agentlas 1.0.59 → 1.0.61

package/engine/agentlas-memory-governance.cjs

@@ -146,13 +146,53 @@ function normalizeOutcome(value) {
   return "completed";
 }
 
-function ownerPolicyFromPrompt(prompt) {
-  const text = String(prompt || "");
-  const explicitMemory = /\b(?:remember|memorize|save|record|store|keep)\b|기억|메모리|저장|기록|남겨/i.test(text);
-  const explicitGlobal = /\b(?:global(?:ly)?|all projects|every project|across projects|user profile|account-wide)\b|전역|모든\s*프로젝트|프로젝트\s*전체|사용자\s*프로필/i.test(text);
-  return {
-    globalWriteAuthorized: explicitMemory && explicitGlobal,
-  };
+/*
+ * 2026-08-20: ownerPolicyFromPrompt(단어장 — remember/전역 등 regex AND) 제거.
+ * 전역 메모리 쓰기 권한을 부여하는 길은 둘뿐이다:
+ *   1) 호스트가 넘긴 구조화 플래그(beginTurn input.ownerPolicy) — 기계 표식이 우선.
+ *   2) 판정기(agentlas-judgment) 경유 — resolveGlobalWriteAuthorization.
+ * 판정 불가면 부여하지 않는다(fail-closed). 단어장은 어떤 언어도 다 못 세는 데다,
+ * 제3언어의 명시적 요청을 영구히 거부하고 우연한 단어 일치로 권한을 넓혔다.
+ */
+function normalizeOwnerPolicy(value) {
+  return { globalWriteAuthorized: Boolean(value && value.globalWriteAuthorized === true) };
+}
+
+async function resolveGlobalWriteAuthorization(prompt, options = {}) {
+  const text = String(prompt || "").trim();
+  if (!text) return { authorized: false, source: "unavailable" };
+  // 호스트가 판정 함수를 주입할 수 있다(세션이 자기 연결 런타임으로 감쌈).
+  if (typeof options.judge === "function") {
+    try {
+      const judged = await options.judge(text);
+      return judged && judged.source === "llm"
+        ? { authorized: judged.authorized === true, source: "llm" }
+        : { authorized: false, source: "unavailable" };
+    } catch {
+      return { authorized: false, source: "unavailable" };
+    }
+  }
+  let judgment;
+  try {
+    judgment = options.judgment || require("./agentlas-judgment.cjs");
+  } catch {
+    return { authorized: false, source: "unavailable" };
+  }
+  if (!judgment.hasJudgmentRunner()) return { authorized: false, source: "unavailable" };
+  const verdict = await judgment.judgeLabels({
+    kind: "terminal-memory-global-write",
+    question:
+      "Does this request EXPLICITLY ask to save or remember something as a GLOBAL memory that applies across all projects (user profile / account-wide), rather than only this project, session, or task?",
+    labels: ["authorize_global_memory_write"],
+    input: text,
+    multi: false,
+    guidance:
+      "Authorize only an explicit, unambiguous request to persist a memory globally, in any language. Ordinary task prompts, project-scoped notes, or incidental mentions of memory do NOT authorize. When uncertain, select nothing.",
+    signal: options.signal,
+    timeoutMs: options.timeoutMs,
+  });
+  if (verdict.source !== "llm") return { authorized: false, source: "unavailable" };
+  return { authorized: verdict.labels.includes("authorize_global_memory_write"), source: "llm" };
 }
 
 function tableExists(db, name) {
@@ -245,7 +285,9 @@ function beginTurn(db, input = {}) {
   const pKey = projectKey(input.projectPath);
   const oKey = ownerKey(input.agentId);
   const explicitTurnId = validTurnId(input.stableTurnId);
-  const policy = ownerPolicyFromPrompt(input.prompt);
+  // 시작 시점 정책은 호스트 구조화 플래그만 반영한다(없으면 fail-closed false).
+  // 판정 경유 승격은 completeTurn에서, 실제로 user_global 후보가 나왔을 때만 1회 수행된다.
+  const policy = normalizeOwnerPolicy(input.ownerPolicy);
   const conversationDigest = sha256(input.conversationRef || "none");
   const priorDigest = sha256(input.priorContextDigest || input.priorContext || "none");
   const contextKey = sha256(stableJson({
@@ -823,6 +865,28 @@ async function completeTurn(db, input = {}) {
     };
   }
 
