agentlas 1.0.65 → 1.0.67

package/engine/commands/swarm.cjs

@@ -38,24 +38,62 @@ function resolvePermission(ctx) {
 function splitRuntimeOverride(args) {
   const rest = [];
   let runtimeOverride = null;
+  let seen = false;
+  let passthrough = false;
   for (let i = 0; i < args.length; i += 1) {
-    if (args[i] === "--runtime" && args[i + 1]) {
-      runtimeOverride = String(args[++i]);
+    const token = String(args[i]);
+    if (passthrough) { rest.push(token); continue; }
+    if (token === "--") { passthrough = true; rest.push(token); continue; }
+    if (token === "--runtime" || token.startsWith("--runtime=")) {
+      if (seen) throw new Error("duplicate option: --runtime");
+      seen = true;
+      const inline = token.startsWith("--runtime=");
+      const value = inline ? token.slice(10) : args[++i];
+      if (value === undefined || value === "" || (!inline && String(value).startsWith("--"))) {
+        throw new Error("--runtime requires a value");
+      }
+      runtimeOverride = String(value);
       continue;
     }
-    rest.push(args[i]);
+    rest.push(token);
   }
   return { rest, runtimeOverride };
 }
 
+function validateSwarmArgs(args) {
+  let seenParallel = false;
+  let passthrough = false;
+  let hasGoal = false;
+  for (let i = 0; i < args.length; i += 1) {
+    const token = String(args[i]);
+    if (passthrough) { hasGoal = true; continue; }
+    if (token === "--") { passthrough = true; continue; }
+    if (token === "--parallel" || token === "-n" || token.startsWith("--parallel=")) {
+      if (seenParallel) return { error: "duplicate option: --parallel", hasGoal };
+      seenParallel = true;
+      const inline = token.startsWith("--parallel=");
+      const raw = inline ? token.slice(11) : args[++i];
+      const value = Number(raw);
+      if (raw === undefined || raw === "" || (!inline && String(raw).startsWith("--")) || !Number.isInteger(value) || value < 1) {
+        return { error: "--parallel requires a positive integer (maximum 8)", hasGoal };
+      }
+    } else if (token.startsWith("-")) {
+      return { error: `unknown option: ${token} (use -- before a goal token that starts with '-')`, hasGoal };
+    } else hasGoal = true;
+  }
+  return { error: null, hasGoal };
+}
+
 async function run(ctx, args) {
-  const { rest, runtimeOverride } = splitRuntimeOverride(args);
+  let parsed;
+  try { parsed = splitRuntimeOverride(args); }
+  catch (error) { ctx.err(String((error && error.message) || error)); return 1; }
+  const { rest, runtimeOverride } = parsed;
+  const validation = validateSwarmArgs(rest);
+  if (validation.error) { ctx.err(validation.error); return 1; }
   // usage 경로(목표 텍스트 없음)는 SQLite를 열 이유가 없다 — cmdSwarm 의 플래그
   // (--parallel/-n <N>)만 있는 호출은 빈 목표다.
-  const hasGoal = rest.some((token, i) =>
-    !["--parallel", "-n"].includes(String(token))
-    && !(i > 0 && ["--parallel", "-n"].includes(String(rest[i - 1]))));
-  if (!hasGoal) {
+  if (!validation.hasGoal) {
     ctx.err("usage: agentlas swarm <goal>  [--parallel N] [--runtime <kind>]");
     return 1;
   }
@@ -72,4 +110,4 @@ async function run(ctx, args) {
   return r && r.ok ? 0 : 1;
 }
 
-module.exports = { run, splitRuntimeOverride };
+module.exports = { run, splitRuntimeOverride, validateSwarmArgs };

package/engine/commands/telegram.cjs

@@ -32,7 +32,12 @@ function renderTelegram(ctx) {
   return 0;
 }
 
-function run(ctx) {
+function run(ctx, args = []) {
+  if (args.length) {
+    const error = new Error("usage: agentlas telegram");
+    error.code = "INVALID_ARGUMENT";
+    throw error;
+  }
   return renderTelegram(ctx);
 }
 

