@nanhara/hara 0.125.0 → 0.125.3

package/dist/index.js

@@ -13,7 +13,7 @@ import { readFileSync, existsSync, realpathSync, statSync, writeFileSync, rmSync
 import { homedir, tmpdir } from "node:os";
 import { fileURLToPath } from "node:url";
 import { randomUUID } from "node:crypto";
-import { dirname, join, relative, resolve } from "node:path";
+import { delimiter, dirname, join, relative, resolve } from "node:path";
 import { loadConfig, configPath, readRawConfig, writeConfigValue, setModelVisionOverride, providerEnvKey, providerDefaultBaseURL, CONFIG_KEYS, APPROVAL_MODES, SANDBOX_MODES, REASONING_EFFORTS, } from "./config.js";
 import { runAgent } from "./agent/loop.js";
 import { formatAgentDuration, parseAgentRunTimeoutMs, MIN_AGENT_RUN_TIMEOUT_MS, MAX_AGENT_RUN_TIMEOUT_MS, MAX_AGENT_MAX_ROUNDS, } from "./agent/limits.js";
@@ -76,7 +76,7 @@ import { collectRepoChunksAsync, collectDirChunksAsync, buildIndex, indexPath, i
 import { searchHybrid } from "./search/hybrid.js";
 import { expandMentionsAsync, fileCandidates, isSlashCommand, inlineLeadingPath } from "./context/mentions.js";
 import { newSessionId, shortId, resolveSessionId, validSessionId, sessionFileExists, saveSession, loadSession, acquireSessionLock, releaseSessionLock, listSessions, latestForCwd, titleFrom, sessionSourceFromEnv, automatedTitle, slugify, } from "./session/store.js";
-import { consumePendingTaskSteering, continueTaskExecution, createTaskExecution, finishTaskExecution, formatTaskExecution, hasPendingTaskSteering, newSteerInteraction, newTurnInteraction, recordTaskSteering, recoverTaskExecution, requestsTaskContinuation, taskExecutionContext, } from "./session/task.js";
+import { consumePendingTaskSteering, continueTaskExecution, createTaskExecution, finishTaskExecution, formatTaskExecution, hasPendingTaskSteering, newSteerInteraction, newTurnInteraction, recordTaskSteering, recoverTaskExecution, routeTaskInteraction, requestsTaskContinuation, taskExecutionContext, } from "./session/task.js";
 import { displaySessionCwd, resolveSessionResumeTarget } from "./session/resume.js";
 import { setSessionForceModel, isSessionForceModel, effectiveRoleModel } from "./session/session-model.js";
 import { loadGlobalRoles, loadRoles, roleToolFilter, scaffoldRoles, subagentToolFilter } from "./org/roles.js";
@@ -85,7 +85,7 @@ import { loadSkillIndex, loadSkillBody, scaffoldSkills, globalSkillsDir } from "
 import { installPlugin, uninstallPlugin, listInstalled, enabledPlugins, setPluginEnabled, pluginMcpServers, pluginHooks, haraBinDir } from "./plugins/plugins.js";
 import { routeByKeywords, buildDispatchPrompt, parseRoleId } from "./org/router.js";
 import { decompose, topoOrder, topoWaves, savePlan, loadPlan, atomPrompt, verify, runCheck } from "./org/planner.js";
-import { connectMcpServers, closeMcp } from "./mcp/client.js";
+import { closeMcp, registerLazyMcpServers } from "./mcp/client.js";
 import { sandboxSupported, runShell } from "./sandbox.js";
 import { undoLast } from "./undo.js";
 import { scaffoldAssets, assetsDir, assetSearchRoots } from "./recall.js";
@@ -1982,13 +1982,14 @@ program
             const live = loadConfig({ cwd: targetCwd ?? cwd });
             return listModels(live.baseURL ?? providerDefaultBaseURL(live.provider), live.apiKey ?? "");
         },
-        effortLevels: levelsFor(resolvePlatform(cfg.provider, cfg.baseURL ?? providerDefaultBaseURL(cfg.provider)).reasoning).filter((e) => !!e),
-        runtimeInfo: (targetCwd) => {
+        effortLevels: levelsFor(resolvePlatform(cfg.provider, cfg.baseURL ?? providerDefaultBaseURL(cfg.provider)).reasoning, cfg.model).filter((e) => !!e),
+        runtimeInfo: (targetCwd, selectedModel) => {
             const live = loadConfig({ cwd: targetCwd ?? cwd });
+            const model = selectedModel ?? live.model;
             return {
                 providerId: live.provider,
-                model: live.model,
-                effortLevels: levelsFor(resolvePlatform(live.provider, live.baseURL ?? providerDefaultBaseURL(live.provider)).reasoning).filter((e) => !!e),
+                model,
+                effortLevels: levelsFor(resolvePlatform(live.provider, live.baseURL ?? providerDefaultBaseURL(live.provider)).reasoning, model).filter((e) => !!e),
             };
         },
         runLimits: (targetCwd) => agentRunLimits(loadConfig({ cwd: targetCwd ?? cwd })),
@@ -2655,11 +2656,13 @@ pluginCmd
             m.mcpServers ? `${Object.keys(m.mcpServers).length} mcp server(s)` : "",
         ].filter(Boolean);
         out(c.green(`Installed ${p.name}@${p.version}${parts.length ? c.dim(" — " + parts.join(", ")) : ""}\n`));
-        // A plugin can ship CLI commands (manifest `bin`); they're linked into ~/.hara/bin. Tell the user to PATH it.
