@nanhara/hara 0.53.0 → 0.67.0

package/dist/mcp/server.js

@@ -0,0 +1,56 @@
+// MCP server — expose hara's safe read/search tools over stdio so other MCP clients (Claude Desktop,
+// Cursor, another hara, …) can use them. The high-value one is `codebase_search` over the current repo
+// (semantic if you've built an index, lexical otherwise). `hara mcp` runs this.
+//
+// Read-only by DEFAULT: no edit/write/bash/computer — an external client must not be able to mutate your
+// machine through hara. Override the exposed set with HARA_MCP_TOOLS (comma list) at your own risk.
+//
+// IMPORTANT: stdio is the JSON-RPC transport — this module must never write to stdout. Diagnostics go to
+// stderr (the `hara mcp` command handles that); tool output flows back through the protocol.
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { ListToolsRequestSchema, CallToolRequestSchema } from "@modelcontextprotocol/sdk/types.js";
+import { getTool, getTools } from "../tools/registry.js";
+/** Safe default: navigate + search the repo + the web. No state, no mutation, no privacy-sensitive memory. */
+const SAFE_TOOLS = ["read_file", "grep", "glob", "ls", "codebase_search", "web_fetch", "web_search"];
+/** Names to expose: HARA_MCP_TOOLS (comma list) if set, else the safe default — intersected with what's
+ *  actually registered. An unknown name in the override is silently dropped. */
+export function mcpServeToolNames() {
+    const env = process.env.HARA_MCP_TOOLS;
+    const want = env ? env.split(",").map((s) => s.trim()).filter(Boolean) : SAFE_TOOLS;
+    const have = new Set(getTools().map((t) => t.name));
+    return want.filter((n) => have.has(n));
+}
+/** The exposed tools in MCP `tools/list` shape. */
+export function mcpToolList() {
+    return mcpServeToolNames().map((n) => {
+        const t = getTool(n);
+        return { name: t.name, description: t.description, inputSchema: t.input_schema };
+    });
+}
+/** Run one exposed tool. Refuses anything outside the exposed set (defense in depth, even if a client
+ *  asks for a name it shouldn't know). Never throws — errors come back as `isError` results. */
+export async function mcpCallTool(name, args, ctx) {
+    if (!mcpServeToolNames().includes(name)) {
+        return { content: [{ type: "text", text: `Tool not exposed by \`hara mcp\`: ${name}` }], isError: true };
+    }
+    const tool = getTool(name);
+    if (!tool)
+        return { content: [{ type: "text", text: `Unknown tool: ${name}` }], isError: true };
+    try {
+        const out = await tool.run(args ?? {}, ctx);
+        return { content: [{ type: "text", text: String(out) }] };
+    }
+    catch (e) {
+        return { content: [{ type: "text", text: `Error: ${e instanceof Error ? e.message : String(e)}` }], isError: true };
+    }
+}
+/** Start the stdio MCP server and block (the transport keeps the process alive). */
+export async function startMcpServer(version, ctx) {
+    const server = new Server({ name: "hara", version }, { capabilities: { tools: {} } });
+    server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: mcpToolList() }));
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any -- SDK's result union has a task-augmented
+    // member TS can't narrow to; our {content,isError} shape is a valid CallToolResult (validated at runtime).
+    server.setRequestHandler(CallToolRequestSchema, async (req) => (await mcpCallTool(req.params.name, (req.params.arguments ?? {}), ctx)));
+    await server.connect(new StdioServerTransport());
+}

