@nanhara/hara 0.132.3 → 0.133.0

package/dist/tools/builtin.js

@@ -1,5 +1,5 @@
 import { existsSync, readFileSync } from "node:fs";
-import { homedir } from "node:os";
+import { homedir, platform } from "node:os";
 import { resolve, isAbsolute } from "node:path";
 import { stdout as procOut } from "node:process";
 import { registerTool } from "./registry.js";
@@ -14,8 +14,16 @@ import { startJob, listJobs, tailJob, killJob } from "../exec/jobs.js";
 import { sensitiveFileError, sensitiveShellCommandReason } from "../security/sensitive-files.js";
 import { createToolOutputLineRedactor, redactToolSubprocessOutput } from "../security/subprocess-env.js";
 import { isReadOnlyCommand, splitCompound } from "../security/permissions.js";
+import { loadConfig } from "../config.js";
+import { commandHasPackageRegistry, normalizePackageRegistry, packageRegistryEnv } from "../package-registry.js";
 import { hostsInCommand, isNetworkGitOp, hostFromConnectError, isConnectFailure, markHostUnreachable, isHostUnreachable, unreachableHostsSnapshot, } from "./net-reachability.js";
 const MAX = 100_000;
+const MAX_PYTHON_SOURCE_BYTES = 500_000;
+/** Python source is delivered over stdin, so one-shot library operations never need a durable helper
+ *  script. Keep the command itself fixed: model-authored source must not be interpolated into a shell. */
+export function pythonStdinCommand(plat = platform()) {
+    return plat === "win32" ? "py -3 -" : "python3 -";
+}
 /** Package installs are network-bound and routinely exceed the ordinary foreground cap. */
 export function isPackageInstallCommand(command) {
     return /(?:^|[;&|]\s*)(?:npm\s+(?:i|install|ci)\b|pnpm\s+(?:i|install|add)\b|yarn(?:\s+(?:install|add))?(?:\s|$)|bun\s+(?:i|install|add)\b)/i.test(command.trim());
@@ -149,7 +157,9 @@ registerTool({
 });
 registerTool({
     name: "write_file",
-    description: "Create or overwrite a UTF-8 text file (creates parent directories).",
+    description: "Create or overwrite a UTF-8 text file (creates parent directories). This is text-only: do not use " +
+        "it for binary Office files or merely to save a one-shot Python helper before executing it; send " +
+        "one-shot Python source directly to the python tool instead.",
     input_schema: {
         type: "object",
         properties: {
@@ -200,6 +210,54 @@ registerTool({
         return `Wrote ${String(input.content).length} chars to ${p}` + (committed.warnings?.length ? ` Warning: ${committed.warnings.join("; ")}` : "");
     },
 });
+registerTool({
+    name: "python",
+    description: "Execute Python 3 source directly from this tool input over stdin; no .py helper file is created. " +
+        "Prefer this for one-shot library APIs such as python-docx. When editing an existing user document, " +
+        "keep the original path as the canonical output unless the user explicitly requests a copy/version. " +
+        "Use a temporary output only for atomic replacement and remove it in finally/on failure.",
+    input_schema: {
+        type: "object",
+        properties: {
+            code: { type: "string", description: "Python 3 source executed from stdin, never written to a .py file" },
+            timeout_ms: { type: "number", description: "default 300000 (5 min), bounded to 1s..1h" },
+        },
+        required: ["code"],
+    },
+    kind: "exec",
+    requiresProjectWorkspace: true,
+    async run(input, ctx) {
+        if (typeof input.code !== "string" || !input.code.trim()) {
+            return "Error: python `code` must be a non-empty string. Nothing executed.";
+        }
+        if (Buffer.byteLength(input.code, "utf8") > MAX_PYTHON_SOURCE_BYTES) {
+            return `Error: python source exceeds ${MAX_PYTHON_SOURCE_BYTES} bytes. Split the operation into smaller direct calls; do not create a helper script.`;
+        }
