agentlas 1.0.65 → 1.0.66

package/engine/project/seed.cjs

@@ -60,34 +60,83 @@ function removeLegacySuperOntologyFiles(dir) {
   }
 }
 
+function privateSeedName(value, fallback) {
+  const name = String(value || fallback || "").trim();
+  if (!name || name !== path.basename(name) || name === "." || name === ".." || name.length > 180) {
+    throw new Error("Agentlas project seed contains an unsafe file name");
+  }
+  return name;
+}
+
+function ensurePrivateDirectory(dir) {
+  try { fs.mkdirSync(dir, { recursive: false, mode: 0o700 }); }
+  catch (error) { if (!error || error.code !== "EEXIST") throw error; }
+  const listed = fs.lstatSync(dir);
+  if (!listed.isDirectory() || listed.isSymbolicLink()) {
+    throw new Error("Agentlas project state path must be a real directory");
+  }
+  if (process.platform !== "win32") fs.chmodSync(dir, 0o700);
+  return dir;
+}
+
+function ensurePrivateSeedFile(file, content) {
+  let fd = null;
+  const noFollow = fs.constants.O_NOFOLLOW || 0;
+  try {
+    try {
+      fd = fs.openSync(file, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL | noFollow, 0o600);
+      const bytes = Buffer.from(String(content), "utf8");
+      const written = fs.writeSync(fd, bytes, 0, bytes.length, null);
+      if (written !== bytes.length) throw new Error("Agentlas project seed write was incomplete");
+      fs.fsyncSync(fd);
+    } catch (error) {
+      if (!error || error.code !== "EEXIST") throw error;
+      if (fd != null) { try { fs.closeSync(fd); } catch { /* ignore */ } fd = null; }
+      fd = fs.openSync(file, fs.constants.O_RDONLY | noFollow);
+    }
+    const opened = fs.fstatSync(fd);
+    const listed = fs.lstatSync(file);
+    if (
+      !opened.isFile() || opened.nlink !== 1 ||
+      !listed.isFile() || listed.isSymbolicLink() || listed.nlink !== 1 ||
+      opened.dev !== listed.dev || opened.ino !== listed.ino
+    ) throw new Error("Agentlas project seed target must be a single-link regular file");
+    try { fs.fchmodSync(fd, 0o600); } catch { /* Windows/ACL-only host */ }
+    return file;
+  } finally {
+    if (fd != null) try { fs.closeSync(fd); } catch { /* ignore */ }
+  }
+}
+
 function ensureProjectMemoryCli(projectPath, projectName) {
   const arch = loadArch();
   try {
-    const dir = path.join(projectPath, arch.memoryDir || ".agentlas");
-    fs.mkdirSync(dir, { recursive: true });
+    const root = path.resolve(projectPath);
+    const canonicalRoot = fs.realpathSync.native(root);
+    const rootStat = fs.lstatSync(root);
+    if (!rootStat.isDirectory() || rootStat.isSymbolicLink() || path.parse(canonicalRoot).root === canonicalRoot) return null;
+    const memoryDirName = privateSeedName(arch.memoryDir, ".agentlas");
+    const dir = ensurePrivateDirectory(path.join(root, memoryDirName));
     removeLegacySuperOntologyFiles(dir);
-    const name = projectName || path.basename(projectPath) || "Project";
-    ensureLocalCredentialStoreCli(projectPath, name, arch);
-    ensureSoulCredentialIndexCli(projectPath, name, arch);
-    const sitemap = path.join(dir, arch.sitemapFile || "sitemap.json");
-    if (!fs.existsSync(sitemap)) {
-      const now = new Date().toISOString();
-      fs.writeFileSync(sitemap, JSON.stringify({ project: name, created_at: now, updated_at: now, nodes: [] }, null, 2), "utf8");
-    }
-    const skillRegistryFile = arch.skillRegistryFile || "skill-registry.json";
-    const skillTrialsFile = arch.skillTrialsFile || "skill-trials.jsonl";
-    const curatorDecisionsFile = arch.curatorDecisionsFile || "curator-decisions.jsonl";
-    const ontologyRuntimeFile = arch.ontologyRuntimeFile || "ontology-runtime.json";
-    const ontologySourceManifestFile = arch.ontologySourceManifestFile || "ontology-sources.json";
-    const ontologyInboxDir = arch.ontologyInboxDir || "ontology-inbox";
-    const ontologyDbFile = arch.ontologyDbFile || "ontology-runtime.sqlite";
-    const careerGraphConfigFile = arch.careerGraphConfigFile || "career-graph.json";
-    const careerGraphSourceManifestFile = arch.careerGraphSourceManifestFile || "career-graph-sources.json";
-    const careerGraphInboxDir = arch.careerGraphInboxDir || "career-graph-inbox";
-    const careerGraphDbFile = arch.careerGraphDbFile || "career-graph.sqlite";
+    const name = String(projectName || path.basename(root) || "Project").slice(0, 200);
+    ensureLocalCredentialStoreCli(root, name, arch);
+    ensureSoulCredentialIndexCli(root, name, arch);
+    const sitemap = path.join(dir, privateSeedName(arch.sitemapFile, "sitemap.json"));
+    const now = new Date().toISOString();
+    ensurePrivateSeedFile(sitemap, JSON.stringify({ project: name, created_at: now, updated_at: now, nodes: [] }, null, 2));
+    const skillRegistryFile = privateSeedName(arch.skillRegistryFile, "skill-registry.json");