package/dist/memory/store.js

@@ -3,9 +3,21 @@
 // project <root>/.hara/memory. Lexical search reuses recall.ts; no embeddings (local-first).
 import { homedir } from "node:os";
 import { join, dirname } from "node:path";
-import { readFileSync, writeFileSync, appendFileSync, mkdirSync, existsSync } from "node:fs";
+import { readFileSync, writeFileSync, appendFileSync, mkdirSync, existsSync, readdirSync } from "node:fs";
 import { findProjectRoot } from "../context/agents-md.js";
-const DIGEST_CAP = 4000; // chars of MEMORY/USER injected at session start (logs reached via search)
+// Per-source budgets for the frozen-snapshot digest (chars). Each source gets its own cap so a large
+// project MEMORY can't crowd out the (smaller but high-value) USER prefs — and each is cut at a line
+// boundary, never mid-entry. Anything beyond these is still reachable via memory_search. (hermes-style
+// per-file budgets; both PAI and hermes confirm lexical injection + capped snapshot beats a vector store.)
+const SOURCE_CAP = { memory: 2000, user: 1200, log: 0 };
+/** Truncate at a line boundary at/under `cap` (never mid-entry), with a pointer to search for the rest. */
+function capAtLine(text, cap) {
+    if (text.length <= cap)
+        return text;
+    const cut = text.slice(0, cap);
+    const nl = cut.lastIndexOf("\n");
+    return (nl > cap * 0.5 ? cut.slice(0, nl) : cut).trimEnd() + "\n…[truncated — memory_search for the rest]";
+}
 export function memoryDir(scope, cwd) {
     if (scope === "global")
         return process.env.HARA_MEMORY || join(homedir(), ".hara", "memory");
@@ -49,7 +61,9 @@ export function forgetMemory(scope, target, match, cwd) {
     writeFileSync(f, kept.join("\n"), "utf8");
     return lines.length - kept.length;
 }
-/** Capped MEMORY + USER digest (project + global) for frozen-snapshot injection at session start. */
+/** MEMORY + USER digest (project + global) for frozen-snapshot injection at session start. Each source is
+ *  capped independently (SOURCE_CAP) at a line boundary, so every source is represented (project memory
+ *  never starves USER prefs) and no entry is cut mid-line. Daily logs are reached via memory_search. */
 export function memoryDigest(cwd) {
     const sources = [
         ["project", "memory", "project MEMORY"],
@@ -64,14 +78,38 @@ export function memoryDigest(cwd) {
         try {
             const t = readFileSync(f, "utf8").trim();
             if (t)
-                parts.push(`## ${label}\n${t}`);
+                parts.push(`## ${label}\n${capAtLine(t, SOURCE_CAP[target])}`);
+        }
+        catch {
+            /* skip unreadable */
+        }
+    }
+    return parts.join("\n\n");
+}
+/** Concatenate the daily logs (`log/YYYY-MM-DD.md`) from the last `days` for one scope — the short-term
+ *  tier `hara memory distill` consolidates into evergreen MEMORY. Empty if there's no log dir. */
+export function readRecentLogs(scope, cwd, days) {
+    const dir = join(memoryDir(scope, cwd), "log");
+    if (!existsSync(dir))
+        return "";
+    const cutoff = Date.now() - days * 86_400_000;
+    const out = [];
+    for (const f of readdirSync(dir).sort()) {
+        if (!f.endsWith(".md"))
+            continue;
+        const m = /^(\d{4})-(\d{2})-(\d{2})\.md$/.exec(f);
+        if (m && new Date(Number(m[1]), Number(m[2]) - 1, Number(m[3])).getTime() < cutoff)
+            continue;
+        try {
+            const t = readFileSync(join(dir, f), "utf8").trim();
+            if (t)
+                out.push(`### ${f}\n${t}`);
         }
         catch {
             /* skip unreadable */
         }
     }
-    const out = parts.join("\n\n");
-    return out.length > DIGEST_CAP ? out.slice(0, DIGEST_CAP) + "\n…[memory truncated — use memory_search]" : out;
+    return out.join("\n\n");
 }
 /** Create memory dirs + seed files (global + project). Returns files written. */
 export function scaffoldMemory(cwd) {

