Changelog

Versioning (pre-1.0): the minor number bumps for a new feature; the patch number for fixes and optimizations.

Real Office validation and safe delivery — Hara 0.139.0 / Desktop 0.1.55

• The Office workbench now starts at Not checked. It shows Verified only after the local Hara engine checks the bytes, declared signature, size, and SHA-256 of the exact current revision. Opening or switching an Artifact immediately invalidates the previous proof instead of reusing stale status.
• A separate Save safe copy action obtains a current validation report when needed, preserves the original PPTX, XLSX, or DOCX format, and never overwrites an existing file. Hara reopens the delivered file, matches its SHA-256, and only then displays a path-redacted export receipt.
• The boundary stays explicit: this is byte-identical Office-format validation and delivery, not Office editing or format conversion. Desktop 0.1.55 bundles the exact verified Hara CLI 0.139.0; existing conversations, projects, organization connections, schedules, Artifacts, and local files need no migration. Windows packages remain updater-signed but not Authenticode-signed, so SmartScreen can still show a reputation warning.

Upgrade:

npm i -g @nanhara/hara@0.139.0
# Desktop: Settings → App & updates → Check for updates → Download and restart

Safe next-turn model selection — Desktop 0.1.54

• The model and thinking controls remain available while a turn is running. A change made during an active turn is clearly marked Next turn: the current turn keeps its original route, while the next queued or new message uses the latest selected model and thinking level.
• Rapid changes are coalesced safely, and sending waits for the staged route to be accepted by the local Hara engine. If an organization policy, conversation history, or connection rejects the new route, Desktop keeps the message unsent and shows an actionable error instead of silently using the previous model.
• Desktop 0.1.54 continues to bundle Hara CLI 0.138.2. Existing conversations, projects, organization connections, schedules, and local files need no migration. Windows packages remain updater-signed but are not yet Authenticode-signed, so SmartScreen can still show a reputation warning.

Upgrade:

# Desktop: Settings → App & updates → Check for updates → Download and restart

Honest oversized-image handling — Hara 0.138.2 / Desktop 0.1.53

• Image routes now advertise and enforce the same 3.6 MB attachment limit. An oversized image is rejected before any selected model or vision helper is called, and Hara explicitly says that it was not silently sent to an OCR fallback. Compress or crop the image before attaching it again.
• Desktop preflights image size consistently for the picker, native file-system drop, and clipboard paste. The blocked attachment stays visible with an actionable message; pasted images are rejected before Base64 allocation or temporary-file persistence. Local byte-size metadata never crosses the authenticated Serve boundary.
• Qwen 3.7 Plus remains a native-vision route; this release does not change the selected model or add an OCR detour. Desktop 0.1.53 bundles Hara CLI 0.138.2, and existing conversations, projects, organization connections, schedules, and local files need no migration. Windows packages remain updater-signed but are not yet Authenticode-signed, so SmartScreen can still show a reputation warning.

Upgrade:

npm i -g @nanhara/hara@0.138.2
# Desktop: Settings → App & updates → Check for updates → Download and restart

Workspace route recovery and first-turn attachments — Hara 0.138.1 / Desktop 0.1.52

• Model settings now show the connection that actually applies to the active working directory instead of showing only the global default. If a project or parent directory is pinned to a stale organization gateway, Restore global default here removes that project override for future conversations; existing conversations remain pinned to their creation route.
• The Assistant home screen can now add images, files, or one folder before the first conversation. It also supports native file-system drops, pasted images, attachment-only turns, per-item removal, and exact draft recovery when the first send fails. The UI shows safe basenames; the local Hara engine remains responsible for content access, type and size checks, and model image-capability validation.
• Desktop 0.1.52 bundles and verifies Hara CLI 0.138.1. No settings, project, conversation, organization connection, or local-file migration is required. Windows packages carry Hara updater signatures but are not yet Authenticode-signed, so some PCs may still show a SmartScreen warning.

Upgrade:

npm i -g @nanhara/hara@0.138.1
# Desktop: Settings → App & updates → Check for updates → Download and restart

Clear local-gateway recovery and deliberate organization switching — Hara 0.138.0 / Desktop 0.1.51

• A closed loopback endpoint saved by an organization connection is now reported as an unavailable local Hara gateway, with reconnect or re-enrollment guidance. Hara keeps the safety rule that loopback targets bypass proxies, but no longer mislabels this failure as a missing PAC, SOCKS, or HTTP(S) proxy.
• Personal direct model connections remain the primary path. Adding or re-enrolling an organization now saves it without silently changing the active route; Add & switch remains an explicit choice. Existing personal settings and conversations are preserved.
• Desktop 0.1.51 bundles the verified Hara CLI 0.138.0. Every signed installer and updater archive was verified against the protected release and the first-party mainland mirror before the stable manifests were published. No settings, project, conversation, or credential migration is required.

Upgrade:

npm i -g @nanhara/hara@0.138.0
# Desktop: Settings → App & updates → Check for updates → Download and restart

Architecture-safe updater verification — Desktop 0.1.50

• Every final macOS, Windows, and Linux executable now runs a native, read-only release diagnostic and must report the exact first-party-CDN-then-GitHub updater order before publication. This verifies the runtime configuration users receive instead of searching linker-dependent raw binary bytes.
• The protected macOS signing lane clears architecture-specific generated output before each ARM and Intel build. Public updater archives and DMGs were then re-downloaded and verified for signatures, notarization, Gatekeeper acceptance, native/Rosetta execution, and updater endpoint order.
• Build-time PostCSS is updated for GHSA-r28c-9q8g-f849; the official-registry audit reports no remaining vulnerabilities. The bundled Hara CLI remains 0.137.0, with no migration for existing work or settings.
• Desktop 0.1.49 was an unpublished validation tag. It never became the stable release or China mirror.