+    const skillTrialsFile = privateSeedName(arch.skillTrialsFile, "skill-trials.jsonl");
+    const curatorDecisionsFile = privateSeedName(arch.curatorDecisionsFile, "curator-decisions.jsonl");
+    const ontologyRuntimeFile = privateSeedName(arch.ontologyRuntimeFile, "ontology-runtime.json");
+    const ontologySourceManifestFile = privateSeedName(arch.ontologySourceManifestFile, "ontology-sources.json");
+    const ontologyInboxDir = privateSeedName(arch.ontologyInboxDir, "ontology-inbox");
+    const ontologyDbFile = privateSeedName(arch.ontologyDbFile, "ontology-runtime.sqlite");
+    const careerGraphConfigFile = privateSeedName(arch.careerGraphConfigFile, "career-graph.json");
+    const careerGraphSourceManifestFile = privateSeedName(arch.careerGraphSourceManifestFile, "career-graph-sources.json");
+    const careerGraphInboxDir = privateSeedName(arch.careerGraphInboxDir, "career-graph-inbox");
+    const careerGraphDbFile = privateSeedName(arch.careerGraphDbFile, "career-graph.sqlite");
     const skillRegistry = path.join(dir, skillRegistryFile);
-    if (!fs.existsSync(skillRegistry)) {
-      fs.writeFileSync(skillRegistry, JSON.stringify({
+    ensurePrivateSeedFile(skillRegistry, JSON.stringify({
         schemaVersion: "1.0",
         kind: "agentlas-skill-lifecycle-registry",
         state: "local_candidate",
@@ -127,18 +176,15 @@ function ensureProjectMemoryCli(projectPath, projectName) {
           lowRiskCanaryOnly: true,
           severeFailureTolerance: 0,
         },
-      }, null, 2), "utf8");
-    }
-    const ontologyInbox = path.join(dir, ontologyInboxDir);
-    if (!fs.existsSync(ontologyInbox)) fs.mkdirSync(ontologyInbox, { recursive: true });
+      }, null, 2));
+    const ontologyInbox = ensurePrivateDirectory(path.join(dir, ontologyInboxDir));
     const ontologyRuntime = path.join(dir, ontologyRuntimeFile);
-    if (!fs.existsSync(ontologyRuntime)) {
-      fs.writeFileSync(ontologyRuntime, JSON.stringify({
+    ensurePrivateSeedFile(ontologyRuntime, JSON.stringify({
         schemaVersion: "1.0",
         kind: "agentlas-ontology-runtime",
         state: "active",
         activation: "automatic",
-        projectRoot: projectPath,
+        projectRoot: root,
         projectName: name,
         dbPath: path.join(dir, ontologyDbFile),
         inboxPath: ontologyInbox,
@@ -161,27 +207,22 @@ function ensureProjectMemoryCli(projectPath, projectName) {
           durableWrites: "candidate-ticket-only",
           workingMemory: "runtime-cache-only",
         },
-      }, null, 2), "utf8");
-    }
+      }, null, 2));
     const ontologySources = path.join(dir, ontologySourceManifestFile);
-    if (!fs.existsSync(ontologySources)) {
-      fs.writeFileSync(ontologySources, JSON.stringify({
+    ensurePrivateSeedFile(ontologySources, JSON.stringify({
         schemaVersion: "1.0",
         kind: "agentlas-ontology-source-manifest",
-        projectRoot: projectPath,
+        projectRoot: root,
         sources: [],
-      }, null, 2), "utf8");
-    }
-    const careerGraphInbox = path.join(dir, careerGraphInboxDir);
-    if (!fs.existsSync(careerGraphInbox)) fs.mkdirSync(careerGraphInbox, { recursive: true });
+      }, null, 2));
+    const careerGraphInbox = ensurePrivateDirectory(path.join(dir, careerGraphInboxDir));
     const careerGraphConfig = path.join(dir, careerGraphConfigFile);
-    if (!fs.existsSync(careerGraphConfig)) {
-      fs.writeFileSync(careerGraphConfig, JSON.stringify({
+    ensurePrivateSeedFile(careerGraphConfig, JSON.stringify({
         schemaVersion: "1.0",
         kind: "agentlas-career-graph",
         state: "active",
         model: "ledger_first_derived_index",
-        projectRoot: projectPath,
+        projectRoot: root,
         projectName: name,
         dbPath: path.join(dir, careerGraphDbFile),
         inboxPath: careerGraphInbox,
@@ -193,20 +234,16 @@ function ensureProjectMemoryCli(projectPath, projectName) {
           neverScanHomeDirectory: true,
           neverScanSiblingProjects: true,
         },
-      }, null, 2), "utf8");
-    }
+      }, null, 2));
     const careerGraphSources = path.join(dir, careerGraphSourceManifestFile);
-    if (!fs.existsSync(careerGraphSources)) {
-      fs.writeFileSync(careerGraphSources, JSON.stringify({
+    ensurePrivateSeedFile(careerGraphSources, JSON.stringify({
         schemaVersion: "1.0",
         kind: "agentlas-career-graph-source-manifest",
-        projectRoot: projectPath,
+        projectRoot: root,
         sources: [],
-      }, null, 2), "utf8");
-    }
+      }, null, 2));
     for (const fileName of [skillTrialsFile, curatorDecisionsFile]) {
-      const filePath = path.join(dir, fileName);
-      if (!fs.existsSync(filePath)) fs.writeFileSync(filePath, "", "utf8");
+      ensurePrivateSeedFile(path.join(dir, fileName), "");
     }
     return dir;
   } catch { return null; }

