@nanhara/hara 0.125.3 → 0.126.0

package/dist/tools/all.js

@@ -3,6 +3,7 @@
 // never empty when runAgent plans a turn — an unregistered tool is silently unplannable, which shows up
 // as "the model called write_file and nothing happened".
 import "./builtin.js"; // read_file / write_file / bash / job
+import "./runtime.js"; // tool_search / tool_result_read
 import "./edit.js"; // edit_file
 import "./search.js"; // grep / glob / ls
 import "./patch.js"; // apply_patch

package/dist/tools/ask_user.js

@@ -6,11 +6,11 @@
 // the TUI. In headless / non-TTY / `-p` / gateway runs there is no interactive user (ctx.ask is absent) — the
 // tool returns a clear "proceed with your best judgment" string instead of hanging. kind:"read" so it never
 // itself triggers the approval gate (the interaction IS the prompt).
-import { registerTool } from "./registry.js";
+import { getTool, registerTool } from "./registry.js";
 /** Returned when nobody can answer (headless / non-TTY / -p / gateway / sub-agent). Phrased so the model
  *  keeps going on its own judgment rather than re-asking or stalling. */
 export const NO_INTERACTIVE_USER = "(no interactive user available — proceed with your best judgment)";
-registerTool({
+const definition = {
     name: "ask_user",
     description: "Ask the user ONE structured question mid-turn and wait for their answer, then continue. " +
         "Use this ONLY when you are genuinely blocked on a decision that ONLY the user can make — an ambiguous " +
@@ -23,6 +23,7 @@ registerTool({
         "In a non-interactive run (no terminal) it returns a 'proceed with your best judgment' note instead of " +
         "blocking, so prefer making a reasonable call over asking when context already answers the question.",
     kind: "read", // the prompt itself is the interaction; never route it through the approval gate
+    classify: () => ({ effect: "interactive", concurrencySafe: false }),
     input_schema: {
         type: "object",
         properties: {
@@ -65,4 +66,8 @@ registerTool({
             return `${NO_INTERACTIVE_USER} (ask failed: ${e?.message ?? e})`;
         }
     },
-});
+};
+registerTool(definition);
+/** Exact registered identity used by the agent loop to grant the engine-owned prompt its pausable
+ * active-budget semantics. A plugin that later shadows the public name does not inherit that authority. */
+export const askUserTool = getTool(definition.name);

package/dist/tools/builtin.js

@@ -13,6 +13,7 @@ import { BinaryFileError, readVerifiedRegularFileSnapshot, resolveVerifiedModelP
 import { startJob, listJobs, tailJob, killJob } from "../exec/jobs.js";
 import { sensitiveFileError, sensitiveShellCommandReason } from "../security/sensitive-files.js";
 import { createToolOutputLineRedactor, redactToolSubprocessOutput } from "../security/subprocess-env.js";
+import { isReadOnlyCommand, splitCompound } from "../security/permissions.js";
 import { hostsInCommand, isNetworkGitOp, hostFromConnectError, isConnectFailure, markHostUnreachable, isHostUnreachable, unreachableHostsSnapshot, } from "./net-reachability.js";
 const MAX = 100_000;
 /** Package installs are network-bound and routinely exceed the ordinary foreground cap. */
@@ -123,6 +124,7 @@ registerTool({
         required: ["path"],
     },
     kind: "read",
+    concurrencySafe: true,
     async run(input, ctx) {
         const p = abs(input.path, ctx.cwd);
         const denied = sensitiveFileError(p, "read");
@@ -211,6 +213,16 @@ registerTool({
         required: ["command"],
     },
     kind: "exec",
+    classify(input) {
+        const command = typeof input?.command === "string" ? input.command : "";
+        const parts = command ? splitCompound(command) : null;
+        const readOnly = !Boolean(input?.background)
+            && !!parts?.length
+            && parts.every(isReadOnlyCommand);
+        return readOnly
+            ? { effect: "read", concurrencySafe: true }
+            : { effect: "exec", concurrencySafe: false };
+    },
     requiresProjectWorkspace: true,
     async run(input, ctx) {
         if (input.background !== undefined && typeof input.background !== "boolean") {
@@ -310,7 +322,13 @@ registerTool({
         },
         required: ["action"],
     },
-    kind: "read", // manages only the agent's own background jobs; safe to run unconfirmed
+    kind: "exec", // conservative default; list/tail are downgraded per input, kill remains approval-gated
+    classify(input) {
+        const action = String(input?.action ?? "");
+        return action === "list" || action === "tail"
+            ? { effect: "read", concurrencySafe: true }
+            : { effect: "exec", concurrencySafe: false, destructive: action === "kill" };
+    },
     async run(input) {
         const action = String(input.action);
         if (action === "list") {