Upgrade:

# Desktop: Settings → App & updates → Check for updates → Download and restart

Open-core workspaces and a context-owned extension dock — Desktop 0.1.48

• Chat, Projects, Tasks, Groups, and Office are now configurable open-core modules. People can hide and reorder work entries, while Settings stays fixed in the lower-left as the recovery path. Groups and Office are visible for new profiles.
• Office adds local-first presentation, spreadsheet, and document entry points. Imports are type-, size-, and integrity-checked through local Hara Serve; the UI does not imply high-fidelity editing until a reviewed capability provides it.
• The Projects preview becomes an owner-bound Extension Dock shared by Design, plugin panels, and Office Artifacts. Local panels require a real project session, must emit an exact loopback HTTP origin owned by their process, and are rechecked before and after launch.
• The capability directory separates Hara core, the active organization, a future signed market, and local packages. Organization switching changes its managed model route and native Desk together, while existing conversations remain pinned to their creation profile and credentials never enter the renderer. The market remains explicitly unavailable until signing, permission review, revocation, and isolated Panel v2 are real.

Upgrade:

# Desktop: Settings → App & updates → Check for updates → Download and restart

Actionable Windows organization-network diagnostics — Hara 0.137.0 / Desktop 0.1.47

• Hara CLI 0.137.0 recovers only Hara's own bounded network diagnostic from an error chain wrapped by the OpenAI or Anthropic SDK. Organization model failures therefore no longer collapse to a generic Connection error.
• Windows diagnostics distinguish an explicit proxy, a static WinINET system proxy, and the absence of a supported HTTP(S) route. PAC-only or SOCKS-only environments are directed to expose a local HTTP(S) proxy entry; an unreachable static proxy points to its listener, bypass list, and VPN. This release does not pretend to create a route that is actually unreachable—it makes that failure actionable.
• Only diagnostics created by Hara under strict length and character bounds may cross the SDK wrapper. Organization keys, proxy credentials, private gateway addresses, credential-bearing URLs, and arbitrary nested errors remain hidden.
• Hara Desktop 0.1.47 bundles and executes the exact verified Hara 0.137.0 engine. The enrollment protocol can also install a separately scoped Desk binding when a Control deployment explicitly enables it; existing Controls and model-only connections retain their previous behavior. No conversation, project, schedule, organization connection, Desk binding, or credential migration is required.

Upgrade:

npm i -g @nanhara/hara@0.137.0
# Desktop: Settings → App & updates → Check for updates → Download and restart

First-party signed Desktop updates — Desktop 0.1.46

• Hara Desktop 0.1.46 makes Hara's assets.nanhara.com signed updater channel primary, so normal in-app updates no longer require a working GitHub connection. GitHub remains secondary when the first-party manifest returns a non-success response.
• Mirrored updater payloads are the exact protected-release bytes and retain the same minisign signatures. Every immutable versioned object is downloaded back through the public CDN, compared byte-for-byte, and tested for range delivery before the stable updater manifest is published last.
• Desktop 0.1.45 users whose GitHub request already fails need one manual upgrade from the mainland download page. After installing 0.1.46, later updates use the first-party channel automatically.
• The bundled Hara CLI remains the verified 0.136.0; no conversation, project, schedule, organization connection, Desk binding, or credential migration is required.

Native multi-organization Desk — Hara 0.136.0 / Desktop 0.1.45

• Hara CLI 0.136.0 adds authenticated Serve reads for the local Desk binding inventory, one bounded organization-board snapshot, and one selected task dossier. Every remote read is pinned to the exact organization profile, and full task content crosses the local protocol only after the user opens it.
• Native Desk bearers now live in a private multi-profile store separate from the legacy MCP credential. Each binding is tied to the Hara Control enrollment identity, rotates an opaque cache revision when replaced, and is retired when the organization is removed or re-enrolled under the same profile ID.
• Hara Desktop 0.1.45 turns the optional Groups module into a native, read-only organization Desk. Sidebar selection changes only the browsing context; Use for new work is the explicit routing action, while existing conversations remain pinned to their original profile. There is no iframe, renderer-owned credential, background polling, or automatic board read.
• Desktop bundles the verified Hara 0.136.0 engine. macOS arm64/x64, Windows x64, and Linux x64 packages execute their packaged sidecar before publication; signed macOS assets additionally pass Developer ID, notarization, stapling, Gatekeeper, and public provenance checks.

Upgrade:

npm i -g @nanhara/hara@0.136.0
# Desktop: Settings → App & updates → Check for updates → Download and restart

One enterprise connection, visible Desktop updates — 0.134.6

• Hara CLI 0.134.6 — conversations persist the exact Personal or enterprise profile that owns them, including guardian, subagent, role, vision, heartbeat, and other auxiliary model work. Existing Hara Control connections refresh their authorized model catalog on heartbeat, and macOS cron installation now uses calendar-minute events instead of a coalescible 60-second timer.
• Hara Control 0.1.15 — one enrollment and device Token authorize the full allowed model catalog. Existing single-model credentials expand in place, so Flash/Pro switching does not require a new Key or connection. Production readiness and positive-spend probes pass for both models.
• Hara Desktop 0.1.38 — launch-time update guidance shows details, real download progress, 24-hour deferral, retryable errors, and an explicit safe restart after active tasks stop. It bundles Hara 0.134.6, shows the session-bound enterprise connection, refreshes Flash/Pro in the same connection, and replaces the duplicate automation entry with one guided task console and explicit management actions.

