agentlas 1.0.65 → 1.0.66

package/engine/project/env-file.cjs

@@ -8,13 +8,85 @@
  */
 const fs = require("node:fs");
 const path = require("node:path");
+const crypto = require("node:crypto");
+
+const MAX_DOT_ENV_BYTES = 512 * 1024;
+
+function readEnvSnapshot(file) {
+  let before;
+  try {
+    before = fs.lstatSync(file);
+  } catch (error) {
+    if (error && error.code === "ENOENT") return { exists: false, body: "" };
+    throw error;
+  }
+  if (!before.isFile() || before.isSymbolicLink() || before.size > MAX_DOT_ENV_BYTES) {
+    throw new Error("credential env target must be a bounded regular non-symbolic-link file");
+  }
+  const fd = fs.openSync(file, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW || 0));
+  try {
+    const opened = fs.fstatSync(fd);
+    if (
+      !opened.isFile() || opened.size > MAX_DOT_ENV_BYTES ||
+      opened.dev !== before.dev || opened.ino !== before.ino
+    ) throw new Error("credential env target changed while opening");
+    return {
+      exists: true,
+      body: fs.readFileSync(fd, "utf8"),
+      dev: opened.dev,
+      ino: opened.ino,
+      size: opened.size,
+      mtimeMs: opened.mtimeMs,
+      ctimeMs: opened.ctimeMs,
+    };
+  } finally {
+    fs.closeSync(fd);
+  }
+}
+
+function assertEnvSnapshotUnchanged(file, snapshot) {
+  let current;
+  try { current = fs.lstatSync(file); }
+  catch (error) {
+    if (error && error.code === "ENOENT" && !snapshot.exists) return;
+    throw new Error("credential env target changed before replacement");
+  }
+  if (
+    !snapshot.exists || !current.isFile() || current.isSymbolicLink() ||
+    current.dev !== snapshot.dev || current.ino !== snapshot.ino ||
+    current.size !== snapshot.size || current.mtimeMs !== snapshot.mtimeMs || current.ctimeMs !== snapshot.ctimeMs
+  ) throw new Error("credential env target changed before replacement");
+}
+
+function replaceEnvFileAtomic(temp, file, snapshot) {
+  assertEnvSnapshotUnchanged(file, snapshot);
+  try {
+    fs.renameSync(temp, file);
+    return;
+  } catch (error) {
+    if (
+      process.platform !== "win32" || !snapshot.exists ||
+      !["EEXIST", "EPERM", "EACCES"].includes(error && error.code)
+    ) throw error;
+  }
+  assertEnvSnapshotUnchanged(file, snapshot);
+  const backup = `${file}.agentlas-${process.pid}-${crypto.randomUUID()}.bak`;
+  fs.renameSync(file, backup);
+  try {
+    fs.renameSync(temp, file);
+  } catch (error) {
+    try { if (!fs.existsSync(file)) fs.renameSync(backup, file); } catch { /* leave the backup recoverable */ }
+    throw error;
+  }
+  try { fs.rmSync(backup, { force: true }); } catch { /* committed target is authoritative */ }
+}
 
 /** .env 파싱 — 값 보존 없이 키만 필요할 때도 같은 파서를 쓴다 (KEY=VALUE, # 주석). */
 function readDotEnvFile(file) {
   const result = {};
   let raw;
   try {
-    raw = fs.readFileSync(file, "utf8");
+    raw = readEnvSnapshot(file).body;
   } catch {
     return result;
   }
@@ -30,17 +102,30 @@ function readDotEnvFile(file) {
 }
 
