@nanhara/hara 0.89.0 → 0.98.0

package/dist/org-fleet/enroll.js

@@ -13,6 +13,7 @@ import { homedir, hostname, platform } from "node:os";
 import { join } from "node:path";
 import { readFileSync, writeFileSync, existsSync, mkdirSync, chmodSync, rmSync } from "node:fs";
 import { orgRolesDir } from "../org/roles.js";
+import { loadActiveProfile } from "../profile/profile.js";
 const orgPath = () => join(homedir(), ".hara", "org.json");
 const deviceInfo = () => ({ name: hostname(), os: platform(), hara_version: process.env.HARA_BUILD_VERSION ?? "dev" });
 /** The effective OpenAI-compatible base URL for an enrollment (explicit, else <gatewayUrl>/v1). */
@@ -20,16 +21,38 @@ export function gatewayBaseURL(e) {
     return e.baseURL || `${e.gatewayUrl.replace(/\/$/, "")}/v1`;
 }
 export function loadEnrollment() {
+    // 1) Legacy storage (~/.hara/org.json) for back-compat with pre-profile builds. After the
+    //    profile migration runs (lazily on any profile.ts read), org.json is renamed to .legacy
+    //    so this branch only fires for users who never touched the new profile layer yet.
     const p = orgPath();
-    if (!existsSync(p))
-        return null;
+    if (existsSync(p)) {
+        try {
+            const e = JSON.parse(readFileSync(p, "utf8"));
+            if (e && typeof e === "object" && e.gatewayUrl && e.deviceToken)
+                return e;
+        }
+        catch {
+            /* fall through to profile-derived */
+        }
+    }
+    // 2) Active-profile path. profile.ts doesn't import enroll.ts so this static import is safe.
     try {
-        const e = JSON.parse(readFileSync(p, "utf8"));
-        return e && typeof e === "object" && e.gatewayUrl && e.deviceToken ? e : null;
+        const ap = loadActiveProfile();
+        if (ap.kind === "gateway" && ap.gatewayUrl && ap.deviceToken) {
+            return {
+                gatewayUrl: ap.gatewayUrl,
+                deviceToken: ap.deviceToken,
+                deviceId: ap.deviceId || "",
+                model: ap.defaultModel || "",
+                baseURL: ap.baseURL,
+                enrolledAt: ap.enrolledAt || new Date().toISOString(),
+            };
+        }
     }
     catch {
-        return null;
+        /* not yet migrated */
     }
+    return null;
 }
 function saveEnrollment(e) {
     mkdirSync(join(homedir(), ".hara"), { recursive: true });

package/dist/plugins/plugins.js

@@ -2,7 +2,7 @@
 // runtime. The existing loaders pick the contents up (skillsDirs/loadRoles append the resolvers below;
 // index.ts merges pluginMcpServers into the MCP set). Manifest is Claude-Code-compatible: we read
 // .claude-plugin/plugin.json, .hara-plugin/plugin.json, or a bare plugin.json at the plugin root.
