@nanhara/hara 0.122.5 → 0.122.7

package/CHANGELOG.md

@@ -5,6 +5,39 @@ All notable changes to `@nanhara/hara`.
 > Versioning (pre-1.0, SemVer-style): the **minor** (middle) number bumps for a **new feature**; the
 > **patch** (last) number bumps for **optimizations/fixes of existing features**.
 
+## 0.122.7 — 2026-07-15 — isolated build-context parity
+
+- **Docker builds carry every package-build dependency.** The image build stage now copies the local-link
+  diagnostic script before `npm run build`, fixing the `MODULE_NOT_FOUND` failure that blocked the 0.122.6
+  Docker CI and GHCR multi-architecture image while npm and native standalone lanes succeeded.
+- **The gate follows the build graph instead of one remembered filename.** Runtime packaging tests parse every
+  `node scripts/...` dependency from the package build command and require a matching Dockerfile `COPY`, so a
+  future build helper cannot pass host-only gates while disappearing from an isolated container context.
+- `v0.122.6` remains immutable and is treated as a partial release; 0.122.7 supersedes it after npm, native
+  binaries, GitHub Release, and both GHCR architectures are independently verified.
+
+## 0.122.6 — 2026-07-15 — resumed continuity and workspace/input hardening
+
+- **Resume continues the persisted task instead of rediscovering the workspace.** CLI `--resume`/`-c`,
+  headless gateway/cron continuations, Desktop `session.resume`, and session forks tell the model that the
+  existing history is already authoritative context. A process restart is no longer a reason to restart the
+  task, inventory files, or answer with an unrelated workspace summary.
+- **Home cannot be promoted into a project one child directory at a time.** When Hara is rooted at the user's
+  Home, runtime guards now reject `ls`, directory `grep`, `glob`, `codebase_search`, `@directory` expansion,
+  fuzzy `@` inventory, and coding mutations even when the model supplies a named child path. Explicit
+  single-file reads remain available; launching Hara from that concrete child project restores normal project
+  search, completion, and coding behavior.
+- **The regression exercises a disobedient model, not only the prompt.** An end-to-end resumed session uses a
+  temporary Home containing a sentinel project, forces the provider to call `ls`, and verifies the tool result
+  is a bounded refusal while the persisted history and latest request reach the model without any Home entry
+  or file name.
+- **Composer tabs no longer move the cursor away from the text.** Literal tabs render and wrap as one-column
+  spaces while the editable and submitted prompt preserves the original tab characters.
+- **Source builds diagnose stale pre-bootstrap npm links.** If an old `npm link` still points `hara` at the
+  now-internal non-executable `dist/index.js`, builds and `npm run doctor:local-link` print the owning Node bin
+  directory and the exact relink/`rehash` repair instead of suggesting an unsafe `chmod` workaround. Clean npm
+  installs and standalone binaries are unaffected.
+
 ## 0.122.5 — 2026-07-15 — standalone ambient-config security boundary
 
 - **Standalone binaries no longer trust the directory they are launched from.** Bun's runtime `.env` and

package/README.md

@@ -59,6 +59,12 @@ npm install        # builds via the prepare script
 npm install -g .   # or: npm link
 ```
 
+If a source checkout linked before 0.122.1 later reports `zsh: permission denied: hara`, the old npm
+link is still targeting the now-internal `dist/index.js`. Activate the same Node installation that owns
+the link, run `npm link` again from this directory, then run `rehash`. `npm run build` and
+`npm run doctor:local-link` detect this stale link and print its exact owning bin directory. Do not repair
+it with `chmod`; the guarded executable entry is `runtime-bootstrap.cjs`.
+
 ## Quickstart
 
 ```bash
@@ -177,8 +183,9 @@ hara -m glm-5              # pick a model
 
 Run Hara from a project directory. When the current directory resolves to your Home root, Hara does not treat
 the whole Home tree as a repository: project init/index and default recursive grep/glob/codebase inventory are
-disabled with a `cd /path/to/project` hint. Non-recursive `ls`, explicitly named files, and explicitly selected
-child directories still work.
+disabled with a `cd /path/to/project` hint. Directory listing and child-directory recursion are also refused so
+the model cannot promote a discovered Home folder into an implicit project; explicitly named single files still
+work. Resuming a session reuses its persisted conversation and must not trigger workspace rediscovery.
 
