agentlas 0.9.5 → 0.9.6

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 0.9.6 — 2026-07-25
+
+- Agent and App Builder routing is now decided by the connected model: lexical
+  scores only recruit candidates, and the model can route a request the keyword
+  lists never matched (any language). The App Builder consent handshake is
+  unchanged, and every route receipt says whether the connected model or the
+  deterministic fallback decided.
+- Whether an agent produces images (and therefore which runtime runs it) is now
+  judged by the connected model from the agent's own identity, with the old
+  keyword list demoted to reference hints. Conservative non-image vetoes stay.
+- Task classification, routing, and image judgments all fail over to the
+  previous deterministic behavior — explicitly labeled — when no connected
+  model is available.
+- Publication gates pin the Agentlas OS v1.1.61 runtime commit, which ships the
+  same judgment-engine migration across the bundled Core runtime.
+
 ## 0.9.4 — 2026-07-23
 
 - `plugin add` no longer registers a code-hosting page (GitHub/GitLab/Bitbucket

package/engine/agentlas-capabilities.cjs

@@ -63,7 +63,10 @@ const IMAGE_TOOL_MARKERS = [/nano-?banana/i, /\bimagen\b/i, /gpt-image/i, /grok\
 // 겹치는 정규식 여러 개를 동시에 때려도 1클러스터다.
 const MIN_BODY_IMAGE_SENTENCES = 3;
 const BODY_SCAN_CAP = 16000; // 로컬 임포트 상한과 동일 — 클라우드 무제한 프롬프트의 전문 스캔 방지
-function needsImage(agent) {
+// 어휘 판정 — 연결 모델이 없을 때의 결정적 폴백이자, 모델 판정 전의 참고 프리필터.
+// 하우스 룰: 단어목록은 최종 결정을 내리지 않는다. 최종 판정은 resolveNeedsImage가
+// 상주 판정 서비스(judgeLabels)에 묻고, 이 함수는 그 폴백으로만 살아남는다.
+function needsImageLexical(agent) {
   if (!agent) return false;
   if (NON_IMAGE_ROLES.has(String(agent.role || "").toLowerCase())) return false;
   // 정체성 존은 사용자가 선언한 이름/태그라인만 — slug는 폴더명에서 기계 파생되므로
@@ -87,6 +90,82 @@ function needsImage(agent) {
   return false;
 }
 
+// ── 상주 판정 서비스 배선 — 모델이 의미로 최종 판정, IMAGE_HINTS는 참고 힌트 ──────
+// needsImage 호출자(REPL 배지·autoRuntimeFor·routingNote)는 동기라서 warm-cache 패턴:
+// 비동기 경로(resolveNeedsImage)가 먼저 판정해 캐시를 데우고, 동기 needsImage는 캐시만
+// 읽는다. 캐시 미스 = 어휘 폴백 그대로 — imageJudgmentSource가 어느 쪽이었는지 라벨한다.
+const IMAGE_VERDICT_CACHE_MAX = 200;
+const imageVerdicts = new Map();
+function imageJudgeInput(agent) {
+  const identity = [agent.slug, agent.name, agent.name_en, agent.tagline, agent.tagline_en].filter(Boolean).join(" | ");
+  return `${identity}\n---\n${String(agent.system_prompt || "").slice(0, 6000)}`;
+}
+// 역할/팀 베토는 보수적 하드 가드로 유지 — 조율 두뇌가 부서 소개 문장("Design HQ")으로
+// 이미지 팀이 되던 사고(vibecoder/appbridge)는 모델 판정 대상에서 아예 뺀다.
+function imageJudgeVetoed(agent) {
+  if (!agent) return true;
+  if (NON_IMAGE_ROLES.has(String(agent.role || "").toLowerCase())) return true;
+  if (String(agent.entity_kind || "").toLowerCase() === "team") return true;
+  return false;
+}
+// 이 에이전트의 직무가 이미지 생산인지를 연결 모델이 의미로 판정한다.
+// 러너 없음/타임아웃/정크 → 어휘 판정을 "fallback"으로 라벨해 반환 (조용한 회귀 금지).
+async function resolveNeedsImage(agent) {
+  const lexical = needsImageLexical(agent);
+  if (imageJudgeVetoed(agent)) return { image: lexical, source: "deterministic" };
+  let judgment;
+  try {
+    judgment = require("./agentlas-judgment.cjs");
+  } catch {
+    judgment = null;
+  }
+  if (!judgment || !judgment.hasJudgmentRunner()) return { image: lexical, source: "fallback" };
+  const input = imageJudgeInput(agent);
+  const cached = imageVerdicts.get(input);
+  if (cached) return cached;
+  const verdict = await judgment.judgeLabels({
+    kind: "agent-produces-images",
+    question:
+      "Does this agent's OWN job include producing images (generating or designing visual assets such as thumbnails, banners, logos, posters, product shots)?",
+    labels: ["image", "not-image"],
+    multi: false,
+    input,
+    hints: { image: IMAGE_HINTS.map((re) => re.source) },
+    guidance:
+      "Judge the agent's role from its identity and instructions, in any language. Mentioning images is not " +
+      "producing them: builders, orchestrators, PMs, curators, and coordination brains that commission or " +
+      "delegate image work are 'not-image'. Refusals or prohibitions ('never generate images') declare the " +
+      "opposite of a capability.",
+    fallback: [lexical ? "image" : "not-image"],
+  });
+  if (verdict.source !== "llm" || !verdict.labels.length) return { image: lexical, source: "fallback" };
+  const out = { image: verdict.labels[0] === "image", source: "llm", reason: verdict.reason || "" };
+  imageVerdicts.set(input, out);
+  if (imageVerdicts.size > IMAGE_VERDICT_CACHE_MAX) {
+    const oldest = imageVerdicts.keys().next().value;
+    if (oldest !== undefined) imageVerdicts.delete(oldest);
+  }
+  return out;
+}
+// Does this agent's job involve generating/handling images? Sync surface for badges and
+// autoRuntimeFor: model verdict from the warm cache wins; miss = deterministic lexical fallback.
+function needsImage(agent) {
+  if (!agent) return false;
+  if (!imageJudgeVetoed(agent)) {
+    const cached = imageVerdicts.get(imageJudgeInput(agent));
+    if (cached) return cached.image;
+  }
+  return needsImageLexical(agent);
+}
+// 라벨용 — 이 에이전트의 현재 이미지 판정이 모델("llm")인지 결정적 경로("deterministic")인지.
+function imageJudgmentSource(agent) {
+  if (agent && !imageJudgeVetoed(agent) && imageVerdicts.has(imageJudgeInput(agent))) return "llm";
+  return "deterministic";
+}
+function clearImageJudgments() {
+  imageVerdicts.clear();
+}
+
 // Auto-pick a runtime spec for an agent given installed CLI kinds and the session default spec.
 // Image agents route to an installed image-capable runtime; otherwise keep the session default.
 function autoRuntimeFor(agent, { installedKinds, activeSpec }) {
@@ -103,4 +182,17 @@ function badge(spec) {
   return c.image ? "🖼" : "";
 }
 
