agentlas 1.0.61 → 1.0.63

package/engine/sessions/session.cjs

@@ -183,6 +183,13 @@ class Session extends EventEmitter {
     this.lastError = null;
     this._privateRecoveryEvidence.length = 0;
     this._record({ type: "turn-start", at: Date.now(), prompt });
+    // ACP agents that cannot load a provider-side session need prior conversation
+    // reattached on a fresh session. Capture it before appending this turn so the
+    // current user prompt is not duplicated in both history and userPrompt.
+    const priorHistory = store.chatHistory(this.db, this.chatId).map((row) => ({
+      role: row.role,
+      text: row.text,
+    }));
     store.appendMessage(this.db, this.chatId, "user", prompt);
     let governedTurn = null;
     try {
@@ -260,6 +267,9 @@ class Session extends EventEmitter {
         this._apiAbort = null;
       }
     } else {
+      const isAcpRuntime = require("../runtimes/acp-driver.cjs").ACP_KINDS.has(this.runtime.kind);
+      const turnAbort = isAcpRuntime ? new AbortController() : null;
+      if (turnAbort) this._apiAbort = turnAbort;
       const req = {
         kind: this.runtime.kind,
         bin: this.runtime.bin,
@@ -269,6 +279,11 @@ class Session extends EventEmitter {
         systemPrompt,
         permission: this.permission,
         session: { ...this.runtimeSession },
+        history: priorHistory,
+        chatId: this.chatId,
+        agentId: this.agent.id,
+        locale: this.lang,
+        sessionFingerprintSeed: this.fingerprint,
         model: this.runtime.model,
         effort: this.runtime.effort,
         // 사용자가 이미 동의한 MCP 서버를 턴에 싣는다.
@@ -286,6 +301,7 @@ class Session extends EventEmitter {
         mcpServers: this._consentedMcpServers(),
         onSpawn: (child) => { this._child = child; },
       };
+      if (turnAbort) req.signal = turnAbort.signal;
       if (this._spawnImpl) req.spawn = this._spawnImpl;
       if (this._timeoutConfig) req.timeoutConfig = this._timeoutConfig;
       try {
@@ -325,6 +341,8 @@ class Session extends EventEmitter {
         }
       } catch (e) {
         res = { text: "", session: req.session, error: (e && e.message) || String(e) };
+      } finally {
+        if (turnAbort && this._apiAbort === turnAbort) this._apiAbort = null;
       }
     }
     this._child = null;

package/engine/telegram/connect.cjs

@@ -55,10 +55,15 @@ async function verifyBotToken(token, opts) {
 function tokenDir() {
   const dir = path.join(userDataDir(), "telegram");
   fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  if (process.platform !== "win32") fs.chmodSync(dir, 0o700);
   return dir;
 }
 function tokenFile(id) { return path.join(tokenDir(), `${id}.token`); }
-function saveToken(id, token) { fs.writeFileSync(tokenFile(id), token, { encoding: "utf8", mode: 0o600 }); }
+function saveToken(id, token) {
+  const file = tokenFile(id);
+  fs.writeFileSync(file, token, { encoding: "utf8", mode: 0o600 });
+  if (process.platform !== "win32") fs.chmodSync(file, 0o600);
+}
 function readToken(id) {
   try { return fs.readFileSync(tokenFile(id), "utf8").trim() || null; } catch { return null; }
 }
@@ -81,19 +86,31 @@ async function startConnection(db, targetKind, targetId, token, opts) {
   runWriteTransaction(db, () => {
     db.prepare(
       "INSERT INTO telegram_bindings (id, target_kind, target_id, bot_user_id, bot_username, bot_display_name, status, enabled, token_saved, token_fingerprint, created_at, updated_at) " +
-      "VALUES (?,?,?,?,?,?,'waiting_for_chat',1,1,?,?,?)",
+      "VALUES (?,?,?,?,?,?,'waiting_for_chat',1,0,?,?,?)",
     ).run(id, targetKind, targetId, me.id, me.username || null, me.first_name || null, tokenFingerprint(token), now, now);
   });
-  saveToken(id, token);
+  try {
+    saveToken(id, token);
+    runWriteTransaction(db, () => {
+      db.prepare("UPDATE telegram_bindings SET token_saved=1, updated_at=? WHERE id=?").run(new Date().toISOString(), id);
+    });
+  } catch (error) {
+    deleteToken(id);
+    try {
+      runWriteTransaction(db, () => db.prepare("DELETE FROM telegram_bindings WHERE id=?").run(id));
+    } catch { /* preserve the original storage failure */ }
+    throw error;
+  }
   // 남은 웹훅이 있으면 getUpdates가 막히므로 제거(있어도 무해).
   await telegramApi(token, "deleteWebhook", { drop_pending_updates: false }, opts).catch(() => null);
   return { id, botUsername: me.username || null };
 }
 
