agentlas 0.4.0 → 0.5.5

package/README.md

@@ -1,7 +1,29 @@
 # agentlas
 
-**The Agentlas agent terminal.** Chat with your installed AI agents and teams
-from the terminal — Claude Code style. Standalone: no desktop app required.
+```
+  █████╗  ██████╗ ███████╗███╗   ██╗████████╗██╗      █████╗ ███████╗
+ ██╔══██╗██╔════╝ ██╔════╝████╗  ██║╚══██╔══╝██║     ██╔══██╗██╔════╝
+ ███████║██║  ███╗█████╗  ██╔██╗ ██║   ██║   ██║     ███████║███████╗
+ ██╔══██║██║   ██║██╔══╝  ██║╚██╗██║   ██║   ██║     ██╔══██║╚════██║
+ ██║  ██║╚██████╔╝███████╗██║ ╚████║   ██║   ███████╗██║  ██║███████║
+ ╚═╝  ╚═╝ ╚═════╝ ╚══════╝╚═╝  ╚═══╝   ╚═╝   ╚══════╝╚═╝  ╚═╝╚══════╝
+```
+
+**The operating system for agents — in your terminal.** Chat with your AI
+agents and teams, build new ones, and run the full Agentlas OS surface
+(`build` · `search` · `install` · `storm` · `network` · …) from one command.
+Claude Code style, standalone: **no desktop app required.**
+
+Agentlas Terminal is the already-shipped independent terminal product. It is
+not a Desktop `cli/` mirror and does not require the Desktop app to run.
+
+> **We are Agent Trust. Your agent is not a program. It is an asset. — Agentlas —**
+
+Agent Trust means owner-scoped, portable, inspectable, and restorable agent
+packages. It is a product principle, not a claim of regulated financial or
+legal trust services. Private Agent Cloud stores owned packages; this existing
+Terminal verifies and runs their local execution copies through supported
+runtimes.
 
 ```sh
 npm install -g agentlas
@@ -40,31 +62,97 @@ Windows(미검증): `powershell -ExecutionPolicy Bypass -File install.ps1`
 ## 사용
 
 ```sh
-agentlas                           # 대화형 TUI (온보딩 → 에이전트 피커 → 스트리밍 REPL)
-agentlas list                      # 설치된 에이전트/회사 + 활성 런타임
-agentlas <agent>                   # 해당 에이전트와 대화형 세션
-agentlas run <agent> "프롬프트"     # 1회 실행 (prompt 없으면 stdin)
-agentlas firm <firm> "프롬프트"     # 회사(팀) 실행
-agentlas cd <agent>                # 에이전트 폴더 경로 → cd "$(agentlas cd seo)" && claude
+agentlas                           # 대화형 TUI (워드마크 → 할 일 입력 → 스트리밍 REPL)
+agentlas "할 일"                    # 자동 라우팅 후 1회 실행
+```
+
+**대화 & 실행**
+```sh
+agentlas <agent>                   # 해당 에이전트와 대화 (예: agentlas seo)
+agentlas run [agent] "프롬프트"      # 1회 실행 (agent 생략 시 자동 라우팅, prompt 없으면 stdin)
+agentlas firm <firm> "프롬프트"     # 회사(팀) CEO에 위임
+agentlas chats [n]                 # 최근 대화 목록
+```
+
+**에이전트 & 허브** (Agentlas OS 표면)
+```sh
+agentlas search "할 일"            # Hub에서 에이전트 발견            (hep-search)
+agentlas install <slug>            # 공개 Hub 에이전트 설치           (hep-cloud)
+agentlas build "요청"              # 에이전트/팀 빌드·수리·패키징     (hep-build)
+agentlas upload <경로>             # 내 Agent Cloud에 비공개 저장    (hep-upload)
+agentlas upload <경로> --visibility marketplace
+                                  # 호환 flag: Agentlas Hub 공개 발행
+agentlas connect                   # Telegram/플랫폼 연결             (hep-connect)
 agentlas import <폴더>             # 로컬 에이전트/팀 임포트
-agentlas storm "목표"               # Stormbreaker 파이프라인 (라우팅→검증→실행) [--research]
-agentlas swarm "목표"               # emergent 에이전트 스웜 (병렬+블랙보드+종합) [--parallel N]
+agentlas list                      # 설치된 에이전트/회사 + 활성 런타임
+```
+
+**내 Agent Cloud 자산**
+```sh
+agentlas cloud save <경로>         # 소유자 전용 비공개 저장(공개 심사/라우팅 카드 없음)
+agentlas cloud publish <경로>      # Agentlas Hub에 명시적으로 공개 발행
+agentlas cloud list                # 로그인한 소유자의 비공개 패키지 조회
+agentlas cloud restore <slug>      # 전체 hash 검증 후 이 컴퓨터에 exact snapshot 복원
+```
+
+비공개 저장도 업로드 전 로컬에서 비밀값, 안전하지 않은 경로, 파일별 hash와
+전체 package hash를 검사한다. 공개 Hub 발행에만 라우팅 카드와 공개 검토가 붙는다.
