@nanhara/hara 0.122.7 → 0.123.0

package/CHANGELOG.md

@@ -5,6 +5,34 @@ All notable changes to `@nanhara/hara`.
 > Versioning (pre-1.0, SemVer-style): the **minor** (middle) number bumps for a **new feature**; the
 > **patch** (last) number bumps for **optimizations/fixes of existing features**.
 
+## 0.123.0 — 2026-07-15 — task-aware interaction and input/security hardening
+
+- **Conversation and execution are separate state.** Sessions now persist a bounded, redacted task record
+  beside the transcript: stable task/turn IDs, the original objective, running/paused/completed/blocked
+  status, outcomes, and steering audit. A crashed running task recovers as paused/interrupted; the first
+  input after resume continues an unfinished objective instead of silently replacing it. Legacy sessions
+  without task state still load normally, and `/task` shows or clears only execution state while preserving
+  the conversation.
+- **Mid-turn input targets an exact run.** TUI type-ahead carries an `expectedTurnId`, late input remains a
+  steer rather than becoming an accidental new task, and Desktop/serve exposes additive `session.steer`,
+  task/turn events, resumed task metadata, plus explicit `newTask: true`. Task context is injected separately
+  from transcript/project context so a conversational reply cannot redefine the active coding objective.
+- **Terminal text paste follows bracketed-paste framing.** Hara enables terminal mode 2004, buffers split
+  `ESC[200~`/`ESC[201~` frames into one logical insert, handles immediate paste+Enter correctly, restores the
+  terminal on exit, and fails visibly on incomplete or over-2 MiB input. Multiline Claude output no longer
+  freezes, disappears, or requires Ctrl+C before it can be pasted.
+- **Three reported path/alias escapes are closed.** Windows Guardian containment uses platform-aware relative
+  paths; global `~/.hara/config.json` reads reject symlink/hard-link aliases and writes use a private atomic
+  replacement without modifying an external inode; organization role sync accepts only portable role IDs
+  and verifies every final path remains directly below `~/.hara/org-roles`.
+- **Home remains private without becoming inconvenient.** `hara --cwd /path/to/project` explicitly selects a
+  project as an alternative to `cd`, and every Home-boundary refusal now shows both choices. Hara deliberately
+  does not scan Home and guess a repository, avoiding ambiguous selection and renewed private-directory
+  inventory.
+- **Cancellation gates no longer probe PID 0.** Computer/cron process-tree fixtures wait for a fully published
+  positive child PID before cancellation assertions, retaining the original strict settlement and process
+  disappearance deadlines under full-suite contention.
+
 ## 0.122.7 — 2026-07-15 — isolated build-context parity
 
 - **Docker builds carry every package-build dependency.** The image build stage now copies the local-link

package/README.md

@@ -18,8 +18,8 @@
 - **Multi-provider, all streamed** — Anthropic (Claude) or any OpenAI-compatible endpoint (Qwen/DashScope, GLM, Kimi, OpenAI) with live Markdown + visible reasoning.
 - **Delegate to other agents** — the **`external_agent`** tool hands a self-contained task to **Claude Code** or **Codex** running headless, and returns the result — so you pick the best engine per task. It is a trusted extension outside Hara's protected-file boundary: every interactive call requires confirmation, and non-interactive use is disabled by default.
 - **Honest under a slow network** — a live "waiting for the model… Ns" status, a stall watchdog that
-  auto-fails-over instead of hanging, big pastes folding to a token, and a startup update notice — the
-  terminal never feels dead.
+  auto-fails-over instead of hanging, terminal-native bracketed paste, big pastes folding to a token, and a
+  startup update notice — the terminal never feels dead.
 - **Solid coding core** — `edit_file` / `apply_patch` (atomic multi-file) with colored diffs · `grep`/`glob`/`ls`/`codebase_search` (lexical + optional semantic search over the repo) /`web_fetch` · fuzzy `@file` · `/undo` · `/compact` · **Esc-to-interrupt** · parallel sub-agents · MCP client · macOS sandbox.
 
