agentlas 1.0.64 → 1.0.66

package/CHANGELOG.md

@@ -1,5 +1,92 @@
 # Changelog
 
+## 1.0.66 — 2026-08-30
+
+- API 스트리밍 요청이 연결·본문 읽기 중 실패하거나 취소돼도 부모 취소 리스너와 idle 타이머를 즉시 정리해, 오래 실행한 Terminal 세션에 실패한 요청의 리스너가 누적되지 않게 했습니다.
+- MCP 정책·동의·Experience 상태 JSON은 이제 no-follow 파일 디스크립터와 읽기 전후 identity 검증을 사용하며, private-state 잠금은 살아 있는 소유자를 시간만으로 탈취하거나 이전 소유자가 후속 잠금을 지울 수 없게 했습니다.
+- `read` 권한의 Memory Event는 One 영구 원장에 기록되지 않으며, 쓰기 권한에서도 큐레이션을 통과한 제한된 후보만 안전한 원장 경로와 소유자 검증 잠금 안에서 중복 없이 전달됩니다.
+- CLI 환경설정도 같은 bounded no-follow JSON 및 live-owner 잠금을 사용해, 오래 실행 중인 설정 저장을 시간만으로 탈취하거나 링크 경로에서 설정을 읽지 않습니다.
+- Graph 인터뷰는 명시 또는 역할 기본값으로 선택한 Ollama를 이제 로컬 API 루프로 실제 실행하며, `bin`이 없다는 이유로 선택을 버리거나 다른 CLI로 바꾸지 않습니다.
+- ACP client 연결이 닫히면 진행 중 child뿐 아니라 대화 유지를 위해 남아 있던 idle Session과 Orchestrator도 모두 종료해 편집기 재연결 뒤 좀비 런타임이 쌓이지 않게 했습니다.
+- Workforce·Storm이 쓰는 Core JSON 캡처는 stdout을 16MiB로 제한하고 기본 120초 안에 끝나지 않는 Python 호출을 종료해, 손상된 Core 응답이 Terminal 메모리나 실행을 무기한 점유하지 않습니다.
+- 자동화 on/off/run/remove의 ID 접두사는 `%`·`_`를 와일드카드로 해석하지 않고, 여러 자동화와 겹치면 임의 행을 조작하는 대신 전체 ID를 요구합니다.
+- 직접 생성한 Operational RunReceipt도 반환된 실제 생성 시각을 fallback run identity에 사용해, `createdAt`을 생략한 호출이 모두 같은 `undefined` 기반 ID로 합쳐지지 않습니다.
+- Desktop이 저장한 자동화의 `antigravity`/backend/source/model/effort 핀을 Terminal도 같은 실행 정체성으로 해석하고, 정확 핀 실패 시 Dashboard 역할 풀의 다른 공급자로 넘어가지 않습니다.
+- Memory Event 큐레이션은 후보 수·본문·증거를 제한하고 단일 원자 SQL로 중복을 막으며, 기존 private 프로젝트 디렉터리의 regular 단일-link JSONL에만 bounded append합니다.
+- Experience 적립은 누락·잘못된 권한을 read로 막고, 부분적으로만 전달된 exact agent binding을 설치본이나 로컬 해시 정체성으로 조용히 대체하지 않습니다.
+- Provider resume ID 저장은 시작 시 읽은 ID를 compare-and-swap 조건으로 사용해, 같은 채팅의 늦게 끝난 이전 턴이 더 최신 세션 연속성을 덮어쓰지 않습니다.
+- Hub 응답은 stream-readable 본문만 16MiB 안에서 읽고, CLI 세션 파일도 bounded no-follow identity 검증을 통과한 private JSON만 인증 증거로 사용합니다.
+- Project 초기 시드는 실제 private `.agentlas` 디렉터리와 single-link regular 파일만 만들거나 재사용해, 미리 놓인 symlink/hardlink를 따라 외부 파일을 쓰지 않습니다.
+- Project 팀 연결은 Desktop의 현재 agent/team 정본과 레거시 행을 명시적으로 구분하고, 정확 릴리스가 로컬에 증명된 컨트롤러만 최대 64개 bounded 팀에서 실행합니다.
+- Cloud 설치·복구는 private 실제 설치 루트와 bounded single-link 저널만 신뢰하고, 심링크·하드링크·특수 엔트리로 바뀐 destination/staging/backup을 재귀 삭제하거나 교체하지 않습니다.
+- Project 활성화는 canonical 루트와 현재 private-state 무결성을 매번 확인하고, Desktop의 `antigravity` 선택을 일반 Terminal 실행에서도 `agy`로 보존하며, 능력 승인 프리픽스는 토큰 경계를 넘어 비슷한 명령을 허용하지 않습니다.
+- Workforce는 누락·손상 권한을 read로 막고 `--parallel`의 실제 8개 상한을 지키며, Dashboard 역할 풀에서 첫 가용 런타임을 우선순위대로 선택하고 빈 Worker 풀은 Orchestrator 풀을 상속합니다.
+- 설치 에이전트 라우팅은 BYOK·Ollama 판정의 인증·한도·연결 오류를 빈 응답으로 지우지 않고, CLI 런타임과 같이 실제 실패 사유를 보존합니다.
+- 명시값·환경설정의 Desktop `antigravity` 런타임도 Terminal `agy`로 일관되게 실행하며, 정상 답변의 기술 용어 `rate-limit`을 한도 거절로 오인하지 않습니다.
+- Native 모델 stdout을 16MiB로 제한하고, 생성·재사용하는 MCP 설정은 실제 private 디렉터리와 bounded single-link 파일만 허용해 비정상 스트림·링크 경로를 따라가지 않습니다.
+- node:sqlite fallback도 실제 `BEGIN IMMEDIATE`/rollback과 중첩 savepoint를 사용해, 예외가 난 다중 쓰기를 부분 커밋하지 않습니다.
+- Runtime capability 변환은 Desktop `antigravity`를 `agy`로 보존하고 ACP CLI를 API backend로 오분류하거나 알 수 없는 runtime spec을 제조하지 않습니다.
+- Local Core Workforce 어댑터는 search→validate→prepare의 WorkOrder·Selection을 정확히 묶고, 과도하게 깊거나 큰 응답 및 prototype key를 경계에서 거절합니다.
+- 로컬 모델의 파일 도구는 8MiB를 넘는 텍스트를 전체 메모리에 읽거나 쓰지 않으며, Terminal 설정 화면은 이미 제공되는 멀티모달 설정 명령을 Desktop 전용으로 잘못 안내하지 않습니다.
+- 희소 cron 탐색은 긴 분 단위 루프 대신 로컬 달력의 불일치 날짜를 건너뛰며 8년 범위를 확인해, 비윤년 직후 등록한 2월 29일 일정도 다음 윤년 실행 시각을 잃지 않습니다.
+- 저장 권한이 없을 때의 제품 기본값과 손상된 권한 값을 구분해 후자는 read로 막고, CLI 런타임 탐지는 PATH의 `which` 프로그램을 실행하지 않고 실제 실행 파일을 직접 확인합니다.
+- Hephaestus 캡처는 시간·출력 상한이나 사용자 중단 뒤 응답 없는 child를 강제 종료하고 부분 JSON을 결과처럼 렌더링하지 않으며, bounded no-follow CLI history와 그 잠금은 살아 있는 소유자를 시간만으로 탈취하거나 이전 소유자가 후속 잠금을 지우지 않습니다.
+- Graph 패키지는 중첩 비밀값까지 재귀 치환하고 그래프·매니페스트 지문을 모두 검증하며, 같은 MCP 서버를 쓰는 모든 노드를 의존성에 보존합니다.
