agentlas 1.0.64 → 1.0.66

package/engine/project/career-graph.cjs

@@ -182,6 +182,7 @@ async function runCareerGraphCli(args, opts) {
   const sub = normalizedArgs[0] || "status";
   const passivePaths = careerGraphPathsForCli(projectPath);
   if (sub === "status" || sub === "list") {
+    if (normalizedArgs.length > 1) throw new Error(`usage: career-graph ${sub}`);
     if (!initializedAgentlasProjectPathCli(projectPath)) {
       return [
         ko ? "커리어 그래프: 초기화되지 않음" : "Career Graph: not initialized",
@@ -192,7 +193,10 @@ async function runCareerGraphCli(args, opts) {
     }
     return formatCareerGraphStatusCli(passivePaths, opts.lang);
   }
-  if (sub === "help" || sub === "--help" || sub === "-h") return careerGraphUsageLinesCli(opts.lang);
+  if (sub === "help" || sub === "--help" || sub === "-h") {
+    if (normalizedArgs.length > 1) throw new Error("usage: career-graph help");
+    return careerGraphUsageLinesCli(opts.lang);
+  }
   if (["ingest", "query", "verify", "trace"].includes(String(sub))) {
     return [
       ko
@@ -207,6 +211,15 @@ async function runCareerGraphCli(args, opts) {
     const parsed = await parseOntologyNaturalArgsCli(normalizedArgs.join(" "), cwd);
     return runCareerGraphCli(parsed, opts);
   }
+  let directFlags = null;
+  if (sub === "open") {
+    if (normalizedArgs.length !== 1) throw new Error("usage: career-graph open");
+  } else if (sub === "add") {
+    directFlags = parseFlagsCli(normalizedArgs.slice(1));
+    if (directFlags._.length < 1 || directFlags._.length > 3) throw new Error("usage: career-graph add <path> [kind] [scope] [--kind <kind>] [--scope <scope>]");
+    if (directFlags.kind !== undefined && directFlags._[1] !== undefined) throw new Error("kind was provided twice; use either the positional value or --kind");
+    if (directFlags.scope !== undefined && directFlags._[2] !== undefined) throw new Error("scope was provided twice; use either the positional value or --scope");
+  }
   const paths = ensureCareerGraphCli(projectPath, opts.lang);
   if (sub === "open") {
     const opened = opts.noOpen ? true : openLocalPathCli(paths.inboxPath, opts.notify);
@@ -215,7 +228,7 @@ async function runCareerGraphCli(args, opts) {
       : (ko ? "커리어 그래프 수신함을 자동으로 열지 못했습니다. 직접 여세요" : "Could not open Career Graph inbox automatically; open it manually")}: ${paths.inboxPath}`];
   }
   if (sub === "add") {
-    const flags = parseFlagsCli(normalizedArgs.slice(1));
+    const flags = directFlags;
     const source = flags._[0];
     const kind = inferOntologyKindCli(flags.kind || flags._[1], normalizedArgs.join(" "));
     const scope = inferOntologyScopeCli(flags.scope || flags._[2], normalizedArgs.join(" "), kind);

package/engine/project/controller.cjs

@@ -4,6 +4,30 @@ const fs = require("node:fs");
 const path = require("node:path");
 const { listRoutableAgents } = require("../agents/registry.cjs");
 
+const MAX_AGENT_POOL_MEMBERS = 64;
+const MAX_AGENT_POOL_BYTES = 256 * 1024;
+const MAX_AGENT_POOL_MEMBER_BYTES = 8 * 1024;
+const MAX_AGENT_ID_BYTES = 512;
+const MAX_RELEASE_ID_BYTES = 512;
+const MAX_MEMBER_NAME_BYTES = 4 * 1024;
+const MAX_PROJECT_NAME_BYTES = 4 * 1024;
+const MAX_SYSTEM_PROMPT_BYTES = 256 * 1024;
+const MAX_COMBINED_SYSTEM_PROMPT_BYTES = 512 * 1024;
+
+function projectError(code, message) {
+  return Object.assign(new Error(message), { code, honestStop: true });
+}
+
+function boundedText(value, maxBytes, label, { allowEmpty = false } = {}) {
+  if (typeof value !== "string") throw projectError("project_team_unreadable", `This project's ${label} is invalid.`);
+  const text = value.trim();
+  if (!allowEmpty && !text) throw projectError("project_team_unreadable", `This project's ${label} is empty.`);
+  if (Buffer.byteLength(text, "utf8") > maxBytes || /[\u0000\u0001-\u0008\u000b\u000c\u000e-\u001f\u007f]/.test(text)) {
+    throw projectError("project_team_unreadable", `This project's ${label} is invalid or too large.`);
