agentlas 1.0.64 → 1.0.66

package/engine/mcp/contract.cjs

@@ -18,6 +18,7 @@ const MAX_JSON_BYTES = 2 * 1024 * 1024;
 const MAX_APPROVED_MCP_PER_BUILD = 8;
 const STATE_LOCK_STALE_MS = 30_000;
 const STATE_LOCK_WAIT_MS = 2_000;
+const STATE_LOCK_OWNER_MAX_BYTES = 512;
 
 // Public contract text must be compact, value-free, and instruction-safe.
 const UNSAFE_TEXT_PATTERNS = [
@@ -92,14 +93,109 @@ function safeDisplayName(value, fallback) {
   return text;
 }
 
+function fileIdentityEqual(left, right) {
+  return Boolean(left && right) && left.dev === right.dev && left.ino === right.ino && left.nlink === right.nlink && left.mode === right.mode;
+}
+
+function fileTimesEqual(left, right) {
+  return Boolean(left && right) && left.mtimeMs === right.mtimeMs && left.ctimeMs === right.ctimeMs;
+}
+
+function assertRegularJsonFile(stat, label) {
+  if (!stat || !stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1) {
+    throw new Error(`${label} must be a regular file (symlinks are not accepted)`);
+  }
+}
+
+function assertJsonFileSize(stat, label) {
+  if (stat.size <= 0 || stat.size > MAX_JSON_BYTES) throw new Error(`${label} has an invalid size`);
+}
+
+function openReadOnlyNoFollow(filePath) {
+  const noFollow = fs.constants.O_NOFOLLOW || 0;
+  try {
+    return fs.openSync(filePath, fs.constants.O_RDONLY | noFollow);
+  } catch (error) {
+    // Node does not expose a no-follow open flag on every Windows filesystem.
+    // Keep the lstat/fstat/path identity checks below as the fallback there;
+    // never silently drop O_NOFOLLOW on POSIX.
+    if (process.platform === "win32" && noFollow && ["EINVAL", "ENOTSUP"].includes(error && error.code)) {
+      return fs.openSync(filePath, fs.constants.O_RDONLY);
+    }
+    throw error;
+  }
+}
+
+function readBoundedDescriptor(fd, maxBytes) {
+  const chunks = [];
+  let total = 0;
+  while (total <= maxBytes) {
+    const capacity = Math.min(64 * 1024, maxBytes + 1 - total);
+    if (capacity <= 0) break;
+    const chunk = Buffer.allocUnsafe(capacity);
+    const result = fs.readSync(fd, chunk, 0, capacity, null);
+    const bytesRead = typeof result === "number" ? result : result.bytesRead;
+    if (!Number.isInteger(bytesRead) || bytesRead < 0) throw new Error("descriptor read returned an invalid byte count");
+    if (bytesRead === 0) break;
+    chunks.push(chunk.subarray(0, bytesRead));
+    total += bytesRead;
+  }
+  return { bytes: Buffer.concat(chunks, total), byteLength: total };
+}
+
 function readJsonFile(filePath, label) {
   const absolute = path.resolve(filePath);
-  const stat = fs.lstatSync(absolute);
-  if (!stat.isFile() || stat.isSymbolicLink()) throw new Error(`${label} must be a regular file (symlinks are not accepted)`);
-  if (stat.size <= 0 || stat.size > MAX_JSON_BYTES) throw new Error(`${label} has an invalid size`);
-  let value;
-  try { value = JSON.parse(fs.readFileSync(absolute, "utf8")); } catch (error) { throw new Error(`${label} is not valid JSON: ${error.message}`); }
-  return { absolute, value };
+  let fd;
+  let listed;
+  try {
+    listed = fs.lstatSync(absolute);
+    assertRegularJsonFile(listed, label);
+    assertJsonFileSize(listed, label);
+    fd = openReadOnlyNoFollow(absolute);
+  } catch (error) {
+    if (error && error.code === "ELOOP") {
+      throw new Error(`${label} must be a regular file (symlinks are not accepted)`);
+    }
+    throw error;
+  }
+  try {
+    const before = fs.fstatSync(fd);
+    assertRegularJsonFile(before, label);
+    assertJsonFileSize(before, label);
+    if (!fileIdentityEqual(listed, before) || !fileTimesEqual(listed, before) || listed.size !== before.size) {
+      throw new Error(`${label} changed while it was being read`);
+    }
+
+    let captured;
+    try {
+      captured = readBoundedDescriptor(fd, MAX_JSON_BYTES);
+    } catch (error) {
+      throw new Error(`${label} is not valid JSON: ${error.message}`);
+    }
+    const after = fs.fstatSync(fd);
+    let current;
+    try { current = fs.lstatSync(absolute); }
+    catch { throw new Error(`${label} changed while it was being read`); }
+    if (!current.isFile() || current.isSymbolicLink() || current.nlink !== 1) {
+      throw new Error(`${label} changed while it was being read`);
+    }
+    if (captured.byteLength <= 0 || captured.byteLength > MAX_JSON_BYTES || after.size <= 0 || after.size > MAX_JSON_BYTES) {
+      throw new Error(`${label} has an invalid size`);
+    }
+    if (
+      !fileIdentityEqual(before, after) || !fileTimesEqual(before, after) || after.size !== before.size ||
+      captured.byteLength !== after.size || !fileIdentityEqual(before, current) ||
+      !fileTimesEqual(before, current) || current.size !== after.size
+    ) {
+      throw new Error(`${label} changed while it was being read`);
+    }
+    let value;
+    try { value = JSON.parse(captured.bytes.toString("utf8")); }
+    catch (error) { throw new Error(`${label} is not valid JSON: ${error.message}`); }
+    return { absolute, value };
+  } finally {
+    try { fs.closeSync(fd); } catch { /* best effort */ }
+  }
 }
 
