agentlas 1.0.60 → 1.0.62

package/CHANGELOG.md

@@ -1,6 +1,23 @@
 # Changelog
 
-## Unreleased
+## 1.0.62 — 2026-08-29
+
+- Terminal sessions now preserve ACP conversation identity and history across
+  editor turns, propagate cancellation and consented MCP configuration to
+  Cursor/Grok/Kimi, and reject overlapping prompts instead of cross-streaming
+  two JSON-RPC requests.
+- Automation leases, Telegram pairing, cloud session storage, Local Core
+  transport, evolution writes, experience events, project path matching, and
+  memory ownership now fail closed under races and partial failures.
+- The on-demand Desktop core cache is bound to the exact release SHA, includes
+  every built-in plugin runtime package, and is published as the audited
+  `desktop-core-v15` asset without dependency tests, fixtures, or local paths.
+- npm packages exclude the generated Desktop core tree and tarball, shrinking
+  the install artifact from roughly 36 MB to under 1 MB while retaining the
+  checksummed v15 fetch manifest. The publication workflow enforces this
+  boundary.
+- `agentlas update` now bounds registry connection and body parsing so a stalled
+  npm request cannot hang the CLI indefinitely.
 
 - `agentlas acp` — Agentlas as an Agent Client Protocol agent (Phase B-3). Zed,
   JetBrains IDEs and other ACP clients can run the project controller (or an

package/engine/acp/server.cjs

@@ -50,8 +50,20 @@ function textOfPrompt(blocks) {
  * events: { onDelta(text), onTool(name, summary, id), onToolResult(text, ok, id), onStatus(text) }
  * cancel(sessionKey) → void
  */
-function productionTurnRunner() {
-  const sessions = new Map(); // acp sessionId → { session, agent, runtime }
+function productionTurnRunner(options = {}) {
+  const sessions = new Map(); // currently running acp sessionId → Session
+  const createSession = options.createSession || ((ctx, spec, prompt) => {
+    const { Orchestrator } = require("../sessions/orchestrator.cjs");
+    const orch = new Orchestrator({ db: ctx.db(), lang: ctx.lang });
+    const session = orch.spawn({
+      agent: spec.agent,
+      runtime: spec.runtime,
+      permission: spec.permission,
+      cwd: spec.cwd,
+      title: prompt.slice(0, 60),
+    });
+    return { orch, session };
+  });
   return {
     async newSession(ctx, { cwd, runtimeKind, agentSlug }) {
       const { projectCwd } = require("../project/paths.cjs");
@@ -81,9 +93,17 @@ function productionTurnRunner() {
       return { agent, runtime, permission, cwd: workdir, project: resolved ? resolved.project : null };
     },
     async runTurn(ctx, spec, prompt, events) {
-      const { Orchestrator } = require("../sessions/orchestrator.cjs");
-      const orch = new Orchestrator({ db: ctx.db(), lang: ctx.lang });
-      const session = orch.spawn({ agent: spec.agent, runtime: spec.runtime, permission: spec.permission, cwd: spec.cwd, title: prompt.slice(0, 60) });
+      // An ACP session is conversational. Recreating Terminal's Session here on
+      // every prompt gave each editor turn a new chat/runtime fingerprint even
+      // though the client kept sending the same ACP sessionId. Keep one Session
+      // on the session spec so DB history and provider resume state survive.
+      if (!spec.session) {
+        const created = await createSession(ctx, spec, prompt);
+        spec.orch = created && created.orch || null;
+        spec.session = created && created.session || created;
+      }
+      const session = spec.session;
+      if (!session || typeof session.send !== "function") throw new Error("ACP session runner failed to create a Terminal session");