-module.exports = { RUNTIME_CAPS, CLI_KINDS, capsFor, specOf, runtimeFromSpec, needsImage, autoRuntimeFor, badge };
+module.exports = {
+  RUNTIME_CAPS,
+  CLI_KINDS,
+  capsFor,
+  specOf,
+  runtimeFromSpec,
+  needsImage,
+  needsImageLexical,
+  resolveNeedsImage,
+  imageJudgmentSource,
+  clearImageJudgments,
+  autoRuntimeFor,
+  badge,
+};

package/engine/agentlas-experience-exchange.cjs

@@ -97,22 +97,20 @@ const SEMVER_RE = /^v?[0-9]+\.[0-9]+\.[0-9]+(?:[-+][A-Za-z0-9.-]+)?$/;
 const ENV_RE = /^[A-Z][A-Z0-9_]*$/;
 const SAFE_IDEMPOTENCY_RE = /^[A-Za-z0-9._:-]{8,200}$/;
 
-const SECRET_PATTERNS = [
-  /\bsk-(?:proj-)?[A-Za-z0-9_-]{20,}\b/i,
-  /\bxox[baprs]-[A-Za-z0-9-]{20,}\b/i,
-  /\bgh[pousr]_[A-Za-z0-9_]{20,}\b/,
-  /\bAKIA[0-9A-Z]{16}\b/,
-  /-----BEGIN (?:RSA |EC |OPENSSH |DSA )?PRIVATE KEY-----/i,
-  /\b(?:api[_-]?key|access[_-]?token|refresh[_-]?token|client[_-]?secret|password|passwd|private[_-]?key|cookie)\b\s*[:=]\s*['"]?[^\s'"]{8,}/i,
-  /\bauthorization\b\s*[:=]\s*['"]?(?:bearer|basic)\s+[A-Za-z0-9._~+/=-]{8,}/i,
-];
+const { SECRET_PATTERNS } = require("./agentlas-secret-patterns.cjs");
 const PII_PATTERNS = [
   /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/i,
   /(?<!\w)(?:\+?\d[\d ().-]{8,}\d)(?!\w)/,
   /\b(?:account|customer|client|tenant|workspace|user)[ _-]?(?:id|key|number|no)\s*[:=#]?\s*[A-Za-z0-9_-]{4,}\b|(?:계정|고객|사용자)[ _-]?(?:id|아이디|번호)\s*[:=#]?\s*[A-Za-z0-9_-]{4,}/i,
 ];
+// Absolute LOCAL paths and file URLs only. The previous alternation matched any
+// slash-containing token, so ordinary prose lost its experience: "TCP/IP", "read/write",
+// "and/or", and web routes like "GET /api/users" were all reported as a local path. A
+// leading-slash path now has to look like a real filesystem root (or start from a home /
+// relative marker, a Windows drive, or a UNC share); a lone `/word` — which is what a web
+// route looks like — no longer counts, and neither does `word/word` inside a sentence.
 const LOCAL_PATH_PATTERNS = [
-  /(?:file:\/\/|(?:^|[\s"'`()\[\]{}=:,;])(?:\.\.[/\\]|~[/\\]|\/(?!\/|\s)(?:[^/\s"'`<>]+\/)*[^/\s"'`<>]+|[A-Za-z]:[/\\]\S+|\\\\[^\\/\s]+[\\/][^\\/\s]+))/i,
+  /(?:file:\/\/|(?:^|[\s"'`()\[\]{}=:,;])(?:\.\.[/\\]|~[/\\]|\/(?:Users|home|root|private|var|tmp|opt|etc|srv|mnt|media|Volumes|Applications|System|Library|usr)\/[^\s"'`<>]+|[A-Za-z]:[/\\]\S+|\\\\[^\\/\s]+[\\/][^\\/\s]+))/i,
 ];
 const RAW_INTERACTION_PATTERNS = [
   /(?:^|\n)\s*(?:system|assistant|user|tool|customer|agent)\s*:\s+/i,
@@ -1530,7 +1528,13 @@ function isCanonicalTaskId(value) {
 function keywordOccurs(normalizedPrompt, rawKeyword) {
   const keyword = normalizeClassificationText(rawKeyword);
   if (!keyword) return false;
-  if (/[가-힣]/.test(keyword)) return normalizedPrompt.includes(keyword);
+  if (/[가-힣]/.test(keyword)) {
+    // Korean has no word boundary, so a raw includes() matched inside longer compounds:
+    // 번역 hit 번역기, 금융 hit compound finance words, 영업 hit 영업일 (business day).
+    // Require the keyword not be glued to another Hangul syllable on either side.
+    const escaped = keyword.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    return new RegExp(`(?<![가-힣])${escaped}(?![가-힣])`).test(normalizedPrompt);
+  }
   return ` ${normalizedPrompt} `.includes(` ${keyword} `);
 }
 