 For automation, `--schema` accepts inline JSON Schema or a schema file. The model must return through the
 validated `structured_output` tool; on success stdout contains only the JSON value, while diagnostics go to
@@ -314,6 +321,7 @@ turn, or **`/undo`** to revert the last edit. In-session **`/diff`**, **`/review
 - **Type-ahead steering**: keep typing while hara works — your message is held, then **folded into the next model call** (not deferred to a new turn), so a clarification or "also do X" course-corrects the task already in flight (codex-style). Messages typed after the final step start a fresh turn; **Esc** drops the queue and stops.
 - **Project context**: auto-loads `AGENTS.md` (the cross-tool standard) walking up to the repo root; `hara init` writes one by analyzing the repo.
 - **`@file` mentions**: attach file contents to a message (`@path`); Tab-completes with a **fuzzy** matcher over the project (subdirs, git-tracked + untracked) — `@idx` → `src/index.ts`. `@<dir>` loads a directory listing, `@src/`+Tab drills into a folder, and mistyped tool/file paths get a "did you mean" suggestion.
+- **Explicit workspace boundary**: launching at Home does not inventory its directories or permit coding mutations. Start Hara from a concrete project to enable search, `@` completion, shell/external agents, and file edits; explicitly named single-file reads remain available at Home.
 - **Multi-provider**: Anthropic (Claude) or any OpenAI-compatible endpoint (Qwen/DashScope, GLM, Kimi, OpenAI) — **all streamed live**.
 - **Chat gateway**: drive your local hara from **Telegram · WeChat · Discord · Feishu/Lark · Slack · Mattermost · Matrix · DingTalk · WeCom · Signal**. The daemon connects out (no public webhook), with per-chat sessions, project roaming (`/cd`), agent switching (`/agent`), and **two-way images on byte-upload-capable platforms**. Setup, platform capability details, and the group-flow security model: **[docs/gateway.md](docs/gateway.md)**.
 

package/dist/agent/loop.js

@@ -127,11 +127,17 @@ function gatewayNote() {
         `PLAIN TEXT ONLY: chat bubbles render markdown literally — never use **bold**, # headers, backticks, tables, ` +
         `or [text](url); write list items as "- " lines and links as bare URLs.`);
 }
-function composeSystem(cwd, projectContext, override, memory) {
+const CONTINUATION_SYSTEM = "# Existing-session continuity\n" +
+    "This turn continues a persisted conversation. Its history is already the authoritative context: do not restart the task, " +
+    "re-inventory the workspace, or summarize files merely to understand what happened before. Follow the latest user request " +
+    "and reuse prior conclusions and tool results. Inspect files only when the latest request requires it. If the working " +
+    "directory is Home, ask the user to start Hara from a concrete project instead of enumerating Home or its children.";
+function composeSystem(cwd, projectContext, override, memory, continuationSession = false) {
     const head = override ? `${override}\n\nWorking directory: ${cwd}` : HARA_SYSTEM(cwd);
     const skills = skillsDigest(cwd);
     return (head +
         gatewayNote() +
+        (continuationSession ? `\n\n${CONTINUATION_SYSTEM}` : "") +
         (projectContext ? `\n\n# Project context (AGENTS.md)\n${projectContext}` : "") +
         (memory ? `\n\n# Memory (durable — facts/decisions/prefs you've saved; use memory_search/get for more)\n${memory}` : "") +
         (skills ? `\n\n# Skills (capabilities you can load — call the \`skill\` tool with the id for full instructions before using one)\n${skills}` : ""));
@@ -421,7 +427,7 @@ async function runAgentInner(history, opts, life) {
                     return { text: "", toolUses: [], stop: "error", errorMsg: "interrupted" };
                 }
                 return activeProvider.turn({
-                    system: composeSystem(ctx.cwd, opts.projectContext, opts.systemOverride, opts.memory),
+                    system: composeSystem(ctx.cwd, opts.projectContext, opts.systemOverride, opts.memory, opts.continuationSession),
                     history,
                     tools: specs,
                     // Any stream chunk keeps the connection considered alive — even suppressed reasoning_content, so a