+        // Hara's model-controlled subprocesses append this directory automatically. The user's independent
+        // interactive shell still needs its own PATH entry when they want to invoke the command directly.
         const bins = Object.keys(m.bin ?? {});
         if (bins.length) {
-            const onPath = (process.env.PATH ?? "").split(":").includes(haraBinDir());
+            const onPath = (process.env.PATH ?? "").split(delimiter).includes(haraBinDir());
             out(c.green(`Linked command(s): ${bins.join(", ")} → ${c.dim(haraBinDir())}\n`));
+            out(c.dim("  available to tool commands started inside Hara automatically\n"));
             if (!onPath)
                 out(c.yellow(`  add to PATH once:  echo 'export PATH="$HOME/.hara/bin:$PATH"' >> ~/.zshrc && source ~/.zshrc\n`));
         }
@@ -2909,35 +2912,13 @@ program.action(async (opts) => {
             out(c.yellow(message));
     }
     const stats = { input: 0, output: 0, lastInput: 0 };
-    // Connecting to MCP executes configured external commands before an MCP tool is selected, so the ordinary
-    // per-tool confirmation is too late. Obtain one explicit startup grant for the named server set. askConfirm
-    // uses a short-lived Ink prompt and restores stdin, making it safe before either the main TUI or readline REPL
-    // owns the terminal. Non-interactive runs remain closed unless the user opted in before process launch.
+    // Advertise configured MCP capabilities without starting any subprocess or blocking startup for permission.
+    // The model can call `mcp_connect` when a task first needs ONE server; that external-boundary tool goes
+    // through the ordinary interactive grant, and the newly discovered tools appear on the next model round.
+    // Read-only headless roles do not receive the launcher at all.
     const mcpAll = { ...pluginMcpServers(), ...cfg.mcpServers }; // user config wins over plugin-contributed servers
-    const mcpNames = Object.keys(mcpAll);
-    if (!requestedHeadlessRole?.readOnly && mcpNames.length) {
-        const trustedOptIn = process.env.HARA_ALLOW_TRUSTED_EXTENSIONS === "1";
-        const interactiveTerminal = !opts.print && !!stdin.isTTY && !!stdout.isTTY;
-        const approved = trustedOptIn ||
-            (interactiveTerminal &&
-                (await askConfirm(`Start configured MCP server${mcpNames.length === 1 ? "" : "s"} ${mcpNames
-                    .slice(0, 8)
-                    .map((name) => `'${name.replace(/[\u0000-\u001f\u007f]/g, "").slice(0, 80)}'`)
-                    .join(", ")}${mcpNames.length > 8 ? ` and ${mcpNames.length - 8} more` : ""}? ` +
-                    "They execute external code outside Hara's protected-file boundary.", false)));
-        if (approved) {
-            await connectMcpServers(mcpAll, (m) => machineOutput ? process.stderr.write(m + "\n") : out(c.dim(m + "\n")), { approved: true });
-        }
-        else {
-            const message = interactiveTerminal
-                ? "hara: MCP server startup declined; no configured MCP command was executed.\n"
-                : "hara: MCP servers skipped because this run has no interactive startup approval. " +
-                    "Set HARA_ALLOW_TRUSTED_EXTENSIONS=1 before launch only for reviewed servers.\n";
-            if (machineOutput || !interactiveTerminal)
-                process.stderr.write(message);
-            else
-                out(c.dim(message));
-        }
+    if (!requestedHeadlessRole?.readOnly && Object.keys(mcpAll).length) {
+        registerLazyMcpServers(mcpAll, (message) => machineOutput ? process.stderr.write(message + "\n") : out(c.dim(message + "\n")));
     }
     // one-shot
     if (opts.print) {
@@ -3198,6 +3179,18 @@ program.action(async (opts) => {
                 memory: memoryDigest(cwd),
                 continuationSession,
                 executionContext: taskExecutionContext(task, headlessInteraction, meta?.todos ?? []),
+                taskIntake: {
+                    task,
+                    current: () => task,
+                    onUpdate: (next) => {
+                        task = next;
+                    },
+                    onCheckpoint: (next) => {
+                        task = next;