@@ -1557,6 +1561,56 @@ function deriveCanonicalTaskClasses(prompt, options = {}) {
   return { taskIds: matches, source: "deterministic-keyword-map", matchedTaskClasses: matches, invalidDeclaredCount: 0 };
 }
 
+/**
+ * Meaning-aware task classification. The resident judge decides; TASK_CLASS_KEYWORDS is
+ * passed as reference hints only. This is what a keyword map cannot do: Korean compounds
+ * (번역 inside 번역기), particle inflection (고객 문의를), dialect, slang, and any other
+ * language all hinge on meaning, and no list enumerates them.
+ *
+ * An explicit declared task class still wins outright (it is data, not a guess), and with
+ * no connected model the deterministic keyword prefilter is the fallback so classification
+ * never stops working.
+ */
+async function resolveCanonicalTaskClasses(prompt, options = {}) {
+  const declaredRaw = options.declaredTaskClasses ?? options.declaredTaskClass;
+  if (declaredRaw != null && (Array.isArray(declaredRaw) ? declaredRaw.length : String(declaredRaw).trim())) {
+    return deriveCanonicalTaskClasses(prompt, options);
+  }
+  const prefilter = deriveCanonicalTaskClasses(prompt, options);
+  const judgment = require("./agentlas-judgment.cjs");
+  if (!judgment.hasJudgmentRunner()) return prefilter;
+
+  const hints = {};
+  for (const slug of CANONICAL_TASK_SLUGS) {
+    const words = TASK_CLASS_KEYWORDS[slug];
+    if (Array.isArray(words) && words.length) hints[slug] = words;
+  }
+  const verdict = await judgment.judgeLabels({
+    kind: "experience-task-class",
+    question:
+      "Which kinds of work does this request actually involve? Judge the user's real task, not words that merely appear.",
+    labels: CANONICAL_TASK_SLUGS,
+    input: String(prompt || ""),
+    guidance:
+      "Return a label only when that kind of work is genuinely part of the request. A word inside an " +
+      "unrelated compound or a different sense of the word does not count. Return an empty list for " +
+      "content with no identifiable task (hashes, ids, random strings).",
+    hints,
+    fallback: [],
+    signal: options.signal,
+  });
+  if (verdict.source !== "llm") return prefilter;
+  const taskIds = CANONICAL_TASK_IDS.filter((id) =>
+    verdict.labels.some((slug) => id === `${CANONICAL_TASK_PREFIX}${slug}`));
+  return {
+    taskIds,
+    source: "model-judgment",
+    matchedTaskClasses: taskIds,
+    invalidDeclaredCount: 0,
+    ...(verdict.reason ? { judgmentReason: verdict.reason } : {}),
+  };
+}
+
 function parseEnvironmentConstraint(value) {
   const normalized = normalizedTaxonomyAtom(value);
   const contract = EXPERIENCE_TAXONOMY_V1.environment;
@@ -2140,6 +2194,7 @@ module.exports = {
   environmentConstraintsMatch,
   selectApplicablePortableItems,
   deriveCanonicalTaskClasses,
+  resolveCanonicalTaskClasses,
   readExactLocalBaseMarker,
   exactTaskSignatureInPrompt,
   resolveRuntimeExperienceForAgent,

package/engine/agentlas-i18n.cjs

@@ -111,6 +111,8 @@ const STRINGS = {
     "team.usage": "usage: /team   ·   /team <agent> <claude-code|codex|gemini|auto>",
     "team.set": "%s → %s",
     "routedImage": "routed to %s for image support",
+    "judge.source.llm": "judged by the connected model",
+    "judge.source.fallback": "deterministic fallback (no connected-model verdict)",
     "usageBar": "tokens",
     "config.title": "Engine auto engagement — explicit on/off (default: off)",
     "config.storm": "Stormbreaker auto-engage on direct-routed real work",
@@ -325,6 +327,8 @@ const STRINGS = {
     "team.usage": "사용법: /team   ·   /team <에이전트> <claude-code|codex|gemini|auto>",
     "team.set": "%s → %s",
     "routedImage": "이미지 지원을 위해 %s로 라우팅",
+    "judge.source.llm": "판정: 연결 모델",
+    "judge.source.fallback": "판정: 결정적 폴백(연결 모델 없음)",
     "usageBar": "토큰",
     "config.title": "엔진 자동 개입 — 명시적 on/off (기본: off)",
     "config.storm": "직답 라우팅된 실작업에 Stormbreaker 자동 개입",

package/engine/agentlas-memory-governance.cjs

@@ -30,17 +30,7 @@ const FINAL_SCOPES = new Set(["user_global", "team", "agent", "project", "sessio
 const SEMANTIC_DISPOSITIONS = new Set(["retain", "session", "discard", "review"]);
 const CONFIDENCE_LEVELS = new Set(["high", "medium", "low"]);
 
-const SECRET_PATTERNS = [
-  /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/i,
-  /\b(?:sk|rk|pk)-(?:ant|proj|live|test)?-?[A-Za-z0-9_-]{16,}\b/i,
-  /\bgh[pousr]_[A-Za-z0-9]{20,}\b/i,
-  /\bxox[baprs]-[A-Za-z0-9-]{16,}\b/i,
-  /\bAIza[A-Za-z0-9_-]{30,}\b/,
-  /\bAKIA[A-Z0-9]{16}\b/,
-  /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/,
-  /\b(?:password|passwd|api[_-]?key|access[_-]?token|refresh[_-]?token|client[_-]?secret)\s*[:=]\s*[^\s,;]{6,}/i,
-  /\bauthorization\s*:\s*bearer\s+[^\s,;]{8,}/i,
-];
+const { SECRET_PATTERNS } = require("./agentlas-secret-patterns.cjs");
 const ABSOLUTE_PATH_PATTERNS = [
   /(?:^|[\s("'`])~\/[A-Za-z0-9._-]/,
   /(?:^|[\s("'`])\/(?:Users|home|private|var|tmp|opt|etc|Volumes|Applications|System|Library)\//,

package/engine/agentlas-memory-import.cjs

@@ -30,12 +30,7 @@ const ALWAYS_KEEP_HINT = /(team[-_ ]?memory|glossary|dossier|handoff|safety|scop
 