package/engine/project/state.cjs

@@ -37,16 +37,27 @@ const projectBootstrapStates = new Map();
 
 function terminalProjectCandidateCli(projectPath) {
   try {
-    const root = path.resolve(projectPath || process.cwd());
+    const requested = path.resolve(projectPath || process.cwd());
+    const stat = fs.statSync(requested);
+    if (!stat.isDirectory()) return null;
+    // Resolve the directory before applying broad-root exclusions. Otherwise
+    // `/tmp/project -> ~/.agentlas` bypasses the lexical checks and lets an
+    // explicit init write private project state into Agentlas' own userData.
+    const root = fs.realpathSync.native(requested);
+    const realOrResolved = (candidate) => {
+      try { return fs.realpathSync.native(candidate); } catch { return path.resolve(candidate); }
+    };
+    const home = realOrResolved(os.homedir());
+    const data = realOrResolved(userDataDir());
+    const fallback = realOrResolved(runCwd());
     const unsafe = new Set([
-      path.resolve(os.homedir()),
+      home,
       path.parse(root).root,
-      path.resolve(userDataDir()),
-      path.resolve(runCwd()),
+      data,
+      fallback,
     ]);
     if (unsafe.has(root)) return null;
-    const stat = fs.statSync(root);
-    if (!stat.isDirectory()) return null;
+    if (root.startsWith(`${data}${path.sep}`) || root.startsWith(`${fallback}${path.sep}`)) return null;
     return root;
   } catch {
     return null;
@@ -67,6 +78,10 @@ function assertNoSymlinkInAgentlasStateCli(stateDir) {
     if (stat.isSymbolicLink()) throw new Error(".agentlas local state must not contain symbolic links");
     if (stat.isDirectory()) {
       for (const entry of fs.readdirSync(current)) pending.push(path.join(current, entry));
+    } else if (stat.isFile()) {
+      if (stat.nlink !== 1) throw new Error(".agentlas local state must not contain hard-linked files");
+    } else {
+      throw new Error(".agentlas local state must contain only directories and regular files");
     }
   }
   if (pending.length) throw new Error(".agentlas local state exceeds the safe bootstrap inspection limit");
@@ -78,7 +93,9 @@ function readRegularUtf8FileNoFollowCli(filePath, maxBytes = AGENTLAS_GITIGNORE_
     if (error && error.code === "ENOENT") return { exists: false, content: "", mode: 0o644, stat: null };
     throw error;
   }
-  if (before.isSymbolicLink() || !before.isFile()) throw new Error(".gitignore must be a regular non-symbolic-link file");
+  if (before.isSymbolicLink() || !before.isFile() || before.nlink !== 1) {
+    throw new Error(".gitignore must be a single-link regular non-symbolic-link file");
+  }
   if (before.size > maxBytes) throw new Error(`.gitignore exceeds the ${maxBytes}-byte safe bootstrap limit`);
 