package/engine/commands/uninstall.cjs

@@ -31,12 +31,18 @@ function chatDeletionCascadesFromAgent(db) {
 
 function run(ctx, args) {
   const ko = ctx.lang === "ko";
-  // 동의 플래그를 슬러그보다 앞에 써도 되도록 첫 번째 비플래그 인자를 대상으로 본다.
-  const token = args.find((a) => !String(a).startsWith("-"));
-  if (!token) {
-    ctx.err(ko ? "사용법: agentlas uninstall <agent>" : "Usage: agentlas uninstall <agent>");
-    return 1;
+  const consentFlags = new Set(["--yes", "-y", "--force"]);
+  const unknownOptions = args.filter((arg) => String(arg).startsWith("-") && !consentFlags.has(arg));
+  const tokens = args.filter((arg) => !String(arg).startsWith("-"));
+  const confirmations = args.filter((arg) => consentFlags.has(arg));
+  if (unknownOptions.length || tokens.length !== 1 || confirmations.length > 1) {
+    const error = new Error(ko
+      ? "사용법: agentlas uninstall <agent> [--yes]"
+      : "Usage: agentlas uninstall <agent> [--yes]");
+    error.code = "INVALID_ARGUMENT";
+    throw error;
   }
+  const token = tokens[0];
   const db = ctx.db();
   const agent = findAgent(db, token);
   if (!agent) {
@@ -83,7 +89,7 @@ function run(ctx, args) {
    * 쓰고 그 파일의 스키마는 기기마다 다르다 — 아직 옛 사다리에 있는 기기에서는 파괴가
    * 여전히 사실이다. 판단은 열려 있는 DB 의 외래키에서 읽는다.
    */
-  const consented = args.some((a) => a === "--yes" || a === "-y" || a === "--force");
+  const consented = confirmations.length === 1;
   const cascades = ctx.tableExists(db, "chats") && chatDeletionCascadesFromAgent(db);
   let chatCount = 0;
   let messageCount = 0;

package/engine/commands/update.cjs

@@ -49,6 +49,11 @@ async function checkNpmLatest({ fetch: fetchImpl, timeoutMs = 8_000 } = {}) {
 }
 
 async function run(ctx, args, deps = {}) {
+  if (args.some((arg) => arg !== "--json") || args.filter((arg) => arg === "--json").length > 1) {
+    const error = new Error("usage: agentlas update [--json]");
+    error.code = "INVALID_ARGUMENT";
+    throw error;
+  }
   const json = ctx.output?.format === "json" || args.includes("--json");
   const status = await checkNpmLatest(deps);
   if (json) {

package/engine/commands/upload.cjs

@@ -13,7 +13,8 @@ async function run(ctx, args) {
       : args;
     return await runUpload(ctx, commandArgs);
   } catch (e) {
-    ctx.err(String((e && e.message) || e));
+    if (typeof ctx.fail === "function") ctx.fail(e);
+    else ctx.err(String((e && e.message) || e));
     return 1;
   }
 }

package/engine/commands/usage.cjs

@@ -2,7 +2,12 @@
 /* usage — 로컬 사용 현황 요약 (공유 DB 읽기 전용). 공급자 쿼터 대시보드는 데스크탑 소관. */
 const { listAgents } = require("../agents/registry.cjs");
 
-function run(ctx) {
+function run(ctx, args = []) {
+  if (args.length) {
+    const error = new Error("usage: agentlas usage");
+    error.code = "INVALID_ARGUMENT";
+    throw error;
+  }
   const ko = ctx.lang === "ko";
   const db = ctx.db();
   const day = new Date(Date.now() - 86400000).toISOString();

package/engine/commands/version.cjs

@@ -29,7 +29,12 @@ function coreLine() {
   }
 }
 
-function run(ctx) {
+function run(ctx, args = []) {
+  if (args.length) {
+    const error = new Error("usage: agentlas version");
+    error.code = "INVALID_ARGUMENT";
+    throw error;
+  }
   ctx.out(`agentlas ${readVersion()}`);
   ctx.out(coreLine());
   return 0;

package/engine/commands/whoami.cjs

@@ -5,8 +5,13 @@
  */
 const auth = require("../cloud/auth.cjs");
 