+                        if (meta)
+                            saveSession(meta, history, task);
+                    },
+                },
                 ...(roleOverride ? { systemOverride: roleOverride } : {}),
                 ...(headlessToolFilter ? { toolFilter: headlessToolFilter } : {}),
                 hooks: headlessHooks,
@@ -3445,6 +3438,19 @@ program.action(async (opts) => {
     }
     const history = resumed?.history ? [...resumed.history] : [];
     const persistSession = () => saveSession(meta, history, task);
+    const taskIntakeForRun = () => task
+        ? {
+            task,
+            current: () => task,
+            onUpdate: (next) => {
+                task = next;
+            },
+            onCheckpoint: (next) => {
+                task = next;
+                persistSession();
+            },
+        }
+        : undefined;
     let requestedWorkspaceSwitch = null;
     let requestedSessionSwitch = null;
     const relaunchRequestedTarget = async () => {
@@ -4087,6 +4093,7 @@ program.action(async (opts) => {
             initialStatus: { sessionName: meta.title || shortId(meta.id), approval, input: stats.input, output: stats.output, ctxPct: 0, agents: 0 },
             model: cfg.model,
             cwd,
+            agentSlashCommands: loadSkillIndex(cwd).filter((skill) => skill.userInvocable).map((skill) => skill.id),
             header: {
                 version: pkg.version,
                 modelLabel: `${cfg.provider}:${cfg.model}`,
@@ -4125,6 +4132,41 @@ program.action(async (opts) => {
                         turnId: interaction?.turnId ?? newTurnInteraction().turnId,
                     };
                 }
+                // Type-ahead steering belongs to every executable Agent turn, including `/skill` kickoff turns.
+                // Local slash controls never publish a steer target in App, so they cannot enter this callback.
+                const pendingInput = async () => {
+                    const freshMessages = new Map();
+                    for (const it of h.drainQueue()) {
+                        const r2 = await resolveImages(it.images, h);
+                        const body = await expandMentionsAsync(it.line, cwd, { signal: h.signal }) + (r2.skip ? "" : (r2.extraText ?? ""));
+                        const attach = !r2.skip && r2.attach?.length ? r2.attach : undefined;
+                        if (!body.trim() && !attach)
+                            continue;
+                        const recorded = recordTaskSteering(task, it.expectedTurnId, body || "(image-only steering)");
+                        if (!recorded.ok) {
+                            h.sink.notice(`(steer rejected: ${recorded.reason})`);
+                            continue;
+                        }
+                        task = recorded.task;
+                        const accepted = task.steering?.at(-1);
+                        if (accepted?.deliveryState === "pending") {
+                            freshMessages.set(accepted.id, { role: "user", content: `${INTERJECT_PREFIX}\n\n${body}`, ...(attach ? { images: attach } : {}) });
+                        }
+                    }
+                    const consumed = consumePendingTaskSteering(task);
+                    if (!consumed)
+                        return [];
+                    const out = consumed.entries.map((entry) => freshMessages.get(entry.id) ?? ({
+                        role: "user",
+                        content: `${INTERJECT_PREFIX}\n\n${entry.content}`,
+                    }));
+                    // Write ahead both the transcript projection and the consumed inbox state. Returning [] prevents
+                    // runAgent from appending the same messages again after this shared live history is updated.
+                    saveSession(meta, [...history, ...out], consumed.task);
+                    task = consumed.task;
+                    history.push(...out);
+                    return [];
+                };
                 // A dropped/pasted file path (`/Users/…/doc.md`, maybe trailing text/images) starts with '/' but
                 // is NOT a command — treat it as a file to read, not "Unknown command" (see isSlashCommand).