-import { readFileSync, writeFileSync, existsSync, mkdirSync, readdirSync, rmSync, cpSync } from "node:fs";
+import { readFileSync, writeFileSync, existsSync, mkdirSync, readdirSync, rmSync, cpSync, symlinkSync, chmodSync } from "node:fs";
 import { join, resolve, isAbsolute } from "node:path";
 import { homedir } from "node:os";
 import { execFileSync } from "node:child_process";
@@ -10,6 +10,52 @@ import { readRawConfig } from "../config.js";
 export function pluginsDir() {
     return join(homedir(), ".hara", "plugins");
 }
+/** Where plugin-contributed CLI commands are symlinked. Add to PATH to use them (e.g. `export PATH="$HOME/.hara/bin:$PATH"`). */
+export function haraBinDir() {
+    return join(homedir(), ".hara", "bin");
+}
+/** Symlink a plugin's `bin` entries into ~/.hara/bin (chmod +x the targets). Returns the command names linked. */
+function linkPluginBins(root, manifest) {
+    if (!manifest.bin)
+        return [];
+    const dir = haraBinDir();
+    mkdirSync(dir, { recursive: true });
+    const linked = [];
+    for (const [name, rel] of Object.entries(manifest.bin)) {
+        const target = join(root, rel);
+        if (!existsSync(target))
+            continue;
+        try {
+            chmodSync(target, 0o755);
+        }
+        catch {
+            /* best-effort */
+        }
+        const link = join(dir, name);
+        try {
+            rmSync(link, { force: true });
+            symlinkSync(target, link);
+            linked.push(name);
+        }
+        catch {
+            /* skip a bin we can't link */
+        }
+    }
+    return linked;
+}
+/** Remove a plugin's linked bins (on uninstall). */
+function unlinkPluginBins(manifest) {
+    if (!manifest?.bin)
+        return;
+    for (const name of Object.keys(manifest.bin)) {
+        try {
+            rmSync(join(haraBinDir(), name), { force: true });
+        }
+        catch {
+            /* ignore */
+        }
+    }
+}
 const MANIFEST_PATHS = [".claude-plugin/plugin.json", ".hara-plugin/plugin.json", "plugin.json"];
 function readManifest(root) {
     for (const rel of MANIFEST_PATHS) {
@@ -112,6 +158,7 @@ export function installPlugin(source) {
         // move tmp → dest (rename within the same dir)
         cpSync(tmp, dest, { recursive: true });
         rmSync(tmp, { recursive: true, force: true });
+        linkPluginBins(dest, manifest); // expose any plugin CLI commands in ~/.hara/bin
         return { name: manifest.name, version: manifest.version || "0.0.0", root: dest, manifest };
     }
     catch (e) {
@@ -123,6 +170,7 @@ export function uninstallPlugin(name) {
     const dest = join(pluginsDir(), name);
     if (!existsSync(dest))
         return false;
+    unlinkPluginBins(readManifest(dest)); // remove any linked CLI commands first
     rmSync(dest, { recursive: true, force: true });
     return true;
 }

package/dist/profile/profile.js

@@ -0,0 +1,436 @@
+// ────────────────────────────────────────────────────────────────────────────────
+// Profile = identity layer for hara (Personal ↔ Org A ↔ Org B). Switching a profile
+// connects through to *every* downstream decision: provider (BYOK direct vs gateway),
+// API key / device token, base URL, **default model** the gateway / setup chose, and
+// the user's model override within that profile. Plus presentation: a `kind` badge
+// ("ORG" vs "PERSONAL"), a label, a routing display.
+//
+// Single source of truth at runtime. `~/.hara/profiles.json` (0600) stores the *list*
+// of profiles + which one is `active`. The legacy `~/.hara/config.json` keeps acting
+// as the storage for the "personal" profile so existing users with only a config.json
+// don't have to migrate anything (their config.json IS their personal profile).
+//
+// Migration (run lazily on first read):
+//   • config.json exists, no profiles.json   → personal profile is config.json itself,
+//                                              profiles.json is created with active=personal.
+//   • org.json exists (legacy enrolled)      → injected as a `default-org` gateway profile,
+//                                              active is set to it (the user IS using a gateway
+//                                              right now — preserve that), org.json renamed
+//                                              `.legacy` so we never re-migrate.
+//   • Both exist → both become profiles; active = default-org (the gateway, since that's the
+//                                              live routing today).
+//
+// Idempotent: re-running the migration after it's done is a no-op.
+//
+// Provider resolution (in src/index.ts buildProvider):
+//   profile.kind === 'gateway' → OpenAI-compatible w/ deviceToken + (baseURL || gatewayUrl+'/v1')
+//   profile.kind === 'byok'    → existing anthropic / qwen / openai / qwen-oauth dispatch
+//
+// The `hara-gateway` ProviderId enum value is retired from new writes — buildProvider still
+// tolerates reading it from a legacy config.json (it just maps to the migrated gateway profile).