+        const protectedReason = sensitiveShellCommandReason(input.code, ctx.cwd);
+        if (protectedReason) {
+            return (`Blocked: Python source crosses Hara's protected secret boundary (${protectedReason}). ` +
+                "This deny is not bypassed by direct stdin execution or full-auto.");
+        }
+        const command = pythonStdinCommand();
+        try {
+            const result = await runShell(command, ctx.cwd, ctx.sandbox ?? "off", {
+                timeout: shellTimeoutMs(command, input.timeout_ms),
+                maxBuffer: 1_000_000,
+                signal: ctx.signal,
+                input: input.code,
+            });
+            const rendered = redactToolSubprocessOutput(capHeadTail([result.stdout, result.stderr].filter(Boolean).join("\n"))).trim();
+            return rendered ? `Python completed without creating a helper script.\n${rendered}` : "Python completed without creating a helper script.";
+        }
+        catch (error) {
+            const rendered = redactToolSubprocessOutput(capHeadTail([error?.stdout, error?.stderr].filter(Boolean).join("\n"))).trim();
+            if (error?.code === 127) {
+                return "Error: Python 3 is not available on PATH. Install Python 3 and the required library, then retry; no helper script was created.";
+            }
+            return `Python failed: ${error?.message ?? String(error)}.${rendered ? `\n${rendered}` : ""}`;
+        }
+    },
+});
 registerTool({
     name: "bash",
     description: "Run a shell command in the working directory; returns combined stdout/stderr.",
@@ -209,6 +267,7 @@ registerTool({
             command: { type: "string" },
             timeout_ms: { type: "number", description: "default 300000 (5 min), or 900000 (15 min) for package installs; bounded to 1s..1h" },
             background: { type: "boolean", description: "run as a background job (dev server, watcher, long task); package installs stay foreground unless explicitly requested" },
+            registry: { type: "string", description: "for package installs only: npmjs, npmmirror, or an HTTP(S) registry URL; injected as environment, never shell text" },
         },
         required: ["command"],
     },
@@ -228,6 +287,25 @@ registerTool({
         if (input.background !== undefined && typeof input.background !== "boolean") {
             return "Error: `background` must be a boolean (true or false), not a string or another truthy value.";
         }
+        const packageInstall = isPackageInstallCommand(String(input.command ?? ""));
+        if (input.registry !== undefined && typeof input.registry !== "string") {
+            return "Error: `registry` must be a string such as npmmirror or https://registry.npmjs.org/.";
+        }
+        if (input.registry !== undefined && !packageInstall) {
+            return "Error: `registry` applies only to npm/pnpm/yarn/bun install commands.";
+        }
+        if (input.registry !== undefined && commandHasPackageRegistry(String(input.command ?? ""))) {
+            return "Error: choose one package-registry control: remove either bash.registry or the command's --registry argument.";
+        }
+        let registry;
+        if (packageInstall && !commandHasPackageRegistry(String(input.command ?? ""))) {
+            try {
+                registry = normalizePackageRegistry(input.registry ?? loadConfig({ cwd: ctx.cwd }).packageRegistry);
+            }
+            catch (error) {
+                return `Error: invalid package registry: ${error?.message ?? "unsupported value"}. Nothing executed.`;
+            }
+        }
         const protectedReason = sensitiveShellCommandReason(String(input.command ?? ""), ctx.cwd);
         if (protectedReason) {
             return (`Blocked: shell command crosses Hara's protected secret boundary (${protectedReason}). ` +
@@ -238,9 +316,11 @@ registerTool({