package/dist/org/review-chain.js

@@ -0,0 +1,91 @@
+// Multi-role review chain — hara's "runs like an engineering org" move. After an implementer makes
+// changes, a reviewer role inspects the diff and either APPROVES or requests changes; requested changes
+// feed back to the implementer, looping until approved or a round cap. The orchestration lives in runOrg
+// (it needs runAgent + providers); these are the pure, testable pieces: verdict parsing, change capture,
+// and the prompts. Used by `hara org --review`.
+import { execFileSync } from "node:child_process";
+/** Fallback reviewer persona when the project has no `reviewer` role. Read-only by intent. */
+export const REVIEWER_SYSTEM = `You are a senior code reviewer reviewing changes made to accomplish a task.
+Inspect them for: correctness and bugs, security, missing edge cases, and whether they actually accomplish
+the task. Use read_file / grep / glob / ls to inspect context and any new files. Be concrete and specific —
+cite files. Block only on real problems (bugs, breakage, security), not style preferences.
+
+A script parses your final line, so it MUST be EXACTLY one of these two, verbatim, as the LAST line —
+the literal word APPROVED or CHANGES_REQUESTED. Do NOT paraphrase it (not "No issues found", not "LGTM"),
+do NOT bold it, do NOT add words after the token:
+VERDICT: APPROVED
+VERDICT: CHANGES_REQUESTED
+
+Use APPROVED only if the changes correctly and safely accomplish the task. If anything must be fixed, use
+CHANGES_REQUESTED and list the required fixes as a short numbered list ABOVE the verdict line — each one
+naming the file and exactly what to change.`;
+// Real models won't reliably emit the literal token — across live runs glm-5 wrote `VERDICT: APPROVED`,
+// `**VERDICT**: No issues found`, and `**VERDICT**: PASS`. So we anchor on the (markdown-tolerant) VERDICT
+// marker, then CLASSIFY the phrase after it: a "changes" signal vetoes (safer), an "approve" signal passes,
+// and anything ambiguous stays NOT approved — worst case is one extra review round, never a bad auto-commit.
+const CHANGES_RE = /\b(changes?[ _-]?request\w*|request\w*[ _-]?changes?|fail(ed|ure)?|reject\w*|block\w*|rework|needs?[ _-]?(work|fix\w*|change\w*)|must[ _-]?(fix|change)|not[ _-]?approv\w*)\b/i;
+const APPROVE_RE = /\b(approv\w*|passe?d?|lgtm|accept\w*|ship[ _-]?it|no[ _-]?(issues?|problems?|changes?|concerns?)|looks?[ _-]?good)\b/i;
+/** Parse a reviewer's reply into a verdict — see the note above for why it's lenient. Takes the LAST
+ *  VERDICT marker (the final call) and classifies the phrase after it; `issues` is the body before it. */
+export function parseVerdict(text) {
+    const markers = [...text.matchAll(/VERDICT\b[*_:\s]*/gi)];
+    const last = markers[markers.length - 1];
+    if (!last)
+        return { approved: false, issues: text.trim() };
+    const idx = last.index ?? 0;
+    const after = text.slice(idx + last[0].length, idx + last[0].length + 80); // the verdict phrase itself
+    const approved = !CHANGES_RE.test(after) && APPROVE_RE.test(after); // changes-signal vetoes; ambiguous = not approved
+    return { approved, issues: text.slice(0, idx).trim() };
+}
+/** Capture the working-tree changes vs HEAD (what to review). Non-destructive; empty for a non-git dir
+ *  or a repo with no commits. New (untracked) files are listed by name — the reviewer can read_file them. */
+export function captureChanges(cwd, cap = 100_000) {
+    const git = (args) => {
+        try {
+            return execFileSync("git", args, { cwd, encoding: "utf8", maxBuffer: 50_000_000 });
+        }
+        catch {
+            return "";
+        }
+    };
+    let diff = git(["diff", "HEAD"]).trim();
+    if (diff.length > cap)
+        diff = diff.slice(0, cap) + "\n…[diff truncated]";
+    const newFiles = git(["ls-files", "--others", "--exclude-standard"])
+        .split("\n")
+        .map((s) => s.trim())
+        .filter(Boolean)
+        .slice(0, 50);
+    return { diff, newFiles };
+}
+/** True only if the working tree is fully clean — no uncommitted changes. The `--commit` capstone uses
+ *  this as a guard: `git add -A` + commit is only safe to run when the tree was clean before the org ran,
+ *  so it captures THIS run's work and never sweeps up pre-existing WIP. False for a non-git dir. */
+export function isTreeClean(cwd) {
+    try {
+        return execFileSync("git", ["status", "--porcelain"], { cwd, encoding: "utf8", maxBuffer: 50_000_000 }).trim() === "";
+    }
+    catch {
+        return false; // not a git repo / git error → treat as "not clean" so we never auto-commit blindly
+    }
+}
+/** Strip a leading/trailing markdown code fence a model sometimes wraps a commit message in. */
+export function stripCommitFence(text) {
+    return text.trim().replace(/^```[a-z]*\n?/i, "").replace(/\n?```$/i, "").trim();
+}
+/** The reviewer's input: the task + the changes to review. */
+export function reviewPrompt(task, changes) {
+    const parts = [`Task that was implemented:\n${task}`, ""];
+    if (changes.diff)
+        parts.push("Changes (working tree vs HEAD):\n```diff\n" + changes.diff + "\n```");
+    if (changes.newFiles.length)
+        parts.push(`New files (use read_file to inspect): ${changes.newFiles.join(", ")}`);
+    if (!changes.diff && !changes.newFiles.length)
+        parts.push("(no diff captured — inspect the working tree with git / read_file)");
+    parts.push("\nReview these changes against the task. Finish with your VERDICT line.");
+    return parts.join("\n");
+}
+/** Feed the reviewer's requested changes back to the implementer. */
+export function fixPrompt(issues) {
+    return `A code reviewer reviewed your changes and requires these fixes before this can ship:\n\n${issues}\n\nMake these fixes now — edit the files directly; don't just explain.`;
+}

