agentlas 1.0.62 → 1.0.64

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## 1.0.64 — 2026-08-29
+
+- First-run database bootstrap now refuses symbolic links and non-file entries
+  at `agentlas.sqlite` instead of following them for permission changes and
+  runtime access.
+- A competing bootstrap is accepted only after its winning database path is a
+  real, non-empty file; undeletable empty placeholders now fail with the exact
+  cause instead of being reported as a successful concurrent initialization.
+- The public runtime guidance now reflects that Kimi, Grok, and Cursor execute
+  through the shared ACP driver instead of describing their retired refusal.
+
+## 1.0.63 — 2026-08-29
+
+- `agentlas update --json` now reads the centralized output-mode context after
+  global flags are consumed, so it emits the promised JSON document instead of
+  falling back to human-readable lines.
+
 ## 1.0.62 — 2026-08-29
 
 - Terminal sessions now preserve ACP conversation identity and history across

package/README.md

@@ -27,7 +27,9 @@ Agent Trust is our product principle: agent packages are treated as portable, ow
 | **Agent CLI** | Requires at least one supported runtime CLI: `agy` (Antigravity, preferred), `claude`, `codex`, or legacy `gemini` in your `PATH`. Halts honestly with `no_runtime` if none are found (no fake model responses). |
 | **OS** | macOS is verified by the current local release gate. Linux is covered by the public adapter/CI contract. A Windows launcher is provided, but this release does not claim independent end-to-end Windows verification. |
 
-*Note: `kimi`, `grok`, and `cursor-agent` are detected by diagnostics (`doctor`) but not yet executable (`has no v2 streaming driver yet`). Supported active runtimes are `claude-code`, `codex`, `agy` (Antigravity), and legacy `gemini`.*
+*Note: active runtimes include `claude-code`, `codex`, `agy` (Antigravity),
+legacy `gemini`, and the shared ACP-backed `kimi`, `grok`, and `cursor-agent`
+adapters. `doctor` reports the exact locally executable set.*
 