+- 모델 카탈로그와 라우팅 영수증은 bounded no-follow 단일-link 파일로만 읽고 쓰며, `route`·`call`·`hep` 요청 안의 일반 단어 `help`를 명령 도움말로 가로채지 않습니다.
+- Desktop Core 캐시는 live-owner 버전 잠금과 streaming 크기·해시 검증을 사용하고, 경로 이탈·링크·특수 엔트리가 든 archive를 풀기 전에 거절합니다.
+
+- CLI output and argument contracts now fail closed across list, run, build,
+  One, roles, variants, graphs, firms, search, automations, credentials, MCP,
+  Experience, Ontology, Storm, Swarm, Workforce, Cloud/upload, doctor,
+  install/update/import/uninstall, login/logout/setup, project/billing,
+  ACP/multimodal/memory, browser/document/plugin, environment/account, and
+  connection commands instead
+  of silently accepting unknown or contradictory input. Invalid commands stop
+  before model, network, project, or credential mutations. JSON, YAML, quiet,
+  no-header, and no-color modes now match their documented behavior.
+- Help now rejects undocumented flags and trailing arguments, and the compact
+  startup banner stays within the actual terminal width on narrow screens.
+- Research now exposes the complete Agentlas OS 1.2.37 diagnostic, proof,
+  browser-hardpoint, module, loadout, planning, read, search, and gather command
+  set instead of rejecting every subcommand outside the legacy five.
+- Async native help now waits for its child output, and the Local Core MCP
+  transport bounds unterminated stdout responses instead of growing memory
+  without limit.
+- MCP connection probes now refuse malformed runtime arguments and handle
+  asynchronous child-stdin failures as a failed preflight instead of risking
+  an unhandled stream error.
+- REPL shell commands now participate in shutdown tracking, stop on Ctrl-C or
+  quit, escalate stubborn process groups to SIGKILL, and cannot survive the
+  parent process as detached zombies.
+- Persistent model-role changes now cover multimodal, keep Dashboard pools and
+  the resolved selection in sync, and bind resumed provider sessions to the
+  selected model (plus ACP permission identity where the protocol requires it).
+  An explicit stop no longer launches the next fallback model, while a genuine
+  ACP recovery receives its own current fingerprint and cancellation signal.
+- Project credential/env files, Telegram token files, MCP consent/inventory,
+  child-process shutdown, session event sinks, and generated output paths now
+  enforce bounded, no-follow, project-scoped storage and cleanup contracts.
+  Native context preparation also refuses broad, missing, or symbolic-link
+  agent source folders instead of recreating or writing through them.
+- Cloud packaging, agent evolution, route persistence, Storm/Swarm fan-out, and
+  Oberon rendering now reject ambiguous or stale state rather than reporting a
+  partial operation as complete.
+- Concurrent Cloud list/save/delete/bind and source-marker updates now preserve
+  every observed revision under private locks, reject corrupted tombstones, and
+  compare receipt times chronologically instead of as text.
+- Terminal palettes no longer advertise the retired `career-graph` command. Its
+  project data remains preserved, while users are directed to `ontology` for
+  sources and the Agentlas OS runtime for derived indexing.
+
+## 1.0.65 — 2026-08-29
+
+- Browser, document, and Telegram CDP flows now create and track an Agentlas-owned
+  tab instead of attaching to the first page exposed by the debugging port. Existing
+  pages require explicit target selection, owned temporary pages are cleaned up, and
+  WebSocket attachment has a bounded open timeout.
+- First-run SQLite bootstrap now starts at schema `user_version=106`, generated from
+  the Desktop migration ladder, including the multimodal model-role constraint.
+
 ## 1.0.64 — 2026-08-29
 