                 if (isSlashCommand(line)) {
@@ -4459,7 +4501,7 @@ program.action(async (opts) => {
                             clearTodos();
                             meta.todos = [];
                             const skillContent = `Skill \`${sk.id}\`:\n${loadSkillBody(sk)}\n\n---\nEntering ${sk.id} mode${arg ? ` — request: ${arg}` : ""}. Follow this skill now. If it has a workspace or live preview, OPEN it FIRST so any existing progress is visible, then proceed — offer to continue existing work or start fresh.`;
-                            const skillInteraction = interaction ?? newTurnInteraction();
+                            const skillInteraction = routeTaskInteraction(task, interaction ?? newTurnInteraction()).interaction;
                             if (skillInteraction.kind === "steer") {
                                 const continued = continueTaskExecution(task, skillInteraction);
                                 if (!continued.ok)
@@ -4480,7 +4522,7 @@ program.action(async (opts) => {
                             const __skApproval = h.approval === "plan" ? "suggest" : h.approval;
                             let skillOutcome;
                             try {
-                                skillOutcome = await runAgent(history, { provider, ctx: { cwd, sandbox, spawn, ui: { text: h.sink.assistantDelta, reasoning: h.sink.reasoningDelta, tool: h.sink.tool, diff: h.sink.diff, notice: h.sink.notice }, ask: h.ask, describeImage: describeScreenshot, locate: locateScreenshot }, approval: __skApproval, confirm: h.confirm, autoApprove, projectContext, memory: buildMemory(), continuationSession, executionContext: skillExecutionContext, stats, signal: h.signal, fallback: fbOpt, guardian: guardianOpt, ...agentRunLimits(cfg) });
+                                skillOutcome = await runAgent(history, { provider, ctx: { cwd, sandbox, spawn, ui: { text: h.sink.assistantDelta, reasoning: h.sink.reasoningDelta, tool: h.sink.tool, diff: h.sink.diff, notice: h.sink.notice }, ask: h.ask, describeImage: describeScreenshot, locate: locateScreenshot }, approval: __skApproval, confirm: h.confirm, autoApprove, projectContext, memory: buildMemory(), continuationSession, executionContext: skillExecutionContext, taskIntake: taskIntakeForRun(), pendingInput, stats, signal: h.signal, fallback: fbOpt, guardian: guardianOpt, ...agentRunLimits(cfg) });
                             }
                             catch (e) {
                                 h.sink.notice(`[error] ${e?.message ?? e}`);
@@ -4504,7 +4546,7 @@ program.action(async (opts) => {
                 line = inlineLeadingPath(line, existsSync);
                 const ui = { text: h.sink.assistantDelta, reasoning: h.sink.reasoningDelta, tool: h.sink.tool, diff: h.sink.diff, notice: h.sink.notice };
                 const appr = h.approval;
-                let submittedInteraction = interaction ?? newTurnInteraction();
+                let submittedInteraction = routeTaskInteraction(task, interaction ?? newTurnInteraction(), { allowInactive: !!continueCommand }).interaction;
                 if (resumeTaskPending && task && submittedInteraction.kind === "turn" &&
                     (hasPendingTaskSteering(task) || requestsTaskContinuation(line))) {
                     submittedInteraction = { kind: "steer", expectedTurnId: task.turnId, turnId: submittedInteraction.turnId };
@@ -4526,43 +4568,6 @@ program.action(async (opts) => {
                     resumeTaskPending = false;
                     return taskExecutionContext(task, submittedInteraction, meta.todos ?? []);
                 };
-                // Type-ahead steering: fold messages typed mid-turn into the next model call (codex-style) so a
-                // clarification/addition course-corrects the live task, rather than waiting for a fresh turn.
-                // Shared by every turn below (plan investigate, plan execute, and the regular turn).
-                const pendingInput = async () => {
-                    const freshMessages = new Map();
-                    for (const it of h.drainQueue()) {
-                        const r2 = await resolveImages(it.images, h);
-                        const body = await expandMentionsAsync(it.line, cwd, { signal: h.signal }) + (r2.skip ? "" : (r2.extraText ?? ""));
-                        const attach = !r2.skip && r2.attach?.length ? r2.attach : undefined;
-                        if (!body.trim() && !attach)
-                            continue; // image-only message whose image was skipped → nothing to add
-                        const recorded = recordTaskSteering(task, it.expectedTurnId, body || "(image-only steering)");
-                        if (!recorded.ok) {
-                            h.sink.notice(`(steer rejected: ${recorded.reason})`);
-                            continue;
-                        }
-                        task = recorded.task;
-                        const accepted = task.steering?.at(-1);
-                        if (accepted?.deliveryState === "pending") {
-                            freshMessages.set(accepted.id, { role: "user", content: `${INTERJECT_PREFIX}\n\n${body}`, ...(attach ? { images: attach } : {}) });
-                        }
-                    }
-                    const consumed = consumePendingTaskSteering(task);
-                    if (!consumed)
-                        return [];
-                    const out = consumed.entries.map((entry) => freshMessages.get(entry.id) ?? ({
-                        role: "user",
-                        content: `${INTERJECT_PREFIX}\n\n${entry.content}`,
-                    }));
-                    // Persist the projected transcript and consumed inbox state first, then update the same live
-                    // history synchronously. Returning [] prevents runAgent from appending the messages twice;
-                    // loop from appending twice; cancellation/error saves can no longer overwrite the projected input.