 Track it: https://github.com/hara-cli/hara · https://hara.run
@@ -176,6 +176,7 @@ hara -p "extract package metadata" --schema ./schema.json         # stdout is ex
 hara -p "review the current diff" --role reviewer                 # persona + model + tool policy from the role
 hara --approval auto-edit  # suggest (default) | auto-edit | full-auto   (-y = full-auto)
 hara --sandbox workspace-write   # confine shell writes to the project (macOS Seatbelt)
+hara --cwd /path/to/project      # explicitly select a workspace without changing your shell directory
 hara -c                    # resume the most recent session in this directory
 hara --profile work        # use a named profile from ~/.hara/config.json
 hara -m glm-5              # pick a model
@@ -183,7 +184,8 @@ hara -m glm-5              # pick a model
 
 Run Hara from a project directory. When the current directory resolves to your Home root, Hara does not treat
 the whole Home tree as a repository: project init/index and default recursive grep/glob/codebase inventory are
-disabled with a `cd /path/to/project` hint. Directory listing and child-directory recursion are also refused so
+disabled with a `cd /path/to/project` / `hara --cwd /path/to/project` hint. Directory listing and
+child-directory recursion are also refused so
 the model cannot promote a discovered Home folder into an implicit project; explicitly named single files still
 work. Resuming a session reuses its persisted conversation and must not trigger workspace rediscovery.
 
@@ -193,7 +195,10 @@ stderr and missing/invalid output exits non-zero. `--role reviewer` resolves loc
 uses the portable global persona in the current project, and `--role shop:reviewer` runs at that registered
 project home. Each form enforces the role's persona, model, `allowTools`/`denyTools`, and `readOnly` policy.
 
-Inside the REPL: `/help` `/init` `/tools` `/model` `/approval` `/org` `/plan` `/roles` `/usage` `/doctor` `/sessions` `/undo` `/compact` `/recall` `/reset` `/exit` (type `/`+Tab to complete). Type `@` + Tab to attach a file (fuzzy, walks subdirectories).
+Inside the REPL: `/help` `/init` `/tools` `/model` `/approval` `/org` `/plan` `/roles` `/task` `/usage`
+`/doctor` `/sessions` `/undo` `/compact` `/recall` `/reset` `/exit` (type `/`+Tab to complete). `/task`
+shows the active execution record; `/task clear` drops it without deleting the conversation. Type `@` + Tab
+to attach a file (fuzzy, walks subdirectories).
 
 The interactive REPL is an **ink TUI**: a bordered **input box pinned at the bottom** — session name in
 the top-right corner, approval modes + token usage + concurrency in the bottom border — with the
@@ -205,6 +210,10 @@ token inline where your cursor is (backspace over it to remove it). hara auto-de
 a vision model sees the image directly; a text-only model routes it through a `visionModel` describer (see
 Setup), shown in the header at startup. Set `HARA_TUI=0` for the classic readline REPL.
 
+Text pasted by a modern terminal is handled as one bracketed-paste event, including multiline Claude/Codex
+output and a paste immediately followed by Enter. It is inserted for review and never auto-submitted merely
+because it contains newlines; malformed/incomplete frames are bounded and surfaced instead of hanging raw mode.
+
 Each session gets a **UUID** and an **auto-summarized name** from your first message (kept verbatim, CJK
 included); `hara sessions` lists them by short id, and `--resume <prefix>` accepts the short id.
 
