@nanhara/hara 0.124.0 → 0.124.2

package/dist/org/review-chain.js

@@ -8,6 +8,7 @@ import { createHash } from "node:crypto";
 import { closeSync, constants, fstatSync, lstatSync, openSync, readSync } from "node:fs";
 import { isAbsolute, join, relative, resolve, sep } from "node:path";
 import { verifyOpenedRegularFileSync } from "../fs-read.js";
+import { optionalPosixOpenFlag } from "../fs-open-flags.js";
 import { sensitiveFileReason } from "../security/sensitive-files.js";
 import { redactToolSubprocessOutput, toolSubprocessEnv } from "../security/subprocess-env.js";
 const MAX_CHANGED_PATHS = 4096;
@@ -125,8 +126,7 @@ function stagedIndexEntry(cwd, path) {
 }
 function verifiedWorktreeBlobOid(cwd, path, algorithm, maxBytes) {
     const absolute = join(cwd, path);
-    const noFollow = typeof constants.O_NOFOLLOW === "number" ? constants.O_NOFOLLOW : 0;
-    const fd = openSync(absolute, constants.O_RDONLY | constants.O_NONBLOCK | noFollow);
+    const fd = openSync(absolute, constants.O_RDONLY | optionalPosixOpenFlag("O_NONBLOCK") | optionalPosixOpenFlag("O_NOFOLLOW"));
     try {
         const before = fstatSync(fd);
         verifyOpenedRegularFileSync(absolute, before, {

package/dist/security/permissions.js

@@ -16,6 +16,7 @@ import { psArgumentsExposeEnvironment } from "./sensitive-files.js";
 import { projectRepositoryTrustedAtStartup } from "./project-trust.js";
 import { readVerifiedRegularFileSnapshotSync } from "../fs-read.js";
 import { homeWorkspaceActionError, isHomeWorkspace } from "../context/workspace-scope.js";
+import { sameOpenedFileIdentity } from "../fs-identity.js";
 const PROJECT_ROOT_MARKERS = [".git", "package.json", "Cargo.toml", "go.mod", "pyproject.toml", ".hg"];
 const MAX_PROJECT_PERMISSIONS_BYTES = 64 * 1024;
 const projectPermissionWarnings = new Set();
@@ -472,7 +473,7 @@ function scaffoldProjectPermissions(cwd) {
         fd = undefined;
         verifiedDirectory(parent, parentIdentity);
         const staged = lstatSync(temp);
-        if (!staged.isFile() || staged.isSymbolicLink() || staged.dev !== tempIdentity.dev || staged.ino !== tempIdentity.ino) {
+        if (!staged.isFile() || staged.isSymbolicLink() || !sameOpenedFileIdentity(staged, tempIdentity)) {
             throw new Error("refusing project permissions write: staging file identity changed");
         }
         verifiedDirectory(parent, parentIdentity);
@@ -490,7 +491,7 @@ function scaffoldProjectPermissions(cwd) {
         }
         verifiedDirectory(parent, parentIdentity);
         const written = lstatSync(target);
-        if (!written.isFile() || written.isSymbolicLink() || written.dev !== tempIdentity.dev || written.ino !== tempIdentity.ino) {
+        if (!written.isFile() || written.isSymbolicLink() || !sameOpenedFileIdentity(written, tempIdentity)) {
             throw new Error("refusing project permissions write: committed file identity changed");
         }
         unlinkSync(temp);
@@ -507,7 +508,7 @@ function scaffoldProjectPermissions(cwd) {
             try {
                 verifiedDirectory(parent, parentIdentity);
                 const current = lstatSync(temp);
-                if (current.isFile() && current.dev === tempIdentity.dev && current.ino === tempIdentity.ino)
+                if (current.isFile() && sameOpenedFileIdentity(current, tempIdentity))
                     unlinkSync(temp);
             }
             catch {

