agentlas 1.0.65 → 1.0.67

package/engine/project/state.cjs

@@ -37,16 +37,27 @@ const projectBootstrapStates = new Map();
 
 function terminalProjectCandidateCli(projectPath) {
   try {
-    const root = path.resolve(projectPath || process.cwd());
+    const requested = path.resolve(projectPath || process.cwd());
+    const stat = fs.statSync(requested);
+    if (!stat.isDirectory()) return null;
+    // Resolve the directory before applying broad-root exclusions. Otherwise
+    // `/tmp/project -> ~/.agentlas` bypasses the lexical checks and lets an
+    // explicit init write private project state into Agentlas' own userData.
+    const root = fs.realpathSync.native(requested);
+    const realOrResolved = (candidate) => {
+      try { return fs.realpathSync.native(candidate); } catch { return path.resolve(candidate); }
+    };
+    const home = realOrResolved(os.homedir());
+    const data = realOrResolved(userDataDir());
+    const fallback = realOrResolved(runCwd());
     const unsafe = new Set([
-      path.resolve(os.homedir()),
+      home,
       path.parse(root).root,
-      path.resolve(userDataDir()),
-      path.resolve(runCwd()),
+      data,
+      fallback,
     ]);
     if (unsafe.has(root)) return null;
-    const stat = fs.statSync(root);
-    if (!stat.isDirectory()) return null;
+    if (root.startsWith(`${data}${path.sep}`) || root.startsWith(`${fallback}${path.sep}`)) return null;
     return root;
   } catch {
     return null;
@@ -67,6 +78,10 @@ function assertNoSymlinkInAgentlasStateCli(stateDir) {
     if (stat.isSymbolicLink()) throw new Error(".agentlas local state must not contain symbolic links");
     if (stat.isDirectory()) {
       for (const entry of fs.readdirSync(current)) pending.push(path.join(current, entry));
+    } else if (stat.isFile()) {
+      if (stat.nlink !== 1) throw new Error(".agentlas local state must not contain hard-linked files");
+    } else {
+      throw new Error(".agentlas local state must contain only directories and regular files");
     }
   }
   if (pending.length) throw new Error(".agentlas local state exceeds the safe bootstrap inspection limit");
@@ -78,7 +93,9 @@ function readRegularUtf8FileNoFollowCli(filePath, maxBytes = AGENTLAS_GITIGNORE_
     if (error && error.code === "ENOENT") return { exists: false, content: "", mode: 0o644, stat: null };
     throw error;
   }
-  if (before.isSymbolicLink() || !before.isFile()) throw new Error(".gitignore must be a regular non-symbolic-link file");
+  if (before.isSymbolicLink() || !before.isFile() || before.nlink !== 1) {
+    throw new Error(".gitignore must be a single-link regular non-symbolic-link file");
+  }
   if (before.size > maxBytes) throw new Error(`.gitignore exceeds the ${maxBytes}-byte safe bootstrap limit`);
 
