agentlas 1.0.61 → 1.0.62

package/CHANGELOG.md

@@ -1,6 +1,23 @@
 # Changelog
 
-## Unreleased
+## 1.0.62 — 2026-08-29
+
+- Terminal sessions now preserve ACP conversation identity and history across
+  editor turns, propagate cancellation and consented MCP configuration to
+  Cursor/Grok/Kimi, and reject overlapping prompts instead of cross-streaming
+  two JSON-RPC requests.
+- Automation leases, Telegram pairing, cloud session storage, Local Core
+  transport, evolution writes, experience events, project path matching, and
+  memory ownership now fail closed under races and partial failures.
+- The on-demand Desktop core cache is bound to the exact release SHA, includes
+  every built-in plugin runtime package, and is published as the audited
+  `desktop-core-v15` asset without dependency tests, fixtures, or local paths.
+- npm packages exclude the generated Desktop core tree and tarball, shrinking
+  the install artifact from roughly 36 MB to under 1 MB while retaining the
+  checksummed v15 fetch manifest. The publication workflow enforces this
+  boundary.
+- `agentlas update` now bounds registry connection and body parsing so a stalled
+  npm request cannot hang the CLI indefinitely.
 
 - `agentlas acp` — Agentlas as an Agent Client Protocol agent (Phase B-3). Zed,
   JetBrains IDEs and other ACP clients can run the project controller (or an

package/engine/acp/server.cjs

@@ -50,8 +50,20 @@ function textOfPrompt(blocks) {
  * events: { onDelta(text), onTool(name, summary, id), onToolResult(text, ok, id), onStatus(text) }
  * cancel(sessionKey) → void
  */
-function productionTurnRunner() {
-  const sessions = new Map(); // acp sessionId → { session, agent, runtime }
+function productionTurnRunner(options = {}) {
+  const sessions = new Map(); // currently running acp sessionId → Session
+  const createSession = options.createSession || ((ctx, spec, prompt) => {
+    const { Orchestrator } = require("../sessions/orchestrator.cjs");
+    const orch = new Orchestrator({ db: ctx.db(), lang: ctx.lang });
+    const session = orch.spawn({
+      agent: spec.agent,
+      runtime: spec.runtime,
+      permission: spec.permission,
+      cwd: spec.cwd,
+      title: prompt.slice(0, 60),
+    });
+    return { orch, session };
+  });
   return {
     async newSession(ctx, { cwd, runtimeKind, agentSlug }) {
       const { projectCwd } = require("../project/paths.cjs");
@@ -81,9 +93,17 @@ function productionTurnRunner() {
       return { agent, runtime, permission, cwd: workdir, project: resolved ? resolved.project : null };
     },
     async runTurn(ctx, spec, prompt, events) {
-      const { Orchestrator } = require("../sessions/orchestrator.cjs");
-      const orch = new Orchestrator({ db: ctx.db(), lang: ctx.lang });
-      const session = orch.spawn({ agent: spec.agent, runtime: spec.runtime, permission: spec.permission, cwd: spec.cwd, title: prompt.slice(0, 60) });
+      // An ACP session is conversational. Recreating Terminal's Session here on
+      // every prompt gave each editor turn a new chat/runtime fingerprint even
+      // though the client kept sending the same ACP sessionId. Keep one Session
+      // on the session spec so DB history and provider resume state survive.
+      if (!spec.session) {
+        const created = await createSession(ctx, spec, prompt);
+        spec.orch = created && created.orch || null;
+        spec.session = created && created.session || created;
+      }
+      const session = spec.session;
+      if (!session || typeof session.send !== "function") throw new Error("ACP session runner failed to create a Terminal session");
