@nanhara/hara 0.124.2 → 0.124.4

package/CHANGELOG.md

@@ -5,6 +5,37 @@ All notable changes to `@nanhara/hara`.
 > Versioning (pre-1.0, SemVer-style): the **minor** (middle) number bumps for a **new feature**; the
 > **patch** (last) number bumps for **optimizations/fixes of existing features**.
 
+## 0.124.4 — 2026-07-18 — deadline-aware task checkpoints
+
+- **The 80% run-budget warning now reaches the Agent, not only the user.** Before the next model turn,
+  Hara injects a hidden checkpoint instruction to finish the current atomic step, persist artifacts,
+  update the checklist, and defer a new multi-minute stage to `/continue`. A video/image batch, full
+  validation, preview, render, install, or deployment should no longer begin with too little turn budget
+  and then appear to stop mysteriously at the 30-minute safety pause.
+
+## 0.124.3 — 2026-07-17 — project-aware resume and runtime hardening
+
+- **Saved sessions now resume in the project they belong to.** `hara resume <id>` validates the persisted
+  project root and relaunches there even when invoked from another directory; session lists show each project
+  path. Inside Hara, `/resume <id>` switches saved sessions while `/continue` exclusively resumes the active
+  task. Missing project roots, corrupt records, concurrent writers, and raw/headless cross-project resumes
+  remain fail-closed.
+- **A total run deadline is now a resumable safety pause.** The 80% warning tells the agent to finish or
+  checkpoint its current step, the hard-stop notice explains that the task/checklist remains resumable with
+  `/continue`, and deadline outcomes persist as `paused` instead of looking irrecoverably blocked. Loop and
+  repeated-failure breakers remain blocked until the approach changes.
+- **Home protection now covers recursive ancestor scopes.** Launching from `/`, `/Users`, a symlink alias, or
+  any directory that contains Home cannot implicitly enumerate or mutate private user state. Explicit child
+  projects remain usable, and interactive `/cd <project>` safely relaunches Hara in the selected project while
+  preserving explicit profile/model/approval/sandbox choices.
+- **Windows portable Home is consistent for direct module consumers.** Explicit Git Bash/MSYS `HOME` wins over
+  a different `USERPROFILE` even when callers bypass the normal CLI bootstrap, keeping config, sessions,
+  indexes, permissions, cron state, and project boundaries on one private root.
+- **Session input is bounded before parsing and recursive processing.** Resume/list reject oversized,
+  excessively deep, structure-heavy, symlinked, or hard-linked session files through a verified no-follow
+  snapshot; saves fail atomically with compact/new-session guidance before unsafe allocations.
+- Upgrade with `npm i -g @nanhara/hara@0.124.3`.
+
 ## 0.124.2 — 2026-07-17 — reliable WeCom gateway transport
 
 - **The WeCom gateway is ready only after WeCom accepts its credentials.** Hara now waits for the

package/dist/agent/loop.js

@@ -149,6 +149,13 @@ function composeSystem(cwd, projectContext, override, memory, continuationSessio
 }
 const RUN_STOPPED = Symbol("agent-run-stopped");
 const REPEATED_FAILURE_LIMIT = 3;
+export function deadlineCheckpointReminder(timeoutMs) {
+    return (`Turn budget checkpoint: about 20% remains before the ${formatAgentDuration(timeoutMs)} safety pause. ` +
+        "Stop expanding scope. Finish only the current atomic step, persist any usable artifact, update todo_write, " +
+        "and reply with the completed checkpoint plus the next exact step. Do not start another generation batch, " +
+        "install, full validation suite, preview, render, deployment, or other multi-minute stage in this turn. " +
+        "The user can run /continue to start that next stage with a fresh bounded budget.");
+}
 function showRunNotice(opts, message, critical = false) {
     if (opts.quiet)
         return;
@@ -164,11 +171,20 @@ function showRunNotice(opts, message, critical = false) {
         }
     }
 }
+function requestRunCheckpoint(opts, life) {
+    if (life.disposed || life.checkpointDue || life.signal.aborted)
+        return;
+    life.checkpointDue = true;
+    const remainingMs = Math.max(0, life.timeoutMs - (Date.now() - life.startedAt));
+    showRunNotice(opts, `⚠ agent turn nearing its safety pause: ${formatAgentDuration(remainingMs)} remains. The agent will be told to finish the current atomic step and checkpoint; use \`/continue\` for the next expensive stage.`);
+}
 function warnRun(opts, life) {
     if (life.disposed || life.warned || life.signal.aborted)
         return;
     life.warned = true;
-    showRunNotice(opts, `⚠ agent still running: ${formatAgentDuration(Date.now() - life.startedAt)} elapsed, round ${life.rounds}/${life.maxRounds}; hard stop at ${formatAgentDuration(life.timeoutMs)}.`);
+    const elapsedMs = Date.now() - life.startedAt;
+    const remainingMs = Math.max(0, life.timeoutMs - elapsedMs);
+    showRunNotice(opts, `⚠ agent still running: ${formatAgentDuration(elapsedMs)} elapsed, round ${life.rounds}/${life.maxRounds}; ${formatAgentDuration(remainingMs)} remains before this turn pauses. Finish the current step or leave a checklist checkpoint; unfinished session work can resume with \`/continue\`.`);
 }
 function createRunLifecycle(opts) {
     const timeoutMs = agentRunTimeoutMs(opts.timeoutMs);
@@ -189,6 +205,9 @@ function createRunLifecycle(opts) {
     const warningDelay = Math.min(5 * 60_000, Math.max(250, Math.floor(timeoutMs * 0.8)));
     const warningTimer = setTimeout(() => warnRun(opts, life), warningDelay);
     warningTimer.unref?.();
+    const checkpointDelay = Math.max(250, Math.floor(timeoutMs * 0.8));
+    const checkpointTimer = setTimeout(() => requestRunCheckpoint(opts, life), checkpointDelay);
+    checkpointTimer.unref?.();
     let removeStopListener = () => { };
     const stopPromise = new Promise((resolveStopped) => {
         const stopped = () => resolveStopped(RUN_STOPPED);
@@ -203,6 +222,7 @@ function createRunLifecycle(opts) {
         timeoutController,
         timeoutTimer,
         warningTimer,
+        checkpointTimer,
         stopPromise,
         removeStopListener,
         startedAt,
@@ -211,6 +231,8 @@ function createRunLifecycle(opts) {
         rounds: 0,
         timedOut: false,
         warned: false,
+        checkpointDue: false,
+        checkpointInjected: false,
         limitAnnounced: false,
         disposed: false,
         failedCalls: new Map(),
@@ -221,12 +243,13 @@ function disposeRunLifecycle(life) {
     life.disposed = true;
     clearTimeout(life.timeoutTimer);
     clearTimeout(life.warningTimer);
+    clearTimeout(life.checkpointTimer);
     life.removeStopListener();
 }
 function hardStop(opts, life, kind, detail) {
     const elapsedMs = Date.now() - life.startedAt;
     const message = kind === "deadline"
-        ? `⛔ agent run stopped: total deadline ${formatAgentDuration(life.timeoutMs)} reached after ${life.rounds} round(s). No further model or tool calls will start. Increase it with \`hara config set runTimeoutMs 45m\` (maximum 2h) only for intentional long work.`
+        ? `⏸ agent run paused: total deadline ${formatAgentDuration(life.timeoutMs)} reached after ${life.rounds} round(s). No further model or tool calls will start in this turn. Session-backed work keeps its task and checklist checkpoint; type \`/continue\` to resume in a fresh bounded turn. Only for intentionally long single turns, use \`hara config set runTimeoutMs 45m\` (maximum 2h).`
         : kind === "max_rounds"
             ? `⛔ agent run stopped: ${life.maxRounds}-round safety limit reached after ${formatAgentDuration(elapsedMs)}. This usually means the model is looping. Increase it with \`hara config set maxAgentRounds <n>\` (maximum 256) only if the extra rounds are intentional.`
             : `⛔ agent run stopped: the same failing ${detail?.tool ?? "tool"} call repeated ${detail?.count ?? REPEATED_FAILURE_LIMIT} times. Change the approach or fix the reported cause before retrying.`;
@@ -323,6 +346,15 @@ async function runAgentInner(history, opts, life) {
         life.rounds += 1;
         if (life.rounds >= Math.ceil(life.maxRounds * 0.75))
             warnRun(opts, life);
+        if (Date.now() - life.startedAt >= Math.floor(life.timeoutMs * 0.8))
+            requestRunCheckpoint(opts, life);
+        if (!opts.quiet && life.checkpointDue && !life.checkpointInjected) {
+            life.checkpointInjected = true;
+            history.push({
+                role: "user",
+                content: wrapReminders([deadlineCheckpointReminder(life.timeoutMs)]),
+            });
+        }
         // Type-ahead steering: fold in anything the user submitted while the previous step ran, so it
         // reaches the model on this next call (drained after the last tool round; empty on the 1st pass).
         if (opts.pendingInput && !runSignal.aborted) {

