@nanhara/hara 0.124.1 → 0.124.3

package/CHANGELOG.md

@@ -5,6 +5,50 @@ All notable changes to `@nanhara/hara`.
 > Versioning (pre-1.0, SemVer-style): the **minor** (middle) number bumps for a **new feature**; the
 > **patch** (last) number bumps for **optimizations/fixes of existing features**.
 
+## 0.124.3 — 2026-07-17 — project-aware resume and runtime hardening
+
+- **Saved sessions now resume in the project they belong to.** `hara resume <id>` validates the persisted
+  project root and relaunches there even when invoked from another directory; session lists show each project
+  path. Inside Hara, `/resume <id>` switches saved sessions while `/continue` exclusively resumes the active
+  task. Missing project roots, corrupt records, concurrent writers, and raw/headless cross-project resumes
+  remain fail-closed.
+- **A total run deadline is now a resumable safety pause.** The 80% warning tells the agent to finish or
+  checkpoint its current step, the hard-stop notice explains that the task/checklist remains resumable with
+  `/continue`, and deadline outcomes persist as `paused` instead of looking irrecoverably blocked. Loop and
+  repeated-failure breakers remain blocked until the approach changes.
+- **Home protection now covers recursive ancestor scopes.** Launching from `/`, `/Users`, a symlink alias, or
+  any directory that contains Home cannot implicitly enumerate or mutate private user state. Explicit child
+  projects remain usable, and interactive `/cd <project>` safely relaunches Hara in the selected project while
+  preserving explicit profile/model/approval/sandbox choices.
+- **Windows portable Home is consistent for direct module consumers.** Explicit Git Bash/MSYS `HOME` wins over
+  a different `USERPROFILE` even when callers bypass the normal CLI bootstrap, keeping config, sessions,
+  indexes, permissions, cron state, and project boundaries on one private root.
+- **Session input is bounded before parsing and recursive processing.** Resume/list reject oversized,
+  excessively deep, structure-heavy, symlinked, or hard-linked session files through a verified no-follow
+  snapshot; saves fail atomically with compact/new-session guidance before unsafe allocations.
+- Upgrade with `npm i -g @nanhara/hara@0.124.3`.
+
+## 0.124.2 — 2026-07-17 — reliable WeCom gateway transport
+
+- **The WeCom gateway is ready only after WeCom accepts its credentials.** Hara now waits for the
+  `aibot_subscribe` acknowledgement, stops after five bounded credential failures, monitors heartbeat
+  acknowledgements, reconnects half-open sockets with bounded exponential backoff, and stops cleanly when
+  `disconnected_event` reports that another active connection replaced it.
+- **A failed WeCom delivery is no longer reported as success.** Correlated requests reject on timeout,
+  cancellation, connection loss, malformed/nonzero acknowledgements, or missing upload results. Text and file
+  transfers have hard deadlines and credential-scoped per-chat FIFO ordering; chunk uploads retry within a
+  fixed bound, and transport diagnostics redact the configured Secret.
+- **WeCom callbacks now participate in Hara's cross-restart execution boundary.** Stable `msgid` and
+  `create_time` metadata feed stale-event filtering, deduplication, and cached no-rerun outcomes so a redelivery
+  cannot silently launch the same coding/file task again.
+- **Inbound media fails closed and keeps file types separate.** Images remain vision attachments, while files
+  and videos become explicit private local-path references. Invalid AES ciphertext/padding is rejected instead
+  of returning padded bytes, and unfinished handoffs remove adapter-owned temporary files.
+- A deterministic local WebSocket suite covers auth failure, heartbeat reconnection, request errors, strict
+  decryption, media classification, two-chunk upload, and a spawned `hara gateway --platform wecom` allowlist
+  round trip without using real enterprise credentials.
+- Upgrade with `npm i -g @nanhara/hara@0.124.2`.
+
 ## 0.124.1 — 2026-07-16 — Windows native private-state and file-identity portability
 