package/dist/tools/codebase.js

@@ -32,6 +32,7 @@ registerTool({
         required: ["query"],
     },
     kind: "read",
+    concurrencySafe: true,
     async run(input, ctx) {
         if (ctx.signal?.aborted)
             throw new Error("codebase_search interrupted by agent run deadline or cancellation");

package/dist/tools/computer.js

@@ -391,6 +391,7 @@ if (!process.env.HARA_GATEWAY || process.env.HARA_GATEWAY_COMPUTER === "1") {
             required: ["action"],
         },
         kind: "computer",
+        visibility: "deferred",
         async run(input, ctx) {
             if (ctx.signal?.aborted)
                 throw new ComputerInterruptedError();

package/dist/tools/cron.js

@@ -62,6 +62,16 @@ registerTool({
         required: ["action"],
     },
     kind: "exec", // scheduling machinery on the user's machine — approval-gated like any exec
+    visibility: "deferred",
+    classify(input) {
+        return input?.action === "list"
+            ? { effect: "read", concurrencySafe: true }
+            : {
+                effect: "exec",
+                concurrencySafe: false,
+                destructive: input?.action === "remove" || input?.action === "disable",
+            };
+    },
     async run(input, ctx) {
         if (process.env.HARA_CRON === "1")
             return "Error: cron-run sessions cannot manage cron jobs (recursion guard — a scheduled task must not schedule more tasks).";

package/dist/tools/external_agent.js

@@ -109,6 +109,7 @@ registerTool({
         "another agent to own end-to-end. It can read/write/run on the host, so it's gated by approval. " +
         "Args: task (required), backend (claude|codex; default = first installed), model (optional).",
     kind: "exec", // → approval gate; never exposed to read-only fan-out sub-agents
+    visibility: "deferred",
     requiresProjectWorkspace: true,
     trustBoundary: "external",
     input_schema: {

package/dist/tools/memory.js

@@ -26,6 +26,7 @@ registerTool({
         required: ["query"],
     },
     kind: "read",
+    concurrencySafe: true,
     async run(input, ctx) {
         const hits = await searchHybrid(String(input.query ?? ""), ctx.cwd, { indexName: "memory", roots: memoryRoots(ctx.cwd), limit: Math.min(Number(input.limit) || 5, 10), signal: ctx.signal });
         if (!hits.length)
@@ -38,6 +39,7 @@ registerTool({
     description: "Read a memory file in full (use after memory_search to pull the exact entry).",
     input_schema: { type: "object", properties: { path: { type: "string" } }, required: ["path"] },
     kind: "read",
+    concurrencySafe: true,
     async run(input, ctx) {
         const p = isAbsolute(String(input.path)) ? String(input.path) : resolve(ctx.cwd, String(input.path));
         if (!memoryRoots(ctx.cwd).some((root) => {