package/dist/checkpoints.js

@@ -10,7 +10,7 @@ import { dirname, join } from "node:path";
 import { homedir } from "node:os";
 import { createHash } from "node:crypto";
 import { findProjectRoot } from "./context/agents-md.js";
-import { isHomeWorkspace } from "./context/workspace-scope.js";
+import { isUnsafeProjectWorkspace } from "./context/workspace-scope.js";
 import { toolSubprocessEnv } from "./security/subprocess-env.js";
 import { sensitiveFileReason } from "./security/sensitive-files.js";
 import { redactSensitiveText } from "./security/secrets.js";
@@ -107,7 +107,7 @@ function dropSensitiveIndexEntries(root, gitDir) {
 export function checkpoint(cwd, label) {
     // A shadow `git add -A` at ~/ would traverse the user's entire personal/control-data scope. Home is
     // deliberately not an implicit project, including when reached through a symlink alias.
-    if (isHomeWorkspace(cwd))
+    if (isUnsafeProjectWorkspace(cwd))
         return null;
     const root = findProjectRoot(cwd);
     const gitDir = shadowGitDir(root);
@@ -138,7 +138,7 @@ export function checkpoint(cwd, label) {
 }
 /** Recent checkpoints, newest first. */
 export function listCheckpoints(cwd, n = 15) {
-    if (isHomeWorkspace(cwd))
+    if (isUnsafeProjectWorkspace(cwd))
         return [];
     const root = findProjectRoot(cwd);
     const gitDir = shadowGitDir(root);
@@ -163,7 +163,7 @@ export function listCheckpoints(cwd, n = 15) {
 export function restoreCheckpoint(cwd, ref) {
     if (!/^[0-9a-f]{4,64}$/i.test(ref))
         return null; // checkpoint refs are hashes; reject option/ref injection
-    if (isHomeWorkspace(cwd))
+    if (isUnsafeProjectWorkspace(cwd))
         return null;
     const root = findProjectRoot(cwd);
     const gitDir = shadowGitDir(root);