package/dist/security/private-state.js

@@ -6,6 +6,8 @@ import { randomUUID } from "node:crypto";
 import { homedir } from "node:os";
 import { basename, dirname, join, resolve } from "node:path";
 import { FileReadLimitError, MAX_EDIT_READ_BYTES, decodeUtf8Strict, openVerifiedRegularFileNoFollow, verifyOpenedRegularFileSync, } from "../fs-read.js";
+import { optionalPosixOpenFlag } from "../fs-open-flags.js";
+import { sameOpenedFileIdentity } from "../fs-identity.js";
 const PRIVATE_TREES = new Set(["sessions", "checkpoints", "index", "gateway", "cron", "weixin"]);
 const tightenedHomes = new Set();
 const DEFAULT_MIGRATION_CAP = 50_000;
@@ -64,9 +66,10 @@ function verifyAndTightenPrivateDirectory(path) {
         // no POSIX ownership mode to repair
     }
     else {
-        const noFollow = typeof constants.O_NOFOLLOW === "number" ? constants.O_NOFOLLOW : 0;
-        const directoryOnly = typeof constants.O_DIRECTORY === "number" ? constants.O_DIRECTORY : 0;
-        const fd = openSync(path, constants.O_RDONLY | constants.O_NONBLOCK | noFollow | directoryOnly);
+        const fd = openSync(path, constants.O_RDONLY
+            | optionalPosixOpenFlag("O_NONBLOCK")
+            | optionalPosixOpenFlag("O_NOFOLLOW")
+            | optionalPosixOpenFlag("O_DIRECTORY"));
         try {
             const opened = fstatSync(fd);
             if (!opened.isDirectory() || opened.dev !== inspected.dev || opened.ino !== inspected.ino) {
@@ -173,8 +176,7 @@ export function readPrivateStateFileSnapshotSync(path, maxBytes = MAX_EDIT_READ_
     }
     if (before.isSymbolicLink())
         throw new Error(`refusing private Hara state file: '${path}' is a symbolic link`);
-    const noFollow = typeof constants.O_NOFOLLOW === "number" ? constants.O_NOFOLLOW : 0;
-    const fd = openSync(path, constants.O_RDONLY | constants.O_NONBLOCK | noFollow);
+    const fd = openSync(path, constants.O_RDONLY | optionalPosixOpenFlag("O_NONBLOCK") | optionalPosixOpenFlag("O_NOFOLLOW"));
     try {
         let info = fstatSync(fd);
         verifyOpenedRegularFileSync(path, info, {
@@ -227,10 +229,39 @@ function samePrivateFile(path, expected) {
     const info = lstatSync(path);
     return (info.isFile()
         && !info.isSymbolicLink()
-        && info.dev === expected.dev
-        && info.ino === expected.ino
-        && (info.mode & 0o777) === expected.mode
-        && info.nlink === expected.nlink);
+        && privateStateFileIdentityMatches({
+            dev: info.dev,
+            ino: info.ino,
+            mode: info.mode & 0o777,
+            nlink: info.nlink,
+        }, expected));
+}
+/**
+ * Compare the fields Node can use as a stable file identity on the current platform. Windows only exposes
+ * owner read/write permission semantics, so its synthetic POSIX mode can differ between descriptor- and
+ * path-based stats without identifying a different file. File type, dev/ino and hard-link count remain
+ * mandatory there; POSIX additionally requires the exact owner-only mode.
+ */
+export function privateStateFileIdentityMatches(actual, expected, platform = process.platform) {
+    return (sameOpenedFileIdentity(actual, expected, platform)
+        && actual.nlink === expected.nlink
+        && (platform === "win32" || actual.mode === expected.mode));
+}
+function privateFileIdentitySummary(path) {
+    try {
+        const info = lstatSync(path);
+        return JSON.stringify({
+            file: info.isFile(),
+            symlink: info.isSymbolicLink(),
+            dev: info.dev,
+            ino: info.ino,
+            mode: info.mode & 0o777,
+            nlink: info.nlink,
+        });
+    }
+    catch (error) {
+        return JSON.stringify({ error: error?.code ?? error?.message ?? String(error) });
+    }
 }
 function restorePrivateClaim(claimed, target, expected) {
     if (!samePrivateFile(claimed, expected)) {
@@ -253,9 +284,10 @@ function restorePrivateClaim(claimed, target, expected) {