package/dist/context/mentions.js

@@ -7,7 +7,7 @@ import { fuzzyRank } from "../fuzzy.js";
 import { mediaTypeFor } from "../images.js";
 import { readModelContextPrefixSync } from "../fs-read.js";
 import { sensitiveFileError } from "../security/sensitive-files.js";
-import { recursiveRootContainsHome, recursiveHomeSearchError } from "./workspace-scope.js";
+import { homeWorkspaceDirectoryScanError, isHomeWorkspace, recursiveRootContainsHome, recursiveHomeSearchError, } from "./workspace-scope.js";
 const MAX_FILE = 50_000;
 // @ at start-of-string or after whitespace; capture a path with no spaces/@ (avoids emails like a@b.com)
 const MENTION_RE = /(?:^|\s)@([^\s@]+)/g;
@@ -108,6 +108,8 @@ async function expandRefAsync(ref, cwd, options) {
             return `\nReferenced file \`${ref}\`:\n\`\`\`\n${txt}\n\`\`\`\n`;
         }
         if (st.isDirectory()) {
+            if (isHomeWorkspace(cwd))
+                return homeWorkspaceDirectoryScanError("directory attachment");
             if (recursiveRootContainsHome(abs))
                 return recursiveHomeSearchError("directory attachment");
             const inventory = await walkFilesAsync(abs, options);
@@ -148,6 +150,8 @@ function expandRef(ref, cwd) {
             return `\nReferenced file \`${ref}\`:\n\`\`\`\n${txt}\n\`\`\`\n`;
         }
         if (st.isDirectory()) {
+            if (isHomeWorkspace(cwd))
+                return homeWorkspaceDirectoryScanError("directory attachment");
             if (recursiveRootContainsHome(abs))
                 return recursiveHomeSearchError("directory attachment");
             // `@dir` loads a listing of the directory's files (the agent can then read specific ones)
@@ -188,6 +192,11 @@ export function invalidateFileCandidates(cwd) {
  * ranks path-prefix and basename matches first. Directories carry a trailing `/`.
  */
 export function fileCandidates(cwd, query, limit = 25) {
+    // Autocomplete is also directory discovery. Do not populate the cache or expose even top-level
+    // names when the user launched Hara at Home; the user establishes project scope by starting in a
+    // concrete child directory. Canonical comparison closes symlink aliases of Home.
+    if (isHomeWorkspace(cwd))
+        return [];
     const entries = projectEntries(cwd);
     if (!query) {
         // bare `@`: top-level entries, directories first