                 "Configure ngrok authentication first, then retry. Do not rotate through other tunnel providers blindly; ask the user which authenticated provider to use.");
         }
         if (input.background) {
-            const id = startJob(input.command, ctx.cwd, ctx.sandbox ?? "off");
+            const id = startJob(input.command, ctx.cwd, ctx.sandbox ?? "off", registry ? packageRegistryEnv(registry) : {});
             const safeCommand = redactToolSubprocessOutput(String(input.command));
-            return `Started background job ${id}: \`${safeCommand}\`. Manage with the \`job\` tool — {action:"tail",id:"${id}"} for output, {action:"kill",id:"${id}"} to stop, {action:"list"} for all. Poll until it exits before running steps that depend on it.`;
+            return `Started background job ${id}: \`${safeCommand}\`.` +
+                (registry ? " Explicit package registry override applied." : "") +
+                ` Manage with the \`job\` tool — {action:"tail",id:"${id}"} for output, {action:"kill",id:"${id}"} to stop, {action:"list"} for all. Poll until it exits before running steps that depend on it.`;
         }
         // Network fault tolerance — short-circuit if this command targets a host already found unreachable this
         // session, so a repeat doesn't burn another ~75s OS connect timeout. Only pays the git-remote lookup
@@ -278,10 +358,14 @@ registerTool({
                 maxBuffer: 10 * 1024 * 1024,
                 onData: live,
                 signal: ctx.signal,
+                ...(registry ? { env: packageRegistryEnv(registry) } : {}),
             });
             flushLive();
             const combined = (stdout || "") + (stderr ? `\n[stderr]\n${stderr}` : "");
-            return capHeadTail(redactToolSubprocessOutput(combined.trim() || "(no output)"));
+            // The endpoint can be a private hostname/path. Confirmation is useful, but echoing it back into the
+            // model transcript is unnecessary and may expose organization-specific routing metadata.
+            const notice = registry ? "hara: explicit package registry override applied\n" : "";
+            return capHeadTail(redactToolSubprocessOutput(notice + (combined.trim() || "(no output)")));
         }
         catch (e) {
             flushLive();
@@ -293,6 +377,11 @@ registerTool({
                     `\n⏱ hara: the command hit its ${timeout}ms cap and was killed. Pick ONE: ` +
                         `a long build/transform → re-run with a larger timeout_ms; a server/watcher → background:true; ` +
                         `a network op (git/curl/npm) → do NOT just retry — check connectivity/proxy or skip this step and tell the user.`;
+                if (packageInstall && !registry && !commandHasPackageRegistry(String(input.command ?? ""))) {
+                    base +=
+                        " For public npm dependencies, an explicit retry may set bash.registry=\"npmmirror\" (or launch with --registry npmmirror). " +
+                            "Hara does not silently redirect installs because private scopes and registry trust must be preserved.";
+                }
             }
             // Network fault tolerance — if this was a genuine host-unreachability (connect timeout / DNS, NOT
             // auth / 404 / connection-refused), remember the host so we fast-fail future ops to it this session.

package/dist/tools/headless-web.js

@@ -0,0 +1,417 @@
+// Optional isolated headless rendering for web_fetch. The browser uses a fresh temporary profile and is
+// forced through a loopback validating proxy: every top-level/subresource destination is resolved once,
+// rejected if any answer is private/internal, and connected by the approved IP. This preserves web_fetch's
+// SSRF boundary across JavaScript redirects instead of handing Chrome an unchecked public URL.