   const noFollow = fs.constants.O_NOFOLLOW || 0;
@@ -91,7 +108,7 @@ function readRegularUtf8FileNoFollowCli(filePath, maxBytes = AGENTLAS_GITIGNORE_
   }
   try {
     const opened = fs.fstatSync(fd);
-    if (!opened.isFile()) throw new Error(".gitignore changed type during bootstrap");
+    if (!opened.isFile() || opened.nlink !== 1) throw new Error(".gitignore changed type during bootstrap");
     if (opened.size > maxBytes) throw new Error(`.gitignore exceeds the ${maxBytes}-byte safe bootstrap limit`);
     if (
       Number.isFinite(before.dev) && Number.isFinite(before.ino) &&
@@ -110,7 +127,9 @@ function readRegularUtf8FileNoFollowCli(filePath, maxBytes = AGENTLAS_GITIGNORE_
     }
     if (total > maxBytes) throw new Error(`.gitignore exceeds the ${maxBytes}-byte safe bootstrap limit`);
     const after = fs.fstatSync(fd);
-    if (after.size !== opened.size || after.mtimeMs !== opened.mtimeMs) throw new Error(".gitignore changed while it was being read");
+    if (after.nlink !== 1 || after.size !== opened.size || after.mtimeMs !== opened.mtimeMs) {
+      throw new Error(".gitignore changed while it was being read");
+    }
     let content;
     try { content = new TextDecoder("utf-8", { fatal: true }).decode(Buffer.concat(chunks, total)); } catch {
       throw new Error(".gitignore must contain valid UTF-8 text");
@@ -132,7 +151,7 @@ function assertFileSnapshotUnchangedCli(filePath, snapshot) {
     }
   }
   const current = fs.lstatSync(filePath);
-  if (current.isSymbolicLink() || !current.isFile()) throw new Error(".gitignore changed type during bootstrap");
+  if (current.isSymbolicLink() || !current.isFile() || current.nlink !== 1) throw new Error(".gitignore changed type during bootstrap");
   const original = snapshot.stat;
   if (
     !original || current.dev !== original.dev || current.ino !== original.ino ||
@@ -227,14 +246,20 @@ function hardenAgentlasProjectStateCli(projectPath) {
     visited += 1;
     try {
       const stat = fs.lstatSync(current);
-      if (stat.isSymbolicLink()) continue;
+      if (stat.isSymbolicLink()) throw new Error(".agentlas local state must not contain symbolic links");
       if (stat.isDirectory()) {
         try { fs.chmodSync(current, 0o700); } catch { /* Windows/best effort */ }
         for (const entry of fs.readdirSync(current)) pending.push(path.join(current, entry));
       } else if (stat.isFile()) {
+        if (stat.nlink !== 1) throw new Error(".agentlas local state must not contain hard-linked files");
         try { fs.chmodSync(current, 0o600); } catch { /* Windows/best effort */ }
+      } else {
+        throw new Error(".agentlas local state must contain only directories and regular files");
       }
-    } catch { /* disappearing files and ACL-only hosts are best effort */ }
+    } catch (error) {
+      if (error && error.code === "ENOENT") continue;
+      throw error;
+    }
   }
 }
 
@@ -314,10 +339,10 @@ function recordCliFolderVisit(db, projectPath, options = {}) {
   const activate = options.activate === true;
   try {
     if (!activate) {
-      const row = tableExists(db, "folder_activity")
-        ? db.prepare("SELECT activated_at FROM folder_activity WHERE path=?").get(root)
-        : null;
-      return { activated: Boolean(row && row.activated_at) || fs.existsSync(path.join(root, ".agentlas")) };
+      // A historical DB row or an arbitrary `.agentlas` entry is not proof
+      // that today's private-state boundary is intact. Revalidate the marker,
+      // soul file, entry types, and link identities on every passive use.
+      return { activated: Boolean(initializedAgentlasProjectPathCli(root)) };
     }
 
     ensureCoreProjectCli(root, { reason: options.reason || "terminal-first-contact", coreRoot: options.coreRoot });

package/engine/project/team.cjs

@@ -18,24 +18,49 @@
  *    갱신하고, 없으면 만든다(데스크탑이 만든 프로젝트도 그대로 이어받는다).
  */
 const crypto = require("node:crypto");
+const os = require("node:os");
 const path = require("node:path");
 const fs = require("node:fs");
 const { runWriteTransaction } = require("../agentlas-sqlite-policy.cjs");
 const { findAgent } = require("../agents/registry.cjs");
+const { userDataDir } = require("../core/paths.cjs");
 
 function canonical(p) {
   const resolved = path.resolve(String(p || ""));
-  try { return fs.realpathSync.native(resolved); } catch { return resolved; }
+  let root;
+  try { root = fs.realpathSync.native(resolved); }
+  catch { throw Object.assign(new Error(`project folder does not exist: ${resolved}`), { code: "project_folder_invalid", honestStop: true }); }
+  const stat = fs.lstatSync(root);
+  let home = path.resolve(os.homedir());
+  let data = path.resolve(userDataDir());
+  try { home = fs.realpathSync.native(home); } catch { /* compare unresolved */ }
+  try { data = fs.realpathSync.native(data); } catch { /* compare unresolved */ }
+  if (
+    !stat.isDirectory() || stat.isSymbolicLink() ||
+    path.parse(root).root === root || root === home ||
+    root === data || root.startsWith(`${data}${path.sep}`)
+  ) {
+    throw Object.assign(new Error(`refusing unsafe project folder: ${resolved}`), { code: "project_folder_invalid", honestStop: true });
+  }
+  return root;
 }
 