+  }
+  return text;
+}
+
 function canonicalPath(value) {
   const resolved = path.resolve(String(value || ""));
   try {
@@ -27,19 +51,80 @@ function projectColumns(db) {
 }
 
 function parseAgentPool(raw) {
+  if (raw !== undefined && raw !== null && typeof raw !== "string") {
+    throw projectError("project_team_unreadable", "This project's agent team cannot be read. Open the project in Agentlas Desktop and save its team again.");
+  }
+  const encoded = raw === undefined || raw === null ? "[]" : raw;
+  if (Buffer.byteLength(encoded, "utf8") > MAX_AGENT_POOL_BYTES) {
+    throw projectError("project_team_unreadable", "This project's agent team is too large. Open the project in Agentlas Desktop and save its team again.");
+  }
   let parsed;
   try {
-    parsed = JSON.parse(raw || "[]");
+    parsed = JSON.parse(encoded || "[]");
   } catch {
-    throw Object.assign(new Error("This project's agent team cannot be read. Open the project in Agentlas Desktop and save its team again."), { code: "project_team_unreadable", honestStop: true });
+    throw projectError("project_team_unreadable", "This project's agent team cannot be read. Open the project in Agentlas Desktop and save its team again.");
   }
   if (!Array.isArray(parsed)) {
-    throw Object.assign(new Error("This project's agent team cannot be read. Open the project in Agentlas Desktop and save its team again."), { code: "project_team_unreadable", honestStop: true });
+    throw projectError("project_team_unreadable", "This project's agent team cannot be read. Open the project in Agentlas Desktop and save its team again.");
   }
-  return parsed.filter((member) => member && typeof member === "object"
-    && typeof member.agentId === "string" && member.agentId.trim()
-    && ["local", "cloud", "hub"].includes(member.source)
-    && typeof member.nameSnapshot === "string");
+  if (parsed.length > MAX_AGENT_POOL_MEMBERS) {
+    throw projectError("project_team_too_large", "This project's agent team has too many members. Open the project in Agentlas Desktop and save its team again.");
+  }
+  const seen = new Set();
+  return parsed.map((member, index) => {
+    if (!member || typeof member !== "object" || Array.isArray(member)) {
+      throw projectError("project_team_unreadable", `This project's agent team member ${index + 1} is invalid.`);
+    }
+    if (Buffer.byteLength(JSON.stringify(member), "utf8") > MAX_AGENT_POOL_MEMBER_BYTES) {
+      throw projectError("project_team_unreadable", `This project's agent team member ${index + 1} is too large.`);
+    }
+    const keys = Object.keys(member).sort();
+    const legacyKeys = ["agentId", "nameSnapshot", "releaseId", "source"];
+    const canonicalKeys = ["agentId", "controllerAgentId", "entityKind", "firmId", "nameSnapshot", "releaseId", "source", "targetId"];
+    const isLegacy = keys.length === legacyKeys.length && keys.every((key, keyIndex) => key === legacyKeys[keyIndex]);
+    const isCanonical = keys.length === canonicalKeys.length && keys.every((key, keyIndex) => key === canonicalKeys[keyIndex]);
+    if (!isLegacy && !isCanonical) {
+      throw projectError("project_team_unreadable", `This project's agent team member ${index + 1} is incomplete.`);
+    }
+    const nameSnapshot = boundedText(member.nameSnapshot, MAX_MEMBER_NAME_BYTES, `agent team member ${index + 1} name`);
+    if (!["local", "cloud", "hub"].includes(member.source)) {
+      throw projectError("project_team_unreadable", `This project's agent team member ${index + 1} has an invalid source.`);
+    }
+    const releaseId = member.releaseId === null
+      ? null
+      : boundedText(member.releaseId, MAX_RELEASE_ID_BYTES, `agent team member ${index + 1} release`);
+    if (isLegacy) {
+      const agentId = boundedText(member.agentId, MAX_AGENT_ID_BYTES, `agent team member ${index + 1} agentId`);