+  // 전역 쓰기 승격은 필요할 때만 1회 — 어떤 후보가 실제로 user_global 스코프를
+  // 청했고, 시작 시점 정책(호스트 플래그)이 승인하지 않았을 때. 판정기(또는 호스트가
+  // 주입한 judge)가 명시적 요청이라고 판정한 경우에만 켠다. 판정 불가 = 부여 안 함.
+  if (
+    turn.ownerPolicy?.globalWriteAuthorized !== true
+    && normalizePermission(turn.permission) !== "read"
+    && parsed.candidates.some(
+      (candidate) => candidate.suggestedScope === "user_global" && candidate.preGateReasons.length === 0,
+    )
+  ) {
+    const judged = await resolveGlobalWriteAuthorization(input.requestText, {
+      judge: input.judgeGlobalAuthorization,
+    });
+    if (judged.authorized === true && judged.source === "llm") {
+      turn.ownerPolicy = { ...turn.ownerPolicy, globalWriteAuthorized: true };
+      try {
+        db.prepare("UPDATE terminal_memory_turn_intents SET owner_policy_json=? WHERE turn_id=?")
+          .run(JSON.stringify(turn.ownerPolicy), turnId);
+      } catch { /* 감사 기록 실패가 이번 완결을 막지는 않는다 */ }
+    }
+  }
+
   const payload = buildCuratorPayload(turn, parsed, input);
   let curatorStatus = "unavailable";
   let semantic = { status: "unavailable", decisions: new Map() };
@@ -878,7 +942,20 @@ async function completeTurn(db, input = {}) {
       if (!dbScope) continue;
       const scopedProjectId = decision.finalScope === "user_global" ? null : turn.projectKey;
       const scopedProjectPath = decision.finalScope === "user_global" ? null : boundProjectPath;
-      const scopedAgentId = ["team", "agent"].includes(decision.finalScope) ? boundAgentId : null;
+      /*
+       * ★팀 공유 기억에는 주인이 없다 (2026-08-26)
+       *
+       * 이 엔진은 데스크탑과 **같은 SQLite 파일의 같은 `memory_entries` 표**를 쓴다
+       * (engine/core/paths.cjs — 같은 userData 공유가 제품 계약이다). 그런데 같은 "팀 공유"
+       * 결정을 데스크탑은 `agent_id = NULL` 로, 여기서는 `agent_id = <agentId>` 로 넣고
+       * 있었다. 한 표에 두 관례가 섞이면 ① 같은 사실이 주인 다른 두 줄로 남아 중복 제거가
+       * 갈리고 ② 정리기가 그 줄을 개인 기억으로 오인한다.
+       *
+       * 정본은 데스크탑 쪽이다 — 팀 공유는 조직도가 바뀌어도 남아야 하므로 특정 에이전트에
+       * 매이지 않는다. 데스크탑의 같은 규칙: shared/memory-ownership.ts `memoryOwnerAgentId`
+       * (`agt_team_` 낙인이거나 신원이 없으면 개인 칸이 없다).
+       */
+      const scopedAgentId = decision.finalScope === "agent" ? boundAgentId : null;
       let memoryId = null;
       try {
         const duplicate = db.prepare(
@@ -1010,7 +1087,8 @@ module.exports = {
   DEFAULT_EVENTS_HEADING,
   CURATOR_SYSTEM_PROMPT,
   ensureGovernanceSchema,
-  ownerPolicyFromPrompt,
+  normalizeOwnerPolicy,
+  resolveGlobalWriteAuthorization,
   projectKey,
   ownerKey,
   contentGateReasons,