@@ -246,7 +255,14 @@ only changed files re-embed (a full repo rebuild that takes ~a minute re-runs in
 `hara config set computerUse read|click|full` and allowlist apps with `hara config set computerApps "App, …"`. Guarded
 by the tier, the frontmost-app allowlist, a dangerous-key blocklist, and a once-per-session grant. Screenshots are read via your
 vision model into **actionable** output — interactive elements + positions (pass `focus` to target what you're after) — so even a text-only main model can click.
-**Sessions**: conversations are saved automatically — `-c` / `--resume <id>` or `hara resume <id>` to continue, `hara sessions` to list, `hara export [id] [--out file]` to render one as a Markdown transcript. The `hara resume` launcher preserves terminal input in both npm/Node and standalone-binary installs.
+**Sessions and task execution**: conversations are saved automatically — `-c` / `--resume <id>` or
+`hara resume <id>` to continue, `hara sessions` to list, `hara export [id] [--out file]` to render one as a
+Markdown transcript. The current task is persisted separately with stable task/turn identity and resumes as
+paused rather than being inferred from chat text; `/task` inspects it and `/task clear` leaves the transcript
+intact. Type-ahead input steers the exact live turn. Desktop/serve clients can use `session.steer` with
+`expectedTurnId`, and may pass `newTask: true` to `session.send` when an unfinished resumed task should be
+replaced explicitly. The `hara resume` launcher preserves terminal input in both npm/Node and standalone-binary
+installs.
 **MCP**: add an `mcpServers` map to global config (a reviewed project config additionally needs `HARA_TRUST_PROJECT_CONFIG=1` at launch); their tools appear to the agent as `mcp__<server>__<tool>`. Configured MCP servers, like `external_agent`, are trusted host extensions outside Hara's protected-file boundary. Every interactive tool call requires confirmation (even in `full-auto`), and non-interactive runs disable them by default; reviewed automation can explicitly opt in before launch with `HARA_ALLOW_TRUSTED_EXTENSIONS=1`. hara can also **be** an MCP server — `hara mcp` exposes its read/search tools (esp. **`codebase_search`**) over stdio so other clients (Claude Desktop, Cursor, another hara) can use them; read-only by default (`HARA_MCP_TOOLS` to override).
 **Vim mode**: `hara config set vimMode true` makes the prompt modal — Esc → normal, `i/a/A/I` insert, `h l 0 $ w b e` motions, `x D C dd cw p` edits. Off by default.
 **Scheduled tasks**: `hara cron add "0 9 * * 1-5" "<task>"` (or `"every 30m"`, `"in 2h"`) runs a task on a schedule — each run is a fresh hara session. `hara cron install` wires a per-minute tick into launchd/crontab (no daemon); `--org` routes through the role org. Manage with `hara cron list/run/enable/disable/remove/logs`. Every job has a 30-minute deadline and the whole sequential tick has a non-renewable 60-minute watchdog: a job timeout kills its process tree, records `timed out` + duration/error, then continues with the next due job; a tick timeout stops the remainder and releases the global lock. Add `--deliver feishu:<chatId>` (or Telegram/webhook) for outcomes and `--alert-after N` for the consecutive-failure 🚨 threshold (default 3). Delivery intent is durable before transport, uses a stable idempotency key, and retries with bounded backoff on later ticks until confirmed. A failed channel cannot grow `jobs.json` forever: each job keeps at most 64 pending effects, reserves outcome/alert room before launch, and disables itself with a visible backlog error when full; restore delivery, let the queue drain, then re-enable it. Tune milliseconds with `HARA_CRON_JOB_TIMEOUT_MS` (hard max 24h) and `HARA_CRON_TICK_TIMEOUT_MS` (hard max 5h); scheduled jobs are also capped by the tick. After upgrading from a version whose tick is already stuck, terminate that specific legacy `hara cron tick` process tree once (or reboot); the next scheduler minute marks over-age state interrupted/disabled and recovers the lock without replaying a possibly orphaned task.
@@ -321,7 +337,7 @@ turn, or **`/undo`** to revert the last edit. In-session **`/diff`**, **`/review
 - **Type-ahead steering**: keep typing while hara works — your message is held, then **folded into the next model call** (not deferred to a new turn), so a clarification or "also do X" course-corrects the task already in flight (codex-style). Messages typed after the final step start a fresh turn; **Esc** drops the queue and stops.
 - **Project context**: auto-loads `AGENTS.md` (the cross-tool standard) walking up to the repo root; `hara init` writes one by analyzing the repo.
 - **`@file` mentions**: attach file contents to a message (`@path`); Tab-completes with a **fuzzy** matcher over the project (subdirs, git-tracked + untracked) — `@idx` → `src/index.ts`. `@<dir>` loads a directory listing, `@src/`+Tab drills into a folder, and mistyped tool/file paths get a "did you mean" suggestion.
-- **Explicit workspace boundary**: launching at Home does not inventory its directories or permit coding mutations. Start Hara from a concrete project to enable search, `@` completion, shell/external agents, and file edits; explicitly named single-file reads remain available at Home.
+- **Explicit workspace boundary**: launching at Home does not inventory its directories or permit coding mutations. Start Hara from a concrete project, or pass `hara --cwd /path/to/project`, to enable search, `@` completion, shell/external agents, and file edits; explicitly named single-file reads remain available at Home.
 - **Multi-provider**: Anthropic (Claude) or any OpenAI-compatible endpoint (Qwen/DashScope, GLM, Kimi, OpenAI) — **all streamed live**.
 - **Chat gateway**: drive your local hara from **Telegram · WeChat · Discord · Feishu/Lark · Slack · Mattermost · Matrix · DingTalk · WeCom · Signal**. The daemon connects out (no public webhook), with per-chat sessions, project roaming (`/cd`), agent switching (`/agent`), and **two-way images on byte-upload-capable platforms**. Setup, platform capability details, and the group-flow security model: **[docs/gateway.md](docs/gateway.md)**.
 