 function upsertEnvLine(file, key, value) {
-  let body = "";
-  try { body = fs.readFileSync(file, "utf8"); } catch { /* new file */ }
-  const line = `${key}=${value}`;
+  if (!/^[A-Z][A-Z0-9_]*$/.test(String(key || ""))) throw new Error("credential env key must look like ENV_NAME");
+  const text = String(value == null ? "" : value);
+  if (/[\u0000\r\n]/.test(text)) throw new Error("credential env value must be a single line; use `agentlas creds file` for multiline credentials");
+  const snapshot = readEnvSnapshot(file);
+  let body = snapshot.body;
+  const line = `${key}=${text}`;
   const re = new RegExp("^" + key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&") + "=.*$", "m");
-  if (re.test(body)) body = body.replace(re, line);
+  // Replacement strings interpret `$&`, `$1`, and similar tokens. Credentials
+  // are opaque bytes, so use a function replacement and preserve them verbatim.
+  if (re.test(body)) body = body.replace(re, () => line);
   else body = body ? body.replace(/\n?$/, "\n") + line + "\n" : line + "\n";
-  fs.mkdirSync(path.dirname(file), { recursive: true });
+  if (Buffer.byteLength(body, "utf8") > MAX_DOT_ENV_BYTES) throw new Error("credential env file exceeds the 512 KiB safety limit");
+  const directory = path.dirname(file);
+  fs.mkdirSync(directory, { recursive: true });
+  const temp = path.join(directory, `.${path.basename(file)}.${process.pid}.${crypto.randomUUID()}.tmp`);
+  try {
+    fs.writeFileSync(temp, body, { encoding: "utf8", mode: 0o600, flag: "wx" });
+    replaceEnvFileAtomic(temp, file, snapshot);
+  } finally {
+    try { fs.rmSync(temp, { force: true }); } catch { /* best-effort cleanup */ }
+  }
   // 이 헬퍼의 모든 호출자는 credential 값/경로를 기록한다. 새 파일뿐 아니라 기존 0644
   // 파일도 매번 0600으로 수렴시켜 같은 머신의 다른 계정이 읽지 못하게 한다.
-  fs.writeFileSync(file, body, { encoding: "utf8", mode: 0o600 });
   try { fs.chmodSync(file, 0o600); } catch { /* Windows/읽기전용 FS best-effort */ }
 }
 
-module.exports = { readDotEnvFile, upsertEnvLine };
+module.exports = { MAX_DOT_ENV_BYTES, readDotEnvFile, upsertEnvLine };

package/engine/project/memory-context.cjs

@@ -21,9 +21,9 @@ const { captureCoreJsonSync, resolveContextMapCoreRoot } = require("../agentlas-
 const terminalMemoryGovernance = require("../agentlas-memory-governance.cjs");
 const terminalExperienceIntake = require("../agentlas-experience-intake.cjs");
 const terminalExperienceExchange = require("../agentlas-experience-exchange.cjs");
+const permissions = require("../agentlas-permissions.cjs");
 const { routesMap } = require("../agents/routes.cjs");
 const { agentFolder } = require("../agents/files.cjs");
-const { ensureProjectMemoryCli } = require("./seed.cjs");
 const { projectCwd } = require("./paths.cjs");
 
 const SECRET_RE = [/\b(?:sk|pk|rk)-[A-Za-z0-9]{16,}/, /AKIA[0-9A-Z]{16}/, /ghp_[A-Za-z0-9]{20,}/, /xox[baprs]-[A-Za-z0-9-]{10,}/, /-----BEGIN [A-Z ]*PRIVATE KEY-----/, /\b(?:password|passwd|secret|api[_-]?key|access[_-]?token|bearer)\b\s*[:=]\s*\S+/i];
@@ -50,16 +50,7 @@ function langDirective(lang) {
 }
 
 function logCli(projectPath, rec) {
-  if (!projectPath) return;
-  try {
-    // 0.9.10 경계: 초기화되지 않은 프로젝트에 시드를 만들지 않는다. 로그는
-    // 이미 존재하는 .agentlas/ 에만 덧붙인다 (seed는 project init 전용).
-    const { initializedAgentlasProjectPathCli } = require("./state.cjs");
-    if (!initializedAgentlasProjectPathCli(projectPath)) return;
-    const dir = ensureProjectMemoryCli(projectPath);
-    if (!dir) return;
-    fs.appendFileSync(path.join(dir, loadArch().logFile || "memory-log.jsonl"), JSON.stringify(rec) + "\n", "utf8");
-  } catch { /* ignore */ }
+  return require("../memory-cli/curate.cjs").logCli(projectPath, rec);
 }
 