   const noFollow = fs.constants.O_NOFOLLOW || 0;
@@ -91,7 +108,7 @@ function readRegularUtf8FileNoFollowCli(filePath, maxBytes = AGENTLAS_GITIGNORE_
   }
   try {
     const opened = fs.fstatSync(fd);
-    if (!opened.isFile()) throw new Error(".gitignore changed type during bootstrap");
+    if (!opened.isFile() || opened.nlink !== 1) throw new Error(".gitignore changed type during bootstrap");
     if (opened.size > maxBytes) throw new Error(`.gitignore exceeds the ${maxBytes}-byte safe bootstrap limit`);
     if (
       Number.isFinite(before.dev) && Number.isFinite(before.ino) &&
@@ -110,7 +127,9 @@ function readRegularUtf8FileNoFollowCli(filePath, maxBytes = AGENTLAS_GITIGNORE_
     }
     if (total > maxBytes) throw new Error(`.gitignore exceeds the ${maxBytes}-byte safe bootstrap limit`);
     const after = fs.fstatSync(fd);
-    if (after.size !== opened.size || after.mtimeMs !== opened.mtimeMs) throw new Error(".gitignore changed while it was being read");
+    if (after.nlink !== 1 || after.size !== opened.size || after.mtimeMs !== opened.mtimeMs) {
+      throw new Error(".gitignore changed while it was being read");
+    }
     let content;
     try { content = new TextDecoder("utf-8", { fatal: true }).decode(Buffer.concat(chunks, total)); } catch {
       throw new Error(".gitignore must contain valid UTF-8 text");
@@ -132,7 +151,7 @@ function assertFileSnapshotUnchangedCli(filePath, snapshot) {
     }
   }
   const current = fs.lstatSync(filePath);
-  if (current.isSymbolicLink() || !current.isFile()) throw new Error(".gitignore changed type during bootstrap");
+  if (current.isSymbolicLink() || !current.isFile() || current.nlink !== 1) throw new Error(".gitignore changed type during bootstrap");
   const original = snapshot.stat;
   if (
     !original || current.dev !== original.dev || current.ino !== original.ino ||
@@ -227,14 +246,20 @@ function hardenAgentlasProjectStateCli(projectPath) {
     visited += 1;
     try {
       const stat = fs.lstatSync(current);
-      if (stat.isSymbolicLink()) continue;
+      if (stat.isSymbolicLink()) throw new Error(".agentlas local state must not contain symbolic links");
       if (stat.isDirectory()) {
         try { fs.chmodSync(current, 0o700); } catch { /* Windows/best effort */ }
         for (const entry of fs.readdirSync(current)) pending.push(path.join(current, entry));
       } else if (stat.isFile()) {
+        if (stat.nlink !== 1) throw new Error(".agentlas local state must not contain hard-linked files");
         try { fs.chmodSync(current, 0o600); } catch { /* Windows/best effort */ }
+      } else {
+        throw new Error(".agentlas local state must contain only directories and regular files");
       }
-    } catch { /* disappearing files and ACL-only hosts are best effort */ }
+    } catch (error) {
+      if (error && error.code === "ENOENT") continue;
+      throw error;
+    }
   }
 }
 
@@ -314,10 +339,10 @@ function recordCliFolderVisit(db, projectPath, options = {}) {
   const activate = options.activate === true;
   try {
     if (!activate) {
-      const row = tableExists(db, "folder_activity")
-        ? db.prepare("SELECT activated_at FROM folder_activity WHERE path=?").get(root)
-        : null;
-      return { activated: Boolean(row && row.activated_at) || fs.existsSync(path.join(root, ".agentlas")) };
+      // A historical DB row or an arbitrary `.agentlas` entry is not proof
+      // that today's private-state boundary is intact. Revalidate the marker,
+      // soul file, entry types, and link identities on every passive use.
+      return { activated: Boolean(initializedAgentlasProjectPathCli(root)) };
     }
 
     ensureCoreProjectCli(root, { reason: options.reason || "terminal-first-contact", coreRoot: options.coreRoot });