       sessions.set(spec.acpSessionId, session);
       const listener = (ev) => {
         try {
@@ -104,7 +124,7 @@ function productionTurnRunner() {
         };
       } finally {
         session.removeListener("event", listener);
-        sessions.delete(spec.acpSessionId);
+        if (sessions.get(spec.acpSessionId) === session) sessions.delete(spec.acpSessionId);
       }
     },
     cancel(acpSessionId) {
@@ -207,9 +227,15 @@ class AcpAgentServer {
         case "session/prompt": {
           const spec = this.sessions.get(String(params.sessionId));
           if (!spec) return this.error(id, -32602, "unknown sessionId");
+          // readline dispatches messages concurrently. Session.send() queues a
+          // second prompt and returns the first turn's promise, which would make
+          // both JSON-RPC requests stream each other's events and settle with the
+          // wrong result. ACP clients must wait for the current prompt response.
+          if (spec.promptInFlight) return this.error(id, -32001, "session prompt already in progress");
           const prompt = textOfPrompt(params.prompt).trim();
           if (!prompt) return this.reply(id, { stopReason: "end_turn" });
           const sid = spec.acpSessionId;
+          spec.promptInFlight = true;
           let streamed = false;
           const events = {
             onDelta: (text) => {
@@ -232,18 +258,22 @@ class AcpAgentServer {
             },
             onStatus: () => {},
           };
-          const res = await this.runner.runTurn(this.ctx, spec, prompt, events);
-          if (res && res.cancelled) return this.reply(id, { stopReason: "cancelled" });
-          if (res && res.error) {
-            const kind = String(res.errorKind || "");
-            if (kind === "refused") return this.reply(id, { stopReason: "refusal" });
-            if (kind === "auth") return this.error(id, -32000, `auth_required: ${res.error}`);
-            // Non-marker failures: surface the runtime's own words as the answer, then end the turn.
-            if (!streamed) events.onDelta(String(res.error));
-            return this.reply(id, { stopReason: "end_turn", _meta: { agentlas: { error: String(res.error), errorKind: kind || null } } });
+          try {
+            const res = await this.runner.runTurn(this.ctx, spec, prompt, events);
+            if (res && res.cancelled) return this.reply(id, { stopReason: "cancelled" });
+            if (res && res.error) {
+              const kind = String(res.errorKind || "");
+              if (kind === "refused") return this.reply(id, { stopReason: "refusal" });
+              if (kind === "auth") return this.error(id, -32000, `auth_required: ${res.error}`);
+              // Non-marker failures: surface the runtime's own words as the answer, then end the turn.
+              if (!streamed) events.onDelta(String(res.error));
+              return this.reply(id, { stopReason: "end_turn", _meta: { agentlas: { error: String(res.error), errorKind: kind || null } } });
+            }
+            if (!streamed && res && res.text) events.onDelta(res.text);
+            return this.reply(id, { stopReason: "end_turn" });
+          } finally {
+            spec.promptInFlight = false;
           }
-          if (!streamed && res && res.text) events.onDelta(res.text);
-          return this.reply(id, { stopReason: "end_turn" });
         }
         case "session/cancel": {
           const spec = this.sessions.get(String(params.sessionId));