+
+`agentlas cloud install <slug>`은 기존 호환 명령이며 공개 Hub 설치다. 비공개
+Agent Cloud 소유자 복원은 반드시 `agentlas cloud restore <slug>`를 사용한다.
+
+**실행 엔진**
+```sh
+agentlas storm "목표"              # 견고 파이프라인 라우팅→검증→실행 (Stormbreaker) [--research]
+agentlas swarm "목표"              # emergent 에이전트 스웜 [--parallel N]
+agentlas network "요청"            # A2A 태스크포스로 분해            (hep-network)
+agentlas call "a,b" "컨텍스트"      # 지정 에이전트 호출               (hep-call)
+agentlas browser                   # 실제 브라우저 하드포인트          (hep-browser)
+agentlas route "요청"              # 라우팅 미리보기 (실행 없음)
+```
+
+**지식 & 리서치**
+```sh
+agentlas research <sub>            # Research Engine (status|gather|search|read|plan)
+agentlas ontology <sub>            # 프로젝트 지식 (status|list|add)
+agentlas journal <sub>             # Stormbreaker 저널 (status|verify|repair|gate)
+```
+
+**계정 & 운영**
+```sh
 agentlas login | logout | whoami   # Agentlas Cloud 로그인 (브라우저 플로우)
-agentlas automation list|add|on|off|remove|runs   # 자동화 등록/관리
-agentlas automation run <id>       # 자동화 지금 1회 실행
-agentlas automation daemon         # 상주 실행기 — 앱 없이 예약 자동화 실행 (앱과 리스 공유)
-agentlas cloud search "찾는 일"     # 마켓플레이스 검색 (로그인 불필요)
-agentlas cloud install <slug>      # 마켓플레이스에서 에이전트 설치
-agentlas usage                     # 로컬 사용 현황 (실행/메시지/자동화)
-agentlas telegram                  # 텔레그램 바인딩 현황 (읽기 전용)
-agentlas creds / env               # 자격증명 · env
+agentlas automation <sub>          # list|add|on|off|remove|run <id>|runs|daemon (로컬 스케줄러)
+agentlas creds <sub> · env         # 자격증명 볼트 · env
 agentlas multimodal                # 이미지/영상/음성 provider
+agentlas usage · telegram · mcp    # 사용 현황 · 텔레그램 · MCP 서버
 agentlas doctor                    # 런타임/데이터 점검
-agentlas setup                     # 온보딩(언어→런타임→권한) 다시 실행
-agentlas update                    # Desktop 최신 릴리스 확인/설치
+agentlas update                    # npm 최신판 확인
+agentlas setup                     # 온보딩 다시 실행
+```
+
+**고급**
+```sh
+agentlas hep <sub…>                # 전체 Hephaestus 패스스루 (wizard·security·cards·ao·plugins…)
+agentlas netadmin <sub>            # 로컬 네트워크 관리 (init|status|reindex|bench)
+agentlas cloud <sub>               # 자산 저장·공개·복원 (save|publish|package|list|restore|…)
 ```
 
 공통 옵션: `--runtime claude-code|codex|gemini` · `--permission read|write|full`
+REPL 안에서는 `/`로 명령 팔레트 (`/build` `/search` `/storm` `/network` …).
+
+권한은 이름과 실제 런타임 실행 범위를 일치시킨다.