 - **Windows private state works in both Node and the native Bun executable.** Exclusive staging creation now

package/dist/agent/loop.js

@@ -168,7 +168,9 @@ function warnRun(opts, life) {
     if (life.disposed || life.warned || life.signal.aborted)
         return;
     life.warned = true;
-    showRunNotice(opts, `⚠ agent still running: ${formatAgentDuration(Date.now() - life.startedAt)} elapsed, round ${life.rounds}/${life.maxRounds}; hard stop at ${formatAgentDuration(life.timeoutMs)}.`);
+    const elapsedMs = Date.now() - life.startedAt;
+    const remainingMs = Math.max(0, life.timeoutMs - elapsedMs);
+    showRunNotice(opts, `⚠ agent still running: ${formatAgentDuration(elapsedMs)} elapsed, round ${life.rounds}/${life.maxRounds}; ${formatAgentDuration(remainingMs)} remains before this turn pauses. Finish the current step or leave a checklist checkpoint; unfinished session work can resume with \`/continue\`.`);
 }
 function createRunLifecycle(opts) {
     const timeoutMs = agentRunTimeoutMs(opts.timeoutMs);
@@ -226,7 +228,7 @@ function disposeRunLifecycle(life) {
 function hardStop(opts, life, kind, detail) {
     const elapsedMs = Date.now() - life.startedAt;
     const message = kind === "deadline"
-        ? `⛔ agent run stopped: total deadline ${formatAgentDuration(life.timeoutMs)} reached after ${life.rounds} round(s). No further model or tool calls will start. Increase it with \`hara config set runTimeoutMs 45m\` (maximum 2h) only for intentional long work.`
+        ? `⏸ agent run paused: total deadline ${formatAgentDuration(life.timeoutMs)} reached after ${life.rounds} round(s). No further model or tool calls will start in this turn. Session-backed work keeps its task and checklist checkpoint; type \`/continue\` to resume in a fresh bounded turn. Only for intentionally long single turns, use \`hara config set runTimeoutMs 45m\` (maximum 2h).`
         : kind === "max_rounds"
             ? `⛔ agent run stopped: ${life.maxRounds}-round safety limit reached after ${formatAgentDuration(elapsedMs)}. This usually means the model is looping. Increase it with \`hara config set maxAgentRounds <n>\` (maximum 256) only if the extra rounds are intentional.`
             : `⛔ agent run stopped: the same failing ${detail?.tool ?? "tool"} call repeated ${detail?.count ?? REPEATED_FAILURE_LIMIT} times. Change the approach or fix the reported cause before retrying.`;

package/dist/checkpoints.js

@@ -10,7 +10,7 @@ import { dirname, join } from "node:path";
 import { homedir } from "node:os";
 import { createHash } from "node:crypto";
 import { findProjectRoot } from "./context/agents-md.js";
-import { isHomeWorkspace } from "./context/workspace-scope.js";
+import { isUnsafeProjectWorkspace } from "./context/workspace-scope.js";
 import { toolSubprocessEnv } from "./security/subprocess-env.js";
 import { sensitiveFileReason } from "./security/sensitive-files.js";
 import { redactSensitiveText } from "./security/secrets.js";
@@ -107,7 +107,7 @@ function dropSensitiveIndexEntries(root, gitDir) {
 export function checkpoint(cwd, label) {
     // A shadow `git add -A` at ~/ would traverse the user's entire personal/control-data scope. Home is
     // deliberately not an implicit project, including when reached through a symlink alias.
-    if (isHomeWorkspace(cwd))
+    if (isUnsafeProjectWorkspace(cwd))
         return null;
     const root = findProjectRoot(cwd);
     const gitDir = shadowGitDir(root);
@@ -138,7 +138,7 @@ export function checkpoint(cwd, label) {
 }
 /** Recent checkpoints, newest first. */
 export function listCheckpoints(cwd, n = 15) {
-    if (isHomeWorkspace(cwd))
+    if (isUnsafeProjectWorkspace(cwd))
         return [];
     const root = findProjectRoot(cwd);
     const gitDir = shadowGitDir(root);
@@ -163,7 +163,7 @@ export function listCheckpoints(cwd, n = 15) {
 export function restoreCheckpoint(cwd, ref) {
     if (!/^[0-9a-f]{4,64}$/i.test(ref))
         return null; // checkpoint refs are hashes; reject option/ref injection
-    if (isHomeWorkspace(cwd))
+    if (isUnsafeProjectWorkspace(cwd))
         return null;
     const root = findProjectRoot(cwd);
     const gitDir = shadowGitDir(root);