Upgrade:

npm i -g @nanhara/hara@0.134.6
hara cron install # once on macOS if scheduled tasks were already installed
# Desktop: follow the launch card, or Settings → App & updates

Scoped DeepSeek V4 enterprise models and Desktop closure — 0.134.1

• 0.134.1 — Hara Control enrollment now stores the server-authorized model catalog and thinking levels in the enterprise profile. CLI and Serve display and accept only the model allowed by that device credential. Managed DeepSeek V4 requests preserve the official thinking and reasoning_effort fields; the supported controls are off, high, and max, with legacy low / medium settings normalized safely to high.
• Hara Control 0.1.14 — the enrollment console offers only canonical deepseek-v4-flash and deepseek-v4-pro, with Flash as the default, and deployment runs a real positive-spend probe against both routes. One enrollment code and device credential authorize one model; issue two codes and add two named connections when a member needs to switch between Flash and Pro.
• Hara Desktop 0.1.37 — the model picker refreshes from the active session and enterprise connection, so a previous route cannot leave a stale model or thinking control behind. It also publishes the Settings-owned WeChat QR login lifecycle; closing the panel cleans up the login session instead of leaving an unusable orphan process.

Upgrade:

npm i -g @nanhara/hara@0.134.1
# Desktop: Settings → App & updates → Check for updates → Download and restart

Field-feedback closure · user-owned organization connections — 0.133.0

• 0.133.0 — existing documents are edited in place by default; a new approval-gated Python tool runs source through stdin without leaving helper files. web_fetch can render SPA shells in an approved isolated browser path, --proxy and --lang are explicit launch options, package installs can use an explicitly selected registry, and fast-uri is pinned to the security-fixed 3.1.4. The TUI keeps a stable input subscription so immediate follow-up keys are no longer lost on slow renders.
• 0.132.4 — Desktop and Serve can list, add, re-enroll, check, switch, and locally remove user-provided Hara Control connections. No enterprise endpoint is preconfigured; remote gateways require HTTPS, and one-time codes are never persisted. Chat gateway status and scoped web-proxy support are observable without returning credentials or message content.
• 0.131.1 / 0.131.0 — hara update verifies the installation that actually launched, project recovery from Home is bounded, /cd and --cwd can carry conversation context, explicit references to older chats use bounded session recall, and three empty memory/session searches stop further recall attempts for the turn.
• Ecosystem releases — Hara Desktop 0.1.34 contains CLI 0.133.0 and safely recovers windows saved outside the current display layout. Hara Control 0.1.13 adds administrator-issued enrollment policy, enforced 5-hour / 7-day / 30-day budgets and RPM/TPM, plus organization-scoped usage and quota charts.

Upgrade:

npm i -g @nanhara/hara@0.133.0
# current npm/standalone installs can also run:
hara update

Windows serve portability · ordered task state · durable artifacts — 0.130.1

• 0.130.1 — Windows no longer attempts POSIX fchmod on private Serve discovery handles, so the official standalone and Desktop sidecar can create serve.json and listen normally instead of exiting with EPERM. File type, identity, no-replace, atomic-write, and symlink/reparse-point checks remain active on Windows; macOS and Linux still fail closed when owner-mode tightening fails. A native Windows CI gate now starts the real .exe, authenticates, and shuts Serve down.
• 0.130.0 — typed event.task_state notifications now carry a server-stream identity and a positive, monotonically increasing sequence across sessions and resume. Desktop can reject duplicated or stale task, approval, checkpoint, and completion transitions without mixing execution state into conversation text. The protocol-v1 change is additive for older clients.
• 0.129.0 — authenticated Desktop clients can commit immutable Artifact revisions with baseRevisionId conflict protection and restore an older revision without rewriting history. Starting Hara interactively from Home now offers an explicit switch to a recent or registered project before providers and MCP start. Repeated protected-directory failures are grouped by root cause across file tools and stop with a focused recovery instruction. Private Git plugin failures are bounded and redacted; Feishu WebSocket gateways expose connection counters, rate-limited alarms, and a safe terminal failure for supervisor recovery.
• 0.128.0 — authenticated Serve clients can safely import, list, inspect, and verify immutable local presentation, spreadsheet, and document artifacts. Import is copy-on-write and rejects links, protected files, macro-enabled Office formats, type confusion, empty files, and files over 64 MiB. This foundation does not yet claim Office rendering, editing, or export fidelity.
• 0.127.0–0.127.2 — system prompt assembly is now deterministic and cache-stable, while conversation and task execution use separate typed protocol planes with expected-turn steering. Managed access expiry is enforced end to end, and cron monitors can deliver always, only on output, or only on error without suppressing failure-streak alarms.
• 0.126.1 — plugin packages are validated and atomically staged before activation. Ownership receipts, package-rooted MCP processes, and fail-closed update/removal checks prevent links, protected files, command collisions, and changed installations from crossing the plugin boundary.
• 0.126.0 — Desktop can list, test, and save cloud, OpenAI-compatible, Qwen OAuth, enterprise, Ollama, and LM Studio connections through authenticated Hara Serve RPC without reading credentials back into the UI. Local endpoints are loopback-only; cloud custom endpoints require HTTPS. Tools now default to side-effect-capable and serial unless they explicitly declare narrower traits, demand-load long-tail schemas, and keep oversized results behind bounded opaque continuation IDs. Human clarification/approval no longer consumes the active task deadline; cancellation still dismisses it immediately. Timed-out providers, tools, subagents, and compaction retain their session lease until the underlying operation physically settles. Desktop also receives authenticated server.shutdown, and WeCom uses a production-compatible bounded WebSocket transport.
• 0.125.3 — separate chat delivery from task execution: local controls queue safely, a raced steer becomes the next turn instead of there is no task to steer, and only /continue reopens paused work. A durable task-intake checkpoint records intent, constraints, acceptance checks, and steps before side effects. Configured MCP servers stay stopped at launch and connect only when the current task explicitly needs one.
• 0.125.1 / 0.125.0 — installed plugin commands are available to agent tool subprocesses without shadowing project/system executables. Hara can discover compatible Claude-style specialist roles, route plans by responsibility, and keep delegated fan-out read-only under the same approval boundary.
• 0.124.x — project-aware resume, resumable deadline checkpoints, bounded context and structured compaction, explicit auditable self-evolution, Windows private-state portability, hardened credential/session files, and reliable WeCom delivery/media processing.