package/engine/project/team.cjs

@@ -18,24 +18,49 @@
  *    갱신하고, 없으면 만든다(데스크탑이 만든 프로젝트도 그대로 이어받는다).
  */
 const crypto = require("node:crypto");
+const os = require("node:os");
 const path = require("node:path");
 const fs = require("node:fs");
 const { runWriteTransaction } = require("../agentlas-sqlite-policy.cjs");
 const { findAgent } = require("../agents/registry.cjs");
+const { userDataDir } = require("../core/paths.cjs");
 
 function canonical(p) {
   const resolved = path.resolve(String(p || ""));
-  try { return fs.realpathSync.native(resolved); } catch { return resolved; }
+  let root;
+  try { root = fs.realpathSync.native(resolved); }
+  catch { throw Object.assign(new Error(`project folder does not exist: ${resolved}`), { code: "project_folder_invalid", honestStop: true }); }
+  const stat = fs.lstatSync(root);
+  let home = path.resolve(os.homedir());
+  let data = path.resolve(userDataDir());
+  try { home = fs.realpathSync.native(home); } catch { /* compare unresolved */ }
+  try { data = fs.realpathSync.native(data); } catch { /* compare unresolved */ }
+  if (
+    !stat.isDirectory() || stat.isSymbolicLink() ||
+    path.parse(root).root === root || root === home ||
+    root === data || root.startsWith(`${data}${path.sep}`)
+  ) {
+    throw Object.assign(new Error(`refusing unsafe project folder: ${resolved}`), { code: "project_folder_invalid", honestStop: true });
+  }
+  return root;
 }
 
 /** slug/이름 목록 → 검증된 순서 풀. 못 찾은 이름은 정직하게 실패. */
 function resolveTeam(db, tokens) {
+  if (tokens.length > 64) {
+    throw Object.assign(new Error("a project team may contain at most 64 agents"), { code: "team_too_large", honestStop: true });
+  }
   const pool = [];
+  const seen = new Set();
   for (const token of tokens) {
     const agent = findAgent(db, token);
     if (!agent) {
       throw Object.assign(new Error(`agent not found: ${token}`), { code: "team_agent_not_found", honestStop: true, token });
     }
+    if (seen.has(agent.id)) {
+      throw Object.assign(new Error(`duplicate project team agent: ${token}`), { code: "team_agent_duplicate", honestStop: true, token });
+    }
+    seen.add(agent.id);
     // 설치 에이전트는 로컬이다(installed_agents에 있음 = 이 머신에서 실행 가능).
     pool.push({
       agentId: agent.id,

package/engine/runtime-refusal.cjs

@@ -27,7 +27,10 @@ const MAX_NOTICE_LENGTH = 400;
 const NOTICE_PATTERNS = [
   /\byou'?ve hit\b/i,                 // "You've hit your weekly/usage limit" (claude·codex 실측)
   /\busage limit\b/i,
-  /\brate.?limit(ed)?\b/i,
+  /\brate.?limit (?:exceeded|reached)\b/i,
+  /^(?:error:\s*)?rate.?limit (?:has been )?(?:exceeded|reached)\b/i,
+  /\b(?:your|the) rate.?limit (?:has been|is) (?:exceeded|reached)\b/i,
+  /\byou (?:are (?:currently )?|have been )rate.?limited\b/i,
   /\bquota (exceeded|reached)\b/i,
   /\bresets? (at|on)\b/i,             // "resets Aug 8 at 6pm"
   /\btry again (at|later)\b/i,

package/engine/runtimes/acp-driver.cjs

@@ -14,6 +14,48 @@ const permissions = require("../agentlas-permissions.cjs");
 