package/dist/org/roles.js

@@ -49,6 +49,17 @@ function parseFrontmatter(text) {
     }
     return { fm, body: m[2].trim() };
 }
+/** Tool filter for a fan-out sub-agent: ALWAYS read-only (sub-agents run full-auto + unconfirmed +
+ *  parallel), with a role allowed to narrow further but never to grant write/exec. `isReadonly` is the
+ *  read-kind predicate. This is the guard that keeps the `agent` tool from bypassing the approval gate. */
+export function subagentToolFilter(role, isReadonly) {
+    const roleFilter = role?.allowTools
+        ? (n) => role.allowTools.includes(n)
+        : role?.denyTools
+            ? (n) => !role.denyTools.includes(n)
+            : null;
+    return (n) => isReadonly(n) && (roleFilter ? roleFilter(n) : true);
+}
 export function loadRoles(cwd) {
     const byId = new Map();
     // lowest→highest precedence: plugins < global < .claude/agents < .hara/roles (project wins, same as memory/config)

package/dist/org-fleet/enroll.js

@@ -0,0 +1,94 @@
+// B-end device enrollment (the OSS client side of the fleet/control-plane story). A hara device joins a
+// fleet by exchanging a one-time enrollment code for a scoped, revocable DEVICE TOKEN — it never holds the
+// real provider key (that stays at the gateway). hara then points its OpenAI-compatible calls at the
+// gateway, which validates the token, maps it to an upstream key, and proxies. Heartbeats give the control
+// plane fleet visibility. Token + endpoint live in ~/.hara/org.json (0600).
+//
+// Protocol (what `hara-control` implements on the other end):
+//   POST {gateway}/v1/enroll      {code, device:{name,os,hara_version}} -> {device_token, device_id, model, base_url?}
+//   POST {gateway}/v1/heartbeat   Bearer <device_token> {device_id, name, os, hara_version} -> 200/204
+//   POST {gateway}/v1/chat/completions  (OpenAI-compatible; the normal agent traffic, Bearer <device_token>)
+import { homedir, hostname, platform } from "node:os";
+import { join } from "node:path";
+import { readFileSync, writeFileSync, existsSync, mkdirSync, chmodSync, rmSync } from "node:fs";
+const orgPath = () => join(homedir(), ".hara", "org.json");
+const deviceInfo = () => ({ name: hostname(), os: platform(), hara_version: process.env.HARA_BUILD_VERSION ?? "dev" });
+/** The effective OpenAI-compatible base URL for an enrollment (explicit, else <gatewayUrl>/v1). */
+export function gatewayBaseURL(e) {
+    return e.baseURL || `${e.gatewayUrl.replace(/\/$/, "")}/v1`;
+}
+export function loadEnrollment() {
+    const p = orgPath();
+    if (!existsSync(p))
+        return null;
+    try {
+        const e = JSON.parse(readFileSync(p, "utf8"));
+        return e && typeof e === "object" && e.gatewayUrl && e.deviceToken ? e : null;
+    }
+    catch {
+        return null;
+    }
+}
+function saveEnrollment(e) {
+    mkdirSync(join(homedir(), ".hara"), { recursive: true });
+    writeFileSync(orgPath(), JSON.stringify(e, null, 2) + "\n", { encoding: "utf8", mode: 0o600 }); // holds a device token → 0600
+    try {
+        chmodSync(orgPath(), 0o600);
+    }
+    catch {
+        /* best-effort */
+    }
+}
+export function clearEnrollment() {
+    if (!existsSync(orgPath()))
+        return false;
+    rmSync(orgPath());
+    return true;
+}
+/** Parse a control-plane enroll response (tolerant of snake_case / camelCase) into an Enrollment. */
+export function parseEnrollResponse(gatewayUrl, j, now) {
+    const deviceToken = (j.device_token ?? j.deviceToken);
+    if (!deviceToken)
+        throw new Error("enroll response missing device_token");
+    return {
+        gatewayUrl: gatewayUrl.replace(/\/$/, ""),
+        deviceToken,
+        deviceId: String(j.device_id ?? j.deviceId ?? ""),
+        model: String(j.model ?? ""),
+        baseURL: (j.base_url ?? j.baseURL),
+        enrolledAt: now,
+    };
+}
+/** Exchange a one-time code for a device token at the gateway, persist it, and return the Enrollment. */
+export async function enrollDevice(gatewayUrl, code, signal) {
+    const base = gatewayUrl.replace(/\/$/, "");
+    const res = await fetch(`${base}/v1/enroll`, {
+        method: "POST",
+        signal,
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ code, device: deviceInfo() }),
+    });
+    if (!res.ok)
+        throw new Error(`HTTP ${res.status}${res.status === 401 || res.status === 403 ? " — bad or expired code" : ""}: ${(await res.text()).slice(0, 200)}`);
+    const e = parseEnrollResponse(base, (await res.json()), new Date().toISOString());
+    saveEnrollment(e);
+    return e;
+}
+/** Best-effort heartbeat so the control plane shows this device online. Never throws. */
+export async function heartbeat(signal) {
+    const e = loadEnrollment();
+    if (!e)
+        return false;
+    try {
+        const res = await fetch(`${e.gatewayUrl}/v1/heartbeat`, {
+            method: "POST",
+            signal,
+            headers: { "content-type": "application/json", authorization: `Bearer ${e.deviceToken}` },
+            body: JSON.stringify({ device_id: e.deviceId, ...deviceInfo() }),
+        });
+        return res.ok;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/providers/qwen-oauth.js