package/dist/context/workspace-scope.js

@@ -1,6 +1,6 @@
-import { realpathSync } from "node:fs";
-import { homedir } from "node:os";
+import { realpathSync, statSync } from "node:fs";
 import { isAbsolute, relative, resolve, sep } from "node:path";
+import { effectiveHomeDir } from "../runtime.js";
 /** Resolve existing paths through symlinks before comparing security/workspace scopes. Falling back to
  *  resolve() keeps messages deterministic for a path that disappears during startup; normal cwd/home paths
  *  exist and therefore take the realpath branch. */
@@ -14,21 +14,25 @@ export function canonicalWorkspacePath(path) {
     }
 }
 /** The user's home directory is a control/personal-data scope, not an implicit project workspace. */
-export function isHomeWorkspace(cwd, home = homedir()) {
+export function isHomeWorkspace(cwd, home = effectiveHomeDir()) {
     return canonicalWorkspacePath(cwd) === canonicalWorkspacePath(home);
 }
 /** A recursive root is unsafe when it is Home itself OR an ancestor that would descend into Home. This
  * closes `path: ".."`, filesystem-root, and symlink-alias bypasses while keeping an explicitly selected
  * project child under Home usable. */
-export function recursiveRootContainsHome(root, home = homedir()) {
+export function recursiveRootContainsHome(root, home = effectiveHomeDir()) {
     const canonicalRoot = canonicalWorkspacePath(root);
     const canonicalHome = canonicalWorkspacePath(home);
     const rel = relative(canonicalRoot, canonicalHome);
     return rel === "" || (rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel));
 }
+/** Project-scoped execution from Home OR one of its ancestors can implicitly reach private user state. */
+export function isUnsafeProjectWorkspace(cwd, home = effectiveHomeDir()) {
+    return recursiveRootContainsHome(cwd, home);
+}
 export function homeWorkspaceActionError(action) {
-    return (`Refusing to ${action} from the home directory: it is not an implicit project workspace. ` +
-        "Run `cd /path/to/project` first, or launch with `hara --cwd /path/to/project`.");
+    return (`Refusing to ${action} from a workspace that is the home directory or contains it: it is not an implicit project workspace. ` +
+        "Use `/cd /path/to/project`, run `cd /path/to/project` first, or launch with `hara --cwd /path/to/project`.");
 }
 export function recursiveHomeSearchError(tool) {
     return (`Error: ${tool} will not recursively scan the home directory. ` +
@@ -43,11 +47,44 @@ export function homeWorkspaceDirectoryScanError(tool) {
 /** Injected into model context when Hara was intentionally launched at ~/. Runtime checks enforce the same
  *  policy, but guidance avoids wasting turns on calls that are guaranteed to be rejected. */
 export function homeWorkspaceGuidance(cwd) {
-    if (!isHomeWorkspace(cwd))
+    if (!isUnsafeProjectWorkspace(cwd))
         return "";
     return ("# Home-directory workspace boundary\n" +
-        "The working directory resolves to the user's home directory, which is not an implicit project. " +
+        "The working directory resolves to the user's home directory or an ancestor that contains it, which is not an implicit project. " +
         "Do not initialize a project, create or modify files, build a repository index, run shell/external " +
         "executable tools, enumerate directories, or grep/glob/search Home or one of its child directories. " +
-        "Ask the user to run `cd /path/to/project` or `hara --cwd /path/to/project` for project work. Only explicitly named single-file reads remain available.");
+        "Ask the user to switch with `/cd /path/to/project`, run `cd /path/to/project`, or launch with " +
+        "`hara --cwd /path/to/project` for project work. Only explicitly named single-file reads remain available.");
+}
+/** Resolve an explicit interactive workspace handoff without accepting Home/ancestor scopes. */
+export function resolveWorkspaceSwitch(input, currentCwd, home = effectiveHomeDir()) {
+    let requested = input.trim();
+    if (!requested)
+        return { ok: false, error: "usage: /cd <project-directory>" };
+    if (requested.length >= 2
+        && ((requested.startsWith('"') && requested.endsWith('"')) || (requested.startsWith("'") && requested.endsWith("'"))))
+        requested = requested.slice(1, -1).trim();
+    if (!requested)
+        return { ok: false, error: "usage: /cd <project-directory>" };
+    if (requested === "~")
+        requested = home;
+    else if (/^~[\\/]/u.test(requested)) {
+        const parts = requested.slice(2).split(/[\\/]+/u).filter(Boolean);
+        requested = resolve(home, ...parts);
+    }
+    try {
+        const target = realpathSync.native(resolve(currentCwd, requested));
+        if (!statSync(target).isDirectory())
+            return { ok: false, error: `not a directory: ${requested}` };
+        if (isUnsafeProjectWorkspace(target, home)) {
+            return { ok: false, error: homeWorkspaceActionError("switch project scope") };
+        }
+        return { ok: true, cwd: target };
+    }
+    catch (error) {
+        return {
+            ok: false,
+            error: `cannot switch to '${requested}': ${error instanceof Error ? error.message : String(error)}`,
+        };
+    }
 }