 - First-run database bootstrap now refuses symbolic links and non-file entries

package/README.md

@@ -79,7 +79,7 @@ agentlas cd <agent>              # Print folder path of an agent (cd "$(agentlas
 agentlas search "<query>"        # Search Hub agents (no login required)
 agentlas install <slug>          # Install Hub agent locally (gated by security trust checks)
 agentlas plugin add <slug>       # Add Hub plugin (MCP server)
-agentlas plugin list             # List active plugins (= agentlas plugins)
+agentlas plugin list             # List active plugins
 agentlas build "<prompt>"        # Build, repair, and package agents or multi-agent teams
 agentlas upload <path>           # Upload package to private Agent Cloud (default)
 agentlas upload <path> --visibility marketplace   # Explicitly publish to public Agentlas Hub
@@ -104,7 +104,7 @@ agentlas hep-local "<prompt>"    # Same staffing, registered Local agents only
 agentlas hep-cloud "<prompt>"    # Same staffing, owner Agent Cloud only
 agentlas hep-hub "<prompt>"      # Same staffing, public Hub only
 agentlas call "a,b" "<context>"  # Call explicitly named Hub or Cloud agents
-agentlas browser [...]           # Real browser hardpoint launcher
+agentlas browser [...]           # Real browser hardpoint launcher (opens an owned tab)
 agentlas route "<prompt>" [--json] # Preview routing decisions without execution
 agentlas research <sub>          # Research loadout (status|gather|search|read|plan)
 ```
@@ -114,8 +114,10 @@ agentlas research <sub>          # Research loadout (status|gather|search|read|p
 agentlas memory import <path> --agent <id> [--apply]
 agentlas evolve [list|apply <id>|revert <id>]
 agentlas ontology <sub>          # Manage project ontology (status|list|add)
-agentlas career-graph <sub>      # Ingest, query, verify, and trace career graph indices
-agentlas journal <sub>           # Run journal operations (status|verify|repair|gate)
+# Derived career-graph indexing is owned by the installed Hephaestus runtime;
+# use `agentlas ontology` for source registration.
+# Run-journal diagnosis is an expert Hephaestus path:
+# agentlas hep stormbreaker journal --run-id <id> --journal <path>
 agentlas project [status|init]   # Explicit entry point to initialize `.agentlas/` context
 agentlas context <sub>           # Context slice operations (refresh|locate|refs|slice|impact|verify)
 ```
@@ -216,7 +218,7 @@ Runtime Search Order (`engine/agentlas-core-harness.cjs`, `engine/hephaestus/run
 2. `~/.agentlas/runtime/current`
 3. Packaged Core (`<resources>/Hephaestus`, macOS: `/Applications/Agentlas.app/Contents/Resources/Hephaestus`)
 
-Commands including `storm`, `swarm`, `workforce`/`network`, `route`, `research`, `context`, `career-graph`, `journal`, `netadmin`, `hep`, `build`, `call`, `browser`, and `connect` pass directly through to this core runtime. If no core runtime is found, Agentlas Terminal halts with an explicit error and exit code 1 (no silent fallback).
+Commands including `storm`, `swarm`, `workforce`/`network`, `route`, `research`, `context`, `netadmin`, `hep`, `build`, `call`, `browser`, and `connect` pass directly through to this core runtime. Derived career-graph indexing and run-journal diagnosis are also owned by the installed Hephaestus runtime; Terminal keeps existing project data intact but no longer exposes separate `agentlas career-graph` or `agentlas journal` commands. If no core runtime is found, Agentlas Terminal halts with an explicit error and exit code 1 (no silent fallback).
 