+// ────────────────────────────────────────────────────────────────────────────────
+import { homedir } from "node:os";
+import { join, dirname, parse as parsePath, resolve as resolvePath } from "node:path";
+import { readFileSync, writeFileSync, existsSync, mkdirSync, chmodSync, renameSync, unlinkSync } from "node:fs";
+const PERSONAL_ID = "personal";
+const DEFAULT_ORG_ID = "default-org";
+function haraDir() {
+    return join(homedir(), ".hara");
+}
+function profilesPath() {
+    return join(haraDir(), "profiles.json");
+}
+function configPath() {
+    return join(haraDir(), "config.json");
+}
+function orgPath() {
+    return join(haraDir(), "org.json");
+}
+function readJSON(p) {
+    if (!existsSync(p))
+        return null;
+    try {
+        return JSON.parse(readFileSync(p, "utf8"));
+    }
+    catch {
+        return null;
+    }
+}
+/** Write the profiles file 0600 (it can hold device tokens / api keys). */
+function persistProfilesFile(f) {
+    const p = profilesPath();
+    mkdirSync(dirname(p), { recursive: true });
+    writeFileSync(p, JSON.stringify(f, null, 2) + "\n", { encoding: "utf8", mode: 0o600 });
+    try {
+        chmodSync(p, 0o600);
+    }
+    catch {
+        /* best-effort */
+    }
+}
+/** Synthesize the "personal" profile view from the legacy config.json. The config.json itself
+ *  stays the *storage* — this just presents it as a Profile object. */
+function readPersonalFromConfig() {
+    const cfg = readJSON(configPath()) ?? {};
+    // A legacy user that ran `hara enroll` had their provider written as "hara-gateway" in config.json.
+    // After migration that case is handled separately (default-org profile), so when synthesizing the
+    // personal profile we coerce a stray "hara-gateway" provider to anthropic (the BYOK default) — the
+    // user can always fix it with `hara setup`.
+    const rawProvider = cfg.provider;
+    const provider = rawProvider && rawProvider !== "hara-gateway" ? rawProvider : "anthropic";
+    return {
+        id: PERSONAL_ID,
+        kind: "byok",
+        label: "Personal",
+        provider,
+        apiKey: cfg.apiKey,
+        baseURL: cfg.baseURL,
+        defaultModel: cfg.model,
+        // No per-profile override yet for the personal slot — `model` (override) and `defaultModel`
+        // come from the same field in config.json. `hara model use X` writes `model` to config.json,
+        // `hara model reset` clears it. Conceptually one slot, but the rest of the codebase only ever
+        // reads "effective model" so this is fine.
+    };
+}
+/** Synthesize a `default-org` profile from the legacy org.json (Enrollment). */
+function readDefaultOrgFromOrgJson() {
+    const e = readJSON(orgPath());
+    if (!e || !e.gatewayUrl || !e.deviceToken)
+        return null;
+    const defaultModel = e.model || "";
+    return {
+        id: DEFAULT_ORG_ID,
+        kind: "gateway",
+        label: "Default Org",
+        gatewayUrl: e.gatewayUrl,
+        deviceId: e.deviceId || "",
+        deviceToken: e.deviceToken,
+        baseURL: e.baseURL,
+        defaultModel,
+        availableModels: defaultModel ? [defaultModel] : [],
+        enrolledAt: e.enrolledAt || new Date().toISOString(),
+    };
+}
+/** First-time migration. Idempotent — running again is a no-op (profiles.json already present). */
+function maybeMigrate() {
+    const existing = readJSON(profilesPath());
+    if (existing && Array.isArray(existing.profiles) && existing.profiles.length > 0)
+        return existing;
+    const personal = readPersonalFromConfig();
+    const org = readDefaultOrgFromOrgJson();
+    const profiles = [personal];
+    let active = PERSONAL_ID;
+    if (org) {
+        profiles.push(org);
+        active = DEFAULT_ORG_ID; // legacy enrolled user IS using the gateway right now — preserve
+    }
+    const f = { active, profiles };
+    persistProfilesFile(f);
+    // Park org.json so we never re-migrate. We keep the file (don't delete data), just rename.
+    if (org && existsSync(orgPath())) {
+        try {
+            renameSync(orgPath(), orgPath() + ".legacy");
+        }
+        catch {
+            /* best-effort */
+        }
+    }
+    return f;
+}
+export function listProfiles() {
+    return maybeMigrate().profiles;
+}
+// ────────────────────────────────────────────────────────────────────────────────
+// `.hara-profile` project pin — like .nvmrc, but personal identity rather than
+// runtime version, so we keep it out of repos by default (the printed hint nudges
+// the user to add it to their *global* gitignore — see `profile pin`). Lookup is
+// "walk up from startDir until we hit a `.hara-profile`, fs root, or home". The
+// walk stops at $HOME to prevent a stray ~/.hara-profile from silently overriding
+// the global default (~/.hara/profiles.json `active`).