Upgrade:

npm i -g @nanhara/hara@0.130.1
hara --version

TUI input hotfix · task/turn continuity · path hardening — 0.123.1

• 0.123.1 — supersede 0.123.0 and fix its default-TUI startup regression: after readline paused the terminal, the bracketed-paste proxy now resumes the wrapped stdin when Ink starts reading or enters raw mode, and pauses and detaches it during cleanup. A regression test starts from an explicitly paused stdin; real PTY verification covers ordinary editing, multiline paste without auto-submit, and clean Ctrl+C exit.
• 0.123.0 — persist active task state separately from the conversation transcript, with stable task and turn IDs, explicit running/paused/completed/blocked outcomes, /task inspection, and /task clear without deleting chat history. Resume continues an unfinished objective; Serve clients can steer the expected turn and use newTask: true only when they intentionally replace it. Terminal bracketed paste now survives split framing, short or large multiline content, paste-plus-Enter ordering, and incomplete frames without freezing or auto-submitting. A global --cwd <project> selects a workspace explicitly. Windows project containment now handles native separators; global config rejects symlink/hard-link aliases and writes atomically; organization role names cannot escape org-roles. npm, all four native assets, and the public amd64/arm64 GHCR image were installed or downloaded and executed after release.

Resume continuity · Home boundary · isolated release parity — 0.122.7

• 0.122.7 — resume the persisted task instead of rediscovering the workspace; when a session starts at the user's Home, reject directory inventory, recursive search, directory references, coding mutations, shell commands, and external agents while still permitting an explicitly named single file. Tab input now occupies one cursor cell without changing the submitted text. Local developers with a pre-0.122.1 npm link receive an exact relink/rehash instruction instead of weakening the guarded runtime entry with chmod. Docker builds now carry every package-build helper, with a generic ordering gate that prevents host-only success from hiding an incomplete isolated build context. 0.122.7 supersedes the partial 0.122.6 deployment; npm, all four native binaries, and both public GHCR architectures were downloaded and executed after release.

• 0.122.5 — stop Bun standalone and the Desktop sidecar from reading a working directory's .env, bunfig.toml preload, package.json, or tsconfig.json before Hara's permission boundary; compile x64 standalone binaries for the baseline CPU target and keep macOS Intel builds working when an optional native binding is unavailable. The public npm package, four native binaries, and dual-architecture GHCR image were all downloaded and executed after release.

• 0.122.4 — add a non-renewable 30-minute agent deadline, 64-round ceiling, long-run warnings, and repeated-failure circuit breaker; give cron per-job and whole-tick watchdogs, process-tree termination, visible running/timed_out state, durable alerts, and transactional leases; make Feishu/Telegram gateways single-instance and restart-deduplicated with fast durable ACKs, so message redelivery resends stored coding/file/TTS results instead of re-running side effects; also fix resume hangs, recursive scans from Home, current-minute and expired one-shot cron behavior, Windows Git Bash discovery, and portable HOME selection.

• 0.122.3 — prevent Bun standalone startup from failing when SharedArrayBuffer is unavailable, and add native Linux/macOS binary execution gates with a pinned Bun compiler.

Upgrade:

npm i -g @nanhara/hara@0.123.1
hara --version

Protected files · explicit repository trust · bounded processes — 0.122.2

• 0.122.2 — require Node.js 22.12+ while giving older runtimes a direct upgrade instruction · deny .env, credential stores, private keys, and private Hara state across file tools, search, context, indexes, checkpoints, review automation, and gateway delivery · scrub subprocess environments and redact output, with a macOS protected-read Seatbelt · treat privileged project config, permission grants, tracked profile pins, MCP, and external agents as explicit trust decisions · use verified descriptors and atomic/CAS writes for coding and project state · make semantic indexes content-addressed, Git history non-autorun, cancellation process-tree aware, cron bounded, and outbound attachment bytes immutable · publish npm, standalone binaries, and a tested dual-architecture GHCR image.

Structured runs · durable agent work · fail-closed gateway — 0.122.0

• 0.122.0 — make headless automation machine-safe with schema-validated, JSON-only output and honest non-zero failures, while --role now enforces persona, model, and tool policy · give agents stable registered project homes plus isolated session todos and a durable cross-session task pool · harden all ten chat gateways around verified private senders, tool-free bounded group flows, single-owner idempotent approvals, capped media/process queues, and layered rate limits · make coding reads, searches, writes, edits, patches, and undo reject devices and symlink races, preserve modes, and avoid overwriting concurrent replacements · make cancellation, read-only roles, live serve config, session persistence, compaction, and shutdown fail visibly and release their resources safely.

[object Object] · crash-safe coding and files · friendlier input — 0.121.0

• 0.121.0 — connect agents to the shared coordination desk with hara desk · make write_file atomic and multi-file patches preflighted and rollback-safe, with correct undo snapshots and consistent rejection of symlink/non-regular destinations · stream only requested slices of large files and centrally bound @file, plugin, MCP, and other tool output with clear truncation metadata · add shell-style composer history with draft restoration and bounded memory · lazy-load Unicode-width and coding-tool setup for a faster cold start · pin the Lark transport to a patched Axios release, leaving the production dependency audit clean.

[object Object] — one door for humans and agents — 0.120.0

• 0.120.0 — hara feedback "what happened" files a structured GitHub issue (env facts auto-collected, credentials aggressively redacted; --session opt-in, --dry-run preview; gh CLI with copy-paste fallback). Matching issue forms ship in the repo. Documented security stance: hara agents exchange structured data — never task instructions from untrusted parties. See Feedback.