package/dist/context/workspace-scope.js

@@ -32,8 +32,13 @@ export function homeWorkspaceActionError(action) {
 }
 export function recursiveHomeSearchError(tool) {
     return (`Error: ${tool} will not recursively scan the home directory. ` +
-        "Run Hara from a project (`cd /path/to/project`) or set `path` to a specific file/subdirectory. " +
-        "Non-recursive `ls` and explicit file reads remain available.");
+        "Run Hara from a project (`cd /path/to/project`). Explicit single-file reads remain available.");
+}
+/** A model rooted at Home must not discover a child and silently promote it into the project scope. The
+ * user establishes that scope by launching Hara from the concrete project directory. */
+export function homeWorkspaceDirectoryScanError(tool) {
+    return (`Error: ${tool} will not enumerate or recursively scan directories while Hara is rooted at the home directory. ` +
+        "Run `cd /path/to/project` and start Hara there. Explicit single-file reads remain available.");
 }
 /** Injected into model context when Hara was intentionally launched at ~/. Runtime checks enforce the same
  *  policy, but guidance avoids wasting turns on calls that are guaranteed to be rejected. */
@@ -42,8 +47,7 @@ export function homeWorkspaceGuidance(cwd) {
         return "";
     return ("# Home-directory workspace boundary\n" +
         "The working directory resolves to the user's home directory, which is not an implicit project. " +
-        "Do not initialize a project, build a repository index, run shell/external executable tools, or recursively " +
-        "grep/glob/search the home root. " +
-        "Ask the user to run `cd /path/to/project` for project work. Non-recursive `ls`, explicitly named files, " +
-        "and explicitly named child directories remain available.");
+        "Do not initialize a project, create or modify files, build a repository index, run shell/external " +
+        "executable tools, enumerate directories, or grep/glob/search Home or one of its child directories. " +
+        "Ask the user to run `cd /path/to/project` for project work. Only explicitly named single-file reads remain available.");
 }