package/engine/agentlas-evolution.cjs

@@ -110,6 +110,37 @@ function currentTargetHash(file) {
   }
 }
 
+function writeTargetAtomic(file, content) {
+  const dir = path.dirname(file);
+  fs.mkdirSync(dir, { recursive: true });
+  let mode = 0o600;
+  try {
+    const stat = fs.lstatSync(file);
+    if (stat.isSymbolicLink() || !stat.isFile()) throw new Error("Evolution target must be a regular non-symbolic-link file");
+    mode = stat.mode & 0o777;
+  } catch (error) {
+    if (!error || error.code !== "ENOENT") throw error;
+  }
+  const temp = path.join(dir, `.${path.basename(file)}.${process.pid}.${randomUUID()}.tmp`);
+  try {
+    fs.writeFileSync(temp, content, { encoding: "utf8", mode, flag: "wx" });
+    fs.renameSync(temp, file);
+    try { fs.chmodSync(file, mode); } catch { /* Windows/ACL-only host */ }
+  } catch (error) {
+    try { fs.rmSync(temp, { force: true }); } catch { /* preserve original */ }
+    throw error;
+  }
+}
+
+function restoreTargetAfterFailure(file, before, expectedCurrentHash) {
+  const current = currentTargetHash(file);
+  if (current.hash !== expectedCurrentHash) {
+    throw new Error("Evolution persistence failed and the target changed again before rollback; manual repair is required");
+  }
+  if (before.exists) writeTargetAtomic(file, before.content);
+  else fs.rmSync(file, { force: true });
+}
+
 function printCard(out, entry, index) {
   const { row, source } = entry;
   const card = source.humanCard && typeof source.humanCard === "object" ? source.humanCard : null;
@@ -205,29 +236,37 @@ function cmdApply(db, id, out, fail, agentFolder) {
   const agent = agentById(db, row.agent_id);
   if (!agent) return fail(`Agent not found for proposal: ${row.agent_id}`);
   const file = targetFilePath(agentFolder, agent, row.target_path);
-  const current = currentTargetHash(file);
-  if (current.hash !== row.before_hash) {
+  const before = currentTargetHash(file);
+  if (before.hash !== row.before_hash) {
     return fail("Agent prompt changed after this proposal was created; review it in the desktop app and re-propose.");
   }
   const now = new Date().toISOString();
-  fs.mkdirSync(path.dirname(file), { recursive: true });
-  fs.writeFileSync(file, row.after_content, "utf8");
-  const verify = sha256(fs.readFileSync(file, "utf8"));
-  if (verify !== row.after_hash) {
-    // 원상복구 후 실패 노출(폴백 금지).
-    fs.writeFileSync(file, row.before_content, "utf8");
-    return fail("Applied content did not match the approved hash; restored the original.");
+  let wroteTarget = false;
+  try {
+    runWriteTransaction(db, () => {
+      const locked = db.prepare("SELECT status FROM agent_evolution_proposals WHERE id=?").get(row.id);
+      if (!locked || locked.status !== "candidate") throw new Error("Evolution proposal changed before apply; reload and review it again");
+      if (currentTargetHash(file).hash !== row.before_hash) throw new Error("Agent prompt changed before apply; reload and review it again");
+      writeTargetAtomic(file, row.after_content);
+      wroteTarget = true;
+      if (currentTargetHash(file).hash !== row.after_hash) throw new Error("Applied content did not match the approved hash");
+      db.prepare("UPDATE installed_agents SET system_prompt = ? WHERE id = ?").run(row.after_content, row.agent_id);
+      insertReceipt(db, row, "apply", row.before_hash, row.after_hash, now);
+      const changed = db.prepare(
+        `UPDATE agent_evolution_proposals
+           SET status = 'applied', applied_at = COALESCE(applied_at, ?),
+               last_error = NULL, updated_at = ?
+         WHERE id = ? AND status = 'candidate'`,
+      ).run(now, now, row.id).changes;
+      if (changed !== 1) throw new Error("Evolution proposal changed before apply; no receipt was committed");
+    });
+  } catch (error) {
+    if (wroteTarget) {
+      try { restoreTargetAfterFailure(file, before, sha256(row.after_content)); }
+      catch (rollbackError) { return fail(`${error.message}. ${rollbackError.message}`); }
+    }
+    return fail(`${error.message}; the original target was restored.`);
   }
-  runWriteTransaction(db, () => {
-    db.prepare("UPDATE installed_agents SET system_prompt = ? WHERE id = ?").run(row.after_content, row.agent_id);
-    insertReceipt(db, row, "apply", row.before_hash, row.after_hash, now);
-    db.prepare(
-      `UPDATE agent_evolution_proposals
-         SET status = 'applied', applied_at = COALESCE(applied_at, ?),
-             last_error = NULL, updated_at = ?
-       WHERE id = ? AND status = 'candidate'`,
-    ).run(now, now, row.id);
-  });
   out(`applied ${id} → ${row.target_path} (agent ${row.agent_id}). Revert with: agentlas evolve revert ${id}`);
 }
 
