Changelog

Versioning (pre-1.0): the minor number bumps for a new feature; the patch number for fixes and optimizations.

Windows chat-bot replies restored — Hara 0.178.3 / Desktop 0.1.171

• Windows standalone builds no longer forward Bun's synthetic B:/~BUN/root/cli.js entry as a user argument when Hara starts a child session. This restores WeChat and Feishu replies that previously failed with too many arguments even while the platform transport appeared online.
• Engine self-invocation now filters both Windows and POSIX Bun virtual entries while preserving ordinary Node and Bun script launches. Native release gates exercise the compiled self-reentry path on Windows, macOS, and Linux.
• Desktop bundles the exact Hara Engine 0.178.3; the Windows installer and updater package both passed sidecar execution smoke tests before publication.

CLI: npm i -g @nanhara/hara@0.178.3
Desktop: Settings → App & updates → Check for updates → Download and restart
Verify: Chat bots → restart WeChat and Feishu → send one new private message to each → confirm both reply normally

Correct completion after external actions — Hara 0.178.2 / Desktop 0.1.170

• When the Engine has verified a successful external action such as sending a message, uploading a file, or publishing, but the Agent has not yet produced its final receipt, the no-progress guard now grants one bounded finalization round instead of immediately mislabeling the completed task as paused.
• Finalization may only inspect completion evidence and return the result. It cannot send, upload, publish, or repeat any other external side effect. If finalization still does not complete, the existing stalled-task pause remains in force.
• Desktop bundles the exact Hara Engine 0.178.2 and retains the existing recovery, stop controls, and progress diagnostics.

CLI: npm i -g @nanhara/hara@0.178.2
Desktop: Settings → App & updates → Check for updates → Download and restart
Verify: perform one safe external send or upload in a test session → confirm it happens once and ends as completed

Verified file progress and quieter chat — Hara 0.178.1 / Desktop 0.1.169

• Long tasks now count Engine-verified file-content changes as progress even when the Agent has not yet updated its checklist. write_file, edit_file, and apply_patch report committed bytes directly; foreground shell and Python calls can declare expected output files for before/after verification. Repeated unchanged content still reaches the stalled-run stop.
• Raw shell output is folded into an expandable line-counted row instead of filling the conversation. Pause reasons, approvals, and final answers remain visible. Output bursts are coalesced, and typing does not redraw the whole transcript projection on every keystroke.
• Chinese stalled-task prompts and recovery steps now ask the Agent to inspect actual artifacts and record verified task state before continuing.

CLI: npm i -g @nanhara/hara@0.178.1
Desktop: Settings → App & updates → Check for updates → Download and restart
Verify: generate a test file → repeat without changing its bytes → inspect progress/pause; run a multi-line command → expand Tool output

Chat bots managed in Desktop — Hara 0.178.0 / Desktop 0.1.167

• WeChat and Feishu connectors can now be started and stopped from Desktop settings. Desktop restores only connectors the user explicitly started, and it will not stop a gateway owned by another process.
• Bot health now separates platform transport from private-message authorization. An online transport is no longer presented as proof that an end-to-end reply is ready.
• A new Feishu private sender receives a short-lived pairing code. The user matches and approves that code in Desktop; the raw platform identity remains in private Engine storage and is never returned to the renderer.
• Ordinary Feishu group mentions remain outside the full Agent driver unless an explicit Flow or bridge is enabled. Advanced deployments can still run gateway commands from the CLI.

CLI: npm i -g @nanhara/hara@0.178.0
Desktop: Settings → App & updates → Check for updates → Download and restart
Verify: Chat bots → Start → private-message the Feishu bot → match and approve the code → send the message again

Bounded long tasks and a clearer Agent Office — Hara 0.177.1 / Desktop 0.1.166

• Long foreground and unattended tasks now warn before their progress budget is exhausted, then pause with a durable checkpoint when repeated rounds stop advancing. A paused task can be resumed in the same conversation without losing its retained question or completed work.
• Retained-task prompts, progress warnings, checkpoints, and stop messages follow the conversation language. Chinese conversations no longer fall back to English operational text.
• Desktop Agent Office uses a compact two-row control bar, shows only useful nonzero status counts, and reveals actor details after selection. This leaves substantially more room for the live office stage while keeping pause and stop controls reachable.
• Desktop includes the exact Hara 0.177.1 Engine. The signed and notarized macOS builds, Windows installers, Linux packages, update manifest, checksums, and provenance are published on the stable channel and China mirror.

CLI: npm i -g @nanhara/hara@0.177.1
Desktop: Settings → App & updates → Check for updates → Download and restart
Verify: resume a retained task in Chinese → let a stalled task reach its warning/pause → inspect Agent Office at a narrow width

Governed Computer Use and browser interaction — Hara 0.172.0 / Desktop 0.1.159

• Hara can now discover governed local Computer Use when a task explicitly needs it. Screen observation, clicking, keyboard input, and screenshot grounding are independently constrained by mode, an exact application allowlist, and per-action approval. Enabling browser control does not silently authorize consequential submit, sign, or pay actions.
• Security settings can install an isolated structured-browser capability. After restarting the Engine and opening a new conversation, Hara can click, type, capture screenshots, and upload files. The isolated browser does not reuse another browser's login session; account login remains an explicit user action.
• Image understanding and coordinate grounding use the exact model connection selected by the current Space, without guessing a provider from a model name. Unknown capability, a missing allowlist entry, or an environment policy lock fails closed with an actionable explanation.
• A scheduled task whose prompt asks to send through Feishu or WeChat while structured delivery remains local-only is rejected before persistence by Desktop, CLI, and Agent entry points. Desktop keeps the editor open with the error.

CLI: npm i -g @nanhara/hara@0.172.0
Desktop: Settings → App & updates → Check for updates → Download and restart
Verify: Security → Computer Use → choose mode and exact apps → install browser control → restart Engine → new conversation

Failover by real connection and model capability — Hara 0.171.0 / Desktop 0.1.158

• Automatic failover now follows the user's ordered saved connections, rather than inferring a provider from a model name. Every candidate keeps its own provider, endpoint, region, credential, current model, health state, and accounting authority. Personal spaces can opt into up to four candidates; managed enterprise sessions never cross into personal connections.
• Image, tool, and context requests only move to a connection whose current model has an explicitly compatible capability. Unknown capability fails closed. Authentication or quota exhaustion excludes the same underlying account for the entire attempt chain, including equivalent default endpoints, so renaming the connection or choosing another model cannot retry the same key. Unknown provider usage remains visibly unavailable instead of estimated.
• Hara never replays a request after any text, tool event, or usage has streamed, preventing duplicate output and side effects. Deleting or rebinding a session connection aborts the stale route. Context overflow can only move to a model with a known larger window, and that minimum remains enforced after later throttling.
• Desktop Model connections exposes per-connection capabilities, region, circuit state, and accounting authority, with explicit enable, reorder, and remove controls for fallback connections. Its bundled Engine is pinned to Hara 0.171.0.

CLI: npm i -g @nanhara/hara@0.171.0
Desktop: Settings → App & updates → Check for updates → Download and restart
Verify: add two personal accounts → order fallback connections → test image, tool, and quota-error paths

Native Feishu/WeChat delivery and bounded unattended progress — Hara 0.169.0

• An authorized WeChat conversation can now send through the Feishu Gateway already connected on the same device. Hara selects the exact account and chat, keeps the Feishu App Secret outside the Agent, and preserves per-chat ordering and idempotency across retries or restarts.
• A gateway owner can explicitly enable a Feishu-group → WeChat-DM bridge with /bridge on; each authorized colleague opts in from their own WeChat DM with /bridge join. Durable receipts and provenance prevent loops, duplicate broadcasts, and accidental cross-tenant delivery.
• The Engine now owns a no-progress watchdog for unattended CLI, gateway, cron, Serve, and native Agent work. Repeated unchanged calls, stalled checkpoints or todos, access-boundary probing, and excessive run-local tokens produce a typed resumable pause. Desktop and Mobile receive credential-free progress and stop-state counters.

CLI: npm i -g @nanhara/hara@0.169.0
Verify: restart Feishu and WeChat Gateways → test an authorized cross-channel message → inspect a stalled task pause

Durable decisions and lossless terminal handoff — Hara 0.168.2 / Desktop 0.1.154

• Unanswered ask_user choices from headless, gateway, or scheduled tasks now become durable pauses. A later reply in the same conversation resumes the original task with that redacted decision retained across compaction, instead of guessing an answer or ending the automation.
• Change tasks require a fresh machine-readable completion receipt for every accepted check. Hara preserves an honest resumable checkpoint when verification is incomplete, and keeps credential enrollment in trusted masked settings or login surfaces rather than model-authored shell commands.
• Desktop and negotiated Mobile bridge clients can transfer control of one live Codex or Claude Code terminal without losing accepted input. The old controller drains and acknowledges an exact input fence before the successor becomes authoritative; timeout, disconnect, launch failure, or a racing reconnect safely restores the existing controller.
• When an image is pasted while the selected model is auto, Desktop no longer implies that the provider will choose a multimodal route. It offers direct actions to configure a connection-bound vision-first model or open the verified visual-model list, while leaving provider routing under the user's explicit connection policy.

CLI: npm i -g @nanhara/hara@0.168.2
Desktop: Settings → App & updates → Check for updates → Download and restart
Verify: resume one paused question → transfer one live terminal → paste an image with model `auto`

Honest provider usage and resumable remote state — Hara 0.167.0 / Desktop 0.1.151

• Model connections now identify who owns their accounting. Provider-native subscriptions retain the provider's own units and reset rules, while enterprise-managed routes remain governed by Hara Control. When a provider does not expose authoritative usage, Hara says it is unavailable instead of estimating a balance, percentage, currency amount, or reset window.
• Automatic failover may use an authoritative exhaustion signal from the provider or Hara Control. Missing usage data does not block ordinary model calls and does not trigger a guessed failover.
• The bundled Hara CLI 0.167.0 adds replay-safe remote commands, ordered resumable events, controller leases, durable read-only Agent Team state, and stronger continuity for long-running tasks.

CLI: npm i -g @nanhara/hara@0.167.0
Desktop: Settings → App & updates → Check for updates → Download and restart
Verify: open Model connections → inspect Usage authority → reconnect a Hara Live session after interruption

Clear terminal identity and adaptive workspace — Desktop 0.1.150

• The built-in surface is now labeled only Hara Terminal. The internal PTY bridge name no longer appears in the interface, and Hara continues to hide external-terminal actions until the Engine can advertise a verified, vendor-neutral adapter for an actually installed terminal.
• Session details keep their intended responsive grid. At compact widths the transcript and information panel stack instead of squeezing the transcript beside large empty cards.
• Physical-keyboard desktops preserve more terminal height by collapsing the bilingual special-key bar by default; touch devices keep it open, and Show key controls reveals it at any time.

Desktop: Settings → App & updates → Check for updates → Download and restart
Verify: open Hara Live → confirm the header says Hara Terminal → resize the window → show/hide key controls

Physical keyboard input and built-in terminal focus — Desktop 0.1.149

• After Hara Live gains local control, the built-in terminal now focuses automatically. Clicking its output focuses it again, so physical keyboards on macOS, Windows, and Linux can type, paste, and control the active Codex or Claude Code session directly.
• Esc, arrows, Enter, Tab, PgUp/PgDn, and Ctrl+C remain touch and special-key helpers. Each returns focus to the terminal instead of leaving the controls responsive while the physical keyboard appears inactive.
• The user-facing WezTerm-only action and the “WezTerm is not installed” error are removed. Hara Terminal is the complete default and requires no external app; future external-terminal handoff will use a vendor-neutral adapter.

Desktop: Settings → App & updates → Check for updates → Download and restart
Verify: open Hara Live → confirm Local control → click the terminal and type on the physical keyboard

Full-width terminal and consistent sidebars — Desktop 0.1.148

• Hara Live's native terminal now opens at full workspace width by default and can return to split view with one action. The explicit Full-width terminal / Restore split control remains visible at medium window widths instead of leaving the terminal in a cramped column.
• The embedded view is labeled Hara Terminal and continues to control the same Codex or Claude Code process through one Herdr PTY. Open in WezTerm hands that same session to a native WezTerm window without launching a duplicate model process.
• Automations and Conversations now use the same primary-sidebar width and header inset. A workspace-level warning also identifies Desktop/Engine version mismatches and can switch back to bundled Engine 0.166.1.