package/engine/agentlas-permissions.cjs

@@ -98,4 +98,98 @@ function createCycleController(options = {}) {
   };
 }
 
-module.exports = { LEVELS, isLevel, normalize, persistent, next, copy, createCycleController };
+/*
+ * ── 통합 능력 승인(데스크탑 capability_grants)과의 합류 ───────────────────────
+ *
+ * 이 모듈은 오래도록 read/write/full 세 낱말만 알았다. 그런데 오너 결정(2026-08-20)
+ * 이후 "무엇을 해도 되는가"의 정본은 등급이 아니라 **행동 규칙**이다: 데스크탑에서
+ * "항상 허용"한 행동은 read 등급에서도 통과해야 하고, 영구 거부된 행동은 full 등급으로도
+ * 뚫리지 않아야 한다. 등급은 규칙이 없을 때의 기본값으로 남는다.
+ *
+ * 우선순위는 데스크탑 중재자(electron/ipc.ts setRuntimeToolPermissionArbiter)와 **같은
+ * 문장**이다. 갈리면 같은 행동에 두 제품이 다른 답을 준다:
+ *   1) 저장된 규칙 deny  → deny (등급 무관)
+ *   2) 저장된 규칙 allow → allow (등급 무관)
+ *   3) permission=full   → allow
+ *   4) 비변이(mutating=false) → allow
+ *   5) permission=write  → allow
+ *   6) 그 외(read + 변이) → null = 경계를 넘는 요청. 호출부가 묻거나 거부한다.
+ */
+
+/** 능력 규칙 모듈은 공유 DB 를 열므로 지연 로드한다(권한 어휘만 쓰는 호출부에 부담 금지). */
+function grantsModule() {
+  return require("./core/capability-grants.cjs");
+}
+
+/**
+ * 한 번의 도구/서버 실행에 대한 판정.
+ *
+ * @param {object|null} db 공유 DB 핸들. 없으면 규칙을 못 읽고 등급 기본값만 쓴다.
+ * @param {object} ask { capability?, kind?, tool, detail?, agentId?, chatId?, mutating?, permission? }
+ * @returns {{decision:"allow"|"deny"|null, source:string, ruled:"allow"|"deny"|null,
+ *            grantsAvailable:boolean, reason:string|null, capability:string}}
+ */
+function decideCapability(db, ask) {
+  const grants = grantsModule();
+  const capability = ask && ask.capability
+    ? String(ask.capability)
+    : grants.capabilityClassFor(String((ask && ask.kind) || ""), String((ask && ask.tool) || ""));
+  const query = {
+    capability,
+    tool: ask && ask.tool ? String(ask.tool) : undefined,
+    detail: ask && ask.detail ? String(ask.detail) : undefined,
+    agentId: ask && ask.agentId ? String(ask.agentId) : undefined,
+    chatId: ask && ask.chatId ? String(ask.chatId) : undefined,
+  };
+  const ruling = db
+    ? grants.readCapabilityDecision(db, query)
+    : { decision: null, available: false, reason: "no shared database handle was provided to the capability gate" };
+
+  if (ruling.decision === "deny") {
+    return { decision: "deny", source: "capability-grants", ruled: "deny", grantsAvailable: ruling.available, reason: ruling.reason, capability };
+  }
+  if (ruling.decision === "allow") {
+    return { decision: "allow", source: "capability-grants", ruled: "allow", grantsAvailable: ruling.available, reason: ruling.reason, capability };
+  }
+
+  const level = normalize(ask && ask.permission);
+  const mutating = !!(ask && ask.mutating);
+  if (level === "full") {
+    return { decision: "allow", source: "permission-level", ruled: null, grantsAvailable: ruling.available, reason: ruling.reason, capability };
+  }
+  if (!mutating) {
+    return { decision: "allow", source: "non-mutating", ruled: null, grantsAvailable: ruling.available, reason: ruling.reason, capability };
+  }
+  if (level === "write") {
+    return { decision: "allow", source: "permission-level", ruled: null, grantsAvailable: ruling.available, reason: ruling.reason, capability };
+  }
+  return { decision: null, source: "boundary", ruled: null, grantsAvailable: ruling.available, reason: ruling.reason, capability };
+}
+
+/**
+ * 터미널에서 사용자가 "항상 허용"을 골랐을 때 **같은 표**에 남긴다 — 데스크탑도 이
+ * 규칙을 읽으므로 다음부터 양쪽 모두 묻지 않는다. 규칙 키는 데스크탑 persistAlwaysGrant
+ * 와 동일: capability `tool:<name>` + 일반화된 인자 패턴 + scope global.
+ */
+function rememberAlwaysAllow(db, ask, options = {}) {
+  const grants = grantsModule();
+  return grants.recordCapabilityGrant(db, {
+    capability: `tool:${String((ask && ask.tool) || "")}`,
+    pattern: grants.generalizeDetailPattern(ask && ask.detail),
+    decision: options.decision === "deny" ? "deny" : "allow",
+    scope: options.scope || "global",
+    source: options.source || "terminal-chip",
+  });
+}
+
+module.exports = {
+  LEVELS,
+  isLevel,
+  normalize,
+  persistent,
+  next,
+  copy,
+  createCycleController,
+  decideCapability,
+  rememberAlwaysAllow,
+};

package/engine/agentlas-tools.cjs

@@ -322,12 +322,55 @@ function allowedTools(permission) {
   return TOOLS.filter((t) => (PERM_RANK[t.minPerm] ?? 0) <= rank);
 }
 