package/dist/index.js

@@ -2916,6 +2916,7 @@ program.action(async (opts) => {
             // saves it back — so `hara -p … --resume <id>` continues a thread (used by cron, scripts, the chat gateway).
             // Plain `hara -p` stays stateless. A --resume id with no match is created WITH that id (stable per caller).
             let meta = null;
+            let continuationSession = false;
             const history = [];
             if (opts.resume || opts.continue) {
                 const resumeArg = opts.resume ? String(opts.resume) : undefined;
@@ -2945,6 +2946,7 @@ program.action(async (opts) => {
                 // Re-read only after acquiring the single-writer lock. Loading first would leave a race window where
                 // another gateway/cron process appends history that this stale snapshot later overwrites.
                 const prior = loadSession(rid);
+                continuationSession = Boolean(prior?.history.length);
                 if (sessionFileExists(rid) && !prior) {
                     process.stderr.write(`hara: session ${shortId(rid)} exists but is unreadable or corrupt; refusing to overwrite it. Inspect ~/.hara/sessions/${rid}.json.\n`);
                     process.exitCode = 2;
@@ -3106,6 +3108,7 @@ program.action(async (opts) => {
                 confirm: async () => true,
                 projectContext,
                 memory: memoryDigest(cwd),
+                continuationSession,
                 ...(roleOverride ? { systemOverride: roleOverride } : {}),
                 ...(headlessToolFilter ? { toolFilter: headlessToolFilter } : {}),
                 hooks: headlessHooks,
@@ -3347,6 +3350,7 @@ program.action(async (opts) => {
         }
     }
     const history = resumed?.history ? [...resumed.history] : [];
+    let continuationSession = Boolean(resumed?.history.length);
     const memorySnap = memoryDigest(cwd); // durable memory, read once (frozen snapshot)
     const buildMemory = () => (meta.workingSet?.length ? `## Working memory (this task)\n${meta.workingSet.map((w) => `- ${w}`).join("\n")}\n\n` : "") + memorySnap;
     if (resumed)
@@ -3868,6 +3872,7 @@ program.action(async (opts) => {
                         return void h.sink.notice(getTools().map((t) => `${t.name}${t.kind !== "read" ? " *" : ""} — ${t.description}`).join("\n"));
                     if (nm === "reset" || nm === "clear") {
                         history.length = 0;
+                        continuationSession = false;
                         recalledContext = "";
                         resetReachability(); // fresh start — drop any "host unreachable" marks (network may be fixed)
                         resetRepeatGuard(); // …and the repeated-failure streaks (the user may have fixed the cause)
@@ -4105,7 +4110,7 @@ program.action(async (opts) => {
                             const __skApproval = h.approval === "plan" ? "suggest" : h.approval;
                             let skillOutcome;
                             try {
-                                skillOutcome = await runAgent(history, { provider, ctx: { cwd, sandbox, spawn, ui: { text: h.sink.assistantDelta, reasoning: h.sink.reasoningDelta, tool: h.sink.tool, diff: h.sink.diff, notice: h.sink.notice }, ask: h.ask, describeImage: describeScreenshot, locate: locateScreenshot }, approval: __skApproval, confirm: h.confirm, autoApprove, projectContext, memory: buildMemory(), stats, signal: h.signal, fallback: fbOpt, guardian: guardianOpt, ...agentRunLimits(cfg) });
+                                skillOutcome = await runAgent(history, { provider, ctx: { cwd, sandbox, spawn, ui: { text: h.sink.assistantDelta, reasoning: h.sink.reasoningDelta, tool: h.sink.tool, diff: h.sink.diff, notice: h.sink.notice }, ask: h.ask, describeImage: describeScreenshot, locate: locateScreenshot }, approval: __skApproval, confirm: h.confirm, autoApprove, projectContext, memory: buildMemory(), continuationSession, stats, signal: h.signal, fallback: fbOpt, guardian: guardianOpt, ...agentRunLimits(cfg) });
                             }
                             catch (e) {
                                 h.sink.notice(`[error] ${e?.message ?? e}`);
@@ -4181,6 +4186,7 @@ program.action(async (opts) => {
                         systemOverride: PLAN_SYSTEM,
                         memory: buildMemory(),
                         projectContext,
+                        continuationSession,
                         stats,
                         signal: h.signal,
                         pendingInput,
@@ -4226,6 +4232,7 @@ program.action(async (opts) => {
                             confirm: h.confirm,
                             autoApprove,
                             projectContext,
+                            continuationSession,
                             stats,
                             signal: h.signal,
                             pendingInput,
@@ -4260,6 +4267,7 @@ program.action(async (opts) => {
                     confirm: h.confirm,
                     autoApprove,
                     projectContext,
+                    continuationSession,
                     stats,
                     signal: h.signal,
                     pendingInput,
@@ -4331,7 +4339,7 @@ program.action(async (opts) => {
                     currentTurn = skillTurn;
                     let skillOutcome;
                     try {
-                        skillOutcome = await runAgent(history, { provider, ctx: { cwd, sandbox, spawn, ask: askUser }, approval, confirm, autoApprove, projectContext, memory: buildMemory(), stats, signal: skillTurn.signal, fallback: fbOpt, guardian: guardianOpt, ...agentRunLimits(cfg) });
+                        skillOutcome = await runAgent(history, { provider, ctx: { cwd, sandbox, spawn, ask: askUser }, approval, confirm, autoApprove, projectContext, memory: buildMemory(), continuationSession, stats, signal: skillTurn.signal, fallback: fbOpt, guardian: guardianOpt, ...agentRunLimits(cfg) });
                     }
                     catch (e) {
                         out(c.red(`\n[error] ${e.message}\n`));
@@ -4369,7 +4377,7 @@ program.action(async (opts) => {
         const t0 = Date.now();
         let turnOutcome;
         try {
-            turnOutcome = await runAgent(history, { provider, ctx: { cwd, sandbox, spawn, ask: askUser }, approval, confirm, autoApprove, projectContext, memory: buildMemory(), stats, signal: turnController.signal, fallback: fbOpt, guardian: guardianOpt, ...agentRunLimits(cfg) });
+            turnOutcome = await runAgent(history, { provider, ctx: { cwd, sandbox, spawn, ask: askUser }, approval, confirm, autoApprove, projectContext, memory: buildMemory(), continuationSession, stats, signal: turnController.signal, fallback: fbOpt, guardian: guardianOpt, ...agentRunLimits(cfg) });
         }
         catch (e) {
             out(c.red(`\n[error] ${e.message}\n`));