 // 정본(runtimes/kinds.cjs)의 ACP 3종에서 파생 — resolve.cjs의 ACP_CLI_KINDS와 같은 원소.
 const ACP_KINDS = new Set(require("./kinds.cjs").ACP_CLI_KINDS);
+const ACP_HISTORY_MAX_ENTRIES = 40;
+const ACP_HISTORY_MAX_BYTES = 512 * 1024;
+const ACP_HISTORY_MAX_ENTRY_BYTES = 64 * 1024;
+
+function boundedHistoryText(value, maxBytes) {
+  const text = String(value || "");
+  const encoded = Buffer.from(text, "utf8");
+  if (encoded.length <= maxBytes) return text;
+  let bounded = encoded.subarray(0, maxBytes).toString("utf8");
+  // A byte cut in the middle of a multibyte code point can decode to U+FFFD,
+  // whose three bytes would otherwise make the decoded value exceed maxBytes.
+  while (Buffer.byteLength(bounded, "utf8") > maxBytes) bounded = bounded.slice(0, -1);
+  return bounded;
+}
+
+/*
+ * Provider history is supplied by the local chat store, where old rows may be
+ * larger than the ACP request budget. Keep the newest messages, retain their
+ * original order, and cap both message count and UTF-8 text bytes before the
+ * request is serialized by the provider runner.
+ */
+function boundedAcpHistory(history) {
+  if (!Array.isArray(history)) return [];
+  const bounded = [];
+  let totalBytes = 0;
+  for (let index = history.length - 1;
+    index >= 0 && bounded.length < ACP_HISTORY_MAX_ENTRIES && totalBytes < ACP_HISTORY_MAX_BYTES;
+    index -= 1) {
+    const entry = history[index];
+    const remainingBytes = ACP_HISTORY_MAX_BYTES - totalBytes;
+    const text = boundedHistoryText(
+      entry && (entry.text ?? entry.content),
+      Math.min(ACP_HISTORY_MAX_ENTRY_BYTES, remainingBytes),
+    );
+    bounded.unshift({
+      role: entry && entry.role === "assistant" ? "assistant" : "user",
+      text,
+    });
+    totalBytes += Buffer.byteLength(text, "utf8");
+  }
+  return bounded;
+}
 
 /** 이 머신에서 ACP 드라이버를 쓸 수 있는가. { ok, reason?, module? } */
 function acpDriverAvailability() {
@@ -48,13 +90,14 @@ async function runAcpTurn(req) {
     return { text: "", session: req.session || {}, error: `runtime '${kind}' is not an ACP agent in this core`, errorKind: "unsupported", errorSource: "marker" };
   }
   const runner = mod.createAcpRunner(spec);
+  const permission = permissions.normalize(req.permission);
   let mcpConfigPath;
   try {
     // ACP runner consumes the same Claude-compatible MCP config shape as Desktop.
     // Reuse native-host's content-addressed, credential-isolating materializer so
     // Cursor/Grok/Kimi receive exactly the already-consented Terminal allowlist.
     const nativeHost = require("../agentlas-native-host.cjs");
-    const allowedMcpServers = permissions.normalize(req.permission) === "full"
+    const allowedMcpServers = permission === "full"
       ? (req.mcpServers || [])
       : [];
     mcpConfigPath = nativeHost.cliMcpConfigPath(allowedMcpServers, {
@@ -92,16 +135,11 @@ async function runAcpTurn(req) {
   try {
     const result = await runner({
       systemPrompt: req.systemPrompt || "",
-      history: Array.isArray(req.history)
-        ? req.history.map((entry) => ({
-          role: entry && entry.role === "assistant" ? "assistant" : "user",
-          text: String((entry && (entry.text ?? entry.content)) || ""),
-        }))
-        : [],
+      history: boundedAcpHistory(req.history),
       userPrompt: req.prompt || "",
       backendLabel: spec.label,
       locale,
-      permission: req.permission,
+      permission,
       runtimeSource: bin,
       cwd: req.cwd,
       env: req.env || process.env,
@@ -132,4 +170,13 @@ async function runAcpTurn(req) {
   }
 }
 
-module.exports = { ACP_KINDS, acpDriverAvailability, acpSpecFor, runAcpTurn };
+module.exports = {
+  ACP_KINDS,
+  ACP_HISTORY_MAX_ENTRIES,
+  ACP_HISTORY_MAX_BYTES,
+  ACP_HISTORY_MAX_ENTRY_BYTES,
+  boundedAcpHistory,
+  acpDriverAvailability,
+  acpSpecFor,
+  runAcpTurn,
+};

package/engine/runtimes/auth-evidence.cjs

@@ -23,13 +23,32 @@ const path = require("node:path");
 const { spawnSync } = require("node:child_process");
 
 const home = () => os.homedir();
+const MAX_AUTH_EVIDENCE_BYTES = 256 * 1024;
+const NOFOLLOW = fs.constants.O_NOFOLLOW || 0;
 