 The terminal package owns REPL orchestration, session trees, agent registries, Hub/Cloud HTTP client surfaces, credential storage, MCP preflight probing, automation scheduling, and SQLite schema management.
 
@@ -230,7 +232,7 @@ The launcher (`bin/agentlas.cjs`) runs system Node against `engine/`. The defaul
 | Windows | `%APPDATA%\Agentlas` |
 | Linux | `$XDG_CONFIG_HOME/Agentlas` (default `~/.config/Agentlas`) |
 
-The SQLite database file is `agentlas.sqlite` (`user_version=97`). When launched for the first time without an existing database, it bootstraps schemas using `engine/bootstrap-schema.sql`. Consequently, **projects, installed agents, task history, automation sessions, and MCP registrations are shared across Desktop and Terminal**. The first ordered project agent remains the controller; additional agents are task-scoped and are stored only as execution ledgers, never as global conversations or durable owners.
+The SQLite database file is `agentlas.sqlite` (`user_version=106`). When launched for the first time without an existing database, it bootstraps schemas using `engine/bootstrap-schema.sql`. Consequently, **projects, installed agents, task history, automation sessions, and MCP registrations are shared across Desktop and Terminal**. The first ordered project agent remains the controller; additional agents are task-scoped and are stored only as execution ledgers, never as global conversations or durable owners.
 
 **Single migration authority.** The Desktop app owns the schema migration ladder; the CLI never migrates the shared database. `engine/bootstrap-schema.sql` is generated by running that ladder to completion against an empty database, so a CLI-created store already sits at the ladder head and has nothing left for Desktop to upgrade. If the CLI opens a store older than the version it knows, it refuses with an actionable message instead of migrating or silently proceeding — a second migrator on this lock-free file is what corrupted the store once before. On a machine with no Desktop app, an operator can set `AGENTLAS_STORE_MIGRATION_ROLE=owner` for a single deliberate upgrade run with every other Agentlas process closed.
 

package/bin/agentlas.cjs

@@ -36,8 +36,14 @@ for (const stream of [process.stdout, process.stderr]) {
 const fs = require("node:fs");
 const os = require("node:os");
 const path = require("node:path");
+const crypto = require("node:crypto");
 const { spawn } = require("node:child_process");
 const { configureSqliteConnection } = require("../engine/agentlas-sqlite-policy.cjs");
+const { parseOutputFlags, renderError } = require("../engine/cli-output.cjs");
+const { resolveCommandName, SELF_HELP_COMMANDS } = require("../engine/commands/index.cjs");
+
+const SQLITE_HEADER = Buffer.from("SQLite format 3\0", "ascii");
+const SQLITE_MIN_BYTES = 512;
 
 const REAL_SELF = (() => {
   try { return fs.realpathSync(__filename); } catch { return __filename; }
@@ -63,11 +69,61 @@ function dbPath() {
   return path.join(userDataDir(), "agentlas.sqlite");
 }
 
+// Keep the launcher's no-database path identical to the engine's CLI grammar.
+// A plain word "help" is valid task content (`agentlas run -p help`); only the
+// actual help/version command forms may skip first-run database bootstrap.
+function isMetadataOnlyInvocation(argv) {
+  const args = Array.isArray(argv) ? argv : [];
+  const helpRequested = args.some((arg) => arg === "--help" || arg === "-h");
+  const helpCommand = args.find((arg) => arg !== "--help" && arg !== "-h" && !String(arg).startsWith("-"));
+  if (helpRequested && helpCommand) return true;
+
+  const normalized = args.map((arg) => {
+    if (arg === "--help" || arg === "-h") return "help";
+    if (arg === "--version" || arg === "-V") return "version";
+    return arg;
+  });
+  const { rest } = parseOutputFlags(normalized);
+  const [rawCommand, ...commandArgs] = rest;
+  if (rawCommand === "help" || rawCommand === "version") return true;
+  return SELF_HELP_COMMANDS.has(resolveCommandName(rawCommand)) && commandArgs[0] === "help";
+}
+
 function securePrivateMode(target, mode) {
   if (process.platform === "win32") return;
   fs.chmodSync(target, mode);
 }
 