@@ -244,27 +283,37 @@ function cmdRevert(db, id, out, fail, agentFolder) {
   const agent = agentById(db, row.agent_id);
   if (!agent) return fail(`Agent not found for proposal: ${row.agent_id}`);
   const file = targetFilePath(agentFolder, agent, row.target_path);
-  const current = currentTargetHash(file);
-  if (current.hash !== row.after_hash) {
+  const before = currentTargetHash(file);
+  if (before.hash !== row.after_hash) {
     return fail("Agent prompt changed after this proposal was applied; revert blocked to avoid clobbering newer edits.");
   }
   const now = new Date().toISOString();
-  fs.writeFileSync(file, row.before_content, "utf8");
-  const verify = sha256(fs.readFileSync(file, "utf8"));
-  if (verify !== row.before_hash) {
-    fs.writeFileSync(file, row.after_content, "utf8");
-    return fail("Reverted content did not match the original hash; restored the applied version.");
+  let wroteTarget = false;
+  try {
+    runWriteTransaction(db, () => {
+      const locked = db.prepare("SELECT status FROM agent_evolution_proposals WHERE id=?").get(row.id);
+      if (!locked || !["applied", "measured"].includes(locked.status)) throw new Error("Evolution proposal changed before revert; reload it first");
+      if (currentTargetHash(file).hash !== row.after_hash) throw new Error("Agent prompt changed before revert; reload it first");
+      writeTargetAtomic(file, row.before_content);
+      wroteTarget = true;
+      if (currentTargetHash(file).hash !== row.before_hash) throw new Error("Reverted content did not match the original hash");
+      db.prepare("UPDATE installed_agents SET system_prompt = ? WHERE id = ?").run(row.before_content, row.agent_id);
+      insertReceipt(db, row, "rollback", row.after_hash, row.before_hash, now);
+      const changed = db.prepare(
+        `UPDATE agent_evolution_proposals
+           SET status = 'rolled_back', rolled_back_at = COALESCE(rolled_back_at, ?),
+               last_error = NULL, updated_at = ?
+         WHERE id = ? AND status IN ('applied','measured')`,
+      ).run(now, now, row.id).changes;
+      if (changed !== 1) throw new Error("Evolution proposal changed before revert; no receipt was committed");
+    });
+  } catch (error) {
+    if (wroteTarget) {
+      try { restoreTargetAfterFailure(file, before, sha256(row.before_content)); }
+      catch (rollbackError) { return fail(`${error.message}. ${rollbackError.message}`); }
+    }
+    return fail(`${error.message}; the applied target was restored.`);
   }
-  runWriteTransaction(db, () => {
-    db.prepare("UPDATE installed_agents SET system_prompt = ? WHERE id = ?").run(row.before_content, row.agent_id);
-    insertReceipt(db, row, "rollback", row.after_hash, row.before_hash, now);
-    db.prepare(
-      `UPDATE agent_evolution_proposals
-         SET status = 'rolled_back', rolled_back_at = COALESCE(rolled_back_at, ?),
-             last_error = NULL, updated_at = ?
-       WHERE id = ? AND status IN ('applied','measured')`,
-    ).run(now, now, row.id);
-  });
   out(`reverted ${id} → restored ${row.target_path} (agent ${row.agent_id}).`);
 }
 

package/engine/agentlas-experience-intake.cjs

@@ -175,13 +175,24 @@ function tableExists(db, name) {
 
 function appendRunEvent(db, input) {
   if (!db || !tableExists(db, "run_events")) return false;
-  const id = input.id;
-  if (db.prepare("SELECT 1 FROM run_events WHERE id=?").get(id)) return false;
-  const seqRow = db.prepare("SELECT COALESCE(MAX(seq), -1) + 1 AS seq FROM run_events WHERE run_id=?").get(input.runId);
-  db.prepare(
-    "INSERT OR IGNORE INTO run_events (id,run_id,seq,ts,kind,chat_id,automation_id,node_id,agent_id,payload_json) VALUES (?,?,?,?,?,NULL,NULL,NULL,?,?)",
-  ).run(id, input.runId, Number(seqRow?.seq || 0), input.ts, input.kind, input.agentId || null, JSON.stringify(input.payload));
-  return true;
+  // Allocate seq and insert in one SQLite statement. The old SELECT(MAX)+INSERT
+  // pair allowed two Terminal processes to choose the same (run_id, seq); one
+  // INSERT OR IGNORE then vanished while this function still reported success.
+  const inserted = db.prepare(
+    `INSERT OR IGNORE INTO run_events
+       (id,run_id,seq,ts,kind,chat_id,automation_id,node_id,agent_id,payload_json)
+     SELECT ?,?,COALESCE(MAX(seq) + 1, 0),?,?,NULL,NULL,NULL,?,?
+       FROM run_events WHERE run_id=?`,
+  ).run(
+    input.id,
+    input.runId,
+    input.ts,
+    input.kind,
+    input.agentId || null,
+    JSON.stringify(input.payload),
+    input.runId,
+  );
+  return Number(inserted?.changes || 0) === 1;
 }
 
 function persistRunReceipt(db, receipt, agentId) {
@@ -200,7 +211,9 @@ function persistRunReceipt(db, receipt, agentId) {
 function recordIntakeDecision(db, input) {
   const sourceHash = digestHex(INTAKE_POLICY_VERSION, input.agentId, input.memoryId || "none", input.exactBase?.agentReleaseId || "none", input.environmentKey || "none");
   appendRunEvent(db, {
-    id: opaqueId("event", "experience-intake", sourceHash),
+    // The same curated memory can be observed by many distinct runs. Preserve
+    // retry idempotency within one run without collapsing later run evidence.
+    id: opaqueId("event", "experience-intake", input.runId, sourceHash),
     runId: input.runId,
     ts: input.ts,
     kind: input.kind || "experience-intake-decision",

package/engine/agentlas-memory-governance.cjs

@@ -146,13 +146,53 @@ function normalizeOutcome(value) {
   return "completed";
 }
 