 }
 function syncPrivateDirectory(path) {
     try {
-        const noFollow = typeof constants.O_NOFOLLOW === "number" ? constants.O_NOFOLLOW : 0;
-        const directoryOnly = typeof constants.O_DIRECTORY === "number" ? constants.O_DIRECTORY : 0;
-        const fd = openSync(path, constants.O_RDONLY | constants.O_NONBLOCK | noFollow | directoryOnly);
+        const fd = openSync(path, constants.O_RDONLY
+            | optionalPosixOpenFlag("O_NONBLOCK")
+            | optionalPosixOpenFlag("O_NOFOLLOW")
+            | optionalPosixOpenFlag("O_DIRECTORY"));
         try {
             if (fstatSync(fd).isDirectory())
                 fsyncSync(fd);
@@ -281,11 +313,12 @@ export function writePrivateStateFileSync(binding, text) {
     const existing = readPrivateStateFileSnapshotSync(path);
     verifyPrivateDirectory(directory);
     const temp = join(directory.path, `.hara-private-${process.pid}-${randomUUID()}.tmp`);
-    const noFollow = typeof constants.O_NOFOLLOW === "number" ? constants.O_NOFOLLOW : 0;
     let fd;
     let staged;
     try {
-        fd = openSync(temp, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | noFollow, 0o600);
+        // `wx` maps to O_WRONLY|O_CREAT|O_EXCL/CREATE_NEW and refuses an already-present symlink or file.
+        // Bun's Windows numeric-open compatibility can otherwise turn this valid create into a false ENOENT.
+        fd = openSync(temp, "wx", 0o600);
         writeFileSync(fd, text, "utf8");
         try {
             fchmodSync(fd, 0o600);
@@ -332,8 +365,7 @@ export function writePrivateStateFileSync(binding, text) {
             try {
                 const claimedSnapshot = readPrivateStateFileSnapshotSync(claimed);
                 verifiedClaim = Boolean(claimedSnapshot
-                    && claimedSnapshot.dev === existing.dev
-                    && claimedSnapshot.ino === existing.ino
+                    && sameOpenedFileIdentity(claimedSnapshot, existing)
                     && claimedSnapshot.mode === existing.mode
                     && claimedSnapshot.nlink === existing.nlink
                     && claimedSnapshot.text === existing.text);
@@ -376,15 +408,17 @@ export function writePrivateStateFileSync(binding, text) {
         }
         const linkedStaged = { ...staged, nlink: staged.nlink + 1 };
         if (!samePrivateFile(temp, linkedStaged) || !samePrivateFile(path, linkedStaged)) {
-            throw new Error(`private Hara state staging identity changed during commit: '${path}'`);
+            throw new Error(`private Hara state staging identity changed during commit: '${path}'`
+                + `; expected=${JSON.stringify(linkedStaged)}`
+                + `; staging=${privateFileIdentitySummary(temp)}`
+                + `; target=${privateFileIdentitySummary(path)}`);
         }
         unlinkSync(temp);
         const committed = lstatSync(path);
         if (!staged
             || !committed.isFile()
             || committed.isSymbolicLink()
-            || committed.dev !== staged.dev
-            || committed.ino !== staged.ino
+            || !sameOpenedFileIdentity(committed, staged)
             || committed.nlink !== 1
             || (process.platform !== "win32" && (committed.mode & 0o777) !== 0o600))
             throw new Error(`private Hara state file changed during commit: '${path}'`);
@@ -489,9 +523,8 @@ export function removePrivateStateFile(path, expected, directory) {
     if (!current.isFile()
         || current.isSymbolicLink()
         || current.nlink !== 1
-        || current.dev !== expected.dev
-        || current.ino !== expected.ino
-        || (current.mode & 0o777) !== expected.mode
+        || !sameOpenedFileIdentity(current, expected)
+        || (process.platform !== "win32" && (current.mode & 0o777) !== expected.mode)
         || current.size !== expected.size
         || current.mtimeMs !== expected.mtimeMs
         || current.ctimeMs !== expected.ctimeMs)