 function writePrivateJsonAtomic(filePath, value) {
@@ -122,43 +218,152 @@ function waitSync(milliseconds) {
   Atomics.wait(signal, 0, 0, milliseconds);
 }
 
+function processIsAlive(pid) {
+  if (!Number.isSafeInteger(pid) || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    if (error && error.code === "ESRCH") return false;
+    // EPERM and unknown failures mean the process may still be alive. Never
+    // reclaim a stale-looking lock when liveness cannot be disproved.
+    return true;
+  }
+}
+
+function readLockOwner(lockPath, labels) {
+  const ownerPath = path.join(lockPath, "owner.json");
+  let fd;
+  try {
+    const listed = fs.lstatSync(ownerPath);
+    if (!listed.isFile() || listed.isSymbolicLink() || listed.nlink !== 1) throw new Error(labels.unsafe);
+    fd = openReadOnlyNoFollow(ownerPath);
+    const before = fs.fstatSync(fd);
+    if (!before.isFile() || before.isSymbolicLink() || before.nlink !== 1 || before.size <= 0 || before.size > STATE_LOCK_OWNER_MAX_BYTES) {
+      throw new Error(labels.unsafe);
+    }
+    // 정상 release/다음 owner 획득과 겹친 교체는 unsafe 파일이 아니라 재시도 신호다.
+    if (!fileIdentityEqual(listed, before) || !fileTimesEqual(listed, before)) return null;
+    const captured = readBoundedDescriptor(fd, STATE_LOCK_OWNER_MAX_BYTES);
+    const after = fs.fstatSync(fd);
+    let current;
+    try { current = fs.lstatSync(ownerPath); }
+    catch (error) {
+      if (error && error.code === "ENOENT") return null;
+      throw new Error(labels.unsafe);
+    }
+    if (
+      captured.byteLength !== before.size || !fileIdentityEqual(before, after) || !fileTimesEqual(before, after) ||
+      after.size !== before.size || !fileIdentityEqual(before, current) || !fileTimesEqual(before, current) ||
+      current.size !== after.size
+    ) return null;
+    let owner;
+    try { owner = JSON.parse(captured.bytes.toString("utf8")); }
+    catch { throw new Error(labels.unsafe); }
+    if (
+      !owner || !Number.isSafeInteger(owner.pid) || owner.pid <= 0 ||
+      typeof owner.nonce !== "string" || !/^[a-f0-9]{32}$/.test(owner.nonce)
+    ) throw new Error(labels.unsafe);
+    return owner;
+  } catch (error) {
+    if (error && error.code === "ENOENT") return null;
+    if (error && error.code === "ELOOP") throw new Error(labels.unsafe);
+    throw error;
+  } finally {
+    if (fd !== undefined) try { fs.closeSync(fd); } catch { /* best effort */ }
+  }
+}
+
 /**
- * <stateFile>.lock 파일 기반 상호배제. 크래시 잔류 락은 STALE_MS 이후 회수한다.
- * busyMessage/unsafeMessage를 호출자가 주어 사용자 문구를 상태별로 유지한다.
+ * <stateFile>.lock directory 기반 상호배제. 크래시 잔류 락은 owner PID가
+ * 실제로 죽었다고 확인될 때만 고유 quarantine 경로로 회수한다. 디렉터리
+ * rename이 소유권 hand-off 경계이므로 이전 소유자의 cleanup이 successor를
+ * unlink할 수 없다.
  */
 function withPrivateStateLock(stateFile, labels, action) {
   const dir = path.dirname(stateFile);
   fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
   try { fs.chmodSync(dir, 0o700); } catch { /* best effort */ }
-  const lockFile = `${stateFile}.lock`;
+  const lockPath = `${stateFile}.lock`;
   const deadline = Date.now() + STATE_LOCK_WAIT_MS;
-  let descriptor = null;
-  while (descriptor == null) {
+  let acquiredOwner = null;
+  let acquired = false;
+  while (!acquired) {
     try {
-      descriptor = fs.openSync(lockFile, "wx", 0o600);
-      fs.writeFileSync(descriptor, `${process.pid}\n${new Date().toISOString()}\n`, "utf8");
+      fs.mkdirSync(lockPath, { mode: 0o700 });
     } catch (error) {