 // Minimal secret guard (a subset of the shared secret-patterns chokepoint) so a
 // stray key in legacy notes never becomes a durable memory row.
-const SECRET_RE =
-  /(sk-[A-Za-z0-9]{20,}|sk_live_[A-Za-z0-9]{16,}|github_pat_[A-Za-z0-9_]{20,}|gh[opsu]_[A-Za-z0-9]{20,}|AIza[0-9A-Za-z_-]{20,}|glpat-[A-Za-z0-9_-]{16,}|xox[baprs]-[A-Za-z0-9-]{10,}|-----BEGIN [A-Z ]*PRIVATE KEY-----|AKIA[0-9A-Z]{16})/;
-
-function looksSecret(content) {
-  return SECRET_RE.test(String(content || ""));
-}
+const { looksSecret } = require("./agentlas-secret-patterns.cjs");
 
 function substantiveBody(body) {
   const lines = body.split("\n").map((l) => l.trim()).filter(Boolean);

package/engine/agentlas-repl.cjs

@@ -643,12 +643,26 @@ function startRepl(opts) {
     state.modelPinned = false;
     state.native = {};
   }
+  // 이미지 능력 판정 warm-cache — 동기 호출자(applyRuntimeFor/배지)가 읽기 전에 비동기
+  // 경로에서 상주 판정 서비스를 먼저 데운다. 러너 없음/실패는 어휘 폴백(라벨은 routingNote가 찍음).
+  async function warmImageJudgment(agentRow) {
+    if (!agentRow || typeof caps.resolveNeedsImage !== "function") return;
+    try {
+      await caps.resolveNeedsImage(agentRow);
+    } catch {
+      /* lexical fallback */
+    }
+  }
   // Tell the user when we routed to an image-capable runtime, or when the current one can't make images.
   function routingNote(subject) {
     if (!subject || !caps.needsImage(subject.capAgent)) return;
     const spec = caps.specOf(state.runtime);
     if (caps.capsFor(spec).image) {
-      if (spec !== caps.specOf(baseRuntime)) ui.info(ui.t("routedImage", spec));
+      if (spec !== caps.specOf(baseRuntime)) {
+        // 판정 주체 라벨 — 모델 판정인지 결정적 폴백인지 반드시 밝힌다(조용한 폴백 금지).
+        const judged = typeof caps.imageJudgmentSource === "function" && caps.imageJudgmentSource(subject.capAgent) === "llm";
+        ui.info(ui.t("routedImage", spec) + " — " + ui.t(judged ? "judge.source.llm" : "judge.source.fallback"));
+      }
     } else {
       ui.warn(ui.t("guard.imageWarn", caps.capsFor(spec).label || spec));
     }
@@ -701,10 +715,11 @@ function startRepl(opts) {
     state.routePreambleOnce = null;
     applyRuntimeFor(state.subject);
   }
-  function switchSubject(kind, query) {
+  async function switchSubject(kind, query) {
     if (kind === "agent") {
       const agent = H.resolveAgent(db, query);
       if (!agent) return ui.error(ui.t("noAgent", query));
+      await warmImageJudgment(agent); // 런타임 자동 배정 전에 모델 판정을 데운다
       setSubjectAgent(agent);
     } else {
       const firm = H.resolveFirm(db, query);
@@ -933,11 +948,11 @@ function startRepl(opts) {
       }
       case "agent":
         if (!arg) return ui.warn(ui.t("agentUsage")), true;
-        switchSubject("agent", arg);
+        await switchSubject("agent", arg);
         return true;
       case "firm":
         if (!arg) return ui.warn(ui.t("firmUsage")), true;
-        switchSubject("firm", arg);
+        await switchSubject("firm", arg);
         return true;
       case "runtime":
         setRuntime(arg);
@@ -1364,7 +1379,8 @@ function startRepl(opts) {
   }
 