package/dist/index.js

@@ -70,13 +70,14 @@ function renderBgJobs() {
 }
 import { qwenDeviceLogin, getValidQwenAuth, loadQwenToken } from "./providers/qwen-oauth.js";
 import { loadAgentContext, hasAgentsMd, INIT_PROMPT, findProjectRoot } from "./context/agents-md.js";
-import { homeWorkspaceActionError, isHomeWorkspace } from "./context/workspace-scope.js";
+import { homeWorkspaceActionError, isUnsafeProjectWorkspace, resolveWorkspaceSwitch, } from "./context/workspace-scope.js";
 import { getEmbedder } from "./search/embed.js";
 import { collectRepoChunksAsync, collectDirChunksAsync, buildIndex, indexPath, indexExists } from "./search/semindex.js";
 import { searchHybrid } from "./search/hybrid.js";
 import { expandMentionsAsync, fileCandidates, isSlashCommand, inlineLeadingPath } from "./context/mentions.js";
 import { newSessionId, shortId, resolveSessionId, validSessionId, sessionFileExists, saveSession, loadSession, acquireSessionLock, releaseSessionLock, listSessions, latestForCwd, titleFrom, sessionSourceFromEnv, automatedTitle, slugify, } from "./session/store.js";
 import { consumePendingTaskSteering, continueTaskExecution, createTaskExecution, finishTaskExecution, formatTaskExecution, hasPendingTaskSteering, newSteerInteraction, newTurnInteraction, recordTaskSteering, recoverTaskExecution, requestsTaskContinuation, taskExecutionContext, } from "./session/task.js";
+import { displaySessionCwd, resolveSessionResumeTarget } from "./session/resume.js";
 import { setSessionForceModel, isSessionForceModel, effectiveRoleModel } from "./session/session-model.js";
 import { loadGlobalRoles, loadRoles, roleToolFilter, scaffoldRoles, subagentToolFilter } from "./org/roles.js";
 import { buildAgentsIndex, canonicalProjectPath, resolveAgent, loadProjects, addProject, removeProject } from "./org/projects.js";
@@ -392,7 +393,7 @@ function agentRunLimits(cfg) {
     return { timeoutMs: cfg.runTimeoutMs, maxRounds: cfg.maxAgentRounds };
 }
 async function runInit(provider, cwd, sandbox = "off", cfg) {
-    if (isHomeWorkspace(cwd))
+    if (isUnsafeProjectWorkspace(cwd))
         throw new Error(homeWorkspaceActionError("initialize AGENTS.md"));
     const history = [{ role: "user", content: INIT_PROMPT }];
     await runAgent(history, { provider, ctx: { cwd, sandbox }, approval: "full-auto", confirm: async () => true, ...(cfg ? agentRunLimits(cfg) : {}) });
@@ -1139,7 +1140,7 @@ program
     .description("analyze the project and (re)generate AGENTS.md")
     .action(async () => {
     const cfg = loadConfig();
-    if (isHomeWorkspace(cfg.cwd)) {
+    if (isUnsafeProjectWorkspace(cfg.cwd)) {
         out(c.red(homeWorkspaceActionError("initialize AGENTS.md")) + "\n");
         process.exitCode = 2;
         return;
@@ -1163,34 +1164,40 @@ program
     }
     for (const m of metas) {
         out(`${c.bold(shortId(m.id))}  ${c.dim(m.updatedAt.slice(0, 16).replace("T", " "))}  ${c.dim(m.provider + ":" + m.model)}  ${m.title || c.dim("(untitled)")}\n`);
+        out(`          ${c.dim(displaySessionCwd(m.cwd))}\n`);
     }
     out(c.dim("\nResume:  hara resume <id>\n"));
 });
 program
     .command("resume [id]")
-    .description("resume a session — no id resumes the most recent here (list ids with `hara sessions`)")
+    .description("resume a session in its saved project — no id resumes the most recent here")
     .action(async (id) => {
-    let full;
-    if (id) {
-        full = resolveSessionId(id) ?? undefined;
-        if (!full) {
-            out(c.red(`No session matching '${id}'.`) + c.dim(" Run `hara sessions` to list.\n"));
-            process.exit(1);
+    const target = resolveSessionResumeTarget(id, process.cwd());
+    if (!target.ok) {
+        if (target.reason === "not-found") {
+            out(c.red(`No session matching '${id ?? ""}'.`) + c.dim(" Run `hara sessions` to list.\n"));
+            process.exitCode = 1;
         }
-    }
-    else {
-        const latest = latestForCwd(process.cwd());
-        if (!latest) {
-            out(c.dim("No sessions for this directory yet — `hara sessions` lists all.\n"));
-            process.exit(0);
+        else if (target.reason === "no-current") {
+            out(c.dim("No sessions for this directory yet — `hara sessions` lists all projects.\n"));
+        }
+        else if (target.reason === "unreadable") {
+            out(c.red(`Session ${shortId(target.id ?? id ?? "")} exists but is unreadable or corrupt; refusing to resume it.\n`));
+            process.exitCode = 2;
         }
-        full = latest.meta.id;
+        else {
+            out(c.red(`Session ${shortId(target.id ?? id ?? "")} belongs to ${target.cwd}, but that project directory is unavailable.\n`));
+            process.exitCode = 2;
+        }
+        return;
     }
-    out(c.dim(`↩ resuming ${shortId(full)}…\n`));
+    out(c.dim(`↩ resuming ${shortId(target.id)} in ${displaySessionCwd(target.cwd)}…\n`));
     // Reuse the existing --resume path exactly (one engine), inheriting this terminal. selfArgv() inside
     // runSelfAttached distinguishes node+entry from a Bun-compiled binary (whose argv[1] is a user arg).
+    // Launch from the persisted project root: the low-level --resume engine intentionally refuses a
+    // foreign cwd so a transcript can never be reinterpreted against the wrong repository.
     try {
-        const result = await runSelfAttached(["--resume", full]);
+        const result = await runSelfAttached(["--resume", target.id], target.cwd);
         if (result.signal) {
             out(c.yellow(`Resumed Hara process stopped by ${result.signal}.\n`));
             process.exitCode = 1;
@@ -1374,7 +1381,7 @@ program
     const cwd = process.cwd();
     let doRepo = !!(opts.all || opts.repo || (!opts.assets && !opts.all));
     const doAssets = !!(opts.all || opts.assets);
-    if (doRepo && isHomeWorkspace(cwd)) {
+    if (doRepo && isUnsafeProjectWorkspace(cwd)) {
         if (!doAssets) {
             out(c.red(homeWorkspaceActionError("build a repository index")) + "\n");
             process.exitCode = 2;
@@ -2782,7 +2789,7 @@ program.action(async (opts) => {
     }
     const cfg = loadConfig({ overlay: opts.overlay, ...(requestedHeadlessAgent?.home ? { cwd: requestedHeadlessAgent.home } : {}) });
     const cwd = cfg.cwd;
-    const homeWorkspace = isHomeWorkspace(cwd);
+    const homeWorkspace = isUnsafeProjectWorkspace(cwd);
     // Resolve the concrete role before constructing any user/plugin MCP transport. MCP servers are arbitrary
     // stdio subprocesses, so a read-only persona must not start them merely by launching a turn. Reusing this
     // object later also closes the resolve→connect→re-resolve race where a role could disappear or change policy.
@@ -3248,7 +3255,7 @@ program.action(async (opts) => {
     const useTui = stdin.isTTY && stdout.isTTY && process.env.HARA_TUI !== "0";
     out(c.bold(`hara ${pkg.version}`) + c.dim(`  ·  ${cfg.provider}:${cfg.model}  ·  ${approval}${sandbox !== "off" ? `  ·  sandbox:${sandbox}` : ""}  ·  ${cwd}\n`));
     if (homeWorkspace) {
-        out(c.yellow("⚠ Home directory is not treated as a project workspace. Run `cd /path/to/project` or `hara --cwd /path/to/project`; recursive project scans are disabled here.\n"));
+        out(c.yellow("⚠ Home or a directory containing it is not treated as a project workspace. Switch with `/cd /path/to/project`, or launch with `hara --cwd /path/to/project`; project-scoped execution is disabled here.\n"));
     }
     // Startup update notice — cache-driven (a previous session's background probe), so it costs zero
     // latency; today's probe (if due) fires in the background for the NEXT launch. TTY sessions only.
@@ -3417,6 +3424,51 @@ program.action(async (opts) => {
     }
     const history = resumed?.history ? [...resumed.history] : [];
     const persistSession = () => saveSession(meta, history, task);
+    let requestedWorkspaceSwitch = null;
+    let requestedSessionSwitch = null;
+    const relaunchRequestedTarget = async () => {
+        if (!requestedWorkspaceSwitch && !requestedSessionSwitch)
+            return;
+        const sessionSwitch = requestedSessionSwitch;
+        const target = sessionSwitch?.cwd ?? requestedWorkspaceSwitch;
+        requestedWorkspaceSwitch = null;
+        requestedSessionSwitch = null;
+        // The foreground child starts a new session. Do not keep the old session artificially locked for the
+        // entire lifetime of the new workspace merely because this small parent process is waiting on it.
+        releaseSessionLock(sessionId);
+        const args = [];
+        if (opts.profile)
+            args.push("--profile", String(opts.profile));
+        if (opts.overlay)
+            args.push("--overlay", String(opts.overlay));
+        if (opts.model)
+            args.push("--model", String(opts.model));
+        if (opts.yes)
+            args.push("--yes");
+        else if (opts.approval)
+            args.push("--approval", String(opts.approval));
+        if (opts.sandbox)
+            args.push("--sandbox", String(opts.sandbox));
+        if (sessionSwitch)
+            args.push("--resume", sessionSwitch.id);
+        out(c.dim(sessionSwitch
+            ? `Resuming session ${shortId(sessionSwitch.id)} → ${displaySessionCwd(target)}\n`
+            : `Switching workspace → ${target}\n`));
+        try {
+            const result = await runSelfAttached(args, target);
+            if (result.signal) {
+                out(c.yellow(`Hara in ${target} stopped by ${result.signal}.\n`));
+                process.exitCode = 1;
+            }
+            else if (result.code) {
+                process.exitCode = result.code;
+            }
+        }
+        catch (error) {