-      if (!error || error.code !== "EEXIST") throw error;
-      try {
-        const stat = fs.lstatSync(lockFile);
-        if (!stat.isFile() || stat.isSymbolicLink()) throw new Error(labels.unsafe);
-        if (Date.now() - stat.mtimeMs > STATE_LOCK_STALE_MS) {
-          fs.unlinkSync(lockFile);
-          continue;
-        }
-      } catch (statError) {
+      if (!error || (error.code !== "EEXIST" && error.code !== "ENOENT")) throw error;
+      if (error.code === "ENOENT") continue;
+      let stat;
+      try { stat = fs.lstatSync(lockPath); }
+      catch (statError) {
         if (statError && statError.code === "ENOENT") continue;
         throw statError;
       }
+      if (!stat.isDirectory() || stat.isSymbolicLink()) throw new Error(labels.unsafe);
+      let owner;
+      try { owner = readLockOwner(lockPath, labels); }
+      catch (ownerError) { throw ownerError; }
+      if (Date.now() - stat.mtimeMs > STATE_LOCK_STALE_MS) {
+        // Missing or malformed owner identity is not evidence of a dead PID.
+        // Stay fail-closed rather than stealing a possibly live lock.
+        if (!owner || processIsAlive(owner.pid)) {
+          if (Date.now() >= deadline) throw new Error(labels.busy);
+          waitSync(25);
+          continue;
+        }
+        const quarantine = `${lockPath}.stale-${process.pid}-${crypto.randomBytes(6).toString("hex")}`;
+        try {
+          fs.renameSync(lockPath, quarantine);
+          fs.rmSync(quarantine, { recursive: true, force: true });
+          continue;
+        } catch (reclaimError) {
+          if (reclaimError && reclaimError.code === "ENOENT") continue;
+          throw reclaimError;
+        }
+      }
       if (Date.now() >= deadline) throw new Error(labels.busy);
       waitSync(25);
+      // 기존 소유자가 정상적으로 보유 중이다. 같은 디렉터리의 owner.json에
+      // 쓰기를 시도하면 EEXIST 처리 중 활성 잠금을 abandoned로 오인해 지울 수 있다.
+      continue;
+    }
+    try {
+      acquiredOwner = {
+        pid: process.pid,
+        nonce: crypto.randomBytes(16).toString("hex"),
+        createdAt: new Date().toISOString(),
+      };
+      // owner.json 자체도 원자적으로 공개한다. mkdir 직후의 부분 쓰기를 다른
+      // contender가 size=0/malformed unsafe lock으로 관측하면 정상 경합이 실패한다.
+      writePrivateJsonAtomic(path.join(lockPath, "owner.json"), acquiredOwner);
+      acquired = true;
+    } catch (error) {
+      const abandoned = `${lockPath}.abandoned-${process.pid}-${crypto.randomBytes(6).toString("hex")}`;
+      try {
+        fs.renameSync(lockPath, abandoned);
+        fs.rmSync(abandoned, { recursive: true, force: true });
+      } catch { /* original owner-write error remains authoritative */ }
+      throw error;
     }
   }
   try {
     return action();
   } finally {
-    try { fs.closeSync(descriptor); } catch { /* noop */ }
-    try { fs.unlinkSync(lockFile); } catch { /* crash recovery handles leftovers */ }
+    let ownsLock = false;
+    try {
+      const owner = readLockOwner(lockPath, labels);
+      ownsLock = Boolean(owner && acquiredOwner && owner.pid === acquiredOwner.pid && owner.nonce === acquiredOwner.nonce);
+    } catch { /* do not remove an unverified lock */ }
+    if (ownsLock) {
+      const cleanup = `${lockPath}.done-${process.pid}-${crypto.randomBytes(6).toString("hex")}`;
+      try {
+        fs.renameSync(lockPath, cleanup);
+        fs.rmSync(cleanup, { recursive: true, force: true });
+      } catch (error) {
+        if (!error || error.code !== "ENOENT") throw error;
+      }
+    }
   }
 }
 