   // ── interactive picker (when no agent was given) ──
-  function chooseAndStart(setter, row) {
+  async function chooseAndStart(setter, row) {
+    if (setter === setSubjectAgent) await warmImageJudgment(row); // firm은 팀 베토라 판정 대상 아님
     setter(row);
     ui.ok(ui.t("switched", state.subject.label));
     routingNote(state.subject);
@@ -1402,12 +1418,14 @@ function startRepl(opts) {
       if (a) return chooseAndStart(setSubjectAgent, a);
       const f = H.resolveFirm(db, t);
       if (f) return chooseAndStart(setSubjectFirm, f);
-      if (H.autoRouteAgent) {
-        const choice = H.autoRouteAgent(db, t, ui.lang);
+      if (H.autoRouteAgent || H.resolveAutoRoute) {
+        // 연결 모델이 라우트를 최종 판정한다(resolveAutoRoute) — 없으면 어휘 폴백.
+        const choice = H.resolveAutoRoute ? await H.resolveAutoRoute(db, t, ui.lang) : H.autoRouteAgent(db, t, ui.lang);
         if (choice) {
           if (choice.direct) {
             setSubjectDirect();
           } else {
+            await warmImageJudgment(choice.agent);
             setSubjectAgent(choice.agent);
           }
           state.routePreambleOnce = H.autoRoutePreamble ? H.autoRoutePreamble(choice, ui.lang) : null;
@@ -1442,6 +1460,7 @@ function startRepl(opts) {
         if (/^\d+$/.test(t)) {
           const n = parseInt(t, 10);
           if (n >= 1 && n <= ags.length) {
+            await warmImageJudgment(ags[n - 1]);
             setSubjectAgent(ags[n - 1]);
             ui.ok(ui.t("switched", state.subject.label));
             routingNote(state.subject);
@@ -1450,13 +1469,14 @@ function startRepl(opts) {
         }
         if (single) {
           const a = H.resolveAgent(db, t);
-          if (a) { setSubjectAgent(a); ui.ok(ui.t("switched", state.subject.label)); routingNote(state.subject); return; }
+          if (a) { await warmImageJudgment(a); setSubjectAgent(a); ui.ok(ui.t("switched", state.subject.label)); routingNote(state.subject); return; }
           const f = H.resolveFirm(db, t);
           if (f) { setSubjectFirm(f); ui.ok(ui.t("switched", state.subject.label)); routingNote(state.subject); return; }
         }
       }
-      if (H.autoRouteAgent) {
-        const choice = H.autoRouteAgent(db, t, ui.lang);
+      if (H.autoRouteAgent || H.resolveAutoRoute) {
+        // 연결 모델이 라우트를 최종 판정한다(resolveAutoRoute) — 없으면 어휘 폴백.
+        const choice = H.resolveAutoRoute ? await H.resolveAutoRoute(db, t, ui.lang) : H.autoRouteAgent(db, t, ui.lang);
         if (choice) {
           if (choice.direct) {
             setSubjectDirect();
@@ -1466,6 +1486,7 @@ function startRepl(opts) {
               ui.info(H.autoRouteNote ? H.autoRouteNote(choice, ui.lang) : `direct answer (no agent)`);
             }
           } else {
+            await warmImageJudgment(choice.agent);
             setSubjectAgent(choice.agent);
             state.routePreambleOnce = H.autoRoutePreamble ? H.autoRoutePreamble(choice, ui.lang) : null;
             ui.info(H.autoRouteNote ? H.autoRouteNote(choice, ui.lang) : `auto-routed to ${choice.agent.name}`);

package/engine/agentlas-secret-patterns.cjs

@@ -0,0 +1,71 @@
+"use strict";
+// Credential/secret detection for every terminal write boundary that must never persist
+// or transmit a live key. Three inline copies had drifted apart (memory import missed
+// JWTs, generic `key=` assignments and bearer headers; governance missed sk_live_/
+// github_pat_/glpat-; experience exchange missed Google AIza and JWTs), so the same
+// secret was caught at one boundary and stored in plain text at another. One list, one
+// behaviour: extend HERE, not at a call site. Mirrors the desktop's
+// shared/secret-patterns.ts.
+//
+// Scope rule: match *credential shapes*, not the words around them. Ordinary prose that
+// mentions "token", or a hyphenated phrase like "risk-management-notes", must not trip
+// this — a false positive silently drops a user's memory, which is its own data loss.
+
+/** Live-credential shapes across the providers this product actually touches. */
+const SECRET_SHAPES = [
+  // GitHub: classic PAT, OAuth/user/server/refresh tokens, fine-grained PAT.
+  /gh[pousr]_[A-Za-z0-9]{20,}/,
+  /github_pat_[A-Za-z0-9_]{20,}/,
+  // Slack bot/user/app tokens.
+  /xox[baprs]-[A-Za-z0-9-]{20,}/,
+  // AWS access key ids (long-lived and STS).
+  /(?:AKIA|ASIA)[0-9A-Z]{16}/,
+  // Google / Firebase API keys.
+  /AIza[0-9A-Za-z_-]{30,}/,
+  // Stripe and similar: secret/restricted/publishable, live or test.
+  /(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{16,}/,
+  // OpenAI / Anthropic, including provider-segmented forms. The \b prevents an ordinary
+  // hyphenated phrase ("ask-forgiveness-not-permission") from matching.
+  /\bsk-(?:proj-|ant-)?[A-Za-z0-9_-]{12,}/,
+  // HuggingFace, GitLab, npm.
+  /hf_[A-Za-z0-9]{20,}/,
+  /glpat-[A-Za-z0-9_-]{20,}/,
+  /npm_[A-Za-z0-9]{20,}/,
+  // JWTs (three base64url segments) — bearer tokens frequently land in pasted logs.
+  /eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/,
+  // Telegram bot tokens.
+  /\b[0-9]{8,}:[A-Za-z0-9_-]{25,}\b/,
+  // Private key blocks.
+  /-----BEGIN [A-Z ]*PRIVATE KEY-----/,
+];
+
+/** `password: hunter2` style assignments, where the value shape alone proves nothing. */
+const SECRET_ASSIGNMENT_RE =
+  /\b(?:password|passwd|secret|api[_-]?key|access[_-]?token|refresh[_-]?token|auth[_-]?token|client[_-]?secret|private[_-]?key|cookie|bearer)\b\s*[:=]\s*['"]?[^\s,;'"]{6,}/i;
+
+/** `Authorization: Bearer …` / `Basic …` headers. */
+const AUTH_HEADER_RE = /\bauthorization\b\s*[:=]\s*['"]?(?:bearer|basic)\s+[A-Za-z0-9._~+/=-]{8,}/i;
+
+/** Single source of truth. Case-insensitive: providers are inconsistent about casing. */
+const SECRET_PATTERNS = [
+  ...SECRET_SHAPES.map((re) => new RegExp(re.source, "i")),
+  SECRET_ASSIGNMENT_RE,
+  AUTH_HEADER_RE,
+];
+
+/** True when the text contains something that looks like a live credential. */
+function looksSecret(content) {
+  const text = String(content || "");
+  return SECRET_PATTERNS.some((re) => re.test(text));
+}
+
+/** Replace credential-shaped substrings with a marker, preserving surrounding text. */
+function redactSecrets(content, marker = "[redacted-secret]") {
+  let out = String(content || "");
+  for (const re of SECRET_PATTERNS) {
+    out = out.replace(new RegExp(re.source, re.flags.includes("g") ? re.flags : `${re.flags}g`), marker);
+  }
+  return out;
+}
+
+module.exports = { SECRET_PATTERNS, looksSecret, redactSecrets };