 function coerceText(v, max) {
@@ -242,51 +233,7 @@ function parseMemoryEventsCli(text) {
 }
 
 function curateCliReply(db, text, ctx) {
-  const { events, cleaned } = parseMemoryEventsCli(text);
-  const style = require("../agentlas-style.cjs");
-  // read 권한: 어떤 durable write도 없이 숨김 메타데이터만 제거해 돌려준다.
-  if (ctx && ctx.permission === "read") return style.sanitizeAssistantText(cleaned);
-  if (!events.length || !tableExists(db, "memory_entries")) return style.sanitizeAssistantText(cleaned);
-  ensureMemoryContextColumn(db);
-  const arch = loadArch();
-  const { randomUUID } = require("node:crypto");
-  const now = new Date().toISOString();
-  const rememberCurated = (memory) => {
-    if (!ctx || !Array.isArray(ctx.curatedMemories) || !memory) return;
-    if (!ctx.curatedMemories.some((item) => item.id === memory.id)) ctx.curatedMemories.push(memory);
-  };
-  const kinds = Array.isArray(arch.kinds) ? arch.kinds : [];
-  const scopes = Array.isArray(arch.scopes) ? arch.scopes : [];
-  for (const ev of events) {
-    const content = ev && typeof ev.content === "string" ? ev.content.trim() : "";
-    if (!content) continue;
-    if (ev.sensitivity === "secret" || SECRET_RE.some((re) => re.test(content))) continue;
-    const kind = kinds.includes(ev.memory_kind) ? ev.memory_kind : "fact";
-    let scope = ev.suggested_scope === "agent_team"
-      ? "team_memory"
-      : scopes.includes(ev.suggested_scope) ? ev.suggested_scope : "session";
-    const kindAllowsUserIdentity = ["fact", "decision", "preference", "procedure"].includes(kind);
-    if (scope === "user_identity" && (ev.confidence !== "high" || !kindAllowsUserIdentity)) scope = "session";
-    if (scope === "discard" || scope === "session") { logCli(ctx.projectPath, { action: scope, kind, content, at: now }); continue; }
-    if (scope === "project" && !ctx.projectPath) scope = "team_memory";
-    const ppath = scope === "project" ? ctx.projectPath : null;
-    const scopedAgentId = scope === "agent_repo" ? (ctx.agentId || null) : null;
-    const requestContext = normalizeRequestContext(ev, ctx, ppath);
-    try {
-      const dup = db.prepare("SELECT id,scope,kind,content,confidence,sensitivity,context_json FROM memory_entries WHERE scope=? AND kind=? AND lower(trim(content))=? AND superseded_at IS NULL AND (project_path IS ? OR project_path=?) AND (agent_id IS ? OR agent_id=?) LIMIT 1").get(scope, kind, content.toLowerCase(), ppath, ppath, scopedAgentId, scopedAgentId);
-      if (dup) {
-        rememberCurated({ ...dup, requestContext });
-        continue;
-      }
-      const memoryId = randomUUID();
-      const confidence = ev.confidence || "medium";
-      const sensitivity = ev.sensitivity || "internal";
-      db.prepare("INSERT INTO memory_entries (id,scope,kind,content,project_id,project_path,agent_id,chat_id,confidence,sensitivity,evidence_json,context_json,superseded_at,created_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,NULL,?)").run(memoryId, scope, kind, content, ctx.projectId || null, ppath, scopedAgentId, null, confidence, sensitivity, JSON.stringify(Array.isArray(ev.evidence_refs) ? ev.evidence_refs : []), JSON.stringify(requestContext), now);
-      rememberCurated({ id: memoryId, scope, kind, content, confidence, sensitivity, requestContext });
-      logCli(ctx.projectPath, { action: "written", scope, kind, content, request_context: requestContext, at: now });
-    } catch { /* ignore */ }
-  }
-  return style.sanitizeAssistantText(cleaned);
+  return require("../memory-cli/curate.cjs").curateCliReply(db, text, ctx);
 }
 