package/engine/mcp/inventory.cjs

@@ -13,6 +13,7 @@ const crypto = require("node:crypto");
 const fs = require("node:fs");
 const os = require("node:os");
 const path = require("node:path");
+const { userDataDir: defaultUserDataDir } = require("../core/paths.cjs");
 const {
   hasSensitiveRuntimeArgument,
   mcpRuntimeHome,
@@ -40,6 +41,10 @@ const TOKEN_BUDGET = Object.freeze({
   experienceRetrievalMaxItems: 8,
 });
 
+function resolvedMcpUserDataDir(value) {
+  return typeof value === "string" && value.trim() ? value : defaultUserDataDir();
+}
+
 const MCP_REQUIREMENT_REQUIRED = [
   "schemaVersion", "kind", "requirementId", "catalogId", "reason", "capabilities",
   "required", "requiresKey", "priority", "permissions", "alternatives", "unavailablePolicy",
@@ -144,8 +149,12 @@ function validateMcpPolicy(value) {
 
 function loadProjectMcpPolicy(cwd) {
   const file = path.join(cwd || process.cwd(), ".agentlas", "mcp-policy.json");
-  if (!fs.existsSync(file)) return null;
-  const { value } = readJsonFile(file, "MCP policy");
+  let value;
+  try { ({ value } = readJsonFile(file, "MCP policy")); }
+  catch (error) {
+    if (error && error.code === "ENOENT") return null;
+    throw error;
+  }
   return validateMcpPolicy(value);
 }
 
@@ -154,9 +163,10 @@ function loadProjectMcpPolicy(cwd) {
  * 소스: 프로세스 env + userData/credentials.env + ~/.agentlas/credentials.env.
  */
 function readCredentialNames(userDataDir, env = process.env) {
+  const resolvedUserDataDir = resolvedMcpUserDataDir(userDataDir);
   const names = new Set(Object.keys(env || {}).filter((key) => ENV_RE.test(key) && env[key]));
   const files = [
-    path.join(userDataDir, "credentials.env"),
+    path.join(resolvedUserDataDir, "credentials.env"),
     path.join(os.homedir(), ".agentlas", "credentials.env"),
   ];
   for (const file of files) {
@@ -193,7 +203,7 @@ function collectSystemMcpInventory(db, options = {}) {
     rows = [];
     registryStatus = "unavailable";
   }
-  const credentialNames = readCredentialNames(options.userDataDir || "", options.env || process.env);
+  const credentialNames = readCredentialNames(options.userDataDir, options.env || process.env);
   const inventory = [];
   const seen = new Set();
   for (const row of rows) {
@@ -279,7 +289,7 @@ function materializeTrustedSystemMcpServer(row, options = {}) {
   });
   if (options.createRuntimeHome !== false) {
     Object.defineProperty(server, "mcpRuntimeHome", {
-      value: mcpRuntimeHome(options.userDataDir, `${catalogId}\u0000${row.id}`),
+      value: mcpRuntimeHome(resolvedMcpUserDataDir(options.userDataDir), `${catalogId}\u0000${row.id}`),
       enumerable: false,
     });
   }