package/dist/agent/loop.js

@@ -132,12 +132,13 @@ const CONTINUATION_SYSTEM = "# Existing-session continuity\n" +
     "re-inventory the workspace, or summarize files merely to understand what happened before. Follow the latest user request " +
     "and reuse prior conclusions and tool results. Inspect files only when the latest request requires it. If the working " +
     "directory is Home, ask the user to start Hara from a concrete project instead of enumerating Home or its children.";
-function composeSystem(cwd, projectContext, override, memory, continuationSession = false) {
+function composeSystem(cwd, projectContext, override, memory, continuationSession = false, executionContext) {
     const head = override ? `${override}\n\nWorking directory: ${cwd}` : HARA_SYSTEM(cwd);
     const skills = skillsDigest(cwd);
     return (head +
         gatewayNote() +
         (continuationSession ? `\n\n${CONTINUATION_SYSTEM}` : "") +
+        (executionContext ? `\n\n${executionContext}` : "") +
         (projectContext ? `\n\n# Project context (AGENTS.md)\n${projectContext}` : "") +
         (memory ? `\n\n# Memory (durable — facts/decisions/prefs you've saved; use memory_search/get for more)\n${memory}` : "") +
         (skills ? `\n\n# Skills (capabilities you can load — call the \`skill\` tool with the id for full instructions before using one)\n${skills}` : ""));
@@ -427,7 +428,7 @@ async function runAgentInner(history, opts, life) {
                     return { text: "", toolUses: [], stop: "error", errorMsg: "interrupted" };
                 }
                 return activeProvider.turn({
-                    system: composeSystem(ctx.cwd, opts.projectContext, opts.systemOverride, opts.memory, opts.continuationSession),
+                    system: composeSystem(ctx.cwd, opts.projectContext, opts.systemOverride, opts.memory, opts.continuationSession, opts.executionContext),
                     history,
                     tools: specs,
                     // Any stream chunk keeps the connection considered alive — even suppressed reasoning_content, so a

package/dist/config.js

@@ -1,6 +1,7 @@
+import { randomUUID } from "node:crypto";
 import { homedir } from "node:os";
 import { join, dirname, resolve } from "node:path";
-import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from "node:fs";
+import { closeSync, constants, existsSync, fstatSync, fsyncSync, lstatSync, mkdirSync, openSync, realpathSync, renameSync, rmSync, writeFileSync, } from "node:fs";
 import { agentMaxRounds, agentRunTimeoutMs } from "./agent/limits.js";
 import { ensurePrivateHaraState } from "./security/private-state.js";
 import { readVerifiedRegularFileSnapshotSync } from "./fs-read.js";
@@ -41,6 +42,7 @@ export const APPROVAL_MODES = ["suggest", "auto-edit", "full-auto"];
 export const SANDBOX_MODES = ["off", "workspace-write", "read-only"];
 const PROJECT_ROOT_MARKERS = [".git", "package.json", "Cargo.toml", "go.mod", "pyproject.toml", ".hg"];
 const MAX_PROJECT_CONFIG_BYTES = 256 * 1024;
+const MAX_GLOBAL_CONFIG_BYTES = 1024 * 1024;
 const KNOWN_CONFIG_KEYS = new Set([
     ...CONFIG_KEYS,
     "hooks", "mcpServers", "modelVision", "overlays", "profiles",
@@ -111,7 +113,12 @@ export function readRawConfig() {
     if (!existsSync(p))
         return {};
     try {
-        return configRecord(JSON.parse(readFileSync(p, "utf8")));
+        const snapshot = readVerifiedRegularFileSnapshotSync(p, MAX_GLOBAL_CONFIG_BYTES, {
+            action: "read global config",
+            protectSensitive: false,
+            rejectHardLinks: true,
+        });
+        return configRecord(JSON.parse(snapshot.text));
     }
     catch {
         return {};
@@ -232,20 +239,72 @@ function readProjectConfig(cwd) {
     }
     return {};
 }
-/** Write the config 0600 (it can hold `apiKey`) + tighten an existing file. */
+function existingConfigIdentity(path) {
+    try {
+        const info = lstatSync(path);
+        if (info.isSymbolicLink())
+            throw new Error(`refusing global config write: '${path}' is a symbolic link`);
+        if (!info.isFile())
+            throw new Error(`refusing global config write: '${path}' is not a regular file`);
+        if (info.nlink !== 1)
+            throw new Error(`refusing global config write: '${path}' is hard-linked`);
+        return { dev: info.dev, ino: info.ino };
+    }
+    catch (error) {
+        if (error?.code === "ENOENT")
+            return null;
+        throw error;
+    }
+}
+/** Atomically replace the global 0600 config without opening its current directory entry for write. */
 function persistConfig(p, cfg) {
     ensurePrivateHaraState();
-    mkdirSync(dirname(p), { recursive: true, mode: 0o700 });
-    try {
-        chmodSync(dirname(p), 0o700);
+    const parent = dirname(p);
+    mkdirSync(parent, { recursive: true, mode: 0o700 });
+    const parentInfo = lstatSync(parent);
+    const canonicalParent = realpathSync.native(parent);
+    if (!parentInfo.isDirectory() || parentInfo.isSymbolicLink()) {
+        throw new Error(`refusing global config write: '${parent}' is not a canonical directory`);
     }
-    catch { /* best effort */ }
-    writeFileSync(p, JSON.stringify(cfg, null, 2) + "\n", { encoding: "utf8", mode: 0o600 });
+    const existing = existingConfigIdentity(p);
+    const temp = join(parent, `.config-${process.pid}-${randomUUID()}.tmp`);
+    const noFollow = typeof constants.O_NOFOLLOW === "number" ? constants.O_NOFOLLOW : 0;
+    let fd;
     try {
-        chmodSync(p, 0o600);
+        fd = openSync(temp, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | noFollow, 0o600);
+        writeFileSync(fd, JSON.stringify(cfg, null, 2) + "\n", "utf8");
+        fsyncSync(fd);
+        const staged = fstatSync(fd);
+        if (!staged.isFile() || staged.nlink !== 1)
+            throw new Error("refusing global config write: unsafe staging inode");
+        closeSync(fd);
+        fd = undefined;
+        const parentAfter = lstatSync(parent);
+        if (!parentAfter.isDirectory() || parentAfter.isSymbolicLink() ||
+            parentAfter.dev !== parentInfo.dev || parentAfter.ino !== parentInfo.ino ||
+            realpathSync.native(parent) !== canonicalParent)
+            throw new Error(`refusing global config write: '${parent}' changed before commit`);
+        const current = existingConfigIdentity(p);
+        if ((existing === null) !== (current === null) || (existing && current && (existing.dev !== current.dev || existing.ino !== current.ino))) {
+            throw new Error(`refusing global config write: '${p}' changed before commit`);
+        }
+        // rename replaces the path entry; it never follows an alias planted after the last identity check.
+        renameSync(temp, p);
+        const committed = lstatSync(p);
+        if (!committed.isFile() || committed.isSymbolicLink() || committed.dev !== staged.dev || committed.ino !== staged.ino || committed.nlink !== 1) {
+            throw new Error(`global config changed during commit: '${p}'`);
+        }
     }
-    catch {
-        /* best-effort */
+    finally {
+        if (fd !== undefined)
+            try {
+                closeSync(fd);
+            }
+            catch { /* preserve original error */ }
+        try {
+            rmSync(temp, { force: true });
+        }
+        catch { /* preserve original error */ }
     }
 }
 export function writeConfigValue(key, value) {