package/engine/agentlas.cjs

@@ -580,6 +580,24 @@ function directSystemPrompt(lang) {
     ? "당신은 Agentlas 터미널의 기본 어시스턴트입니다. 특별한 페르소나 없이 사용자의 요청에 정확하고 간결하게 바로 답하세요. 에이전트 라우팅이나 이미지 생성 능력을 스스로 언급하지 마세요."
     : "You are the Agentlas terminal's default assistant. Answer the user's request directly and concisely, with no special persona. Do not bring up agent routing or image-generation capabilities on your own.";
 }
+// 어휘 스코어링 — 설치 에이전트 전원을 점수순으로 나열한다. 하우스 룰에 따라 이 점수는
+// (1) resolveAutoRoute의 후보 모집과 (2) 라벨 붙은 오프라인 폴백(autoRouteAgent)으로만
+// 쓰인다 — 연결 모델이 있으면 최종 라우트 결정은 상주 판정 서비스가 의미로 내린다.
+function rankRouteAgents(db, prompt, lang) {
+  const resolvedLang = lang || prefsLang();
+  const agents = listRoutableAgents(db).filter((agent) => !NON_GENERIC_ROUTE_SLUGS.has(agent.slug));
+  if (!agents.length) return [];
+  let terms = routeTokenize(prompt);
+  // 헤이스택은 한 번만 계산해 IDF와 스코어링 양쪽에서 재사용한다.
+  const hays = agents.map((agent) => ({ identityHay: routeIdentityHaystack(agent), haystack: routeHaystack(agent) }));
+  // IDF 근사 — 설치 에이전트 절반 이상의 haystack에 나오는 단어("ai","도구" 등)는 판별력이 없어 제외.
+  if (agents.length >= 3) {
+    terms = terms.filter((term) => hays.filter((h) => h.haystack.includes(term)).length * 2 <= agents.length);
+  }
+  return agents
+    .map((agent, i) => scoreRouteAgent(prompt, terms, agent, resolvedLang, hays[i]))
+    .sort((a, b) => b.score - a.score);
+}
 function autoRouteAgent(db, prompt, lang) {
   const resolvedLang = lang || prefsLang();
   // 명확한 "에이전트/팀/회사 만들기" 의도 → 메타-빌더로 직행 (약한 키워드 점수에 밀리지 않게).
@@ -598,35 +616,123 @@ function autoRouteAgent(db, prompt, lang) {
       };
     }
   }
-  const agents = listRoutableAgents(db).filter((agent) => !NON_GENERIC_ROUTE_SLUGS.has(agent.slug));
-  if (!agents.length) return directRouteChoice(resolvedLang);
-  let terms = routeTokenize(prompt);
-  // 헤이스택은 한 번만 계산해 IDF와 스코어링 양쪽에서 재사용한다.
-  const hays = agents.map((agent) => ({ identityHay: routeIdentityHaystack(agent), haystack: routeHaystack(agent) }));
-  // IDF 근사 — 설치 에이전트 절반 이상의 haystack에 나오는 단어("ai","도구" 등)는 판별력이 없어 제외.
-  if (agents.length >= 3) {
-    terms = terms.filter((term) => hays.filter((h) => h.haystack.includes(term)).length * 2 <= agents.length);
-  }
-  const ranked = agents
-    .map((agent, i) => scoreRouteAgent(prompt, terms, agent, resolvedLang, hays[i]))
-    .sort((a, b) => b.score - a.score);
+  const ranked = rankRouteAgents(db, prompt, resolvedLang);
+  if (!ranked.length) return directRouteChoice(resolvedLang);
   // 1위가 아니라 "임계값+strong을 모두 만족하는 최고 순위"를 뽑는다 — 장황한 프롬프트의
   // 약한 단어 적중이 점수 1위를 먹어도, 자격 있는 전문 에이전트가 직답으로 밀려나지 않는다.
   const pick = ranked.find((r) => r.score >= MIN_ROUTE_SCORE && r.strong);
   if (pick) return pick;
   return directRouteChoice(resolvedLang);
 }
+// ── 모델 최종 라우팅 판정 ──────────────────────────────────
+// 하우스 룰: 단어목록/정규식은 최종 라우트 결정을 내리지 않는다. 연결 모델이 있으면
+// judgeLabels가 후보(어휘 모집 + 설치 전원, 상한) + 합성 라벨(meta-builder/app-builder/
+// direct) 중에서 의미로 하나를 고른다 — 어휘 점수 0점인 에이전트(아랍어 등 어떤 언어의
+// 요청이든)도 모델은 뽑을 수 있다. 닫힌형 가드는 결정적으로 유지: 잡담 short-circuit
+// (isTrivialRoutePrompt)과 경로 스트리핑(ROUTE_PATH_RE)은 모델 호출 전에 그대로 적용.
+// 러너 없음/타임아웃/정크 → 기존 어휘 라우팅(autoRouteAgent)을 routeSource:"deterministic"
+// 으로 라벨해 반환한다 — 조용한 폴백 금지(라우트 노트에 판정 주체가 찍힌다).
+const ROUTE_JUDGE_CANDIDATE_CAP = 30;
+const ROUTE_JUDGE_DIRECT_LABEL = "direct";
+const ROUTE_JUDGE_META_LABEL = "meta-builder";
+const ROUTE_JUDGE_APP_LABEL = "app-builder";
+const APP_BUILDER_ROUTE_SLUG = "agentlas-app-builder";
+async function resolveAutoRoute(db, prompt, lang) {
+  const resolvedLang = lang || prefsLang();
+  const prefilter = autoRouteAgent(db, prompt, resolvedLang);
+  let judgment;
+  try {
+    judgment = require("./agentlas-judgment.cjs");
+  } catch {
+    judgment = null;
+  }
+  if (!judgment || !judgment.hasJudgmentRunner()) return { ...prefilter, routeSource: "deterministic" };
+  const promptText = routeNormalize(routeStripPaths(prompt));
+  // 잡담("hi")까지 모델에 물으면 매 턴이 느려진다 — 정확 매칭 가드는 닫힌형이라 결정적 유지.
+  if (!promptText.trim() || isTrivialRoutePrompt(promptText)) return { ...prefilter, routeSource: "deterministic" };
+  const ranked = rankRouteAgents(db, prompt, resolvedLang);
+  const meta = resolveMetaBuilder(db);
+  if (!ranked.length && !meta) return { ...prefilter, routeSource: "deterministic" };
+  // App Builder는 합성 라벨로만 제시한다(동의 핸드셰이크가 걸린 특수 라우트임을 모델에 명시).
+  const appBuilder = ranked.find((r) => r.agent.slug === APP_BUILDER_ROUTE_SLUG) || null;
+  const candidates = ranked.filter((r) => r.agent.slug !== APP_BUILDER_ROUTE_SLUG).slice(0, ROUTE_JUDGE_CANDIDATE_CAP);