Desktop: Settings → App & updates → Check for updates → Download and restart

Persistent recovery, explicit authentication, and local Chrome access — Hara 0.166.1 / Desktop 0.1.147

• Long tasks no longer stop at the former 20-round threshold. The second identical failure now explicitly requires a different strategy; only a third unchanged failure stops safely, preventing endless retries of the same broken command. The final 30-minute, 64-round-per-turn, and 100-round-per-task safety boundaries remain in place.
• Hara blocks requests for API keys, passwords, cookies, authorization headers, browser storage, and session tokens, and keeps those values out of persisted handoffs. When an already signed-in page is genuinely needed, the user can explicitly install bundled:chrome locally and authorize remote debugging in Chrome 144 or newer. This connects only to the locally approved Chrome session; it does not grant unattended browser access to gateway tasks.
• Claude Code history availability and authentication in the current Hara process are now checked and shown separately. If history exists but authentication is unavailable, Desktop asks the user to sign in and check again instead of copying the selected model-connection key or claiming that the original session is connected. Desktop bundles the exact Engine 0.166.1 and includes the live terminal, WezTerm handoff, Agent Plan auto recovery, and personal multi-account connection fixes from the preceding release.

npm i -g @nanhara/hara@0.166.1
# Optional access to a locally signed-in Chrome session:
hara plugin add bundled:chrome
# Desktop: Settings → App & updates → Check for updates → Download and restart

Interactive extension terminal and WezTerm handoff — Hara 0.166.0 / Desktop 0.1.146

• Hara Live's native Codex and Claude Code terminal now uses a live PTY stream in a right-side extension panel that can be resized, maximized, collapsed, and reopened without losing the conversation. Physical keyboard input, paste, terminal resize, and scrolling reach the same process. Esc, arrows, Enter, Tab, PgUp/PgDn, and Ctrl+C controls send their real terminal input and show localized action labels.
• One terminal can have multiple read-only observers but only one input controller. Taking over requires confirmation and disconnecting releases the lease. On macOS and Linux, Open in WezTerm can hand the same terminal to an installed WezTerm window without starting another Codex or Claude Code process; the complete built-in terminal remains available when WezTerm is absent.
• Volcengine Ark Agent Plan now recovers when its auto route returns the specific unsupported-model 404: before any output exists, Hara retries once through stable ark-code-latest, without replaying text or tools. A new personal connection must validate its exact provider, URL, key, and model before it can be saved; a failed test on an existing connection now clearly says that it remains saved but is not verified.

npm i -g @nanhara/hara@0.166.0
# Desktop: Settings → App & updates → Check for updates → Download and restart

Recoverable Hara Live sessions and visible connection drafts — Hara 0.165.3 / Desktop 0.1.144

• Hara Live no longer labels every provider terminal awaiting input as an ambiguous indefinite wait. Such sessions open directly into the expanded native terminal. If the terminal is gone, the session becomes explicitly unavailable, stops pointless polling, and offers retry, start-again, and confirmed end-and-remove exits. Removal closes only the isolated terminal created by Hara and leaves workspace files intact.
• The Model Connections add button now immediately inserts and selects a New model connection · Unsaved draft row. Its label, provider, and model follow the form; save makes it persistent and cancel removes only the draft. The original migrated Personal connection and the last personal connection are removable after an in-app account-specific confirmation, while the empty state keeps its add entry point.
• Blank app chrome no longer exposes a context-menu Reload that refreshes the whole WebView; native actions remain available for fields, links, selected text, and the terminal. The CLI falls back to visible terminal output when Claude Code is awaiting input and exposes an identity-revalidated end action. Desktop bundles the exact Hara CLI 0.165.3 release.

npm i -g @nanhara/hara@0.165.3
# Desktop: Settings → App & updates → Check for updates → Download and restart

Multiple personal model accounts and resilient recovery — Hara 0.165.0 / Desktop 0.1.142

• Personal now stores model connections as named accounts rather than one replace-in-place provider. You can add several providers or several accounts from the same provider, keep each endpoint, Key, model, reasoning default, and vision route isolated, test the exact account, and switch without re-entering credentials. Existing conversations remain pinned to the connection they started with.
• Legacy vision-first settings recover their missing compatible provider adapter and keep the matching credential. Images still run through one fixed recognition task first, with its returned text passed unchanged to the conversation model. Oversized durable histories now compact before retrying a failed image/tool turn instead of repeatedly submitting the same bounded but still failing request.
• Desktop fixes the Windows model/work-mode selection crash, keeps Hara and its local Engine running when the macOS red close button hides the window, and repositions Automation action menus after resize or scroll. Revoked company access now becomes a localized read-only recovery state while local history remains intact.

npm i -g @nanhara/hara@0.165.0
# Desktop: Settings → App & updates → Check for updates → Download and restart

Connection-scoped vision and reliable update restarts — Hara 0.164.2 / Desktop 0.1.141

• Vision settings now live in Model Settings and belong to the current model connection. Every image runs through a fixed visual-understanding task first, and the returned text is passed unchanged to the next conversation model. Personal connections may select a visual model on the current provider or configure an independent compatible endpoint; managed company connections expose only visual models actually enabled by the organization and reuse their managed credential.
• Volcengine Ark Agent Plan now prioritizes the current product catalog: auto, Doubao Seed, GLM 5.3, DeepSeek V4, and MiniMax M3, with auto recommended for quality/speed routing. Live catalogs filter out embeddings, rerankers, speech, realtime audio, image generation, and video generation; the vision picker also lists only models whose multimodal capability has been confirmed.
• Hara and Codex continue to use Ark's Beijing Responses route, while Claude Code uses its separate Anthropic-compatible route. Desktop now validates the authenticated updater-restart marker before reconciling the previous run, so a normal download-and-restart is no longer reported as unclean_exit; genuine abnormal exits remain diagnosable.

npm i -g @nanhara/hara@0.164.2
# Desktop: Settings → App & updates → Check for updates → Download and restart

Native coding-agent workbench — Hara 0.162.0 / Desktop 0.1.137

• Hara Live now starts provider-native Codex or Claude Code sessions in a chosen workspace and keeps the structured workbench and native terminal as two views of the same live process. Messages, interruption, approvals, and bounded terminal keys go through Hara without copying or taking over provider histories.
• Launch controls follow the selected provider: model, reasoning effort, and safe work mode are available where supported, with Codex fast mode kept Codex-specific. Enter sends, Shift+Enter inserts a line break, Chinese IME composition is protected, and drafts, actions, approvals, and errors stay isolated per session.
• Stored Codex and Claude Code histories remain read-only until an explicit in-place resume. Desktop 0.1.137 bundles Hara CLI 0.162.0; four-platform packages, both notarized macOS architectures, GitHub immutable release evidence, and the complete first-party CDN byte, SHA-256, signature, and Range audits passed before the stable channel moved.

npm i -g @nanhara/hara@0.162.0
# Desktop: Settings → App & updates → Check for updates → Download and restart

Reliable new conversations — Hara 0.159.1 / Desktop 0.1.130

• Fixes a regression where New conversation and New conversation in this directory could appear to do nothing. A newly created empty conversation now remains visible and becomes active immediately, even before its first message creates a durable transcript or while the first list refresh is catching up.
• Empty drafts remain disk-free until the first message, while list filters, pagination, project routing, and Agent routing continue to use the authoritative session metadata. A failed refresh now keeps the created conversation available and shows a recoverable warning instead of discarding the successful create.
• Desktop 0.1.130 bundles the exact Hara CLI 0.159.1 release. Four-platform package checks, signed and notarized Apple Silicon/Intel builds, immutable GitHub release verification, and first-party CDN byte, SHA-256, signature, and Range audits all passed before the stable channel moved.

npm i -g @nanhara/hara@0.159.1
# Desktop: Settings → App & updates → Check for updates → Download and restart

Codex and Claude Code session relay — Hara 0.159.0 / Desktop 0.1.129

• Hara CLI 0.159.0 discovers, reads, safely forks, and continues local Codex and Claude Code sessions. Codex uses its official App Server for protected forks, managed work, compatible live turns, same-turn follow-ups, and interruption. Claude Code preserves the source session, forks through the official Agent SDK, resumes it with query, and streams the result back through Hara. Independently running Claude turns are never injected into or commandeered.
• Desktop 0.1.129 adds a searchable coding-session workbench with truthful history, managed, and live states. Tool activity is collapsed by default, temporary rows clear after the authoritative transcript arrives, and narrow-window/detail layouts no longer collapse into a vertical strip. Automation pages also adapt to small windows and report the real run outcome consistently.
• 0.1.128 was paused before publication for the additional real two-provider round-trip gate and never entered the stable channel. Desktop 0.1.129 bundles the exact Hara CLI 0.159.0 release; four-platform package checks, signed and notarized Apple Silicon/Intel builds, GitHub immutable-release attestation, and complete first-party CDN byte, SHA-256, signature, and Range audits must pass before the stable channel moves.

npm i -g @nanhara/hara@0.159.0
# Desktop: Settings → App & updates → Check for updates → Download and restart

Reliable message control and a themed Capability Center — Hara 0.158.0 / Desktop 0.1.127

• Hara CLI 0.158.0 scopes every WeChat remote-terminal route to the chat that created it, expires temporary routes, and replaces the internal “injected, no new output” diagnostic with an explicit receipt. Scheduled Agent runs now expose bounded outcomes and durations, refresh their effective date and time zone, and stop safely when a non-interactive ask_user step genuinely needs an answer.
• Desktop 0.1.127 bundles the exact Hara CLI 0.157.0 execution-profile release. It keeps one Personal model connection with a model/reasoning default, lets Personal Agents use a validated override, and keeps the Main Agent and company Agents on their authoritative Space policy. Conversation-create and rename failures are visible, duplicate creates are blocked, and existing histories and credentials remain intact.
• The Capability Center now follows one semantic Daylight/Night design contract for tabs, search, cards, icons, status, keyboard focus, responsive layout, and text selection. Four-platform package verification, signed and notarized Apple Silicon/Intel builds, GitHub immutable-release attestation, and the complete first-party CDN byte, SHA-256, signature, and Range audit passed before the stable channel moved.

npm i -g @nanhara/hara@0.158.0
# Desktop: Settings → App & updates → Check for updates → Download and restart

Alibaba Responses, native vision, and fast message Flows — Hara 0.156.0 / Desktop 0.1.124

• Alibaba Token Plan now uses the documented OpenAI-compatible Responses route for current Qwen 3.8/3.7/3.6, DeepSeek V4, and GLM 5.2 Agent models. The Key-scoped live model catalog remains authoritative; media generators stay out of the chat picker, while custom model IDs remain available as an advanced option.
• qwen3.8-max, qwen3.8-flash, qwen3.7-plus, and qwen3.6-flash receive native image attachments. Normal chat keeps its selectable thinking level. Off sends only enable_thinking:false, matching live Token Plan behavior that returns zero reasoning tokens instead of trusting the ineffective effort:none path.
• store:false prevents creation of retrievable seven-day Response state for previous_response_id; Hara keeps the durable transcript locally and enables Alibaba's prefix Session cache. Provider-hosted Harness tools are not silently enabled, so Hara's local approvals, company policy, and audit boundary remain authoritative.
• Message Flows default to thinking Off, can select another model on the same credential and endpoint, and can use a schema-validated static result for deterministic routing with zero model calls. A narrowly malformed legacy connection registry is repaired without replacing the selected route or its credential.

npm i -g @nanhara/hara@0.156.0
# Desktop: Settings → App & updates → Check for updates → Download and restart

Windows startup black-screen recovery — Hara 0.155.1 / Desktop 0.1.119

• Fixes an update-time failure where the native Windows window remained responsive while its WebView content stayed black. Windows renderer bundles now target a more conservative WebView2 JavaScript baseline so older runtimes do not fail before React mounts.
• A startup recovery surface now works independently of React. If native code receives no renderer-ready signal within 10 seconds, it recreates the window once with isolated data and software rendering. Versioned markers and a strict retry bound prevent restart loops.
• The stable channel moves only after native Windows MSVC compilation, packaged EXE/MSI sidecar launch smoke, all four platform bundles, both signed and notarized macOS architectures, immutable GitHub attestation, and the complete China-CDN byte, SHA-256, signature, and Range audit pass. Desktop 0.1.118 was withheld after the Windows compile gate found an issue; the corrected public build is 0.1.119.

npm i -g @nanhara/hara@0.155.1
# Desktop: Settings → App & updates → Check for updates → Download and restart

Local Codex/Claude sessions and a bilingual Agent workforce — Hara 0.155.1 / Desktop 0.1.117

• Hara can now discover installed Codex and Claude Code sessions on the current device. Desktop provides a separate searchable session center for bounded, redacted history, safe forks, continuation, approval, and interruption; native session IDs and filesystem paths remain outside the renderer.
• The Talent Bureau now contains 308 deduplicated roles across 22 departments, with localized names and summaries, compact-window hiring flows, and an individual locally generated portrait for every candidate. Release validation rejects missing, unexpected, malformed, oversized, or byte-duplicated portraits.
• Alibaba Token Plan exposes qwen3.8-flash as a native visual and reasoning conversation model with its documented one-million-token context. Media-generation IDs remain in media surfaces, known chat models use a searchable selector, and advanced users can still enter a validated custom model ID.
• Automations gain a native working-directory picker, a reachable fixed action footer for long instructions, honest Manual run only platform status, and repair of stale packaged scheduler paths after upgrades. Unavoidable external steps now appear as focused recovery cards with copy, verify, and resume guidance.
• Desktop 0.1.117 bundles the exact Hara CLI 0.155.1. Four-platform package smoke, macOS signing and notarization, protected immutable release verification, and the complete China CDN byte, SHA-256, signature, and updater-range audit passed before the stable channel moved.

npm i -g @nanhara/hara@0.155.1
# Desktop: Settings → App & updates → Check for updates → Download and restart

Recoverable startup locks and complete final replies — Hara 0.154.1 / Desktop 0.1.114

• hara serve now safely recovers a complete startup lock only when its recorded process is no longer alive. Live, malformed, or contended locks remain untouched, and token-fenced exclusive takeover prevents one process from deleting another process's lock.
• Desktop now reconciles the authoritative final reply with streamed tool and commentary segments. A completed task no longer leaves the central answer area blank, while tool evidence, notices, and non-duplicated streamed content remain visible.
• Desktop 0.1.114 bundles the exact Hara CLI 0.154.1. All four platform packages, packaged-sidecar smoke tests, both macOS signatures and notarizations, the immutable GitHub release, and the full China CDN byte, SHA-256, signature, and updater-range audit passed before the stable channel moved.

npm i -g @nanhara/hara@0.154.1
# Desktop: Settings → App & updates → Check for updates → Download and restart

MiniMax M3, recoverable long tasks, and independent company billing — Hara 0.154.0 / Desktop 0.1.112 / Control 0.1.25