+
+| Agentlas 권한 | Claude Code | Codex | Gemini CLI |
+| --- | --- | --- | --- |
+| `read` | `plan` | `read-only` sandbox | `plan` |
+| `write` | `acceptEdits` | `workspace-write` sandbox | `auto_edit` |
+| `full` | permission 검사 우회 | approval + sandbox 우회 | `yolo` |
+
+`write`는 무제한 권한의 다른 이름이 아니다. 외부 상태를 바꿀 수 있는 MCP/Playwright
+도구는 `full` 턴에서만 주입한다. 입력창에서 `Shift-Tab`으로 권한을 순환할 수 있지만,
+`write → full`은 5초 안에 두 번 연속 눌러야 하며 이 변경은 현재 세션에만 적용된다.
+실행 중 `Ctrl-T`는 Claude Todo/Task, Codex `todo_list`, Gemini `write_todos`가 실제로
+보낸 체크리스트만 열고 접는다. 일반 Bash/Read 실행을 계획 항목처럼 꾸며내지 않는다.
 
 ## 동작 방식
 
@@ -102,6 +190,7 @@ rm ~/.local/bin/agentlas             # install.sh 설치 시
 
 ## License
 
-Apache-2.0 — engine sources are vendored from the public
-[agentlas-ai/agentlas-desktop](https://github.com/agentlas-ai/agentlas-desktop) repo
-(see `engine/ENGINE_META.json` for the exact version/commit).
+Apache-2.0 — Agentlas Terminal is the independent terminal runtime for the
+[Agentlas OS](https://github.com/agentlas-ai/Agentlas-OS) package contract. Its
+`engine/` directory is maintained and released from this repository; it is not
+a generated mirror of Agentlas Desktop.

package/bin/agentlas.cjs

@@ -51,14 +51,41 @@ function dbPath() {
 // require.resolve가 아니라 실제 로드로 판별한다 — ABI가 깨진 better-sqlite3나
 // node:sqlite가 아직 없는/플래그가 필요한 Node(≤22.4 등)를 정확히 걸러낸다.
 function probeSqliteDriver() {
-  try { require("better-sqlite3"); return "better-sqlite3"; } catch { /* absent or ABI-broken */ }
   try {
-    const { DatabaseSync } = require("node:sqlite");
-    if (DatabaseSync) return "node:sqlite";
+    const Database = require("better-sqlite3");
+    // Loading the JS wrapper alone does not prove that its native binding matches
+    // this Node ABI. Exercise the constructor before reporting it to --where.
+    const db = new Database(":memory:");
+    db.close();
+    return "better-sqlite3";
+  } catch { /* absent or ABI-broken */ }
+  try {
+    const { DatabaseSync } = loadNodeSqliteQuietly();
+    if (DatabaseSync) {
+      const db = new DatabaseSync(":memory:");
+      db.close();
+      return "node:sqlite";
+    }
   } catch { /* not available without a flag on this Node */ }
   return null;
 }
 
+function loadNodeSqliteQuietly() {
+  const originalEmitWarning = process.emitWarning;
+  process.emitWarning = function agentlasSqliteWarningFilter(warning, ...args) {
+    const message = typeof warning === "string" ? warning : String((warning && warning.message) || warning || "");
+    const type = typeof args[0] === "string" ? args[0] : "";
+    if (type === "ExperimentalWarning" && /SQLite/i.test(message)) return;
+    if (/SQLite is an experimental feature/i.test(message)) return;
+    return originalEmitWarning.call(process, warning, ...args);
+  };
+  try {
+    return require("node:sqlite");
+  } finally {
+    process.emitWarning = originalEmitWarning;
+  }
+}
+
 function openSqlite(p) {
   try {
     const Database = require("better-sqlite3");
@@ -69,7 +96,7 @@ function openSqlite(p) {
   if (major < 22) {
     throw new Error(`Node ${process.version} — better-sqlite3가 없으면 Node 22+ (node:sqlite)가 필요합니다.`);
   }
-  const { DatabaseSync } = require("node:sqlite");
+  const { DatabaseSync } = loadNodeSqliteQuietly();
   const db = new DatabaseSync(p);
   return { exec: (sql) => db.exec(sql), close: () => db.close(), driver: "node:sqlite" };
 }
@@ -86,16 +113,34 @@ function bootstrapDbIfMissing() {
   }
   fs.mkdirSync(path.dirname(p), { recursive: true });
   const sql = fs.readFileSync(schemaFile, "utf8");
-  const db = openSqlite(p);
+  // DB를 정식 경로에서 직접 만들면 두 첫 실행이 모두 exists=false를 본 뒤 한 프로세스의
+  // 실패 cleanup이 다른 프로세스의 정상 DB까지 지울 수 있다. 각자 같은 볼륨의 임시 DB를
+  // 완성하고 hard-link(EEXIST=다른 프로세스 승리)로만 정식 이름을 원자 획득한다.