-                    saveSession(meta, [...history, ...out], consumed.task);
-                    task = consumed.task;
-                    history.push(...out);
-                    return [];
-                };
                 const turnStart = Date.now(); // for the task-done notification (gated on elapsed)
                 if (appr === "plan") {
                     // PLAN MODE: read-only investigate; the MODEL signals plan-readiness by calling `exit_plan`
@@ -4609,6 +4614,7 @@ program.action(async (opts) => {
                         projectContext,
                         continuationSession,
                         executionContext,
+                        taskIntake: taskIntakeForRun(),
                         stats,
                         signal: h.signal,
                         pendingInput,
@@ -4662,6 +4668,7 @@ program.action(async (opts) => {
                             projectContext,
                             continuationSession,
                             executionContext,
+                            taskIntake: taskIntakeForRun(),
                             stats,
                             signal: h.signal,
                             pendingInput,
@@ -4706,6 +4713,7 @@ program.action(async (opts) => {
                     projectContext,
                     continuationSession,
                     executionContext,
+                    taskIntake: taskIntakeForRun(),
                     stats,
                     signal: h.signal,
                     pendingInput,
@@ -4795,7 +4803,7 @@ program.action(async (opts) => {
                     currentTurn = skillTurn;
                     let skillOutcome;
                     try {
-                        skillOutcome = await runAgent(history, { provider, ctx: { cwd, sandbox, spawn, ask: askUser }, approval, confirm, autoApprove, projectContext, memory: buildMemory(), continuationSession, executionContext: skillExecutionContext, stats, signal: skillTurn.signal, fallback: fbOpt, guardian: guardianOpt, ...agentRunLimits(cfg) });
+                        skillOutcome = await runAgent(history, { provider, ctx: { cwd, sandbox, spawn, ask: askUser }, approval, confirm, autoApprove, projectContext, memory: buildMemory(), continuationSession, executionContext: skillExecutionContext, taskIntake: taskIntakeForRun(), stats, signal: skillTurn.signal, fallback: fbOpt, guardian: guardianOpt, ...agentRunLimits(cfg) });
                     }
                     catch (e) {
                         out(c.red(`\n[error] ${e.message}\n`));
@@ -4863,7 +4871,7 @@ program.action(async (opts) => {
         const t0 = Date.now();
         let turnOutcome;
         try {
-            turnOutcome = await runAgent(history, { provider, ctx: { cwd, sandbox, spawn, ask: askUser }, approval, confirm, autoApprove, projectContext, memory: buildMemory(), continuationSession, executionContext, stats, signal: turnController.signal, fallback: fbOpt, guardian: guardianOpt, ...agentRunLimits(cfg) });
+            turnOutcome = await runAgent(history, { provider, ctx: { cwd, sandbox, spawn, ask: askUser }, approval, confirm, autoApprove, projectContext, memory: buildMemory(), continuationSession, executionContext, taskIntake: taskIntakeForRun(), stats, signal: turnController.signal, fallback: fbOpt, guardian: guardianOpt, ...agentRunLimits(cfg) });
         }
         catch (e) {
             out(c.red(`\n[error] ${e.message}\n`));

package/dist/mcp/client.js

@@ -4,11 +4,12 @@ import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js"
 import { registerTool } from "../tools/registry.js";
 import { redactToolSubprocessOutput, toolSubprocessEnv } from "../security/subprocess-env.js";
 import { sensitiveStructuredInputReason } from "../security/sensitive-files.js";
-const clients = [];
+const clients = new Map();
 const DEFAULT_STARTUP_TIMEOUT_MS = 10_000;
 const MIN_STARTUP_TIMEOUT_MS = 50;
 const MAX_STARTUP_TIMEOUT_MS = 60_000;
 const safeDiagnosticName = (name) => name.replace(/[\u0000-\u001f\u007f]/g, "").slice(0, 128) || "server";
+const NPM_UNKNOWN_USER_CONFIG_NOISE = /^npm\s+warn\s+Unknown user config "(?:always-auth|home)"(?:\s|\(|\.|$)/i;
 function startupTimeout(value) {
     if (value === undefined || !Number.isFinite(value))
         return DEFAULT_STARTUP_TIMEOUT_MS;
@@ -60,6 +61,12 @@ function mcpStderrRedactor(name, explicitEnv, log) {
             .replace(/\r?\n$/, "");
         if (!clean)
             return;
+        // npm 11 prints these host-user `.npmrc` deprecation notices before an npx-backed MCP server writes
+        // anything. They are neither server diagnostics nor actionable inside Hara, and repeating them in the
+        // TUI makes a healthy MCP startup look broken. Keep the filter deliberately exact: all other npm/MCP
+        // warnings and every error still cross the bounded redactor. Never read or rewrite the user's `.npmrc`.