package/engine/mcp/plan.cjs

@@ -58,7 +58,11 @@ function lexicalRequirementHintIds(request, inventory) {
   const text = String(request || "").toLowerCase();
   const ids = [];
   for (const item of inventory) {
-    const direct = text.includes(String(item.catalogId).toLowerCase()) || text.includes(String(item.name || "").toLowerCase());
+    const catalogId = String(item.catalogId || "").trim().toLowerCase();
+    const name = String(item.name || "").trim().toLowerCase();
+    // String#includes("") is always true. A registry row whose optional display
+    // name is empty must not become a hint for every unrelated build request.
+    const direct = Boolean((catalogId && text.includes(catalogId)) || (name && text.includes(name)));
     const heuristic = HEURISTIC_GROUPS.some(([nameRe, taskRe]) => nameRe.test(`${item.catalogId} ${item.name}`) && taskRe.test(text));
     if (direct || heuristic) ids.push(item.catalogId);
   }

package/engine/mcp/probe.cjs

@@ -30,6 +30,7 @@ function probeSystemMcpServerConnection(server, options = {}) {
     let abortHandler = null;
     let forceKillTimer = null;
     let childClosed = false;
+    let writeMessage = () => false;
     const terminateChild = (signal) => {
       const pid = Number(child?.pid);
       // detached 자식은 프로세스 그룹(-pid)째로 종료해야 패키지 매니저가 띄운
@@ -63,12 +64,8 @@ function probeSystemMcpServerConnection(server, options = {}) {
       if (message.id === 1) {
         if (message.error || !message.result) return finish(false, "initialize_failed");
         initialized = true;
-        try {
-          child.stdin.write(`${JSON.stringify({ jsonrpc: "2.0", method: "notifications/initialized", params: {} })}\n`);
-          child.stdin.write(`${JSON.stringify({ jsonrpc: "2.0", id: 2, method: "tools/list", params: {} })}\n`);
-        } catch {
-          finish(false, "connection_failed");
-        }
+        if (!writeMessage({ jsonrpc: "2.0", method: "notifications/initialized", params: {} })) return;
+        writeMessage({ jsonrpc: "2.0", id: 2, method: "tools/list", params: {} });
       } else if (message.id === 2 && initialized) {
         finish(
           !message.error && Boolean(message.result),
@@ -100,8 +97,13 @@ function probeSystemMcpServerConnection(server, options = {}) {
       }
     };
     const timer = setTimeout(() => finish(false, "connection_timeout"), timeoutMs);
+    const runtimeArgs = parseRuntimeServerArgs(server.args_json);
+    if (!runtimeArgs) {
+      finish(false, "invalid_runtime_args");
+      return;
+    }
     try {
-      child = spawnImpl(server.command, parseRuntimeServerArgs(server.args_json) || [], {
+      child = spawnImpl(server.command, runtimeArgs, {
         cwd: options.cwd || process.cwd(),
         env: buildMcpChildEnv(options.env || process.env, server.credentialKeyNames || [], {
           runtimeHome: server.mcpRuntimeHome || mcpRuntimeHome(options.userDataDir, server.catalog_id || server.id || server.command),
@@ -110,6 +112,7 @@ function probeSystemMcpServerConnection(server, options = {}) {
         stdio: ["pipe", "pipe", "ignore"],
       });
       child.once("error", () => finish(false, "connection_failed"));
+      child.stdin.on?.("error", () => finish(false, "connection_failed"));
       child.once("close", () => {
         childClosed = true;
         if (forceKillTimer) clearTimeout(forceKillTimer);
@@ -122,7 +125,19 @@ function probeSystemMcpServerConnection(server, options = {}) {
         buffer = Buffer.concat([buffer, Buffer.from(chunk)]);
         drain();
       });
-      child.stdin.write(`${JSON.stringify({
+      writeMessage = (message) => {
+        if (settled) return false;
+        try {
+          child.stdin.write(`${JSON.stringify(message)}\n`, (error) => {
+            if (error) finish(false, "connection_failed");
+          });
+          return true;
+        } catch {
+          finish(false, "connection_failed");
+          return false;
+        }
+      };
+      writeMessage({
         jsonrpc: "2.0",
         id: 1,
         method: "initialize",
@@ -131,7 +146,7 @@ function probeSystemMcpServerConnection(server, options = {}) {
           capabilities: {},
           clientInfo: { name: "agentlas-terminal-build", version: "1" },
         },
-      })}\n`);
+      });
       if (options.signal) {
         abortHandler = () => finish(false, "connection_timeout");
         if (options.signal.aborted) abortHandler();