+// ────────────────────────────────────────────────────────────────────────────────
+const PIN_FILE = ".hara-profile";
+export function pinFilePath(dir) {
+    return join(dir, PIN_FILE);
+}
+/** Walk up from `startDir` looking for `.hara-profile`; return the first hit whose
+ *  contents name a real profile. Returns `{ id, file }` (absolute file path) or null.
+ *  If a pin file exists but names an unknown profile, we emit a one-line stderr warn
+ *  and return null (non-fatal — the active resolution falls through to the next layer). */
+export function findPinnedProfile(startDir) {
+    const home = homedir();
+    const { root } = parsePath(startDir);
+    let dir = resolvePath(startDir);
+    // Track visited to defend against pathological symlink loops (best-effort).
+    const seen = new Set();
+    while (!seen.has(dir)) {
+        seen.add(dir);
+        const file = pinFilePath(dir);
+        if (existsSync(file)) {
+            try {
+                const id = readFileSync(file, "utf8").split(/\r?\n/)[0].trim();
+                if (id && getProfile(id))
+                    return { id, file };
+                if (id) {
+                    // pin points to a profile that no longer exists — warn once, fall through.
+                    try {
+                        process.stderr.write(`hara: ${file} pins profile '${id}', but it doesn't exist — falling back. Run \`hara profile pin <id>\` or \`hara profile unpin\` to fix.\n`);
+                    }
+                    catch {
+                        /* ignore */
+                    }
+                }
+            }
+            catch {
+                /* unreadable pin — skip */
+            }
+        }
+        // Stop walking once we're at $HOME or the fs root (don't escape into shared parent dirs).
+        if (dir === home || dir === root)
+            return null;
+        const parent = dirname(dir);
+        if (!parent || parent === dir)
+            return null;
+        dir = parent;
+    }
+    return null;
+}
+/** Write `.hara-profile` in the given dir with `id` as the only line. */
+export function writePin(dir, id) {
+    if (!getProfile(id))
+        throw new Error(`no profile '${id}' — list with \`hara profile list\``);
+    const file = pinFilePath(dir);
+    writeFileSync(file, id + "\n", "utf8");
+    return { file };
+}
+/** Remove `.hara-profile` from the given dir. Returns true if it was there. */
+export function removePin(dir) {
+    const file = pinFilePath(dir);
+    if (!existsSync(file))
+        return false;
+    try {
+        unlinkSync(file);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+let _flagProfile = null;
+/** Set by the top-level `--profile <id>` flag handler. Cleared between processes
+ *  (we never persist this — it's a one-shot override). Pass null to clear. */
+export function setFlagOverride(id) {
+    _flagProfile = id && id.trim() ? id.trim() : null;
+}
+export function getFlagOverride() {
+    return _flagProfile;
+}
+export function resolveActive(cwd = process.cwd()) {
+    // 1. CLI flag (one-shot).
+    if (_flagProfile && getProfile(_flagProfile))
+        return { id: _flagProfile, source: "flag" };
+    // 2. env (also one-shot — scripts / cron).
+    const env = process.env.HARA_PROFILE;
+    if (env && getProfile(env))
+        return { id: env, source: "env" };
+    // 3. project pin — walk up from cwd to home/root.
+    const pin = findPinnedProfile(cwd);
+    if (pin)
+        return { id: pin.id, source: "pin", pinFile: pin.file };
+    // 4. global default.
+    const f = maybeMigrate();
+    if (f.active && getProfile(f.active))
+        return { id: f.active, source: "default" };
+    // 5. ultimate fallback — personal always exists (migration guarantees it).
+    return { id: PERSONAL_ID, source: "fallback" };
+}
+/** Thin wrapper for the (many) call sites that just need "which profile am I as". */
+export function activeId() {
+    return resolveActive().id;
+}
+export function getProfile(id) {
+    return maybeMigrate().profiles.find((p) => p.id === id);
+}
+/** The effective, runtime view of the active profile. For id==='personal' we re-read from
+ *  config.json on each call so external edits (config set / setup) are picked up live. */
+export function loadActiveProfile() {
+    const id = activeId();
+    const f = maybeMigrate();
+    if (id === PERSONAL_ID) {
+        // Always re-sync personal from config.json (the storage of record). Other profile fields in
+        // profiles.json for "personal" are presentation only (label).