+  const bySlug = new Map(candidates.map((r) => [r.agent.slug, r]));
+  const labels = [...bySlug.keys()];
+  const hints = {};
+  const roster = [];
+  for (const r of candidates) {
+    const a = r.agent;
+    const name = [...new Set([a.name, a.name_en].filter(Boolean))].join(" / ");
+    const tagline = [...new Set([a.tagline, a.tagline_en].filter(Boolean))].join(" / ");
+    roster.push(`- ${a.slug}: ${String(name).slice(0, 80)}${tagline ? ` — ${String(tagline).slice(0, 120)}` : ""}`);
+    // 옛 단어목록은 힌트로 강등: 큐레이션 힌트 용어 + 이 프롬프트에서 어휘 스코어러가 맞춘 용어.
+    const curated = ROUTE_HINTS.find((h) => h.slug === a.slug);
+    const hintTerms = [...new Set([...(curated ? curated.terms : []), ...(r.terms || [])])];
+    if (hintTerms.length) hints[a.slug] = hintTerms;
+  }
+  if (appBuilder) {
+    labels.push(ROUTE_JUDGE_APP_LABEL);
+    roster.push(
+      `- ${ROUTE_JUDGE_APP_LABEL}: build a dedicated internal Agentlas App (recurring workflow, durable state, editing surfaces); explicit user consent is asked separately before anything is created`,
+    );
+    hints[ROUTE_JUDGE_APP_LABEL] = APP_BUILDER_EXPLICIT_TERMS;
+  }
+  if (meta) {
+    labels.push(ROUTE_JUDGE_META_LABEL);
+    roster.push(`- ${ROUTE_JUDGE_META_LABEL}: build a NEW agent/team/company itself (the meta-builder)`);
+    hints[ROUTE_JUDGE_META_LABEL] = AGENT_BUILD_TERMS;
+  }
+  labels.push(ROUTE_JUDGE_DIRECT_LABEL);
+  roster.push(`- ${ROUTE_JUDGE_DIRECT_LABEL}: no installed agent clearly fits; answer as the plain assistant`);
+  const verdict = await judgment.judgeLabels({
+    // 라벨 집합(설치 상태)이 바뀌면 캐시 키도 바뀌어야 한다 — kind에 라벨 지문을 넣는다.
+    kind: `terminal-auto-route:${crypto.createHash("sha256").update(labels.join("\n")).digest("hex").slice(0, 12)}`,
+    question: "Which installed agent should own this user request, if any?",
+    labels,
+    input: routeStripPaths(String(prompt || "")),
+    hints,
+    guidance: [
+      "Installed agents:",
+      ...roster,
+      "Mentioning a word is not intent — judge what the user actually asks to be done, in any language.",
+      `Pick "${ROUTE_JUDGE_META_LABEL}" only when the user asks to create a new agent/team/company itself.`,
+      `Pick "${ROUTE_JUDGE_DIRECT_LABEL}" when no installed agent clearly fits the request.`,
+    ].join("\n"),
+    multi: false,
+    fallback: [],
+  });
+  if (verdict.source !== "llm" || !verdict.labels.length) return { ...prefilter, routeSource: "deterministic" };
+  const picked = verdict.labels[0];
+  const reason =
+    verdict.reason ||
+    (resolvedLang === "ko" ? "연결 모델이 요청의 의미로 판정했습니다" : "the connected model judged the request by meaning");
+  if (picked === ROUTE_JUDGE_DIRECT_LABEL) return { ...directRouteChoice(resolvedLang), reason, routeSource: "llm" };
+  if (picked === ROUTE_JUDGE_META_LABEL && meta) {
+    return { agent: meta, score: 1000, strong: true, terms: [], reason, routeSource: "llm" };
+  }
+  const chosen = picked === ROUTE_JUDGE_APP_LABEL ? appBuilder : bySlug.get(picked);
+  if (!chosen) return { ...prefilter, routeSource: "deterministic" };
+  // 모델 확답은 strong 계약을 충족한다 — 어휘 근거(terms/score)는 참고로 보존.
+  return { ...chosen, strong: true, reason, routeSource: "llm" };
+}
+// 라우트 영수증 라벨 — 누가 최종 판정했는지 반드시 찍는다(조용한 폴백 금지 하우스 룰).
+function routeJudgeSourceNote(choice, lang) {
+  if (!choice || !choice.routeSource) return "";
+  if (choice.routeSource === "llm") return lang === "ko" ? " (판정: 연결 모델)" : " (judged by the connected model)";
+  return lang === "ko" ? " (판정: 결정적 폴백 — 연결 모델 없음)" : " (deterministic fallback — no connected-model verdict)";
+}
 function autoRouteNote(choice, lang) {
   const resolvedLang = lang || prefsLang();
+  const sourceNote = routeJudgeSourceNote(choice, resolvedLang);
   if (choice.direct) {
     return resolvedLang === "ko"
-      ? `사용 에이전트: 없음 — 바로 답합니다. 이유: ${choice.reason}.`
-      : `Selected agent: none — answering directly. Reason: ${choice.reason}.`;
+      ? `사용 에이전트: 없음 — 바로 답합니다. 이유: ${choice.reason}.${sourceNote}`
+      : `Selected agent: none — answering directly. Reason: ${choice.reason}.${sourceNote}`;
   }
   const name = resolvedLang === "ko" ? choice.agent.name : choice.agent.name_en || choice.agent.name;
   return resolvedLang === "ko"
-    ? `사용 에이전트: ${name}. 이유: ${choice.reason}.`
-    : `Selected agent: ${name}. Reason: ${choice.reason}.`;
+    ? `사용 에이전트: ${name}. 이유: ${choice.reason}.${sourceNote}`
+    : `Selected agent: ${name}. Reason: ${choice.reason}.${sourceNote}`;
 }
 function autoRoutePreamble(choice, lang) {
   const resolvedLang = lang || prefsLang();
@@ -8507,6 +8613,48 @@ const RUNTIME_BIN = {
 };
 