 /** slug/이름 목록 → 검증된 순서 풀. 못 찾은 이름은 정직하게 실패. */
 function resolveTeam(db, tokens) {
+  if (tokens.length > 64) {
+    throw Object.assign(new Error("a project team may contain at most 64 agents"), { code: "team_too_large", honestStop: true });
+  }
   const pool = [];
+  const seen = new Set();
   for (const token of tokens) {
     const agent = findAgent(db, token);
     if (!agent) {
       throw Object.assign(new Error(`agent not found: ${token}`), { code: "team_agent_not_found", honestStop: true, token });
     }
+    if (seen.has(agent.id)) {
+      throw Object.assign(new Error(`duplicate project team agent: ${token}`), { code: "team_agent_duplicate", honestStop: true, token });
+    }
+    seen.add(agent.id);
     // 설치 에이전트는 로컬이다(installed_agents에 있음 = 이 머신에서 실행 가능).
     pool.push({
       agentId: agent.id,

package/engine/runtime-refusal.cjs

@@ -27,7 +27,10 @@ const MAX_NOTICE_LENGTH = 400;
 const NOTICE_PATTERNS = [
   /\byou'?ve hit\b/i,                 // "You've hit your weekly/usage limit" (claude·codex 실측)
   /\busage limit\b/i,
-  /\brate.?limit(ed)?\b/i,
+  /\brate.?limit (?:exceeded|reached)\b/i,
+  /^(?:error:\s*)?rate.?limit (?:has been )?(?:exceeded|reached)\b/i,
+  /\b(?:your|the) rate.?limit (?:has been|is) (?:exceeded|reached)\b/i,
+  /\byou (?:are (?:currently )?|have been )rate.?limited\b/i,
   /\bquota (exceeded|reached)\b/i,
   /\bresets? (at|on)\b/i,             // "resets Aug 8 at 6pm"
   /\btry again (at|later)\b/i,

package/engine/runtimes/acp-driver.cjs

@@ -14,6 +14,48 @@ const permissions = require("../agentlas-permissions.cjs");
 
 // 정본(runtimes/kinds.cjs)의 ACP 3종에서 파생 — resolve.cjs의 ACP_CLI_KINDS와 같은 원소.
 const ACP_KINDS = new Set(require("./kinds.cjs").ACP_CLI_KINDS);
+const ACP_HISTORY_MAX_ENTRIES = 40;
+const ACP_HISTORY_MAX_BYTES = 512 * 1024;
+const ACP_HISTORY_MAX_ENTRY_BYTES = 64 * 1024;
+
+function boundedHistoryText(value, maxBytes) {
+  const text = String(value || "");
+  const encoded = Buffer.from(text, "utf8");
+  if (encoded.length <= maxBytes) return text;
+  let bounded = encoded.subarray(0, maxBytes).toString("utf8");
+  // A byte cut in the middle of a multibyte code point can decode to U+FFFD,
+  // whose three bytes would otherwise make the decoded value exceed maxBytes.
+  while (Buffer.byteLength(bounded, "utf8") > maxBytes) bounded = bounded.slice(0, -1);
+  return bounded;
+}
+
+/*
+ * Provider history is supplied by the local chat store, where old rows may be
+ * larger than the ACP request budget. Keep the newest messages, retain their
+ * original order, and cap both message count and UTF-8 text bytes before the
+ * request is serialized by the provider runner.
+ */
+function boundedAcpHistory(history) {
+  if (!Array.isArray(history)) return [];
+  const bounded = [];
+  let totalBytes = 0;
+  for (let index = history.length - 1;
+    index >= 0 && bounded.length < ACP_HISTORY_MAX_ENTRIES && totalBytes < ACP_HISTORY_MAX_BYTES;
+    index -= 1) {
+    const entry = history[index];
+    const remainingBytes = ACP_HISTORY_MAX_BYTES - totalBytes;
+    const text = boundedHistoryText(
+      entry && (entry.text ?? entry.content),
+      Math.min(ACP_HISTORY_MAX_ENTRY_BYTES, remainingBytes),
+    );
+    bounded.unshift({
+      role: entry && entry.role === "assistant" ? "assistant" : "user",
+      text,
+    });
+    totalBytes += Buffer.byteLength(text, "utf8");
+  }
+  return bounded;
+}
 