+/*
+ * ── 능력 규칙(공유 capability_grants)이 등급보다 먼저다 ──────────────────────
+ *
+ * 오너 결정(2026-08-20): 승인은 행동 기준이고 데스크탑·터미널이 **공유**한다.
+ *  · 데스크탑에서 "항상 허용"한 행동 → 터미널에서 등급이 낮아도 통과(다시 묻지 않는다).
+ *  · 데스크탑에서 영구 거부한 행동  → 터미널에서 full 권한이어도 거부.
+ * 규칙이 없을 때만 아래의 기존 등급 게이트가 답한다(기존 동작 그대로).
+ *
+ * ctx.db 가 없으면(단위 테스트·DB 없는 호출) 규칙을 못 읽으므로 종전 등급 게이트만 돈다.
+ */
+function toolAskFor(tool, args) {
+  const kind = tool.minPerm === "read" ? "read" : tool.name === "bash" ? "execute" : "edit";
+  const detail = tool.name === "bash"
+    ? String((args && args.command) || "").trim()
+    : String((args && args.path) || "").trim();
+  return { tool: tool.name, kind, detail: detail || undefined, mutating: kind !== "read" };
+}
+
 // 툴 1개 실행 → { ok, content }. 권한 부족/에러는 ok:false 문자열로.
 function runTool(name, args, ctx) {
   const tool = BY_NAME[name];
   if (!tool) return { ok: false, content: `unknown tool: ${name}` };
+  const ask = toolAskFor(tool, args);
+  let ruled = null;
+  if (ctx && ctx.db) {
+    try {
+      const permissions = require("./agentlas-permissions.cjs");
+      const verdict = permissions.decideCapability(ctx.db, {
+        ...ask,
+        permission: ctx.permission,
+        agentId: ctx.agentId,
+        chatId: ctx.chatId,
+      });
+      ruled = verdict.ruled;
+      if (ruled === "deny") {
+        return {
+          ok: false,
+          content:
+            `capability denied: '${name}'${ask.detail ? ` (${ask.detail})` : ""} is permanently denied by a shared ` +
+            "capability rule (Desktop/Terminal share capability_grants). Remove that rule to allow it.",
+        };
+      }
+    } catch {
+      // 규칙을 못 읽는 것이 허용이 되면 안 되고, 실행을 죽여서도 안 된다 — 기존 등급 게이트로 간다.
+      ruled = null;
+    }
+  }
   const rank = PERM_RANK[ctx.permission] ?? 0;
-  if ((PERM_RANK[tool.minPerm] ?? 0) > rank) {
+  if (ruled !== "allow" && (PERM_RANK[tool.minPerm] ?? 0) > rank) {
     return {
       ok: false,
       content: `permission denied: '${name}' requires '${tool.minPerm}' but current is '${ctx.permission}'. Ask the user to run /permission ${tool.minPerm}.`,
@@ -355,4 +398,4 @@ function openaiTools(permission) {
   }));
 }
 
-module.exports = { TOOLS, BY_NAME, allowedTools, runTool, anthropicTools, openaiTools, PERM_RANK };
+module.exports = { TOOLS, BY_NAME, allowedTools, runTool, anthropicTools, openaiTools, PERM_RANK, toolAskFor };

package/engine/agents/builder.cjs

@@ -29,6 +29,10 @@ const BUILDER_SYSTEM_PROMPT = [
   "  - AGENTS.md — the agent's full system prompt / soul: who it is, what it does, how it behaves, its guardrails. Write it as the instructions the agent itself will run under. Be specific and production-ready, not a description of the agent.",
   "  - manifest.md — first line `# <Agent Name>`, second line a one-sentence tagline.",
   "  - README.md — a short human-facing summary of what the agent does and how to use it.",
+  "  - agentlas.json — `{ \"schemaVersion\": \"1.0\", \"name\": \"<Agent Name>\", \"slug\": \"<kebab-case-slug>\", \"entry\": \"AGENTS.md\", \"skills\": [] }`. Do NOT invent an agentId; the identity is minted once by the packaging path and must never be typed by hand.",
+  "",
+  "If the agent needs reusable procedures, add them as `.claude/skills/<skill-name>/SKILL.md`.",
+  "A skill's name IS its folder name: the frontmatter `name:` must equal the folder exactly, and `agentlas.json` skills[] must list exactly those folder names. Never write a placeholder like `{{SKILL_ID_1}}` — leave the list empty instead.",
   "",
   "Rules:",
   "  - Decide the agent's scope from the request; if the request is thin, choose sensible, specific defaults and state them in README.md rather than asking endless questions.",

package/engine/architecture.data.json

@@ -116,7 +116,7 @@
       "systemPrompt": "# Task Bias Curator (Agentlas built-in)\n\nYou reduce TASK BIAS in multi-surface projects — the tendency to keep working on\nsurfaces that are recent, salient, or easy to measure while other surfaces stay\nuninspected. You are a SECOND-ORDER control role: you adjust the rules of work\nallocation and evidence review; you do not implement product work yourself, and you\ncannot mark a node \"complete\".\n\n## External state: the AI Sitemap\nThe project's shared external state lives in .agentlas/sitemap.json. Each\nnode carries: node_id, kind, status (unknown|todo|in_progress|blocked|validated|revalidate),\ncompletion_score (0..1, evidence-backed), risk_level, last_modified, last_tested,\ndependencies, acceptance_checks, evidence, provisional.\n\n## What you do\n1. Read/maintain the sitemap. Create provisional nodes for newly discovered surfaces.\n2. Choose the next bounded task from a VISIBLE priority policy, not recent chat context:\n   prioritize high risk, low completion_score, stale last_tested, and blocking dependencies.\n3. Audit for bias: which surfaces are over-worked vs never inspected? Name them.\n4. Audit validation: flag completion claims without evidence or with weak evidence;\n   require revalidation and name the missing evidence.\n5. Produce a compact, reversible curator decision record. Escalate mission-level changes\n   to the user.\n\n## Boundaries\nCannot mark a node complete. Cannot erase evidence (only supersede it with a logged\ndecision). Cannot expand the project mission without explicit user approval.\n\nKeep outputs small: a policy/priority recommendation, a revalidation request, a\nsitemap update proposal, or a provisional-node decision."
     },
     {
-      "id": "builtin-agentlas-orchestrator",
+      "id": "builtin-agentlas-one",
       "slug": "agentlas-one",
       "name": "Agentlas One",
       "nameEn": "Agentlas One",