 ## Installation
 
@@ -278,7 +280,7 @@ agentlas doctor      # Checks database, PATH runtimes, active CLI drivers, and c
 agentlas --where     # Outputs JSON diagnostic of launcher, engine, DB paths, driver, and Node version
 ```
 
-- **`no_runtime: no agent CLI found`**: Connect Antigravity and put `agy` on `PATH` first, or install `claude`/`codex`; `gemini` remains available as a legacy CLI. Note that `kimi`/`grok`/`cursor-agent` are detected by `doctor` but do not yet have streaming execution drivers.
+- **`no_runtime: no agent CLI found`**: Connect Antigravity and put `agy` on `PATH` first, or install `claude`/`codex`; `gemini` remains available as a legacy CLI. Kimi, Grok, and Cursor use the shared ACP driver when their local CLIs are available.
 - **`runtime '<kind>' has no v2 streaming driver yet`**: Specified `--runtime` is not supported for active execution. Supported values: `claude-code`, `codex`, `agy` (Antigravity), `gemini` (legacy).
 - **`Node vX — Node 22+ (node:sqlite) is required when better-sqlite3 is unavailable`**: `better-sqlite3` native build failed on Node 20/21. Upgrade to Node 22+ or install build tools for native compilation.
 - **`storm`/`context`/`hep` halting due to missing runtime**: Agentlas OS core runtime is missing. Install Agentlas OS or set `HEPHAESTUS_BIN=<path>`.

package/bin/agentlas.cjs

@@ -68,6 +68,20 @@ function securePrivateMode(target, mode) {
   fs.chmodSync(target, mode);
 }
 
+function databaseFileStat(target) {
+  let stat;
+  try {
+    stat = fs.lstatSync(target);
+  } catch (error) {
+    if (error && error.code === "ENOENT") return null;
+    throw error;
+  }
+  if (stat.isSymbolicLink() || !stat.isFile()) {
+    throw new Error(`Agentlas database path must be a regular file: ${target}`);
+  }
+  return stat;
+}
+
 // ── SQLite 로더 (부트스트랩용): better-sqlite3 → node:sqlite ──
 // require.resolve가 아니라 실제 로드로 판별한다 — ABI가 깨진 better-sqlite3나
 // node:sqlite가 아직 없는/플래그가 필요한 Node(≤22.4 등)를 정확히 걸러낸다.
@@ -141,14 +155,17 @@ function bootstrapDbIfMissing() {
   // 잡힌 파일이므로 없는 것으로 취급해 정상 부트스트랩 경로를 태운다. 내용이 있는데
   // 손상된 경우는 여기서 판단하지 않는다 — 그건 복구지 부트스트랩이 아니고, 멀쩡한
   // DB 를 빈 것으로 오판해 덮어쓰는 위험이 훨씬 크다.
-  if (exists(p)) {
-    let empty = false;
-    try { empty = fs.statSync(p).size === 0; } catch { empty = false; }
-    if (!empty) {
+  const existing = databaseFileStat(p);
+  if (existing) {
+    if (existing.size > 0) {
       securePrivateMode(p, 0o600);
       return { created: false, path: p };
     }
-    try { fs.rmSync(p, { force: true }); } catch { /* 지울 수 없으면 아래 link 가 EEXIST 로 알려준다 */ }
+    try {
+      fs.rmSync(p);
+    } catch (error) {
+      throw new Error(`Empty Agentlas database could not be replaced: ${error && error.message ? error.message : error}`);
+    }
   }
   const schemaFile = path.join(PKG_ROOT, "engine", "bootstrap-schema.sql");
   if (!exists(schemaFile)) {
@@ -189,12 +206,23 @@ function bootstrapDbIfMissing() {
     if (!e || e.code !== "EEXIST") {
       throw new Error(`Atomic database bootstrap failed: ${e && e.message ? e.message : e}`);
     }
+    // EEXIST only means another path entry won the name. It is a successful
+    // concurrent bootstrap only if that winner is already a real, non-empty
+    // database file; a symlink/directory/empty placeholder must fail closed.
+    const winner = databaseFileStat(p);
+    if (!winner || winner.size === 0) {
+      throw new Error(`Concurrent Agentlas database bootstrap produced an invalid file: ${p}`);
+    }
   } finally {
     try { fs.rmSync(temp, { force: true }); } catch { /* noop */ }
     try { fs.rmSync(temp + "-journal", { force: true }); } catch { /* noop */ }
     try { fs.rmSync(temp + "-wal", { force: true }); } catch { /* noop */ }
     try { fs.rmSync(temp + "-shm", { force: true }); } catch { /* noop */ }
   }
+  const finalStat = databaseFileStat(p);
+  if (!finalStat || finalStat.size === 0) {
+    throw new Error(`Agentlas database bootstrap did not produce a valid file: ${p}`);
+  }
   securePrivateMode(p, 0o600);
   return { created, path: p };
 }

package/engine/commands/update.cjs

@@ -48,9 +48,9 @@ async function checkNpmLatest({ fetch: fetchImpl, timeoutMs = 8_000 } = {}) {
   };
 }
 
-async function run(ctx, args) {
-  const json = args.includes("--json");
-  const status = await checkNpmLatest();
+async function run(ctx, args, deps = {}) {
+  const json = ctx.output?.format === "json" || args.includes("--json");
+  const status = await checkNpmLatest(deps);
   if (json) {
     ctx.out(JSON.stringify(status, null, 2));
     return 0;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentlas",
-  "version": "1.0.62",
+  "version": "1.0.64",
   "description": "Agentlas project terminal — run project controllers and task-scoped agent teams from the terminal. Standalone: no desktop app process required.",
   "bin": {
     "agentlas": "bin/agentlas.cjs"