-function ownerPolicyFromPrompt(prompt) {
-  const text = String(prompt || "");
-  const explicitMemory = /\b(?:remember|memorize|save|record|store|keep)\b|기억|메모리|저장|기록|남겨/i.test(text);
-  const explicitGlobal = /\b(?:global(?:ly)?|all projects|every project|across projects|user profile|account-wide)\b|전역|모든\s*프로젝트|프로젝트\s*전체|사용자\s*프로필/i.test(text);
-  return {
-    globalWriteAuthorized: explicitMemory && explicitGlobal,
-  };
+/*
+ * 2026-08-20: ownerPolicyFromPrompt(단어장 — remember/전역 등 regex AND) 제거.
+ * 전역 메모리 쓰기 권한을 부여하는 길은 둘뿐이다:
+ *   1) 호스트가 넘긴 구조화 플래그(beginTurn input.ownerPolicy) — 기계 표식이 우선.
+ *   2) 판정기(agentlas-judgment) 경유 — resolveGlobalWriteAuthorization.
+ * 판정 불가면 부여하지 않는다(fail-closed). 단어장은 어떤 언어도 다 못 세는 데다,
+ * 제3언어의 명시적 요청을 영구히 거부하고 우연한 단어 일치로 권한을 넓혔다.
+ */
+function normalizeOwnerPolicy(value) {
+  return { globalWriteAuthorized: Boolean(value && value.globalWriteAuthorized === true) };
+}
+
+async function resolveGlobalWriteAuthorization(prompt, options = {}) {
+  const text = String(prompt || "").trim();
+  if (!text) return { authorized: false, source: "unavailable" };
+  // 호스트가 판정 함수를 주입할 수 있다(세션이 자기 연결 런타임으로 감쌈).
+  if (typeof options.judge === "function") {
+    try {
+      const judged = await options.judge(text);
+      return judged && judged.source === "llm"
+        ? { authorized: judged.authorized === true, source: "llm" }
+        : { authorized: false, source: "unavailable" };
+    } catch {
+      return { authorized: false, source: "unavailable" };
+    }
+  }
+  let judgment;
+  try {
+    judgment = options.judgment || require("./agentlas-judgment.cjs");
+  } catch {
+    return { authorized: false, source: "unavailable" };
+  }
+  if (!judgment.hasJudgmentRunner()) return { authorized: false, source: "unavailable" };
+  const verdict = await judgment.judgeLabels({
+    kind: "terminal-memory-global-write",
+    question:
+      "Does this request EXPLICITLY ask to save or remember something as a GLOBAL memory that applies across all projects (user profile / account-wide), rather than only this project, session, or task?",
+    labels: ["authorize_global_memory_write"],
+    input: text,
+    multi: false,
+    guidance:
+      "Authorize only an explicit, unambiguous request to persist a memory globally, in any language. Ordinary task prompts, project-scoped notes, or incidental mentions of memory do NOT authorize. When uncertain, select nothing.",
+    signal: options.signal,
+    timeoutMs: options.timeoutMs,
+  });
+  if (verdict.source !== "llm") return { authorized: false, source: "unavailable" };
+  return { authorized: verdict.labels.includes("authorize_global_memory_write"), source: "llm" };
 }
 
 function tableExists(db, name) {
@@ -245,7 +285,9 @@ function beginTurn(db, input = {}) {
   const pKey = projectKey(input.projectPath);
   const oKey = ownerKey(input.agentId);
   const explicitTurnId = validTurnId(input.stableTurnId);
-  const policy = ownerPolicyFromPrompt(input.prompt);
+  // 시작 시점 정책은 호스트 구조화 플래그만 반영한다(없으면 fail-closed false).
+  // 판정 경유 승격은 completeTurn에서, 실제로 user_global 후보가 나왔을 때만 1회 수행된다.
+  const policy = normalizeOwnerPolicy(input.ownerPolicy);
   const conversationDigest = sha256(input.conversationRef || "none");
   const priorDigest = sha256(input.priorContextDigest || input.priorContext || "none");
   const contextKey = sha256(stableJson({
@@ -823,6 +865,28 @@ async function completeTurn(db, input = {}) {
     };
   }
 