• MiniMax Token Plan is now a first-class connection: Hara uses the official https://api.minimaxi.com/v1 endpoint, Responses transport, MiniMax-M3, native image input, adaptive thinking, and a verified live model catalog. Desktop guides setup through choose a plan → verify the Key → choose a model → chat, while custom compatible endpoints and model IDs remain available under advanced settings.
• Images now go only to the selected conversation model. The legacy secondary vision route is removed; a text-only model asks the user to switch instead of silently sending an attachment to Qwen or another provider.
• Long tasks retain the newest tool evidence during context reduction, narrow or page their own reads, and no longer ask the user to reopen a conversation, rerun Hara's script, or paste Hara's omitted output. Strategy checkpoints and recoverable pauses stop unproductive work before the old 64-round failure message.
• Authentication expiry is a resumable Sign in again state with retained progress and a preflight before continuation. Daylight model settings now keep readable surfaces, selection text, and type sizes.
• Control 0.1.25 adds fail-closed administrator consent for member-owned model connections inside a company Space. When allowed, company data, Agent permissions, approvals, and audit scope remain company-owned while inference is explicitly labelled Company data · Personal billing.
• Desktop 0.1.112 bundles the exact Hara CLI 0.154.0 and passed four-platform packaging, packaged-sidecar smoke, both macOS signatures/notarizations, immutable GitHub release verification, and full China-CDN byte, SHA-256, and updater-range verification. Windows installers remain updater-signed but are not Authenticode-signed.

npm i -g @nanhara/hara@0.154.0
# Desktop: Settings → App & updates → Check for updates → Download and restart

Bounded execution recovery and day/night themes — Hara 0.153.1 / Desktop 0.1.111 / Control 0.1.24

• Hara hashes successful tool observations within each run. Two consecutive repeats of the same completion evidence trigger a strategy-change nudge; six unchanged repeats stop with an explicit loop report. Fresh tool evidence resets the counter. Quiet subagents avoid an inappropriate progress nudge but retain the same hard-stop protection.
• Missing or incomplete tool arguments are discarded and receive one bounded same-model retry. Hara never executes a partial call or retries forever. Control 0.1.24 gates production on Flash, Pro, and Vision-Exp, and requires a real image-understanding result to enter an exact tool call before deployment proceeds.
• Desktop adds persistent System / Daylight / Night appearance modes. Semantic colors cover the workbench, inbox, settings and model screens, approvals/errors, company groups, Talent Bureau, Office, 2D/3D offices, and the desktop companion.
• Desktop 0.1.111 bundles the exact Hara CLI 0.153.1 and passed four-platform native packaging, packaged Windows sidecar smoke, both macOS signatures/notarizations, immutable-release attestation, and public-CDN Gatekeeper verification. Windows installers are still not Authenticode-signed, so SmartScreen may continue to show a publisher reputation warning.

npm i -g @nanhara/hara@0.153.1
# Desktop: Settings → App & updates → Check for updates → Download and restart

Agent Talent Bureau — Hara 0.153.0 / Desktop 0.1.110

• Desktop adds a game-like Talent Bureau with 270 versioned Agent roles across 18 departments. Finance, Sales, and People/HR are first-class filters, business-outcome search works in English or Chinese, and a candidate joins the Agent directory and comic Office only after an explicit hire.
• The catalog distinguishes 31 hand-adapted Hara roles from 239 community imports. Finance, sales, and recruiting heroes have independent comic portraits, while every remaining candidate receives a stable identity from an expanded fallback system instead of sharing the same look.
• Hara 0.153.0 records blueprint ID, version, publisher, source revision, license, and a server-computed prompt digest. Editing a hired role deliberately removes verified provenance; hiring never grants tools, models, memory, company permissions, payment authority, outreach authority, or employment authority.
• Desktop 0.1.110 bundles the exact Hara CLI 0.153.0 and independently verifies both public macOS DMGs, Gatekeeper trust, and stable updater metadata after protected signing, notarization, and immutable release.
• Windows packages remain updater-signed but are not yet Authenticode-signed, so SmartScreen may still show a publisher reputation warning.

npm i -g @nanhara/hara@0.153.0
# Desktop: Settings → App & updates → Check for updates → Download and restart

Agent recovery and verified release transport — Hara 0.152.2 / Desktop 0.1.109

• Generated Python now recovers from SyntaxError, IndentationError, and TabError in the same conversation. Hara identifies the current file and reported line, requires the Agent to read that exact region before editing again, and keeps repeated recovery bounded.
• A missing final receipt after successful tool work is no longer confused with advice-only delegation. Completed edits and commands remain a resumable checkpoint; before any real action, the ownership rule is still strict and an Agent cannot hand authorized executable work back to the user.
• Desktop 0.1.109 bundles the exact Hara CLI 0.152.2. Its protected publisher verifies source packs and every hidden release asset by exact size and SHA-256, uses bounded HTTP/1.1 fallbacks for GitHub transport stalls, and keeps credentials out of arguments and files. A release remains hidden until all platform artifacts, macOS signatures/notarization, updater signatures, and public immutable bytes pass verification.
• Windows installers remain updater-signed but are not yet Authenticode-signed, so SmartScreen may still show a publisher reputation warning.

npm i -g @nanhara/hara@0.152.2
# Desktop: Settings → App & updates → Check for updates → Download and restart

Personal/company Spaces and managed Agents — Hara 0.152.0 / Desktop 0.1.104 / Control 0.1.23

• Personal and every company are now first-class Spaces with a Control-authoritative company identity. Conversations freeze their Space and provider route when they are created, so replacing or reconnecting a company route cannot send an old company's transcript to another tenant. Unverifiable legacy organization history stays local and read-only instead of being guessed into a current Space.
• Agent catalogs, prompts, projects, conversations, model routes, and the comic Office follow one atomic Space switch. Personal users can hire, edit, and recoverably dismiss Agents with unique usernames, public profiles, safe avatars, and private work briefs. Company-managed identities remain read-only unless Control grants the administrator action.
• Organization inference now requires a fresh, fail-closed model/tool/write policy. Control 0.1.23 binds every role, person, team, assignment, policy, digital employee, and device administration route to the authenticated administrator's tenant, rejects cross-company references, and records the real actor in governance audits.
• Local profiles, configuration, and managed role bundles use crash-recoverable cross-process coordination, so concurrent CLI, Desktop, Serve, and gateway processes cannot silently drop another process's route or secret. Desktop 0.1.104 bundles the exact Hara CLI 0.152.0 and makes every release download bounded and recoverable.

npm i -g @nanhara/hara@0.152.0

Agent-owned execution and reviewed business learning — Hara 0.150.0 / Desktop 0.1.100 / Control 0.1.22

• Accepted change tasks now have an engine-enforced action-ownership contract. Hara does not accept a prose-only “run this yourself” handoff when an authorized tool is available: it keeps executing, requires fresh completion evidence, and fails closed if the model still refuses after a bounded retry.
• A real human dependency is now explicit and evidenced: missing secret, missing authority, unavoidable physical action, material business choice, unresolved external state, or destructive confirmation. CLI, Serve, and Desktop expose the same typed blocker instead of vague advice.
• Execution-time business learning is available at personal, project, and organization scopes. Observations are bounded, redacted, deduplicated candidates; only user-approved local rules or Control-approved organization rules can enter future task context. Rejected or revoked rules do not affect behavior, and learning never grants model, tool, or filesystem authority.
• Desktop adds Settings → Business learning for review, approve/reject/revoke, organization submission, and versioned sync. Control adds a tenant-scoped Business Learning console with recurrence evidence and administrator review. Organization candidates remain inactive until approved, and revocation removes them from the next full device sync.
• Desktop 0.1.100 bundles the exact Hara CLI 0.150.0. It carries forward the visible Alibaba Token Plan endpoint/searchable live model catalog and native DeepSeek Vision-Exp image understanding from 0.1.99.

npm i -g @nanhara/hara@0.150.0

Native DeepSeek vision and an explicit Token Plan setup — Hara 0.149.0 / Desktop 0.1.99 / Control 0.1.21

• Direct official DeepSeek connections now expose deepseek-v4-flash-vision-exp as an explicitly visual model. It uses the official Responses input_image path for uploaded PNG, JPEG, GIF, and WebP files; Flash and Pro remain accurately marked as text-only models.
• One enterprise Hara Control connection now receives Flash, Pro, and Vision-Exp together. Control keeps DeepSeek's native thinking and tool semantics while preserving image blocks, and its release gate must obtain the correct answer from a real three-object image plus positive USD spend before production can switch versions. Current official Flash/Pro/Vision pricing is used for budgets.
• Desktop always displays the fixed Alibaba Cloud Model Studio Token Plan Base URL as read-only and copyable. Its accessible model combobox searches suggested/live-authorized models and still accepts an exact custom ID only through the provider's test-before-save policy. Legacy DashScope and Qwen browser-sign-in entries stay out of new setup.
• The feedback-improvement loop is deliberately controlled: text is redacted and injection-scanned, review is bound to an immutable version, and accepted examples become deterministic regression cases. It does not autonomously rewrite production prompts or code.
• Desktop 0.1.99 bundles the exact Hara CLI 0.149.0. Windows packages remain updater-signed but not Authenticode-signed, so SmartScreen may still show a publisher reputation warning.

Upgrade:

npm i -g @nanhara/hara@0.149.0
# Desktop: Settings → App & updates → Check for updates → Download and restart

Safe project-list removal — Desktop 0.1.98

• Every project in the Desktop sidebar now has an accessible remove action, including projects that already contain conversations. The action no longer depends on an empty project or pointer hover.
• Removal is intentionally local and non-destructive: the project leaves this Desktop's navigation, while all Hara conversations and every file in the project directory remain untouched. The confirmation dialog explains that boundary before applying the change.
• Opening the same directory restores the project and its conversations. Removing the active project safely returns to Assistant and clears its remembered project selection.
• Desktop 0.1.98 continues to bundle the exact verified Hara CLI 0.148.4; no project, conversation, file, credential, or enterprise Hara Control migration is required. Windows packages remain updater-signed but not Authenticode-signed, so SmartScreen may still show a publisher reputation warning.

Upgrade:

# Desktop: Settings → App & updates → Check for updates → Download and restart

Searchable provider models and legacy Alibaba cleanup — Hara 0.148.4 / Desktop 0.1.97

• Provider setup now uses one accessible searchable combobox instead of choosing between a locked dropdown and an unassisted text field. Suggested models stay easy to select, while an exact custom model ID can still be typed and connection-tested.
• Token Plan continues to treat the current API Key's live /models response as authoritative: a custom ID must test as authorized before it can be saved. OpenAI-compatible custom endpoints can retain a verified custom model when their catalog is incomplete.
• Legacy DashScope (qwen) and Qwen Code browser sign-in (qwen-oauth) no longer appear as new setup choices, including when Desktop reconnects to an older engine. Existing connections remain readable and offer a focused Token Plan migration action.
• When a stale bundled engine is the reason old provider entries are still visible, Provider settings now explains the mismatch and offers a safe engine restart. Desktop 0.1.97 continues to bundle the exact verified Hara CLI 0.148.4; existing conversations and enterprise Hara Control routes are unchanged.
• Windows packages remain updater-signed but not Authenticode-signed, so SmartScreen may still show a publisher reputation warning.

Upgrade:

npm i -g @nanhara/hara@0.148.4
# Desktop: Settings → App & updates → Check for updates → Download and restart

Safe migration for stale Token Plan models — Hara 0.148.4 / Desktop 0.1.96

• Alibaba Cloud Model Studio Token Plan is now the single current Alibaba setup entry, using its subscription endpoint, masked Key input, and a selectable text-model catalog. Existing DashScope and Qwen Code OAuth connections remain readable without presenting browser sign-in as Token Plan login.
• After connection verification, the picker uses only the current Key's live /models authorization result and continues to exclude image, audio, and video generators. Out-of-catalog models cannot be tested or saved.
• When a resumed conversation is pinned to a model that disappeared from the live catalog, sending pauses first and offers only a live-authorized replacement such as glm-5 → glm-5.2; Hara no longer sends a request to the retired model.
• Desktop 0.1.96 bundles CLI 0.148.4 exactly and carries forward 0.1.95's signed-asset reconciliation: uncertain uploads are checked against GitHub's remote size and SHA-256 before a single conflicting asset can be retried inside the hidden draft. Any mismatch remains fail closed.
• Windows packages remain updater-signed but not Authenticode-signed, so SmartScreen may still show a publisher reputation warning.

Upgrade:

npm i -g @nanhara/hara@0.148.4
# Desktop: Settings → App & updates → Check for updates → Download and restart

Windows execution fallback, Token Plan Responses, and reliable Desktop releases — Hara 0.148.2 / Desktop 0.1.93

• Windows child processes restore trusted System32, Wbem, and Windows PowerShell system paths and resolve cmd.exe, where.exe, and taskkill.exe from the system directory. A trimmed inherited PATH should no longer block work with spawn cmd.exe ENOENT.
• computerUse accepts only off, read, and full. When the HARA_COMPUTER_USE environment variable overrides the file setting, the save command now explains that the value was persisted but the current effective source is still the environment.
• Qwen 3.8/3.7 models on Alibaba Cloud Model Studio Token Plan now use the Responses API. The model picker exposes model-aware Low, Medium, and High reasoning levels and matching context metadata without applying Qwen fields to other models that share the endpoint.
• Office work must visually inspect the first and densest representative pages before completion and fix overlapping titles, cramped tables, inconsistent hierarchy, and stray template language. When a renderer is unavailable, Hara discloses that limitation instead of claiming the layout was verified.
• Desktop 0.1.93 bundles the exact verified Hara CLI 0.148.2 and carries forward the preinstalled Agent Office, WebGL/2.5D/list fallbacks, the macOS cold-start main-window repair, and companion state controls. Existing conversations, projects, files, Artifacts, and presentations need no migration.
• Every platform now invokes the locked-install and production-audit helpers explicitly through Bash, so Windows cannot treat a .sh helper as a successful no-op. A release becomes public only after dependency install, audit, real-package smoke, Developer ID signing, and notarization pass. ARM DMGs use native smoke; only Intel DMGs use the protected foreign-architecture verifier. Windows packages remain updater-signed but not Authenticode-signed, so SmartScreen may still show a reputation warning.