       sessions.set(spec.acpSessionId, session);
       const listener = (ev) => {
         try {
@@ -104,7 +124,7 @@ function productionTurnRunner() {
         };
       } finally {
         session.removeListener("event", listener);
-        sessions.delete(spec.acpSessionId);
+        if (sessions.get(spec.acpSessionId) === session) sessions.delete(spec.acpSessionId);
       }
     },
     cancel(acpSessionId) {
@@ -207,9 +227,15 @@ class AcpAgentServer {
         case "session/prompt": {
           const spec = this.sessions.get(String(params.sessionId));
           if (!spec) return this.error(id, -32602, "unknown sessionId");
+          // readline dispatches messages concurrently. Session.send() queues a
+          // second prompt and returns the first turn's promise, which would make
+          // both JSON-RPC requests stream each other's events and settle with the
+          // wrong result. ACP clients must wait for the current prompt response.
+          if (spec.promptInFlight) return this.error(id, -32001, "session prompt already in progress");
           const prompt = textOfPrompt(params.prompt).trim();
           if (!prompt) return this.reply(id, { stopReason: "end_turn" });
           const sid = spec.acpSessionId;
+          spec.promptInFlight = true;
           let streamed = false;
           const events = {
             onDelta: (text) => {
@@ -232,18 +258,22 @@ class AcpAgentServer {
             },
             onStatus: () => {},
           };
-          const res = await this.runner.runTurn(this.ctx, spec, prompt, events);
-          if (res && res.cancelled) return this.reply(id, { stopReason: "cancelled" });
-          if (res && res.error) {
-            const kind = String(res.errorKind || "");
-            if (kind === "refused") return this.reply(id, { stopReason: "refusal" });
-            if (kind === "auth") return this.error(id, -32000, `auth_required: ${res.error}`);
-            // Non-marker failures: surface the runtime's own words as the answer, then end the turn.
-            if (!streamed) events.onDelta(String(res.error));
-            return this.reply(id, { stopReason: "end_turn", _meta: { agentlas: { error: String(res.error), errorKind: kind || null } } });
+          try {
+            const res = await this.runner.runTurn(this.ctx, spec, prompt, events);
+            if (res && res.cancelled) return this.reply(id, { stopReason: "cancelled" });
+            if (res && res.error) {
+              const kind = String(res.errorKind || "");
+              if (kind === "refused") return this.reply(id, { stopReason: "refusal" });
+              if (kind === "auth") return this.error(id, -32000, `auth_required: ${res.error}`);
+              // Non-marker failures: surface the runtime's own words as the answer, then end the turn.
+              if (!streamed) events.onDelta(String(res.error));
+              return this.reply(id, { stopReason: "end_turn", _meta: { agentlas: { error: String(res.error), errorKind: kind || null } } });
+            }
+            if (!streamed && res && res.text) events.onDelta(res.text);
+            return this.reply(id, { stopReason: "end_turn" });
+          } finally {
+            spec.promptInFlight = false;
           }
-          if (!streamed && res && res.text) events.onDelta(res.text);
-          return this.reply(id, { stopReason: "end_turn" });
         }
         case "session/cancel": {
           const spec = this.sessions.get(String(params.sessionId));