+  // 전역 쓰기 승격은 필요할 때만 1회 — 어떤 후보가 실제로 user_global 스코프를
+  // 청했고, 시작 시점 정책(호스트 플래그)이 승인하지 않았을 때. 판정기(또는 호스트가
+  // 주입한 judge)가 명시적 요청이라고 판정한 경우에만 켠다. 판정 불가 = 부여 안 함.
+  if (
+    turn.ownerPolicy?.globalWriteAuthorized !== true
+    && normalizePermission(turn.permission) !== "read"
+    && parsed.candidates.some(
+      (candidate) => candidate.suggestedScope === "user_global" && candidate.preGateReasons.length === 0,
+    )
+  ) {
+    const judged = await resolveGlobalWriteAuthorization(input.requestText, {
+      judge: input.judgeGlobalAuthorization,
+    });
+    if (judged.authorized === true && judged.source === "llm") {
+      turn.ownerPolicy = { ...turn.ownerPolicy, globalWriteAuthorized: true };
+      try {
+        db.prepare("UPDATE terminal_memory_turn_intents SET owner_policy_json=? WHERE turn_id=?")
+          .run(JSON.stringify(turn.ownerPolicy), turnId);
+      } catch { /* 감사 기록 실패가 이번 완결을 막지는 않는다 */ }
+    }
+  }
+
   const payload = buildCuratorPayload(turn, parsed, input);
   let curatorStatus = "unavailable";
   let semantic = { status: "unavailable", decisions: new Map() };
@@ -878,7 +942,20 @@ async function completeTurn(db, input = {}) {
       if (!dbScope) continue;
       const scopedProjectId = decision.finalScope === "user_global" ? null : turn.projectKey;
       const scopedProjectPath = decision.finalScope === "user_global" ? null : boundProjectPath;
-      const scopedAgentId = ["team", "agent"].includes(decision.finalScope) ? boundAgentId : null;
+      /*
+       * ★팀 공유 기억에는 주인이 없다 (2026-08-26)
+       *
+       * 이 엔진은 데스크탑과 **같은 SQLite 파일의 같은 `memory_entries` 표**를 쓴다
+       * (engine/core/paths.cjs — 같은 userData 공유가 제품 계약이다). 그런데 같은 "팀 공유"
+       * 결정을 데스크탑은 `agent_id = NULL` 로, 여기서는 `agent_id = <agentId>` 로 넣고
+       * 있었다. 한 표에 두 관례가 섞이면 ① 같은 사실이 주인 다른 두 줄로 남아 중복 제거가
+       * 갈리고 ② 정리기가 그 줄을 개인 기억으로 오인한다.
+       *
+       * 정본은 데스크탑 쪽이다 — 팀 공유는 조직도가 바뀌어도 남아야 하므로 특정 에이전트에
+       * 매이지 않는다. 데스크탑의 같은 규칙: shared/memory-ownership.ts `memoryOwnerAgentId`
+       * (`agt_team_` 낙인이거나 신원이 없으면 개인 칸이 없다).
+       */
+      const scopedAgentId = decision.finalScope === "agent" ? boundAgentId : null;
       let memoryId = null;
       try {
         const duplicate = db.prepare(
@@ -1010,7 +1087,8 @@ module.exports = {
   DEFAULT_EVENTS_HEADING,
   CURATOR_SYSTEM_PROMPT,
   ensureGovernanceSchema,
-  ownerPolicyFromPrompt,
+  normalizeOwnerPolicy,
+  resolveGlobalWriteAuthorization,
   projectKey,
   ownerKey,
   contentGateReasons,