 function fileEvidence(rel, label) {
   const p = path.join(home(), ...rel);
+  let fd = null;
   try {
-    if (fs.existsSync(p) && fs.statSync(p).size > 0) return { status: "evidence", detail: label || p };
+    const before = fs.lstatSync(p);
+    if (
+      before.isSymbolicLink() || !before.isFile() || before.nlink !== 1 ||
+      before.size <= 0 || before.size > MAX_AUTH_EVIDENCE_BYTES
+    ) return null;
+    fd = fs.openSync(p, fs.constants.O_RDONLY | NOFOLLOW);
+    const after = fs.fstatSync(fd);
+    if (
+      after.isSymbolicLink() || !after.isFile() || after.nlink !== 1 ||
+      after.size <= 0 || after.size > MAX_AUTH_EVIDENCE_BYTES ||
+      after.dev !== before.dev || after.ino !== before.ino
+    ) return null;
+    return { status: "evidence", detail: label || p };
   } catch { /* unreadable == no evidence */ }
-  return null;
+  finally {
+    if (fd !== null) {
+      try { fs.closeSync(fd); } catch { /* already closed */ }
+    }
+  }
 }
 
 function envEvidence(names) {

package/engine/runtimes/detect.cjs

@@ -6,21 +6,41 @@
  * 여기서는 "실행 파일이 있는가"만 결정론적으로 본다. 모델 응답 여부는 판정하지 않는다
  * (없으면 no_runtime 정직 정지 — 폴백 금지는 상위 계층의 계약).
  */
-const { spawnSync } = require("node:child_process");
+const fs = require("node:fs");
+const path = require("node:path");
 // kind 목록/실행 파일 이름의 정본은 runtimes/kinds.cjs 하나다 — 여기서 다시 적지 않는다.
 const { RUNTIME_BIN, CLI_KINDS } = require("./kinds.cjs");
 
 const CLI_RUNTIMES = CLI_KINDS;
 
 function whichSync(bin) {
-  const cmd = process.platform === "win32" ? "where" : "which";
-  try {
-    const res = spawnSync(cmd, [bin], { encoding: "utf8", timeout: 4000 });
-    if (res.status === 0) {
-      const line = String(res.stdout || "").split(/\r?\n/).find((l) => l.trim());
-      return line ? line.trim() : null;
+  const name = typeof bin === "string" ? bin.trim() : "";
+  if (!name || name.includes("\0") || path.basename(name) !== name) return null;
+  const pathValue = String(process.env.PATH || "");
+  if (!pathValue) return null;
+  const windows = process.platform === "win32";
+  const configuredExts = windows
+    ? String(process.env.PATHEXT || ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean)
+    : [""];
+  const hasWindowsExt = windows && configuredExts.some((ext) => name.toLowerCase().endsWith(ext.toLowerCase()));
+  const extensions = hasWindowsExt ? [""] : configuredExts;
+  for (const rawDir of pathValue.split(path.delimiter)) {
+    const unquoted = rawDir.length >= 2 && rawDir.startsWith('"') && rawDir.endsWith('"')
+      ? rawDir.slice(1, -1)
+      : rawDir;
+    const directory = path.resolve(unquoted || ".");
+    for (const ext of extensions) {
+      const candidate = path.join(directory, name + ext);
+      try {
+        const stat = fs.statSync(candidate);
+        if (!stat.isFile()) continue;
+        fs.accessSync(candidate, windows ? fs.constants.F_OK : fs.constants.X_OK);
+        return candidate;
+      } catch {
+        // Continue to the next PATH entry just like a shell command lookup.
+      }
     }
-  } catch { /* not found */ }
+  }
   return null;
 }
 

package/engine/runtimes/kinds.cjs

@@ -94,15 +94,23 @@ const API_BACKEND_SPECS = ["anthropic", "openai", "google", "ollama", "upstage"]
 const RUNTIME_SPECS = [...NATIVE_CLI_KINDS, ...API_BACKEND_SPECS];
 
 /**
- * 저장 계약(automation 등)이 허용하는 kind 전체 — CLI + 로컬/BYOK 실행 kind.
- * 데스크탑 shared/runtime-kinds.ts 와 동형(터미널 표기: antigravity→agy, acp 미지원).
+ * 저장 계약(automation 등)이 허용하는 kind 전체.
+ *
+ * 공유 SQLite의 소유자는 Desktop이므로 Desktop shared/runtime-kinds.ts의 저장
+ * 어휘를 모두 받아야 한다. 이 Terminal이 아직 실행하지 못하는 kind도 구조적으로
+ * 정상인 핀은 "손상"이 아니라 pinned-runtime-unavailable로 정직하게 멈춘다.
+ * agy/gemini는 이전 Terminal·Desktop 행의 전진 호환 별칭이다.
  */
-const CONTRACT_RUNTIME_KINDS = [...CLI_KINDS, "byok", "ollama", "lmstudio", "mlx"];
+const CONTRACT_RUNTIME_KINDS = [
+  "claude-code", "codex", "antigravity", "kimi", "grok", "cursor",
+  "byok", "ollama", "lmstudio", "mlx", "acp", "agentlas",
+  "agy", "gemini",
+];
 