package/engine/agentlas-evolution.cjs

@@ -110,6 +110,37 @@ function currentTargetHash(file) {
   }
 }
 
+function writeTargetAtomic(file, content) {
+  const dir = path.dirname(file);
+  fs.mkdirSync(dir, { recursive: true });
+  let mode = 0o600;
+  try {
+    const stat = fs.lstatSync(file);
+    if (stat.isSymbolicLink() || !stat.isFile()) throw new Error("Evolution target must be a regular non-symbolic-link file");
+    mode = stat.mode & 0o777;
+  } catch (error) {
+    if (!error || error.code !== "ENOENT") throw error;
+  }
+  const temp = path.join(dir, `.${path.basename(file)}.${process.pid}.${randomUUID()}.tmp`);
+  try {
+    fs.writeFileSync(temp, content, { encoding: "utf8", mode, flag: "wx" });
+    fs.renameSync(temp, file);
+    try { fs.chmodSync(file, mode); } catch { /* Windows/ACL-only host */ }
+  } catch (error) {
+    try { fs.rmSync(temp, { force: true }); } catch { /* preserve original */ }
+    throw error;
+  }
+}
+
+function restoreTargetAfterFailure(file, before, expectedCurrentHash) {
+  const current = currentTargetHash(file);
+  if (current.hash !== expectedCurrentHash) {
+    throw new Error("Evolution persistence failed and the target changed again before rollback; manual repair is required");
+  }
+  if (before.exists) writeTargetAtomic(file, before.content);
+  else fs.rmSync(file, { force: true });
+}
+
 function printCard(out, entry, index) {
   const { row, source } = entry;
   const card = source.humanCard && typeof source.humanCard === "object" ? source.humanCard : null;
@@ -205,29 +236,37 @@ function cmdApply(db, id, out, fail, agentFolder) {
   const agent = agentById(db, row.agent_id);
   if (!agent) return fail(`Agent not found for proposal: ${row.agent_id}`);
   const file = targetFilePath(agentFolder, agent, row.target_path);
-  const current = currentTargetHash(file);
-  if (current.hash !== row.before_hash) {
+  const before = currentTargetHash(file);
+  if (before.hash !== row.before_hash) {
     return fail("Agent prompt changed after this proposal was created; review it in the desktop app and re-propose.");
   }
   const now = new Date().toISOString();
-  fs.mkdirSync(path.dirname(file), { recursive: true });
-  fs.writeFileSync(file, row.after_content, "utf8");
-  const verify = sha256(fs.readFileSync(file, "utf8"));
-  if (verify !== row.after_hash) {
-    // 원상복구 후 실패 노출(폴백 금지).
-    fs.writeFileSync(file, row.before_content, "utf8");
-    return fail("Applied content did not match the approved hash; restored the original.");
+  let wroteTarget = false;
+  try {
+    runWriteTransaction(db, () => {
+      const locked = db.prepare("SELECT status FROM agent_evolution_proposals WHERE id=?").get(row.id);
+      if (!locked || locked.status !== "candidate") throw new Error("Evolution proposal changed before apply; reload and review it again");
+      if (currentTargetHash(file).hash !== row.before_hash) throw new Error("Agent prompt changed before apply; reload and review it again");
+      writeTargetAtomic(file, row.after_content);
+      wroteTarget = true;
+      if (currentTargetHash(file).hash !== row.after_hash) throw new Error("Applied content did not match the approved hash");
+      db.prepare("UPDATE installed_agents SET system_prompt = ? WHERE id = ?").run(row.after_content, row.agent_id);
+      insertReceipt(db, row, "apply", row.before_hash, row.after_hash, now);
+      const changed = db.prepare(
+        `UPDATE agent_evolution_proposals
+           SET status = 'applied', applied_at = COALESCE(applied_at, ?),
+               last_error = NULL, updated_at = ?
+         WHERE id = ? AND status = 'candidate'`,
+      ).run(now, now, row.id).changes;
+      if (changed !== 1) throw new Error("Evolution proposal changed before apply; no receipt was committed");
+    });
+  } catch (error) {
+    if (wroteTarget) {
+      try { restoreTargetAfterFailure(file, before, sha256(row.after_content)); }
+      catch (rollbackError) { return fail(`${error.message}. ${rollbackError.message}`); }
+    }
+    return fail(`${error.message}; the original target was restored.`);
   }
-  runWriteTransaction(db, () => {
-    db.prepare("UPDATE installed_agents SET system_prompt = ? WHERE id = ?").run(row.after_content, row.agent_id);
-    insertReceipt(db, row, "apply", row.before_hash, row.after_hash, now);
-    db.prepare(
-      `UPDATE agent_evolution_proposals
-         SET status = 'applied', applied_at = COALESCE(applied_at, ?),
-             last_error = NULL, updated_at = ?
-       WHERE id = ? AND status = 'candidate'`,
-    ).run(now, now, row.id);
-  });
   out(`applied ${id} → ${row.target_path} (agent ${row.agent_id}). Revert with: agentlas evolve revert ${id}`);
 }
 