+      const key = `${member.source}:agent:${agentId}:${releaseId || ""}`;
+      if (seen.has(key)) throw projectError("project_team_unreadable", `This project's agent team member ${index + 1} is duplicated.`);
+      seen.add(key);
+      return {
+        entityKind: "agent", targetId: agentId, agentId, firmId: null, controllerAgentId: null,
+        source: member.source, releaseId, nameSnapshot,
+      };
+    }
+
+    if (member.entityKind !== "agent" && member.entityKind !== "team") {
+      throw projectError("project_team_unreadable", `This project's agent team member ${index + 1} has an invalid entity kind.`);
+    }
+    const optionalId = (value, label) => value === null
+      ? null
+      : boundedText(value, MAX_AGENT_ID_BYTES, `agent team member ${index + 1} ${label}`);
+    const targetId = boundedText(member.targetId, MAX_AGENT_ID_BYTES, `agent team member ${index + 1} targetId`);
+    const agentId = optionalId(member.agentId, "agentId");
+    const firmId = optionalId(member.firmId, "firmId");
+    const controllerAgentId = optionalId(member.controllerAgentId, "controllerAgentId");
+    if (member.entityKind === "agent" && (firmId !== null || controllerAgentId !== null || (member.source === "local" && agentId === null))) {
+      throw projectError("project_team_unreadable", `This project's agent team member ${index + 1} has inconsistent agent identity fields.`);
+    }
+    if (member.entityKind === "team" && (agentId !== null || (member.source === "local" && firmId === null))) {
+      throw projectError("project_team_unreadable", `This project's agent team member ${index + 1} has inconsistent team identity fields.`);
+    }
+    const key = `${member.source}:${member.entityKind}:${targetId}:${releaseId || ""}`;
+    if (seen.has(key)) throw projectError("project_team_unreadable", `This project's agent team member ${index + 1} is duplicated.`);
+    seen.add(key);
+    return { entityKind: member.entityKind, targetId, agentId, firmId, controllerAgentId, source: member.source, releaseId, nameSnapshot };
+  });
 }
 
 function resolveProjectForCwd(db, cwd) {
@@ -64,7 +149,23 @@ function resolveProjectForCwd(db, cwd) {
   if (best.length !== 1) {
     throw Object.assign(new Error("More than one Agentlas project is connected to this folder. Keep one source connection, then retry."), { code: "project_ambiguous", honestStop: true });
   }
-  return { ...best[0].row, rootPath: best[0].root, agentPool: parseAgentPool(best[0].row.agent_pool_json) };
+  const row = best[0].row;
+  boundedText(row.name, MAX_PROJECT_NAME_BYTES, "name");
+  if (row.system_prompt !== null && row.system_prompt !== undefined) {
+    boundedText(row.system_prompt, MAX_SYSTEM_PROMPT_BYTES, "system prompt", { allowEmpty: true });
+  }
+  return { ...row, rootPath: best[0].root, agentPool: parseAgentPool(row.agent_pool_json) };
+}
+
+function exactInstalledRelease(db, agentId) {
+  try {
+    const row = db.prepare(
+      "SELECT agent_release_id FROM installed_agent_hub_bindings WHERE installed_agent_id=?",
+    ).get(agentId);
+    return row && typeof row.agent_release_id === "string" ? row.agent_release_id : null;
+  } catch {
+    return null;
+  }
 }
 
 function resolveProjectController(db, cwd) {
@@ -73,10 +174,19 @@ function resolveProjectController(db, cwd) {
     throw Object.assign(new Error("This project has no agent team. Drag agents into the project in Desktop Work, then retry."), { code: "project_team_empty", honestStop: true });
   }
   const controllerRef = project.agentPool[0];
-  if (controllerRef.source !== "local") {
+  const controllerAgentId = controllerRef.entityKind === "team"
+    ? controllerRef.controllerAgentId
+    : controllerRef.agentId;
+  if (!controllerAgentId) {
     throw Object.assign(new Error(`The project controller “${controllerRef.nameSnapshot}” is not installed locally for Terminal execution. Install that exact release locally or reorder the project team.`), { code: "controller_not_installed", honestStop: true });