package/engine/bootstrap-schema.sql

@@ -1,4 +1,4 @@
--- Agentlas 첫 실행 부트스트랩 스키마 (생성: 2026-08-18T11:06:30Z)
+-- Agentlas 첫 실행 부트스트랩 스키마 (생성: 2026-08-26T07:56:09Z)
 --
 -- ★생성물이다. 손으로 고치지 말고 재생성하라:
 --     node scripts/gen-bootstrap-schema.cjs
@@ -6,7 +6,7 @@
 -- 정본은 Desktop 의 마이그레이션 사다리(agentlas_desktop/electron/store/db.ts, SCHEMA_VERSION).
 -- 이 파일은 그 사다리를 **빈 DB** 에 끝까지 돌린 결과의 덤프이므로, 터미널이 만든 DB 는
 -- 처음부터 사다리 머리에 있다 — 데스크탑이 나중에 승급할 것이 남지 않는다.
-PRAGMA user_version=97;
+PRAGMA user_version=104;
 CREATE TABLE active_runtime (
         id INTEGER PRIMARY KEY CHECK(id = 1),
         kind TEXT NOT NULL
@@ -98,6 +98,22 @@ CREATE TABLE agent_evolution_receipts (
         FOREIGN KEY(agent_id) REFERENCES installed_agents(id) ON DELETE CASCADE,
         UNIQUE(proposal_id, action)
       );
+CREATE TABLE agent_identity_map (
+        -- CASCADE 다. 대응표는 **파생 데이터**이고 정본은 패키지의 agentId 다.
+        -- RESTRICT 로 두면 에이전트 삭제가 6곳에서 막힌다 — 사용자 삭제, 중복정리 2곳,
+        -- 설치 실패 롤백, One 멤버 생성 실패 롤백, 터미널 삭제. 롤백이 막히면
+        -- "설치 실패"가 "설치 실패 + 복구 실패 + 유령 행"이 된다.
+        local_id            TEXT PRIMARY KEY REFERENCES installed_agents(id) ON DELETE CASCADE,
+        -- 이름을 agent_id 로 두면 agent-dedupe 의 컬럼명 스윕에 걸린다. 값이 달라
+        -- 지금은 매칭이 0건이지만, 이름 우연에 기대는 구조 자체가 지뢰다.
+        immutable_agent_id  TEXT NOT NULL,
+        agent_version       INTEGER NOT NULL DEFAULT 1,
+        -- package: 패키지 agentlas.json 에서 읽음 (정본)
+        -- builtin-reserved: 앱에 구워진 에이전트 — 패키지가 없어 예약 네임스페이스를 쓴다
+        -- minted-local: 출처가 없어 이 기기에서 발급 (다음에 패키지를 받으면 package 가 이긴다)
+        mapping_source      TEXT NOT NULL,
+        bound_at            TEXT NOT NULL
+      );
 CREATE TABLE agent_mcp_servers (
         agent_id TEXT NOT NULL,
         server_id TEXT NOT NULL,
@@ -470,6 +486,16 @@ CREATE TABLE browser_sites (
         created_at TEXT NOT NULL,
         updated_at TEXT NOT NULL
       );
+CREATE TABLE capability_grants (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      capability TEXT NOT NULL,
+      pattern TEXT,
+      decision TEXT NOT NULL CHECK(decision IN ('allow','deny')),
+      scope TEXT NOT NULL DEFAULT 'global',
+      source TEXT NOT NULL DEFAULT 'chip',
+      created_at TEXT NOT NULL,
+      UNIQUE(capability, pattern, scope)
+    );
 CREATE TABLE chat_goal_contracts (
       goal_id TEXT PRIMARY KEY,
       chat_id TEXT NOT NULL,
@@ -503,25 +529,44 @@ CREATE TABLE chat_messages (
         created_at TEXT NOT NULL,
         FOREIGN KEY(chat_id) REFERENCES chats(id) ON DELETE CASCADE
       );
-CREATE TABLE chat_runtime_sessions (
-        chat_id TEXT NOT NULL,
-        kind TEXT NOT NULL,
-        session_id TEXT NOT NULL,
-        fingerprint TEXT NOT NULL,
-        updated_at TEXT NOT NULL, reported_output_tokens INTEGER, reported_input_tokens INTEGER, reported_cached_input_tokens INTEGER,
-        PRIMARY KEY (chat_id, kind),
-        FOREIGN KEY(chat_id) REFERENCES chats(id) ON DELETE CASCADE
-      );
-CREATE TABLE chats (
-        id TEXT PRIMARY KEY,
-        project_id TEXT,
-        agent_id TEXT NOT NULL,
-        title TEXT NOT NULL DEFAULT 'New chat',
-        created_at TEXT NOT NULL,
-        updated_at TEXT NOT NULL, firm_id TEXT REFERENCES firms(id) ON DELETE SET NULL, archived_at TEXT, working_folder TEXT, kind TEXT NOT NULL DEFAULT 'user', parent_chat_id TEXT, used_at TEXT, continuous_mode INTEGER NOT NULL DEFAULT 0, swarm_mode INTEGER NOT NULL DEFAULT 0, last_viewed_at TEXT, hired_agents TEXT, origin_surface TEXT NOT NULL DEFAULT 'work', runtime_selection_json TEXT, goal_id TEXT,