 /** 저장 계약이 허용하는 LLM 백엔드 — 데스크탑 shared/runtime-backends.ts 와 동일 15종. */
 const CONTRACT_RUNTIME_BACKENDS = [
   "anthropic", "openai", "google", "ollama", "lmstudio", "mlx", "upstage", "custom", "glm",
-  "kimi", "deepseek", "minimax", "xai", "openrouter", "cursor",
+  "kimi", "deepseek", "minimax", "xai", "openrouter", "cursor", "agentlas",
 ];
 
 module.exports = {

package/engine/runtimes/overrides.cjs

@@ -7,9 +7,10 @@
  * 스키마 소유권은 데스크탑에 있으므로 여기서는 방어적으로만 읽는다(tableExists/
  * columnExists) — 구버전 DB에서 열이 없으면 "오버라이드 없음"으로 조용히 전진.
  *
- * 해석 사다리(오너 계약): 명시(--runtime) > 에이전트별 오버라이드 > prefs >
- * active_runtime > detected. resolve.cjs 는 건드리지 않는다 — 이 모듈이
- * 오버라이드 층만 앞에 얹고 나머지는 resolve.cjs 에 위임한다.
+ * 해석 사다리(오너 계약): 명시(--runtime) > 에이전트별 오버라이드 > 역할별
+ * Dashboard 후보 풀 > prefs > active_runtime > detected. 역할 풀은 사용자가
+ * Orchestrator/Worker별로 정한 실행 우선순위이므로 전역 legacy prefs보다 앞선다.
+ * resolve.cjs 는 건드리지 않는다 — 이 모듈이 앞의 두 층을 얹는다.
  */
 const { tableExists, columnExists } = require("../core/db.cjs");
 const { RUNTIME_BIN, whichSync } = require("./detect.cjs");

package/engine/runtimes/resolve.cjs

@@ -63,7 +63,7 @@ function sharedRuntimeKind(row) {
   // never discard `agy` and silently fall through to Gemini or another CLI.
   const selectedBin = path.posix.basename(path.win32.basename(String(row.source || ""))).toLowerCase();
   if (row.kind === "gemini" && /^agy(?:\.exe|\.cmd)?$/i.test(selectedBin)) return "agy";
-  return row.kind;
+  return KINDS.canonicalRuntimeKind(row.kind);
 }
 
 class NoRuntimeError extends Error {
@@ -79,21 +79,22 @@ class NoRuntimeError extends Error {
  */
 function resolveRuntime({ db, prefs, explicit }) {
   if (explicit) {
-    const api = apiRuntime(explicit, null, "explicit");
+    const explicitKind = KINDS.canonicalRuntimeKind(explicit);
+    const api = apiRuntime(explicitKind, null, "explicit");
     if (api) return api;
-    const bin = RUNTIME_BIN[explicit];
+    const bin = RUNTIME_BIN[explicitKind];
     if (!bin) throw new NoRuntimeError(`unknown runtime: ${explicit}`);
-    if (!CLI_EXECUTABLE_KINDS.has(explicit)) {
-      const acpHint = ACP_CLI_KINDS.has(explicit)
+    if (!CLI_EXECUTABLE_KINDS.has(explicitKind)) {
+      const acpHint = ACP_CLI_KINDS.has(explicitKind)
         ? ` — its ACP driver needs the desktop core with electron/runtime/acp.js (npm run vendor:core / agentlas doctor)`
         : "";
       throw new NoRuntimeError(`runtime '${explicit}' has no v2 streaming driver yet (available: ${[...EXECUTABLE_KINDS].join(", ")})${acpHint}`);
     }
     const p = whichSync(bin);
     if (!p) throw new NoRuntimeError(`runtime '${explicit}' requested but '${bin}' is not on PATH`);
-    return { kind: explicit, bin: p, source: "explicit" };
+    return { kind: explicitKind, bin: p, source: "explicit" };
   }
-  const pref = prefs && prefs.runtime;
+  const pref = KINDS.canonicalRuntimeKind(prefs && prefs.runtime);
   if (pref && API_EXECUTABLE_KINDS.has(pref)) {
     return apiRuntime(pref, null, "prefs");
   }