 const TERMINAL_MEMORY_CORE_MAX_TOKENS = 150;
@@ -382,9 +329,16 @@ function exactAgentBaseForExecution(db, agent, runtimeExperience = null) {
   const packageHash = /^[a-f0-9]{64}$/.test(rawHash) ? `sha256:${rawHash}` : null;
   const explicitDefinition = String(runtimeExperience?.agentDefinitionId || "");
   const explicitRelease = String(runtimeExperience?.baseAgentReleaseId || "");
+  const hasExplicitBinding = !!runtimeExperience && (
+    Object.prototype.hasOwnProperty.call(runtimeExperience, "agentDefinitionId") ||
+    Object.prototype.hasOwnProperty.call(runtimeExperience, "baseAgentReleaseId")
+  );
   if (portableId.test(explicitDefinition) && portableId.test(explicitRelease)) {
     return { agentDefinitionId: explicitDefinition, agentReleaseId: explicitRelease, packageHash, authority: "explicit-runtime-binding" };
   }
+  // A partially supplied runtime binding is an attempted exact authority, not
+  // permission to fall through to an unrelated installed/local identity.
+  if (hasExplicitBinding) return null;
   if (binding && portableId.test(String(binding.agent_definition_id)) && portableId.test(String(binding.agent_release_id))) {
     return { agentDefinitionId: binding.agent_definition_id, agentReleaseId: binding.agent_release_id, packageHash, authority: "installed-hub-binding" };
   }
@@ -400,7 +354,7 @@ function exactAgentBaseForExecution(db, agent, runtimeExperience = null) {
 }
 
 function finalizeExperienceExecutionCli(db, input) {
-  if (input.permission === "read") return null;
+  if (permissions.normalize(input.permission) === "read") return null;
   if (!input.agentId) return null;
   let agent;
   try { agent = db.prepare("SELECT * FROM installed_agents WHERE id=?").get(input.agentId); }

package/engine/project/ontology.cjs

@@ -20,23 +20,31 @@ const { initializedAgentlasProjectPathCli } = require("./state.cjs");
 
 const ONTOLOGY_SUPPORTED_EXTS = new Set([".txt", ".md", ".markdown", ".json", ".csv", ".tsv"]);
 
-/** `--key value` / `--flag` 파서 — v1 parseCloudFlags와 동일 규칙의 로컬 복사본. */
-function parseFlagsCli(args) {
+/** Ontology source registration options. Unknown/duplicate flags fail closed. */
+function parseFlagsCli(args, schema = {}) {
   const flags = { _: [] };
+  const values = new Set(schema.values || ["kind", "scope"]);
+  const booleans = new Set(schema.booleans || []);
+  let passthrough = false;
   for (let i = 0; i < args.length; i++) {
-    const a = args[i];
-    if (a && a.startsWith("--")) {
-      const key = a.slice(2);
-      const next = args[i + 1];
-      if (next !== undefined && !String(next).startsWith("--")) {
-        flags[key] = next;
-        i++;
-      } else {
-        flags[key] = true;
-      }
-    } else {
-      flags._.push(a);
+    const token = String(args[i]);
+    if (passthrough) { flags._.push(token); continue; }
+    if (token === "--") { passthrough = true; continue; }
+    if (!token.startsWith("--")) { flags._.push(token); continue; }
+    const at = token.indexOf("=");
+    const key = token.slice(2, at > 2 ? at : undefined);
+    if (!values.has(key) && !booleans.has(key)) throw new Error(`unknown option: --${key}`);
+    if (Object.prototype.hasOwnProperty.call(flags, key)) throw new Error(`duplicate option: --${key}`);
+    if (booleans.has(key)) {
+      if (at > 2) throw new Error(`--${key} does not take a value`);
+      flags[key] = true;
+      continue;
+    }
+    const value = at > 2 ? token.slice(at + 1) : args[++i];
+    if (value === undefined || value === "" || (at <= 2 && String(value).startsWith("--"))) {
+      throw new Error(`--${key} requires a value`);
     }
+    flags[key] = String(value);
   }
   return flags;
 }
@@ -233,18 +241,24 @@ function resolveOntologyPathCli(value, cwd) {
 function inferOntologyKindCli(value, text) {
   const v = String(value || "").toLowerCase();
   const hay = String(text || "").toLowerCase();
-  if (["company", "work", "business", "corp", "team", "회사", "업무", "팀", "조직"].includes(v) || /(company|work|business|corp|team|회사|업무|조직)/i.test(hay)) return "company";
-  if (["personal", "private-life", "life", "me", "개인", "내자료", "일상"].includes(v) || /(personal|private-life|\bme\b|개인|내\s*자료|일상)/i.test(hay)) return "personal";
-  if (["project", "repo", "프로젝트", "레포"].includes(v) || /(project|repo|프로젝트|레포)/i.test(hay)) return "project";
+  if (["company", "work", "business", "corp", "team", "회사", "업무", "팀", "조직"].includes(v)) return "company";
+  if (["personal", "private-life", "life", "me", "개인", "내자료", "일상"].includes(v)) return "personal";
+  if (["project", "repo", "프로젝트", "레포"].includes(v)) return "project";
+  if (/(company|work|business|corp|team|회사|업무|조직)/i.test(hay)) return "company";
+  if (/(personal|private-life|\bme\b|개인|내\s*자료|일상)/i.test(hay)) return "personal";
+  if (/(project|repo|프로젝트|레포)/i.test(hay)) return "project";
   return "project";
 }
 