+        if (NPM_UNKNOWN_USER_CONFIG_NOISE.test(clean))
+            return;
         const message = `mcp: ${safeName} stderr: ${clean}`;
         if (emitted + message.length > totalLimit) {
             log(`mcp: ${safeName} stderr: [further diagnostics omitted]`);
@@ -124,15 +131,20 @@ export async function connectMcpServers(servers, log, options = {}) {
         return 0;
     }
     const timeoutMs = startupTimeout(options.timeoutMs);
-    const requestOptions = { timeout: timeoutMs, maxTotalTimeout: timeoutMs };
+    const requestOptions = { timeout: timeoutMs, maxTotalTimeout: timeoutMs, signal: options.signal };
     let count = 0;
     for (const [name, cfg] of Object.entries(servers)) {
         const diagnosticName = safeDiagnosticName(name);
+        if (clients.has(name)) {
+            log(`mcp: ${diagnosticName} already connected`);
+            continue;
+        }
         let flushStderr;
         let transport;
         let client;
         let stage = "connect";
         try {
+            options.signal?.throwIfAborted();
             transport = new StdioClientTransport({
                 command: cfg.command,
                 args: cfg.args ?? [],
@@ -152,8 +164,10 @@ export async function connectMcpServers(servers, log, options = {}) {
             client = new Client({ name: "hara", version: "0.4.0" }, { capabilities: {} });
             await client.connect(transport, requestOptions);
             stage = "list tools";
+            options.signal?.throwIfAborted();
             const activeClient = client;
             const { tools } = await activeClient.listTools(undefined, requestOptions);
+            options.signal?.throwIfAborted();
             for (const t of tools) {
                 const schema = t.inputSchema ?? { type: "object", properties: {} };
                 registerTool({
@@ -169,7 +183,7 @@ export async function connectMcpServers(servers, log, options = {}) {
                         const protectedReason = sensitiveStructuredInputReason(input, ctx.cwd);
                         if (protectedReason)
                             return `Blocked: MCP input names protected ${protectedReason}.`;
-                        const res = await activeClient.callTool({ name: t.name, arguments: input ?? {} });
+                        const res = await activeClient.callTool({ name: t.name, arguments: input ?? {} }, undefined, { signal: ctx.signal });
                         const blocks = Array.isArray(res?.content) ? res.content : [];
                         const text = blocks.map((b) => (b?.type === "text" ? b.text : JSON.stringify(b))).join("\n");
                         return redactToolSubprocessOutput(text || "(no output)", process.env, cfg.env ?? {});
@@ -177,7 +191,7 @@ export async function connectMcpServers(servers, log, options = {}) {
                 });
                 count++;
             }
-            clients.push(activeClient);
+            clients.set(name, activeClient);
             log(`mcp: ${diagnosticName} → ${tools.length} tool(s)`);
         }
         catch (e) {
@@ -193,8 +207,60 @@ export async function connectMcpServers(servers, log, options = {}) {
     }
     return count;
 }
+/** Register a zero-side-effect launcher for configured MCP servers. The model sees only this bounded index
+ * until a relevant task calls it; connecting one server dynamically registers its real tools for the next
+ * provider round (runAgent rebuilds tool specs every round). */
+export function registerLazyMcpServers(servers, log) {
+    const names = Object.keys(servers);
+    if (!names.length)
+        return;
+    const display = names
+        .slice(0, 24)
+        .map((name) => safeDiagnosticName(name))
+        .join(", ");
+    const more = names.length > 24 ? `, … (${names.length - 24} more)` : "";
+    registerTool({
+        name: "mcp_connect",
+        description: "Connect exactly one configured MCP server when the current task first needs it. " +
+            "Do not call speculatively: launching it executes reviewed external code outside Hara's protected-file boundary. " +
+            `Configured servers: ${display}${more}. After success, its mcp__<server>__* tools appear on the next turn.`,
+        input_schema: {
+            type: "object",
+            properties: {
+                server: {
+                    type: "string",
+                    enum: names,
+                    description: "Exact configured server name to connect.",
+                },
+            },
+            required: ["server"],
+        },
+        kind: "exec",
+        trustBoundary: "external",
+        async run(input, ctx) {
+            const name = typeof input?.server === "string" ? input.server : "";
+            const cfg = servers[name];
+            if (!cfg) {
+                return `Error: unknown MCP server '${safeDiagnosticName(name)}'. Available: ${display}${more}.`;
+            }
+            if (!ctx.ask && process.env.HARA_ALLOW_TRUSTED_EXTENSIONS !== "1") {
+                return ("Blocked: MCP is a trusted extension outside Hara's file boundary and is disabled in " +
+                    "non-interactive runs. Set HARA_ALLOW_TRUSTED_EXTENSIONS=1 before launch only after reviewing the server.");
+            }
+            if (clients.has(name))
+                return `MCP server '${safeDiagnosticName(name)}' is already connected.`;
+            const runtimeLog = ctx.ui ? (message) => ctx.ui.notice(message) : log;
+            const count = await connectMcpServers({ [name]: cfg }, runtimeLog, { approved: true, signal: ctx.signal });
+            if (!clients.has(name)) {
+                return `Error: MCP server '${safeDiagnosticName(name)}' failed to connect. Review its redacted startup diagnostics.`;
+            }
+            return (`Connected MCP server '${safeDiagnosticName(name)}'; ${count} tool(s) are now available under ` +
+                `mcp__${safeDiagnosticName(name)}__*. Continue with the specific tool needed for the task.`);
+        },
+    });
+}
 export async function closeMcp() {
-    for (const cl of clients) {
+    for (const cl of clients.values()) {
         try {
             await cl.close();
         }
@@ -202,5 +268,5 @@ export async function closeMcp() {
             /* ignore */
         }
     }
-    clients.length = 0;
+    clients.clear();
 }

package/dist/providers/models.js

@@ -1,21 +1,54 @@
+// Alibaba Coding Plan's documented exact ids (verified 2026-07-18). Live `/models` remains authoritative;
+// this list is only a usability fallback because the coding endpoint/key combinations do not all enumerate.