+function databaseStatsMatch(expected, actual) {
+  return Boolean(expected && actual) &&
+    expected.isFile() && actual.isFile() &&
+    !expected.isSymbolicLink() && !actual.isSymbolicLink() &&
+    expected.dev === actual.dev &&
+    expected.ino === actual.ino &&
+    expected.nlink === actual.nlink &&
+    expected.size === actual.size &&
+    expected.mtimeMs === actual.mtimeMs &&
+    expected.ctimeMs === actual.ctimeMs;
+}
+
+function databaseContentMatch(expected, actual) {
+  return Boolean(expected && actual) &&
+    expected.isFile() && actual.isFile() &&
+    !expected.isSymbolicLink() && !actual.isSymbolicLink() &&
+    expected.dev === actual.dev &&
+    expected.ino === actual.ino &&
+    expected.nlink === actual.nlink &&
+    expected.size === actual.size &&
+    expected.mtimeMs === actual.mtimeMs;
+}
+
+function directoryIdentityMatch(expected, actual) {
+  return Boolean(expected && actual) &&
+    expected.isDirectory() && actual.isDirectory() &&
+    !expected.isSymbolicLink() && !actual.isSymbolicLink() &&
+    expected.dev === actual.dev && expected.ino === actual.ino;
+}
+
 function databaseFileStat(target) {
   let stat;
   try {
@@ -76,12 +132,206 @@ function databaseFileStat(target) {
     if (error && error.code === "ENOENT") return null;
     throw error;
   }
-  if (stat.isSymbolicLink() || !stat.isFile()) {
-    throw new Error(`Agentlas database path must be a regular file: ${target}`);
+  if (stat.isSymbolicLink() || !stat.isFile() || stat.nlink !== 1) {
+    const error = new Error(`Agentlas database path must be a regular file: ${target}`);
+    if (stat.nlink !== 1) error.code = "AGENTLAS_DATABASE_MULTILINK";
+    throw error;
   }
   return stat;
 }
 