+        const p = readPersonalFromConfig();
+        const stored = f.profiles.find((x) => x.id === PERSONAL_ID);
+        if (stored?.label)
+            p.label = stored.label;
+        return p;
+    }
+    const p = f.profiles.find((x) => x.id === id);
+    if (p)
+        return p;
+    // Active points to nothing → degrade to personal silently and persist.
+    const personal = readPersonalFromConfig();
+    return personal;
+}
+export function useProfile(id) {
+    const f = maybeMigrate();
+    const p = f.profiles.find((x) => x.id === id);
+    if (!p)
+        return { ok: false, reason: `no profile '${id}' — try \`hara profile list\`` };
+    f.active = id;
+    persistProfilesFile(f);
+    return { ok: true, profile: p };
+}
+export function addProfile(p) {
+    if (!p.id || /[\s/]/.test(p.id))
+        return { ok: false, reason: "profile id must be non-empty and contain no whitespace or '/'" };
+    const f = maybeMigrate();
+    if (f.profiles.some((x) => x.id === p.id))
+        return { ok: false, reason: `profile '${p.id}' already exists` };
+    if (p.kind === "gateway" && (!p.gatewayUrl || !p.deviceToken))
+        return { ok: false, reason: "gateway profile needs gatewayUrl + deviceToken" };
+    if (p.kind === "byok" && !p.provider)
+        return { ok: false, reason: "byok profile needs a provider" };
+    f.profiles.push(p);
+    persistProfilesFile(f);
+    return { ok: true };
+}
+/** Replace an existing profile (same id) — used by `hara enroll <url> --code` when the
+ *  default-org profile already exists (re-enrollment / token rotation). */
+export function upsertProfile(p) {
+    const f = maybeMigrate();
+    const i = f.profiles.findIndex((x) => x.id === p.id);
+    if (i >= 0)
+        f.profiles[i] = p;
+    else
+        f.profiles.push(p);
+    persistProfilesFile(f);
+}
+export function removeProfile(id) {
+    if (id === PERSONAL_ID)
+        return { ok: false, reason: "personal is your base profile — switch away with `hara profile use <other>`; it stays." };
+    const f = maybeMigrate();
+    const i = f.profiles.findIndex((x) => x.id === id);
+    if (i < 0)
+        return { ok: false, reason: `no profile '${id}' — list with \`hara profile list\`` };
+    const removed = f.profiles[i];
+    f.profiles.splice(i, 1);
+    let activeChanged = false;
+    if (f.active === id) {
+        f.active = PERSONAL_ID;
+        activeChanged = true;
+    }
+    persistProfilesFile(f);
+    return { ok: true, activeChanged, removedKind: removed.kind, removed };
+}
+/** Override the effective model within a profile. For "personal" this writes to config.json
+ *  (the storage of record). For others it writes to profiles.json. P0: when availableModels
+ *  is non-empty on a gateway profile we validate the choice is in the set. */
+export function setModel(id, model) {
+    if (id === PERSONAL_ID) {
+        // delegate to config.ts so this stays single-storage for personal
+        return setModelOnPersonal(model);
+    }
+    const f = maybeMigrate();
+    const i = f.profiles.findIndex((x) => x.id === id);
+    if (i < 0)
+        return { ok: false, reason: `no profile '${id}'` };
+    const p = f.profiles[i];
+    if (p.kind === "gateway" && p.availableModels && p.availableModels.length > 0 && !p.availableModels.includes(model)) {
+        return { ok: false, reason: `'${model}' not in this profile's availableModels (${p.availableModels.join(", ")})` };
+    }
+    f.profiles[i] = { ...p, model };
+    persistProfilesFile(f);
+    return { ok: true };
+}
+/** Clear a per-profile model override (revert to defaultModel). */
+export function resetModel(id) {
+    if (id === PERSONAL_ID) {
+        // For personal we don't have a distinct override slot — `model` IS the value. Reset means
+        // remove the model line from config.json so the provider default kicks in.