   }
-  const controller = listRoutableAgents(db).find((agent) => agent.id === controllerRef.agentId) || null;
+  if (controllerRef.entityKind === "team" && controllerRef.source !== "local" && controllerRef.releaseId !== null) {
+    throw projectError("controller_release_unavailable", `The project controller team “${controllerRef.nameSnapshot}” needs its exact team release restored before Terminal can execute it.`);
+  }
+  if (controllerRef.entityKind === "agent" && controllerRef.releaseId !== null && exactInstalledRelease(db, controllerAgentId) !== controllerRef.releaseId) {
+    throw projectError("controller_release_unavailable", `The project controller “${controllerRef.nameSnapshot}” is pinned to an unavailable exact release. Restore that release or explicitly choose a new first agent in Desktop Work.`);
+  }
+  const controller = listRoutableAgents(db).find((agent) => agent.id === controllerAgentId) || null;
   if (!controller) {
     throw Object.assign(new Error(`The project controller “${controllerRef.nameSnapshot}” is unavailable. Restore that agent or explicitly choose a new first agent in Desktop Work.`), { code: "controller_unavailable", honestStop: true });
   }
@@ -84,22 +194,30 @@ function resolveProjectController(db, cwd) {
 }
 
 function withProjectControllerContext(controller, project) {
+  const projectName = boundedText(project.name, MAX_PROJECT_NAME_BYTES, "name");
   const team = project.agentPool.map((member, index) =>
     `${index + 1}. ${member.nameSnapshot} (${member.source}${member.releaseId ? `, exact release ${member.releaseId}` : ""})`,
   ).join("\n");
-  const projectInstruction = String(project.system_prompt || "").trim();
+  const projectInstruction = project.system_prompt === null || project.system_prompt === undefined
+    ? ""
+    : boundedText(project.system_prompt, MAX_SYSTEM_PROMPT_BYTES, "system prompt", { allowEmpty: true });
+  const controllerPrompt = boundedText(controller.systemPrompt || "", MAX_SYSTEM_PROMPT_BYTES, "controller system prompt", { allowEmpty: true });
   const ownership = [
-    `You are the controller for the Agentlas Work project “${project.name}”.`,
+    `You are the controller for the Agentlas Work project “${projectName}”.`,
     "You own this task. The remaining ordered project members are eligible sub-agents for task-scoped WorkOrders only.",
     "Do not transfer task ownership, silently substitute an unavailable member, or claim a sub-agent ran without an assignment and execution receipt.",
     "Project team:",
     team,
   ].join("\n");
+  const systemPrompt = [controllerPrompt, projectInstruction && `Project system prompt:\n${projectInstruction}`, ownership]
+    .filter(Boolean)
+    .join("\n\n");
+  if (Buffer.byteLength(systemPrompt, "utf8") > MAX_COMBINED_SYSTEM_PROMPT_BYTES) {
+    throw projectError("project_context_too_large", "This project's controller context is too large to execute safely.");
+  }
   return {
     ...controller,
-    systemPrompt: [controller.systemPrompt, projectInstruction && `Project system prompt:\n${projectInstruction}`, ownership]
-      .filter(Boolean)
-      .join("\n\n"),
+    systemPrompt,
   };
 }
 

package/engine/project/credentials.cjs

@@ -10,9 +10,119 @@
  */
 const fs = require("node:fs");
 const path = require("node:path");
+const crypto = require("node:crypto");
 const { loadArch } = require("../core/db.cjs");
 const { runCwd } = require("./paths.cjs");
 
+const MAX_MANAGED_CREDENTIAL_METADATA_BYTES = 1024 * 1024;
+const MAX_CREDENTIAL_FILE_BYTES = 16 * 1024 * 1024;
+
+function credentialProjectRootCli(projectPath) {
+  const requested = path.resolve(projectPath || "");
+  const root = fs.realpathSync.native(requested);
+  const stat = fs.statSync(root);
+  if (!stat.isDirectory()) throw new Error("credential project must be a real directory");