package/engine/memory-cli/curate.cjs

@@ -19,6 +19,11 @@ const fs = require("node:fs");
 const path = require("node:path");
 const { tableExists, columnExists } = require("../core/db.cjs");
 
+const MAX_MEMORY_EVENTS = 32;
+const MAX_MEMORY_CONTENT_CHARS = 900;
+const MAX_MEMORY_LOG_BYTES = 16 * 1024 * 1024;
+const MAX_MEMORY_LOG_RECORD_BYTES = 16 * 1024;
+
 // 앱과 동일한 컴파일된 manifest — 빌트인 에이전트 + 메모리 아키텍처 상수.
 let _arch = null;
 function loadArch() {
@@ -45,13 +50,43 @@ const SECRET_RE = [/\b(?:sk|pk|rk)-[A-Za-z0-9]{16,}/, /AKIA[0-9A-Z]{16}/, /ghp_[
  * 이 모듈이 위장하지 않는다.
  */
 function logCli(projectPath, rec) {
-  if (!projectPath) return;
+  if (!projectPath) return false;
+  let fd = null;
   try {
     const arch = loadArch();
-    const dir = path.join(projectPath, arch.memoryDir);
-    fs.mkdirSync(dir, { recursive: true });
-    fs.appendFileSync(path.join(dir, arch.logFile), JSON.stringify(rec) + "\n", "utf8");
-  } catch { /* ignore */ }
+    // Memory curation is not project initialization. Only an existing private
+    // .agentlas directory may receive the best-effort decision log.
+    const root = fs.realpathSync(path.resolve(projectPath));
+    const dir = path.join(root, arch.memoryDir || ".agentlas");
+    const dirStat = fs.lstatSync(dir);
+    if (!dirStat.isDirectory() || dirStat.isSymbolicLink()) return false;
+    if (process.platform !== "win32" && (dirStat.mode & 0o077) !== 0) return false;
+
+    const line = Buffer.from(JSON.stringify(rec) + "\n", "utf8");
+    if (line.length <= 1 || line.length > MAX_MEMORY_LOG_RECORD_BYTES) return false;
+    const file = path.join(dir, arch.logFile || "memory-log.jsonl");
+    const noFollow = fs.constants.O_NOFOLLOW || 0;
+    fd = fs.openSync(
+      file,
+      fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_APPEND | noFollow,
+      0o600,
+    );
+    const opened = fs.fstatSync(fd);
+    const listed = fs.lstatSync(file);
+    if (
+      !opened.isFile() || opened.nlink !== 1 ||
+      !listed.isFile() || listed.isSymbolicLink() || listed.nlink !== 1 ||
+      opened.dev !== listed.dev || opened.ino !== listed.ino ||
+      opened.size + line.length > MAX_MEMORY_LOG_BYTES
+    ) return false;
+    const written = fs.writeSync(fd, line, 0, line.length, null);
+    if (written !== line.length) return false;
+    fs.fsyncSync(fd);
+    fs.fchmodSync(fd, 0o600);
+    const after = fs.fstatSync(fd);
+    return after.isFile() && after.nlink === 1 && after.dev === opened.dev && after.ino === opened.ino;
+  } catch { return false; }
+  finally { if (fd != null) try { fs.closeSync(fd); } catch { /* best effort */ } }
 }
 