 // 활성 런타임 → 실행 방식 결정. CLI(claude/codex/gemini) 또는 API(BYOK/Ollama).
+/**
+ * Wire the resident judgment service to whatever runtime the user actually has connected.
+ * This is what lets classification be decided by MEANING instead of by a wordlist: the
+ * judge asks the connected model, and the old keyword maps are passed only as hints. It is
+ * invisible to the user (no output, read-only, no tools) and every judged call falls back
+ * to the deterministic prefilter when no runtime answers.
+ */
+function installJudgmentRunner(db, rt) {
+  let judgment;
+  try {
+    judgment = require("./agentlas-judgment.cjs");
+  } catch {
+    return;
+  }
+  if (!rt || rt.mode !== "cli" || !RUNTIME_BIN[rt.kind]) {
+    judgment.setJudgmentRunner(null);
+    return;
+  }
+  judgment.setJudgmentRunner(async ({ system, prompt, signal }) => {
+    const { runNativeTurn } = require("./agentlas-native-host.cjs");
+    const { Ui } = require("./agentlas-ui.cjs");
+    const silent = new Ui({ lang: prefsLang(), quiet: true });
+    for (const method of ["write", "warn", "info", "tool", "result", "status", "line"]) {
+      if (typeof silent[method] === "function") silent[method] = () => {};
+    }
+    const res = await runNativeTurn({
+      kind: rt.kind,
+      bin: RUNTIME_BIN[rt.kind],
+      prompt,
+      systemPrompt: system,
+      cwd: projectCwd(),
+      permission: "read",
+      session: {},
+      ui: silent,
+      env: process.env,
+      signal,
+    });
+    if (res && res.error) return "";
+    return (res && res.text) || "";
+  });
+}
+
 function resolveRuntime(db, override) {
   const ar = activeRuntime(db);
   const activeCli = ar && RUNTIME_BIN[ar.kind]
@@ -8850,6 +8998,9 @@ async function executeOnce(db, system, prompt, override, ctx) {
   }
   const rt = resolveRuntime(db, override);
   memoryRuntime = rt;
+  // The resident judge uses the same connected runtime, so wordlist-based classification is
+  // replaced by meaning-based judgment for this turn.
+  installJudgmentRunner(db, rt);
   if (rt.mode === "cli") {
     // 네이티브 CLI에도 같은 Memory emitter를 주입하되 guard가 화면의 JSON 블록을 숨긴다.
     // 큐레이터가 만든 구조화 Memory만 성공 RunReceipt 이후 Experience intake로 전달된다.
@@ -9502,6 +9653,7 @@ function buildHelpers(db) {
     listFirms,
     firmSystemPrompt,
     autoRouteAgent: (db_, prompt, lang) => autoRouteAgent(db_, prompt, lang),
+    resolveAutoRoute: (db_, prompt, lang) => resolveAutoRoute(db_, prompt, lang),
     autoRouteNote: (choice, lang) => autoRouteNote(choice, lang),
     autoRoutePreamble: (choice, lang) => autoRoutePreamble(choice, lang),
     directSystemPrompt: (lang) => directSystemPrompt(lang),
@@ -10185,7 +10337,8 @@ async function cmdRun(db, query, prompt, runtimeOverride, runtimeExperience = nu
 
 async function cmdAutoRun(db, prompt, runtimeOverride, runtimeExperience = null) {
   const lang = prefsLang();
-  const choice = autoRouteAgent(db, prompt, lang);
+  // 연결 모델이 라우트를 최종 판정한다 — 어휘 스코어는 후보 모집/라벨 붙은 폴백 전용.
+  const choice = await resolveAutoRoute(db, prompt, lang);
   if (!choice) fail("No agent is available for automatic routing. Check installation with agentlas list.");
   if (choice.direct) {
     // 전문 에이전트 확신 없음 → 페르소나/능력 라우팅 없이 현재 런타임으로 직답.
@@ -11982,6 +12135,8 @@ module.exports = {
   ANTHROPIC_COMPAT_API,
   // 자동 라우팅 회귀 테스트 표면 — 약한 매치 직답/오라우팅 방지 규칙 검증용.
   autoRouteAgent,
+  // 모델 최종 라우팅 — 어휘 점수는 후보 모집 전용, 연결 모델이 의미로 판정.
+  resolveAutoRoute,
   autoRouteNote,
   autoRoutePreamble,
   directSystemPrompt,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentlas",
-  "version": "0.9.5",
+  "version": "0.9.6",
   "description": "Agentlas agent terminal — chat with your installed AI agents and teams from the terminal, Claude Code style. Standalone: no desktop app required.",
   "bin": {
     "agentlas": "bin/agentlas.cjs"