+        return clearModelOnPersonal();
+    }
+    const f = maybeMigrate();
+    const i = f.profiles.findIndex((x) => x.id === id);
+    if (i < 0)
+        return { ok: false, reason: `no profile '${id}'` };
+    const { model: _drop, ...rest } = f.profiles[i];
+    f.profiles[i] = rest;
+    persistProfilesFile(f);
+    return { ok: true };
+}
+/** The effective model for a profile = override (model) || defaultModel || "" (caller decides default). */
+export function effectiveModel(p) {
+    return process.env.HARA_MODEL || p.model || p.defaultModel || "";
+}
+/** Routing display string — the user-visible "where this profile sends requests".
+ *  Used by `whoami` / `profile list`; the TUI header uses `routeHost` for a tighter,
+ *  host-only render. */
+export function routingLabel(p) {
+    if (p.kind === "gateway") {
+        try {
+            const host = new URL(p.gatewayUrl || "").host;
+            return `${host}${p.deviceId ? " · device " + p.deviceId.slice(-8) : ""}`;
+        }
+        catch {
+            return p.gatewayUrl || "gateway";
+        }
+    }
+    return `${p.provider}${p.baseURL ? " · " + p.baseURL : ""}`;
+}
+/** Host-only routing for the TUI header. Returns the URL host (no scheme, no path) plus
+ *  `isCustom`: true when the profile carries a non-default baseURL (BYOK) or always-true
+ *  for gateway profiles. View layer decides whether to show `→ host` (always for org;
+ *  only when `isCustom` for personal). Returns `null` if there's nothing to display
+ *  (BYOK on the provider's official endpoint). */
+export function routeHost(p) {
+    if (p.kind === "gateway") {
+        try {
+            return { host: new URL(p.gatewayUrl || "").host, isCustom: true };
+        }
+        catch {
+            return p.gatewayUrl ? { host: p.gatewayUrl, isCustom: true } : null;
+        }
+    }
+    // BYOK: only surface a host when the user pointed at a non-default endpoint.
+    if (!p.baseURL)
+        return null;
+    try {
+        return { host: new URL(p.baseURL).host, isCustom: true };
+    }
+    catch {
+        return { host: p.baseURL, isCustom: true };
+    }
+}
+// ────────────────────────────────────────────────────────────────────────────────
+// Personal-profile model storage helpers — split out so they can be re-exported via
+// config.ts without circular imports. Implemented inline to avoid pulling config.ts.
+// ────────────────────────────────────────────────────────────────────────────────
+function setModelOnPersonal(model) {
+    const p = configPath();
+    const cfg = readJSON(p) ?? {};
+    cfg.model = model;
+    mkdirSync(dirname(p), { recursive: true });
+    writeFileSync(p, JSON.stringify(cfg, null, 2) + "\n", { encoding: "utf8", mode: 0o600 });
+    try {
+        chmodSync(p, 0o600);
+    }
+    catch {
+        /* best-effort */
+    }
+    return { ok: true };
+}
+function clearModelOnPersonal() {
+    const p = configPath();
+    const cfg = readJSON(p) ?? {};
+    delete cfg.model;
+    mkdirSync(dirname(p), { recursive: true });
+    writeFileSync(p, JSON.stringify(cfg, null, 2) + "\n", { encoding: "utf8", mode: 0o600 });
+    try {
+        chmodSync(p, 0o600);
+    }
+    catch {
+        /* best-effort */
+    }
+    return { ok: true };
+}
+export { PERSONAL_ID, DEFAULT_ORG_ID };

package/dist/providers/anthropic.js

@@ -51,16 +51,43 @@ export function toAnthropic(history) {
     }
     return msgs;
 }
+/** Anthropic models whose only valid `thinking` setting is `{type: "adaptive"}` — they reject any
+ *  explicit `budget_tokens`. We detect them by id family so "off"/low/high still degrade gracefully
+ *  (we just omit the field or stay on adaptive instead of sending a 400-triggering body). */
+function isAdaptiveOnly(model) {
+    // Known adaptive-only families per Anthropic docs: opus-4-7 / opus-4-8 / claude-fable.