+import { spawn } from "node:child_process";
+import { once } from "node:events";
+import { existsSync, mkdtempSync, rmSync } from "node:fs";
+import { createServer, request as httpRequest, } from "node:http";
+import { request as httpsRequest } from "node:https";
+import { createConnection } from "node:net";
+import { tmpdir, platform } from "node:os";
+import { delimiter, isAbsolute, join } from "node:path";
+import { connect as tlsConnect } from "node:tls";
+import { terminateSubprocessTree, toolSubprocessEnv } from "../security/subprocess-env.js";
+const MAX_BROWSER_REQUESTS = 192;
+const MAX_BROWSER_BYTES = 64 * 1024 * 1024;
+const MAX_BROWSER_HTML_BYTES = 4 * 1024 * 1024;
+const BROWSER_TIMEOUT_MS = 25_000;
+const BROWSER_SOCKET_TIMEOUT_MS = 12_000;
+function executableCandidates(env, plat) {
+    const explicit = String(env.HARA_BROWSER_PATH ?? "").trim();
+    const fixed = plat === "darwin"
+        ? [
+            "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome",
+            "/Applications/Microsoft Edge.app/Contents/MacOS/Microsoft Edge",
+            "/Applications/Chromium.app/Contents/MacOS/Chromium",
+        ]
+        : plat === "win32"
+            ? [
+                env.ProgramFiles && join(env.ProgramFiles, "Google/Chrome/Application/chrome.exe"),
+                env["ProgramFiles(x86)"] && join(env["ProgramFiles(x86)"], "Google/Chrome/Application/chrome.exe"),
+                env.LOCALAPPDATA && join(env.LOCALAPPDATA, "Google/Chrome/Application/chrome.exe"),
+                env.ProgramFiles && join(env.ProgramFiles, "Microsoft/Edge/Application/msedge.exe"),
+            ]
+            : [
+                "/usr/bin/google-chrome",
+                "/usr/bin/google-chrome-stable",
+                "/usr/bin/chromium",
+                "/usr/bin/chromium-browser",
+                "/usr/bin/microsoft-edge",
+            ];
+    const names = plat === "win32"
+        ? ["chrome.exe", "msedge.exe", "chromium.exe"]
+        : ["google-chrome", "google-chrome-stable", "chromium", "chromium-browser", "microsoft-edge"];
+    const onPath = String(env.PATH ?? "")
+        .split(delimiter)
+        .filter(Boolean)
+        .flatMap((dir) => names.map((name) => join(dir, name)));
+    return [explicit && isAbsolute(explicit) ? explicit : "", ...fixed, ...onPath]
+        .filter((value) => !!value);
+}
+/** Find an already-installed Chromium-family browser. Hara never downloads or mutates a browser install. */
+export function findHeadlessBrowser(env = process.env, plat = platform()) {
+    return executableCandidates(env, plat).find((path) => {
+        try {
+            return existsSync(path);
+        }
+        catch {
+            return false;
+        }
+    });
+}
+function safeHeaders(headers) {
+    const result = {};
+    const dropped = new Set([
+        "connection", "proxy-authorization", "proxy-authenticate", "proxy-connection", "keep-alive",
+        "te", "trailer", "transfer-encoding", "upgrade",
+    ]);
+    for (const [name, value] of Object.entries(headers)) {
+        if (value === undefined || dropped.has(name.toLowerCase()))
+            continue;
+        result[name] = value;
+    }
+    return result;
+}
+function proxyAuth(proxy) {
+    if (!proxy.username && !proxy.password)
+        return undefined;
+    return `Basic ${Buffer.from(`${decodeURIComponent(proxy.username)}:${decodeURIComponent(proxy.password)}`).toString("base64")}`;
+}
+function pinnedAuthority(route, port) {
+    return `${route.family === 6 ? `[${route.address}]` : route.address}:${port}`;
+}
+function parseConnectTarget(authority) {
+    if (!authority || /[\s/@?#]/u.test(authority))
+        throw new Error("invalid CONNECT target");
+    const target = new URL(`https://${authority}`);
+    if (!target.hostname || target.username || target.password || target.pathname !== "/")
+        throw new Error("invalid CONNECT target");
+    return target;
+}
+function requestThroughUpstream(proxyUri, target, route, req, res, countBytes) {
+    const proxy = new URL(proxyUri);
+    if (proxy.protocol !== "http:" && proxy.protocol !== "https:")
+        throw new Error("unsupported upstream proxy");
+    const pinned = new URL(target.href);
+    pinned.hostname = route.family === 6 ? `[${route.address}]` : route.address;
+    pinned.username = "";
+    pinned.password = "";
+    const headers = { ...safeHeaders(req.headers), host: target.host };
+    const auth = proxyAuth(proxy);
+    if (auth)
+        headers["proxy-authorization"] = auth;
+    const options = {
+        protocol: proxy.protocol,
+        hostname: proxy.hostname,
+        port: proxy.port || undefined,
+        method: req.method,