-async function run(ctx) {
+async function run(ctx, args = []) {
   const ko = ctx.lang === "ko";
+  if (args.length) {
+    const error = new Error("usage: agentlas whoami");
+    error.code = "INVALID_ARGUMENT";
+    throw error;
+  }
   const cookie = auth.cloudSessionCookie();
   if (!cookie) {
     ctx.out(ko

package/engine/commands/workforce.cjs

@@ -27,9 +27,9 @@ function resolvePermission(ctx) {
   // persistent()가 fail-closed 로 강등한다.
   try {
     const policy = require("../agentlas-permissions.cjs");
-    return policy.persistent(ctx && ctx.prefs && ctx.prefs.permission, "write");
+    return policy.persistent(ctx && ctx.prefs && ctx.prefs.permission, "read");
   } catch {
-    return "write";
+    return "read";
   }
 }
 
@@ -37,16 +37,56 @@ function resolvePermission(ctx) {
 function splitRuntimeOverride(args) {
   const rest = [];
   let runtimeOverride = null;
+  let seen = false;
+  let passthrough = false;
   for (let i = 0; i < args.length; i += 1) {
-    if (args[i] === "--runtime" && args[i + 1]) {
-      runtimeOverride = String(args[++i]);
+    const token = String(args[i]);
+    if (passthrough) { rest.push(token); continue; }
+    if (token === "--") { passthrough = true; rest.push(token); continue; }
+    if (token === "--runtime" || token.startsWith("--runtime=")) {
+      if (seen) throw new Error("duplicate option: --runtime");
+      seen = true;
+      const inline = token.startsWith("--runtime=");
+      const value = inline ? token.slice(10) : args[++i];
+      if (value === undefined || value === "" || (!inline && String(value).startsWith("--"))) {
+        throw new Error("--runtime requires a value");
+      }
+      runtimeOverride = String(value);
       continue;
     }
-    rest.push(args[i]);
+    rest.push(token);
   }
   return { rest, runtimeOverride };
 }
 
+function validateWorkforceArgs(args) {
+  const seen = new Set();
+  let passthrough = false;
+  let hasTask = false;
+  for (let i = 0; i < args.length; i += 1) {
+    const token = String(args[i]);
+    if (passthrough) { hasTask = true; continue; }
+    if (token === "--") { passthrough = true; continue; }
+    if (token === "--benchmark" || token === "--json") {
+      const key = token.slice(2);
+      if (seen.has(key)) return { error: `duplicate option: ${token}`, hasTask };
+      seen.add(key);
+    } else if (token === "--parallel" || token === "-n" || token.startsWith("--parallel=")) {
+      if (seen.has("parallel")) return { error: "duplicate option: --parallel", hasTask };
+      seen.add("parallel");
+      const inline = token.startsWith("--parallel=");
+      const raw = inline ? token.slice(11) : args[++i];
+      const value = Number(raw);
+      if (raw === undefined || raw === "" || (!inline && String(raw).startsWith("--")) || !Number.isInteger(value) || value < 1 || value > 8) {
+        return { error: "--parallel requires a positive integer (maximum 8)", hasTask };
+      }
+    } else if (token.startsWith("-")) {
+      return { error: `unknown option: ${token} (use -- before a task token that starts with '-')`, hasTask };
+    } else hasTask = true;
+  }
+  return { error: null, hasTask };
+}
+
 /**
  * command 별 디스패치. commands/index.cjs 는 명령 이름을 별도 인자로 넘기지 않으므로
  * run()이 기본 "workforce" 로 진입하고, 별칭 배선 시 이 dispatch 를 직접 쓴다.
@@ -56,13 +96,15 @@ async function dispatch(ctx, command, args) {
     case "workforce":
     case "network":
     case "taskforce": {
-      const { rest, runtimeOverride } = splitRuntimeOverride(args);
+      let parsed;
+      try { parsed = splitRuntimeOverride(args); }
+      catch (error) { ctx.err(String((error && error.message) || error)); return 1; }
+      const { rest, runtimeOverride } = parsed;
+      const validation = validateWorkforceArgs(rest);
+      if (validation.error) { ctx.err(validation.error); return 1; }
       // usage 경로(작업 텍스트 없음)는 SQLite를 열 이유가 없다 — cmdWorkforce 의
       // parseArgs 와 동일한 판정: 플래그가 아닌 토큰이 하나도 없으면 빈 작업이다.
-      const hasTask = rest.some((token, i) =>
-        !["--benchmark", "--json", "--parallel", "-n"].includes(String(token))
-        && !(i > 0 && ["--parallel", "-n"].includes(String(rest[i - 1]))));
-      if (!hasTask) {
+      if (!validation.hasTask) {
         ctx.err("usage: agentlas workforce <task> [--parallel N] [--benchmark] [--json] [--runtime <kind>]");
         return 1;
       }
@@ -107,11 +149,13 @@ async function dispatch(ctx, command, args) {
     case "hep-hub": {
       const sourceScope = command.slice(4); // network|local|cloud|hub
       const ko = ctx.lang !== "en";
-      const { rest, runtimeOverride } = splitRuntimeOverride(args);
-      const hasTask = rest.some((token, i) =>
-        !["--benchmark", "--json", "--parallel", "-n"].includes(String(token))
-        && !(i > 0 && ["--parallel", "-n"].includes(String(rest[i - 1]))));
-      if (!hasTask) {
+      let parsed;
+      try { parsed = splitRuntimeOverride(args); }
+      catch (error) { ctx.err(String((error && error.message) || error)); return 1; }
+      const { rest, runtimeOverride } = parsed;
+      const validation = validateWorkforceArgs(rest);
+      if (validation.error) { ctx.err(validation.error); return 1; }
+      if (!validation.hasTask) {
         ctx.err(`usage: agentlas ${command} "<task>" [--parallel N] [--json] [--runtime <kind>]`);
         return 1;
       }
@@ -162,4 +206,4 @@ function run(ctx, args) {
   return dispatch(ctx, "workforce", args);
 }
 