-        FOREIGN KEY(project_id) REFERENCES projects(id) ON DELETE SET NULL,
-        FOREIGN KEY(agent_id) REFERENCES installed_agents(id) ON DELETE CASCADE
-      );
+CREATE TABLE "chat_runtime_sessions" (
+                chat_id TEXT NOT NULL,
+                kind TEXT NOT NULL,
+                agent_id TEXT NOT NULL DEFAULT '',
+                session_id TEXT NOT NULL,
+                fingerprint TEXT NOT NULL,
+                updated_at TEXT NOT NULL,
+                reported_output_tokens INTEGER,
+                reported_input_tokens INTEGER,
+                reported_cached_input_tokens INTEGER,
+                PRIMARY KEY (chat_id, kind, agent_id),
+                FOREIGN KEY(chat_id) REFERENCES chats(id) ON DELETE CASCADE
+              );
+CREATE TABLE "chats" (
+            id TEXT PRIMARY KEY,
+            project_id TEXT,
+            title TEXT NOT NULL DEFAULT 'New chat',
+            created_at TEXT NOT NULL,
+            updated_at TEXT NOT NULL,
+            firm_id TEXT,
+            archived_at TEXT,
+            working_folder TEXT,
+            kind TEXT NOT NULL DEFAULT 'user',
+            parent_chat_id TEXT,
+            used_at TEXT,
+            continuous_mode INTEGER NOT NULL DEFAULT 0,
+            swarm_mode INTEGER NOT NULL DEFAULT 0,
+            last_viewed_at TEXT,
+            hired_agents TEXT,
+            origin_surface TEXT NOT NULL DEFAULT 'work',
+            runtime_selection_json TEXT,
+            goal_id TEXT,
+            seat_id TEXT,
+            agent_id TEXT, seat_label TEXT, seat_kind TEXT, participants_json TEXT,
+            FOREIGN KEY(project_id) REFERENCES projects(id) ON DELETE SET NULL,
+            FOREIGN KEY(seat_id) REFERENCES one_seats(id) ON DELETE CASCADE,
+            FOREIGN KEY(agent_id) REFERENCES installed_agents(id) ON DELETE SET NULL
+          );
 CREATE TABLE experience_auto_intake_receipts (
         id TEXT PRIMARY KEY,
         agent_id TEXT NOT NULL,
@@ -979,6 +1024,100 @@ CREATE TABLE model_roles (
         updated_at TEXT NOT NULL,
         CHECK(role = 'worker' OR inherit = 0)
       );
+CREATE TABLE one_artifact_bindings (
+      id TEXT PRIMARY KEY,
+      task_id TEXT NOT NULL,
+      task_version INTEGER NOT NULL,
+      bound_task_version INTEGER NOT NULL,
+      chat_id TEXT NOT NULL,
+      run_id TEXT NOT NULL,
+      manifest_id TEXT NOT NULL,
+      artifact_ref TEXT NOT NULL,
+      source_path TEXT NOT NULL,
+      kind TEXT NOT NULL,
+      mime_type TEXT NOT NULL,
+      size_bytes INTEGER NOT NULL,
+      file_dev TEXT NOT NULL,
+      file_ino TEXT NOT NULL,
+      file_mtime_ns TEXT NOT NULL,
+      file_ctime_ns TEXT NOT NULL,
+      sha256 TEXT NOT NULL,
+      created_at TEXT NOT NULL,
+      UNIQUE(task_id, chat_id, run_id, manifest_id, artifact_ref)
+    );
+CREATE TABLE one_org_completion_cache (
+      installed_agent_id TEXT PRIMARY KEY,
+      run_id TEXT,
+      summary_json TEXT NOT NULL,
+      updated_at TEXT NOT NULL
+    );
+CREATE TABLE one_org_members (
+      id TEXT PRIMARY KEY,
+      agent_slug TEXT NOT NULL,
+      installed_agent_id TEXT NOT NULL,
+      display_name TEXT,
+      icon TEXT NOT NULL DEFAULT 'one-puppy',
+      sort_order INTEGER NOT NULL DEFAULT 0,
+      source TEXT NOT NULL CHECK(source IN ('local','cloud','hub')),
+      lease_expires_at TEXT,
+      added_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL,