package/dist/serve/server.js

@@ -32,6 +32,8 @@ import { INTERJECT_PREFIX, disposeReminderScope } from "../agent/reminders.js";
 import { SessionHub, realStore } from "./sessions.js";
 import { parseFrame, rpcResult, rpcError, rpcNotify, ERR, PROTOCOL_VERSION } from "./protocol.js";
 import { readModelContextFileSync } from "../fs-read.js";
+import { optionalPosixOpenFlag } from "../fs-open-flags.js";
+import { sameOpenedFileIdentity } from "../fs-identity.js";
 import { consumePendingTaskSteering, createTaskExecution, continueTaskExecution, finishTaskExecution, newSteerInteraction, newTurnInteraction, recordTaskSteering, requestsTaskContinuation, taskExecutionContext, } from "../session/task.js";
 const APPROVAL_TIMEOUT_MS = 300_000; // an unanswered approval denies after 5 min (never hangs a turn)
 const COMPACT_TIMEOUT_MS = 60_000;
@@ -54,7 +56,7 @@ const ensurePrivateDiscoveryDir = (dir) => {
     mkdirSync(dir, { recursive: true, mode: 0o700 });
     let fd;
     try {
-        fd = openSync(dir, fsConstants.O_RDONLY | fsConstants.O_DIRECTORY | fsConstants.O_NOFOLLOW);
+        fd = openSync(dir, fsConstants.O_RDONLY | optionalPosixOpenFlag("O_DIRECTORY") | optionalPosixOpenFlag("O_NOFOLLOW"));
         const st = fstatSync(fd);
         if (!st.isDirectory())
             throw new Error(`${dir} must be a private directory, not a symlink`);
@@ -151,7 +153,7 @@ const writeDiscovery = async (dir, path, record) => {
         const temp = join(dir, `.serve.json.${process.pid}.${record.instanceId}.tmp`);
         let fd;
         try {
-            fd = openSync(temp, fsConstants.O_CREAT | fsConstants.O_EXCL | fsConstants.O_WRONLY | fsConstants.O_NOFOLLOW, 0o600);
+            fd = openSync(temp, "wx", 0o600);
             fchmodSync(fd, 0o600);
             writeFileSync(fd, `${JSON.stringify(record, null, 2)}\n`, "utf8");
             fsyncSync(fd);
@@ -177,7 +179,7 @@ const removeOwnedDiscovery = async (dir, path, record) => {
     await withDiscoveryLock(dir, record.instanceId, () => {
         let fd;
         try {
-            fd = openSync(path, fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW);
+            fd = openSync(path, fsConstants.O_RDONLY | optionalPosixOpenFlag("O_NOFOLLOW"));
             const opened = fstatSync(fd);
             if (!opened.isFile() || opened.size > 64 * 1024)
                 return;
@@ -191,7 +193,7 @@ const removeOwnedDiscovery = async (dir, path, record) => {
             // Re-check the directory entry against the already-open, verified inode. Cooperating writers are
             // serialized by the lock; this check also refuses an uncooperative symlink/replacement race.
             const linked = lstatSync(path);
-            if (!linked.isFile() || linked.isSymbolicLink() || linked.dev !== opened.dev || linked.ino !== opened.ino)
+            if (!linked.isFile() || linked.isSymbolicLink() || !sameOpenedFileIdentity(linked, opened))
                 return;
             unlinkSync(path);
             syncDirectory(dir);

package/dist/tools/search.js

@@ -290,7 +290,8 @@ function execute() {
 
   const readBuffer = Buffer.allocUnsafe(cfg.maxFileBytes + 1);
   function sameIdentity(info, candidate) {
-    return String(info.dev) === candidate.dev && String(info.ino) === candidate.ino;
+    return String(info.ino) === candidate.ino
+      && (process.platform === "win32" || String(info.dev) === candidate.dev);
   }
   function safeReadText(candidate) {
     const absolute = candidate.path;
@@ -298,7 +299,10 @@ function execute() {
     try {
       const before = fs.lstatSync(absolute, { bigint: true });
       if (!before.isFile() || before.nlink !== 1n || !sameIdentity(before, candidate)) return null;
-      fd = fs.openSync(absolute, fs.constants.O_RDONLY | (fs.constants.O_NONBLOCK || 0) | (fs.constants.O_NOFOLLOW || 0));
+      const posixFlags = process.platform === "win32"
+        ? 0
+        : (fs.constants.O_NONBLOCK || 0) | (fs.constants.O_NOFOLLOW || 0);
+      fd = fs.openSync(absolute, fs.constants.O_RDONLY | posixFlags);
       const info = fs.fstatSync(fd, { bigint: true });
       if (!info.isFile() || info.nlink !== 1n || !sameIdentity(info, candidate) || info.size > BigInt(cfg.maxFileBytes)) return null;
       let total = 0;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanhara/hara",
-  "version": "0.124.0",
+  "version": "0.124.2",
   "description": "hara — a coding agent CLI that runs like an engineering org.",
   "bin": {
     "hara": "runtime-bootstrap.cjs"