+function quarantinePath(target) {
+  return `${target}.bootstrap-quarantine-${process.pid}-${crypto.randomUUID()}`;
+}
+
+function bootstrapRaceError(message) {
+  const error = new Error(message);
+  error.code = "AGENTLAS_BOOTSTRAP_CONCURRENT_RETRY";
+  return error;
+}
+
+function activeBootstrapOwnerExists(target) {
+  const dir = path.dirname(target);
+  const prefix = `${path.basename(target)}.bootstrap-quarantine-`;
+  let entries;
+  try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch { return false; }
+  for (const entry of entries) {
+    if (!entry || !entry.isFile() || !entry.name.startsWith(prefix)) continue;
+    const match = entry.name.slice(prefix.length).match(/^(\d+)-[0-9a-f-]+$/i);
+    if (!match) continue;
+    const ownerPid = Number(match[1]);
+    if (!Number.isSafeInteger(ownerPid) || ownerPid <= 0 || ownerPid === process.pid) continue;
+    try {
+      process.kill(ownerPid, 0);
+      return true;
+    } catch (error) {
+      if (error && error.code === "EPERM") return true;
+    }
+  }
+  return false;
+}
+
+function activeBootstrapBuildExists(target) {
+  const dir = path.dirname(target);
+  const prefix = `${path.basename(target)}.bootstrap-`;
+  let entries;
+  try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch { return false; }
+  for (const entry of entries) {
+    if (!entry || !entry.isFile() || !entry.name.startsWith(prefix)) continue;
+    const match = entry.name.slice(prefix.length).match(/^(\d+)-/);
+    if (!match) continue;
+    const ownerPid = Number(match[1]);
+    if (!Number.isSafeInteger(ownerPid) || ownerPid <= 0 || ownerPid === process.pid) continue;
+    try {
+      process.kill(ownerPid, 0);
+      return true;
+    } catch (error) {
+      if (error && error.code === "EPERM") return true;
+    }
+  }
+  return false;
+}
+
+function waitForBootstrapOwner() {
+  try {
+    const waitCell = new Int32Array(new SharedArrayBuffer(4));
+    Atomics.wait(waitCell, 0, 0, 25);
+  } catch { /* runtimes without Atomics.wait continue with the next check */ }
+}
+
+function stableSqliteWinner(target, before) {
+  let fd;
+  try {
+    if (!before || before.size < SQLITE_MIN_BYTES) return false;
+    fd = fs.openSync(target, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW || 0));
+    const opened = fs.fstatSync(fd);
+    if (!databaseStatsMatch(before, opened)) return false;
+    const header = Buffer.alloc(SQLITE_HEADER.length);
+    if (fs.readSync(fd, header, 0, header.length, 0) !== header.length || !header.equals(SQLITE_HEADER)) return false;
+    const afterRead = fs.fstatSync(fd);
+    const afterPath = databaseFileStat(target);
+    return databaseStatsMatch(opened, afterRead) && databaseStatsMatch(afterRead, afterPath);
+  } catch {
+    return false;
+  } finally {
+    if (fd !== undefined) {
+      try { fs.closeSync(fd); } catch { /* best effort */ }
+    }
+  }
+}
+
+function quarantineEmptyDatabaseIfUnchanged(target, expected) {
+  const dir = path.dirname(target);
+  const noFollow = fs.constants.O_NOFOLLOW || 0;
+  const directoryFlags = fs.constants.O_RDONLY | (fs.constants.O_DIRECTORY || 0) | noFollow;
+  let fd;
+  let directoryFd;
+  let quarantine;
+  try {
+    // Re-lstat immediately before opening the descriptor. The original lstat
+    // alone is stale as soon as another process can replace the pathname.
+    const current = databaseFileStat(target);
+    if (!current) throw bootstrapRaceError("database disappeared while another bootstrap was quarantining it");
+    if (!databaseStatsMatch(expected, current)) {
+      if (current.size > 0) throw bootstrapRaceError("database was replaced while another bootstrap was quarantining it");
+      throw new Error("database changed before empty-file removal");
+    }
+
+    const listedDirectory = fs.lstatSync(dir);
+    if (!listedDirectory.isDirectory() || listedDirectory.isSymbolicLink()) {
+      throw new Error("database parent directory is unsafe");
+    }
+    try {
+      directoryFd = fs.openSync(dir, directoryFlags);
+      const openedDirectory = fs.fstatSync(directoryFd);
+      if (!directoryIdentityMatch(listedDirectory, openedDirectory)) {
+        throw new Error("database parent directory changed before empty-file removal");
+      }
+    } catch (error) {
+      // Windows does not permit opening a directory with the same descriptor
+      // flags. The file descriptor identity checks below remain mandatory.
+      if (process.platform !== "win32" || !["EISDIR", "EINVAL", "ENOTSUP", "EPERM"].includes(error && error.code)) {
+        throw error;
+      }
+    }
+
+    // O_NOFOLLOW prevents a swapped symlink from being opened on POSIX. The
+    // fstat fields are compared to both lstat observations before quarantine.
+    try {
+      fd = fs.openSync(target, fs.constants.O_RDONLY | noFollow);
+    } catch (error) {
+      if (error && error.code === "ENOENT") throw bootstrapRaceError("database disappeared while opening empty file");
+      throw error;
+    }
+    const opened = fs.fstatSync(fd);
+    if (!databaseStatsMatch(expected, opened)) {
+      if (opened.size > 0) throw bootstrapRaceError("database was replaced while opening empty file");
+      throw new Error("database changed while opening empty file");
+    }
+    const beforeQuarantine = databaseFileStat(target);
+    if (!beforeQuarantine) throw bootstrapRaceError("database disappeared immediately before quarantine");
+    if (!databaseStatsMatch(expected, beforeQuarantine) || !databaseStatsMatch(opened, beforeQuarantine)) {
+      if (beforeQuarantine.size > 0) throw bootstrapRaceError("database was replaced immediately before quarantine");
+      throw new Error("database changed immediately before empty-file removal");
+    }
+    const currentDirectory = fs.lstatSync(dir);
+    if (!directoryIdentityMatch(listedDirectory, currentDirectory)) {
+      throw new Error("database parent directory changed immediately before empty-file removal");
+    }
+
+    // Never unlink the pathname after a check: a concurrent replacement could
+    // make that path name a different file. Move the checked candidate to a
+    // same-directory, recoverable quarantine name instead. A UUID plus an
+    // O_EXCL reservation makes accidental destination collisions negligible;
+    // the moved inode is verified again before bootstrap can continue.
+    for (let attempt = 0; attempt < 8; attempt += 1) {
+      const candidate = quarantinePath(target);
+      try {
+        const reservation = fs.openSync(candidate, fs.constants.O_CREAT | fs.constants.O_EXCL | fs.constants.O_WRONLY, 0o600);
+        fs.closeSync(reservation);
+        quarantine = candidate;