@@ -3,7 +3,7 @@
 import { createHash, randomBytes } from "node:crypto";
 import { homedir } from "node:os";
 import { join } from "node:path";
-import { readFileSync, writeFileSync, existsSync, mkdirSync } from "node:fs";
+import { readFileSync, writeFileSync, existsSync, mkdirSync, chmodSync } from "node:fs";
 const BASE = "https://chat.qwen.ai";
 const DEVICE_CODE_URL = `${BASE}/api/v1/oauth2/device/code`;
 const TOKEN_URL = `${BASE}/api/v1/oauth2/token`;
@@ -28,7 +28,14 @@ export function loadQwenToken() {
 function saveQwenToken(t) {
     const p = tokenPath();
     mkdirSync(join(homedir(), ".hara"), { recursive: true });
-    writeFileSync(p, JSON.stringify(t, null, 2) + "\n", "utf8");
+    // 0600 — the file holds long-lived access + refresh tokens; don't leave it world-readable on shared boxes.
+    writeFileSync(p, JSON.stringify(t, null, 2) + "\n", { encoding: "utf8", mode: 0o600 });
+    try {
+        chmodSync(p, 0o600); // tighten an existing file that predated the mode
+    }
+    catch {
+        /* best-effort */
+    }
 }
 const b64url = (b) => b.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 function pkce() {