package/dist/tools/registry.js

@@ -1,4 +1,4 @@
-import { limitToolResult } from "./result-limit.js";
+import { prepareToolResult } from "./result-limit.js";
 import { homeWorkspaceActionError, isUnsafeProjectWorkspace } from "../context/workspace-scope.js";
 /** Names of required parameters that are ABSENT (undefined/null) in a tool call's input. Defends
  *  against models that drop parameters outright (observed: qwen3.7-plus losing write_file's
@@ -31,7 +31,10 @@ export function registerTool(t) {
             if (t.requiresProjectWorkspace && isUnsafeProjectWorkspace(ctx.cwd)) {
                 return `Error: ${homeWorkspaceActionError(`run ${t.name}`)}`;
             }
-            return limitToolResult(await run(input, ctx));
+            // Verified read_file content already passed the protected-file policy. Preserve its historical
+            // explicit opt-in semantics and harmless template placeholders in the immediate preview; oversized
+            // continuation storage is still independently redacted by storeToolResult().
+            return prepareToolResult(await run(input, ctx), undefined, { redactPreview: t.name !== "read_file" });
         },
     });
     specsCache = null;
@@ -42,8 +45,53 @@ export function getTool(name) {
 export function getTools() {
     return [...registry.values()];
 }
+function defaultEffect(tool) {
+    if (tool.kind === "edit")
+        return "edit";
+    if (tool.kind === "exec")
+        return "exec";
+    if (tool.kind === "computer")
+        return "computer";
+    if (tool.kind === "read")
+        return "read";
+    // Legacy/plugin tools that omitted their safety declaration used to remain approval-gated. Preserve that
+    // conservative boundary: missing metadata must never silently mean read-only.
+    return "exec";
+}
+const TOOL_EFFECTS = new Set(["read", "state", "edit", "exec", "computer", "interactive"]);
+/** Conservative, non-throwing classifier shared by approval, understanding, guardian, and scheduling. */
+export function toolOperationTraits(tool, input, ctx) {
+    const effect = defaultEffect(tool);
+    const fallback = { effect, concurrencySafe: tool.concurrencySafe === true };
+    if (!tool.classify)
+        return fallback;
+    try {
+        const classified = tool.classify(input, ctx);
+        if (!classified || typeof classified !== "object" || !TOOL_EFFECTS.has(classified.effect)) {
+            return { ...fallback, concurrencySafe: false };
+        }
+        return {
+            effect: classified.effect,
+            concurrencySafe: classified.concurrencySafe === true,
+            ...(classified.destructive === true ? { destructive: true } : {}),
+        };
+    }
+    catch {
+        // A failed classifier may never downgrade into parallel execution.
+        return { ...fallback, concurrencySafe: false };
+    }
+}
+export function approvalKindForOperation(traits) {
+    if (traits.effect === "edit")
+        return "edit";
+    if (traits.effect === "exec")
+        return "exec";
+    if (traits.effect === "computer")
+        return "computer";
+    return "read";
+}
 /** Provider-neutral tool specs derived from the registry. */
-export function toolSpecs() {
+export function toolSpecs(options) {
     if (!specsCache) {
         specsCache = getTools().map((t) => ({
             name: t.name,
@@ -51,7 +99,50 @@ export function toolSpecs() {
             input_schema: t.input_schema,
         }));
     }
+    const visible = options === undefined || options.includeDeferred
+        ? specsCache
+        : specsCache.filter((spec) => {
+            const tool = registry.get(spec.name);
+            return tool?.visibility !== "deferred" || options.activatedDeferred?.has(spec.name);
+        });
     // Callers commonly filter the array for a role. Return a shallow copy so that never mutates the
     // stable cached snapshot shared by subsequent agent rounds.
-    return specsCache.slice();
+    return visible.slice();
+}
+function catalogTerms(value) {
+    return value.toLowerCase().split(/[^a-z0-9_\-\u3400-\u9fff]+/u).filter(Boolean);
+}
+/** Search deferred tools without exposing every JSON schema. Names rank above descriptions. */
+export function searchDeferredToolCatalog(query, limit = 8) {
+    const normalized = query.trim().toLowerCase();
+    if (!normalized)
+        return [];
+    const terms = catalogTerms(normalized);
+    const matches = [];
+    for (const tool of getTools()) {
+        if (tool.visibility !== "deferred")
+            continue;
+        const name = tool.name.toLowerCase();
+        const description = tool.description.toLowerCase();
+        let score = 0;
+        if (name === normalized)
+            score += 100;
+        if (name.includes(normalized))
+            score += 30;
+        if (description.includes(normalized))
+            score += 15;
+        for (const term of terms) {
+            if (name === term)
+                score += 20;
+            else if (name.includes(term))
+                score += 8;
+            if (description.includes(term))
+                score += 3;
+        }
+        if (score > 0)
+            matches.push({ name: tool.name, description: tool.description, score });
+    }
+    return matches
+        .sort((a, b) => b.score - a.score || a.name.localeCompare(b.name))
+        .slice(0, Math.max(1, Math.min(32, Math.floor(limit))));
 }