 function inferOntologyScopeCli(value, text, kind) {
   const v = String(value || "").toLowerCase();
   const hay = String(text || "").toLowerCase();
-  if (["public", "open", "공개"].includes(v) || /(public|open|공개)/i.test(hay)) return "public";
-  if (["internal", "team", "내부", "팀"].includes(v) || /(internal|team-only|company-wide|내부|팀\s*공유|회사\s*공유)/i.test(hay)) return "internal";
-  if (["private", "secret", "local", "비공개", "개인"].includes(v) || /(private|secret|local-only|비공개|개인만|나만)/i.test(hay)) return "private";
+  if (["public", "open", "공개"].includes(v)) return "public";
+  if (["internal", "team", "내부", "팀"].includes(v)) return "internal";
+  if (["private", "secret", "local", "비공개", "개인"].includes(v)) return "private";
+  if (/(public|open|공개)/i.test(hay)) return "public";
+  if (/(internal|team-only|company-wide|내부|팀\s*공유|회사\s*공유)/i.test(hay)) return "internal";
+  if (/(private|secret|local-only|비공개|개인만|나만)/i.test(hay)) return "private";
   return kind === "company" || kind === "personal" ? "private" : "private";
 }
 
@@ -366,7 +380,7 @@ function formatOntologyStatusCli(paths, lang) {
   lines.push("", `${ko ? "소스" : "Sources"} (${sources.length}):`);
   for (const source of sources) {
     const sourcePath = path.resolve(String(source.path || ""));
-    lines.push(`  ${fs.existsSync(sourcePath) ? "✓" : "!"} ${sourcePath}  ${source.kind || "project"} / ${source.scope || "internal"}`);
+    lines.push(`  ${fs.existsSync(sourcePath) ? "✓" : "!"} ${sourcePath}  ${source.kind || "project"} / ${source.scope || "private"}`);
   }
   if (!sources.length) lines.push(ko ? "  (없음)" : "  (none)");
   lines.push(
@@ -438,6 +452,7 @@ async function runOntologyCli(args, opts) {
   const sub = normalizedArgs[0] || "status";
   const passivePaths = ontologyPathsForCli(projectPath);
   if (sub === "status" || sub === "list") {
+    if (normalizedArgs.length > 1) throw new Error(`usage: agentlas ontology ${sub}`);
     if (!initializedAgentlasProjectPathCli(projectPath)) {
       return [
         ko ? "온톨로지: 초기화되지 않음" : "Ontology: not initialized",
@@ -448,7 +463,10 @@ async function runOntologyCli(args, opts) {
     }
     return formatOntologyStatusCli(passivePaths, opts.lang);
   }
-  if (sub === "help" || sub === "--help" || sub === "-h") return ontologyUsageLinesCli(opts.lang);
+  if (sub === "help" || sub === "--help" || sub === "-h") {
+    if (normalizedArgs.length > 1) throw new Error("usage: agentlas ontology help");
+    return ontologyUsageLinesCli(opts.lang);
+  }
   const directOntologyCommand = ["open", "add", "company", "personal", "project"].includes(String(sub).toLowerCase())
     || isOntologyPathishCli(sub, cwd, true);
   if (!directOntologyCommand) {
@@ -456,6 +474,22 @@ async function runOntologyCli(args, opts) {
     const parsed = await parseOntologyNaturalArgsCli(normalizedArgs.join(" "), cwd);
     return runOntologyCli(parsed, opts);
   }
+  let directFlags = null;
+  if (sub === "open") {
+    if (normalizedArgs.length !== 1) throw new Error("usage: agentlas ontology open");
+  } else if (sub === "add") {