+  const temp = `${p}.bootstrap-${process.pid}-${Date.now()}-${Math.random().toString(16).slice(2)}.tmp`;
+  const db = openSqlite(temp);
   try {
     db.exec(sql);
   } catch (e) {
     db.close();
-    try { fs.rmSync(p); } catch { /* leave partial for inspection */ }
+    try { fs.rmSync(temp, { force: true }); } catch { /* leave temp for inspection */ }
     throw new Error(`DB 부트스트랩 실패: ${e.message}`);
   }
   db.close();
-  return { created: true, path: p };
+  let created = false;
+  try {
+    fs.linkSync(temp, p);
+    created = true;
+  } catch (e) {
+    if (!e || e.code !== "EEXIST") {
+      throw new Error(`DB 원자 부트스트랩 전환 실패: ${e && e.message ? e.message : e}`);
+    }
+  } finally {
+    try { fs.rmSync(temp, { force: true }); } catch { /* noop */ }
+    try { fs.rmSync(temp + "-journal", { force: true }); } catch { /* noop */ }
+    try { fs.rmSync(temp + "-wal", { force: true }); } catch { /* noop */ }
+    try { fs.rmSync(temp + "-shm", { force: true }); } catch { /* noop */ }
+  }
+  return { created, path: p };
 }
 
 function main() {
@@ -173,4 +218,6 @@ function main() {
   });
 }
 
-main();
+if (require.main === module) main();
+
+module.exports = { bootstrapDbIfMissing, dbPath, userDataDir, probeSqliteDriver };

package/engine/agentlas-api-agent.cjs

@@ -300,7 +300,7 @@ async function runOpenAILoop(req) {
 // ── Ollama (openai 스타일 tools, /api/chat) ──────────────
 async function runOllamaLoop(req) {
   const { ctx, ui } = req;
-  const host = process.env.OLLAMA_HOST || "http://127.0.0.1:11434";
+  const host = (req.ctx.env && req.ctx.env.OLLAMA_HOST) || process.env.OLLAMA_HOST || "http://127.0.0.1:11434";
   const messages = req.messages.slice();
   if (!messages.length || messages[0].role !== "system") messages.unshift({ role: "system", content: req.system });
   const toolDefs = tools.openaiTools(ctx.permission);

package/engine/agentlas-banner.cjs

@@ -1,17 +1,33 @@
 "use strict";
 /*
- * Agentlas terminal splash — small dinosaur mascot (Chrome-dino style) + wordmark + status.
+ * Agentlas terminal splash — AGENTLAS wordmark banner + status card.
  */
 const path = require("node:path");
 const os = require("node:os");
+const permissions = require("./agentlas-permissions.cjs");
+const { truncateWidth, visWidth } = require("./agentlas-composer.cjs");
 
-// Small T-Rex (side view, facing right) — eye is ●.
-const DINO_ART = [
-  "          ▟████▙",
-  "          █●  ▜█▙",
-  "   ▖      ████████",
-  "   ▜█▄▄▄▄▄███",
-  "    ▀▀▀█▌ █▌",
+// AGENTLAS wordmark (block letters). Rendered with a brand gradient across columns.