+        path: pinned.href,
+        headers,
+        ...(proxy.protocol === "https:" ? { servername: proxy.hostname } : {}),
+    };
+    const upstream = (proxy.protocol === "https:" ? httpsRequest : httpRequest)(options, (remote) => {
+        res.writeHead(remote.statusCode ?? 502, remote.headers);
+        remote.once("error", () => { if (!res.destroyed)
+            res.end(); });
+        remote.on("data", (chunk) => {
+            if (!countBytes(chunk.length))
+                remote.destroy();
+        });
+        remote.pipe(res);
+    });
+    upstream.setTimeout(BROWSER_SOCKET_TIMEOUT_MS, () => upstream.destroy(new Error("render proxy timeout")));
+    res.once("close", () => upstream.destroy());
+    upstream.once("error", () => {
+        if (!res.headersSent)
+            res.writeHead(502);
+        res.end("render proxy request failed");
+    });
+    req.pipe(upstream);
+}
+function requestDirect(target, route, req, res, countBytes) {
+    const upstream = httpRequest({
+        protocol: "http:",
+        hostname: route.address,
+        family: route.family,
+        port: target.port || 80,
+        method: req.method,
+        path: `${target.pathname}${target.search}`,
+        headers: { ...safeHeaders(req.headers), host: target.host },
+    }, (remote) => {
+        res.writeHead(remote.statusCode ?? 502, remote.headers);
+        remote.once("error", () => { if (!res.destroyed)
+            res.end(); });
+        remote.on("data", (chunk) => {
+            if (!countBytes(chunk.length))
+                remote.destroy();
+        });
+        remote.pipe(res);
+    });
+    upstream.setTimeout(BROWSER_SOCKET_TIMEOUT_MS, () => upstream.destroy(new Error("render destination timeout")));
+    res.once("close", () => upstream.destroy());
+    upstream.once("error", () => {
+        if (!res.headersSent)
+            res.writeHead(502);
+        res.end("render proxy request failed");
+    });
+    req.pipe(upstream);
+}
+async function upstreamTunnel(proxyUri, authority, onSocket) {
+    const proxy = new URL(proxyUri);
+    if (proxy.protocol !== "http:" && proxy.protocol !== "https:")
+        throw new Error("unsupported upstream proxy");
+    const port = Number(proxy.port || (proxy.protocol === "https:" ? 443 : 80));
+    const socket = proxy.protocol === "https:"
+        ? tlsConnect({ host: proxy.hostname, port, servername: proxy.hostname })
+        : createConnection({ host: proxy.hostname, port });
+    onSocket(socket);
+    socket.setTimeout(BROWSER_SOCKET_TIMEOUT_MS, () => socket.destroy(new Error("upstream proxy timeout")));
+    await once(socket, proxy.protocol === "https:" ? "secureConnect" : "connect");
+    const auth = proxyAuth(proxy);
+    socket.write(`CONNECT ${authority} HTTP/1.1\r\nHost: ${authority}\r\n` +
+        (auth ? `Proxy-Authorization: ${auth}\r\n` : "") +
+        "Connection: keep-alive\r\n\r\n");
+    return await new Promise((resolve, reject) => {
+        let buffered = Buffer.alloc(0);
+        const fail = () => reject(new Error("upstream proxy tunnel failed"));
+        const onData = (chunk) => {
+            buffered = Buffer.concat([buffered, chunk]);
+            if (buffered.length > 16 * 1024)
+                return fail();
+            const boundary = buffered.indexOf("\r\n\r\n");
+            if (boundary < 0)
+                return;
+            socket.off("data", onData);
+            socket.off("error", fail);
+            const status = Number(/^HTTP\/\d(?:\.\d)?\s+(\d{3})/iu.exec(buffered.subarray(0, boundary).toString("latin1"))?.[1] ?? 0);
+            if (status < 200 || status >= 300)
+                return fail();
+            socket.setTimeout(BROWSER_TIMEOUT_MS, () => socket.destroy());
+            resolve({ socket, leftover: buffered.subarray(boundary + 4) });
+        };
+        socket.on("data", onData);
+        socket.once("error", fail);
+    }).catch((error) => {
+        socket.destroy();
+        throw error;
+    });
+}
+async function startValidatingProxy(resolveRoute) {
+    const sockets = new Set();
+    let requestCount = 0;
+    let byteCount = 0;
+    let closed = false;
+    const countRequest = () => !closed && ++requestCount <= MAX_BROWSER_REQUESTS;
+    const countBytes = (amount) => !closed && (byteCount += amount) <= MAX_BROWSER_BYTES;
+    const server = createServer(async (req, res) => {
+        if (!countRequest()) {
+            res.writeHead(429);
+            return void res.end("render request budget exceeded");
+        }
+        try {
+            const target = new URL(String(req.url));
+            if (target.protocol !== "http:" || target.username || target.password)
+                throw new Error("invalid proxied URL");