TUI: visible update notices · CJK-correct wrapping — 0.119.2

• 0.119.2 — update notices now render inside the TUI (they used to print before ink mounted and vanish — TUI users never saw them and versions went stale) · input wrapping measures terminal cells, so mixed 中文+ASCII prompts no longer overflow and tear words at the terminal edge.

Field-feedback robustness — 0.119.1

• 0.119.1 — four fixes straight from user reports: tool calls missing required parameters are rejected with a precise error before execution (kills the "model drops write_file's path and retries forever" loop) · git can't silently hang for credentials anymore (GIT_TERMINAL_PROMPT=0, fails in seconds with a real auth error) · command timeouts now say what to do next · a stale-artifact rule: generated output older than its sources gets rebuilt before previewing (hara-design 0.3.6 adds the matching deterministic warning + preview idle auto-exit).

Project panels: the chat ↔ live-preview split — 0.119.0

• 0.119.0 — plugin panels become project-aware: a panel declares detect markers (.hara/design, remotion.config.ts, …) and project.panels returns the ones applicable to a project. In Hara Desktop, opening a design project puts a preview toggle right on the conversation — talk to the agent on the left, watch the live preview react on the right.

Session delete & fork · slash skills over serve — 0.118.0

• 0.118.0 — session.delete (permanent, lock-aware — archive stays the soft path) · session.fork (duplicate a conversation into a new session and diverge; rewind's non-destructive sibling) · slash skills over the wire (session.send with /skill-id request… triggers the CLI's skill flow — the desktop "/" popup rides on it).

Context watermark · compact · rewind · fuzzy file search — 0.117.0

• 0.117.0 — hara serve batch 3, the conversation-hygiene set:
  • Context watermark everywhere — every session.send result and event.turn_end carries ctx: { lastInput, window, pct }; session.context adds the spend breakdown on demand. Clients render a live context meter with zero extra round-trips.
  • session.compact — the CLI's /compact over the wire: summarize-and-replace with working notes kept and the touched-file restore (scoped to the session's own cwd).
  • session.rewind — fork the thread back to before the n-th-most-recent user turn. History only; file edits stay.
  • files.search — fuzzy project-file lookup (git-aware + the CLI's fuzzy ranker), powering @-mention autocomplete in the desktop composer.

The desktop-grade serve protocol — 0.116.0

• 0.116.0 — sessions record their creator (interactive/gateway/cron) and automated sessions get "name · time" titles (a cron prompt never becomes a title again). hara serve batch 2: models.list + session.set-model (per-session model/effort switch) · automation.list (cron timeline) · session.rename/session.archive · initialize advertises capabilities.methods · @file mentions in session.send. This is the protocol the Hara desktop app (Tauri) drives.

serve exposes plugins & skills — 0.115.0

• 0.115.0 — hara serve grows a plugin surface: plugins.list / plugins.set (enable/disable) / skills.list. Powers the hara desktop app's plugin manager panel; any WS client gets it for free.

Long files in slices · repeat-guard · [object Object] — 0.114.0

• 0.114.0 — three things:
  • Long files no longer flood the context. read_file returns cat-n numbered lines with offset/limit slicing (2000-line window, continue hints, long-line truncation) instead of dumping the whole file; paired prompt rules stop whole-file re-reads after edits. This is the "slow on long files" fix.
  • Repeat-guard. The exact same tool call failing twice in a row now gets an explicit "repeating this unchanged will fail again — change something or ask the user" note appended to its result; successes reset the streak, /reset clears it. The anti-spinning tripwire.
  • hara serve — a persistent local WebSocket JSON-RPC server (protocol v1): sessions (create/resume/list/send/interrupt, same ~/.hara/sessions store as the CLI), streamed text/reasoning/tool/diff/notice events, approval round-trips, token auth, and a ~/.hara/serve.json discovery file. The backbone the new hara desktop app (Tauri) drives.

DeepSeek reasoning control (thinking + effort, incl. [object Object]) · host-unreachable memory — 0.113.0

• 0.113.0 — DeepSeek reasoning is now a real dial. DeepSeek V4 (deepseek-v4-pro/deepseek-v4-flash) added a per-request thinking switch on the OpenAI-compatible chat path — thinking:{type} plus reasoning_effort (native high|max; low/medium map → high server-side). hara sends both via a new deepseek reasoning style: off → thinking:{type:"disabled"} (reasoning_effort has no "off"), any level → enabled + the effort. The /model picker's ←→ thinking dial now lights up for DeepSeek. Verified against the live API: off emits no reasoning, high/max stream it (max thinks measurably harder), and tool-calls work with reasoning on.
• New max reasoning level across reasoningEffort and the /model picker — the top of the dial. On DeepSeek it becomes reasoning_effort:"max"; on OpenAI reasoning models it clamps to high (OpenAI has no max, so it never 400s); on Anthropic it takes the largest thinking budget.
• Host-unreachable memory — stop re-hanging on a dead host. When a network command (git clone/pull/fetch, curl…) fails to CONNECT — a TCP connect timeout or DNS failure (macOS's ~75s SYN timeout), not an auth/404/connection-refused — hara remembers that host for the session and fast-fails later network ops to it instantly instead of eating another ~75s per retry. The failure output also flags that git ignores the macOS system / Clash proxy unless configured (git config --global http.proxy). Cleared by /reset, and paired with a system-prompt rule: reuse a local checkout before cloning, don't swap a public mirror in for a private repo, and verify connectivity yourself rather than trusting "the network is fine".

Single-writer session lock — 0.112.5

• 0.112.5 — a double-resume can no longer corrupt session history: a single-writer lock serializes session writes so two processes resuming the same session don't interleave and clobber the transcript.

Reasoning models don't false-timeout · fallback routing — 0.112.4

• 0.112.4 — a reasoning model (qwen3.7-plus/GLM/DeepSeek) thinking on a long context no longer false- times-out: every stream chunk (reasoning, tool-args, even suppressed reasoning) now resets the stall watchdog, and its default is 120s→240s (HARA_STALL_TIMEOUT). The bash default timeout is 120s→300s for long transforms. And cross-provider fallback now routes correctly: a fallbackModel from another vendor no longer gets posted to the primary endpoint (400) — set the new fallbackProvider (a mismatch is now refused with a warning instead of a silent 400).

