@nanhara/hara 0.125.3 → 0.126.1

package/CHANGELOG.md

@@ -5,6 +5,64 @@ All notable changes to `@nanhara/hara`.
 > Versioning (pre-1.0, SemVer-style): the **minor** (middle) number bumps for a **new feature**; the
 > **patch** (last) number bumps for **optimizations/fixes of existing features**.
 
+## 0.126.1 — 2026-07-19 — verified plugin packages and ownership-safe lifecycle
+
+- **Plugin packages now fail closed at staging.** Hara validates a bounded manifest schema, portable IDs and
+  relative paths, declared Skills/roles/binaries/panels, and MCP entry points before activation. Complete
+  package scans reject symbolic links, hard-linked or special files, protected credential-shaped files,
+  filesystem-boundary crossings, and excessive file/byte counts.
+- **Install, update, and removal have an ownership transaction.** A same-filesystem private staging directory
+  is atomically activated; command collisions never overwrite foreign entries; and a private receipt binds the
+  installed root device/inode, manifest digest, and exact command links. Update rollback preserves the previous
+  package and commands, while uninstall refuses a changed root, a foreign command replacement, or an older
+  unreceipted install. A legacy plugin remains usable; reinstalling it from the same reviewed source performs
+  the one-time receipt migration, after which later updates and removal use the verified ownership path.
+- **Plugin MCP processes are rooted in their installed package.** Relative executables and conventional
+  Node/Bun/Deno/Python entry scripts are verified and converted to absolute installed paths, and each server
+  receives the immutable plugin root as its working directory instead of the user's project.
+- Install warnings no longer echo manifest-provided MCP arguments or hook command bodies, which could contain
+  credentials. They still identify each executable surface so the package source can be reviewed before use.
+- Upgrade with `npm i -g @nanhara/hara@0.126.1`.
+
+## 0.126.0 — 2026-07-19 — provider control plane, bounded tools, and honest execution time
+
+- **Desktop can configure providers through an authenticated, redacted Serve control plane.** The shared
+  catalog distinguishes cloud, local, OAuth, and managed routes; settings can list, test, and save a Personal
+  route without returning credentials to the UI. Switching provider or endpoint requires a matching new key
+  instead of replaying another vendor's credential, named/managed profiles remain explicit, and launch-time
+  environment overrides stay immutable from Desktop.
+- **Ollama and LM Studio are first-class local providers.** They require no fake API key, accept only
+  loopback HTTP endpoints, omit the Authorization header on the wire, and can discover installed models
+  through the same bounded connection-test path. Cloud custom endpoints continue to require HTTPS except
+  for an explicit loopback target.
+- **Tool execution has conservative runtime traits.** Tools without a complete declaration default to
+  side-effect-capable and serial; input-level classification can narrow a real read but cannot turn a
+  mutating call into an inherited read approval. Parallel calls share an aggregate result budget so one
+  round cannot flood the next model request.
+- **Long-tail tool schemas and large results are demand-loaded.** `tool_search` activates only matched,
+  role-allowed capabilities for the next model round. Oversized, redacted tool output is kept in a
+  quota/TTL-bounded private store and exposed only through opaque `tool_result_read` continuation IDs, never
+  arbitrary filesystem paths.
+
+- Human clarification and approval waits no longer consume `runTimeoutMs`. The non-renewable budget now
+  measures active model/tool execution, resumes with the exact remaining time after an answer, and still
+  stops genuinely stuck providers, tools, and loops. Esc, shutdown, and explicit cancellation continue to
+  dismiss a waiting prompt immediately.
+- The TUI distinguishes this state as `waiting for your answer · task timer paused`; five-minute and 80%
+  lifecycle notices no longer fire while Hara is waiting for a person.
+- `hara serve` now exposes authenticated `server.shutdown` so Desktop can gracefully release sessions and
+  locks before relaunching after an update.
+- Timed-out or interrupted provider/tool calls retain their Serve session lease until the underlying
+  operation physically settles. A second turn, session deletion, or updater shutdown receives `BUSY`
+  instead of overlapping a non-cooperative request or releasing its lock early.
+- Headless resumed sessions use the same physical-lifetime rule for dynamically nested sub-agents and
+  automatic compaction, so a late child request cannot escape a cleanup snapshot and release the
+  cross-process lock early.
+- The WeCom gateway now uses the bundled `ws` transport because Node 22's native WebSocket handshake is
+  rejected by WeCom's production endpoint before authentication. A late authentication frame can no longer
+  revive an already-aborted connection or install a heartbeat after cleanup.
+- Upgrade with `npm i -g @nanhara/hara@0.126.0`.
+
 ## 0.125.3 — 2026-07-18 — conversation/task boundary and deliberate execution
 
 - **Chat delivery is now separate from task execution.** Slash controls such as `/model` no longer create a
@@ -38,7 +96,7 @@ All notable changes to `@nanhara/hara`.
   unless `HARA_ALLOW_TRUSTED_EXTENSIONS=1` was set before launch.
 - MCP stderr now drops only npm 11's repeated `Unknown user config "always-auth"` and `"home"` deprecation
   lines. Other npm warnings and all actual server errors remain visible and redacted. Hara does not read,
-  rewrite, or weaken the user's `.npmrc`. Esc, interruption, and the total task deadline now also cancel a
+  rewrite, or weaken the user's `.npmrc`. Esc, interruption, and the active-execution deadline now also cancel a
   lazy MCP startup/tool call and close an unresponsive child instead of leaving it behind.
 - Upgrade with `npm i -g @nanhara/hara@0.125.3`.
 

