hits.length) {
+            if (scanNote)
+                return `No files matched ${pattern}; ${scanNote}. Narrow \`path\` and retry.`;
             return budgetReached
                 ? `No files matched ${pattern} before the ${GLOB_MATCH_BUDGET_MS}ms safety budget; narrow \`path\` or simplify the glob.`
                 : `No files match ${pattern}.`;
@@ -593,7 +650,9 @@ registerTool({
         const shown = hits.slice(0, 400);
         const head = budgetReached
             ? `(showing ${shown.length} matches found before the ${GLOB_MATCH_BUDGET_MS}ms safety budget; examined ${examined}/${files.length} files)\n`
-            : hits.length > shown.length ? `(${hits.length} matches, showing 400)\n` : "";
+            : scanNote
+                ? `(showing ${shown.length} matches; ${scanNote})\n`
+                : hits.length > shown.length ? `(${hits.length} matches, showing 400)\n` : "";
         return head + shown.join("\n");
     },
 });

package/dist/tools/send.js

@@ -27,7 +27,7 @@ if (process.env.HARA_GATEWAY) {
                 return "send_file only works inside `hara gateway` — there is no chat to send to here.";
             const p = resolve(ctx.cwd, String(input.path ?? ""));
             try {
-                await queueOutboundSnapshot(p, outbox);
+                await queueOutboundSnapshot(p, outbox, ctx.signal);
                 return `Queued a private snapshot for delivery to the user in this chat: ${p}`;
             }
             catch (error) {