package/dist/recall.js

@@ -24,6 +24,20 @@ export function titleOf(text, path) {
     const h = /^#\s+(.+)$/m.exec(text);
     return h ? h[1].trim() : (path.split("/").pop() ?? path);
 }
+/** A ranking boost from the asset's declared dimensions: a query word in the title or the frontmatter
+ *  tags/lang matters more than one buried in the body. Used to order results, NOT the base relevance
+ *  score (which the dedup threshold relies on). */
+export function metaBoost(text, title, words) {
+    const titleL = title.toLowerCase();
+    let b = words.filter((w) => titleL.includes(w)).length * 3;
+    const fm = /^---\n([\s\S]*?)\n---/.exec(text);
+    if (fm) {
+        const tags = (/(?:^|\n)tags:\s*(.+)/i.exec(fm[1])?.[1] ?? "").toLowerCase();
+        const lang = (/(?:^|\n)lang:\s*(.+)/i.exec(fm[1])?.[1] ?? "").toLowerCase();
+        b += words.filter((w) => `${tags} ${lang}`.includes(w)).length * 2;
+    }
+    return b;
+}
 /**
  * Lexical search: rank .md files by how many query words appear in path+content.
  * Default searches the code-asset library (relative paths). Pass `roots` to search other dirs
@@ -48,14 +62,16 @@ export function searchAssets(query, limit = 5, roots) {
                 continue;
             }
             const hay = (rel + "\n" + text).toLowerCase();
-            const score = words.filter((w) => hay.includes(w)).length;
+            const score = words.filter((w) => hay.includes(w)).length; // distinct query words present (dedup threshold uses this)
             if (!score)
                 continue;
-            hits.push({ path: abs ? join(dir, rel) : rel, title: titleOf(text, rel), snippet: text.slice(0, 800), score });
+            const title = titleOf(text, rel);
+            hits.push({ path: abs ? join(dir, rel) : rel, title, snippet: text.slice(0, 800), score, boost: metaBoost(text, title, words) });
         }
     }
-    hits.sort((a, b) => b.score - a.score || a.path.length - b.path.length);
-    return hits.slice(0, limit);
+    // rank by relevance, then by the declared-dimension boost (title/tags/lang), then prefer the shorter path
+    hits.sort((a, b) => b.score - a.score || b.boost - a.boost || a.path.length - b.path.length);
+    return hits.slice(0, limit).map(({ boost, ...r }) => r);
 }
 /** Create the assets dir with an example snippet + README. Returns files written. */
 export function scaffoldAssets() {

package/dist/sandbox.js

@@ -1,6 +1,10 @@
-// OS sandboxing for the bash tool. macOS = Seatbelt (sandbox-exec); other platforms run unsandboxed
-// (the approval gate + cwd-scoped file tools still apply). Only the `bash` shell is sandboxed —
-// hara's own file tools (write_file/edit_file) are in-process, explicit, and gated.
+// OS sandboxing for the bash tool — WRITE CONFINEMENT, not a security jail. macOS = Seatbelt
+// (sandbox-exec) restricting `file-write*` to the workspace (workspace-write) or to nothing outside
+// temp (read-only). Reads, network, and process exec are NOT restricted, and /private/tmp +
+// /private/var/folders stay writable in every mode — so this stops a stray `rm`/overwrite escaping the
+// project, NOT a determined exfiltration. Other platforms run UNSANDBOXED (a one-time warning is
+// emitted from runShell so every entry point — REPL, -p, org, cron — surfaces it). Only the `bash`
+// shell is sandboxed; hara's own file tools are in-process, explicit, and gated by the approval flow.
 import { spawn } from "node:child_process";
 import { writeFileSync, mkdtempSync } from "node:fs";
 import { tmpdir, platform } from "node:os";
@@ -23,6 +27,7 @@ function seatbeltProfile(cwd, mode) {
 export function sandboxSupported() {
     return platform() === "darwin";
 }
+let warnedUnsandboxed = false; // emit the "macOS-only" notice at most once per process
 /**
  * Run a shell command, sandboxed when mode != off and the platform supports it.
  * Streams output via `opts.onData` while capturing it for the resolved value.
@@ -39,6 +44,10 @@ export function runShell(command, cwd, mode, opts) {
         args = ["-f", profileFile, "/bin/bash", "-lc", command];
     }
     else {
+        if (mode !== "off" && !warnedUnsandboxed) {
+            warnedUnsandboxed = true;
+            process.stderr.write(`hara: --sandbox ${mode} is macOS-only — the shell runs UNSANDBOXED on ${platform()}.\n`);
+        }
         cmd = "/bin/sh";
         args = ["-c", command];
     }
@@ -47,20 +56,31 @@ export function runShell(command, cwd, mode, opts) {
         let stdout = "";
         let stderr = "";
         let timedOut = false;
+        let killedForSize = false;
         const grow = (cur, add) => (cur.length < opts.maxBuffer ? cur + add : cur);
         const timer = setTimeout(() => {
             timedOut = true;
             child.kill("SIGKILL");
         }, opts.timeout);
+        // Kill a runaway command once its total output passes maxBuffer — don't let it stream GBs to the UI
+        // until the timeout just because we stopped retaining the bytes.
+        const checkOverflow = () => {
+            if (!killedForSize && stdout.length + stderr.length >= opts.maxBuffer) {
+                killedForSize = true;
+                child.kill("SIGKILL");
+            }
+        };
         child.stdout.on("data", (d) => {
             const s = d.toString();
             stdout = grow(stdout, s);
             opts.onData?.(s);
+            checkOverflow();
         });
         child.stderr.on("data", (d) => {
             const s = d.toString();
             stderr = grow(stderr, s);
             opts.onData?.(s);
+            checkOverflow();
         });
         child.on("error", (e) => {
             clearTimeout(timer);
@@ -68,6 +88,8 @@ export function runShell(command, cwd, mode, opts) {
         });
         child.on("close", (code) => {
             clearTimeout(timer);
+            if (killedForSize)
+                return resolve({ stdout, stderr: stderr + `\n[output truncated — exceeded ${opts.maxBuffer} bytes; process killed]` });
             if (timedOut)
                 return reject(Object.assign(new Error(`timed out after ${opts.timeout}ms`), { stdout, stderr }));
             if (code !== 0)