package/dist/tools/result-limit.js

@@ -1,6 +1,21 @@
-// One invariant for every registered tool: no single result may monopolize the model context. Individual
-// tools can use tighter domain-specific limits, but this final boundary also covers plugins/new tools.
+// Tool results cross two boundaries: the model needs a bounded preview, while useful command/MCP output
+// must remain recoverable. Oversized redacted values are therefore written to Hara's private state and
+// represented by an opaque id that the model can page with tool_result_read.
+import { randomBytes } from "node:crypto";
+import { lstatSync, readdirSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { bindPrivateHaraStateFile, readPrivateStateFileSnapshotSync, removePrivateStateFile, writePrivateStateFileSync, } from "../security/private-state.js";
+import { redactToolSubprocessOutput } from "../security/subprocess-env.js";
 export const MAX_TOOL_RESULT_CHARS = 24_000;
+export const MAX_TOOL_RESULT_BATCH_CHARS = 64_000;
+export const MAX_TOOL_RESULT_READ_CHARS = 18_000;
+export const MAX_STORED_TOOL_RESULT_BYTES = 4 * 1024 * 1024;
+const MAX_STORED_TOOL_RESULT_TOTAL_BYTES = 64 * 1024 * 1024;
+const MAX_STORED_TOOL_RESULT_FILES = 128;
+const STORED_TOOL_RESULT_TTL_MS = 7 * 24 * 60 * 60 * 1000;
+const RESULT_ID = /^tr_[a-f0-9]{32}$/;
+const RESULT_FILE = /^(tr_[a-f0-9]{32})\.txt$/;
 function safeHead(value, end) {
     let at = Math.max(0, Math.min(value.length, end));
     if (at > 0 && /[\uD800-\uDBFF]/.test(value[at - 1] ?? ""))
@@ -35,3 +50,158 @@ export function limitToolResult(value, max = MAX_TOOL_RESULT_CHARS) {
     const tailChars = room - headChars;
     return safeHead(text, headChars) + marker + safeTail(text, text.length - tailChars);
 }
+function resultBinding(id) {
+    if (!RESULT_ID.test(id))
+        throw new Error("invalid tool result id");
+    return bindPrivateHaraStateFile(homedir(), ["tool-results"], `${id}.txt`);
+}
+/** Remove only verified single-link private-state files. Changed, linked, or aliased entries are retained
+ * and count against the quota, making a hostile local preseed fail closed. */
+function pruneStore(directory, incomingBytes, now = Date.now()) {
+    const entries = [];
+    let totalBytes = 0;
+    let totalFiles = 0;
+    for (const name of readdirSync(directory.path)) {
+        if (!RESULT_FILE.test(name))
+            continue;
+        const path = join(directory.path, name);
+        try {
+            const info = lstatSync(path);
+            totalFiles++;
+            totalBytes += info.size;
+            if (info.isFile() && !info.isSymbolicLink() && info.nlink === 1) {
+                entries.push({ path, size: info.size, mtimeMs: info.mtimeMs });
+            }
+        }
+        catch {
+            // A disappearing or changed entry is not safe to remove.
+        }
+    }
+    entries.sort((a, b) => a.mtimeMs - b.mtimeMs);
+    for (const entry of entries) {
+        const expired = now - entry.mtimeMs > STORED_TOOL_RESULT_TTL_MS;
+        const overQuota = totalFiles >= MAX_STORED_TOOL_RESULT_FILES
+            || totalBytes + incomingBytes > MAX_STORED_TOOL_RESULT_TOTAL_BYTES;
+        if (!expired && !overQuota)
+            continue;
+        try {
+            const snapshot = readPrivateStateFileSnapshotSync(entry.path, MAX_STORED_TOOL_RESULT_BYTES);
+            if (!snapshot)
+                continue;
+            removePrivateStateFile(entry.path, snapshot, directory);
+            totalFiles--;
+            totalBytes -= entry.size;
+        }
+        catch {
+            // Never unlink a path that failed the private-state identity boundary.
+        }
+    }
+    return (totalFiles < MAX_STORED_TOOL_RESULT_FILES
+        && totalBytes + incomingBytes <= MAX_STORED_TOOL_RESULT_TOTAL_BYTES);
+}
+/** Store only a redacted, bounded UTF-8 value. Failure degrades to an ordinary preview; the original tool
+ * action must not fail merely because this optional continuation store is unavailable. */
+export function storeToolResult(value) {
+    const raw = typeof value === "string" ? value : String(value ?? "");
+    const text = redactToolSubprocessOutput(raw);
+    const bytes = Buffer.byteLength(text, "utf8");
+    if (!bytes || bytes > MAX_STORED_TOOL_RESULT_BYTES)
+        return null;
+    try {
+        const id = `tr_${randomBytes(16).toString("hex")}`;
+        const binding = resultBinding(id);
+        if (!pruneStore(binding.directory, bytes))
+            return null;
+        writePrivateStateFileSync(binding, text);