 /** 이 머신에서 ACP 드라이버를 쓸 수 있는가. { ok, reason?, module? } */
 function acpDriverAvailability() {
@@ -48,13 +90,14 @@ async function runAcpTurn(req) {
     return { text: "", session: req.session || {}, error: `runtime '${kind}' is not an ACP agent in this core`, errorKind: "unsupported", errorSource: "marker" };
   }
   const runner = mod.createAcpRunner(spec);
+  const permission = permissions.normalize(req.permission);
   let mcpConfigPath;
   try {
     // ACP runner consumes the same Claude-compatible MCP config shape as Desktop.
     // Reuse native-host's content-addressed, credential-isolating materializer so
     // Cursor/Grok/Kimi receive exactly the already-consented Terminal allowlist.
     const nativeHost = require("../agentlas-native-host.cjs");
-    const allowedMcpServers = permissions.normalize(req.permission) === "full"
+    const allowedMcpServers = permission === "full"
       ? (req.mcpServers || [])
       : [];
     mcpConfigPath = nativeHost.cliMcpConfigPath(allowedMcpServers, {
@@ -92,16 +135,11 @@ async function runAcpTurn(req) {
   try {
     const result = await runner({
       systemPrompt: req.systemPrompt || "",
-      history: Array.isArray(req.history)
-        ? req.history.map((entry) => ({
-          role: entry && entry.role === "assistant" ? "assistant" : "user",
-          text: String((entry && (entry.text ?? entry.content)) || ""),
-        }))
-        : [],
+      history: boundedAcpHistory(req.history),
       userPrompt: req.prompt || "",
       backendLabel: spec.label,
       locale,
-      permission: req.permission,
+      permission,
       runtimeSource: bin,
       cwd: req.cwd,
       env: req.env || process.env,
@@ -132,4 +170,13 @@ async function runAcpTurn(req) {
   }
 }
 
-module.exports = { ACP_KINDS, acpDriverAvailability, acpSpecFor, runAcpTurn };
+module.exports = {
+  ACP_KINDS,
+  ACP_HISTORY_MAX_ENTRIES,
+  ACP_HISTORY_MAX_BYTES,
+  ACP_HISTORY_MAX_ENTRY_BYTES,
+  boundedAcpHistory,
+  acpDriverAvailability,
+  acpSpecFor,
+  runAcpTurn,
+};

package/engine/runtimes/auth-evidence.cjs

@@ -23,13 +23,32 @@ const path = require("node:path");
 const { spawnSync } = require("node:child_process");
 
 const home = () => os.homedir();
+const MAX_AUTH_EVIDENCE_BYTES = 256 * 1024;
+const NOFOLLOW = fs.constants.O_NOFOLLOW || 0;
 
 function fileEvidence(rel, label) {
   const p = path.join(home(), ...rel);
+  let fd = null;
   try {
-    if (fs.existsSync(p) && fs.statSync(p).size > 0) return { status: "evidence", detail: label || p };
+    const before = fs.lstatSync(p);
+    if (
+      before.isSymbolicLink() || !before.isFile() || before.nlink !== 1 ||
+      before.size <= 0 || before.size > MAX_AUTH_EVIDENCE_BYTES
+    ) return null;
+    fd = fs.openSync(p, fs.constants.O_RDONLY | NOFOLLOW);
+    const after = fs.fstatSync(fd);
+    if (
+      after.isSymbolicLink() || !after.isFile() || after.nlink !== 1 ||
+      after.size <= 0 || after.size > MAX_AUTH_EVIDENCE_BYTES ||
+      after.dev !== before.dev || after.ino !== before.ino
+    ) return null;
+    return { status: "evidence", detail: label || p };
   } catch { /* unreadable == no evidence */ }
-  return null;
+  finally {
+    if (fd !== null) {
+      try { fs.closeSync(fd); } catch { /* already closed */ }
+    }
+  }
 }
 
 function envEvidence(names) {

package/engine/runtimes/detect.cjs

@@ -6,21 +6,41 @@
  * 여기서는 "실행 파일이 있는가"만 결정론적으로 본다. 모델 응답 여부는 판정하지 않는다
  * (없으면 no_runtime 정직 정지 — 폴백 금지는 상위 계층의 계약).
  */
-const { spawnSync } = require("node:child_process");
+const fs = require("node:fs");
+const path = require("node:path");
 // kind 목록/실행 파일 이름의 정본은 runtimes/kinds.cjs 하나다 — 여기서 다시 적지 않는다.
 const { RUNTIME_BIN, CLI_KINDS } = require("./kinds.cjs");
 
 const CLI_RUNTIMES = CLI_KINDS;
 