Big writes no longer loop with empty params — 0.112.3

• 0.112.3 — fixed the loop where glm-5/qwen (DashScope) repeat write_file/bash with empty/undefined arguments. A large write ran past the max_tokens: 8192 output cap, its tool-call JSON was truncated, and hara silently turned the unparseable JSON into {} — so the tool ran with no args and the model looped. Now max_tokens is 32000 and truncated/malformed tool arguments surface as an actionable error ("write the file in smaller parts") instead of a silent {}.

Resize no longer garbles the UI — 0.112.2

• 0.112.2 — moving/resizing the terminal window no longer stacks the status row + input box into a repeated-lines garble. ink only clears on narrowing; on a widen it re-rendered without erasing the reflowed old frame, and the spinner tick stacked copies. hara now clears ink's tracked output on any resize so the next render is clean.

Live background-job indicator — 0.112.1

• 0.112.1 — the ⚙ N bg running indicator is now live even at idle. Before, it only refreshed during a turn, so a background task (preview server, watcher, render) still running after the agent finished looked like "nothing running" — reading as "it stopped". It's now event-driven: appears on start, updates as jobs finish, clears when the last ends. /jobs stays the on-demand detail view.

/jobs — see background work — 0.112.0

• 0.112.0 — /jobs gives you a view of the agent's background shell jobs (dev servers, watchers, long builds run via bash {background:true}): /jobs lists them (id · status · age · command), /jobs tail <id> shows output, /jobs kill <id> stops one. hara tracked these for the agent already; now the user can see them too, the way codex/Claude Code do. A ⚙ N bg indicator in the status row shows when something's humming in the background.

Interactive /model picker — 0.111.0

• 0.111.0 — /model (no arg) now opens an interactive picker built on the provider registry: it pulls the endpoint's live model list (GET /models — a coding-plan key exposes ~10), then ↑↓ picks a model and ←→ sets the thinking level (the levels come from the registry — off/on on DashScope/Ollama, the full dial on OpenAI/Anthropic). ⏎ applies (switch model + set dial + rebuild + persist), esc cancels. /model <id> still switches directly. TUI only.

Provider registry: one key, many platforms — 0.110.0

• 0.110.0 — hara now speaks each platform its own way, from a data-driven registry (a dictionary), not scattered code. A row per platform declares its wire protocol (chat / Anthropic / Responses), how it expresses the thinking dial, and how it caches — so a custom baseURL Just Works:
  • Any vendor's .../anthropic endpoint (DeepSeek, Kimi, Zhipu GLM, MiniMax, Alibaba /apps/anthropic) routes through the Anthropic wire → prompt caching + native thinking budget. Verified end-to-end.
  • Local Ollama / LM Studio — reasoning off sends think:false, actually stopping a local reasoning model's thinking (measured deepseek-r1:14b 17s → 0.6s).
  • DashScope chat — reasoning off → enable_thinking:false (qwen3.7-plus ~14s → ~1.6s), keyed on the endpoint not the model name. OpenAI keeps reasoning_effort; Anthropic its thinking budget. UNSET → untouched everywhere (zero impact).
  • The Responses API (Token Plan's newest models) isn't spoken yet — a Responses endpoint returns a clear pointer to the chat / /apps/anthropic endpoint instead of failing cryptically.
• Windows no longer hangs at startup / first command. Three synchronous probes (the where bash shell probe, git ls-files, the per-turn shadow git add -A) ran with no timeout, so a slow/hung one froze the whole process. All three are now bounded and fall back gracefully — the "stuck at shell/directory probing" hang is fixed.

Enter enters instantly + faster DashScope — 0.109.5

• 0.109.5 — two things:
  • Enter enters the conversation flow instantly. A turn's synchronous prep (reading an inlined @file, encoding pasted images) used to run before ink could paint, so a heavy message left the text stuck in the input box for seconds. The submit now yields a tick so the committed message + cleared input + spinner paint first — instant feedback no matter how heavy the turn or slow the first token.
  • On DashScope, reasoning off truly disables the thinking phase (enable_thinking: false) instead of just hiding it — that thinking pass is the main latency (measured: qwen3.7-plus ~14s → ~1.6s). Low/medium/high keep it on; leaving the dial unset changes nothing (model default — zero impact). Detected by the DashScope endpoint (built-in qwen/qwen-oauth or a custom dashscope.aliyuncs.com baseURL), not the model name. Set via HARA_REASONING_EFFORT=off or reasoningEffort in your config; a runtime /reasoning toggle is coming next.

Drop a file, don't get "Unknown command" — 0.109.4

• 0.109.4 — dragging/pasting a file into the prompt pastes an absolute path (/Users/…/spec.md); because it starts with /, hara used to answer Unknown command /Users/…. The command parser now only fires when the first token has no embedded slash (real commands never do), so a path is read as a file instead — and a message that begins with an existing path is auto-inlined as an @-mention so its content lands in the turn ("interpret this file" just works). TUI + readline both.

Empty response ≠ hang — 0.109.3

• 0.109.3 — a model turn that returns no text and no tool calls no longer vanishes silently (it used to end the turn with zero feedback, so the box looked frozen for hours after e.g. a "继续"). hara now retries once, then, if still empty, says so plainly instead of disappearing — and a tool_use stop with an empty tool list is bounded by the same guard instead of re-requesting in a loop. (The 120s stall-watchdog already handled a dead socket; this handles a request that succeeds but returns nothing.)