package/dist/serve/server.js

@@ -375,6 +375,7 @@ export async function startServe(opts, deps) {
                 autoApprove: s.autoApprove,
                 projectContext: s.projectContext,
                 memory: memoryDigest(s.meta.cwd),
+                continuationSession: s.continuationSession,
                 stats: s.stats,
                 signal: turnAbort.signal,
                 onProviderTurn: (turn) => {

package/dist/serve/sessions.js

@@ -47,7 +47,7 @@ export class SessionHub {
         const lock = this.store.acquire(meta.id); // fresh UUID, but filesystem errors must still fail closed
         if (!lock.ok)
             throw new Error(`could not acquire session lock for ${meta.id}${lock.pid ? ` (held by pid ${lock.pid})` : ""}`);
-        const s = { meta, history: [], provider: o.provider, approval: o.approval, autoApprove: new Set(), stats: { input: 0, output: 0 }, projectContext: o.projectContext, busy: false, configuring: false, pendingProviderTurns: 0, pendingToolRuns: 0, abort: null };
+        const s = { meta, history: [], provider: o.provider, approval: o.approval, autoApprove: new Set(), stats: { input: 0, output: 0 }, projectContext: o.projectContext, continuationSession: false, busy: false, configuring: false, pendingProviderTurns: 0, pendingToolRuns: 0, abort: null };
         try {
             this.sessions.set(meta.id, s);
             this.store.save(meta, []); // an empty newly-created thread must survive restart and appear in lists
@@ -76,7 +76,7 @@ export class SessionHub {
                 return { missing: true };
             // Credential/provider routing is live, while the model remains the session's explicit pin.
             prior.meta.provider = o.provider.id;
-            const s = { meta: prior.meta, history: [...prior.history], provider: o.provider, approval: o.approval, autoApprove: new Set(), stats: { input: 0, output: 0 }, projectContext: o.projectContext, busy: false, configuring: false, pendingProviderTurns: 0, pendingToolRuns: 0, abort: null, effort: prior.meta.effort };
+            const s = { meta: prior.meta, history: [...prior.history], provider: o.provider, approval: o.approval, autoApprove: new Set(), stats: { input: 0, output: 0 }, projectContext: o.projectContext, continuationSession: prior.history.length > 0, busy: false, configuring: false, pendingProviderTurns: 0, pendingToolRuns: 0, abort: null, effort: prior.meta.effort };
             this.sessions.set(id, s);
             keepLock = true; // live session owns it until delete/releaseAll
             return { session: s };
@@ -177,6 +177,7 @@ export class SessionHub {
             autoApprove: new Set(),
             stats: { input: 0, output: 0 },
             projectContext: o.projectContext,
+            continuationSession: src.history.length > 0,
             busy: false,
             configuring: false,
             pendingProviderTurns: 0,

package/dist/tools/builtin.js

@@ -157,6 +157,7 @@ registerTool({
         required: ["path", "content"],
     },
     kind: "edit",
+    requiresProjectWorkspace: true,
     async run(input, ctx) {
         const p = abs(input.path, ctx.cwd);
         const denied = sensitiveFileError(p, "write");