Upgrade the CLI:

npm i -g @nanhara/hara@0.148.2

Desktop: Settings → App & updates → Check for updates → Download and restart.

Live Agent Office and one focused Hara companion — Hara 0.148.0 / Desktop 0.1.80

• The right dock can now open a native Agent Office tab that visualizes the real root Agent and bounded sub-agent lifecycle from the active session. Scene and list views show current state and responsibility; the tab remains resizable, collapsible, and closable, and does not open itself for every background event.
• Hara now has one official companion identity instead of eleven near-duplicate choices. Work, waiting, paused, completed, and blocked states are expressed with attached actions and props. Existing 0.1.79 official selections migrate to the single companion automatically, so an upgrade cannot leave it blank.
• The new workforce protocol is ordered, versioned, session-scoped, and privacy-bounded. It exposes only typed lifecycle metadata and never prompt text, reasoning, tool arguments, file paths, provider IDs, or credentials. Older engines safely fall back to the root task.
• Desktop 0.1.80 bundles the exact verified Hara CLI 0.148.0. Existing conversations, projects, files, Artifacts, presentations, and settings need no migration. Windows packages remain updater-signed but not Authenticode-signed, so SmartScreen may still show a reputation warning.

Upgrade:

npm i -g @nanhara/hara@0.148.0
# Desktop: Settings → App & updates → Check for updates → Download and restart

Live project instructions without restart — Hara 0.147.2

• Long-lived CLI and Desktop Serve conversations now reload the bounded, protected AGENTS.md project instructions immediately before every new idle turn. Project-rule edits take effect in the same conversation without restarting Hara, reopening the project, or discarding history.
• An active turn keeps one stable system context. Steering accepted while work is running does not change instructions underneath that execution; the next idle turn receives the refresh.
• Approval modes, gateway sender restrictions, protected-file rules, and the existing 32 KiB project- instruction cap remain unchanged.

Upgrade the CLI:

npm i -g @nanhara/hara@0.147.2

Truthful task completion and native local-image inspection — Hara 0.147.1

• Images downloaded or discovered during a task now use the current conversation's authorized image route through a verified private snapshot. Qwen 3.7 Plus and other image-capable main models no longer need a project script, protected .env access, or a second API key to inspect a local image.
• An accepted task reaches completed only after Core receives a fresh final receipt with observable acceptance evidence. Missing user input becomes an explicit resumable awaiting_user pause, while any later work invalidates an earlier success receipt automatically.
• Repeated failures remain visible across interleaved failing tools, and a matching configured MCP service is preferred over browsing or recreating its implementation. Trusted-extension approvals are unchanged.
• Windows now prefers Git Bash and rejects mixed WSL/drive-letter paths before they become malformed. New and resumed sessions also record their exact Hara engine version for actionable feedback reports.

Upgrade the CLI:

npm i -g @nanhara/hara@0.147.1

Durable DeepSeek reasoning and bounded sub-agents — Hara 0.147.0 / Desktop 0.1.73

• Direct official DeepSeek connections now give both V4 Flash and V4 Pro the complete non-thinking, Low, High, and Max controls on stateless Responses. Completed reasoning is retained across tool rounds and replayed in order without depending on unsupported server-side conversation state.
• Hara Control 0.1.18 publishes the same model and effort catalog for company connections. Its verified LiteLLM DeepSeek route keeps thinking and reasoning_effort intact; it does not pretend the managed gateway implements a native Responses endpoint.
• Chinese task intake now resolves short follow-ups such as “fix”, “start”, and “continue” against the active request and checkpoint. A new provider-neutral sub-agent runtime adds bounded FIFO admission, isolated read-only child state, cancellation, structured settlement, and accurate delegated usage.
• Organization connections no longer advertise an image fallback they did not authorize. The optional vision helper remains only for text-only providers that actually need image compatibility, not as a second reasoning model. Large local session stores also compile to a bounded macOS Seatbelt profile.
• Desktop 0.1.73 bundles the exact verified Hara CLI 0.147.0. Existing conversations, projects, schedules, Artifacts, presentations, and files require no migration. Windows packages remain updater-signed but not Authenticode-signed, so SmartScreen may still show a reputation warning.

Upgrade:

npm i -g @nanhara/hara@0.147.0
# Desktop: Settings → App & updates → Check for updates → Download and restart

Authoritative turn input routing — Hara 0.146.3 / Desktop 0.1.72

• Core now owns one atomic session.submit admission point for persistent clients. It decides from the authoritative session state whether input starts an idle turn, steers the live turn, or stays unsent; concurrent submissions retain arrival order without confusing a late turn_end with a newer message.
• Text and attachments remain one queued input. A new-task request cannot enter a running task, and idle sessions no longer expose a stale previous turn as active. Older clients remain compatible through the guarded session.send and session.steer protocol-v1 adapters.
• A freshly selected model and thinking effort are checked at the exact start boundary. If configuration changed or has not settled, Core returns an explicit mismatch and Desktop safely retries instead of silently starting the message on the previous route.
• Desktop 0.1.72 bundles the exact verified Hara CLI 0.146.3. Existing conversations, projects, schedules, Artifacts, presentations, and local files require no migration. Windows packages remain updater-signed but not Authenticode-signed, so SmartScreen may still show a reputation warning.

Upgrade:

npm i -g @nanhara/hara@0.146.3
# Desktop: Settings → App & updates → Check for updates → Download and restart

DeepSeek V4 Pro Responses and safer provider failures — Hara 0.146.2 / Desktop 0.1.71

• Direct official DeepSeek connections now use the stateless Responses API for both deepseek-v4-flash and deepseek-v4-pro. The fallback picker contains exactly those two documented models when live discovery is unavailable; a successful live catalog remains authoritative.
• Responses streams reject non-increasing sequence numbers and any event after a terminal event. Provider errors are normalized through one bounded sanitizer, removing known credentials, URL credentials, authorization values, control characters, and oversized upstream bodies before they can reach the terminal, Desktop, or durable conversation history.
• Routing is capability-based: only the official api.deepseek.com root or /v1 route receives native Responses behavior. Custom endpoints and the managed Hara Control gateway keep their actual protocol, so a model name alone can never send traffic to an unsupported /v1/responses path.
• Desktop 0.1.71 bundles the exact verified Hara CLI 0.146.2. Existing conversations, projects, schedules, Artifacts, local files, and presentations need no migration.

Upgrade:

npm i -g @nanhara/hara@0.146.2
# Desktop: Settings → App & updates → Check for updates → Download and restart

Native Responses, exact PDF, and recoverable presentation delivery — Hara 0.146.1 / Desktop 0.1.70

• DeepSeek deepseek-v4-flash uses the official stateless Responses API with semantic stream events, reasoning/text deltas, function-call replay, and accurate usage. In 0.146.1, V4 Pro remained on Chat instead of being misrepresented as a Responses route.
• Presentations export PDF directly from the same self-contained presenter and verify the PDF header, end marker, and exact page count before delivery. Agent-created decks also check repeated titles and claims, generic headings, duplicated body copy, repetitive composition, and visual monotony. Findings remain below the canvas, locate the affected slide, never cover the deck, and do not leak raw engine prose.
• A draft with advisory narrative findings can still export a JSON source copy whose receipt records that revision is required. PDF, HTML, editable PPTX, and structurally invalid content remain strictly blocked. Windows Chinese-path reads, Bash health selection, and MCP capability descriptions are fixed.
• Desktop 0.1.70 bundles the exact verified Hara CLI 0.146.1. Both macOS architectures are signed, notarized, and Gatekeeper-checked; Windows, Linux, and the first-party mirror passed signature, SHA-256, packaged-sidecar, and byte-range checks. Existing data needs no migration. Windows packages are still not Authenticode-signed, so SmartScreen may warn.

Upgrade:

npm i -g @nanhara/hara@0.146.1
# Desktop: Settings → App & updates → Check for updates → Download and restart

Clearer presentation narratives and actionable layout diagnostics — Hara 0.145.1 / Desktop 0.1.69

• The Presentation specialist now gives every slide one narrative job and keeps its title, claim, evidence, and action distinct. It defaults to two or three visible blocks, moves background detail into speaker notes, and no longer turns agent plans, revision plumbing, or validation codes into audience-facing copy.
• @nanhara/hara-presentation@0.1.0-alpha.8 chooses opening layouts from the actual content instead of forcing a statement page, uses Chinese-aware wrapping, and projects the same bounded visible blocks into HTML and editable PPTX. Dense slides still fail closed, but their structured findings remain outside the slide rather than becoming part of the presentation.
• Desktop 0.1.69 removes the native iframe title tooltip and shows localized layout findings below the canvas. A finding identifies its slide and block, can be clicked to locate the exact content, and never covers the deck. It bundles the exact verified Hara CLI 0.145.1; existing conversations, projects, schedules, Artifacts, local files, and decks need no migration. Windows packages remain updater-signed but not Authenticode-signed, so SmartScreen may still show a warning.

Upgrade:

npm i -g @nanhara/hara@0.145.1
# Desktop: Settings → App & updates → Check for updates → Download and restart

Real-browser verification, bounded work, and safer updates — Hara 0.145.0 / Desktop 0.1.68

• Hara can open an HTTP(S) page in the real system browser for interactive and SPA verification after explicit screen-control approval. web_fetch remains the bounded text-reading path and works during investigation; unusable SPA extraction stops after two variants instead of looping or turning hidden framework markup into a fake 404.
• A project's “always allow” choice is reused by operation family rather than being regenerated for each concrete command or path. Protected files, explicit deny rules, guardian checks, screen control, and external extensions retain independent mandatory boundaries.
• A running or approval-waiting conversation can fork from a protocol-complete immutable snapshot while the original continues. Exact failures stop after two attempts, changed variants of one failing script or endpoint stop after three high-signal failures, and long tasks checkpoint at 50 rounds and pause recoverably at 100 until the user explicitly continues. Existing tools are scanned before new scripts, with a Bash/PowerShell Unicode-boundary warning where relevant.
• Desktop 0.1.68 keeps IME candidate-confirmation Enter inside all composers and fails closed if a macOS updater manifest maps Intel to Apple Silicon or vice versa. It bundles the exact verified Hara CLI 0.145.0; existing conversations, projects, schedules, Artifacts, local files, and decks need no migration. Windows packages remain updater-signed but not Authenticode-signed, so SmartScreen may still show a warning.

Upgrade:

npm i -g @nanhara/hara@0.145.0
# Desktop: Settings → App & updates → Check for updates → Download and restart

Final layout evidence and conversation permissions — Hara 0.144.1 / Desktop 0.1.66

• Presentation now measures title/body collisions, block overlap, clipping, overflow, and safe-area violations after fonts, wrapping, and the final DOM settle. A failing slide reports its number and findings and blocks version save, verification, Browser/PDF, HTML, and PPTX output. Structured JSON remains available for recovery instead of presenting a broken layout as verified.
• pitch, report, technical, and visual are four real layout templates independent from color themes. Native editable bar, line, area, pie, and doughnut charts retain bounded categories, series, and slide density; images, flow/architecture diagrams, and composite content continue to drive the same Desktop, HTML, and editable-PPTX projections.
• The Desktop property inspector is a collapsible third column at ordinary widths and no longer covers the preview; very narrow windows explicitly switch between inspector and canvas. The composer adds a conversation-scoped Ask / Auto edit / Full auto selector persisted by the engine across reconnects and restarts. Protected paths, screen control, external extensions, and explicit denies remain gated.
• Desktop 0.1.66 bundles the exact verified Hara CLI 0.144.1 and @nanhara/hara-presentation@0.1.0-alpha.7. Existing conversations, projects, schedules, Artifacts, local files, and decks need no migration. Windows packages remain updater-signed but not Authenticode-signed, so SmartScreen may still show a warning.

Upgrade:

npm i -g @nanhara/hara@0.144.1
# Desktop: Settings → App & updates → Check for updates → Download and restart

Native visual Dock, richer decks, and localized recovery — Hara 0.144.0 / Desktop 0.1.65

• Desktop now uses one real, resizable right-side Dock for Presentation, Browser, Files, Terminal, and Review surfaces. Tabs can coexist, the active surface is explicit, and closing the Dock returns all space to the conversation instead of leaving a floating start screen or covering the work area.
• The Presentation specialist and @nanhara/hara-presentation@0.1.0-alpha.6 add selectable visual themes and content-aware layouts, native bar/line/area/pie/doughnut charts, bounded images, architecture and flow diagrams, and reliable nested content. The same structured source drives the Desktop preview plus JSON, self-contained HTML, editable PPTX, and PDF through Browser print.
• Presentation revision races use a stable protocol code. Desktop automatically reopens the latest revision when safe and otherwise shows a localized recovery message; raw engine prose and internal routing wrappers no longer leak into the conversation or toast layer.
• Desktop 0.1.65 bundles the exact verified Hara CLI 0.144.0. Existing conversations, projects, and Artifacts need no migration. Windows installers remain updater-signed but not Authenticode-signed, so SmartScreen may still show a reputation warning.