+  return root;
+}
+
+function ensureManagedDirectoryCli(root, relativePath, mode = 0o700) {
+  let current = root;
+  for (const segment of String(relativePath || "").split(/[\\/]+/).filter(Boolean)) {
+    current = path.join(current, segment);
+    try {
+      const stat = fs.lstatSync(current);
+      if (!stat.isDirectory() || stat.isSymbolicLink()) throw new Error("credential store directories must not be symbolic links");
+    } catch (error) {
+      if (!error || error.code !== "ENOENT") throw error;
+      fs.mkdirSync(current, { recursive: false, mode });
+    }
+  }
+  return current;
+}
+
+function readManagedTextSnapshotCli(filePath, maxBytes = MAX_MANAGED_CREDENTIAL_METADATA_BYTES) {
+  let before;
+  try { before = fs.lstatSync(filePath); }
+  catch (error) {
+    if (error && error.code === "ENOENT") return { exists: false, text: "", mode: 0o600 };
+    throw error;
+  }
+  if (!before.isFile() || before.isSymbolicLink() || before.size > maxBytes) {
+    throw new Error("credential store file must be a bounded regular non-symbolic-link file");
+  }
+  const fd = fs.openSync(filePath, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW || 0));
+  try {
+    const opened = fs.fstatSync(fd);
+    if (!opened.isFile() || opened.size > maxBytes || opened.dev !== before.dev || opened.ino !== before.ino) {
+      throw new Error("credential store file changed while opening");
+    }
+    return {
+      exists: true,
+      text: fs.readFileSync(fd, "utf8"),
+      mode: before.mode & 0o777,
+      stat: before,
+    };
+  } finally {
+    fs.closeSync(fd);
+  }
+}
+
+function assertManagedSnapshotUnchangedCli(filePath, snapshot) {
+  let current;
+  try { current = fs.lstatSync(filePath); }
+  catch (error) {
+    if (error && error.code === "ENOENT" && !snapshot.exists) return;
+    throw new Error("credential store file changed before replacement");
+  }
+  if (
+    !snapshot.exists || !current.isFile() || current.isSymbolicLink() || !snapshot.stat ||
+    current.dev !== snapshot.stat.dev || current.ino !== snapshot.stat.ino ||
+    current.size !== snapshot.stat.size || current.mtimeMs !== snapshot.stat.mtimeMs
+  ) throw new Error("credential store file changed before replacement");
+}
+
+function replaceManagedFileCli(tempPath, filePath, snapshot) {
+  assertManagedSnapshotUnchangedCli(filePath, snapshot);
+  try {
+    fs.renameSync(tempPath, filePath);
+    return;
+  } catch (error) {
+    if (
+      process.platform !== "win32" || !snapshot.exists ||
+      !["EEXIST", "EPERM", "EACCES"].includes(error && error.code)
+    ) throw error;
+  }
+  assertManagedSnapshotUnchangedCli(filePath, snapshot);
+  const backup = `${filePath}.agentlas-${process.pid}-${crypto.randomUUID()}.bak`;
+  fs.renameSync(filePath, backup);
+  try {
+    fs.renameSync(tempPath, filePath);
+  } catch (error) {
+    try { if (!fs.existsSync(filePath)) fs.renameSync(backup, filePath); } catch { /* leave recoverable backup */ }
+    throw error;
+  }
+  try { fs.rmSync(backup, { force: true }); } catch { /* committed target is authoritative */ }
+}
+
+function writeManagedTextAtomicCli(filePath, text, options = {}) {
+  const snapshot = options.snapshot || readManagedTextSnapshotCli(filePath, options.maxBytes);
+  const bytes = Buffer.byteLength(text, "utf8");
+  if (bytes > (options.maxBytes || MAX_MANAGED_CREDENTIAL_METADATA_BYTES)) throw new Error("credential store file exceeds its safety limit");
+  const temp = path.join(path.dirname(filePath), `.${path.basename(filePath)}.${process.pid}.${crypto.randomUUID()}.tmp`);
+  try {
+    fs.writeFileSync(temp, text, { encoding: "utf8", mode: options.mode || snapshot.mode || 0o600, flag: "wx" });
+    replaceManagedFileCli(temp, filePath, snapshot);
+  } finally {
+    try { fs.rmSync(temp, { force: true }); } catch { /* best-effort cleanup */ }
+  }
+}
+
+function ensureManagedTextFileCli(filePath, content, mode = 0o600) {