 /**
- * getUpdates 폴링으로 첫 private 메시지의 chat을 이 바인딩에 귀속한다.
- * 보안: 데스크탑과 같은 규칙 — 미페어링·enabled·waiting_for_chat 인 신선 바인딩
- * (30분 이내)에만, private 채팅만. 반환: 페어링된 바인딩 또는 null(시간초과).
+ * getUpdates 폴링으로 `/start <bindingId>`를 보낸 private chat을 이 바인딩에 귀속한다.
+ * 보안: 봇 이름을 발견한 제3자의 첫 메시지가 로컬 에이전트를 탈취하지 못하도록 정확한
+ * 페어링 토큰을 요구한다. 최종 UPDATE도 미페어링·enabled·waiting 상태를 조건으로 삼아
+ * 두 Terminal 프로세스가 같은 바인딩을 동시에 덮어쓰지 못하게 한다.
  */
 async function pairByPolling(db, id, { timeoutMs = 120_000, opts, onWait } = {}) {
   const token = readToken(id);
@@ -110,6 +127,8 @@ async function pairByPolling(db, id, { timeoutMs = 120_000, opts, onWait } = {})
       if (typeof update.update_id === "number") offset = Math.max(offset, update.update_id);
       const message = update.message;
       if (!message || !message.chat || message.chat.type !== "private") continue;
+      const pairingToken = String(message.text || "").match(/^\/start(?:@\w+)?\s+(\S+)/i)?.[1] || "";
+      if (pairingToken !== id) continue;
       // 신선 미페어링 바인딩인지 재확인(경합 방지) 후 귀속.
       const row = getBinding(db, id);
       if (!row || row.telegram_chat_id || row.status !== "waiting_for_chat") continue;
@@ -117,11 +136,13 @@ async function pairByPolling(db, id, { timeoutMs = 120_000, opts, onWait } = {})
       if (!Number.isFinite(createdAt) || Date.now() - createdAt > 30 * 60 * 1000) throw new Error("pairing window expired (30 min) — reconnect");
       const now = new Date().toISOString();
       const title = message.chat.title || [message.chat.first_name, message.chat.last_name].filter(Boolean).join(" ") || message.chat.username || String(message.chat.id);
-      runWriteTransaction(db, () => {
-        db.prepare("UPDATE telegram_bindings SET telegram_chat_id=?, telegram_chat_title=?, status='chat_paired', last_update_id=?, updated_at=? WHERE id=?")
-          .run(String(message.chat.id), title, offset, now, id);
+      const claimed = runWriteTransaction(db, () => {
+        return db.prepare(
+          "UPDATE telegram_bindings SET telegram_chat_id=?, telegram_chat_title=?, status='chat_paired', last_update_id=?, updated_at=? " +
+          "WHERE id=? AND telegram_chat_id IS NULL AND enabled=1 AND status='waiting_for_chat'",
+        ).run(String(message.chat.id), title, offset, now, id).changes === 1;
       });
-      return getBinding(db, id);
+      if (claimed) return getBinding(db, id);
     }
     if (offset) {
       runWriteTransaction(db, () => {

package/engine/ui/screens.cjs

@@ -11,6 +11,8 @@
  *  - 모든 화면은 ctx.out 이 아니라 ui 를 직접 받아 pi 프레임 안에 그린다.
  */
 
+const path = require("node:path");
+
 function table(ui, rows, opts = {}) {
   // rows: [[col, col, …]] — 첫 행이 헤더. 폭은 CJK 셀 폭으로 계산한다.
   const { visWidth, truncateWidth } = require("./width.cjs");
@@ -52,6 +54,28 @@ function rows(db, sql, args = []) {
 }
 const shortTs = (v) => (v ? String(v).replace("T", " ").slice(0, 16) : "");
 
+const ATTENTION_RUN_WHERE = `
+  r.id = (
+    SELECT r2.id FROM automation_runs r2
+     WHERE r2.automation_id IS r.automation_id
+     ORDER BY COALESCE(r2.started_at,'') DESC, r2.rowid DESC LIMIT 1
+  )
+  AND (
+    r.status IN ('error','partial','blocked','needs_input')
+    OR r.outcome IN ('needs_input','blocked','rejected')
+    OR (r.status = 'running' AND julianday(r.last_activity_at) < julianday('now','-15 minutes'))
+  )`;
+
+function pathContains(root, candidate) {
+  if (!root) return false;
+  try {
+    const relative = path.relative(path.resolve(String(root)), path.resolve(String(candidate)));
+    return relative === "" || (!relative.startsWith(`..${path.sep}`) && relative !== ".." && !path.isAbsolute(relative));
+  } catch {
+    return false;
+  }
+}
+
 /* ── /dashboard — 데스크탑 dashboard 의 관제 패널 집합 ── */
 function dashboard(ui, db, en) {
   const chip = (paint, s) => paint(` ${s} `);
@@ -66,11 +90,12 @@ function dashboard(ui, db, en) {
   ui.line(`  ${chip(ui.c.inverse, `${en ? "agents" : "에이전트"} ${local}`)} ${chip(ui.c.dim, `builtin ${builtin}`)} ${chip(ui.c.inverse, `${en ? "firms" : "회사"} ${firms}`)} ${chip(ui.c.dim, `${en ? "bookmarks" : "북마크"} ${marks}`)} ${chip(ui.c.dim, `${en ? "borrowed" : "대여"} ${borrowed}`)}`);
 