-module.exports = { run, dispatch };
+module.exports = { run, dispatch, splitRuntimeOverride, validateWorkforceArgs };

package/engine/core/capability-grants.cjs

@@ -55,7 +55,9 @@ function patternMatches(pattern, detail) {
   if (pattern === null || pattern === undefined || pattern === "") return true;
   if (!detail) return false;
   const text = String(pattern);
-  if (text.endsWith("*")) return String(detail).startsWith(text.slice(0, -1).trimEnd());
+  // Keep the separator before `*`. Removing it turns `git push *` into the
+  // broader prefix `git push`, which also authorizes unrelated `git pushx`.
+  if (text.endsWith("*")) return String(detail).startsWith(text.slice(0, -1));
   return String(detail) === text;
 }
 
@@ -126,7 +128,10 @@ function recordCapabilityGrant(db, input) {
   if (!capabilityGrantsAvailable(db)) {
     return { ok: false, available: false, reason: UNAVAILABLE_REASON };
   }
-  const decision = input && input.decision === "deny" ? "deny" : "allow";
+  const decision = input && input.decision;
+  if (decision !== "allow" && decision !== "deny") {
+    return { ok: false, available: true, reason: "capability_grants decision must be allow or deny" };
+  }
   try {
     db.prepare(
       `INSERT INTO ${TABLE} (capability, pattern, decision, scope, source, created_at)

package/engine/core/daemon-client.cjs

@@ -17,9 +17,12 @@
  */
 const net = require("node:net");
 const crypto = require("node:crypto");
+const fs = require("node:fs");
 const path = require("node:path");
 const { userDataDir } = require("./paths.cjs");
 