Upgrade:

npm i -g @nanhara/hara@0.144.0
# Desktop: Settings → App & updates → Check for updates → Download and restart

Editable Presentation surfaces and simpler image routing — Hara 0.143.0

• The Presentation specialist now creates an editable draft early and revises the same owner-bound Artifact with optimistic revision checks. Compatible Serve clients receive typed surface events for the exact deck revision, while unsaved edits can be rendered through the same bounded presenter before they are committed or exported.
• visual_preview lets a compatible client place a Node-powered local web result beside its conversation. It accepts only credential-free loopback HTTP URLs (localhost, 127.0.0.1, or [::1]) with an explicit port; arbitrary remote pages are not promoted to trusted project surfaces.
• Ordinary PPT generation now uses one selected main model, one Presentation-specialist prompt, and one structured source. The optional image compatibility model remains only for text-only attachment and screenshot workflows; it is no longer shown as a second primary identity and never runs in the default Presentation path.
• @nanhara/hara-presentation@0.1.0-alpha.5 removes PptxGenJS's unused vulnerable image-size declaration from the production dependency graph while preserving editable PPTX output. The public npm package, four standalone binaries, and both GHCR architectures were independently executed after release with a clean production audit.

Upgrade:

npm i -g @nanhara/hara@0.143.0

Reliable directory opening and data-first debugging — Hara 0.142.2 / Desktop 0.1.64

• Explicit requests to open an existing local folder now use Hara's dedicated open_directory capability. The path is validated and canonicalized, then passed as one argument to Finder, File Explorer, or the Linux file manager instead of being interpolated into a shell command.
• A clear request such as “把文件目录打开” is treated as a direct local interaction, so it no longer enters task_intake, triggers the Understanding Gate, or trips the repeated-failure breaker. Generic shell execution and the breaker's existing safety boundaries are unchanged.
• Debugging turns now validate the reported function's real inputs and observable state, trace missing values upstream through callers and data construction, and stop repeating symptom-level edits after one ineffective attempt. This covers cases where an omitted object field—not the called function—is the actual defect.
• Desktop 0.1.64 bundles the exact verified Hara CLI 0.142.2. Existing conversations, projects, schedules, Artifacts, presentations, and settings need no migration. Windows packages remain updater-signed but not Authenticode-signed, so SmartScreen may still show a reputation warning.

Upgrade:

npm i -g @nanhara/hara@0.142.2
# Desktop: Settings → App & updates → Check for updates → Download and restart

Native presentation generation and delivery — Hara 0.142.0 / Desktop 0.1.60

• Presentation is now a preinstalled Hara capability rather than an executable Slidev project. The authenticated local engine creates and normalizes the versioned hara.presentation/1 document, validates it, renders one exact self-contained HTML runtime, and exports editable PPTX through the audited @nanhara/hara-presentation package.
• Desktop adds an owner-bound Presentation workbench in the right panel. A generated deck can be previewed without leaving the conversation, presented fullscreen, opened in the system browser, or exported as structured JSON, self-contained HTML, or editable PPTX. Browser print remains the explicit PDF route.
• Import accepts bounded Hara JSON and safe Slidev-style Markdown only. Vue/HTML execution, local imports, scripts, and remote content are rejected. Existing arbitrary PPTX/ODP files stay on the byte-preserving Office Artifact path; this release does not claim editable conversion of a third-party deck.
• Desktop 0.1.60 bundles the exact verified Hara CLI 0.142.0. Existing conversations, projects, schedules, Artifacts, and settings need no migration. Windows packages remain updater-signed but not Authenticode-signed, so SmartScreen may still show a reputation warning.

Upgrade:

npm i -g @nanhara/hara@0.142.0
# Desktop: Settings → App & updates → Check for updates → Download and restart

Private reasoning and dependable input — Hara 0.141.1 / Desktop 0.1.59

• Hara now removes hidden <think> and <thinking> reasoning blocks from both streamed and saved answers, including tags split across provider chunks and orphan closing tags. The visible answer is explicitly requested in the user's language, without exposing provider reasoning.
• After task_intake, the execution view now says when it is waiting for the model. An empty or failed continuation becomes an actionable blocked state that can be resumed, instead of remaining falsely busy. Local previews and tunnels must be launched as durable background services and pass a readiness check; Hara no longer treats a foreground server killed by a short tool timeout as a deployment.
• Desktop stores pasted images atomically in an owner-only persistent media directory and refuses unsafe symlink paths. The formal conversation composer now accepts native cross-app drops of images, files, and folders. A real pasted, dropped, or selected image follows qwen3.7-plus's native-vision route; text that merely looks like a local path stays literal and is never silently read or uploaded.
• Desktop 0.1.59 bundles the exact verified Hara CLI 0.141.1. Existing conversations and settings need no migration. Windows packages remain updater-signed but not Authenticode-signed, so SmartScreen may still show a reputation warning.

Upgrade:

npm i -g @nanhara/hara@0.141.1
# Desktop: Settings → App & updates → Check for updates → Download and restart

Recoverable conversations and clearer execution — Hara 0.141.0 / Desktop 0.1.58

• Authenticated hara serve clients can open an on-disk conversation through read-only session.history even when its pinned organization connection or model is no longer authorized. Reading local history never rebuilds or calls the unavailable provider. Desktop falls back to this local replay, visibly keeps every send path read-only, and offers a focused recovery action instead of showing a blank conversation.
• Continuing on another connection is an explicit copy, not an in-place reroute. A client must name the target connection and model and record history-transfer consent before session.fork creates a new conversation. Desktop explains the copy before confirmation; Hara validates target authorization and native-image compatibility, keeps the original unchanged, and sends no copied context to the target model until the user deliberately submits the next message.
• Desktop now separates the assistant's answer from local execution evidence and adds concise, standard, and debug display modes. Durable task blockers, facts, capability checks, next steps, and artifacts remain visible so interrupted work can resume without looking falsely complete.
• Redacted organization service bindings, scoped project-approval explanations, and pinnable plugin panels are also surfaced without weakening workspace boundaries. Desktop 0.1.58 bundles the exact verified Hara CLI 0.141.0; existing conversations and local state need no migration. Windows packages remain updater-signed but not Authenticode-signed, so SmartScreen may still show a reputation warning. Persistent clients can find the protocol contract in Memory & Sessions.

Upgrade:

npm i -g @nanhara/hara@0.141.0
# Desktop: Settings → App & updates → Check for updates → Download and restart

Named personal model connections and safe two-way handoff — Hara 0.140.0 / Desktop 0.1.57

• AI & models can now save multiple named personal connections. Each connection keeps its provider, exact model identifier, endpoint, and protected credential; users can test it before saving, make it active explicitly, or remove it. Saved names appear in Settings and in the conversation model menu, so a custom model such as qwen3.7-plus is no longer hidden behind a single provider preset.
• Existing conversations remain pinned to the connection that created them. Switching from an enterprise conversation back to a personal or named personal connection uses the same confirmed, separate-conversation handoff as switching in the other direction. The old history stays unchanged; an unsent draft moves only after confirmation and is never submitted automatically.
• On Windows, Hara now removes stale updater staging directories that it owns after startup. The update panel shows the actual cache path and provides a safe manual cleanup action. This does not move an installation chosen for another drive and does not claim a custom updater staging location, which the current Tauri updater does not expose. Desktop 0.1.57 bundles the exact verified Hara CLI 0.140.0.

Upgrade:

npm i -g @nanhara/hara@0.140.0
# Desktop: Settings → App & updates → Check for updates → Download and restart

Deliberate enterprise-model handoff from an existing conversation — Hara 0.139.1 / Desktop 0.1.56

• Existing conversations remain pinned to the connection that created them; their history is never silently migrated. The model menu now also shows authorized models from the organizations a user has enrolled. Choosing DeepSeek V4 Flash or Pro from an older personal Qwen conversation first explains that Hara will create a separate enterprise conversation and waits for confirmation.
• The new conversation keeps the current working directory. Unsent text and attachments move to its draft but are not submitted automatically, while the old conversation and history keep their original route. Cross-connection handoff is refused while the current task is still running.
• A no-fixed-expiry device authorization issued by Hara Control is now preserved through the CLI and labelled No fixed expiry in Desktop. A legacy server that omitted expiry information remains labelled Expiry not provided, so the two states are not conflated. Only authorized public model identifiers enter the catalog; Keys and device credentials stay protected. Desktop 0.1.56 bundles the exact verified Hara CLI 0.139.1.

Upgrade:

npm i -g @nanhara/hara@0.139.1
# Desktop: Settings → App & updates → Check for updates → Download and restart

Real Office validation and safe delivery — Hara 0.139.0 / Desktop 0.1.55

• The Office workbench now starts at Not checked. It shows Verified only after the local Hara engine checks the bytes, declared signature, size, and SHA-256 of the exact current revision. Opening or switching an Artifact immediately invalidates the previous proof instead of reusing stale status.
• A separate Save safe copy action obtains a current validation report when needed, preserves the original PPTX, XLSX, or DOCX format, and never overwrites an existing file. Hara reopens the delivered file, matches its SHA-256, and only then displays a path-redacted export receipt.
• The boundary stays explicit: this is byte-identical Office-format validation and delivery, not Office editing or format conversion. Desktop 0.1.55 bundles the exact verified Hara CLI 0.139.0; existing conversations, projects, organization connections, schedules, Artifacts, and local files need no migration. Windows packages remain updater-signed but not Authenticode-signed, so SmartScreen can still show a reputation warning.

Upgrade:

npm i -g @nanhara/hara@0.139.0
# Desktop: Settings → App & updates → Check for updates → Download and restart

Safe next-turn model selection — Desktop 0.1.54

• The model and thinking controls remain available while a turn is running. A change made during an active turn is clearly marked Next turn: the current turn keeps its original route, while the next queued or new message uses the latest selected model and thinking level.
• Rapid changes are coalesced safely, and sending waits for the staged route to be accepted by the local Hara engine. If an organization policy, conversation history, or connection rejects the new route, Desktop keeps the message unsent and shows an actionable error instead of silently using the previous model.
• Desktop 0.1.54 continues to bundle Hara CLI 0.138.2. Existing conversations, projects, organization connections, schedules, and local files need no migration. Windows packages remain updater-signed but are not yet Authenticode-signed, so SmartScreen can still show a reputation warning.

Upgrade:

# Desktop: Settings → App & updates → Check for updates → Download and restart

Honest oversized-image handling — Hara 0.138.2 / Desktop 0.1.53

• Image routes now advertise and enforce the same 3.6 MB attachment limit. An oversized image is rejected before any selected model or vision helper is called, and Hara explicitly says that it was not silently sent to an OCR fallback. Compress or crop the image before attaching it again.
• Desktop preflights image size consistently for the picker, native file-system drop, and clipboard paste. The blocked attachment stays visible with an actionable message; pasted images are rejected before Base64 allocation or temporary-file persistence. Local byte-size metadata never crosses the authenticated Serve boundary.
• Qwen 3.7 Plus remains a native-vision route; this release does not change the selected model or add an OCR detour. Desktop 0.1.53 bundles Hara CLI 0.138.2, and existing conversations, projects, organization connections, schedules, and local files need no migration. Windows packages remain updater-signed but are not yet Authenticode-signed, so SmartScreen can still show a reputation warning.

Upgrade:

npm i -g @nanhara/hara@0.138.2
# Desktop: Settings → App & updates → Check for updates → Download and restart

Workspace route recovery and first-turn attachments — Hara 0.138.1 / Desktop 0.1.52

• Model settings now show the connection that actually applies to the active working directory instead of showing only the global default. If a project or parent directory is pinned to a stale organization gateway, Restore global default here removes that project override for future conversations; existing conversations remain pinned to their creation route.
• The Assistant home screen can now add images, files, or one folder before the first conversation. It also supports native file-system drops, pasted images, attachment-only turns, per-item removal, and exact draft recovery when the first send fails. The UI shows safe basenames; the local Hara engine remains responsible for content access, type and size checks, and model image-capability validation.
• Desktop 0.1.52 bundles and verifies Hara CLI 0.138.1. No settings, project, conversation, organization connection, or local-file migration is required. Windows packages carry Hara updater signatures but are not yet Authenticode-signed, so some PCs may still show a SmartScreen warning.

Upgrade:

npm i -g @nanhara/hara@0.138.1
# Desktop: Settings → App & updates → Check for updates → Download and restart

Clear local-gateway recovery and deliberate organization switching — Hara 0.138.0 / Desktop 0.1.51

• A closed loopback endpoint saved by an organization connection is now reported as an unavailable local Hara gateway, with reconnect or re-enrollment guidance. Hara keeps the safety rule that loopback targets bypass proxies, but no longer mislabels this failure as a missing PAC, SOCKS, or HTTP(S) proxy.
• Personal direct model connections remain the primary path. Adding or re-enrolling an organization now saves it without silently changing the active route; Add & switch remains an explicit choice. Existing personal settings and conversations are preserved.
• Desktop 0.1.51 bundles the verified Hara CLI 0.138.0. Every signed installer and updater archive was verified against the protected release and the first-party mainland mirror before the stable manifests were published. No settings, project, conversation, or credential migration is required.