+    directFlags = parseFlagsCli(normalizedArgs.slice(1));
+    if (directFlags._.length < 1 || directFlags._.length > 3) throw new Error("usage: agentlas ontology add <path> [kind] [scope] [--kind <kind>] [--scope <scope>]");
+    if (directFlags.kind !== undefined && directFlags._[1] !== undefined) throw new Error("kind was provided twice; use either the positional value or --kind");
+    if (directFlags.scope !== undefined && directFlags._[2] !== undefined) throw new Error("scope was provided twice; use either the positional value or --scope");
+  } else if (["company", "personal", "project"].includes(String(sub).toLowerCase())) {
+    directFlags = parseFlagsCli(normalizedArgs.slice(1), { values: ["scope"] });
+    if (directFlags._.length < 1 || directFlags._.length > 2) throw new Error(`usage: agentlas ontology ${sub} <path> [scope] [--scope <scope>]`);
+    if (directFlags.scope !== undefined && directFlags._[1] !== undefined) throw new Error("scope was provided twice; use either the positional value or --scope");
+  } else if (isOntologyPathishCli(sub, cwd, true)) {
+    directFlags = parseFlagsCli(normalizedArgs.slice(1));
+    if (directFlags._.length) throw new Error("unexpected positional argument after ontology source path");
+  }
   const paths = ensureOntologyCli(projectPath, opts.lang);
   if (sub === "open") {
     const opened = opts.noOpen ? true : openLocalPathCli(paths.inboxPath, opts.notify);
@@ -464,20 +498,27 @@ async function runOntologyCli(args, opts) {
       : (ko ? "온톨로지 수신함을 자동으로 열지 못했습니다. 직접 여세요" : "Could not open ontology inbox automatically; open it manually")}: ${paths.inboxPath}`];
   }
   if (sub === "add") {
-    const flags = parseFlagsCli(normalizedArgs.slice(1));
+    const flags = directFlags;
     const source = flags._[0];
     const kind = inferOntologyKindCli(flags.kind || flags._[1], normalizedArgs.join(" "));
     const scope = inferOntologyScopeCli(flags.scope || flags._[2], normalizedArgs.join(" "), kind);
     return registerOntologySourceCli(paths, source, kind, scope, cwd, opts.lang);
   }
   if (["company", "personal", "project"].includes(String(sub).toLowerCase())) {
-    const flags = parseFlagsCli(normalizedArgs.slice(1));
+    const flags = directFlags;
     const kind = inferOntologyKindCli(sub, normalizedArgs.join(" "));
     const scope = inferOntologyScopeCli(flags.scope || flags._[1], normalizedArgs.join(" "), kind);
     return registerOntologySourceCli(paths, flags._[0], kind, scope, cwd, opts.lang);
   }
   if (isOntologyPathishCli(sub, cwd, true)) {
-    return registerOntologySourceCli(paths, sub, inferOntologyKindCli(null, normalizedArgs.join(" ")), inferOntologyScopeCli(null, normalizedArgs.join(" "), "project"), cwd, opts.lang);
+    return registerOntologySourceCli(
+      paths,
+      sub,
+      inferOntologyKindCli(directFlags.kind, normalizedArgs.join(" ")),
+      inferOntologyScopeCli(directFlags.scope, normalizedArgs.join(" "), directFlags.kind || "project"),
+      cwd,
+      opts.lang,
+    );
   }
   throw new Error(ko
     ? "사용법: /ontology status|list|open|add <경로>"