+            const route = await resolveRoute(target);
+            if (route.proxyUri)
+                requestThroughUpstream(route.proxyUri, target, route, req, res, countBytes);
+            else
+                requestDirect(target, route, req, res, countBytes);
+        }
+        catch {
+            res.writeHead(502);
+            res.end("render destination blocked");
+        }
+    });
+    server.on("connection", (socket) => {
+        sockets.add(socket);
+        socket.once("close", () => sockets.delete(socket));
+    });
+    server.on("clientError", (_error, socket) => socket.destroy());
+    server.on("connect", async (req, client, head) => {
+        client.on("error", () => { });
+        if (!countRequest()) {
+            client.end("HTTP/1.1 429 Too Many Requests\r\nConnection: close\r\n\r\n");
+            return;
+        }
+        try {
+            const target = parseConnectTarget(String(req.url));
+            const port = Number(target.port || 443);
+            const route = await resolveRoute(target);
+            const authority = pinnedAuthority(route, port);
+            let tunnel;
+            if (route.proxyUri) {
+                tunnel = await upstreamTunnel(route.proxyUri, authority, (socket) => {
+                    sockets.add(socket);
+                    socket.once("close", () => sockets.delete(socket));
+                });
+            }
+            else {
+                const socket = createConnection({ host: route.address, port, family: route.family });
+                sockets.add(socket);
+                socket.once("close", () => sockets.delete(socket));
+                socket.setTimeout(BROWSER_SOCKET_TIMEOUT_MS, () => socket.destroy(new Error("render destination timeout")));
+                await once(socket, "connect");
+                socket.setTimeout(BROWSER_TIMEOUT_MS, () => socket.destroy());
+                tunnel = { socket, leftover: Buffer.alloc(0) };
+            }
+            const remote = tunnel.socket;
+            client.write("HTTP/1.1 200 Connection Established\r\n\r\n");
+            if (tunnel.leftover.length)
+                client.write(tunnel.leftover);
+            if (head.length)
+                remote.write(head);
+            // Browsers routinely cancel speculative/subresource tunnels. A pipe destination can then raise EPIPE;
+            // pair the two endpoints explicitly so cancellation is ordinary cleanup, never a Hara process crash.
+            client.on("error", () => remote.destroy());
+            remote.on("error", () => client.destroy());
+            client.once("close", () => remote.destroy());
+            remote.once("close", () => client.destroy());
+            remote.on("data", (chunk) => {
+                if (!countBytes(chunk.length)) {
+                    remote.destroy();
+                    client.destroy();
+                }
+            });
+            client.on("data", (chunk) => {
+                if (!countBytes(chunk.length)) {
+                    remote.destroy();
+                    client.destroy();
+                }
+            });
+            client.pipe(remote);
+            remote.pipe(client);
+        }
+        catch {
+            client.end("HTTP/1.1 502 Bad Gateway\r\nConnection: close\r\n\r\n");
+        }
+    });
+    server.listen(0, "127.0.0.1");
+    await once(server, "listening");
+    const address = server.address();
+    if (!address || typeof address === "string")
+        throw new Error("could not bind render proxy");
+    return {
+        url: `http://127.0.0.1:${address.port}`,
+        async close() {
+            if (closed)
+                return;
+            closed = true;
+            for (const socket of sockets)
+                socket.destroy();
+            await new Promise((resolve) => server.close(() => resolve()));
+        },
+    };
+}
+/** Render one page in an isolated profile. This is deliberately optional: callers classify it as computer
+ * use so ordinary read-only web_fetch never starts a JS engine without a user-approved render:true call. */
+export async function renderHeadlessHtml(url, resolveRoute, parentSignal, env = process.env) {
+    const browser = findHeadlessBrowser(env);
+    if (!browser)
+        return { error: "browser-unavailable" };
+    if (parentSignal?.aborted)
+        return { error: "failed" };
+    const profile = mkdtempSync(join(tmpdir(), "hara-headless-web-"));
+    let proxy;
+    let child;
+    let timer;
+    let cancelTree;
+    try {
+        // Keep proxy startup inside the cleanup boundary: a bind/listen failure must not strand the fresh
+        // browser profile created above.