Long paste stays smooth — 0.109.2

• 0.109.2 — a long multi-line paste no longer freezes the input box. It used to render every wrapped row on each keystroke (hundreds of lines → ink chokes → the box looks stuck); it now draws a bottom-anchored viewport of ~14 rows with ⋯ N more lines above/below markers. Tip: to launch a skill from a long paste, prefix the command (e.g. /design <brief>) — that enters the mode directly instead of relying on the model to infer it.

Faster on long sessions — 0.109.1

• 0.109.1 — prompt caching is on: hara now marks Anthropic cache_control breakpoints on the static prefix (system + tools) and the message tail, so each turn re-reads the unchanged prefix from cache instead of re-billing and re-processing the whole prompt. As history grows this is the biggest latency + cost drop. Paired with dynamic compaction — auto-compact used to wait for 85% of the window (an unreachable 850k on a 1M model), so it never fired; it now also triggers at an absolute ~200k-token cap (tune with HARA_AUTO_COMPACT_TOKENS), keeping long sessions snappy.

Real multi-line paste — 0.109.0

• 0.109.0 — pasting multi-line text now inserts real, editable lines in the box (not a [Paste] token, not an instant send) — only a real Enter submits, matching codex's textarea behavior; a huge dump (>8000 chars) still folds to a token. Plus Windows: the shell no longer hard-fails — hara prefers a real bash (Git Bash / WSL) and falls back to cmd.exe with a notice.

Cron grows up — 0.108.0

• 0.108.0 — scheduling from chat ("every morning at 9…" → the cronjob tool handles it, with a recursion guard), a --command deterministic lane (plain shell, no agent, no tokens), result delivery to telegram/feishu/webhook with 🚨 alerts after 3 consecutive failures, and per-job timezones. Still daemon-free — the OS ticks it.

Interjection triage — 0.107.0

• 0.107.0 — typing while hara works now gets triaged, not blindly folded in: a refinement joins the current task immediately; a new independent task lands on the todo queue with a one-line acknowledgment; something urgent ("a bug!", "stop", "this first") finishes the current step safely, re-plans, and switches. The model is the scheduler; the todo list is the queue.

Gateway session hygiene — 0.106.0

• 0.106.0 — idle chats auto-rotate: a WeChat/Feishu chat idle past 8h starts fresh (one-time /resume <id> notice; the old thread persists), so days-old context stops polluting new asks. HARA_GATEWAY_IDLE_HOURS tunes; 0 disables.

Fan-outs synthesize before acting — 0.105.0

• 0.105.0 — when a round returns 3+ parallel agent reports, a silent system-reminder asks the model to merge them first (reconcile conflicts explicitly, note single-source findings, state the merged conclusion) — instead of anchoring on whichever report sits last in context.

Compaction keeps your working files — 0.104.0

• 0.104.0 — compaction now restores your working files: after summarizing, the top-5 most recently touched files re-attach with their CURRENT on-disk content (byte-capped) — no re-reads, no edits against a stale memory. The footer's ctx N% gains a threshold ladder (yellow ≥60%, red ≥80%; auto-compact at 85) and Anthropic input accounting now includes cache reads/writes (cached sessions used to under-report fullness so auto-compact could never fire). Also fixes the release pipeline — standalone binaries and the ghcr image ship again from this tag.

The project-analysis SOP — 0.103.0

• 0.103.0 — "analyzing a repo is slower than codex" was pedagogy, not plumbing: reads always ran in parallel and read-only sub-agents existed, but nothing taught the model. Now the system prompt carries the playbook (batch independent calls; one-batch manifest+README+CI sweep; >~3 searches → fan out sub-agents), the agent tool has WHEN-TO-USE / WHEN-NOT guidance, and a built-in explore persona (agent(role:"explore"), zero setup) searches in parallel and returns conclusions with path:line refs — never file dumps.

A slow network never feels dead — 0.101.1 → 0.102.0

• 0.102.0 — three fixes from real slow-network reports ("pressed Enter, looks stuck"): a stall watchdog aborts a model attempt that streams nothing for 120s (HARA_STALL_TIMEOUT) into the normal failover path; the status row shows "waiting for the model… Ns" before the first token (a live, ticking, interruptible signal); and big pastes fold into a [Paste #1 +N lines] token — no box flooding, no accidental submit at the first newline, full text expands on send.
• 0.101.1 — live-region overflow guard: a long streaming answer or big diff can no longer grow the live region past the terminal height (which broke ink's repaint and made the input box "run to the top"). Live blocks render a bounded tail window; the full text lands in scrollback on finalize.

Startup update check — 0.101.0

• 0.101.0 — hara now tells you when it's out of date: a one-line ⬆ Update available notice at launch, driven by a daily background probe that never delays startup (cache-first, 3s timeout, npmmirror fallback for CN networks). Disable with updateCheck false / HARA_UPDATE_CHECK=0.

The agent keeps its own attention — 0.100.0

• 0.100.0 — system-reminders + anti-drift compaction (distilled from a source-level study of Claude Code's agent internals). An event layer now lands silent system-reminder messages before the next model call — first wired event: todo attention-refresh (a checklist with unfinished items untouched for five tool-rounds gets re-shown to the model with a request for a status pass, so long tasks stop abandoning their own plan). And the compaction brief grew from six to eight sections, now preserving all your messages verbatim and the key technical concepts — your intent survives any squeeze.

Steady input box & the plan handshake — 0.99.1 → 0.99.3

• 0.99.3 — the input box stops moving. The bottom chrome is now constant-height: a permanent one-row status slot swaps spinner ⇄ key hints instead of appearing/disappearing (the old working block cost ±3 rows at every turn boundary — the "bobbing"), the shift+tab picker became a one-row mode line that swaps into the same slot, and the todo panel folds on your next submit instead of a 30-second timer. Plan mode grew a real handshake: the model itself calls a new exit_plan tool when its plan is ready — the plan renders as a bordered ╭─ Plan block, then the proceed picker appears; investigation turns end quietly. No more "proceed?" after every read-only turn. (Built from a source-level study of codex-rs and Claude Code.)
• 0.99.2 — the always-on two-row approval bar left the chrome: the current mode reads colored inline in the status footer, and shift+tab pops a transient picker. Streaming reasoning collapsed to a one-line header by default (ctrl+r expands) so finishing a thought no longer yanked the input box up.
• 0.99.1 — the session name rides the input box's top-right border (a titled panel, codex-style) instead of taking its own line.