+const WORDMARK = [
+  "  █████╗  ██████╗ ███████╗███╗   ██╗████████╗██╗      █████╗ ███████╗",
+  " ██╔══██╗██╔════╝ ██╔════╝████╗  ██║╚══██╔══╝██║     ██╔══██╗██╔════╝",
+  " ███████║██║  ███╗█████╗  ██╔██╗ ██║   ██║   ██║     ███████║███████╗",
+  " ██╔══██║██║   ██║██╔══╝  ██║╚██╗██║   ██║   ██║     ██╔══██║╚════██║",
+  " ██║  ██║╚██████╔╝███████╗██║ ╚████║   ██║   ███████╗██║  ██║███████║",
+  " ╚═╝  ╚═╝ ╚═════╝ ╚══════╝╚═╝  ╚═══╝   ╚═╝   ╚══════╝╚═╝  ╚═╝╚══════╝",
+];
+
+// Compact single-line wordmark for narrow terminals.
+const WORDMARK_COMPACT = "▞▖ AGENTLAS";
+
+// Brand gradient (emerald → green → lime → blue) applied left-to-right across the wordmark.
+const GRADIENT = [
+  [110, 231, 183],
+  [52, 211, 153],
+  [16, 185, 129],
+  [45, 212, 191],
+  [56, 189, 248],
+  [147, 197, 253],
 ];
 
 function readVersion() {
@@ -28,17 +44,12 @@ function shorten(p) {
   return p.startsWith(home) ? "~" + p.slice(home.length) : p;
 }
 
-// Just the mascot lines (used by the onboarding wizard header).
+// AGENTLAS wordmark, per-column brand gradient. Falls back to plain / compact.
 function renderMascot(ui) {
   const c = ui.c;
-  if (!ui.enabled) {
-    ui.line("  Agentlas");
-    return;
-  }
-  for (let i = 0; i < DINO_ART.length; i++) {
-    const row = DINO_ART[i];
-    ui.line("   " + (i === 1 ? c.text(row).split("●").join(c.emerald("●")) : c.text(row)));
-  }
+  // A one-line mark keeps first launch and setup compact. The old six-row wordmark
+  // remains exported for recordings/assets, but is no longer startup chrome.
+  ui.line("  " + c.bold(c.emerald(WORDMARK_COMPACT)));
 }
 
 function stripAnsi(s) {
@@ -59,50 +70,54 @@ function row(ui, width, text) {
   ui.line(ui.c.faint("│ ") + ui.c.text(fit(text, inner)) + ui.c.faint(" │"));
 }
 
+function sessionValues(ctx) {
+  const ui = ctx.ui;
+  return {
+    version: ctx.version || readVersion(),
+    subject: ctx.subjectLabel || ui.t("composer.autoroute"),
+    permission: permissions.copy(ctx.permission || "write", ui.lang).label,
+    runtime: ctx.runtimeLabel || "—",
+    cwd: ctx.cwd ? shorten(ctx.cwd) : process.cwd(),
+  };
+}
+
 function renderStatusCard(ctx, opts = {}) {
   const ui = ctx.ui;
   const c = ui.c;
-  const cols = ui.out.columns || 80;
-  const width = Math.max(54, Math.min(cols - 2, 78));
-  const version = ctx.version || readVersion();
-  const subject = ctx.subjectLabel || "Pick an agent, choose a company, or type a task";
-  const permission = ctx.permission || "write";
-  const runtime = ctx.runtimeLabel || "(not configured)";
-  const cwd = ctx.cwd ? shorten(ctx.cwd) : process.cwd();
-
+  const value = sessionValues(ctx);
+  const columns = ui.out.columns || 80;
+  const labels = [ui.t("status.runtime"), ui.t("status.agent"), ui.t("status.permission"), ui.t("status.directory")].map((label) => `${label}:`);
+  const labelCells = Math.min(Math.max(...labels.map((label) => visWidth(label))) + 2, Math.max(12, Math.floor(columns * 0.42)));
+  const line = (label, text) => {
+    const labelText = `${label}:`;
+    const padded = labelText + " ".repeat(Math.max(1, labelCells - visWidth(labelText)));
+    const room = Math.max(8, columns - 2 - visWidth(padded));
+    ui.line("  " + c.faint(padded) + c.text(truncateWidth(text, room)));
+  };
   ui.line("");
-  ui.line(c.faint("╭" + "─".repeat(width - 2) + "╮"));
-  row(ui, width, `>_ Agentlas${version ? " (v" + version + ")" : ""}`);
-  row(ui, width, "");
-  row(ui, width, `model:       ${runtime}`);
-  row(ui, width, `agent:       ${subject}`);
-  row(ui, width, `directory:   ${cwd}`);
-  row(ui, width, `permissions: ${permission}`);