+        break;
+      } catch (error) {
+        if (!error || error.code !== "EEXIST") throw error;
+      }
+    }
+    if (!quarantine) throw new Error("could not allocate a unique database quarantine path");
+    try {
+      fs.renameSync(target, quarantine);
+    } catch (error) {
+      if (error && error.code === "ENOENT") throw bootstrapRaceError("database disappeared while quarantining empty file");
+      throw error;
+    }
+
+    // rename updates ctime on POSIX, so compare the pre-rename inode/content
+    // fields against the post-rename descriptor and verify the post-rename
+    // ctime/other stat fields against a fresh pathname observation.
+    const afterQuarantine = fs.fstatSync(fd);
+    const quarantined = databaseFileStat(quarantine);
+    if (!databaseContentMatch(expected, afterQuarantine) || !databaseStatsMatch(afterQuarantine, quarantined)) {
+      throw new Error(`database changed while quarantining empty file; preserved at ${quarantine}`);
+    }
+    const afterDirectory = fs.lstatSync(dir);
+    if (!directoryIdentityMatch(listedDirectory, afterDirectory)) {
+      throw new Error(`database parent directory changed while quarantining empty file; preserved at ${quarantine}`);
+    }
+    let targetAfter;
+    try { targetAfter = fs.lstatSync(target); } catch (error) {
+      if (!error || error.code !== "ENOENT") throw error;
+    }
+    if (targetAfter) {
+      throw new Error(`database path was replaced while quarantining empty file; preserved at ${quarantine}`);
+    }
+  } finally {
+    if (fd !== undefined) {
+      try { fs.closeSync(fd); } catch { /* best effort */ }
+    }
+    if (directoryFd !== undefined) {
+      try { fs.closeSync(directoryFd); } catch { /* best effort */ }
+    }
+  }
+}
+
 // ── SQLite 로더 (부트스트랩용): better-sqlite3 → node:sqlite ──
 // require.resolve가 아니라 실제 로드로 판별한다 — ABI가 깨진 better-sqlite3나
 // node:sqlite가 아직 없는/플래그가 필요한 Node(≤22.4 등)를 정확히 걸러낸다.
@@ -155,18 +405,72 @@ function bootstrapDbIfMissing() {
   // 잡힌 파일이므로 없는 것으로 취급해 정상 부트스트랩 경로를 태운다. 내용이 있는데
   // 손상된 경우는 여기서 판단하지 않는다 — 그건 복구지 부트스트랩이 아니고, 멀쩡한
   // DB 를 빈 것으로 오판해 덮어쓰는 위험이 훨씬 크다.
-  const existing = databaseFileStat(p);
-  if (existing) {
+  let waitingForConcurrentBootstrap = false;
+  let emptyCandidateResolved = false;
+  for (let attempt = 0; attempt < 40; attempt += 1) {
+    let existing;
+    try {
+      existing = databaseFileStat(p);
+    } catch (error) {
+      // A winning bootstrap briefly has two hard links (its temp inode and the
+      // final name). Treat only that observable window as retryable when the
+      // owner process is still alive; a user-created hard link remains a hard
+      // failure.
+      if (error && error.code === "AGENTLAS_DATABASE_MULTILINK" && activeBootstrapBuildExists(p)) {
+        waitingForConcurrentBootstrap = true;
+        waitForBootstrapOwner();
+        continue;
+      }
+      throw error;
+    }
+    if (!existing) {
+      if (!waitingForConcurrentBootstrap) {
+        emptyCandidateResolved = true;
+        break;
+      }
+      if (!activeBootstrapOwnerExists(p)) {
+        throw new Error("Empty Agentlas database could not be replaced: concurrent bootstrap owner disappeared before publishing a database");
+      }
+      waitForBootstrapOwner();
+      continue;
+    }
     if (existing.size > 0) {
       securePrivateMode(p, 0o600);
       return { created: false, path: p };
     }
     try {
-      fs.rmSync(p);
+      quarantineEmptyDatabaseIfUnchanged(p, existing);
+      emptyCandidateResolved = true;
+      break;
     } catch (error) {
+      if (error && error.code === "AGENTLAS_BOOTSTRAP_CONCURRENT_RETRY") {
+        let winner;
+        try {
+          winner = databaseFileStat(p);
+        } catch (winnerError) {
+          if (!(winnerError && winnerError.code === "AGENTLAS_DATABASE_MULTILINK" && activeBootstrapBuildExists(p))) {
+            throw new Error(`Empty Agentlas database could not be replaced: ${winnerError && winnerError.message ? winnerError.message : winnerError}`);
+          }
+          waitingForConcurrentBootstrap = true;
+          waitForBootstrapOwner();
+          continue;
+        }
+        if (winner && winner.size >= SQLITE_MIN_BYTES && stableSqliteWinner(p, winner)) {
+          securePrivateMode(p, 0o600);
+          return { created: false, path: p };
+        }
+        if (activeBootstrapOwnerExists(p)) {
+          waitingForConcurrentBootstrap = true;
+          waitForBootstrapOwner();
+          continue;
+        }
+      }
       throw new Error(`Empty Agentlas database could not be replaced: ${error && error.message ? error.message : error}`);
     }
   }
+  if (!emptyCandidateResolved) {
+    throw new Error("Empty Agentlas database could not be replaced: concurrent bootstrap did not publish a database");
+  }
   const schemaFile = path.join(PKG_ROOT, "engine", "bootstrap-schema.sql");
   if (!exists(schemaFile)) {
     throw new Error(`Bootstrap schema not found: ${schemaFile}`);
@@ -209,9 +513,32 @@ function bootstrapDbIfMissing() {
     // EEXIST only means another path entry won the name. It is a successful
     // concurrent bootstrap only if that winner is already a real, non-empty
     // database file; a symlink/directory/empty placeholder must fail closed.
-    const winner = databaseFileStat(p);
-    if (!winner || winner.size === 0) {
-      throw new Error(`Concurrent Agentlas database bootstrap produced an invalid file: ${p}`);
+    let winnerAccepted = false;
+    for (let attempt = 0; attempt < 40; attempt += 1) {
+      let winner;
+      try {
+        winner = databaseFileStat(p);
+      } catch (error) {
+        if (error && error.code === "AGENTLAS_DATABASE_MULTILINK" && activeBootstrapBuildExists(p)) {
+          waitForBootstrapOwner();
+          continue;
+        }
+        throw error;
+      }
+      if (stableSqliteWinner(p, winner)) {
+        winnerAccepted = true;
+        break;
+      }
+      if (winner.size < SQLITE_MIN_BYTES) {
+        throw new Error(`Concurrent Agentlas database bootstrap produced an invalid or changed file: ${p}`);
+      }
+      // The winning process can unlink its temporary hard link between the
+      // winner stat and the descriptor's final stat. Retry the bounded identity
+      // check once the link count settles; never accept an unstable winner.
+      waitForBootstrapOwner();
+    }
+    if (!winnerAccepted) {
+      throw new Error(`Concurrent Agentlas database bootstrap did not publish a stable database: ${p}`);
     }
   } finally {
     try { fs.rmSync(temp, { force: true }); } catch { /* noop */ }
@@ -229,10 +556,8 @@ function bootstrapDbIfMissing() {
 