package/dist/context/workspace-scope.js

@@ -28,17 +28,17 @@ export function recursiveRootContainsHome(root, home = homedir()) {
 }
 export function homeWorkspaceActionError(action) {
     return (`Refusing to ${action} from the home directory: it is not an implicit project workspace. ` +
-        "Run `cd /path/to/project` first.");
+        "Run `cd /path/to/project` first, or launch with `hara --cwd /path/to/project`.");
 }
 export function recursiveHomeSearchError(tool) {
     return (`Error: ${tool} will not recursively scan the home directory. ` +
-        "Run Hara from a project (`cd /path/to/project`). Explicit single-file reads remain available.");
+        "Run Hara from a project (`cd /path/to/project` or `hara --cwd /path/to/project`). Explicit single-file reads remain available.");
 }
 /** A model rooted at Home must not discover a child and silently promote it into the project scope. The
  * user establishes that scope by launching Hara from the concrete project directory. */
 export function homeWorkspaceDirectoryScanError(tool) {
     return (`Error: ${tool} will not enumerate or recursively scan directories while Hara is rooted at the home directory. ` +
-        "Run `cd /path/to/project` and start Hara there. Explicit single-file reads remain available.");
+        "Run `cd /path/to/project` or relaunch with `hara --cwd /path/to/project`. Explicit single-file reads remain available.");
 }
 /** Injected into model context when Hara was intentionally launched at ~/. Runtime checks enforce the same
  *  policy, but guidance avoids wasting turns on calls that are guaranteed to be rejected. */
@@ -49,5 +49,5 @@ export function homeWorkspaceGuidance(cwd) {
         "The working directory resolves to the user's home directory, which is not an implicit project. " +
         "Do not initialize a project, create or modify files, build a repository index, run shell/external " +
         "executable tools, enumerate directories, or grep/glob/search Home or one of its child directories. " +
-        "Ask the user to run `cd /path/to/project` for project work. Only explicitly named single-file reads remain available.");
+        "Ask the user to run `cd /path/to/project` or `hara --cwd /path/to/project` for project work. Only explicitly named single-file reads remain available.");
 }