Terminal UI redesign — 0.99.0

• 0.99.0 — a redesigned terminal UI. The header and input box are now rounded, dim-bordered cards (Codex-grade containment) instead of flat text framed by dash-rules. The header hugs its content, leads with a seal-red ◆ hara mark, and lays out profile/org, model, cwd, session as an aligned label grid (labels flush-left with the mark) with a green /model ↹ affordance on the model row; the vision sidecar still shows inline. The input box drops the two dash-rules for one rounded box, and session / usage / route / approval collapse into a single dim status footer below it (model · approval · route · cwd · ↑ ↓ · ctx). Same interactions — streaming, vim, transcript, reasoning, @-mentions, the deterministic wrap — just contained and legible, especially over slow/remote terminals.

Terminal UI polish — 0.98.1 → 0.98.4

• 0.98.4 — the header now shows the active vision sidecar inline (· vision <model>) whenever one is configured, so you can see it at a glance — plus a /model to change hint, ctrl+t transcript · ctrl+r reasoning in the footer, and ctx% shown from the start (no mid-session layout pop).
• 0.98.3 — hara resume: exiting a session with no turns no longer prints a misleading "saved · resume" hint. It was never saved (sessions persist per turn), so hara resume <id> would fail — now the hint only shows when the session was actually written.
• 0.98.2 — input box: real, deterministic line-wrapping (long input no longer misaligns against the prompt gutter), a steadier cursor, and far less redrawing per keystroke; the spinner + panels re-render only what changed. Calmer, especially over slow/remote connections.
• 0.98.1 — finalized transcript + reasoning now commit to scrollback once (ink <Static>) behind a throttled live region — so long or looping turns stop stacking duplicate "thinking…" lines and flickering over remote terminals.

Safety, setup & skills — 0.91 → 0.98

• 0.98 — guardian: an internal safety layer — a cheap-model veto on genuinely dangerous actions (destructive shell, writes outside your project) before they run, plus a circuit-breaker that halts a runaway. Conservative and fail-open, so normal work is untouched. HARA_GUARDIAN=0 to disable.
• 0.97 — ask_user: when the agent hits a fork only you can decide, it pauses and asks — a question with numbered choices (free-text always allowed) — instead of guessing. Works in the REPL and the TUI; stays non-blocking in headless runs.
• 0.96 — hara setup is now a provider picker: Anthropic / OpenAI / GLM / DeepSeek / Qwen / any OpenAI-compatible endpoint — with masked key entry and a one-shot connection check.
• 0.95 — /<skill> opens a skill directly (e.g. /design); hara resume / hara sessions pick up where you left off; Ctrl+T shows the full transcript.
• 0.94 — plugins can ship a command (their bin is linked into ~/.hara/bin); skills get their absolute directory injected so their assets resolve.

Chat everywhere — 0.80 → 0.90

The gateway grew from "Telegram text" into a full multi-channel surface.

• 0.90 — WeCom + Signal adapters — ten chat platforms total.
• 0.89 — four adapters in one release: Slack, Mattermost, Matrix, DingTalk (eight platforms).
• 0.87–0.88 — Discord, then Feishu/Lark adapters (native WebSocket; no public webhook needed).
• 0.86 — inbound images reach the model as real images (not breadcrumbs); Telegram/WeChat image parity.
• 0.85 — the send_file tool: hara sends files and images back conversationally. Plus a stuck-guard that nudges the agent if it repeats a tool too many times.
• 0.84 — receive files & photos from chat (downloaded and AES-decrypted from the WeChat CDN).
• 0.83 — voice replies with pluggable TTS (say / OpenAI-compatible / local command); /voice, /say.
• 0.80–0.82 — the chat gateway itself: Telegram first, then native WeChat (iLink), voice-in transcription, and /cd-roaming projects with a resumable thread per directory.

Resilience & context — 0.74 → 0.79

• 0.79 — app-level failover: retry an errored turn on a fallback model.
• 0.78 — file-state checkpoints (shadow-git snapshots outside your repo) + /checkpoint restore.
• 0.77 — /rewind forks the conversation back to an earlier turn, files untouched.
• 0.76 — /context shows exactly what's filling the window.
• 0.74 — auto-compaction summarizes before the context overflows.

Org, safety & memory — 0.55 → 0.73

• 0.73 — background shell jobs (bash {background:true}) + a job tool.
• 0.72 — per-turn model routing: a cheap model for trivial turns, the strong one for code.
• 0.71 — command-level permission rules + untrusted-content defanging against prompt injection.
• 0.70 — B-end device enrollment syncs an org-role bundle from a control plane.
• 0.61 — the hara memory CLI (show / init / distill) + two rounds of security hardening.
• 0.58 — hara cron scheduled tasks (no daemon; fires via launchd/crontab).
• 0.55–0.57 — multi-role review chains (hara org --review) and the in-session diff → review → commit loop.

Foundations — 0.52 → 0.69

• 0.69 — local semantic search (ANN retrieval, graceful brute-force fallback).
• 0.68 — multi-arch Docker image.
• 0.60–0.64 — single-binary builds, the hara setup wizard, shell completions, hara export.
• 0.59 — optional vim mode.
• 0.54 — hara mcp server mode (expose read/search tools to other MCP clients).
• 0.52 — type-ahead steering: mid-turn messages course-correct the live task.

This page is the home for release notes — every new hara version lands here.