+// Keep exact casing: Coding Plan explicitly forbids guessing compatible/version-like aliases.
+export const CODING_PLAN_FALLBACK_MODELS = Object.freeze([
+    "qwen3.7-plus",
+    "qwen3.6-plus",
+    "kimi-k2.5",
+    "glm-5",
+    "MiniMax-M2.5",
+    "qwen3.5-plus",
+    "qwen3-max-2026-01-23",
+    "qwen3-coder-next",
+    "qwen3-coder-plus",
+    "glm-4.7",
+]);
+export function codingPlanFallbackModels(baseURL) {
+    if (!baseURL)
+        return [];
+    try {
+        const host = new URL(baseURL).hostname.toLowerCase();
+        return host === "coding.dashscope.aliyuncs.com" || host === "coding-intl.dashscope.aliyuncs.com"
+            ? [...CODING_PLAN_FALLBACK_MODELS]
+            : [];
+    }
+    catch {
+        return [];
+    }
+}
 // Model discovery — "what can this key run?" A coding-plan / OpenAI-compatible key usually exposes many
 // models (Qwen, GLM, Kimi, …) via `GET {baseURL}/models`; the /model picker lists them so you switch by
-// arrow keys, not by memorizing ids. Best-effort: many endpoints don't implement it → [] and the picker
-// falls back to typing an id. `fetchImpl` is injected so this stays pure/testable.
+// arrow keys, not by memorizing ids. Live results win. A bounded request falls back to Alibaba's documented
+// exact Coding Plan ids only on the two official coding hosts; other endpoints keep the existing [] →
+// type-an-id behavior. `fetchImpl` is injected so this stays pure/testable.
 export async function listModels(baseURL, apiKey, fetchImpl = fetch) {
     if (!baseURL)
         return []; // SDK-default hosts (anthropic/openai) — no custom endpoint to enumerate
+    const fallback = codingPlanFallbackModels(baseURL);
     try {
         const url = baseURL.replace(/\/+$/, "") + "/models";
-        const r = await fetchImpl(url, { headers: { Authorization: `Bearer ${apiKey}` } });
+        const headers = {};
+        if (apiKey)
+            headers.Authorization = `Bearer ${apiKey}`;
+        const r = await fetchImpl(url, { headers, signal: AbortSignal.timeout(5_000) });
         if (!r.ok)
-            return [];
+            return fallback;
         const j = (await r.json());
         const ids = (j?.data ?? []).map((m) => m?.id).filter((x) => typeof x === "string" && x.length > 0);
         // Stable order + de-dup so the picker list doesn't jump around between opens.
-        return [...new Set(ids)].sort((a, b) => a.localeCompare(b));
+        return ids.length ? [...new Set(ids)].sort((a, b) => a.localeCompare(b)) : fallback;
     }
     catch {
-        return [];
+        return fallback;
     }
 }

package/dist/providers/reasoning.js

@@ -8,6 +8,16 @@
 export function isReasoningModel(model) {
     return /^(o1|o3|o4|gpt-5)/i.test(model);
 }
+/** Endpoint capability is not enough: Alibaba's Coding Plan serves qwen3-coder-next/plus on the same
+ * DashScope URL as thinking models, but documents both coder ids as not supporting thinking mode. */
+export function supportsReasoningStyle(style, model = "") {
+    if (style === "none")
+        return false;
+    if (style === "enable_thinking" && /^qwen3-coder-(?:next|plus)(?:-|$)/i.test(model.split("/").at(-1) ?? model)) {
+        return false;
+    }
+    return true;
+}
 /** Translate the dial into request params to MERGE into the wire body (chat/responses styles). Returns an
  *  empty object — leave the request untouched — when the dial is UNSET (keep the model's own default; zero
  *  impact, the safe default) or the style/model has nothing to add. Anthropic's `thinking_budget` is built
@@ -17,6 +27,8 @@ export function reasoningParams(style, effort, model = "") {
         return {};
     switch (style) {
         case "enable_thinking":
+            if (!supportsReasoningStyle(style, model))
+                return {};
             // off → false (stop the thinking phase, fast); any explicit level → true (keep it on).
             return { enable_thinking: effort !== "off" };
         case "ollama_think":

package/dist/security/subprocess-env.js

@@ -3,7 +3,10 @@
 // A user can explicitly pass selected names with HARA_SUBPROCESS_ENV_ALLOW=NAME,OTHER before launching Hara.