 function coerceText(v, max) {
@@ -128,9 +163,9 @@ function curateCliReply(db, text, ctx) {
     if (!ctx || !Array.isArray(ctx.curatedMemories) || !memory) return;
     if (!ctx.curatedMemories.some((item) => item.id === memory.id)) ctx.curatedMemories.push(memory);
   };
-  for (const ev of events) {
+  for (const ev of events.slice(0, MAX_MEMORY_EVENTS)) {
     const content = ev && typeof ev.content === "string" ? ev.content.trim() : "";
-    if (!content) continue;
+    if (!content || content.length > MAX_MEMORY_CONTENT_CHARS) continue;
     if (ev.sensitivity === "secret" || SECRET_RE.some((re) => re.test(content))) continue;
     const kind = arch.kinds.includes(ev.memory_kind) ? ev.memory_kind : "fact";
     let scope = ev.suggested_scope === "agent_team"
@@ -146,17 +181,37 @@ function curateCliReply(db, text, ctx) {
     const scopedAgentId = scope === "agent_repo" ? (ctx.agentId || null) : null;
     const requestContext = normalizeRequestContext(ev, ctx, ppath);
     try {
-      const dup = db.prepare("SELECT id,scope,kind,content,confidence,sensitivity,context_json FROM memory_entries WHERE scope=? AND kind=? AND lower(trim(content))=? AND superseded_at IS NULL AND (project_path IS ? OR project_path=?) AND (agent_id IS ? OR agent_id=?) LIMIT 1").get(scope, kind, content.toLowerCase(), ppath, ppath, scopedAgentId, scopedAgentId);
-      if (dup) {
-        rememberCurated({ ...dup, requestContext });
+      const memoryId = randomUUID();
+      const confidence = ["low", "medium", "high"].includes(ev.confidence) ? ev.confidence : "medium";
+      const sensitivity = ["public", "internal", "private"].includes(ev.sensitivity) ? ev.sensitivity : "internal";
+      const evidence = Array.isArray(ev.evidence_refs)
+        ? ev.evidence_refs.filter((item) => typeof item === "string").slice(0, 16).map((item) => item.slice(0, 240))
+        : [];
+      // One statement owns both the duplicate observation and insertion. A
+      // SELECT followed by INSERT allowed two Terminal processes to observe
+      // absence and persist the same memory under different UUIDs.
+      const inserted = db.prepare(`
+        INSERT INTO memory_entries
+          (id,scope,kind,content,project_id,project_path,agent_id,chat_id,confidence,sensitivity,evidence_json,context_json,superseded_at,created_at)
+        SELECT ?,?,?,?,?,?,?,?,?,?,?,?,NULL,?
+        WHERE NOT EXISTS (
+          SELECT 1 FROM memory_entries
+          WHERE scope=? AND kind=? AND lower(trim(content))=? AND superseded_at IS NULL
+            AND (project_path IS ? OR project_path=?)
+            AND (agent_id IS ? OR agent_id=?)
+        )
+      `).run(
+        memoryId, scope, kind, content, ctx.projectId || null, ppath, scopedAgentId, null,
+        confidence, sensitivity, JSON.stringify(evidence), JSON.stringify(requestContext), now,
+        scope, kind, content.toLowerCase(), ppath, ppath, scopedAgentId, scopedAgentId,
+      );
+      if ((inserted.changes ?? inserted.rowsAffected ?? 0) > 0) {
+        rememberCurated({ id: memoryId, scope, kind, content, confidence, sensitivity, requestContext });
+        logCli(ctx.projectPath, { action: "written", scope, kind, content, request_context: requestContext, at: now });
         continue;
       }
-      const memoryId = randomUUID();
-      const confidence = ev.confidence || "medium";
-      const sensitivity = ev.sensitivity || "internal";
-      db.prepare("INSERT INTO memory_entries (id,scope,kind,content,project_id,project_path,agent_id,chat_id,confidence,sensitivity,evidence_json,context_json,superseded_at,created_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,NULL,?)").run(memoryId, scope, kind, content, ctx.projectId || null, ppath, scopedAgentId, null, confidence, sensitivity, JSON.stringify(Array.isArray(ev.evidence_refs) ? ev.evidence_refs : []), JSON.stringify(requestContext), now);
-      rememberCurated({ id: memoryId, scope, kind, content, confidence, sensitivity, requestContext });
-      logCli(ctx.projectPath, { action: "written", scope, kind, content, request_context: requestContext, at: now });
+      const dup = db.prepare("SELECT id,scope,kind,content,confidence,sensitivity,context_json FROM memory_entries WHERE scope=? AND kind=? AND lower(trim(content))=? AND superseded_at IS NULL AND (project_path IS ? OR project_path=?) AND (agent_id IS ? OR agent_id=?) LIMIT 1").get(scope, kind, content.toLowerCase(), ppath, ppath, scopedAgentId, scopedAgentId);
+      if (dup) rememberCurated({ ...dup, requestContext });
     } catch { /* ignore */ }
   }
   return style.sanitizeAssistantText(cleaned);
@@ -170,4 +225,7 @@ module.exports = {
   normalizeRequestContext,
   parseMemoryEventsCli,
   curateCliReply,
+  MAX_MEMORY_EVENTS,
+  MAX_MEMORY_CONTENT_CHARS,
+  MAX_MEMORY_LOG_BYTES,
 };