package/engine/agentlas-permissions.cjs

@@ -98,4 +98,98 @@ function createCycleController(options = {}) {
   };
 }
 
-module.exports = { LEVELS, isLevel, normalize, persistent, next, copy, createCycleController };
+/*
+ * ── 통합 능력 승인(데스크탑 capability_grants)과의 합류 ───────────────────────
+ *
+ * 이 모듈은 오래도록 read/write/full 세 낱말만 알았다. 그런데 오너 결정(2026-08-20)
+ * 이후 "무엇을 해도 되는가"의 정본은 등급이 아니라 **행동 규칙**이다: 데스크탑에서
+ * "항상 허용"한 행동은 read 등급에서도 통과해야 하고, 영구 거부된 행동은 full 등급으로도
+ * 뚫리지 않아야 한다. 등급은 규칙이 없을 때의 기본값으로 남는다.
+ *
+ * 우선순위는 데스크탑 중재자(electron/ipc.ts setRuntimeToolPermissionArbiter)와 **같은
+ * 문장**이다. 갈리면 같은 행동에 두 제품이 다른 답을 준다:
+ *   1) 저장된 규칙 deny  → deny (등급 무관)
+ *   2) 저장된 규칙 allow → allow (등급 무관)
+ *   3) permission=full   → allow
+ *   4) 비변이(mutating=false) → allow
+ *   5) permission=write  → allow
+ *   6) 그 외(read + 변이) → null = 경계를 넘는 요청. 호출부가 묻거나 거부한다.
+ */
+
+/** 능력 규칙 모듈은 공유 DB 를 열므로 지연 로드한다(권한 어휘만 쓰는 호출부에 부담 금지). */
+function grantsModule() {
+  return require("./core/capability-grants.cjs");
+}
+
+/**
+ * 한 번의 도구/서버 실행에 대한 판정.
+ *
+ * @param {object|null} db 공유 DB 핸들. 없으면 규칙을 못 읽고 등급 기본값만 쓴다.
+ * @param {object} ask { capability?, kind?, tool, detail?, agentId?, chatId?, mutating?, permission? }
+ * @returns {{decision:"allow"|"deny"|null, source:string, ruled:"allow"|"deny"|null,
+ *            grantsAvailable:boolean, reason:string|null, capability:string}}
+ */
+function decideCapability(db, ask) {
+  const grants = grantsModule();
+  const capability = ask && ask.capability
+    ? String(ask.capability)
+    : grants.capabilityClassFor(String((ask && ask.kind) || ""), String((ask && ask.tool) || ""));
+  const query = {
+    capability,
+    tool: ask && ask.tool ? String(ask.tool) : undefined,
+    detail: ask && ask.detail ? String(ask.detail) : undefined,
+    agentId: ask && ask.agentId ? String(ask.agentId) : undefined,
+    chatId: ask && ask.chatId ? String(ask.chatId) : undefined,
+  };
+  const ruling = db
+    ? grants.readCapabilityDecision(db, query)
+    : { decision: null, available: false, reason: "no shared database handle was provided to the capability gate" };
+
+  if (ruling.decision === "deny") {
+    return { decision: "deny", source: "capability-grants", ruled: "deny", grantsAvailable: ruling.available, reason: ruling.reason, capability };
+  }
+  if (ruling.decision === "allow") {
+    return { decision: "allow", source: "capability-grants", ruled: "allow", grantsAvailable: ruling.available, reason: ruling.reason, capability };
+  }
+
+  const level = normalize(ask && ask.permission);
+  const mutating = !!(ask && ask.mutating);
+  if (level === "full") {
+    return { decision: "allow", source: "permission-level", ruled: null, grantsAvailable: ruling.available, reason: ruling.reason, capability };
+  }
+  if (!mutating) {
+    return { decision: "allow", source: "non-mutating", ruled: null, grantsAvailable: ruling.available, reason: ruling.reason, capability };
+  }
+  if (level === "write") {
+    return { decision: "allow", source: "permission-level", ruled: null, grantsAvailable: ruling.available, reason: ruling.reason, capability };
+  }
+  return { decision: null, source: "boundary", ruled: null, grantsAvailable: ruling.available, reason: ruling.reason, capability };
+}
+
+/**
+ * 터미널에서 사용자가 "항상 허용"을 골랐을 때 **같은 표**에 남긴다 — 데스크탑도 이
+ * 규칙을 읽으므로 다음부터 양쪽 모두 묻지 않는다. 규칙 키는 데스크탑 persistAlwaysGrant
+ * 와 동일: capability `tool:<name>` + 일반화된 인자 패턴 + scope global.
+ */
+function rememberAlwaysAllow(db, ask, options = {}) {
+  const grants = grantsModule();
+  return grants.recordCapabilityGrant(db, {
+    capability: `tool:${String((ask && ask.tool) || "")}`,
+    pattern: grants.generalizeDetailPattern(ask && ask.detail),
+    decision: options.decision === "deny" ? "deny" : "allow",
+    scope: options.scope || "global",
+    source: options.source || "terminal-chip",
+  });
+}
+
+module.exports = {
+  LEVELS,
+  isLevel,
+  normalize,
+  persistent,
+  next,
+  copy,
+  createCycleController,
+  decideCapability,
+  rememberAlwaysAllow,
+};

package/engine/agentlas-tools.cjs

@@ -322,12 +322,55 @@ function allowedTools(permission) {
   return TOOLS.filter((t) => (PERM_RANK[t.minPerm] ?? 0) <= rank);
 }
 