+        return { id, chars: text.length };
+    }
+    catch {
+        return null;
+    }
+}
+function referenceFooter(stored, compact = false) {
+    if (compact)
+        return `[tool result ${stored.id}; use tool_result_read]`;
+    return (`\n…[hara: ${stored.chars} redacted chars stored as ${stored.id}; ` +
+        `call tool_result_read with {"id":"${stored.id}","offset":0,"limit":${MAX_TOOL_RESULT_READ_CHARS}} to continue]…`);
+}
+function previewWithReference(text, stored, max) {
+    const cap = Math.max(0, Math.floor(max));
+    if (!cap)
+        return "";
+    const footer = referenceFooter(stored);
+    if (footer.length + 32 < cap)
+        return limitToolResult(text, cap - footer.length) + footer;
+    return limitToolResult(referenceFooter(stored, true), cap);
+}
+/** Registry boundary: redact ordinary results and spool them before trimming so direct callers and the main
+ * loop receive the same safe representation. Verified file reads may keep their immediate preview because
+ * their protected-file policy has already run; continuation storage remains redacted independently. */
+export function prepareToolResult(value, max = MAX_TOOL_RESULT_CHARS, options = {}) {
+    const raw = typeof value === "string" ? value : String(value ?? "");
+    const text = options.redactPreview === false ? raw : redactToolSubprocessOutput(raw);
+    const cap = Math.max(0, Math.floor(max));
+    if (text.length <= cap)
+        return text;
+    const stored = storeToolResult(raw);
+    return stored ? previewWithReference(text, stored, cap) : limitToolResult(text, cap);
+}
+function existingResultReference(text) {
+    const match = text.match(/\[hara:\s+(\d+)\s+redacted chars stored as (tr_[a-f0-9]{32});/);
+    if (!match)
+        return null;
+    const [, charsText, id] = match;
+    try {
+        const binding = resultBinding(id);
+        const snapshot = readPrivateStateFileSnapshotSync(binding.path, MAX_STORED_TOOL_RESULT_BYTES);
+        if (!snapshot)
+            return null;
+        const chars = Number(charsText);
+        return { id, chars: Number.isFinite(chars) ? chars : snapshot.text.length };
+    }
+    catch {
+        return null;
+    }
+}
+/** Bound one parallel tool round. Values reduced only because siblings consumed the round budget receive
+ * their own continuation id instead of losing content. */
+export function limitToolResultBatch(values, max = MAX_TOOL_RESULT_BATCH_CHARS) {
+    const cap = Math.max(0, Math.floor(max));
+    if (values.reduce((sum, value) => sum + value.length, 0) <= cap)
+        return [...values];
+    if (!values.length)
+        return [];
+    const allowance = Math.floor(cap / values.length);
+    return values.map((value) => {
+        if (value.length <= allowance)
+            return value;
+        const stored = existingResultReference(value) ?? storeToolResult(value);
+        return stored ? previewWithReference(value, stored, allowance) : limitToolResult(value, allowance);
+    });
+}
+/** Page one opaque result id. Paths are never accepted, and the private reader rejects symlinks/hard links. */
+export function readStoredToolResult(id, offsetValue = 0, limitValue = MAX_TOOL_RESULT_READ_CHARS) {
+    if (!RESULT_ID.test(id))
+        return "Error: invalid tool result id.";
+    const offset = Math.max(0, Math.floor(Number(offsetValue) || 0));
+    const limit = Math.min(MAX_TOOL_RESULT_READ_CHARS, Math.max(1, Math.floor(Number(limitValue) || MAX_TOOL_RESULT_READ_CHARS)));
+    try {
+        const binding = resultBinding(id);
+        const snapshot = readPrivateStateFileSnapshotSync(binding.path, MAX_STORED_TOOL_RESULT_BYTES);
+        if (!snapshot)
+            return `Error: tool result ${id} was not found or has expired. Re-run the narrow source query.`;
+        const text = snapshot.text;
+        if (offset >= text.length)
+            return `(tool result ${id} has ${text.length} chars; offset ${offset} is past the end)`;
+        const end = Math.min(text.length, offset + limit);
+        let slice = safeTail(text, offset);
+        slice = safeHead(slice, end - offset);
+        const actualEnd = offset + slice.length;
+        const header = `(tool result ${id}: chars ${offset}–${actualEnd} of ${text.length}` +
+            `${actualEnd < text.length ? `; continue with offset:${actualEnd}` : ""})\n`;
+        return header + slice;
+    }
+    catch (error) {
+        return `Error: cannot read tool result ${id}: ${error instanceof Error ? error.message : String(error)}`;
+    }
+}