package/engine/oberon/common.cjs

@@ -21,22 +21,47 @@ function fail(msg, code) {
   throw new OberonFail(String(msg ?? ""), code);
 }
 
-// v1 oberonParseFlags 그대로: `--key value` / `--key`(불리언) / 나머지는 위치 인자.
-// 다음 토큰이 `--`로 시작하면 값이 아니라 다른 플래그로 본다.
-function parseFlags(args) {
+// 타입 스키마가 있으면 알 수 없는/중복/값 누락 플래그를 fail-closed 한다.
+// `--key=value`와 위치 인자용 `--` sentinel도 지원한다.
+function parseFlags(args, schema = null) {
   const flags = {};
   const rest = [];
   for (let i = 0; i < args.length; i++) {
-    const a = args[i];
-    if (a.startsWith("--")) {
-      const key = a.slice(2);
+    const a = String(args[i]);
+    if (a === "--") {
+      rest.push(...args.slice(i + 1).map(String));
+      break;
+    }
+    if (!a.startsWith("--")) { rest.push(a); continue; }
+    const equals = a.indexOf("=");
+    const key = a.slice(2, equals >= 0 ? equals : undefined);
+    const inlineValue = equals >= 0 ? a.slice(equals + 1) : null;
+    if (!key) fail("Oberon option name is empty");
+    if (Object.prototype.hasOwnProperty.call(flags, key)) fail(`Duplicate Oberon option: --${key}`);
+    const type = schema && schema[key];
+    if (schema && !type) fail(`Unknown Oberon option: --${key}`);
+    if (!schema) {
       const next = args[i + 1];
-      if (next === undefined || next.startsWith("--")) flags[key] = true;
-      else {
-        flags[key] = next;
-        i++;
-      }
-    } else rest.push(a);
+      if (inlineValue != null) flags[key] = inlineValue;
+      else if (next === undefined || String(next).startsWith("--")) flags[key] = true;
+      else { flags[key] = String(next); i += 1; }
+      continue;
+    }
+    if (type === "boolean") {
+      if (inlineValue != null) fail(`Boolean Oberon option does not take a value: --${key}`);
+      flags[key] = true;
+      continue;
+    }
+    if (type !== "value") fail(`Invalid Oberon option schema: --${key}`);
+    if (inlineValue != null) {
+      if (!inlineValue) fail(`Oberon option requires a value: --${key}`);
+      flags[key] = inlineValue;
+      continue;
+    }
+    const next = args[i + 1];
+    if (next === undefined || String(next).startsWith("--")) fail(`Oberon option requires a value: --${key}`);
+    flags[key] = String(next);
+    i += 1;
   }
   return { flags, rest };
 }