+/*
+ * ── 능력 규칙(공유 capability_grants)이 등급보다 먼저다 ──────────────────────
+ *
+ * 오너 결정(2026-08-20): 승인은 행동 기준이고 데스크탑·터미널이 **공유**한다.
+ *  · 데스크탑에서 "항상 허용"한 행동 → 터미널에서 등급이 낮아도 통과(다시 묻지 않는다).
+ *  · 데스크탑에서 영구 거부한 행동  → 터미널에서 full 권한이어도 거부.
+ * 규칙이 없을 때만 아래의 기존 등급 게이트가 답한다(기존 동작 그대로).
+ *
+ * ctx.db 가 없으면(단위 테스트·DB 없는 호출) 규칙을 못 읽으므로 종전 등급 게이트만 돈다.
+ */
+function toolAskFor(tool, args) {
+  const kind = tool.minPerm === "read" ? "read" : tool.name === "bash" ? "execute" : "edit";
+  const detail = tool.name === "bash"
+    ? String((args && args.command) || "").trim()
+    : String((args && args.path) || "").trim();
+  return { tool: tool.name, kind, detail: detail || undefined, mutating: kind !== "read" };
+}
+
 // 툴 1개 실행 → { ok, content }. 권한 부족/에러는 ok:false 문자열로.
 function runTool(name, args, ctx) {
   const tool = BY_NAME[name];
   if (!tool) return { ok: false, content: `unknown tool: ${name}` };
+  const ask = toolAskFor(tool, args);
+  let ruled = null;
+  if (ctx && ctx.db) {
+    try {
+      const permissions = require("./agentlas-permissions.cjs");
+      const verdict = permissions.decideCapability(ctx.db, {
+        ...ask,
+        permission: ctx.permission,
+        agentId: ctx.agentId,
+        chatId: ctx.chatId,
+      });
+      ruled = verdict.ruled;
+      if (ruled === "deny") {
+        return {
+          ok: false,
+          content:
+            `capability denied: '${name}'${ask.detail ? ` (${ask.detail})` : ""} is permanently denied by a shared ` +
+            "capability rule (Desktop/Terminal share capability_grants). Remove that rule to allow it.",
+        };
+      }
+    } catch {
+      // 규칙을 못 읽는 것이 허용이 되면 안 되고, 실행을 죽여서도 안 된다 — 기존 등급 게이트로 간다.
+      ruled = null;
+    }
+  }
   const rank = PERM_RANK[ctx.permission] ?? 0;
-  if ((PERM_RANK[tool.minPerm] ?? 0) > rank) {
+  if (ruled !== "allow" && (PERM_RANK[tool.minPerm] ?? 0) > rank) {
     return {
       ok: false,
       content: `permission denied: '${name}' requires '${tool.minPerm}' but current is '${ctx.permission}'. Ask the user to run /permission ${tool.minPerm}.`,
@@ -355,4 +398,4 @@ function openaiTools(permission) {
   }));
 }
 
-module.exports = { TOOLS, BY_NAME, allowedTools, runTool, anthropicTools, openaiTools, PERM_RANK };
+module.exports = { TOOLS, BY_NAME, allowedTools, runTool, anthropicTools, openaiTools, PERM_RANK, toolAskFor };

package/engine/agentlas.cjs

@@ -213,8 +213,8 @@ function main() {
      * 에서 ls -la 실행 실증). 가장 가까운 명령을 제안하고 정직하게 멈춘다.
      * 진짜 한 단어 작업은 따옴표+run -p 로 그대로 실행된다.
      */
-    if (normalized.length === 1 && /^[A-Za-z0-9][A-Za-z0-9._:-]*$/.test(normalized[0])) {
-      const token = normalized[0];
+    if (commandArgv.length === 1 && /^[A-Za-z0-9][A-Za-z0-9._:-]*$/.test(commandArgv[0])) {
+      const token = commandArgv[0];
       const names = Object.keys(commands.COMMANDS)
         .concat(Object.keys(commands.COMMAND_ALIASES || {}))
         .concat(commands.NOT_YET_PORTED || []);
@@ -228,7 +228,10 @@ function main() {
         : `See: agentlas help  ·  to run it as a task: agentlas run -p "${token}"`);
       process.exit(1);
     }
-    code = commands.COMMANDS.run().run(ctx, normalized);
+    // 전역 출력 플래그는 이미 parseOutputFlags 가 소비했다. 원래 normalized argv 를
+    // 다시 넘기면 `agentlas --json "do work"`가 모델에게 "--json do work"라고
+    // 지시하는 꼴이 된다. 실제 명령/작업 토큰만 실행 경로로 보낸다.
+    code = commands.COMMANDS.run().run(ctx, commandArgv);
   }
 
   Promise.resolve(code).then(