package/dist/search/semindex.js

@@ -121,6 +121,13 @@ export async function buildIndex(name, chunks, embed, cwd, model = "embed") {
 export function indexExists(name, cwd) {
     return existsSync(indexPath(name, cwd));
 }
+// Never embed (and POST to an embedding provider, then persist in the index) a secret-bearing file —
+// the asset/skill/memory dirs aren't .gitignore-filtered, so a stray credentials.json/secrets.yaml/.env
+// there would otherwise leak. Defense-in-depth (the repo walk already respects .gitignore).
+const SECRET_FILE = /(^\.?env(\.|$)|secret|credential|password|apikey|api[_-]?key|\btoken|\.(pem|key|p12|pfx|keystore|crt)$|^\.netrc$|^\.npmrc$|id_(rsa|ed25519|ecdsa))/i;
+function looksSecret(rel) {
+    return SECRET_FILE.test(rel.split("/").pop() ?? rel);
+}
 /** Walk one knowledge directory (code-assets / skills / memory) and chunk its files. Files come back as
  *  absolute paths so recall/memory_search can read or open them directly. */
 export function collectDirChunks(dir, source) {
@@ -128,7 +135,7 @@ export function collectDirChunks(dir, source) {
         return [];
     const chunks = [];
     for (const rel of walkFiles(dir)) {
-        if (!CODE_RE.test(rel))
+        if (!CODE_RE.test(rel) || looksSecret(rel))
             continue;
         const abs = join(dir, rel);
         if (fileSize(abs) > 200_000)
@@ -150,7 +157,7 @@ export function collectDirChunks(dir, source) {
 export function collectRepoChunks(root) {
     const chunks = [];
     for (const rel of listProjectFiles(root)) {
-        if (!CODE_RE.test(rel))
+        if (!CODE_RE.test(rel) || looksSecret(rel))
             continue;
         const abs = join(root, rel);
         if (fileSize(abs) > 200_000)

package/dist/session/store.js

@@ -42,6 +42,8 @@ export function cleanSessionName(raw) {
  *  (unlike the ASCII-slug `cleanSessionName`), trims code/whitespace, caps length. Empty for blank input
  *  (callers fall back to the short id, never "new session"). */
 export function deriveTitle(text) {
+    if (typeof text !== "string")
+        return ""; // a malformed/hand-edited session may have a non-string content
     const t = text
         .replace(/^\/\S+\s*/, "") // drop a leading slash-command
         .replace(/```[\s\S]*?```/g, " ") // drop fenced code blocks
@@ -75,12 +77,18 @@ export function saveSession(meta, history) {
     const data = { meta, history };
     writeFileSync(sessionFile(meta.id), JSON.stringify(data, null, 2), "utf8");
 }
+/** True if a parsed object has the SessionData shape we can safely use (meta object + history array). */
+function isSessionData(d) {
+    const o = d;
+    return !!o && typeof o === "object" && !!o.meta && typeof o.meta === "object" && Array.isArray(o.history);
+}
 export function loadSession(id) {
     const p = sessionFile(id);
     if (!existsSync(p))
         return null;
     try {
-        return JSON.parse(readFileSync(p, "utf8"));
+        const d = JSON.parse(readFileSync(p, "utf8"));
+        return isSessionData(d) ? d : null; // a corrupt / hand-edited file resumes as "no session" instead of crashing
     }
     catch {
         return null;
@@ -93,7 +101,9 @@ export function listSessions(cwd) {
         if (!f.endsWith(".json"))
             continue;
         try {
-            metas.push(JSON.parse(readFileSync(join(sessionsDir(), f), "utf8")).meta);
+            const d = JSON.parse(readFileSync(join(sessionsDir(), f), "utf8"));
+            if (d?.meta && typeof d.meta === "object" && d.meta.id && d.meta.updatedAt)
+                metas.push(d.meta); // skip metaless/corrupt
         }
         catch {
             /* skip corrupt */