+            out(c.red(`Could not start Hara in ${target}: ${error instanceof Error ? error.message : String(error)}\n`));
+            process.exitCode = 1;
+        }
+    };
     const keepUnfinishedTaskActive = () => {
         resumeTaskPending = Boolean(task && task.status !== "completed");
     };
@@ -3460,14 +3512,51 @@ program.action(async (opts) => {
     };
     const commands = [
         { name: "help", desc: "show this help", run: () => void out(helpText(commands)) },
+        {
+            name: "cd",
+            desc: "switch to a project workspace: /cd <directory>",
+            run: (a) => {
+                const result = resolveWorkspaceSwitch(a, cwd);
+                if (!result.ok)
+                    return void out(c.red(`(${result.error})\n`));
+                if (result.cwd === realpathSync.native(cwd))
+                    return void out(c.dim(`(already in ${result.cwd})\n`));
+                requestedWorkspaceSwitch = result.cwd;
+                return "exit";
+            },
+        },
         {
             name: "continue",
-            aliases: ["resume"],
             desc: "resume the unfinished task: /continue [instruction]",
             // Interactive loops translate this command into an ordinary model turn before slash dispatch. This
             // fallback only protects future callers that invoke the command table directly.
             run: () => void out(c.dim("(type /continue [instruction] in an interactive session)\n")),
         },
+        {
+            name: "resume",
+            desc: "switch to a saved session: /resume <id>",
+            run: (a) => {
+                if (!a.trim()) {
+                    const ms = listSessions().slice(0, 12);
+                    if (!ms.length)
+                        return void out(c.dim("No sessions yet.\n"));
+                    for (const m of ms) {
+                        out(`  ${shortId(m.id)}  ${c.dim(displaySessionCwd(m.cwd))}  ${m.title || "(untitled)"}\n`);
+                    }
+                    return void out(c.dim("Use /resume <id> to switch sessions.\n"));
+                }
+                const target = resolveSessionResumeTarget(a.trim(), cwd);
+                if (!target.ok) {
+                    if (target.reason === "cwd-unavailable")
+                        return void out(c.red(`(saved project unavailable: ${target.cwd})\n`));
+                    return void out(c.red(`(cannot resume '${a.trim()}': ${target.reason})\n`));
+                }
+                if (target.id === sessionId)
+                    return void out(c.dim("(this session is already open)\n"));
+                requestedSessionSwitch = { id: target.id, cwd: target.cwd };
+                return "exit";
+            },
+        },
         {
             name: "init",
             desc: "analyze project & regenerate AGENTS.md",
@@ -3637,7 +3726,7 @@ program.action(async (opts) => {
                 if (!ms.length)
                     return void out(c.dim("No sessions yet.\n"));
                 for (const m of ms)
-                    out(`  ${shortId(m.id)}  ${c.dim(m.updatedAt.slice(0, 16).replace("T", " "))}  ${m.title || "(untitled)"}\n`);
+                    out(`  ${shortId(m.id)}  ${c.dim(m.updatedAt.slice(0, 16).replace("T", " "))}  ${c.dim(displaySessionCwd(m.cwd))}  ${m.title || "(untitled)"}\n`);
             },
         },
         {
@@ -3994,7 +4083,7 @@ program.action(async (opts) => {
                 // never saw update notices and versions silently went stale (field report: stuck on 0.112.5)
                 updateNotice: cfg.updateCheck ? (checkForUpdate(pkg.version) ?? undefined) : undefined,
                 workspaceNotice: homeWorkspace
-                    ? "Home is not a project workspace · cd there or use hara --cwd /path/to/project"
+                    ? "Home is not a project workspace · use /cd /path/to/project to switch"
                     : undefined,
             },
             visionNotice: __visionNotice,
@@ -4004,7 +4093,7 @@ program.action(async (opts) => {
             onSubmit: async (line, h, images, interaction) => {
                 // `/continue` is a task interaction, not a control-only command: turn it into a model message before
                 // slash dispatch, preserving the submitted turn id while explicitly targeting the unfinished task.
-                const continueCommand = /^\/(?:continue|resume)(?:\s+([\s\S]+))?$/i.exec(line.trim());
+                const continueCommand = /^\/continue(?:\s+([\s\S]+))?$/i.exec(line.trim());
                 if (continueCommand) {
                     if (!task || task.status === "completed")
                         return void h.sink.notice("(there is no unfinished task to continue)");
@@ -4020,6 +4109,35 @@ program.action(async (opts) => {
                 if (isSlashCommand(line)) {
                     const [nm, ...rest] = line.slice(1).split(/\s+/);
                     const arg = rest.join(" ").trim();
+                    if (nm === "cd") {
+                        const result = resolveWorkspaceSwitch(arg, cwd);
+                        if (!result.ok)
+                            return void h.sink.notice(`(${result.error})`);
+                        if (result.cwd === realpathSync.native(cwd))
+                            return void h.sink.notice(`(already in ${result.cwd})`);
+                        requestedWorkspaceSwitch = result.cwd;
+                        h.sink.notice(`(switching workspace → ${result.cwd})`);
+                        return void h.exit();
+                    }
+                    if (nm === "resume") {
+                        if (!arg) {
+                            const ms = listSessions().slice(0, 12);
+                            return void h.sink.notice(ms.length
+                                ? "Saved sessions — /resume <id>:\n" + ms.map((m) => `  ${shortId(m.id)}  ${displaySessionCwd(m.cwd)}  ${m.title || "(untitled)"}`).join("\n")
+                                : "No sessions yet.");
+                        }
+                        const target = resolveSessionResumeTarget(arg, cwd);
+                        if (!target.ok) {
+                            if (target.reason === "cwd-unavailable")
+                                return void h.sink.notice(`(saved project unavailable: ${target.cwd})`);
+                            return void h.sink.notice(`(cannot resume '${arg}': ${target.reason})`);
+                        }
+                        if (target.id === sessionId)
+                            return void h.sink.notice("(this session is already open)");
+                        requestedSessionSwitch = { id: target.id, cwd: target.cwd };
+                        h.sink.notice(`(resuming ${shortId(target.id)} → ${displaySessionCwd(target.cwd)})`);
+                        return void h.exit();
+                    }
                     if (nm === "exit" || nm === "quit") {
                         if (shouldAutoEvolve(cfg.evolve, history.length)) {
                             h.sink.notice("✻ distilling session learnings…");
@@ -4222,7 +4340,7 @@ program.action(async (opts) => {
                     }
                     if (nm === "sessions") {
                         const ms = listSessions();
-                        return void h.sink.notice(ms.length ? ms.slice(0, 12).map((m) => `  ${shortId(m.id)}  ${m.updatedAt.slice(0, 16).replace("T", " ")}  ${m.title || "(untitled)"}`).join("\n") : "No sessions yet.");
+                        return void h.sink.notice(ms.length ? ms.slice(0, 12).map((m) => `  ${shortId(m.id)}  ${m.updatedAt.slice(0, 16).replace("T", " ")}  ${displaySessionCwd(m.cwd)}  ${m.title || "(untitled)"}`).join("\n") : "No sessions yet.");
                     }
                     if (nm === "usage")
                         return void h.sink.notice(`tokens — ↑${stats.input} ↓${stats.output}`);
@@ -4598,7 +4716,8 @@ program.action(async (opts) => {
         if (loadSession(meta.id))
             out("\n" + c.dim("Session ") + c.bold(shortId(meta.id)) + c.dim(" saved · resume:  ") + c.cyan(`hara resume ${shortId(meta.id)}`) + "\n");
         await closeMcp();
-        process.exit(0); // TUI done — exit cleanly (ink can leave stdin referenced)
+        await relaunchRequestedTarget();
+        process.exit(process.exitCode ?? 0); // TUI done — exit cleanly (ink can leave stdin referenced)
     }
     out(c.dim(`Type a task. /help · @path attaches a file · shift+tab cycles mode · Esc interrupts · /exit to quit.${hasAgentsMd(cwd) ? "  (AGENTS.md loaded)" : ""}\n\n`));
     bar.install({ sessionName: meta.title || shortId(meta.id), model: cfg.model, approval, input: stats.input, output: stats.output, profileId: __activeP.id, profileKind: __activeP.kind });
@@ -4623,7 +4742,7 @@ program.action(async (opts) => {
         if (!line)
             continue;
         let forcedContinuation;
-        const continueCommand = /^\/(?:continue|resume)(?:\s+([\s\S]+))?$/i.exec(line);
+        const continueCommand = /^\/continue(?:\s+([\s\S]+))?$/i.exec(line);
         if (continueCommand) {
             if (!task || task.status === "completed") {
                 out(c.dim("(there is no unfinished task to continue)\n"));
@@ -4766,9 +4885,11 @@ program.action(async (opts) => {
         }
     }
     bar.uninstall();
-    out("\n" + c.dim("Session ") + c.bold(shortId(meta.id)) + c.dim(" saved · resume:  ") + c.cyan(`hara resume ${shortId(meta.id)}`) + "\n");
+    if (loadSession(meta.id))
+        out("\n" + c.dim("Session ") + c.bold(shortId(meta.id)) + c.dim(" saved · resume:  ") + c.cyan(`hara resume ${shortId(meta.id)}`) + "\n");
     rl.close();
     await closeMcp();
+    await relaunchRequestedTarget();
 });
 program.parseAsync().catch((e) => {
     try {