 import { redactSensitiveText } from "./secrets.js";
 import { spawn } from "node:child_process";
+import { existsSync } from "node:fs";
 import { platform } from "node:os";
+import { delimiter, join } from "node:path";
+import { normalizePortableWindowsHome } from "../runtime.js";
 const SECRET_NAME = /(?:^|_)(?:API_?KEY|KEY|SECRET|TOKEN|PASSWORD|PASSWD|CREDENTIALS?|COOKIE|JWT|AUTH)(?:_|$)/i;
 const SECRET_EXACT = new Set([
     "DATABASE_URL",
@@ -27,6 +30,32 @@ function explicitAllow(env) {
         .filter((name) => /^[A-Za-z_][A-Za-z0-9_]*$/.test(name))
         .map((name) => name.toUpperCase()));
 }
+function environmentValue(env, name) {
+    const key = Object.keys(env).find((candidate) => candidate.toUpperCase() === name);
+    return key ? env[key] : undefined;
+}
+/** Installed plugin commands are user-approved Hara extensions. Make them reachable by model-controlled
+ * subprocesses without allowing them to shadow an existing system/project command: ~/.hara/bin is appended,
+ * never prepended. The interactive shell still owns its own PATH configuration. */
+function appendHaraPluginBin(env) {
+    const explicitHome = environmentValue(env, "HOME");
+    const fallbackHome = environmentValue(env, "USERPROFILE");
+    // Match Hara's portable-home contract: an explicit Git Bash/MSYS HOME wins on Windows too.
+    const home = platform() === "win32" && explicitHome
+        ? normalizePortableWindowsHome(explicitHome)
+        : explicitHome ?? fallbackHome;
+    if (!home)
+        return;
+    const pluginBin = join(home, ".hara", "bin");
+    if (!existsSync(pluginBin))
+        return;
+    const pathKey = Object.keys(env).find((candidate) => candidate.toUpperCase() === "PATH") ?? "PATH";
+    const current = env[pathKey] ?? "";
+    const comparable = (value) => platform() === "win32" ? value.toLowerCase() : value;
+    if (current.split(delimiter).some((entry) => comparable(entry) === comparable(pluginBin)))
+        return;
+    env[pathKey] = current ? `${current}${delimiter}${pluginBin}` : pluginBin;
+}
 /** Build an own copy so callers never mutate process.env. Explicit overrides (for example an MCP server's
  * configured env) are intentional and win after the inherited environment has been scrubbed. */
 export function toolSubprocessEnv(source = process.env, overrides = {}) {
@@ -48,6 +77,7 @@ export function toolSubprocessEnv(source = process.env, overrides = {}) {
         else
             out[name] = value;
     }
+    appendHaraPluginBin(out);
     return out;
 }
 /** Redact both recognizable credential syntax and the exact values of secret-named environment variables.

package/dist/serve/server.js

@@ -239,11 +239,11 @@ export async function startServe(opts, deps) {
     const token = opts.token ?? randomBytes(16).toString("hex");
     const instanceId = randomUUID();
     const hub = new SessionHub(deps.store ?? realStore);
-    const runtimeInfo = (cwd) => {
-        const live = deps.runtimeInfo?.(cwd);
+    const runtimeInfo = (cwd, model) => {
+        const live = deps.runtimeInfo?.(cwd, model);
         return {
             providerId: live?.providerId ?? deps.providerId,
-            model: live?.model ?? deps.model,
+            model: live?.model ?? model ?? deps.model,
             effortLevels: live?.effortLevels ?? deps.effortLevels ?? [],
         };
     };
@@ -429,6 +429,17 @@ export async function startServe(opts, deps) {
                     memory: memoryDigest(s.meta.cwd),
                     continuationSession: s.continuationSession,
                     executionContext,
+                    taskIntake: {
+                        task: s.task,
+                        current: () => s.task,
+                        onUpdate: (next) => {
+                            s.task = next;
+                        },
+                        onCheckpoint: (next) => {
+                            s.task = next;
+                            hub.save(s);
+                        },
+                    },
                     pendingInput: async () => {
                         materializePendingSteering(s); // helper updates the shared live history after its write-ahead save
                         return [];
@@ -810,8 +821,10 @@ export async function startServe(opts, deps) {
                             const session = typeof p.sessionId === "string" ? hub.get(p.sessionId) : undefined;
                             const targetCwd = typeof p.cwd === "string" && p.cwd ? p.cwd : (session?.meta.cwd ?? opts.cwd);
                             const models = deps.listModels ? await deps.listModels(targetCwd).catch(() => []) : [];
-                            const runtime = runtimeInfo(targetCwd);
-                            return reply(rpcResult(id, { models, current: session?.meta.model ?? runtime.model, effort: session?.effort ?? null, effortLevels: runtime.effortLevels }));
+                            const defaultRuntime = runtimeInfo(targetCwd);
+                            const current = session?.meta.model ?? defaultRuntime.model;
+                            const currentRuntime = runtimeInfo(targetCwd, current);
+                            return reply(rpcResult(id, { models, current, effort: session?.effort ?? null, effortLevels: currentRuntime.effortLevels }));
                         }
                         case "session.set-model": {
                             // per-session model / thinking-effort switch (the composer picker). Rebuilds the session's