package/dist/tools/codebase.js

@@ -10,7 +10,7 @@ import { findProjectRoot } from "../context/agents-md.js";
 import { loadConfig } from "../config.js";
 import { getEmbedder } from "../search/embed.js";
 import { queryIndex, indexExists } from "../search/semindex.js";
-import { recursiveRootContainsHome, recursiveHomeSearchError } from "../context/workspace-scope.js";
+import { homeWorkspaceDirectoryScanError, isHomeWorkspace, recursiveRootContainsHome, recursiveHomeSearchError, } from "../context/workspace-scope.js";
 import { readVerifiedRegularFileSnapshotSync } from "../fs-read.js";
 const MAX_FILE = 200_000; // skip very large files
 const INVENTORY_TIMEOUT_MS = 2_000;
@@ -21,7 +21,7 @@ registerTool({
     description: "Find code in THIS project relevant to a natural-language query — ranked by relevance (not exact match). " +
         "Use it to locate similar/related code while working ('where is auth handled?', 'retry logic'); use grep " +
         "for exact strings/regex. Returns the top files with their most relevant snippet (file:line). When Hara " +
-        "was started in the home directory, set path to a specific project subdirectory.",
+        "was started in the home directory, cd to a specific project before searching.",
     input_schema: {
         type: "object",
         properties: {
@@ -43,6 +43,8 @@ registerTool({
         const requestedRoot = typeof input.path === "string" && input.path.trim()
             ? (isAbsolute(input.path) ? input.path : resolve(ctx.cwd, input.path))
             : ctx.cwd;
+        if (isHomeWorkspace(ctx.cwd))
+            return homeWorkspaceDirectoryScanError("codebase_search");
         try {
             if (!statSync(requestedRoot).isDirectory())
                 return `Error: codebase_search path is not a directory: ${input.path ?? "."}`;

package/dist/tools/edit.js

@@ -40,6 +40,7 @@ registerTool({
         required: ["path"],
     },
     kind: "edit",
+    requiresProjectWorkspace: true,
     async run(input, ctx) {
         const p = isAbsolute(input.path) ? input.path : resolve(ctx.cwd, input.path);
         const denied = sensitiveFileError(p, "edit");

package/dist/tools/patch.js

@@ -201,6 +201,7 @@ registerTool({
         required: ["changes"],
     },
     kind: "edit",
+    requiresProjectWorkspace: true,
     async run(input, ctx) {
         const changes = Array.isArray(input.changes) ? input.changes : [];
         if (!changes.length)

package/dist/tools/registry.js

@@ -25,8 +25,8 @@ export function registerTool(t) {
             if (ctx.signal?.aborted) {
                 return `Error: ${t.name} cancelled before execution because the agent run has ended.`;
             }
-            // Only explicitly project-scoped executable tools are blocked. `kind:"exec"` is also used for safe
-            // management/delivery side effects, so it must not itself imply a project workspace requirement.
+            // Only explicitly project-scoped operations are blocked. Tool kinds are also used for safe
+            // management/delivery side effects, so a kind must not itself imply a project workspace requirement.
             // Canonical comparison closes Home symlink aliases.
             if (t.requiresProjectWorkspace && isHomeWorkspace(ctx.cwd)) {
                 return `Error: ${homeWorkspaceActionError(`run ${t.name}`)}`;

package/dist/tools/search.js

@@ -7,7 +7,7 @@ import { registerTool } from "./registry.js";
 import { IGNORE_DIRS, walkFilesAsync } from "../fs-walk.js";
 import { isSensitiveFilePath, sensitiveFileError, sensitiveFilesAllowed, SENSITIVE_SEARCH_GLOBS, } from "../security/sensitive-files.js";
 import { toolSubprocessEnv } from "../security/subprocess-env.js";
-import { recursiveRootContainsHome, recursiveHomeSearchError } from "../context/workspace-scope.js";
+import { homeWorkspaceDirectoryScanError, isHomeWorkspace, recursiveRootContainsHome, recursiveHomeSearchError, } from "../context/workspace-scope.js";
 const MAX_OUT = 60_000;
 const MAX_MATCHES = 300;
 const MAX_FILE_BYTES = 2 * 1024 * 1024;
@@ -538,6 +538,8 @@ registerTool({
         catch {
             return `Error: no such path: ${input.path ?? "."}`;
         }
+        if (!isFile && isHomeWorkspace(ctx.cwd))
+            return homeWorkspaceDirectoryScanError("grep");
         if (!isFile && recursiveRootContainsHome(root))
             return recursiveHomeSearchError("grep");
         const searchArgs = [
@@ -605,6 +607,8 @@ registerTool({
         const denied = sensitiveFileError(root, "search");
         if (denied)
             return denied;
+        if (isHomeWorkspace(ctx.cwd))
+            return homeWorkspaceDirectoryScanError("glob");
         if (recursiveRootContainsHome(root))
             return recursiveHomeSearchError("glob");
         const pattern = typeof input.pattern === "string" ? input.pattern : "";
@@ -665,6 +669,8 @@ registerTool({
     },
     kind: "read",
     async run(input, ctx) {
+        if (isHomeWorkspace(ctx.cwd))
+            return homeWorkspaceDirectoryScanError("ls");
         const dir = absOf(input.path, ctx.cwd);
         const denied = sensitiveFileError(dir, "list");
         if (denied)