+  const snapshot = readManagedTextSnapshotCli(filePath);
+  if (!snapshot.exists) writeManagedTextAtomicCli(filePath, content, { snapshot, mode });
+  return snapshot.exists ? snapshot.text : content;
+}
+
 function localCredentialConfigCli(arch) {
   return {
     mapFile: arch.localCredentialsMapFile || "local-credentials.map.json",
@@ -94,24 +204,24 @@ ${credentialIndexSectionContentCli(arch)}
 `;
 }
 function ensureSoulCredentialIndexCli(projectPath, projectName, arch) {
+  const root = credentialProjectRootCli(projectPath);
   const memoryDir = (arch && arch.memoryDir) || ".agentlas";
   const soulFile = (arch && arch.soulFile) || "project-soul-memory.md";
-  const dir = path.join(projectPath, memoryDir);
+  const dir = ensureManagedDirectoryCli(root, memoryDir);
   const soul = path.join(dir, soulFile);
-  fs.mkdirSync(dir, { recursive: true });
-  if (!fs.existsSync(soul)) {
-    fs.writeFileSync(soul, projectSoulTemplateCli(projectName, arch), "utf8");
+  const snapshot = readManagedTextSnapshotCli(soul);
+  if (!snapshot.exists) {
+    writeManagedTextAtomicCli(soul, projectSoulTemplateCli(projectName, arch), { snapshot, mode: 0o600 });
     return soul;
   }
-  let content = "";
-  try { content = fs.readFileSync(soul, "utf8"); } catch { content = ""; }
+  const content = snapshot.text;
   if (!content.includes(CREDENTIAL_INDEX_SECTION_CLI)) {
     const section = credentialIndexSectionContentCli(arch);
     const marker = "\n## Project Purpose";
     const next = content.includes(marker)
       ? content.replace(marker, `\n${section}\n## Project Purpose`)
       : `${content.trimEnd()}\n\n${section}\n`;
-    fs.writeFileSync(soul, next.endsWith("\n") ? next : next + "\n", "utf8");
+    writeManagedTextAtomicCli(soul, next.endsWith("\n") ? next : next + "\n", { snapshot, mode: 0o600 });
   }
   return soul;
 }
@@ -157,7 +267,8 @@ Do not commit files from this folder.
 `;
 }
 function ensureAgentlasCredentialIgnoreCli(projectPath, cfg) {
-  const gitignorePath = path.join(projectPath, ".gitignore");
+  const root = credentialProjectRootCli(projectPath);
+  const gitignorePath = path.join(root, ".gitignore");
   const marker = "# Agentlas local credentials";
   const block = `${marker}
 .env
@@ -171,45 +282,62 @@ ${cfg.credentialsDir}/*
 !${cfg.credentialsDir}/
 !${cfg.credentialsDir}/${cfg.readmeFile}
 `;
-  let existing = "";
-  try { existing = fs.readFileSync(gitignorePath, "utf8"); } catch { existing = ""; }
+  const snapshot = readManagedTextSnapshotCli(gitignorePath);
+  const existing = snapshot.text;
   if (existing.includes(marker)) {
-    if (!/^\._\*$/m.test(existing)) fs.writeFileSync(gitignorePath, `${existing.trimEnd()}\n._*\n`, "utf8");
+    if (!/^\._\*$/m.test(existing)) {
+      writeManagedTextAtomicCli(gitignorePath, `${existing.trimEnd()}\n._*\n`, { snapshot, mode: snapshot.mode || 0o644 });
+    }
     return;
   }
   const next = existing.trimEnd() ? `${existing.trimEnd()}\n\n${block}` : block;
-  fs.writeFileSync(gitignorePath, next.endsWith("\n") ? next : next + "\n", "utf8");
+  writeManagedTextAtomicCli(gitignorePath, next.endsWith("\n") ? next : next + "\n", {
+    snapshot,
+    mode: snapshot.exists ? snapshot.mode : 0o644,
+  });
 }
 function ensureLocalCredentialStoreCli(projectPath, projectName, arch) {
+  const root = credentialProjectRootCli(projectPath);
   const cfg = localCredentialConfigCli(arch || loadArch());
-  const dir = path.join(projectPath, (arch && arch.memoryDir) || ".agentlas");
-  fs.mkdirSync(dir, { recursive: true });
-  fs.mkdirSync(path.join(projectPath, cfg.signingDir), { recursive: true });
-  fs.mkdirSync(path.join(projectPath, cfg.credentialsDir), { recursive: true });
-  const envExample = path.join(projectPath, cfg.envExampleFile);
-  if (!fs.existsSync(envExample)) fs.writeFileSync(envExample, envExampleContentCli(cfg), "utf8");