package/dist/tools/runtime.js

@@ -0,0 +1,67 @@
+// Provider-neutral deferred tool discovery and continuation reads for oversized tool output.
+// These eager tools replace two context-hostile patterns: exposing every long-tail schema up front, and
+// rerunning a broad command because the useful middle of its output was discarded.
+import { registerTool, searchDeferredToolCatalog } from "./registry.js";
+import { MAX_TOOL_RESULT_READ_CHARS, readStoredToolResult } from "./result-limit.js";
+registerTool({
+    name: "tool_search",
+    description: "Search Hara's deferred tool catalog when the current task needs a capability that is not already listed. " +
+        "Matching tools become available on the NEXT model round without loading every long-tail/MCP schema up front. " +
+        "Search by capability or service, for example browser, wechat, spreadsheet, or calendar.",
+    input_schema: {
+        type: "object",
+        properties: {
+            query: { type: "string", description: "Capability, service, or action to find." },
+            max_results: { type: "integer", minimum: 1, maximum: 8, description: "Maximum matches to activate (default 5)." },
+        },
+        required: ["query"],
+    },
+    kind: "read",
+    classify: () => ({ effect: "state", concurrencySafe: false }),
+    async run(input, ctx) {
+        const query = typeof input?.query === "string" ? input.query.trim() : "";
+        if (!query)
+            return "Error: tool_search needs a non-empty query.";
+        const limit = Math.max(1, Math.min(8, Math.floor(Number(input?.max_results) || 5)));
+        // Search beyond the display limit because a role filter may reject high-ranked candidates.
+        const candidates = searchDeferredToolCatalog(query, 32);
+        const selected = [];
+        for (const match of candidates) {
+            const accepted = ctx.activateTools ? ctx.activateTools([match.name]) : [match.name];
+            if (!accepted.includes(match.name))
+                continue;
+            selected.push(match);
+            if (selected.length >= limit)
+                break;
+        }
+        if (!selected.length) {
+            return `No deferred tools matching "${query}" are available to this run. Use an existing tool or refine the query.`;
+        }
+        return (`Activated ${selected.length} tool(s) for the next model round:\n` +
+            selected.map((match) => `- ${match.name} — ${match.description.slice(0, 300)}`).join("\n"));
+    },
+});
+registerTool({
+    name: "tool_result_read",
+    description: "Read the next bounded character slice of an oversized tool result stored under an opaque tr_* id. " +
+        "Use the id and continuation offset from the truncation notice; this tool never accepts filesystem paths.",
+    input_schema: {
+        type: "object",
+        properties: {
+            id: { type: "string", pattern: "^tr_[a-f0-9]{32}$", description: "Opaque result id from a tool output." },
+            offset: { type: "integer", minimum: 0, description: "0-based character offset (default 0)." },
+            limit: {
+                type: "integer",
+                minimum: 1,
+                maximum: MAX_TOOL_RESULT_READ_CHARS,
+                description: `Characters to return (default/max ${MAX_TOOL_RESULT_READ_CHARS}).`,
+            },
+        },
+        required: ["id"],
+    },
+    kind: "read",
+    concurrencySafe: true,
+    async run(input) {
+        return readStoredToolResult(String(input?.id ?? ""), input?.offset, input?.limit);
+    },
+});

package/dist/tools/search.js

@@ -522,6 +522,7 @@ registerTool({
         required: ["pattern"],
     },
     kind: "read",
+    concurrencySafe: true,
     async run(input, ctx) {
         const pattern = typeof input.pattern === "string" ? input.pattern : "";
         if (pattern.length > MAX_PATTERN_CHARS)
@@ -606,6 +607,7 @@ registerTool({
         required: ["pattern"],
     },
     kind: "read",
+    concurrencySafe: true,
     async run(input, ctx) {
         const root = absOf(input.path, ctx.cwd);
         const denied = sensitiveFileError(root, "search");
@@ -672,6 +674,7 @@ registerTool({
         properties: { path: { type: "string", description: "directory (default: cwd)" } },
     },
     kind: "read",
+    concurrencySafe: true,
     async run(input, ctx) {
         if (isHomeWorkspace(ctx.cwd))
             return homeWorkspaceDirectoryScanError("ls");