-  ui.line(c.faint("╰" + "─".repeat(width - 2) + "╯"));
-  if (!opts.noTip) {
-    ui.line(
-      "  " +
-        c.bold(c.text("Tip:")) +
-        c.dim(" Type ") +
-        c.faint("/help") +
-        c.dim(" for commands, ") +
-        c.faint("/status") +
-        c.dim(" for session state, ") +
-        c.faint("/exit") +
-        c.dim(" to quit."),
-    );
-  }
+  ui.rule(ui.t("status.title"));
+  line(ui.t("status.runtime"), value.runtime);
+  line(ui.t("status.agent"), value.subject);
+  line(ui.t("status.permission"), value.permission);
+  line(ui.t("status.directory"), value.cwd);
 }
 
 // Main splash. ctx = { ui, version, runtimeLabel, subjectLabel, permission, cwd }
 function renderBanner(ctx) {
-  renderStatusCard(ctx);
-  ctx.ui.line("");
+  const ui = ctx.ui;
+  const c = ui.c;
+  const value = sessionValues(ctx);
+  const room = Math.max(20, (ui.out.columns || 80) - 4);
+  ui.line("");
+  ui.line("  " + c.bold(c.emerald(WORDMARK_COMPACT)) + (value.version ? c.faint("  v" + value.version) : "") + c.dim("  ·  " + ui.t("banner.product")));
+  ui.line("  " + c.text(truncateWidth(ui.t("banner.session", value.runtime, value.subject, value.permission), room)));
+  ui.line("  " + c.faint(truncateWidth(ui.t("banner.location", value.cwd), room)));
+  ui.line("");
 }
 
-// runtime · subject · permission · working folder
+// runtime · subject · permission · working folder (no wordmark — used for /status).
 function renderStatus(ctx) {
-  renderStatusCard(ctx, { noTip: true });
+  renderStatusCard(ctx, { noTip: true, noWordmark: true });
 }
 
-module.exports = { renderBanner, renderStatus, renderMascot, readVersion, shorten, DINO_ART, fit };
+module.exports = { renderBanner, renderStatus, renderMascot, readVersion, shorten, WORDMARK, fit };

package/engine/agentlas-capabilities.cjs

@@ -15,6 +15,7 @@ const RUNTIME_CAPS = {
   "claude-code": { code: true, image: false, label: "claude" },
   codex: { code: true, image: true, label: "codex" }, // Imagen
   gemini: { code: true, image: true, label: "gemini" }, // nano-banana
+  grok: { code: true, image: true, label: "grok" }, // Grok Imagine (generate_image/generate_video, 구독 키리스)
   anthropic: { code: true, image: false, label: "anthropic" },
   openai: { code: true, image: true, label: "openai" }, // gpt-image
   google: { code: true, image: true, label: "google" }, // imagen
@@ -22,6 +23,8 @@ const RUNTIME_CAPS = {
   upstage: { code: true, image: false, label: "solar" }, // Upstage Solar — Korean sovereign LLM (OpenAI-compatible)
 };
 
+// NOTE: grok은 CAPS(멀티모달 능력 인지)만 등록 — 터미널 스폰 러너(RUNTIME_BIN)가 아직 없어
+// CLI_KINDS에 넣으면 repl의 which(RUNTIME_BIN[k]) 탐지가 깨진다. 러너 추가 시 함께 확장할 것.
 const CLI_KINDS = ["claude-code", "codex", "gemini"];
 
 function capsFor(spec) {

package/engine/agentlas-cloud-runtime.cjs

@@ -78,7 +78,7 @@ function buildManifest(root, options = {}) {
     publicExportPolicy: "clean-copy",
     requiredRuntime: ["mcp-client"],
     license: "call-only-default",
-    createdBy: "agentlas-desktop-setup-wizard",
+    createdBy: "agentlas-terminal-setup-wizard",
   };
 }
 
@@ -132,9 +132,46 @@ function loadManifest(root) {
   return JSON.parse(fs.readFileSync(path.join(path.resolve(root), "agentlas.json"), "utf8"));
 }
 
+function globRegex(pattern) {
+  const source = String(pattern || "").replace(/\\/g, "/");
+  let out = "";
+  for (let i = 0; i < source.length; i += 1) {
+    const ch = source[i];
+    if (ch === "*") {
+      if (source[i + 1] === "*") {
+        i += 1;
+        // `**/` includes zero directory levels, so **/secrets/** also
+        // protects a root-level secrets directory.