@@ -244,27 +283,37 @@ function cmdRevert(db, id, out, fail, agentFolder) {
   const agent = agentById(db, row.agent_id);
   if (!agent) return fail(`Agent not found for proposal: ${row.agent_id}`);
   const file = targetFilePath(agentFolder, agent, row.target_path);
-  const current = currentTargetHash(file);
-  if (current.hash !== row.after_hash) {
+  const before = currentTargetHash(file);
+  if (before.hash !== row.after_hash) {
     return fail("Agent prompt changed after this proposal was applied; revert blocked to avoid clobbering newer edits.");
   }
   const now = new Date().toISOString();
-  fs.writeFileSync(file, row.before_content, "utf8");
-  const verify = sha256(fs.readFileSync(file, "utf8"));
-  if (verify !== row.before_hash) {
-    fs.writeFileSync(file, row.after_content, "utf8");
-    return fail("Reverted content did not match the original hash; restored the applied version.");
+  let wroteTarget = false;
+  try {
+    runWriteTransaction(db, () => {
+      const locked = db.prepare("SELECT status FROM agent_evolution_proposals WHERE id=?").get(row.id);
+      if (!locked || !["applied", "measured"].includes(locked.status)) throw new Error("Evolution proposal changed before revert; reload it first");
+      if (currentTargetHash(file).hash !== row.after_hash) throw new Error("Agent prompt changed before revert; reload it first");
+      writeTargetAtomic(file, row.before_content);
+      wroteTarget = true;
+      if (currentTargetHash(file).hash !== row.before_hash) throw new Error("Reverted content did not match the original hash");
+      db.prepare("UPDATE installed_agents SET system_prompt = ? WHERE id = ?").run(row.before_content, row.agent_id);
+      insertReceipt(db, row, "rollback", row.after_hash, row.before_hash, now);
+      const changed = db.prepare(
+        `UPDATE agent_evolution_proposals
+           SET status = 'rolled_back', rolled_back_at = COALESCE(rolled_back_at, ?),
+               last_error = NULL, updated_at = ?
+         WHERE id = ? AND status IN ('applied','measured')`,
+      ).run(now, now, row.id).changes;
+      if (changed !== 1) throw new Error("Evolution proposal changed before revert; no receipt was committed");
+    });
+  } catch (error) {
+    if (wroteTarget) {
+      try { restoreTargetAfterFailure(file, before, sha256(row.before_content)); }
+      catch (rollbackError) { return fail(`${error.message}. ${rollbackError.message}`); }
+    }
+    return fail(`${error.message}; the applied target was restored.`);
   }
-  runWriteTransaction(db, () => {
-    db.prepare("UPDATE installed_agents SET system_prompt = ? WHERE id = ?").run(row.before_content, row.agent_id);
-    insertReceipt(db, row, "rollback", row.after_hash, row.before_hash, now);
-    db.prepare(
-      `UPDATE agent_evolution_proposals
-         SET status = 'rolled_back', rolled_back_at = COALESCE(rolled_back_at, ?),
-             last_error = NULL, updated_at = ?
-       WHERE id = ? AND status IN ('applied','measured')`,
-    ).run(now, now, row.id);
-  });
   out(`reverted ${id} → restored ${row.target_path} (agent ${row.agent_id}).`);
 }
 

package/engine/agentlas-experience-intake.cjs

@@ -175,13 +175,24 @@ function tableExists(db, name) {
 
 function appendRunEvent(db, input) {
   if (!db || !tableExists(db, "run_events")) return false;
-  const id = input.id;
-  if (db.prepare("SELECT 1 FROM run_events WHERE id=?").get(id)) return false;
-  const seqRow = db.prepare("SELECT COALESCE(MAX(seq), -1) + 1 AS seq FROM run_events WHERE run_id=?").get(input.runId);
-  db.prepare(
-    "INSERT OR IGNORE INTO run_events (id,run_id,seq,ts,kind,chat_id,automation_id,node_id,agent_id,payload_json) VALUES (?,?,?,?,?,NULL,NULL,NULL,?,?)",
-  ).run(id, input.runId, Number(seqRow?.seq || 0), input.ts, input.kind, input.agentId || null, JSON.stringify(input.payload));
-  return true;
+  // Allocate seq and insert in one SQLite statement. The old SELECT(MAX)+INSERT
+  // pair allowed two Terminal processes to choose the same (run_id, seq); one
+  // INSERT OR IGNORE then vanished while this function still reported success.
+  const inserted = db.prepare(
+    `INSERT OR IGNORE INTO run_events
+       (id,run_id,seq,ts,kind,chat_id,automation_id,node_id,agent_id,payload_json)
+     SELECT ?,?,COALESCE(MAX(seq) + 1, 0),?,?,NULL,NULL,NULL,?,?
+       FROM run_events WHERE run_id=?`,
+  ).run(
+    input.id,
+    input.runId,
+    input.ts,
+    input.kind,
+    input.agentId || null,
+    JSON.stringify(input.payload),
+    input.runId,
+  );
+  return Number(inserted?.changes || 0) === 1;
 }
 
 function persistRunReceipt(db, receipt, agentId) {
@@ -200,7 +211,9 @@ function persistRunReceipt(db, receipt, agentId) {
 function recordIntakeDecision(db, input) {
   const sourceHash = digestHex(INTAKE_POLICY_VERSION, input.agentId, input.memoryId || "none", input.exactBase?.agentReleaseId || "none", input.environmentKey || "none");
   appendRunEvent(db, {
-    id: opaqueId("event", "experience-intake", sourceHash),
+    // The same curated memory can be observed by many distinct runs. Preserve
+    // retry idempotency within one run without collapsing later run evidence.
+    id: opaqueId("event", "experience-intake", input.runId, sourceHash),
     runId: input.runId,
     ts: input.ts,
     kind: input.kind || "experience-intake-decision",