package/dist/tools/skill.js

@@ -11,6 +11,7 @@ registerTool({
         "call this to get a skill's steps before performing a task it covers, then follow them.",
     input_schema: { type: "object", properties: { id: { type: "string", description: "the skill id from the Skills list" } }, required: ["id"] },
     kind: "read",
+    concurrencySafe: true,
     async run(input, ctx) {
         const id = String(input.id ?? "").trim();
         const sk = loadSkillIndex(ctx.cwd).find((s) => s.id === id);

package/dist/tools/task.js

@@ -436,6 +436,11 @@ registerTool({
         required: ["action"],
     },
     kind: "edit",
+    classify(input) {
+        return input?.action === "list"
+            ? { effect: "read", concurrencySafe: true }
+            : { effect: "edit", concurrencySafe: false, destructive: input?.action === "remove" };
+    },
     async run(input, ctx) {
         try {
             return withTaskLock(ctx.cwd, () => {

package/dist/tools/todo.js

@@ -1,6 +1,6 @@
 // todo_write — an inline task checklist the agent maintains during a turn (like codex's update_plan /
 // Claude Code's TodoWrite). Keeps the model organized on multi-step work and shows the user live progress.
-// In-memory, replace-whole-list semantics; kind:"read" so it never prompts and is safe to call freely.
+// In-memory, replace-whole-list semantics; approval-safe but serialized because it mutates shared run state.
 import { registerTool } from "./registry.js";
 const DEFAULT_SCOPE = "default";
 const stores = new Map([[DEFAULT_SCOPE, []]]);
@@ -133,7 +133,8 @@ registerTool({
         },
         required: ["todos"],
     },
-    kind: "read", // pure state + display: never prompts, parallel-safe
+    kind: "read", // state/display only: never prompts; input-level traits keep replacement writes serial
+    classify: () => ({ effect: "state", concurrencySafe: false }),
     async run(input, ctx) {
         const scope = scopeKey(ctx.todoScope);
         const raw = Array.isArray(input.todos) ? input.todos : [];

package/dist/tools/web.js

@@ -399,6 +399,8 @@ registerTool({
         required: ["query"],
     },
     kind: "read",
+    concurrencySafe: true,
+    visibility: "deferred",
     async run(input, ctx) {
         if (ctx.signal?.aborted)
             throw interrupted("web search");
@@ -506,6 +508,8 @@ registerTool({
         required: ["url"],
     },
     kind: "read",
+    concurrencySafe: true,
+    visibility: "deferred",
     async run(input, ctx) {
         if (ctx.signal?.aborted)
             throw interrupted("web fetch");

package/dist/tui/App.js

@@ -299,7 +299,11 @@ function StatusRow({ working, steerable, todos, queued }) {
     const elapsedSec = Math.floor((Date.now() - startRef.current) / 1000);
     // Pre-first-token honesty (codex-parity): "waiting for the model" reads very differently from a
     // generic "working" when the network is slow — the user knows the request is out, not dead.
-    const verb = (phase === "waiting" ? `waiting for the model… ${elapsedSec}s · esc to interrupt` : spinnerVerb(todos, elapsedSec)) + bgTag;
+    const verb = (phase === "awaiting_user"
+        ? "waiting for your answer · task timer paused · esc to cancel"
+        : phase === "waiting"
+            ? `waiting for the model… ${elapsedSec}s · esc to interrupt`
+            : spinnerVerb(todos, elapsedSec)) + bgTag;
     return (_jsxs(Box, { marginTop: 1, children: [_jsx(Text, { color: "yellow", children: frames[frame % frames.length] }), _jsx(Text, { dimColor: true, children: ` ${verb} · ${steerable ? "⏎ steers · /next queues" : "⏎ queues next"}${queued ? ` (${queued})` : ""}` })] }));
 }
 // Short per-mode descriptions for the ONE-ROW mode line (the old two-row ModeBar's long sentences

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanhara/hara",
-  "version": "0.125.3",
+  "version": "0.126.0",
   "description": "hara — a coding agent CLI that runs like an engineering org.",
   "bin": {
     "hara": "runtime-bootstrap.cjs"