package/dist/tools/computer.js

@@ -12,15 +12,20 @@ import { registerTool } from "./registry.js";
 import { loadConfig } from "../config.js";
 const RANK = { off: 0, read: 1, click: 2, full: 3 };
 const ACTION_MIN = { screenshot: "read", find: "read", activate: "click", move: "click", click: "click", type: "full", key: "full" };
-// dangerous combos refused even at full tier (quit / close / delete / task-switch-kill)
+// dangerous combos refused even at full tier (quit / close / delete / task-switch-kill).
 const KEY_BLOCK = /(?:\b(cmd|command|ctrl|control|alt|option|win|super|meta)\b.*\+.*\b(q|w|delete|del|f4|escape|esc)\b)|ctrl\+alt\+(?:delete|del|backspace)/i;
+// Windows SendKeys spells modifiers as % (Alt) / ^ (Ctrl) with no modifier WORD, so the combo regex
+// above misses them: block Alt+F4 / Ctrl+F4 (close window) and Ctrl+W (close tab) in that syntax.
+const KEY_BLOCK_SENDKEYS = /[%^]\s*\{\s*f4\s*\}|\^\s*w\b/i;
+// Linux/X keysyms for logout / power-off (xdotool key XF86LogOff …) — not modifier combos.
+const KEY_BLOCK_KEYSYM = /\bxf86(logoff|poweroff|reboot|sleep)\b/i;
 /** Whether the configured tier permits the action. Exported for tests. */
 export function actionAllowed(tier, action) {
     return RANK[tier] >= RANK[ACTION_MIN[action] ?? "full"];
 }
 /** Whether a key combo is on the dangerous blocklist. Exported for tests. */
 export function keyIsBlocked(keys) {
-    return KEY_BLOCK.test(keys);
+    return KEY_BLOCK.test(keys) || KEY_BLOCK_SENDKEYS.test(keys) || KEY_BLOCK_KEYSYM.test(keys);
 }
 // Circuit breaker (learned from codex): bound consecutive screen-control failures so the agent can't loop
 // forever on a broken setup. Reset on any success; after FAIL_LIMIT in a row, return a clear stop + how to fix.
@@ -315,7 +320,7 @@ registerTool({
             const app = String(input.app ?? input.target ?? "");
             if (!app)
                 return "activate needs an `app` name (e.g. 'WeChat').";
-            if (!cfg.computerApps.some((a) => app.toLowerCase().includes(a.toLowerCase()) || a.toLowerCase().includes(app.toLowerCase())))
+            if (!cfg.computerApps.some((a) => a.toLowerCase() === app.toLowerCase()))
                 return `Refused: "${app}" isn't in your allowlist (${cfg.computerApps.join(", ") || "empty"}). Add it: \`hara config set computerApps "${app}"\`.`;
             const r = activateApp(app);
             return r.ok ? ok(`✓ ${r.msg} — now screenshot/find/click to act on it`) : fail(r.msg);
@@ -325,7 +330,7 @@ registerTool({
             if (!cfg.computerApps.length)
                 return "No apps allowlisted — set `hara config set computerApps \"App Name, …\"` before clicking/typing.";
             const app = frontmostApp();
-            const allowed = cfg.computerApps.some((a) => app.toLowerCase().includes(a.toLowerCase()) || a.toLowerCase().includes(app.toLowerCase()));
+            const allowed = cfg.computerApps.some((a) => a.toLowerCase() === app.toLowerCase());
             if (!allowed)
                 return `Refused: frontmost app "${app || "unknown"}" isn't in your allowlist (${cfg.computerApps.join(", ")}). Switch to an allowed app or update computerApps.`;
         }