Upgrade:

npm i -g @nanhara/hara@0.138.0
# Desktop: Settings → App & updates → Check for updates → Download and restart

Architecture-safe updater verification — Desktop 0.1.50

• Every final macOS, Windows, and Linux executable now runs a native, read-only release diagnostic and must report the exact first-party-CDN-then-GitHub updater order before publication. This verifies the runtime configuration users receive instead of searching linker-dependent raw binary bytes.
• The protected macOS signing lane clears architecture-specific generated output before each ARM and Intel build. Public updater archives and DMGs were then re-downloaded and verified for signatures, notarization, Gatekeeper acceptance, native/Rosetta execution, and updater endpoint order.
• Build-time PostCSS is updated for GHSA-r28c-9q8g-f849; the official-registry audit reports no remaining vulnerabilities. The bundled Hara CLI remains 0.137.0, with no migration for existing work or settings.
• Desktop 0.1.49 was an unpublished validation tag. It never became the stable release or China mirror.

Upgrade:

# Desktop: Settings → App & updates → Check for updates → Download and restart

Open-core workspaces and a context-owned extension dock — Desktop 0.1.48

• Chat, Projects, Tasks, Groups, and Office are now configurable open-core modules. People can hide and reorder work entries, while Settings stays fixed in the lower-left as the recovery path. Groups and Office are visible for new profiles.
• Office adds local-first presentation, spreadsheet, and document entry points. Imports are type-, size-, and integrity-checked through local Hara Serve; the UI does not imply high-fidelity editing until a reviewed capability provides it.
• The Projects preview becomes an owner-bound Extension Dock shared by Design, plugin panels, and Office Artifacts. Local panels require a real project session, must emit an exact loopback HTTP origin owned by their process, and are rechecked before and after launch.
• The capability directory separates Hara core, the active organization, a future signed market, and local packages. Organization switching changes its managed model route and native Desk together, while existing conversations remain pinned to their creation profile and credentials never enter the renderer. The market remains explicitly unavailable until signing, permission review, revocation, and isolated Panel v2 are real.

Upgrade:

# Desktop: Settings → App & updates → Check for updates → Download and restart

Actionable Windows organization-network diagnostics — Hara 0.137.0 / Desktop 0.1.47

• Hara CLI 0.137.0 recovers only Hara's own bounded network diagnostic from an error chain wrapped by the OpenAI or Anthropic SDK. Organization model failures therefore no longer collapse to a generic Connection error.
• Windows diagnostics distinguish an explicit proxy, a static WinINET system proxy, and the absence of a supported HTTP(S) route. PAC-only or SOCKS-only environments are directed to expose a local HTTP(S) proxy entry; an unreachable static proxy points to its listener, bypass list, and VPN. This release does not pretend to create a route that is actually unreachable—it makes that failure actionable.
• Only diagnostics created by Hara under strict length and character bounds may cross the SDK wrapper. Organization keys, proxy credentials, private gateway addresses, credential-bearing URLs, and arbitrary nested errors remain hidden.
• Hara Desktop 0.1.47 bundles and executes the exact verified Hara 0.137.0 engine. The enrollment protocol can also install a separately scoped Desk binding when a Control deployment explicitly enables it; existing Controls and model-only connections retain their previous behavior. No conversation, project, schedule, organization connection, Desk binding, or credential migration is required.

Upgrade:

npm i -g @nanhara/hara@0.137.0
# Desktop: Settings → App & updates → Check for updates → Download and restart

First-party signed Desktop updates — Desktop 0.1.46

• Hara Desktop 0.1.46 makes Hara's assets.nanhara.com signed updater channel primary, so normal in-app updates no longer require a working GitHub connection. GitHub remains secondary when the first-party manifest returns a non-success response.
• Mirrored updater payloads are the exact protected-release bytes and retain the same minisign signatures. Every immutable versioned object is downloaded back through the public CDN, compared byte-for-byte, and tested for range delivery before the stable updater manifest is published last.
• Desktop 0.1.45 users whose GitHub request already fails need one manual upgrade from the mainland download page. After installing 0.1.46, later updates use the first-party channel automatically.
• The bundled Hara CLI remains the verified 0.136.0; no conversation, project, schedule, organization connection, Desk binding, or credential migration is required.

Native multi-organization Desk — Hara 0.136.0 / Desktop 0.1.45

• Hara CLI 0.136.0 adds authenticated Serve reads for the local Desk binding inventory, one bounded organization-board snapshot, and one selected task dossier. Every remote read is pinned to the exact organization profile, and full task content crosses the local protocol only after the user opens it.
• Native Desk bearers now live in a private multi-profile store separate from the legacy MCP credential. Each binding is tied to the Hara Control enrollment identity, rotates an opaque cache revision when replaced, and is retired when the organization is removed or re-enrolled under the same profile ID.
• Hara Desktop 0.1.45 turns the optional Groups module into a native, read-only organization Desk. Sidebar selection changes only the browsing context; Use for new work is the explicit routing action, while existing conversations remain pinned to their original profile. There is no iframe, renderer-owned credential, background polling, or automatic board read.
• Desktop bundles the verified Hara 0.136.0 engine. macOS arm64/x64, Windows x64, and Linux x64 packages execute their packaged sidecar before publication; signed macOS assets additionally pass Developer ID, notarization, stapling, Gatekeeper, and public provenance checks.

Upgrade:

npm i -g @nanhara/hara@0.136.0
# Desktop: Settings → App & updates → Check for updates → Download and restart

One enterprise connection, visible Desktop updates — 0.134.6

• Hara CLI 0.134.6 — conversations persist the exact Personal or enterprise profile that owns them, including guardian, subagent, role, vision, heartbeat, and other auxiliary model work. Existing Hara Control connections refresh their authorized model catalog on heartbeat, and macOS cron installation now uses calendar-minute events instead of a coalescible 60-second timer.
• Hara Control 0.1.15 — one enrollment and device Token authorize the full allowed model catalog. Existing single-model credentials expand in place, so Flash/Pro switching does not require a new Key or connection. Production readiness and positive-spend probes pass for both models.
• Hara Desktop 0.1.38 — launch-time update guidance shows details, real download progress, 24-hour deferral, retryable errors, and an explicit safe restart after active tasks stop. It bundles Hara 0.134.6, shows the session-bound enterprise connection, refreshes Flash/Pro in the same connection, and replaces the duplicate automation entry with one guided task console and explicit management actions.

Upgrade:

npm i -g @nanhara/hara@0.134.6
hara cron install # once on macOS if scheduled tasks were already installed
# Desktop: follow the launch card, or Settings → App & updates

Scoped DeepSeek V4 enterprise models and Desktop closure — 0.134.1

• 0.134.1 — Hara Control enrollment now stores the server-authorized model catalog and thinking levels in the enterprise profile. CLI and Serve display and accept only the model allowed by that device credential. Managed DeepSeek V4 requests preserve the official thinking and reasoning_effort fields; the supported controls are off, high, and max, with legacy low / medium settings normalized safely to high.
• Hara Control 0.1.14 — the enrollment console offers only canonical deepseek-v4-flash and deepseek-v4-pro, with Flash as the default, and deployment runs a real positive-spend probe against both routes. One enrollment code and device credential authorize one model; issue two codes and add two named connections when a member needs to switch between Flash and Pro.
• Hara Desktop 0.1.37 — the model picker refreshes from the active session and enterprise connection, so a previous route cannot leave a stale model or thinking control behind. It also publishes the Settings-owned WeChat QR login lifecycle; closing the panel cleans up the login session instead of leaving an unusable orphan process.

Upgrade:

npm i -g @nanhara/hara@0.134.1
# Desktop: Settings → App & updates → Check for updates → Download and restart

Field-feedback closure · user-owned organization connections — 0.133.0

• 0.133.0 — existing documents are edited in place by default; a new approval-gated Python tool runs source through stdin without leaving helper files. web_fetch can render SPA shells in an approved isolated browser path, --proxy and --lang are explicit launch options, package installs can use an explicitly selected registry, and fast-uri is pinned to the security-fixed 3.1.4. The TUI keeps a stable input subscription so immediate follow-up keys are no longer lost on slow renders.
• 0.132.4 — Desktop and Serve can list, add, re-enroll, check, switch, and locally remove user-provided Hara Control connections. No enterprise endpoint is preconfigured; remote gateways require HTTPS, and one-time codes are never persisted. Chat gateway status and scoped web-proxy support are observable without returning credentials or message content.
• 0.131.1 / 0.131.0 — hara update verifies the installation that actually launched, project recovery from Home is bounded, /cd and --cwd can carry conversation context, explicit references to older chats use bounded session recall, and three empty memory/session searches stop further recall attempts for the turn.
• Ecosystem releases — Hara Desktop 0.1.34 contains CLI 0.133.0 and safely recovers windows saved outside the current display layout. Hara Control 0.1.13 adds administrator-issued enrollment policy, enforced 5-hour / 7-day / 30-day budgets and RPM/TPM, plus organization-scoped usage and quota charts.

Upgrade:

npm i -g @nanhara/hara@0.133.0
# current npm/standalone installs can also run:
hara update

Windows serve portability · ordered task state · durable artifacts — 0.130.1

• 0.130.1 — Windows no longer attempts POSIX fchmod on private Serve discovery handles, so the official standalone and Desktop sidecar can create serve.json and listen normally instead of exiting with EPERM. File type, identity, no-replace, atomic-write, and symlink/reparse-point checks remain active on Windows; macOS and Linux still fail closed when owner-mode tightening fails. A native Windows CI gate now starts the real .exe, authenticates, and shuts Serve down.
• 0.130.0 — typed event.task_state notifications now carry a server-stream identity and a positive, monotonically increasing sequence across sessions and resume. Desktop can reject duplicated or stale task, approval, checkpoint, and completion transitions without mixing execution state into conversation text. The protocol-v1 change is additive for older clients.
• 0.129.0 — authenticated Desktop clients can commit immutable Artifact revisions with baseRevisionId conflict protection and restore an older revision without rewriting history. Starting Hara interactively from Home now offers an explicit switch to a recent or registered project before providers and MCP start. Repeated protected-directory failures are grouped by root cause across file tools and stop with a focused recovery instruction. Private Git plugin failures are bounded and redacted; Feishu WebSocket gateways expose connection counters, rate-limited alarms, and a safe terminal failure for supervisor recovery.
• 0.128.0 — authenticated Serve clients can safely import, list, inspect, and verify immutable local presentation, spreadsheet, and document artifacts. Import is copy-on-write and rejects links, protected files, macro-enabled Office formats, type confusion, empty files, and files over 64 MiB. This foundation does not yet claim Office rendering, editing, or export fidelity.
• 0.127.0–0.127.2 — system prompt assembly is now deterministic and cache-stable, while conversation and task execution use separate typed protocol planes with expected-turn steering. Managed access expiry is enforced end to end, and cron monitors can deliver always, only on output, or only on error without suppressing failure-streak alarms.
• 0.126.1 — plugin packages are validated and atomically staged before activation. Ownership receipts, package-rooted MCP processes, and fail-closed update/removal checks prevent links, protected files, command collisions, and changed installations from crossing the plugin boundary.
• 0.126.0 — Desktop can list, test, and save cloud, OpenAI-compatible, Qwen OAuth, enterprise, Ollama, and LM Studio connections through authenticated Hara Serve RPC without reading credentials back into the UI. Local endpoints are loopback-only; cloud custom endpoints require HTTPS. Tools now default to side-effect-capable and serial unless they explicitly declare narrower traits, demand-load long-tail schemas, and keep oversized results behind bounded opaque continuation IDs. Human clarification/approval no longer consumes the active task deadline; cancellation still dismisses it immediately. Timed-out providers, tools, subagents, and compaction retain their session lease until the underlying operation physically settles. Desktop also receives authenticated server.shutdown, and WeCom uses a production-compatible bounded WebSocket transport.
• 0.125.3 — separate chat delivery from task execution: local controls queue safely, a raced steer becomes the next turn instead of there is no task to steer, and only /continue reopens paused work. A durable task-intake checkpoint records intent, constraints, acceptance checks, and steps before side effects. Configured MCP servers stay stopped at launch and connect only when the current task explicitly needs one.
• 0.125.1 / 0.125.0 — installed plugin commands are available to agent tool subprocesses without shadowing project/system executables. Hara can discover compatible Claude-style specialist roles, route plans by responsibility, and keep delegated fan-out read-only under the same approval boundary.
• 0.124.x — project-aware resume, resumable deadline checkpoints, bounded context and structured compaction, explicit auditable self-evolution, Windows private-state portability, hardened credential/session files, and reliable WeCom delivery/media processing.

Upgrade:

npm i -g @nanhara/hara@0.130.1
hara --version

TUI input hotfix · task/turn continuity · path hardening — 0.123.1

• 0.123.1 — supersede 0.123.0 and fix its default-TUI startup regression: after readline paused the terminal, the bracketed-paste proxy now resumes the wrapped stdin when Ink starts reading or enters raw mode, and pauses and detaches it during cleanup. A regression test starts from an explicitly paused stdin; real PTY verification covers ordinary editing, multiline paste without auto-submit, and clean Ctrl+C exit.
• 0.123.0 — persist active task state separately from the conversation transcript, with stable task and turn IDs, explicit running/paused/completed/blocked outcomes, /task inspection, and /task clear without deleting chat history. Resume continues an unfinished objective; Serve clients can steer the expected turn and use newTask: true only when they intentionally replace it. Terminal bracketed paste now survives split framing, short or large multiline content, paste-plus-Enter ordering, and incomplete frames without freezing or auto-submitting. A global --cwd <project> selects a workspace explicitly. Windows project containment now handles native separators; global config rejects symlink/hard-link aliases and writes atomically; organization role names cannot escape org-roles. npm, all four native assets, and the public amd64/arm64 GHCR image were installed or downloaded and executed after release.