+        proxy = await startValidatingProxy(resolveRoute);
+        const args = [
+            "--headless=new",
+            "--disable-background-networking",
+            "--disable-component-update",
+            "--disable-default-apps",
+            "--disable-extensions",
+            "--disable-sync",
+            "--disable-translate",
+            "--disable-quic",
+            "--disable-dev-shm-usage",
+            "--force-webrtc-ip-handling-policy=disable_non_proxied_udp",
+            "--host-resolver-rules=MAP * ~NOTFOUND, EXCLUDE 127.0.0.1, EXCLUDE ::1",
+            "--metrics-recording-only",
+            "--mute-audio",
+            "--no-default-browser-check",
+            "--no-first-run",
+            "--password-store=basic",
+            "--use-mock-keychain",
+            `--user-data-dir=${profile}`,
+            `--disk-cache-dir=${join(profile, "cache")}`,
+            `--proxy-server=${proxy.url}`,
+            "--proxy-bypass-list=<-loopback>",
+            "--virtual-time-budget=8000",
+            "--dump-dom",
+            url.href,
+        ];
+        const processGroup = platform() !== "win32";
+        child = spawn(browser, args, {
+            stdio: ["ignore", "pipe", "pipe"],
+            detached: processGroup,
+            env: toolSubprocessEnv(env, {
+                HARA_BROWSER_PATH: undefined,
+                HARA_WEB_PROXY: undefined,
+                HTTPS_PROXY: undefined,
+                HTTP_PROXY: undefined,
+                https_proxy: undefined,
+                http_proxy: undefined,
+            }),
+        });
+        const result = await new Promise((resolve) => {
+            const chunks = [];
+            let size = 0;
+            let settled = false;
+            const finish = (value) => {
+                if (settled)
+                    return;
+                settled = true;
+                if (timer)
+                    clearTimeout(timer);
+                parentSignal?.removeEventListener("abort", abort);
+                resolve(value);
+            };
+            const stop = (value) => {
+                if (child && !cancelTree)
+                    cancelTree = terminateSubprocessTree(child, { processGroup, force: true });
+                finish(value);
+            };
+            const abort = () => stop({ error: "failed" });
+            parentSignal?.addEventListener("abort", abort, { once: true });
+            timer = setTimeout(() => stop({ error: "timed-out" }), BROWSER_TIMEOUT_MS);
+            child.stdout.on("data", (chunk) => {
+                size += chunk.length;
+                if (size > MAX_BROWSER_HTML_BYTES)
+                    return stop({ error: "output-too-large" });
+                chunks.push(chunk);
+                // Chrome can keep utility processes/pipes alive briefly after --dump-dom has emitted the complete
+                // document (especially with a validating proxy). The serialized closing tag is the result boundary;
+                // return it immediately and terminate the isolated process tree instead of false-timing-out.
+                const tail = Buffer.concat(chunks.slice(-3)).toString("utf8").slice(-256);
+                if (/<\/html>\s*$/iu.test(tail)) {
+                    if (child && !cancelTree)
+                        cancelTree = terminateSubprocessTree(child, { processGroup, force: true });
+                    finish({ html: Buffer.concat(chunks).toString("utf8") });
+                }
+            });
+            // Browser diagnostics can contain machine-specific paths. Drain but never return them to the model.