 function main() {
   const args = process.argv.slice(2);
-  const metadataOnly = args.some((arg) => arg === "help" || arg === "--help" || arg === "-h")
-    || args[0] === "version"
-    || args[0] === "--version"
-    || args[0] === "-V";
+  const { options: outputOptions } = parseOutputFlags(args);
+  const metadataOnly = isMetadataOnlyInvocation(args);
   const sqliteDriver = probeSqliteDriver();
   const engineFound = exists(ENGINE);
 
@@ -259,18 +584,18 @@ function main() {
   }
 
   if (error) {
-    process.stderr.write(error + "\n");
+    process.stderr.write(renderError(new Error(error), outputOptions) + "\n");
     process.exit(1);
   }
 
   if (!metadataOnly) {
     try {
       const boot = bootstrapDbIfMissing();
-      if (boot.created) {
+      if (boot.created && outputOptions.format === "table" && !outputOptions.quiet) {
         process.stderr.write("First run: Agentlas data initialized.\n");
       }
     } catch (e) {
-      process.stderr.write(`${e.message}\n`);
+      process.stderr.write(renderError(e, outputOptions) + "\n");
       process.exit(1);
     }
   }
@@ -310,4 +635,4 @@ function main() {
 
 if (require.main === module) main();
 
-module.exports = { bootstrapDbIfMissing, dbPath, userDataDir, probeSqliteDriver };
+module.exports = { bootstrapDbIfMissing, dbPath, userDataDir, probeSqliteDriver, isMetadataOnlyInvocation };

package/engine/acp/server.cjs

@@ -131,6 +131,21 @@ function productionTurnRunner(options = {}) {
       const s = sessions.get(acpSessionId);
       if (s) { try { s.kill(); } catch { /* best effort */ } }
     },
+    closeSession(spec) {
+      if (!spec) return;
+      const session = spec.session;
+      if (session) {
+        try { session.kill(); } catch { /* best effort */ }
+      }
+      if (spec.acpSessionId && sessions.get(spec.acpSessionId) === session) {
+        sessions.delete(spec.acpSessionId);
+      }
+      if (spec.orch && typeof spec.orch.shutdown === "function") {
+        try { spec.orch.shutdown(); } catch { /* best effort */ }
+      }
+      spec.session = null;
+      spec.orch = null;
+    },
   };
 }
 
@@ -168,7 +183,18 @@ class AcpAgentServer {
       if (!msg || typeof msg !== "object" || !msg.method) return;
       void this.handle(msg);
     });
-    rl.on("close", () => { this.closed = true; });
+    rl.on("close", () => {
+      this.closed = true;
+      // stdin을 닫은 ACP client는 이 서버의 모든 session 소유권을 내려놓았다.
+      // idle conversation의 Orchestrator도, 진행 중 native child도 남기지 않는다.
+      for (const spec of this.sessions.values()) {
+        try {
+          if (typeof this.runner.closeSession === "function") this.runner.closeSession(spec);
+          else this.runner.cancel(spec.acpSessionId);
+        } catch { /* connection close must still settle */ }
+      }
+      this.sessions.clear();
+    });
     return new Promise((resolve) => rl.on("close", resolve));
   }