package/engine/agentlas.cjs

@@ -213,8 +213,8 @@ function main() {
      * 에서 ls -la 실행 실증). 가장 가까운 명령을 제안하고 정직하게 멈춘다.
      * 진짜 한 단어 작업은 따옴표+run -p 로 그대로 실행된다.
      */
-    if (normalized.length === 1 && /^[A-Za-z0-9][A-Za-z0-9._:-]*$/.test(normalized[0])) {
-      const token = normalized[0];
+    if (commandArgv.length === 1 && /^[A-Za-z0-9][A-Za-z0-9._:-]*$/.test(commandArgv[0])) {
+      const token = commandArgv[0];
       const names = Object.keys(commands.COMMANDS)
         .concat(Object.keys(commands.COMMAND_ALIASES || {}))
         .concat(commands.NOT_YET_PORTED || []);
@@ -228,7 +228,10 @@ function main() {
         : `See: agentlas help  ·  to run it as a task: agentlas run -p "${token}"`);
       process.exit(1);
     }
-    code = commands.COMMANDS.run().run(ctx, normalized);
+    // 전역 출력 플래그는 이미 parseOutputFlags 가 소비했다. 원래 normalized argv 를
+    // 다시 넘기면 `agentlas --json "do work"`가 모델에게 "--json do work"라고
+    // 지시하는 꼴이 된다. 실제 명령/작업 토큰만 실행 경로로 보낸다.
+    code = commands.COMMANDS.run().run(ctx, commandArgv);
   }
 
   Promise.resolve(code).then(

package/engine/automation/daemon.cjs

@@ -185,9 +185,30 @@ async function runAutomationOnce(ctx, db, row, opts = {}) {
   // 데스크탑 스케줄러는 60초마다 리스를 갱신한다. 여기는 한 번 잡고 끝이라
   // TTL(15분)을 넘긴 실행은 프로세스가 살아 있어도 회수 대상이 됐다 — 같은
   // 자동화가 두 실행기에서 겹쳐 도는 경로. 같은 주기로 심장박동을 보낸다.
+  let activeSession = null;
+  let leaseOwnershipLost = false;
+  let leaseRenewWarningEmitted = false;
   const leaseHeartbeat = setInterval(() => {
-    try { store.renewAutomationLease(db, row.id); } catch { /* best-effort */ }
-  }, 60_000);
+    try {
+      const renewed = store.renewAutomationLease(db, row.id);
+      if (!renewed) {
+        leaseOwnershipLost = true;
+        if (activeSession && typeof activeSession.kill === "function") activeSession.kill();
+      } else {
+        leaseRenewWarningEmitted = false;
+      }
+    } catch (error) {
+      // One SQLITE_BUSY/I/O miss is not ownership loss. Keep the run alive and
+      // retry on the next heartbeat, while surfacing the first deferred renewal.
+      if (!leaseRenewWarningEmitted) {
+        leaseRenewWarningEmitted = true;
+        const code = error && typeof error === "object" && "code" in error
+          ? String(error.code || "transient")
+          : "transient";
+        ctx.err(`automation lease heartbeat deferred (${code.slice(0, 80)})`);
+      }
+    }
+  }, Math.max(10, Number(opts.leaseHeartbeatMs) || 60_000));
   if (typeof leaseHeartbeat.unref === "function") leaseHeartbeat.unref();
 
   try {
@@ -244,9 +265,18 @@ async function runAutomationOnce(ctx, db, row, opts = {}) {
       timeoutConfig: opts.timeoutConfig,
       ...(markerChatId ? { chatId: markerChatId } : {}),
     });
+    activeSession = session;
+    if (leaseOwnershipLost) {
+      session.kill();
+      return { ok: false, skipped: true, reason: "lease-lost", error: "Automation execution lease ownership lost" };
+    }
     if (typeof opts.onSession === "function") opts.onSession(session);
 