package/README.md

@@ -238,7 +238,10 @@ and a near-duplicate is flagged so it updates instead of piling up. `assetCaptur
 **Plugins** — bundle skills + roles + MCP servers in one installable unit (Claude-Code-compatible
 `plugin.json` / `.claude-plugin/`). `hara plugin add file:<path> | github:<owner/repo> | git:<url>` installs it;
 `hara plugin` lists; `enable`/`disable`/`remove`. A plugin's skills/roles/MCP auto-contribute (your project &
-global override them). `.claude/agents/*.md` subagents load as roles too.
+global override them). Installation validates the full package in a private stage, activates it atomically,
+and records an owner-only receipt for the exact root and command links. Plugins installed before `0.126.1`
+remain usable; reinstall the same reviewed source once to create the receipt before removing them.
+`.claude/agents/*.md` subagents load as roles too.
 
 **Recall** — `hara recall --init` creates a personal `~/.hara/code-assets` library (snippets as `*.md`);
 `hara recall "<query>"` searches it **plus your skills** (one corpus), and `/recall <query>` pulls the best
@@ -286,9 +289,12 @@ checkpointed in its own model/tool round. Mixed tools are classified by action (
 a brief revision cannot share its round with a side effect. `/task` shows the current execution identity and brief. See
 [`docs/conversation-task-execution.md`](docs/conversation-task-execution.md).
 **Notifications**: `hara config set notify bell` (terminal bell) or `notify system` (OS notification) pings you when a turn finishes — handy for long runs you've stepped away from. Gated on elapsed time so quick turns stay quiet; off by default.
-**Run limits and loop alarms**: every agent turn has a non-renewable 30-minute total deadline and a 64-round
-model/tool cap. Hara warns after five minutes or at 75% of the round budget, stops the third identical failing
-tool call, and surfaces the final reason in CLI, Desktop, or gateway output. Tune intentional long work with
+**Run limits and loop alarms**: every agent turn has a non-renewable 30-minute active-execution budget and a
+64-round model/tool cap. Time spent waiting for an engine-owned question or approval does not consume that
+budget; the status row says the task timer is paused, while Esc, shutdown, and explicit cancellation still
+take effect immediately. Answering resumes the remaining budget rather than resetting it. Hara warns after
+five active minutes or at 75% of the round budget, stops the third identical failing tool call, and surfaces
+the final reason in CLI, Desktop, or gateway output. Tune intentional long work with
 `hara config set runTimeoutMs 45m` (1s..2h) and `hara config set maxAgentRounds 96` (1..256), or
 `HARA_RUN_TIMEOUT_MS` / `HARA_MAX_AGENT_ROUNDS`; neither boundary can be disabled. Sub-agents are capped at
 8 minutes/24 rounds and inherit the parent's cancellation. Auxiliary model work (planning, verification,

package/SECURITY.md

@@ -74,9 +74,13 @@ local user (who already has your shell).
   permission and starts one named server only when a task needs it. Their inherited environment is still
   scrubbed, but the extension may use its own credentials or access anything its host process permits.
 - **Plugins are code you trust.** Installing a plugin (`hara plugin add`) grants its author code execution:
-  its MCP servers may run on first relevant use and its hooks may run around matching tool calls. `hara plugin
-  add` **prints the exact commands** a plugin can run so you can review them; disable with
-  `hara plugin disable <name>`.
+  its MCP servers may run on first relevant use and its hooks may run around matching tool calls. Installation
+  validates the complete package in a private same-filesystem stage, binds executable contributions to portable
+  package-relative paths, and records an owner-only root/manifest/command receipt before removal is allowed.
+  `hara plugin add` identifies each executable surface without echoing manifest-provided arguments or hook
+  bodies, which may contain credentials; review the package source itself, and disable it with
+  `hara plugin disable <name>`. Plugins installed before `0.126.1` remain usable; reinstalling one from the same
+  reviewed source creates the receipt required for later ownership-safe updates and removal.
 - **Coding-plan keys.** Provider keys you configure are used only to call the model endpoint you set.
 
 ## What is *not* a security boundary

package/dist/agent/limits.js

@@ -19,8 +19,8 @@ export function parseAgentRunTimeoutMs(value) {
     const parsed = amount * multiplier;
     return Number.isFinite(parsed) ? parsed : undefined;
 }
-/** Parse a total run deadline. Invalid/zero values cannot disable the safety boundary. Human values such
- * as `30m`, `90s`, and `1h` are accepted in config; HARA_RUN_TIMEOUT_MS also accepts plain milliseconds. */
+/** Parse the active execution deadline. Invalid/zero values cannot disable the safety boundary. Human values
+ * such as `30m`, `90s`, and `1h` are accepted in config; HARA_RUN_TIMEOUT_MS also accepts plain milliseconds. */
 export function agentRunTimeoutMs(value = process.env.HARA_RUN_TIMEOUT_MS) {
     const parsed = parseAgentRunTimeoutMs(value);
     if (parsed === undefined || parsed <= 0)