+const DAEMON_MAX_RESPONSE_BYTES = 16 * 1024 * 1024;
+
 /** 데몬 소켓 주소 — control-socket.ts 의 defaultControlSocketPath 와 같은 규칙. */
 function daemonSocketPath() {
   const dir = userDataDir();
@@ -41,11 +44,13 @@ function callDaemon(method, params, timeoutMs) {
   return new Promise((resolve, reject) => {
     const socket = net.connect(daemonSocketPath());
     const id = crypto.randomUUID();
-    let buffer = "";
+    let buffer = Buffer.alloc(0);
+    let responseBytes = 0;
     let settled = false;
     const finish = (fn) => {
       if (settled) return;
       settled = true;
+      buffer = Buffer.alloc(0);
       clearTimeout(timer);
       socket.destroy();
       fn();
@@ -56,10 +61,19 @@ function callDaemon(method, params, timeoutMs) {
     );
     socket.on("connect", () => socket.write(`${JSON.stringify({ id, method, params })}\n`));
     socket.on("data", (chunk) => {
-      buffer += chunk.toString("utf8");
+      if (settled) return;
+      const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+      responseBytes += bytes.length;
+      if (responseBytes > DAEMON_MAX_RESPONSE_BYTES) {
+        const error = new Error(`daemon response exceeded ${DAEMON_MAX_RESPONSE_BYTES} bytes`);
+        error.code = "DAEMON_RESPONSE_BODY_LIMIT";
+        finish(() => reject(error));
+        return;
+      }
+      buffer = buffer.length ? Buffer.concat([buffer, bytes]) : bytes;
       let nl;
-      while ((nl = buffer.indexOf("\n")) >= 0) {
-        const line = buffer.slice(0, nl).trim();
+      while (!settled && (nl = buffer.indexOf(0x0a)) >= 0) {
+        const line = buffer.subarray(0, nl).toString("utf8").trim();
         buffer = buffer.slice(nl + 1);
         if (!line) continue;
         let message;
@@ -109,8 +123,23 @@ function sharesOurStore(pong) {
     );
     return false;
   }
-  const path = require("node:path");
-  if (path.resolve(theirs) === path.resolve(ours)) return true;
+  let oursStat;
+  let theirsStat;
+  try {
+    oursStat = fs.statSync(path.resolve(ours));
+    theirsStat = fs.statSync(path.resolve(theirs));
+  } catch {
+    console.error(
+      `[daemon] could not verify the database identity (${theirs}) against this command (${ours}).\n`
+      + "[daemon] Running the graph locally instead, so the work cannot land in a different store.",
+    );
+    return false;
+  }
+  if (
+    oursStat.isFile() && theirsStat.isFile() &&
+    String(oursStat.dev) === String(theirsStat.dev) &&
+    String(oursStat.ino) === String(theirsStat.ino)
+  ) return true;
   console.error(
     `[daemon] the daemon opened a different database (${theirs}) than this command (${ours}).\n`
     + "[daemon] Running the graph locally instead, so the work cannot land in a different store.",
@@ -118,4 +147,4 @@ function sharesOurStore(pong) {
   return false;
 }
 
-module.exports = { daemonSocketPath, callDaemon, daemonAvailable, sharesOurStore };
+module.exports = { daemonSocketPath, callDaemon, daemonAvailable, sharesOurStore, DAEMON_MAX_RESPONSE_BYTES };

package/engine/core/db.cjs

@@ -14,6 +14,7 @@
  * 정직하게 거절한다(승급은 여전히 데스크탑의 일이다).
  */
 const fs = require("node:fs");
+const { pathToFileURL } = require("node:url");
 const { configureSqliteConnection } = require("../agentlas-sqlite-policy.cjs");
 const { parseSemVer, compareSemVer } = require("../semver.cjs");
 const { dbPath } = require("./paths.cjs");
@@ -38,13 +39,16 @@ function loadNodeSqliteQuietly() {
 function openRaw(file) {
   try {
     const Database = require("better-sqlite3");
-    const db = new Database(file);
+    const db = new Database(file, { fileMustExist: true });
     configureSqliteConnection(db);
     db.__driver = "better-sqlite3";
     return db;
   } catch { /* optional dep 미설치/ABI 불일치 → node:sqlite */ }
   const { DatabaseSync } = loadNodeSqliteQuietly();
-  const db = new DatabaseSync(file);
+  // DatabaseSync does not expose better-sqlite3's `fileMustExist` option. A
+  // SQLite URI with mode=rw opens an existing file read/write but refuses to
+  // create it when an existsSync check races with deletion.
+  const db = new DatabaseSync(`${pathToFileURL(file).href}?mode=rw`);
   configureSqliteConnection(db);
   db.__driver = "node:sqlite";
   return db;
@@ -125,9 +129,13 @@ function columnExists(db, table, col) {
 }
 
 function runWriteTransaction(db, fn) {
+  if (!db || typeof fn !== "function") throw new TypeError("SQLite connection and transaction callback are required");
   db.exec("BEGIN IMMEDIATE");
   try {
     const result = fn();
+    if (result && typeof result.then === "function") {
+      throw new TypeError("SQLite write transactions must be synchronous");
+    }
     db.exec("COMMIT");
     return result;
   } catch (e) {