 function whichSync(bin) {
-  const cmd = process.platform === "win32" ? "where" : "which";
-  try {
-    const res = spawnSync(cmd, [bin], { encoding: "utf8", timeout: 4000 });
-    if (res.status === 0) {
-      const line = String(res.stdout || "").split(/\r?\n/).find((l) => l.trim());
-      return line ? line.trim() : null;
+  const name = typeof bin === "string" ? bin.trim() : "";
+  if (!name || name.includes("\0") || path.basename(name) !== name) return null;
+  const pathValue = String(process.env.PATH || "");
+  if (!pathValue) return null;
+  const windows = process.platform === "win32";
+  const configuredExts = windows
+    ? String(process.env.PATHEXT || ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean)
+    : [""];
+  const hasWindowsExt = windows && configuredExts.some((ext) => name.toLowerCase().endsWith(ext.toLowerCase()));
+  const extensions = hasWindowsExt ? [""] : configuredExts;
+  for (const rawDir of pathValue.split(path.delimiter)) {
+    const unquoted = rawDir.length >= 2 && rawDir.startsWith('"') && rawDir.endsWith('"')
+      ? rawDir.slice(1, -1)
+      : rawDir;
+    const directory = path.resolve(unquoted || ".");
+    for (const ext of extensions) {
+      const candidate = path.join(directory, name + ext);
+      try {
+        const stat = fs.statSync(candidate);
+        if (!stat.isFile()) continue;
+        fs.accessSync(candidate, windows ? fs.constants.F_OK : fs.constants.X_OK);
+        return candidate;
+      } catch {
+        // Continue to the next PATH entry just like a shell command lookup.
+      }
     }
-  } catch { /* not found */ }
+  }
   return null;
 }
 

package/engine/runtimes/kinds.cjs

@@ -94,15 +94,23 @@ const API_BACKEND_SPECS = ["anthropic", "openai", "google", "ollama", "upstage"]
 const RUNTIME_SPECS = [...NATIVE_CLI_KINDS, ...API_BACKEND_SPECS];
 
 /**
- * 저장 계약(automation 등)이 허용하는 kind 전체 — CLI + 로컬/BYOK 실행 kind.
- * 데스크탑 shared/runtime-kinds.ts 와 동형(터미널 표기: antigravity→agy, acp 미지원).
+ * 저장 계약(automation 등)이 허용하는 kind 전체.
+ *
+ * 공유 SQLite의 소유자는 Desktop이므로 Desktop shared/runtime-kinds.ts의 저장
+ * 어휘를 모두 받아야 한다. 이 Terminal이 아직 실행하지 못하는 kind도 구조적으로
+ * 정상인 핀은 "손상"이 아니라 pinned-runtime-unavailable로 정직하게 멈춘다.
+ * agy/gemini는 이전 Terminal·Desktop 행의 전진 호환 별칭이다.
  */
-const CONTRACT_RUNTIME_KINDS = [...CLI_KINDS, "byok", "ollama", "lmstudio", "mlx"];
+const CONTRACT_RUNTIME_KINDS = [
+  "claude-code", "codex", "antigravity", "kimi", "grok", "cursor",
+  "byok", "ollama", "lmstudio", "mlx", "acp", "agentlas",
+  "agy", "gemini",
+];
 
 /** 저장 계약이 허용하는 LLM 백엔드 — 데스크탑 shared/runtime-backends.ts 와 동일 15종. */
 const CONTRACT_RUNTIME_BACKENDS = [
   "anthropic", "openai", "google", "ollama", "lmstudio", "mlx", "upstage", "custom", "glm",
-  "kimi", "deepseek", "minimax", "xai", "openrouter", "cursor",
+  "kimi", "deepseek", "minimax", "xai", "openrouter", "cursor", "agentlas",
 ];
 
 module.exports = {

package/engine/runtimes/overrides.cjs

@@ -7,9 +7,10 @@
  * 스키마 소유권은 데스크탑에 있으므로 여기서는 방어적으로만 읽는다(tableExists/
  * columnExists) — 구버전 DB에서 열이 없으면 "오버라이드 없음"으로 조용히 전진.
  *
- * 해석 사다리(오너 계약): 명시(--runtime) > 에이전트별 오버라이드 > prefs >
- * active_runtime > detected. resolve.cjs 는 건드리지 않는다 — 이 모듈이
- * 오버라이드 층만 앞에 얹고 나머지는 resolve.cjs 에 위임한다.
+ * 해석 사다리(오너 계약): 명시(--runtime) > 에이전트별 오버라이드 > 역할별
+ * Dashboard 후보 풀 > prefs > active_runtime > detected. 역할 풀은 사용자가
+ * Orchestrator/Worker별로 정한 실행 우선순위이므로 전역 legacy prefs보다 앞선다.
+ * resolve.cjs 는 건드리지 않는다 — 이 모듈이 앞의 두 층을 얹는다.
  */
 const { tableExists, columnExists } = require("../core/db.cjs");
 const { RUNTIME_BIN, whichSync } = require("./detect.cjs");