-  const signingReadme = path.join(projectPath, cfg.signingDir, cfg.readmeFile);
-  if (!fs.existsSync(signingReadme)) fs.writeFileSync(signingReadme, signingReadmeContentCli(cfg), "utf8");
-  const credentialsReadme = path.join(projectPath, cfg.credentialsDir, cfg.readmeFile);
-  if (!fs.existsSync(credentialsReadme)) fs.writeFileSync(credentialsReadme, credentialsReadmeContentCli(cfg), "utf8");
+  const dir = ensureManagedDirectoryCli(root, (arch && arch.memoryDir) || ".agentlas");
+  const signingDir = ensureManagedDirectoryCli(root, cfg.signingDir);
+  const credentialsDir = ensureManagedDirectoryCli(root, cfg.credentialsDir);
+  const envExample = path.join(root, cfg.envExampleFile);
+  ensureManagedTextFileCli(envExample, envExampleContentCli(cfg), 0o600);
+  const signingReadme = path.join(signingDir, cfg.readmeFile);
+  ensureManagedTextFileCli(signingReadme, signingReadmeContentCli(cfg), 0o600);
+  const credentialsReadme = path.join(credentialsDir, cfg.readmeFile);
+  ensureManagedTextFileCli(credentialsReadme, credentialsReadmeContentCli(cfg), 0o600);
   const mapPath = path.join(dir, cfg.mapFile);
-  if (!fs.existsSync(mapPath)) {
-    fs.writeFileSync(mapPath, JSON.stringify(localCredentialsMapSkeletonCli(projectPath, projectName, cfg), null, 2) + "\n", "utf8");
+  const mapText = ensureManagedTextFileCli(
+    mapPath,
+    JSON.stringify(localCredentialsMapSkeletonCli(root, projectName, cfg), null, 2) + "\n",
+    0o600,
+  );
+  let mapValue;
+  try { mapValue = JSON.parse(mapText); }
+  catch (error) { throw new Error(`credential map is invalid JSON: ${String((error && error.message) || error)}`); }
+  if (!mapValue || typeof mapValue !== "object" || Array.isArray(mapValue)) {
+    throw new Error("credential map must contain a JSON object");
   }
-  ensureAgentlasCredentialIgnoreCli(projectPath, cfg);
-  return { cfg, mapPath };
+  ensureAgentlasCredentialIgnoreCli(root, cfg);
+  return { cfg, mapPath, projectRoot: root };
 }
-function readJsonObjectCli(file, fallback) {
+function readJsonObjectCli(file, fallback, options = {}) {
   try {
-    const parsed = JSON.parse(fs.readFileSync(file, "utf8"));
-    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : fallback;
-  } catch {
+    const parsed = JSON.parse(readManagedTextSnapshotCli(file).text);
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) return parsed;
+    if (options.strict) throw new Error("credential map must contain a JSON object");
+    return fallback;
+  } catch (error) {
+    if (options.strict) throw new Error(`credential map is unreadable or invalid: ${String((error && error.message) || error)}`);
     return fallback;
   }
 }
 function upsertLocalCredentialMapCli(projectPath, projectName, arch, entry) {
-  const { cfg, mapPath } = ensureLocalCredentialStoreCli(projectPath, projectName, arch || loadArch());
-  const data = readJsonObjectCli(mapPath, localCredentialsMapSkeletonCli(projectPath, projectName, cfg));
+  const { cfg, mapPath, projectRoot } = ensureLocalCredentialStoreCli(projectPath, projectName, arch || loadArch());
+  const snapshot = readManagedTextSnapshotCli(mapPath);
+  const data = readJsonObjectCli(mapPath, localCredentialsMapSkeletonCli(projectPath, projectName, cfg), { strict: true });
   const now = new Date().toISOString();
   data.updatedAt = now;
   if (!Array.isArray(data.entries)) data.entries = [];
@@ -230,17 +358,64 @@ function upsertLocalCredentialMapCli(projectPath, projectName, arch, entry) {
   const idx = data.entries.findIndex((row) => row && row.id === id);
   if (idx >= 0) data.entries[idx] = { ...data.entries[idx], ...clean };
   else data.entries.push(clean);
-  fs.writeFileSync(mapPath, JSON.stringify(data, null, 2) + "\n", "utf8");
+  data.projectRoot = projectRoot;
+  writeManagedTextAtomicCli(mapPath, JSON.stringify(data, null, 2) + "\n", { snapshot, mode: 0o600 });
 }
 // v1은 fail()로 즉시 종료했다 — v2 규칙은 throw → 명령이 ctx.err + return 1 로 변환.