+    // Conservative: regex on the family slug so future micro-versions (opus-4-8-20260101) match.
+    return /^(claude-)?(opus-4-7|opus-4-8|fable)/i.test(model) || /(opus-4-7|opus-4-8|fable)/i.test(model);
+}
+/** Map hara's reasoningEffort dial to Anthropic's `thinking` parameter (or omit it).
+ *  Exported for unit testing. */
+export function buildThinkingParam(model, effort) {
+    // Unset = preserve hara's prior behavior (adaptive thinking on by default).
+    if (effort === undefined)
+        return { type: "adaptive" };
+    if (effort === "off")
+        return undefined; // omit thinking entirely (works on every model, incl. adaptive-only)
+    const adaptiveOnly = isAdaptiveOnly(model);
+    if (adaptiveOnly)
+        return { type: "adaptive" }; // can't honor budget on these — fall back to adaptive instead of 400'ing
+    if (effort === "low")
+        return { type: "enabled", budget_tokens: 4096 };
+    if (effort === "medium")
+        return { type: "adaptive" };
+    // high
+    return { type: "enabled", budget_tokens: 24000 };
+}
 export function createAnthropicProvider(opts) {
     const client = new Anthropic({ apiKey: opts.apiKey, maxRetries: 4, ...(opts.baseURL ? { baseURL: opts.baseURL } : {}) });
     return {
         id: "anthropic",
         model: opts.model,
         async turn({ system, history, tools, onText, onReasoning, signal }) {
+            const thinking = buildThinkingParam(opts.model, opts.reasoningEffort);
             const stream = client.messages.stream({
                 model: opts.model,
                 max_tokens: 32000,
-                thinking: { type: "adaptive" },
+                ...(thinking ? { thinking } : {}),
                 system,
                 tools: tools,
                 messages: toAnthropic(history),

package/dist/providers/openai.js

@@ -45,6 +45,12 @@ export function toOpenAI(system, history) {
     }
     return msgs;
 }
+/** Reasoning models on OpenAI (o-series + gpt-5) accept `reasoning_effort` on chat-completions.
+ *  Non-reasoning models reject it. We only attach the param when the model id matches a known
+ *  reasoning family — keeps DeepSeek/GLM/Qwen requests clean. Exported for tests. */
+export function isReasoningModel(model) {
+    return /^(o1|o3|o4|gpt-5)/i.test(model);
+}
 /** OpenAI-compatible provider (works with OpenAI, Qwen/DashScope, GLM, Kimi, …). */
 export function createOpenAIProvider(opts) {
     const client = new OpenAI({ apiKey: opts.apiKey, maxRetries: 4, ...(opts.baseURL ? { baseURL: opts.baseURL } : {}) });
@@ -65,6 +71,13 @@ export function createOpenAIProvider(opts) {
             };
             if (oaiTools.length)
                 params.tools = oaiTools;
+            // reasoning_effort: only attach for OpenAI reasoning models, and only when the user picked a
+            // non-default level. "off" means "don't ask the model to reason" — for reasoning models we
+            // pass "minimal" (gpt-5 / o-series accept it); on chat-style models that put reasoning in
+            // the stream (DeepSeek/GLM) we can't silence it server-side, so the UI just won't render.
+            if (opts.reasoningEffort && opts.reasoningEffort !== undefined && isReasoningModel(opts.model)) {
+                params.reasoning_effort = opts.reasoningEffort === "off" ? "minimal" : opts.reasoningEffort;
+            }
             // Stream: emit text deltas live; accumulate tool-call args by index; grab usage from the tail chunk.
             let text = "";
             const acc = new Map();
@@ -80,7 +93,9 @@ export function createOpenAIProvider(opts) {
                         onText(delta.content);
                     }
                     const rc = delta?.reasoning_content ?? delta?.reasoning; // GLM-5 / DeepSeek
-                    if (rc)
+                    // reasoningEffort="off" + a stream-reasoning model: server can't be silenced, so we just
+                    // don't surface it. Anything else (incl. undefined) shows the reasoning live.
+                    if (rc && opts.reasoningEffort !== "off")
                         onReasoning?.(rc);
                     if (delta?.tool_calls) {
                         for (const tc of delta.tool_calls) {