package/engine/runtimes/resolve.cjs

@@ -63,7 +63,7 @@ function sharedRuntimeKind(row) {
   // never discard `agy` and silently fall through to Gemini or another CLI.
   const selectedBin = path.posix.basename(path.win32.basename(String(row.source || ""))).toLowerCase();
   if (row.kind === "gemini" && /^agy(?:\.exe|\.cmd)?$/i.test(selectedBin)) return "agy";
-  return row.kind;
+  return KINDS.canonicalRuntimeKind(row.kind);
 }
 
 class NoRuntimeError extends Error {
@@ -79,21 +79,22 @@ class NoRuntimeError extends Error {
  */
 function resolveRuntime({ db, prefs, explicit }) {
   if (explicit) {
-    const api = apiRuntime(explicit, null, "explicit");
+    const explicitKind = KINDS.canonicalRuntimeKind(explicit);
+    const api = apiRuntime(explicitKind, null, "explicit");
     if (api) return api;
-    const bin = RUNTIME_BIN[explicit];
+    const bin = RUNTIME_BIN[explicitKind];
     if (!bin) throw new NoRuntimeError(`unknown runtime: ${explicit}`);
-    if (!CLI_EXECUTABLE_KINDS.has(explicit)) {
-      const acpHint = ACP_CLI_KINDS.has(explicit)
+    if (!CLI_EXECUTABLE_KINDS.has(explicitKind)) {
+      const acpHint = ACP_CLI_KINDS.has(explicitKind)
         ? ` — its ACP driver needs the desktop core with electron/runtime/acp.js (npm run vendor:core / agentlas doctor)`
         : "";
       throw new NoRuntimeError(`runtime '${explicit}' has no v2 streaming driver yet (available: ${[...EXECUTABLE_KINDS].join(", ")})${acpHint}`);
     }
     const p = whichSync(bin);
     if (!p) throw new NoRuntimeError(`runtime '${explicit}' requested but '${bin}' is not on PATH`);
-    return { kind: explicit, bin: p, source: "explicit" };
+    return { kind: explicitKind, bin: p, source: "explicit" };
   }
-  const pref = prefs && prefs.runtime;
+  const pref = KINDS.canonicalRuntimeKind(prefs && prefs.runtime);
   if (pref && API_EXECUTABLE_KINDS.has(pref)) {
     return apiRuntime(pref, null, "prefs");
   }

package/engine/runtimes/roles.cjs

@@ -5,6 +5,7 @@
  * Persistence is owned by Desktop migration v79. Terminal reads defensively:
  *   orchestrator row -> legacy active_runtime -> null
  *   worker direct row -> orchestrator row/legacy active_runtime
+ *   multimodal direct row -> null (never inherits a conversational runtime)
  *
  * The worker may inherit upward for quality; the orchestrator never falls
  * downward to the worker row.
@@ -13,7 +14,7 @@ const { canonicalRuntimeKind } = require("./kinds.cjs");
 const { tableExists, columnExists } = require("../core/db.cjs");
 
 const MODEL_ROLE_TABLE = "model_roles";
-const VALID_ROLES = new Set(["orchestrator", "worker"]);
+const VALID_ROLES = new Set(["orchestrator", "worker", "multimodal"]);
 
 function cleanText(value) {
   const trimmed = typeof value === "string" ? value.trim() : "";
@@ -136,17 +137,18 @@ function resolvedModelRole(db, role = "orchestrator") {
   if (role === "orchestrator") {
     return normalizedRow(roleRow(db, "orchestrator"), role) || legacyOrchestrator(db);
   }
-  const worker = normalizedRow(roleRow(db, "worker"), "worker");
-  if (worker && !worker.inherit) return worker;
+  const direct = normalizedRow(roleRow(db, role), role);
+  if (role === "multimodal") return direct;
+  if (direct && !direct.inherit) return direct;
   const orchestrator = resolvedModelRole(db, "orchestrator");
   if (!orchestrator) return null;
   return {
     ...orchestrator,
     role: "worker",
     inherit: true,
-    updatedAt: worker?.updatedAt || orchestrator.updatedAt,
+    updatedAt: direct?.updatedAt || orchestrator.updatedAt,
     sourceLayer:
-      worker?.sourceLayer === "model-role"
+      direct?.sourceLayer === "model-role"
         ? "model-role-inherit"
         : "active-runtime-inherit",
   };