Resume continuity · Home boundary · isolated release parity — 0.122.7

• 0.122.7 — resume the persisted task instead of rediscovering the workspace; when a session starts at the user's Home, reject directory inventory, recursive search, directory references, coding mutations, shell commands, and external agents while still permitting an explicitly named single file. Tab input now occupies one cursor cell without changing the submitted text. Local developers with a pre-0.122.1 npm link receive an exact relink/rehash instruction instead of weakening the guarded runtime entry with chmod. Docker builds now carry every package-build helper, with a generic ordering gate that prevents host-only success from hiding an incomplete isolated build context. 0.122.7 supersedes the partial 0.122.6 deployment; npm, all four native binaries, and both public GHCR architectures were downloaded and executed after release.

• 0.122.5 — stop Bun standalone and the Desktop sidecar from reading a working directory's .env, bunfig.toml preload, package.json, or tsconfig.json before Hara's permission boundary; compile x64 standalone binaries for the baseline CPU target and keep macOS Intel builds working when an optional native binding is unavailable. The public npm package, four native binaries, and dual-architecture GHCR image were all downloaded and executed after release.

• 0.122.4 — add a non-renewable 30-minute agent deadline, 64-round ceiling, long-run warnings, and repeated-failure circuit breaker; give cron per-job and whole-tick watchdogs, process-tree termination, visible running/timed_out state, durable alerts, and transactional leases; make Feishu/Telegram gateways single-instance and restart-deduplicated with fast durable ACKs, so message redelivery resends stored coding/file/TTS results instead of re-running side effects; also fix resume hangs, recursive scans from Home, current-minute and expired one-shot cron behavior, Windows Git Bash discovery, and portable HOME selection.

• 0.122.3 — prevent Bun standalone startup from failing when SharedArrayBuffer is unavailable, and add native Linux/macOS binary execution gates with a pinned Bun compiler.

Upgrade:

npm i -g @nanhara/hara@0.123.1
hara --version

Protected files · explicit repository trust · bounded processes — 0.122.2

• 0.122.2 — require Node.js 22.12+ while giving older runtimes a direct upgrade instruction · deny .env, credential stores, private keys, and private Hara state across file tools, search, context, indexes, checkpoints, review automation, and gateway delivery · scrub subprocess environments and redact output, with a macOS protected-read Seatbelt · treat privileged project config, permission grants, tracked profile pins, MCP, and external agents as explicit trust decisions · use verified descriptors and atomic/CAS writes for coding and project state · make semantic indexes content-addressed, Git history non-autorun, cancellation process-tree aware, cron bounded, and outbound attachment bytes immutable · publish npm, standalone binaries, and a tested dual-architecture GHCR image.

Structured runs · durable agent work · fail-closed gateway — 0.122.0

• 0.122.0 — make headless automation machine-safe with schema-validated, JSON-only output and honest non-zero failures, while --role now enforces persona, model, and tool policy · give agents stable registered project homes plus isolated session todos and a durable cross-session task pool · harden all ten chat gateways around verified private senders, tool-free bounded group flows, single-owner idempotent approvals, capped media/process queues, and layered rate limits · make coding reads, searches, writes, edits, patches, and undo reject devices and symlink races, preserve modes, and avoid overwriting concurrent replacements · make cancellation, read-only roles, live serve config, session persistence, compaction, and shutdown fail visibly and release their resources safely.

[object Object] · crash-safe coding and files · friendlier input — 0.121.0

• 0.121.0 — connect agents to the shared coordination desk with hara desk · make write_file atomic and multi-file patches preflighted and rollback-safe, with correct undo snapshots and consistent rejection of symlink/non-regular destinations · stream only requested slices of large files and centrally bound @file, plugin, MCP, and other tool output with clear truncation metadata · add shell-style composer history with draft restoration and bounded memory · lazy-load Unicode-width and coding-tool setup for a faster cold start · pin the Lark transport to a patched Axios release, leaving the production dependency audit clean.

[object Object] — one door for humans and agents — 0.120.0

• 0.120.0 — hara feedback "what happened" files a structured GitHub issue (env facts auto-collected, credentials aggressively redacted; --session opt-in, --dry-run preview; gh CLI with copy-paste fallback). Matching issue forms ship in the repo. Documented security stance: hara agents exchange structured data — never task instructions from untrusted parties. See Feedback.

TUI: visible update notices · CJK-correct wrapping — 0.119.2

• 0.119.2 — update notices now render inside the TUI (they used to print before ink mounted and vanish — TUI users never saw them and versions went stale) · input wrapping measures terminal cells, so mixed 中文+ASCII prompts no longer overflow and tear words at the terminal edge.

Field-feedback robustness — 0.119.1

• 0.119.1 — four fixes straight from user reports: tool calls missing required parameters are rejected with a precise error before execution (kills the "model drops write_file's path and retries forever" loop) · git can't silently hang for credentials anymore (GIT_TERMINAL_PROMPT=0, fails in seconds with a real auth error) · command timeouts now say what to do next · a stale-artifact rule: generated output older than its sources gets rebuilt before previewing (hara-design 0.3.6 adds the matching deterministic warning + preview idle auto-exit).

Project panels: the chat ↔ live-preview split — 0.119.0

• 0.119.0 — plugin panels become project-aware: a panel declares detect markers (.hara/design, remotion.config.ts, …) and project.panels returns the ones applicable to a project. In Hara Desktop, opening a design project puts a preview toggle right on the conversation — talk to the agent on the left, watch the live preview react on the right.

Session delete & fork · slash skills over serve — 0.118.0

• 0.118.0 — session.delete (permanent, lock-aware — archive stays the soft path) · session.fork (duplicate a conversation into a new session and diverge; rewind's non-destructive sibling) · slash skills over the wire (session.send with /skill-id request… triggers the CLI's skill flow — the desktop "/" popup rides on it).

Context watermark · compact · rewind · fuzzy file search — 0.117.0

• 0.117.0 — hara serve batch 3, the conversation-hygiene set:
  • Context watermark everywhere — every session.send result and event.turn_end carries ctx: { lastInput, window, pct }; session.context adds the spend breakdown on demand. Clients render a live context meter with zero extra round-trips.
  • session.compact — the CLI's /compact over the wire: summarize-and-replace with working notes kept and the touched-file restore (scoped to the session's own cwd).
  • session.rewind — fork the thread back to before the n-th-most-recent user turn. History only; file edits stay.
  • files.search — fuzzy project-file lookup (git-aware + the CLI's fuzzy ranker), powering @-mention autocomplete in the desktop composer.

The desktop-grade serve protocol — 0.116.0

• 0.116.0 — sessions record their creator (interactive/gateway/cron) and automated sessions get "name · time" titles (a cron prompt never becomes a title again). hara serve batch 2: models.list + session.set-model (per-session model/effort switch) · automation.list (cron timeline) · session.rename/session.archive · initialize advertises capabilities.methods · @file mentions in session.send. This is the protocol the Hara desktop app (Tauri) drives.

serve exposes plugins & skills — 0.115.0

• 0.115.0 — hara serve grows a plugin surface: plugins.list / plugins.set (enable/disable) / skills.list. Powers the hara desktop app's plugin manager panel; any WS client gets it for free.

Long files in slices · repeat-guard · [object Object] — 0.114.0

• 0.114.0 — three things:
  • Long files no longer flood the context. read_file returns cat-n numbered lines with offset/limit slicing (2000-line window, continue hints, long-line truncation) instead of dumping the whole file; paired prompt rules stop whole-file re-reads after edits. This is the "slow on long files" fix.
  • Repeat-guard. The exact same tool call failing twice in a row now gets an explicit "repeating this unchanged will fail again — change something or ask the user" note appended to its result; successes reset the streak, /reset clears it. The anti-spinning tripwire.
  • hara serve — a persistent local WebSocket JSON-RPC server (protocol v1): sessions (create/resume/list/send/interrupt, same ~/.hara/sessions store as the CLI), streamed text/reasoning/tool/diff/notice events, approval round-trips, token auth, and a ~/.hara/serve.json discovery file. The backbone the new hara desktop app (Tauri) drives.

DeepSeek reasoning control (thinking + effort, incl. [object Object]) · host-unreachable memory — 0.113.0

• 0.113.0 — DeepSeek reasoning is now a real dial. DeepSeek V4 (deepseek-v4-pro/deepseek-v4-flash) added a per-request thinking switch on the OpenAI-compatible chat path — thinking:{type} plus reasoning_effort (native high|max; low/medium map → high server-side). hara sends both via a new deepseek reasoning style: off → thinking:{type:"disabled"} (reasoning_effort has no "off"), any level → enabled + the effort. The /model picker's ←→ thinking dial now lights up for DeepSeek. Verified against the live API: off emits no reasoning, high/max stream it (max thinks measurably harder), and tool-calls work with reasoning on.
• New max reasoning level across reasoningEffort and the /model picker — the top of the dial. On DeepSeek it becomes reasoning_effort:"max"; on OpenAI reasoning models it clamps to high (OpenAI has no max, so it never 400s); on Anthropic it takes the largest thinking budget.
• Host-unreachable memory — stop re-hanging on a dead host. When a network command (git clone/pull/fetch, curl…) fails to CONNECT — a TCP connect timeout or DNS failure (macOS's ~75s SYN timeout), not an auth/404/connection-refused — hara remembers that host for the session and fast-fails later network ops to it instantly instead of eating another ~75s per retry. The failure output also flags that git ignores the macOS system / Clash proxy unless configured (git config --global http.proxy). Cleared by /reset, and paired with a system-prompt rule: reuse a local checkout before cloning, don't swap a public mirror in for a private repo, and verify connectivity yourself rather than trusting "the network is fine".

Single-writer session lock — 0.112.5

• 0.112.5 — a double-resume can no longer corrupt session history: a single-writer lock serializes session writes so two processes resuming the same session don't interleave and clobber the transcript.

Reasoning models don't false-timeout · fallback routing — 0.112.4

• 0.112.4 — a reasoning model (qwen3.7-plus/GLM/DeepSeek) thinking on a long context no longer false- times-out: every stream chunk (reasoning, tool-args, even suppressed reasoning) now resets the stall watchdog, and its default is 120s→240s (HARA_STALL_TIMEOUT). The bash default timeout is 120s→300s for long transforms. And cross-provider fallback now routes correctly: a fallbackModel from another vendor no longer gets posted to the primary endpoint (400) — set the new fallbackProvider (a mismatch is now refused with a warning instead of a silent 400).

Big writes no longer loop with empty params — 0.112.3

• 0.112.3 — fixed the loop where glm-5/qwen (DashScope) repeat write_file/bash with empty/undefined arguments. A large write ran past the max_tokens: 8192 output cap, its tool-call JSON was truncated, and hara silently turned the unparseable JSON into {} — so the tool ran with no args and the model looped. Now max_tokens is 32000 and truncated/malformed tool arguments surface as an actionable error ("write the file in smaller parts") instead of a silent {}.

Resize no longer garbles the UI — 0.112.2

• 0.112.2 — moving/resizing the terminal window no longer stacks the status row + input box into a repeated-lines garble. ink only clears on narrowing; on a widen it re-rendered without erasing the reflowed old frame, and the spinner tick stacked copies. hara now clears ink's tracked output on any resize so the next render is clean.

Live background-job indicator — 0.112.1

• 0.112.1 — the ⚙ N bg running indicator is now live even at idle. Before, it only refreshed during a turn, so a background task (preview server, watcher, render) still running after the agent finished looked like "nothing running" — reading as "it stopped". It's now event-driven: appears on start, updates as jobs finish, clears when the last ends. /jobs stays the on-demand detail view.

/jobs — see background work — 0.112.0

• 0.112.0 — /jobs gives you a view of the agent's background shell jobs (dev servers, watchers, long builds run via bash {background:true}): /jobs lists them (id · status · age · command), /jobs tail <id> shows output, /jobs kill <id> stops one. hara tracked these for the agent already; now the user can see them too, the way codex/Claude Code do. A ⚙ N bg indicator in the status row shows when something's humming in the background.

Interactive /model picker — 0.111.0

• 0.111.0 — /model (no arg) now opens an interactive picker built on the provider registry: it pulls the endpoint's live model list (GET /models — a coding-plan key exposes ~10), then ↑↓ picks a model and ←→ sets the thinking level (the levels come from the registry — off/on on DashScope/Ollama, the full dial on OpenAI/Anthropic). ⏎ applies (switch model + set dial + rebuild + persist), esc cancels. /model <id> still switches directly. TUI only.

Provider registry: one key, many platforms — 0.110.0

• 0.110.0 — hara now speaks each platform its own way, from a data-driven registry (a dictionary), not scattered code. A row per platform declares its wire protocol (chat / Anthropic / Responses), how it expresses the thinking dial, and how it caches — so a custom baseURL Just Works:
  • Any vendor's .../anthropic endpoint (DeepSeek, Kimi, Zhipu GLM, MiniMax, Alibaba /apps/anthropic) routes through the Anthropic wire → prompt caching + native thinking budget. Verified end-to-end.
  • Local Ollama / LM Studio — reasoning off sends think:false, actually stopping a local reasoning model's thinking (measured deepseek-r1:14b 17s → 0.6s).
  • DashScope chat — reasoning off → enable_thinking:false (qwen3.7-plus ~14s → ~1.6s), keyed on the endpoint not the model name. OpenAI keeps reasoning_effort; Anthropic its thinking budget. UNSET → untouched everywhere (zero impact).
  • The Responses API (Token Plan's newest models) isn't spoken yet — a Responses endpoint returns a clear pointer to the chat / /apps/anthropic endpoint instead of failing cryptically.
• Windows no longer hangs at startup / first command. Three synchronous probes (the where bash shell probe, git ls-files, the per-turn shadow git add -A) ran with no timeout, so a slow/hung one froze the whole process. All three are now bounded and fall back gracefully — the "stuck at shell/directory probing" hang is fixed.