   // ── 확인 필요 (D1 숨은 계약 2: 없으면 실행이 조용히 멈춘 채 정상처럼 보인다) ──
-  const pending = count(db, "SELECT COUNT(*) n FROM automation_node_approvals WHERE decision NOT IN ('approved','rejected')");
+  const pending = count(db, `SELECT COUNT(*) n FROM automation_runs r WHERE ${ATTENTION_RUN_WHERE}`);
   const stalled = rows(db,
     `SELECT r.id, a.name, r.status, r.last_activity_at
        FROM automation_runs r LEFT JOIN automations a ON a.id = r.automation_id
-      WHERE r.status NOT IN ('ok','error','cancelled') ORDER BY COALESCE(r.last_activity_at,'') DESC LIMIT 5`);
+      WHERE ${ATTENTION_RUN_WHERE}
+      ORDER BY COALESCE(r.last_activity_at,'') DESC LIMIT 5`);
   ui.line("");
   ui.line(ui.c.bold(en ? "Needs attention" : "확인 필요"));
   if (!pending && !stalled.length) {
@@ -242,10 +267,10 @@ function projects(ui, db, en) {
   if (list.length) {
     table(ui, [[en ? "project" : "프로젝트", en ? "source" : "소스", en ? "chats" : "채팅", en ? "tasks" : "작업", en ? "updated" : "수정"],
       ...list.map((p) => [
-        (p.folder_path && cwd.startsWith(p.folder_path) ? "▸ " : "  ") + (p.name || p.id),
+        (pathContains(p.folder_path, cwd) ? "▸ " : "  ") + (p.name || p.id),
         p.source_type || "local", String(p.chats), String(p.tasks), shortTs(p.updated_at)])],
       { cap: [30, 10, 6, 6, 16] });
-    const here = list.find((p) => p.folder_path && cwd.startsWith(p.folder_path));
+    const here = list.find((p) => pathContains(p.folder_path, cwd));
     ui.line("");
     ui.line(here
       ? ui.c.dim(en ? `▸ this folder is connected to "${here.name}"` : `▸ 이 폴더는 "${here.name}"에 연결돼 있습니다`)
@@ -350,5 +375,4 @@ function firms(ui, db, en, ctx, arg) {
   void ctx;
 }
 
-module.exports = { dashboard, library, marketplace, settings, projects, automations, firms, table };
-
+module.exports = { dashboard, library, marketplace, settings, projects, automations, firms, table, pathContains, ATTENTION_RUN_WHERE };

package/engine/vendor/desktop-core.manifest.json

@@ -1,7 +1,7 @@
 {
-  "version": "14",
-  "url": "https://github.com/agentlas-ai/agentlas-terminal/releases/download/desktop-core-v14/desktop-core.tar.gz",
-  "sha256": "483f618756018dfb82e8851152eb50f45ed691d35e434bbbb09d3b13d844b6b9",
-  "sizeBytes": 18764550,
-  "writtenAt": "2026-08-26T12:42:18.915Z"
+  "version": "15",
+  "url": "https://github.com/agentlas-ai/agentlas-terminal/releases/download/desktop-core-v15/desktop-core.tar.gz",
+  "sha256": "df39404b55ea4e6a3571e416167f64e75bcde92fdb86f19bd26e54746156f87b",
+  "sizeBytes": 18167726,
+  "writtenAt": "2026-08-29T08:38:53.468Z"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentlas",
-  "version": "1.0.61",
+  "version": "1.0.63",
   "description": "Agentlas project terminal — run project controllers and task-scoped agent teams from the terminal. Standalone: no desktop app process required.",
   "bin": {
     "agentlas": "bin/agentlas.cjs"
@@ -27,6 +27,8 @@
   "files": [
     "bin/",
     "engine/",
+    "!engine/vendor/desktop-core/",
+    "!engine/vendor/desktop-core.tar.gz",
     "install.sh",
     "install.ps1",
     "CHANGELOG.md",