     const res = await session.send(row.prompt_template);
+    if (leaseOwnershipLost) {
+      ctx.err("Automation execution lease ownership lost");
+      return { ok: false, skipped: true, reason: "lease-lost", error: "Automation execution lease ownership lost" };
+    }
     const finalText = (res && (res.finalText || res.text)) || "";
     const failed = session.status === "failed";
     const errMsg = failed ? String(session.lastError || "runtime turn failed").slice(0, 500) : null;
@@ -265,12 +295,15 @@ async function runAutomationOnce(ctx, db, row, opts = {}) {
   } catch (e) {
     const msg = String((e && e.message) || e).slice(0, 500);
     ctx.err(msg);
+    if (leaseOwnershipLost) {
+      return { ok: false, skipped: true, reason: "lease-lost", error: "Automation execution lease ownership lost" };
+    }
     store.recordRun(db, row.id, "error", msg, opts.scheduledFor);
     store.advanceAfterRun(db, row, { ok: false, advanceSchedule: !!opts.advanceSchedule });
     return { ok: false, error: msg };
   } finally {
     clearInterval(leaseHeartbeat);
-    store.releaseAutomation(db, row.id);
+    store.releaseAutomation(db, row.id, store.LEASE_OWNER);
   }
 }
 

package/engine/automation/store.cjs

@@ -116,20 +116,22 @@ function claimAutomation(db, id, now = new Date(), owner = LEASE_OWNER) {
  */
 function renewAutomationLease(db, id, now = new Date(), owner = LEASE_OWNER) {
   if (!leaseSupported(db)) return false;
-  try {
-    const result = db
-      .prepare("UPDATE automations SET claimed_at = ? WHERE id = ? AND lease_owner = ?")
-      .run(now.toISOString(), id, owner);
-    return (result.changes ?? result.rowsAffected ?? 0) > 0;
-  } catch {
-    return false;
-  }
+  // false means definitive ownership loss. SQLite busy/I/O errors must throw
+  // so the caller can retry instead of killing a valid run as if a peer had
+  // taken the lease (Desktop renewAutomationRunLease contract).
+  const result = db
+    .prepare("UPDATE automations SET claimed_at = ? WHERE id = ? AND lease_owner = ? AND claimed_at IS NOT NULL")
+    .run(now.toISOString(), id, owner);
+  return (result.changes ?? result.rowsAffected ?? 0) > 0;
 }
 
-function releaseAutomation(db, id) {
+function releaseAutomation(db, id, owner = LEASE_OWNER) {
   try {
-    db.prepare("UPDATE automations SET claimed_at = NULL, lease_owner = NULL WHERE id = ?").run(id);
-  } catch { /* best-effort */ }
+    const result = db
+      .prepare("UPDATE automations SET claimed_at = NULL, lease_owner = NULL WHERE id = ? AND lease_owner = ?")
+      .run(id, owner);
+    return (result.changes ?? result.rowsAffected ?? 0) > 0;
+  } catch { return false; }
 }
 