+      archived_at TEXT,
+      status_kind TEXT NOT NULL DEFAULT 'new',
+      -- PRD §4.33 — 스키마에 사람이 읽는 문구(그것도 한 언어)를 박지 않는다.
+      -- 빈 값이면 투영이 로케일 표에서 "아직 맡은 일 없음 / No work assigned yet"을 만든다.
+      status_line TEXT NOT NULL DEFAULT '',
+      last_activity_at TEXT,
+      pending_count INTEGER NOT NULL DEFAULT 0,
+      pending_kind TEXT NOT NULL DEFAULT 'approval' CHECK(pending_kind IN ('approval','review','input')),
+      unread_count INTEGER NOT NULL DEFAULT 0,
+      credit_state TEXT NOT NULL DEFAULT 'unknown' CHECK(credit_state IN ('ok','insufficient','unknown')),
+      auto_select_tools INTEGER NOT NULL DEFAULT 1 CHECK(auto_select_tools IN (0,1)),
+      collaboration_style TEXT NOT NULL DEFAULT 'default' CHECK(collaboration_style IN ('default','concise','warm','direct')),
+      handover_note TEXT,
+      revision INTEGER NOT NULL DEFAULT 1
+    );
+CREATE TABLE one_seat_occupants (
+        seat_id      TEXT NOT NULL REFERENCES one_seats(id) ON DELETE CASCADE,
+        slot         INTEGER NOT NULL DEFAULT 0,
+        agent_id     TEXT,
+        display_name TEXT NOT NULL DEFAULT '',
+        since        TEXT NOT NULL,
+        until        TEXT,
+        PRIMARY KEY (seat_id, slot, since)
+      );
+CREATE TABLE one_seats (
+        id          TEXT PRIMARY KEY,
+        kind        TEXT NOT NULL CHECK(kind IN ('solo','group')),
+        title       TEXT NOT NULL DEFAULT '',
+        project_id  TEXT REFERENCES projects(id) ON DELETE SET NULL,
+        created_at  TEXT NOT NULL,
+        updated_at  TEXT NOT NULL,
+        archived_at TEXT
+      , dissolved_at TEXT);
+CREATE TABLE one_taskforces (
+      id TEXT PRIMARY KEY,
+      chat_id TEXT NOT NULL UNIQUE,
+      title TEXT NOT NULL,
+      description TEXT NOT NULL DEFAULT '',
+      member_agent_ids_json TEXT NOT NULL DEFAULT '[]',
+      created_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL,
+      revision INTEGER NOT NULL DEFAULT 1,
+      FOREIGN KEY(chat_id) REFERENCES chats(id) ON DELETE CASCADE
+    );
+CREATE TABLE plugin_builder_sessions (
+        id TEXT PRIMARY KEY,
+        chat_id TEXT NOT NULL,
+        slug TEXT,
+        phase TEXT NOT NULL CHECK(phase IN ('interview','draft','verify','install','prove','discarded')),
+        staging_dir TEXT,
+        answers_json TEXT,
+        gate_report_json TEXT,
+        seed_json TEXT NOT NULL,
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL
+      );
 CREATE TABLE project_agent_rent_allow (
       project_id TEXT NOT NULL,
       slug TEXT NOT NULL,
@@ -1123,7 +1262,7 @@ CREATE TABLE "telegram_bindings" (
         designated_project_id TEXT REFERENCES projects(id) ON DELETE SET NULL,
         designated_graph_id TEXT,
         legacy_notice_at TEXT
-      );
+      , seat_id TEXT);
 CREATE INDEX idx_agent_app_ops_app_created
         ON agent_app_operations(app_id, created_at DESC);
 CREATE INDEX idx_agent_apps_chat_updated
@@ -1142,6 +1281,8 @@ CREATE INDEX idx_agent_evolution_receipts_agent
         ON agent_evolution_receipts(agent_id, created_at DESC);
 CREATE INDEX idx_agent_evolution_receipts_proposal
         ON agent_evolution_receipts(proposal_id, created_at ASC);
+CREATE INDEX idx_agent_identity_map_agent ON agent_identity_map(immutable_agent_id);
+CREATE INDEX idx_agent_identity_map_source ON agent_identity_map(mapping_source);
 CREATE INDEX idx_agent_mcp_agent ON agent_mcp_servers(agent_id);
 CREATE INDEX idx_agent_runtime_overrides_updated
         ON agent_runtime_overrides(updated_at DESC);