 function safeCredentialDestRelCli(destRel) {
   const rel = path.normalize(String(destRel || "")).replace(/\\/g, "/");
-  if (!rel || path.isAbsolute(rel) || rel === "." || rel.startsWith("../") || rel.includes("\0")) {
+  if (!rel || path.isAbsolute(rel) || rel === "." || rel.startsWith("../") || /[\u0000-\u001f\u007f]/.test(rel)) {
     throw new Error("credential destination must be a relative path inside the project");
   }
   return rel;
 }
 
+function resolveCredentialDestinationCli(projectPath, destRel) {
+  const root = credentialProjectRootCli(projectPath);
+  const rel = safeCredentialDestRelCli(destRel);
+  const parentRel = path.dirname(rel);
+  const parent = parentRel === "." ? root : ensureManagedDirectoryCli(root, parentRel);
+  const realParent = fs.realpathSync.native(parent);
+  const relativeParent = path.relative(root, realParent);
+  if (path.isAbsolute(relativeParent) || relativeParent === ".." || relativeParent.startsWith(`..${path.sep}`)) {
+    throw new Error("credential destination escaped the project");
+  }
+  return path.join(realParent, path.basename(rel));
+}
+
+function copyCredentialFileAtomicCli(sourcePath, destinationPath, options = {}) {
+  const source = fs.realpathSync.native(path.resolve(sourcePath));
+  const sourceStat = fs.statSync(source);
+  if (!sourceStat.isFile() || sourceStat.size <= 0 || sourceStat.size > MAX_CREDENTIAL_FILE_BYTES) {
+    throw new Error("credential source must be a non-empty regular file no larger than 16 MiB");
+  }
+  const snapshot = (() => {
+    try {
+      const stat = fs.lstatSync(destinationPath);
+      if (!stat.isFile() || stat.isSymbolicLink()) throw new Error("credential destination must be a regular non-symbolic-link file");
+      if (!options.force) throw new Error("credential destination already exists (use --force to replace)");
+      return { exists: true, stat };
+    } catch (error) {
+      if (error && error.code === "ENOENT") return { exists: false };
+      throw error;
+    }
+  })();
+  const temp = path.join(path.dirname(destinationPath), `.${path.basename(destinationPath)}.${process.pid}.${crypto.randomUUID()}.tmp`);
+  try {
+    fs.copyFileSync(source, temp, fs.constants.COPYFILE_EXCL);
+    const copied = fs.lstatSync(temp);
+    if (!copied.isFile() || copied.isSymbolicLink() || copied.size !== sourceStat.size) {
+      throw new Error("credential copy did not produce the exact regular file");
+    }
+    try { fs.chmodSync(temp, 0o600); } catch { /* Windows/best-effort */ }
+    replaceManagedFileCli(temp, destinationPath, snapshot);
+    try { fs.chmodSync(destinationPath, 0o600); } catch { /* Windows/best-effort */ }
+  } finally {
+    try { fs.rmSync(temp, { force: true }); } catch { /* best-effort cleanup */ }
+  }
+  return destinationPath;
+}
+
 module.exports = {
   CREDENTIAL_INDEX_SECTION_CLI,
   localCredentialConfigCli,
@@ -259,4 +434,7 @@ module.exports = {
   readJsonObjectCli,
   upsertLocalCredentialMapCli,
   safeCredentialDestRelCli,
+  credentialProjectRootCli,
+  resolveCredentialDestinationCli,
+  copyCredentialFileAtomicCli,
 };