package/dist/runtime.js

@@ -1,3 +1,4 @@
+import { homedir } from "node:os";
 export const MIN_NODE_MAJOR = 22;
 // Commander 15 (a direct runtime dependency) requires this exact floor. Keep package engines, startup,
 // doctor, and docs aligned so an early Node 22 release gets an upgrade hint before dependencies load.
@@ -26,6 +27,18 @@ export function normalizePortableWindowsHome(value) {
         return home[0].toUpperCase() + home.slice(1).replace(/\//g, "\\");
     return home;
 }
+/**
+ * Resolve the same user home even when Hara modules are embedded directly instead of entered through
+ * `cli.ts`/`runtime-bootstrap.cjs`. Native Windows Node ignores HOME in `os.homedir()`, while Git Bash and
+ * portable launchers intentionally use it. Keeping this resolver side-effect free lets security/workspace
+ * checks honor that explicit boundary without requiring callers to mutate their environment first.
+ */
+export function effectiveHomeDir(env = process.env, runtimePlatform = process.platform, systemHome = homedir()) {
+    const explicit = String(env.HOME ?? "").trim();
+    if (!explicit)
+        return systemHome;
+    return runtimePlatform === "win32" ? normalizePortableWindowsHome(explicit) : explicit;
+}
 function supportedNodeVersion(version) {
     const match = /^(\d+)\.(\d+)\.(\d+)$/.exec(version);
     if (!match)

package/dist/sandbox.js

@@ -13,7 +13,7 @@ import { platform } from "node:os";
 import { win32 as winPath } from "node:path";
 import { existingSensitiveSeatbeltMasks, sensitiveFilesAllowed, sensitiveShellCommandReason, } from "./security/sensitive-files.js";
 import { terminateSubprocessTree, toolSubprocessEnv } from "./security/subprocess-env.js";
-import { homeWorkspaceActionError, isHomeWorkspace } from "./context/workspace-scope.js";
+import { homeWorkspaceActionError, isUnsafeProjectWorkspace } from "./context/workspace-scope.js";
 // Windows shell resolution. hara (and the model) speak POSIX shell — the agent writes `ls`, `grep`,
 // `cat`, pipes, `&&`. So on Windows we PREFER a real bash (Git Bash or WSL, which most Windows devs
 // have) and only fall back to cmd.exe when none is found. Memoized: the PATH probe runs at most once.
@@ -126,7 +126,7 @@ let warnedUnsandboxed = false; // emit the "macOS-only" notice at most once per
 export function shellCommand(command, cwd, mode) {
     // Shell syntax can recursively traverse arbitrary paths, so unlike explicit read/write tools it is not
     // safe at the Home root. Check before protected-file mask discovery, which itself would have to walk ~/.
-    if (isHomeWorkspace(cwd))
+    if (isUnsafeProjectWorkspace(cwd))
         throw new Error(homeWorkspaceActionError("run shell commands"));
     const protectedReason = sensitiveShellCommandReason(command, cwd);
     if (protectedReason) {

package/dist/search/semindex.js

@@ -11,7 +11,7 @@ import { listProjectFiles, listProjectFilesAsync, walkFiles, walkFilesAsync, } f
 import { zvecBuild, zvecQueryIds, zvecRemove } from "./zvec-store.js";
 import { isSensitiveFilePath } from "../security/sensitive-files.js";
 import { readModelContextFileSync } from "../fs-read.js";
-import { homeWorkspaceActionError, isHomeWorkspace } from "../context/workspace-scope.js";
+import { homeWorkspaceActionError, isUnsafeProjectWorkspace } from "../context/workspace-scope.js";
 import { ensurePrivateStateSubdirectory, readPrivateStateFileSnapshot, removePrivateStateFile, } from "../security/private-state.js";
 import { atomicWriteText, bindHaraPrivateStateWritePath, } from "../fs-write.js";
 // Same code/text extensions codebase_search ranks lexically — keep the two walks in sync.
@@ -52,7 +52,7 @@ async function ensurePrivateIndexState(name, cwd) {
 }
 function existingPrivateIndexPath(name, cwd) {
     try {
-        if (name === "repo" && isHomeWorkspace(cwd))
+        if (name === "repo" && isUnsafeProjectWorkspace(cwd))
             return null;
         const requested = indexPath(name, cwd);
         const base = realpathSync.native(indexBase(name, cwd));
@@ -132,7 +132,7 @@ async function rotateLegacyIndex(name, cwd, state) {
 export async function buildIndex(name, chunks, embed, cwd, model = "embed", signal) {
     if (signal?.aborted)
         throw new Error("semantic index build interrupted");
-    if (name === "repo" && isHomeWorkspace(cwd))
+    if (name === "repo" && isUnsafeProjectWorkspace(cwd))
         throw new Error(homeWorkspaceActionError("build a repository index"));
     const state = await ensurePrivateIndexState(name, cwd);
     const p = state.path;
@@ -254,7 +254,7 @@ export function collectDirChunks(dir, source) {
 }
 /** Walk the repo (respecting .gitignore) and chunk every code/text file — the corpus `hara index` embeds. */
 export function collectRepoChunks(root) {
-    if (isHomeWorkspace(root))
+    if (isUnsafeProjectWorkspace(root))
         throw new Error(homeWorkspaceActionError("scan the home directory for a repository index"));
     const chunks = [];
     for (const rel of listProjectFiles(root)) {
@@ -315,7 +315,7 @@ export async function collectDirChunksAsync(dir, source, options = {}) {
 }
 /** Interruptible repository collection. Git discovery and file reads share one total wall budget. */
 export async function collectRepoChunksAsync(root, options = {}) {
-    if (isHomeWorkspace(root))
+    if (isUnsafeProjectWorkspace(root))
         throw new Error(homeWorkspaceActionError("scan the home directory for a repository index"));
     const timeoutMs = Number.isFinite(options.timeoutMs) ? Math.max(0, Math.floor(options.timeoutMs)) : 30_000;
     const startedAt = Date.now();