@@ -1205,6 +1346,7 @@ CREATE INDEX idx_browser_logs_ts ON browser_action_logs(ts DESC);
 CREATE UNIQUE INDEX idx_browser_perm_site_action
         ON browser_permissions(site, action_type);
 CREATE UNIQUE INDEX idx_browser_sessions_site ON browser_sessions(site);
+CREATE INDEX idx_capability_grants_scope ON capability_grants(scope);
 CREATE UNIQUE INDEX idx_chat_goal_contracts_active_chat
       ON chat_goal_contracts(chat_id)
       WHERE status = 'active';
@@ -1217,6 +1359,7 @@ CREATE INDEX idx_chats_firm_updated ON chats(firm_id, updated_at DESC);
 CREATE INDEX idx_chats_parent ON chats(parent_chat_id);
 CREATE INDEX idx_chats_project_updated
         ON chats(project_id, updated_at DESC);
+CREATE INDEX idx_chats_seat_updated ON chats(seat_id, updated_at DESC);
 CREATE INDEX idx_chats_updated ON chats(updated_at DESC);
 CREATE INDEX idx_chats_used_updated ON chats(used_at, updated_at DESC);
 CREATE INDEX idx_experience_auto_intake_agent_status
@@ -1308,6 +1451,22 @@ CREATE INDEX idx_memory_tickets_project_created
         ON memory_tickets(project_id, created_at DESC);
 CREATE INDEX idx_memory_tickets_status_created
         ON memory_tickets(emitter_status, state, created_at DESC);
+CREATE INDEX idx_occupants_seat_time ON one_seat_occupants(seat_id, since);
+CREATE INDEX idx_one_artifact_binding_chat
+      ON one_artifact_bindings(chat_id, created_at);
+CREATE INDEX idx_one_artifact_binding_exact
+      ON one_artifact_bindings(task_id, chat_id, run_id, manifest_id, artifact_ref);
+CREATE INDEX idx_one_org_members_agent
+      ON one_org_members(installed_agent_id);
+CREATE INDEX idx_one_org_members_order
+      ON one_org_members(archived_at, sort_order, added_at);
+CREATE INDEX idx_one_seats_updated ON one_seats(updated_at DESC);
+CREATE INDEX idx_one_taskforces_updated
+      ON one_taskforces(updated_at DESC);
+CREATE INDEX idx_plugin_builder_sessions_chat_updated
+        ON plugin_builder_sessions(chat_id, updated_at DESC);
+CREATE INDEX idx_plugin_builder_sessions_slug_phase
+        ON plugin_builder_sessions(slug, phase);
 CREATE INDEX idx_run_events_agent_kind_ts
           ON run_events(agent_id, kind, ts DESC);
 CREATE INDEX idx_run_events_agent_ts ON run_events(agent_id, ts DESC);
@@ -1320,6 +1479,10 @@ CREATE INDEX idx_run_events_run_seq
 CREATE INDEX idx_run_events_ts
         ON run_events(ts DESC);
 CREATE INDEX idx_run_history_automation ON run_history(automation_id);
+CREATE INDEX idx_seat_occupants_agent
+        ON one_seat_occupants(agent_id) WHERE agent_id IS NOT NULL;
+CREATE UNIQUE INDEX idx_seat_occupants_current
+        ON one_seat_occupants(seat_id, slot) WHERE until IS NULL;
 CREATE INDEX idx_task_participants_agent ON task_agent_participants(agent_id);
 CREATE INDEX idx_tasks_firm_updated ON tasks(firm_id, updated_at DESC);
 CREATE INDEX idx_tasks_origin_chat ON tasks(origin_chat_id);
@@ -1337,7 +1500,8 @@ CREATE INDEX idx_telegram_bindings_chat
         ON telegram_bindings(telegram_chat_id);
 CREATE INDEX idx_telegram_bindings_enabled
         ON telegram_bindings(enabled, status);
-CREATE UNIQUE INDEX idx_telegram_bindings_one_singleton
-        ON telegram_bindings(target_kind) WHERE target_kind = 'one';
+CREATE UNIQUE INDEX idx_telegram_bindings_one_room
+        ON telegram_bindings(telegram_chat_id)
+        WHERE target_kind = 'one' AND telegram_chat_id IS NOT NULL;
 CREATE INDEX idx_telegram_bindings_target
         ON telegram_bindings(target_kind, target_id);