Enter enters instantly + faster DashScope — 0.109.5

• 0.109.5 — two things:
  • Enter enters the conversation flow instantly. A turn's synchronous prep (reading an inlined @file, encoding pasted images) used to run before ink could paint, so a heavy message left the text stuck in the input box for seconds. The submit now yields a tick so the committed message + cleared input + spinner paint first — instant feedback no matter how heavy the turn or slow the first token.
  • On DashScope, reasoning off truly disables the thinking phase (enable_thinking: false) instead of just hiding it — that thinking pass is the main latency (measured: qwen3.7-plus ~14s → ~1.6s). Low/medium/high keep it on; leaving the dial unset changes nothing (model default — zero impact). Detected by the DashScope endpoint (built-in qwen/qwen-oauth or a custom dashscope.aliyuncs.com baseURL), not the model name. Set via HARA_REASONING_EFFORT=off or reasoningEffort in your config; a runtime /reasoning toggle is coming next.

Drop a file, don't get "Unknown command" — 0.109.4

• 0.109.4 — dragging/pasting a file into the prompt pastes an absolute path (/Users/…/spec.md); because it starts with /, hara used to answer Unknown command /Users/…. The command parser now only fires when the first token has no embedded slash (real commands never do), so a path is read as a file instead — and a message that begins with an existing path is auto-inlined as an @-mention so its content lands in the turn ("interpret this file" just works). TUI + readline both.

Empty response ≠ hang — 0.109.3

• 0.109.3 — a model turn that returns no text and no tool calls no longer vanishes silently (it used to end the turn with zero feedback, so the box looked frozen for hours after e.g. a "继续"). hara now retries once, then, if still empty, says so plainly instead of disappearing — and a tool_use stop with an empty tool list is bounded by the same guard instead of re-requesting in a loop. (The 120s stall-watchdog already handled a dead socket; this handles a request that succeeds but returns nothing.)

Long paste stays smooth — 0.109.2

• 0.109.2 — a long multi-line paste no longer freezes the input box. It used to render every wrapped row on each keystroke (hundreds of lines → ink chokes → the box looks stuck); it now draws a bottom-anchored viewport of ~14 rows with ⋯ N more lines above/below markers. Tip: to launch a skill from a long paste, prefix the command (e.g. /design <brief>) — that enters the mode directly instead of relying on the model to infer it.

Faster on long sessions — 0.109.1

• 0.109.1 — prompt caching is on: hara now marks Anthropic cache_control breakpoints on the static prefix (system + tools) and the message tail, so each turn re-reads the unchanged prefix from cache instead of re-billing and re-processing the whole prompt. As history grows this is the biggest latency + cost drop. Paired with dynamic compaction — auto-compact used to wait for 85% of the window (an unreachable 850k on a 1M model), so it never fired; it now also triggers at an absolute ~200k-token cap (tune with HARA_AUTO_COMPACT_TOKENS), keeping long sessions snappy.

Real multi-line paste — 0.109.0

• 0.109.0 — pasting multi-line text now inserts real, editable lines in the box (not a [Paste] token, not an instant send) — only a real Enter submits, matching codex's textarea behavior; a huge dump (>8000 chars) still folds to a token. Plus Windows: the shell no longer hard-fails — hara prefers a real bash (Git Bash / WSL) and falls back to cmd.exe with a notice.

Cron grows up — 0.108.0

• 0.108.0 — scheduling from chat ("every morning at 9…" → the cronjob tool handles it, with a recursion guard), a --command deterministic lane (plain shell, no agent, no tokens), result delivery to telegram/feishu/webhook with 🚨 alerts after 3 consecutive failures, and per-job timezones. Still daemon-free — the OS ticks it.

Interjection triage — 0.107.0

• 0.107.0 — typing while hara works now gets triaged, not blindly folded in: a refinement joins the current task immediately; a new independent task lands on the todo queue with a one-line acknowledgment; something urgent ("a bug!", "stop", "this first") finishes the current step safely, re-plans, and switches. The model is the scheduler; the todo list is the queue.

Gateway session hygiene — 0.106.0

• 0.106.0 — idle chats auto-rotate: a WeChat/Feishu chat idle past 8h starts fresh (one-time /resume <id> notice; the old thread persists), so days-old context stops polluting new asks. HARA_GATEWAY_IDLE_HOURS tunes; 0 disables.

Fan-outs synthesize before acting — 0.105.0

• 0.105.0 — when a round returns 3+ parallel agent reports, a silent system-reminder asks the model to merge them first (reconcile conflicts explicitly, note single-source findings, state the merged conclusion) — instead of anchoring on whichever report sits last in context.

Compaction keeps your working files — 0.104.0

• 0.104.0 — compaction now restores your working files: after summarizing, the top-5 most recently touched files re-attach with their CURRENT on-disk content (byte-capped) — no re-reads, no edits against a stale memory. The footer's ctx N% gains a threshold ladder (yellow ≥60%, red ≥80%; auto-compact at 85) and Anthropic input accounting now includes cache reads/writes (cached sessions used to under-report fullness so auto-compact could never fire). Also fixes the release pipeline — standalone binaries and the ghcr image ship again from this tag.

The project-analysis SOP — 0.103.0

• 0.103.0 — "analyzing a repo is slower than codex" was pedagogy, not plumbing: reads always ran in parallel and read-only sub-agents existed, but nothing taught the model. Now the system prompt carries the playbook (batch independent calls; one-batch manifest+README+CI sweep; >~3 searches → fan out sub-agents), the agent tool has WHEN-TO-USE / WHEN-NOT guidance, and a built-in explore persona (agent(role:"explore"), zero setup) searches in parallel and returns conclusions with path:line refs — never file dumps.

A slow network never feels dead — 0.101.1 → 0.102.0

• 0.102.0 — three fixes from real slow-network reports ("pressed Enter, looks stuck"): a stall watchdog aborts a model attempt that streams nothing for 120s (HARA_STALL_TIMEOUT) into the normal failover path; the status row shows "waiting for the model… Ns" before the first token (a live, ticking, interruptible signal); and big pastes fold into a [Paste #1 +N lines] token — no box flooding, no accidental submit at the first newline, full text expands on send.
• 0.101.1 — live-region overflow guard: a long streaming answer or big diff can no longer grow the live region past the terminal height (which broke ink's repaint and made the input box "run to the top"). Live blocks render a bounded tail window; the full text lands in scrollback on finalize.

Startup update check — 0.101.0

• 0.101.0 — hara now tells you when it's out of date: a one-line ⬆ Update available notice at launch, driven by a daily background probe that never delays startup (cache-first, 3s timeout, npmmirror fallback for CN networks). Disable with updateCheck false / HARA_UPDATE_CHECK=0.

The agent keeps its own attention — 0.100.0

• 0.100.0 — system-reminders + anti-drift compaction (distilled from a source-level study of Claude Code's agent internals). An event layer now lands silent system-reminder messages before the next model call — first wired event: todo attention-refresh (a checklist with unfinished items untouched for five tool-rounds gets re-shown to the model with a request for a status pass, so long tasks stop abandoning their own plan). And the compaction brief grew from six to eight sections, now preserving all your messages verbatim and the key technical concepts — your intent survives any squeeze.

Steady input box & the plan handshake — 0.99.1 → 0.99.3

• 0.99.3 — the input box stops moving. The bottom chrome is now constant-height: a permanent one-row status slot swaps spinner ⇄ key hints instead of appearing/disappearing (the old working block cost ±3 rows at every turn boundary — the "bobbing"), the shift+tab picker became a one-row mode line that swaps into the same slot, and the todo panel folds on your next submit instead of a 30-second timer. Plan mode grew a real handshake: the model itself calls a new exit_plan tool when its plan is ready — the plan renders as a bordered ╭─ Plan block, then the proceed picker appears; investigation turns end quietly. No more "proceed?" after every read-only turn. (Built from a source-level study of codex-rs and Claude Code.)
• 0.99.2 — the always-on two-row approval bar left the chrome: the current mode reads colored inline in the status footer, and shift+tab pops a transient picker. Streaming reasoning collapsed to a one-line header by default (ctrl+r expands) so finishing a thought no longer yanked the input box up.
• 0.99.1 — the session name rides the input box's top-right border (a titled panel, codex-style) instead of taking its own line.

Terminal UI redesign — 0.99.0

• 0.99.0 — a redesigned terminal UI. The header and input box are now rounded, dim-bordered cards (Codex-grade containment) instead of flat text framed by dash-rules. The header hugs its content, leads with a seal-red ◆ hara mark, and lays out profile/org, model, cwd, session as an aligned label grid (labels flush-left with the mark) with a green /model ↹ affordance on the model row; the vision sidecar still shows inline. The input box drops the two dash-rules for one rounded box, and session / usage / route / approval collapse into a single dim status footer below it (model · approval · route · cwd · ↑ ↓ · ctx). Same interactions — streaming, vim, transcript, reasoning, @-mentions, the deterministic wrap — just contained and legible, especially over slow/remote terminals.

Terminal UI polish — 0.98.1 → 0.98.4

• 0.98.4 — the header now shows the active vision sidecar inline (· vision <model>) whenever one is configured, so you can see it at a glance — plus a /model to change hint, ctrl+t transcript · ctrl+r reasoning in the footer, and ctx% shown from the start (no mid-session layout pop).
• 0.98.3 — hara resume: exiting a session with no turns no longer prints a misleading "saved · resume" hint. It was never saved (sessions persist per turn), so hara resume <id> would fail — now the hint only shows when the session was actually written.
• 0.98.2 — input box: real, deterministic line-wrapping (long input no longer misaligns against the prompt gutter), a steadier cursor, and far less redrawing per keystroke; the spinner + panels re-render only what changed. Calmer, especially over slow/remote connections.
• 0.98.1 — finalized transcript + reasoning now commit to scrollback once (ink <Static>) behind a throttled live region — so long or looping turns stop stacking duplicate "thinking…" lines and flickering over remote terminals.

Safety, setup & skills — 0.91 → 0.98

• 0.98 — guardian: an internal safety layer — a cheap-model veto on genuinely dangerous actions (destructive shell, writes outside your project) before they run, plus a circuit-breaker that halts a runaway. Conservative and fail-open, so normal work is untouched. HARA_GUARDIAN=0 to disable.
• 0.97 — ask_user: when the agent hits a fork only you can decide, it pauses and asks — a question with numbered choices (free-text always allowed) — instead of guessing. Works in the REPL and the TUI; stays non-blocking in headless runs.
• 0.96 — hara setup is now a provider picker: Anthropic / OpenAI / GLM / DeepSeek / Qwen / any OpenAI-compatible endpoint — with masked key entry and a one-shot connection check.
• 0.95 — /<skill> opens a skill directly (e.g. /design); hara resume / hara sessions pick up where you left off; Ctrl+T shows the full transcript.
• 0.94 — plugins can ship a command (their bin is linked into ~/.hara/bin); skills get their absolute directory injected so their assets resolve.

Chat everywhere — 0.80 → 0.90

The gateway grew from "Telegram text" into a full multi-channel surface.

• 0.90 — WeCom + Signal adapters — ten chat platforms total.
• 0.89 — four adapters in one release: Slack, Mattermost, Matrix, DingTalk (eight platforms).
• 0.87–0.88 — Discord, then Feishu/Lark adapters (native WebSocket; no public webhook needed).
• 0.86 — inbound images reach the model as real images (not breadcrumbs); Telegram/WeChat image parity.
• 0.85 — the send_file tool: hara sends files and images back conversationally. Plus a stuck-guard that nudges the agent if it repeats a tool too many times.
• 0.84 — receive files & photos from chat (downloaded and AES-decrypted from the WeChat CDN).
• 0.83 — voice replies with pluggable TTS (say / OpenAI-compatible / local command); /voice, /say.
• 0.80–0.82 — the chat gateway itself: Telegram first, then native WeChat (iLink), voice-in transcription, and /cd-roaming projects with a resumable thread per directory.

Resilience & context — 0.74 → 0.79

• 0.79 — app-level failover: retry an errored turn on a fallback model.
• 0.78 — file-state checkpoints (shadow-git snapshots outside your repo) + /checkpoint restore.
• 0.77 — /rewind forks the conversation back to an earlier turn, files untouched.
• 0.76 — /context shows exactly what's filling the window.
• 0.74 — auto-compaction summarizes before the context overflows.

Org, safety & memory — 0.55 → 0.73

• 0.73 — background shell jobs (bash {background:true}) + a job tool.
• 0.72 — per-turn model routing: a cheap model for trivial turns, the strong one for code.
• 0.71 — command-level permission rules + untrusted-content defanging against prompt injection.
• 0.70 — B-end device enrollment syncs an org-role bundle from a control plane.
• 0.61 — the hara memory CLI (show / init / distill) + two rounds of security hardening.
• 0.58 — hara cron scheduled tasks (no daemon; fires via launchd/crontab).
• 0.55–0.57 — multi-role review chains (hara org --review) and the in-session diff → review → commit loop.

Foundations — 0.52 → 0.69

• 0.69 — local semantic search (ANN retrieval, graceful brute-force fallback).
• 0.68 — multi-arch Docker image.
• 0.60–0.64 — single-binary builds, the hara setup wizard, shell completions, hara export.
• 0.59 — optional vim mode.
• 0.54 — hara mcp server mode (expose read/search tools to other MCP clients).
• 0.52 — type-ahead steering: mid-turn messages course-correct the live task.

This page is the home for release notes — every new hara version lands here.