+        if (source[i + 1] === "/") {
+          i += 1;
+          out += "(?:.*/)?";
+        } else {
+          out += ".*";
+        }
+      } else {
+        out += "[^/]*";
+      }
+      continue;
+    }
+    out += /[.+^${}()|[\]\\]/.test(ch) ? `\\${ch}` : ch;
+  }
+  return new RegExp(`^${out}$`, "i");
+}
+
 function matches(filePath, pattern) {
-  const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*\*/g, ".*").replace(/\*/g, "[^/]*");
-  return new RegExp(`^${escaped}$`, "i").test(filePath);
+  return globRegex(pattern).test(String(filePath || "").replace(/\\/g, "/"));
+}
+
+function normalizeRequestedPath(requestedPath) {
+  const raw = typeof requestedPath === "string" ? requestedPath.replace(/\\/g, "/") : "";
+  if (!raw || raw.includes("\0") || raw.startsWith("/") || /^[A-Za-z]:\//.test(raw)) return null;
+  const parts = [];
+  for (const segment of raw.split("/")) {
+    if (!segment || segment === ".") continue;
+    if (segment === "..") return null;
+    parts.push(segment);
+  }
+  return parts.length > 0 ? parts.join("/") : null;
 }
 
 function compileBundle(root) {
@@ -160,17 +197,25 @@ function compileBundle(root) {
 
 function readAgentFile(root, requestedPath) {
   const manifest = loadManifest(root);
-  if ((manifest.denyRead || []).some((pattern) => matches(requestedPath, pattern))) {
-    return { status: "denied", path: requestedPath, reason: "Denied by agentlas.json denyRead.", redacted: true };
+  const safePath = normalizeRequestedPath(requestedPath);
+  if (!safePath) {
+    return { status: "denied", path: String(requestedPath || ""), reason: "Invalid or escaping path.", redacted: true };
+  }
+  if ((manifest.denyRead || []).some((pattern) => matches(safePath, pattern))) {
+    return { status: "denied", path: safePath, reason: "Denied by agentlas.json denyRead.", redacted: true };
   }
-  if (!(manifest.allowRead || []).some((pattern) => matches(requestedPath, pattern))) {
-    return { status: "denied", path: requestedPath, reason: "Path is not in agentlas.json allowRead.", redacted: false };
+  if (!(manifest.allowRead || []).some((pattern) => matches(safePath, pattern))) {
+    return { status: "denied", path: safePath, reason: "Path is not in agentlas.json allowRead.", redacted: false };
+  }
+  const base = path.resolve(root);
+  const abs = path.resolve(base, safePath);
+  if (abs !== base && !abs.startsWith(base + path.sep)) {
+    return { status: "denied", path: safePath, reason: "Path escapes the agent package.", redacted: true };
   }
-  const abs = path.join(path.resolve(root), requestedPath);
-  if (!fs.existsSync(abs)) return { status: "missing", path: requestedPath, reason: "File not found." };
+  if (!fs.existsSync(abs)) return { status: "missing", path: safePath, reason: "File not found." };
   const raw = fs.readFileSync(abs, "utf8");
   const content = redact(raw);
-  return { status: "allowed", path: requestedPath, content, redacted: content !== raw };
+  return { status: "allowed", path: safePath, content, redacted: content !== raw };
 }
 
 function runFieldTest() {
@@ -196,4 +241,13 @@ function runFieldTest() {
   return report;
 }
 
-module.exports = { buildManifest, scanFolder, runWizard, compileBundle, readAgentFile, runFieldTest };
+module.exports = {
+  buildManifest,
+  scanFolder,
+  runWizard,
+  compileBundle,
+  readAgentFile,
+  runFieldTest,
+  matches,
+  normalizeRequestedPath,
+};