package/engine/project/paths.cjs

@@ -2,23 +2,50 @@
 /*
  * project/paths — 프로젝트 경계 판정용 경로 헬퍼 (v1 runCwd/projectCwd 포팅).
  *
- * workforce/capture.cjs에도 같은 규칙의 projectCwd가 있지만 기능 디렉터리 간
- * 수평 의존을 만들지 않기 위해 여기 별도 구현을 둔다. 규칙이 바뀌면 둘 다 함께
- * 바꿔야 한다 (v1 monolith 9961–9981 라인이 원본 계약).
+ * 이 파일이 Terminal 전체의 단일 정본이다. Workforce와 Hephaestus가 각자 복제하면
+ * 폴백 보안 경계가 갈리므로 둘 다 여기의 함수를 그대로 export한다.
  */
 const fs = require("node:fs");
 const os = require("node:os");
 const path = require("node:path");
 const { userDataDir } = require("../core/paths.cjs");
 
+let temporaryRunCwd = null;
+
+function ensurePrivateDirectory(directory) {
+  fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+  const stat = fs.lstatSync(directory);
+  if (!stat.isDirectory() || stat.isSymbolicLink()) {
+    throw new Error("agent run folder is not a private directory");
+  }
+  if (process.platform !== "win32") {
+    fs.chmodSync(directory, 0o700);
+    if ((fs.statSync(directory).mode & 0o777) !== 0o700) {
+      throw new Error("agent run folder permissions could not be restricted");
+    }
+  }
+  return fs.realpathSync.native(directory);
+}
+
 /** 에이전트 격리 실행용 전용 폴더 — "프로젝트 아님" 위치의 안전한 폴백. */
 function runCwd() {
   const dir = path.join(userDataDir(), "agent-cwd");
   try {
-    fs.mkdirSync(dir, { recursive: true });
-    return dir;
-  } catch {
-    return os.homedir();
+    return ensurePrivateDirectory(dir);
+  } catch (primaryError) {
+    try {
+      if (!temporaryRunCwd) {
+        temporaryRunCwd = fs.mkdtempSync(path.join(os.tmpdir(), "agentlas-agent-cwd-"));
+      }
+      return ensurePrivateDirectory(temporaryRunCwd);
+    } catch (fallbackError) {
+      const error = new Error(
+        "Agentlas could not create a private agent working directory; refusing to use the home folder.",
+      );
+      error.code = "AGENTLAS_RUN_CWD_UNAVAILABLE";
+      error.cause = fallbackError || primaryError;
+      throw error;
+    }
   }
 }
 
@@ -29,7 +56,14 @@ function runCwd() {
 function projectCwd() {
   try {
     const cwd = process.cwd();
-    if (!cwd || cwd === os.homedir() || cwd === userDataDir() || cwd === runCwd()) return runCwd();
+    const neutral = runCwd();
+    const canonical = cwd ? fs.realpathSync.native(cwd) : "";
+    const home = fs.realpathSync.native(os.homedir());
+    let data = path.resolve(userDataDir());
+    try { data = fs.realpathSync.native(userDataDir()); } catch { /* compare the unresolved configured path */ }
+    if (!canonical || canonical === home || canonical === data || canonical === neutral || path.parse(canonical).root === canonical) {
+      return neutral;
+    }
     return cwd;
   } catch {
     return runCwd();