package/dist/tui/InputBox.js

@@ -140,6 +140,12 @@ export function cells(s) {
         n += charCells(ch);
     return n;
 }
+/** One-cell display representation for composer text. The editable/submitted value keeps literal tabs,
+ *  while wrapping, cursor math, and Ink all see the same one-cell glyph. Removing newlines here preserves
+ *  renderRow's invariant that hard line breaks are represented by rows rather than nested Text output. */
+export function composerTextForDisplay(text) {
+    return text.replace(/\n/g, "").replace(/\t/g, " ");
+}
 /** Wrap `value` into rows that each fit within `cols` cells, breaking on spaces where possible but
  *  never inside an `[Image #N]` token. Deterministic (no reliance on ink's soft-wrap) so wrapped rows
  *  align under a stable gutter and the cursor position is exact. Always returns at least one row. */
@@ -230,7 +236,7 @@ export function wrapRows(value, cols) {
 function renderRow(value, row, cursor, showCursor, isLastRow, keyPrefix) {
     // `\n` chars are row SEPARATORS (wrapRows already broke the row on them) — never render them, or ink
     // would insert a second line break and desync the deterministic layout.
-    const seg = (token, text, k) => token ? (_jsx(Text, { backgroundColor: "magenta", color: "white", children: text.replace(/\n/g, "") }, k)) : (_jsx(Text, { children: text.replace(/\n/g, "") }, k));
+    const seg = (token, text, k) => token ? (_jsx(Text, { backgroundColor: "magenta", color: "white", children: composerTextForDisplay(text) }, k)) : (_jsx(Text, { children: composerTextForDisplay(text) }, k));
     // Segments intersected with this row's [start,end) range.
     const parts = segmentize(value);
     const nodes = [];
@@ -250,7 +256,7 @@ function renderRow(value, row, cursor, showCursor, isLastRow, keyPrefix) {
             const rel = cursor - from;
             if (rel > 0)
                 nodes.push(seg(p.token, slice.slice(0, rel), `${keyPrefix}s${ki++}`));
-            nodes.push(_jsx(Text, { inverse: true, children: slice[rel] === "\n" ? " " : slice[rel] }, `${keyPrefix}c${ki++}`));
+            nodes.push(_jsx(Text, { inverse: true, children: slice[rel] === "\n" || slice[rel] === "\t" ? " " : slice[rel] }, `${keyPrefix}c${ki++}`));
             if (rel + 1 < slice.length)
                 nodes.push(seg(p.token, slice.slice(rel + 1), `${keyPrefix}e${ki++}`));
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanhara/hara",
-  "version": "0.122.5",
+  "version": "0.122.7",
   "description": "hara — a coding agent CLI that runs like an engineering org.",
   "bin": {
     "hara": "runtime-bootstrap.cjs"
@@ -39,8 +39,9 @@
     "node": ">=22.12.0"
   },
   "scripts": {
-    "build": "tsc && node scripts/normalize-dist-modes.mjs",
+    "build": "tsc && node scripts/normalize-dist-modes.mjs && node scripts/check-local-bin-link.mjs",
     "prepare": "npm run build",
+    "doctor:local-link": "node scripts/check-local-bin-link.mjs",
     "dev": "tsx src/cli.ts",
     "start": "node runtime-bootstrap.cjs",
     "test": "npm run build && node --test --test-timeout=120000 test/*.test.mjs",