 /**

package/engine/bootstrap-schema.sql

@@ -1,4 +1,4 @@
--- Agentlas 첫 실행 부트스트랩 스키마 (생성: 2026-08-26T07:56:09Z)
+-- Agentlas 첫 실행 부트스트랩 스키마 (생성: 2026-08-29T07:55:23Z)
 --
 -- ★생성물이다. 손으로 고치지 말고 재생성하라:
 --     node scripts/gen-bootstrap-schema.cjs
@@ -6,7 +6,7 @@
 -- 정본은 Desktop 의 마이그레이션 사다리(agentlas_desktop/electron/store/db.ts, SCHEMA_VERSION).
 -- 이 파일은 그 사다리를 **빈 DB** 에 끝까지 돌린 결과의 덤프이므로, 터미널이 만든 DB 는
 -- 처음부터 사다리 머리에 있다 — 데스크탑이 나중에 승급할 것이 남지 않는다.
-PRAGMA user_version=104;
+PRAGMA user_version=105;
 CREATE TABLE active_runtime (
         id INTEGER PRIMARY KEY CHECK(id = 1),
         kind TEXT NOT NULL
@@ -867,6 +867,20 @@ CREATE TABLE installed_agents (
         installed_at TEXT NOT NULL,
         tone TEXT NOT NULL
       , env_requirements_json TEXT NOT NULL DEFAULT '[]', name_en TEXT NOT NULL DEFAULT '', tagline_en TEXT NOT NULL DEFAULT '', builtin INTEGER NOT NULL DEFAULT 0, role TEXT, visibility TEXT NOT NULL DEFAULT 'visible' CHECK(visibility IN ('visible','background','private')), entity_kind TEXT, local_display_name TEXT, bookmarked_at TEXT NULL, parent_team_id TEXT NULL);
+CREATE TABLE invocation_steers (
+      id TEXT PRIMARY KEY,
+      chat_id TEXT NOT NULL,
+      original_run_id TEXT NOT NULL,
+      prompt_text TEXT NOT NULL,
+      prompt_hash TEXT NOT NULL,
+      request_json TEXT NOT NULL,
+      workspace_binding_json TEXT,
+      execution_context_json TEXT,
+      status TEXT NOT NULL CHECK(status IN ('queued','draining','started','cancelled','failed')),
+      drained_run_id TEXT,
+      queued_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL
+    );
 CREATE TABLE judgment_verdicts (
       kind          TEXT NOT NULL,
       signature     TEXT NOT NULL,
@@ -1071,6 +1085,7 @@ CREATE TABLE one_org_members (
       pending_count INTEGER NOT NULL DEFAULT 0,
       pending_kind TEXT NOT NULL DEFAULT 'approval' CHECK(pending_kind IN ('approval','review','input')),
       unread_count INTEGER NOT NULL DEFAULT 0,
+      unread_generation INTEGER NOT NULL DEFAULT 0,
       credit_state TEXT NOT NULL DEFAULT 'unknown' CHECK(credit_state IN ('ok','insufficient','unknown')),
       auto_select_tools INTEGER NOT NULL DEFAULT 1 CHECK(auto_select_tools IN (0,1)),
       collaboration_style TEXT NOT NULL DEFAULT 'default' CHECK(collaboration_style IN ('default','concise','warm','direct')),
@@ -1135,6 +1150,13 @@ CREATE TABLE projects (
         updated_at TEXT NOT NULL, folder_path TEXT, system_prompt TEXT, agent_pool_json TEXT NOT NULL DEFAULT '[]', source_type TEXT NOT NULL DEFAULT 'local', source_ref TEXT,
         FOREIGN KEY(default_agent_id) REFERENCES installed_agents(id) ON DELETE SET NULL
       );
+CREATE TABLE prompt_chat_start_intents (
+      intent_id TEXT PRIMARY KEY,
+      chat_id TEXT NOT NULL UNIQUE,
+      prompt_digest TEXT NOT NULL,
+      seed_only INTEGER NOT NULL CHECK(seed_only IN (0,1)),
+      created_at TEXT NOT NULL
+    );
 CREATE TABLE run_events (
         id TEXT PRIMARY KEY,
         run_id TEXT NOT NULL,
@@ -1426,6 +1448,10 @@ CREATE INDEX idx_installed_agent_hub_binding_exact
         ON installed_agent_hub_bindings(agent_definition_id, agent_release_id);
 CREATE INDEX idx_installed_agents_parent_team ON installed_agents(parent_team_id) WHERE parent_team_id IS NOT NULL;
 CREATE INDEX idx_installed_agents_visibility ON installed_agents(visibility, installed_at DESC);
+CREATE INDEX idx_invocation_steers_chat
+      ON invocation_steers(chat_id, queued_at, id);
+CREATE INDEX idx_invocation_steers_queue
+      ON invocation_steers(status, queued_at, id);
 CREATE INDEX idx_judgment_verdicts_recency ON judgment_verdicts(last_hit_at);
 CREATE INDEX idx_memory_agent ON memory_entries(agent_id, superseded_at);
 CREATE INDEX idx_memory_chat ON memory_entries(chat_id);
@@ -1467,6 +1493,8 @@ CREATE INDEX idx_plugin_builder_sessions_chat_updated
         ON plugin_builder_sessions(chat_id, updated_at DESC);
 CREATE INDEX idx_plugin_builder_sessions_slug_phase
         ON plugin_builder_sessions(slug, phase);
+CREATE INDEX idx_prompt_chat_start_chat
+      ON prompt_chat_start_intents(chat_id);
 CREATE INDEX idx_run_events_agent_kind_ts
           ON run_events(agent_id, kind, ts DESC);
 CREATE INDEX idx_run_events_agent_ts ON run_events(agent_id, ts DESC);

package/engine/cloud/auth.cjs

@@ -24,6 +24,12 @@ const LOGIN_CALLBACK_PATH = "/callback";
 const LOGIN_TIMEOUT_MS = 180_000;
 const MAX_LOGIN_SESSION_BYTES = 16 * 1024;
 