package/dist/security/permissions.js

@@ -15,7 +15,7 @@ import { closeSync, existsSync, fstatSync, fsyncSync, linkSync, lstatSync, mkdir
 import { psArgumentsExposeEnvironment } from "./sensitive-files.js";
 import { projectRepositoryTrustedAtStartup } from "./project-trust.js";
 import { readVerifiedRegularFileSnapshotSync } from "../fs-read.js";
-import { homeWorkspaceActionError, isHomeWorkspace } from "../context/workspace-scope.js";
+import { homeWorkspaceActionError, isHomeWorkspace, isUnsafeProjectWorkspace } from "../context/workspace-scope.js";
 import { sameOpenedFileIdentity } from "../fs-identity.js";
 const PROJECT_ROOT_MARKERS = [".git", "package.json", "Cargo.toml", "go.mod", "pyproject.toml", ".hg"];
 const MAX_PROJECT_PERMISSIONS_BYTES = 64 * 1024;
@@ -436,7 +436,7 @@ function scaffoldProjectPermissions(cwd) {
     const project = realpathSync.native(resolve(cwd));
     // Project scaffolding at ~/ would target the same ~/.hara/permissions.json used by global policy and
     // silently promote repository starter rules to every Hara session. Reject before creating `.hara`.
-    if (isHomeWorkspace(project))
+    if (isUnsafeProjectWorkspace(project))
         throw new Error(homeWorkspaceActionError("create project permissions"));
     const projectIdentity = verifiedDirectory(project);
     const parent = join(project, ".hara");

package/dist/session/resume.js

@@ -0,0 +1,52 @@
+import { homedir } from "node:os";
+import { isAbsolute, relative, sep } from "node:path";
+import { canonicalProjectPath } from "../org/projects.js";
+import { latestForCwd, loadSession, resolveSessionId, sessionFileExists, } from "./store.js";
+/**
+ * Resolve the execution root before relaunching an interactive session.
+ *
+ * The low-level `--resume` path still rejects a foreign cwd. This resolver is for the explicit,
+ * user-facing `hara resume <id>` transition: it binds the attached child to the session's persisted
+ * project root so invoking the command from another directory cannot reinterpret the transcript there.
+ */
+export function resolveSessionResumeTarget(idOrPrefix, currentCwd) {
+    let id;
+    if (idOrPrefix) {
+        id = resolveSessionId(idOrPrefix) ?? undefined;
+        if (!id)
+            return { ok: false, reason: "not-found" };
+    }
+    else {
+        const latest = latestForCwd(currentCwd);
+        if (!latest)
+            return { ok: false, reason: "no-current" };
+        id = latest.meta.id;
+    }
+    const session = loadSession(id);
+    if (!session) {
+        return {
+            ok: false,
+            reason: sessionFileExists(id) ? "unreadable" : "not-found",
+            id,
+        };
+    }
+    const cwd = canonicalProjectPath(session.meta.cwd, true);
+    if (!cwd) {
+        return {
+            ok: false,
+            reason: "cwd-unavailable",
+            id,
+            cwd: session.meta.cwd,
+        };
+    }
+    return { ok: true, id, cwd, meta: session.meta };
+}
+/** Compact a persisted absolute project path for session lists without losing its identity. */
+export function displaySessionCwd(cwd, home = homedir()) {
+    const rel = relative(home, cwd);
+    if (rel === "")
+        return "~";
+    if (rel && !rel.startsWith(`..${sep}`) && rel !== ".." && !isAbsolute(rel))
+        return `~${sep}${rel}`;
+    return cwd;
+}