+            child.stderr.resume();
+            child.once("error", () => finish({ error: "failed" }));
+            child.once("close", (code) => {
+                if (code !== 0 || !chunks.length)
+                    return finish({ error: "failed" });
+                finish({ html: Buffer.concat(chunks).toString("utf8") });
+            });
+        });
+        return result;
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+        cancelTree?.();
+        await proxy?.close().catch(() => { });
+        rmSync(profile, { recursive: true, force: true });
+    }
+}

package/dist/tools/session-search.js

@@ -12,6 +12,18 @@ const MAX_AUTO_PROJECT_CANDIDATES = 80;
 const MAX_AUTO_PROJECT_CHARS = 8_000_000;
 const MAX_MESSAGE_SCAN_CHARS = 120_000;
 const MAX_EXCERPT_CHARS = 700;
+const HISTORICAL_REFERENCE = [
+    /(?:之前|以前|上次|前一(?:次|个)|此前|我们前面)(?:的|聊过|讨论过|说过|做过|处理过|提过|那个|那次|任务|问题|方案|对话|会话|项目|内容)?/u,
+    /(?:继续|接着)(?:之前|以前|上次|前一(?:次|个)|此前)(?:的|那个|那次)?/u,
+    /(?:还记得|记不记得|你记得)(?:之前|以前|上次|我们)?/u,
+    /\b(?:previous|prior|earlier|last)\s+(?:chat|session|conversation|time|task|issue|discussion|project)\b/iu,
+    /\b(?:continue|pick up)\s+(?:from|where)\b/iu,
+    /\b(?:do you remember|we (?:discussed|talked about|worked on)|you said before)\b/iu,
+];
+const HISTORICAL_REFERENCE_NEGATION = [
+    /(?:不要|不用|无需|别)(?:查|找|看|搜索|读取|回忆).{0,8}(?:之前|以前|上次|历史|旧会话)/u,
+    /\b(?:do not|don't|dont|no need to)\s+(?:search|read|look at|recall).{0,32}(?:previous|prior|earlier|history|old (?:chat|session))/iu,
+];
 function normalized(value) {
     return value.normalize("NFKC").toLocaleLowerCase().replace(/\s+/g, " ").trim();
 }
@@ -23,6 +35,28 @@ export function sessionSearchTerms(query) {
     const terms = lexicalSearchTerms(query);
     return terms.length <= 32 ? terms : [...terms.slice(0, 16), ...terms.slice(-16)];
 }
+/** Only search raw transcripts when the user explicitly points at older work. This makes ordinary turns
+ * deterministic and cheap while fixing the common "continue the task from our previous chat" case without
+ * relying on the model to notice and call session_search itself. Explicit opt-outs always win. */
+export function sessionRecallQuery(messageValue) {
+    const message = String(messageValue ?? "").replace(/\s+/g, " ").trim();
+    if (!message || HISTORICAL_REFERENCE_NEGATION.some((pattern) => pattern.test(message)))
+        return null;
+    if (!HISTORICAL_REFERENCE.some((pattern) => pattern.test(message)))
+        return null;
+    return message.slice(0, 512);
+}
+/** Return an injectable, clearly untrusted recall block, or an empty string when no explicit cue/match
+ * exists. Audience/project enforcement remains centralized in searchSessionHistory. */
+export async function automaticSessionRecall(message, ctx) {
+    const query = sessionRecallQuery(message);
+    if (!query)
+        return "";
+    const result = await searchSessionHistory(query, "auto", 3, ctx);
+    if (result === "(no session matches)" || result.startsWith("Error:") || result.startsWith("Blocked:"))
+        return "";
+    return `Automatic prior-session recall (triggered by the user's explicit historical reference):\n${result}`;
+}
 function visibleMessages(history) {
     const out = [];
     for (const message of history) {