package/dist/context/workspace-scope.js

@@ -1,6 +1,6 @@
-import { realpathSync } from "node:fs";
-import { homedir } from "node:os";
+import { realpathSync, statSync } from "node:fs";
 import { isAbsolute, relative, resolve, sep } from "node:path";
+import { effectiveHomeDir } from "../runtime.js";
 /** Resolve existing paths through symlinks before comparing security/workspace scopes. Falling back to
  *  resolve() keeps messages deterministic for a path that disappears during startup; normal cwd/home paths
  *  exist and therefore take the realpath branch. */
@@ -14,21 +14,25 @@ export function canonicalWorkspacePath(path) {
     }
 }
 /** The user's home directory is a control/personal-data scope, not an implicit project workspace. */
-export function isHomeWorkspace(cwd, home = homedir()) {
+export function isHomeWorkspace(cwd, home = effectiveHomeDir()) {
     return canonicalWorkspacePath(cwd) === canonicalWorkspacePath(home);
 }
 /** A recursive root is unsafe when it is Home itself OR an ancestor that would descend into Home. This
  * closes `path: ".."`, filesystem-root, and symlink-alias bypasses while keeping an explicitly selected
  * project child under Home usable. */
-export function recursiveRootContainsHome(root, home = homedir()) {
+export function recursiveRootContainsHome(root, home = effectiveHomeDir()) {
     const canonicalRoot = canonicalWorkspacePath(root);
     const canonicalHome = canonicalWorkspacePath(home);
     const rel = relative(canonicalRoot, canonicalHome);
     return rel === "" || (rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel));
 }
+/** Project-scoped execution from Home OR one of its ancestors can implicitly reach private user state. */
+export function isUnsafeProjectWorkspace(cwd, home = effectiveHomeDir()) {
+    return recursiveRootContainsHome(cwd, home);
+}
 export function homeWorkspaceActionError(action) {
-    return (`Refusing to ${action} from the home directory: it is not an implicit project workspace. ` +
-        "Run `cd /path/to/project` first, or launch with `hara --cwd /path/to/project`.");
+    return (`Refusing to ${action} from a workspace that is the home directory or contains it: it is not an implicit project workspace. ` +
+        "Use `/cd /path/to/project`, run `cd /path/to/project` first, or launch with `hara --cwd /path/to/project`.");
 }
 export function recursiveHomeSearchError(tool) {
     return (`Error: ${tool} will not recursively scan the home directory. ` +
@@ -43,11 +47,44 @@ export function homeWorkspaceDirectoryScanError(tool) {
 /** Injected into model context when Hara was intentionally launched at ~/. Runtime checks enforce the same
  *  policy, but guidance avoids wasting turns on calls that are guaranteed to be rejected. */
 export function homeWorkspaceGuidance(cwd) {
-    if (!isHomeWorkspace(cwd))
+    if (!isUnsafeProjectWorkspace(cwd))
         return "";
     return ("# Home-directory workspace boundary\n" +
-        "The working directory resolves to the user's home directory, which is not an implicit project. " +
+        "The working directory resolves to the user's home directory or an ancestor that contains it, which is not an implicit project. " +
         "Do not initialize a project, create or modify files, build a repository index, run shell/external " +
         "executable tools, enumerate directories, or grep/glob/search Home or one of its child directories. " +
-        "Ask the user to run `cd /path/to/project` or `hara --cwd /path/to/project` for project work. Only explicitly named single-file reads remain available.");
+        "Ask the user to switch with `/cd /path/to/project`, run `cd /path/to/project`, or launch with " +
+        "`hara --cwd /path/to/project` for project work. Only explicitly named single-file reads remain available.");
+}
+/** Resolve an explicit interactive workspace handoff without accepting Home/ancestor scopes. */
+export function resolveWorkspaceSwitch(input, currentCwd, home = effectiveHomeDir()) {
+    let requested = input.trim();
+    if (!requested)
+        return { ok: false, error: "usage: /cd <project-directory>" };
+    if (requested.length >= 2
+        && ((requested.startsWith('"') && requested.endsWith('"')) || (requested.startsWith("'") && requested.endsWith("'"))))
+        requested = requested.slice(1, -1).trim();
+    if (!requested)
+        return { ok: false, error: "usage: /cd <project-directory>" };
+    if (requested === "~")
+        requested = home;
+    else if (/^~[\\/]/u.test(requested)) {
+        const parts = requested.slice(2).split(/[\\/]+/u).filter(Boolean);
+        requested = resolve(home, ...parts);
+    }
+    try {
+        const target = realpathSync.native(resolve(currentCwd, requested));
+        if (!statSync(target).isDirectory())
+            return { ok: false, error: `not a directory: ${requested}` };
+        if (isUnsafeProjectWorkspace(target, home)) {
+            return { ok: false, error: homeWorkspaceActionError("switch project scope") };
+        }
+        return { ok: true, cwd: target };
+    }
+    catch (error) {
+        return {
+            ok: false,
+            error: `cannot switch to '${requested}': ${error instanceof Error ? error.message : String(error)}`,
+        };
+    }
 }