package/dist/session/store.js

@@ -4,7 +4,15 @@ import { join } from "node:path";
 import { chmodSync, closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync, } from "node:fs";
 import { randomUUID } from "node:crypto";
 import { redactSensitiveValue } from "../security/secrets.js";
+import { readVerifiedRegularFileSnapshotSync } from "../fs-read.js";
 import { isTaskExecution } from "./task.js";
+/** Durable transcripts are local input on resume. Bound both allocation and post-parse traversal so a
+ * corrupt/hostile session cannot turn startup or `hara sessions` into an unbounded resource operation. */
+export const MAX_SESSION_FILE_BYTES = 64 * 1024 * 1024;
+export const MAX_SESSION_JSON_DEPTH = 64;
+export const MAX_SESSION_JSON_NODES = 250_000;
+export const MAX_SESSION_ARRAY_ITEMS = 50_000;
+export const MAX_SESSION_STRING_CHARS = 8 * 1024 * 1024;
 /** Derive the session source from the spawn environment — the gateway subprocess runs with
  *  HARA_GATEWAY=<platform>, the cron runner with HARA_CRON=1 (+ HARA_CRON_NAME=<job name>). */
 export function sessionSourceFromEnv() {
@@ -382,13 +390,21 @@ function redactedSessionCopy(data) {
 export function saveSession(meta, history, task) {
     checkedSessionId(meta.id);
     meta.updatedAt = new Date().toISOString();
-    const safe = redactedSessionCopy({ meta, history, ...(task ? { task } : {}) });
+    const data = { meta, history, ...(task ? { task } : {}) };
+    if (!sessionValueWithinLimits(data)) {
+        throw new Error("session exceeds Hara's safe persistence complexity limit; compact or start a new session");
+    }
+    const safe = redactedSessionCopy(data);
+    const encoded = JSON.stringify(safe, null, 2);
+    if (Buffer.byteLength(encoded, "utf8") > MAX_SESSION_FILE_BYTES) {
+        throw new Error("session exceeds Hara's 64 MiB persistence limit; compact or start a new session");
+    }
     const target = sessionFile(meta.id);
     const tmp = `${target}.${process.pid}.${randomUUID()}.tmp`;
     let fd;
     try {
         fd = openSync(tmp, "wx", 0o600);
-        writeFileSync(fd, JSON.stringify(safe, null, 2), "utf8");
+        writeFileSync(fd, encoded, "utf8");
         fsyncSync(fd);
         closeSync(fd);
         fd = undefined;
@@ -480,6 +496,32 @@ function isSessionMeta(value) {
         (meta.archived === undefined || typeof meta.archived === "boolean") &&
         (meta.gatewayOwner === undefined || typeof meta.gatewayOwner === "string"));
 }
+/** Iterative on purpose: reject excessive nesting before recursive redaction/validation can exhaust stack. */
+function sessionValueWithinLimits(value) {
+    const pending = [{ value, depth: 0 }];
+    let nodes = 0;
+    while (pending.length) {
+        const current = pending.pop();
+        nodes += 1;
+        if (nodes > MAX_SESSION_JSON_NODES || current.depth > MAX_SESSION_JSON_DEPTH)
+            return false;
+        if (typeof current.value === "string") {
+            if (current.value.length > MAX_SESSION_STRING_CHARS)
+                return false;
+            continue;
+        }
+        if (!current.value || typeof current.value !== "object")
+            continue;
+        const values = Array.isArray(current.value)
+            ? current.value
+            : Object.values(current.value);
+        if (values.length > MAX_SESSION_ARRAY_ITEMS)
+            return false;
+        for (const child of values)
+            pending.push({ value: child, depth: current.depth + 1 });
+    }
+    return true;
+}
 /** True if a parsed object has the SessionData shape we can safely use. */
 function isSessionData(d) {
     const o = d;
@@ -491,8 +533,13 @@ function isSessionData(d) {
  *  here: listing/resuming must not perform an unlocked write. The next explicit save atomically migrates it. */
 function readSessionFile(p) {
     try {
-        const d = JSON.parse(readFileSync(p, "utf8"));
-        return isSessionData(d) ? redactedSessionCopy(d) : null;
+        const raw = readVerifiedRegularFileSnapshotSync(p, MAX_SESSION_FILE_BYTES, {
+            action: "read Hara session",
+            protectSensitive: false,
+            rejectHardLinks: true,
+        }).text;
+        const d = JSON.parse(raw);
+        return sessionValueWithinLimits(d) && isSessionData(d) ? redactedSessionCopy(d) : null;
     }
     catch {
         return null;

package/dist/session/task.js

@@ -111,7 +111,7 @@ export function requestsTaskContinuation(text) {
     const value = text.trim().toLocaleLowerCase();
     if (!value)
         return false;
-    return /^(?:\/(?:continue|resume)(?:\s|$)|(?:continue|resume|go\s+on)(?:[\s,.:;!?，。：；！？]|$)|(?:继续|接着|接着做|继续处理)(?:[\s,.:;!?，。：；！？]|$))/.test(value);
+    return /^(?:\/continue(?:\s|$)|(?:continue|resume|go\s+on)(?:[\s,.:;!?，。：；！？]|$)|(?:继续|接着|接着做|继续处理)(?:[\s,.:;!?，。：；！？]|$))/.test(value);
 }
 export function finishTaskExecution(task, outcome, todos = [], interrupted = false, at = new Date()) {
     if (!task)
@@ -123,9 +123,11 @@ export function finishTaskExecution(task, outcome, todos = [], interrupted = fal
         ? "paused"
         : outcome?.status === "completed"
             ? (incomplete ? "paused" : "completed")
-            : outcome?.status === "error" || outcome?.status === "empty" || outcome?.status === "halted"
-                ? "blocked"
-                : "paused";
+            : outcome?.status === "halted" && outcome.stopReason === "deadline"
+                ? "paused"
+                : outcome?.status === "error" || outcome?.status === "empty" || outcome?.status === "halted"
+                    ? "blocked"
+                    : "paused";
     return { ...task, status, lastOutcome, updatedAt: now, endedAt: now };
 }
 /** A process died while this task was running. Recovery is explicit and never claims success. */

package/dist/tools/cron.js

@@ -11,7 +11,7 @@ import { runJobTracked } from "../cron/runner.js";
 import { parseDeliver } from "../cron/deliver.js";
 import { isInstalled } from "../cron/install.js";
 import { sensitiveShellCommandReason } from "../security/sensitive-files.js";
-import { homeWorkspaceActionError, isHomeWorkspace } from "../context/workspace-scope.js";
+import { homeWorkspaceActionError, isUnsafeProjectWorkspace } from "../context/workspace-scope.js";
 const fmt = (ms) => (ms ? new Date(ms).toLocaleString() : "—");
 const fmtNext = (ms, now) => (ms !== null && ms <= now ? "due now" : fmt(ms));
 const duration = (ms) => {
@@ -87,7 +87,7 @@ registerTool({
         if (action === "add") {
             // Every new job persists ctx.cwd and later treats it as its implicit agent/shell workspace. Management
             // of existing jobs remains available at Home, but creating a Home-root job would bypass project scope.
-            if (isHomeWorkspace(ctx.cwd))
+            if (isUnsafeProjectWorkspace(ctx.cwd))
                 return `Error: ${homeWorkspaceActionError("schedule a job")}`;
             const scheduleStr = String(input.schedule ?? "").trim();
             const task = String(input.task ?? "").trim();

package/dist/tools/registry.js

@@ -1,5 +1,5 @@
 import { limitToolResult } from "./result-limit.js";
-import { homeWorkspaceActionError, isHomeWorkspace } from "../context/workspace-scope.js";
+import { homeWorkspaceActionError, isUnsafeProjectWorkspace } from "../context/workspace-scope.js";
 /** Names of required parameters that are ABSENT (undefined/null) in a tool call's input. Defends
  *  against models that drop parameters outright (observed: qwen3.7-plus losing write_file's
  *  path/content mid-stream) — the loop rejects the call with a precise error instead of executing
@@ -28,7 +28,7 @@ export function registerTool(t) {
             // Only explicitly project-scoped operations are blocked. Tool kinds are also used for safe
             // management/delivery side effects, so a kind must not itself imply a project workspace requirement.
             // Canonical comparison closes Home symlink aliases.
-            if (t.requiresProjectWorkspace && isHomeWorkspace(ctx.cwd)) {
+            if (t.requiresProjectWorkspace && isUnsafeProjectWorkspace(ctx.cwd)) {
                 return `Error: ${homeWorkspaceActionError(`run ${t.name}`)}`;
             }
             return limitToolResult(await run(input, ctx));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanhara/hara",
-  "version": "0.124.2",
+  "version": "0.124.4",
   "description": "hara — a coding agent CLI that runs like an engineering org.",
   "bin": {
     "hara": "runtime-bootstrap.cjs"