+function validLoginSessionValue(value) {
+  return typeof value === "string" && value.length > 0 &&
+    Buffer.byteLength(value, "utf8") <= MAX_LOGIN_SESSION_BYTES &&
+    !/[\u0000-\u0020\u007f;,]/.test(value);
+}
+
 function webBaseUrl() {
   return (process.env.AGENTLAS_WEB_BASE_URL || "https://agentlas.cloud").replace(/\/$/, "");
 }
@@ -97,13 +103,13 @@ function createLoginCallbackGuard(expectedState) {
           message: "The callback did not include a session value.",
         };
       }
-      if (Buffer.byteLength(value, "utf8") > MAX_LOGIN_SESSION_BYTES) {
+      if (!validLoginSessionValue(value)) {
         return {
           handled: true,
           final: true,
           ok: false,
           statusCode: 400,
-          message: "The login session value is too large.",
+          message: "The login session value is invalid.",
         };
       }
       return { handled: true, final: true, ok: true, statusCode: 200, value, message: "Agentlas login complete" };
@@ -120,6 +126,9 @@ function openInBrowser(url) {
     : ["xdg-open", url];
   try {
     const child = spawn(argv[0], argv.slice(1), { stdio: "ignore", detached: true });
+    // spawn failures such as a missing xdg-open arrive asynchronously. Without
+    // a listener Node treats them as an uncaught process error.
+    child.once("error", () => {});
     child.unref();
   } catch { /* ignore */ }
 }
@@ -220,18 +229,35 @@ function cliSessionPath() {
 
 function readCliSessionValue() {
   try {
-    const j = JSON.parse(fs.readFileSync(cliSessionPath(), "utf8"));
-    return (j && typeof j.value === "string" && j.value) || null;
+    const p = cliSessionPath();
+    const stat = fs.lstatSync(p);
+    if (stat.isSymbolicLink() || !stat.isFile() || stat.size > MAX_LOGIN_SESSION_BYTES * 2) return null;
+    const j = JSON.parse(fs.readFileSync(p, "utf8"));
+    return j && validLoginSessionValue(j.value) ? j.value : null;
   } catch {
     return null;
   }
 }
 
 function saveCliSession(value) {
+  if (!validLoginSessionValue(value)) throw new Error("Refusing to save an invalid Agentlas login session value.");
   const p = cliSessionPath();
   // 디렉터리 0700 + 파일 0600 — 기본 umask(0644)로 세션이 world-readable 이 되는 것을 막는다.
-  fs.mkdirSync(path.dirname(p), { recursive: true, mode: 0o700 });
-  fs.writeFileSync(p, JSON.stringify({ version: 1, value, updatedAt: new Date().toISOString() }, null, 2) + "\n", { mode: 0o600 });
+  const dir = path.dirname(p);
+  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  try { fs.chmodSync(dir, 0o700); } catch { /* win32 */ }
+  const temp = path.join(dir, `.cli-session.${process.pid}.${crypto.randomUUID()}.tmp`);
+  try {
+    fs.writeFileSync(temp, JSON.stringify({ version: 1, value, updatedAt: new Date().toISOString() }, null, 2) + "\n", {
+      encoding: "utf8",
+      mode: 0o600,
+      flag: "wx",
+    });
+    fs.renameSync(temp, p);
+  } catch (error) {
+    try { fs.rmSync(temp, { force: true }); } catch { /* preserve original */ }
+    throw error;
+  }
   try { fs.chmodSync(p, 0o600); } catch { /* win32 */ }
   return p;
 }
@@ -246,7 +272,7 @@ function deleteCliSession() {
 // 쿠키 해석 순서 계약: AGENTLAS_SESSION env → 세션 파일. (v1의 keytar 폴백은
 // 데스크탑이 세션을 keytar에 두지 않아 항상 비어 있었다 — v2에서는 싣지 않는다.)
 function cloudSessionCookie() {
-  if (process.env.AGENTLAS_SESSION) return `agentlas_session=${process.env.AGENTLAS_SESSION}`;
+  if (validLoginSessionValue(process.env.AGENTLAS_SESSION)) return `agentlas_session=${process.env.AGENTLAS_SESSION}`;
   const fileValue = readCliSessionValue();
   if (fileValue) return `agentlas_session=${fileValue}`;
   return null;
@@ -275,5 +301,5 @@ module.exports = {
   deleteCliSession,
   cloudSessionCookie,
   fetchSessionMeta,
-  _test: { createLoginState, createLoginCallbackGuard },
+  _test: { createLoginState, createLoginCallbackGuard, validLoginSessionValue },
 };