agentlas 1.0.65 → 1.0.67

package/engine/sessions/fences.cjs

@@ -32,42 +32,93 @@ const AUTOMATION_HEADING = "## Automation";
 const ASK_OPEN = "<<agentlas-ask>>";
 const ASK_CLOSE = "<</agentlas-ask>>";
 
+// Fence payloads are model-authored input. Keep parsing and downstream
+// side-effect loops bounded; oversized entries are refused, not truncated.
+const MAX_FENCE_JSON_BYTES = 256 * 1024;
+const MAX_DELEGATIONS = 64;
+const MAX_AUTOMATIONS = 64;
+const MAX_ASKS = 32;
+const MAX_STEPS = 32;
+const MAX_DELEGATE_ENTRY_BYTES = 16 * 1024;
+const MAX_AUTOMATION_ENTRY_BYTES = 32 * 1024;
+const MAX_STEPS_BYTES = 64 * 1024;
+const MAX_TARGET_BYTES = 256;
+const MAX_BRIEF_BYTES = 8 * 1024;
+const MAX_NAME_BYTES = 256;
+const MAX_PROMPT_BYTES = 16 * 1024;
+const MAX_AGENT_BYTES = 256;
+const MAX_SCHEDULE_BYTES = 512;
+const MAX_ASK_BODY_BYTES = 64 * 1024;
+
+function utf8Bytes(value) {
+  return Buffer.byteLength(String(value || ""), "utf8");
+}
+
+function boundedString(value, maxBytes) {
+  if (typeof value !== "string") return "";
+  const trimmed = value.trim();
+  return utf8Bytes(trimmed) <= maxBytes ? trimmed : null;
+}
+
+function jsonBytes(value) {
+  try { return utf8Bytes(JSON.stringify(value)); } catch { return Infinity; }
+}
+
 /* ── ## Delegate (delegate.ts parseDelegations 포팅) ─────────────────────── */
 
 function parseDelegateBlock(text) {
   const idx = text.lastIndexOf(DELEGATE_HEADING);
-  if (idx < 0) return { delegations: [], synthesisAllocation: null, cleanedText: text.trim() };
+  if (idx < 0) return { delegations: [], synthesisAllocation: null, cleanedText: text.trim(), errors: [] };
 
   const after = text.slice(idx + DELEGATE_HEADING.length);
   const fence = after.match(/```(?:json)?\s*([\s\S]*?)```/);
   let delegations = [];
   let synthesisAllocation = null;
+  const errors = [];
   if (fence) {
-    try {
-      const data = JSON.parse(fence[1].trim());
+    const jsonText = fence[1].trim();
+    if (utf8Bytes(jsonText) > MAX_FENCE_JSON_BYTES) {
+      errors.push("Delegate JSON exceeds " + MAX_FENCE_JSON_BYTES + " bytes");
+    } else try {
+      const data = JSON.parse(jsonText);
       const rawDelegations = Array.isArray(data)
         ? data
         : data && typeof data === "object" && Array.isArray(data.delegations)
           ? data.delegations
           : [];
-      if (!Array.isArray(data) && data && typeof data === "object" && data.synthesis) {
-        synthesisAllocation = workloadRouting.normalizeAllocation(data.synthesis, "synthesize");
+      if (rawDelegations.length > MAX_DELEGATIONS) {
+        errors.push("Delegate block exceeds maximum of " + MAX_DELEGATIONS + " entries");
+      } else {
+        if (!Array.isArray(data) && data && typeof data === "object" && data.synthesis) {
+          synthesisAllocation = workloadRouting.normalizeAllocation(data.synthesis, "synthesize");
+        }
+        delegations = rawDelegations
+          .map((d, index) => {
+            if (!d || typeof d !== "object" || Array.isArray(d)) return null;
+            if (jsonBytes(d) > MAX_DELEGATE_ENTRY_BYTES) {
+              errors.push("Delegate entry " + (index + 1) + " exceeds " + MAX_DELEGATE_ENTRY_BYTES + " bytes");
+              return null;
+            }
+            const target = boundedString(d.target, MAX_TARGET_BYTES);
+            const brief = boundedString(d.brief, MAX_BRIEF_BYTES);
+            if (target === null || brief === null) {
+              errors.push("Delegate entry " + (index + 1) + " contains an oversized string");
+              return null;
+            }
+            // Desktop 계약: target 만 필수. allocation 은 정규화 실패 시 null 로 남고
+            // (레거시 텍스트 위임과 동일) 실행 측이 현재 모델 폴백 영수증을 남긴다.
+            return target
+              ? { target, brief, allocation: workloadRouting.normalizeAllocation(d.allocation, "delegate") }
+              : null;
+          })
+          .filter(Boolean);
       }
-      delegations = rawDelegations
-        .map((d) => {
-          if (!d || typeof d !== "object") return null;
-          const target = typeof d.target === "string" ? d.target.trim() : "";
-          const brief = typeof d.brief === "string" ? d.brief.trim() : "";
-          // Desktop 계약: target 만 필수. allocation 은 정규화 실패 시 null 로 남고
-          // (레거시 텍스트 위임과 동일) 실행 측이 현재 모델 폴백 영수증을 남긴다.
-          return target
-            ? { target, brief, allocation: workloadRouting.normalizeAllocation(d.allocation, "delegate") }
-            : null;
-        })
-        .filter(Boolean);
     } catch {
       delegations = [];
+      errors.push("Delegate JSON parse failed");
     }
+  } else {
+    errors.push("Delegate heading present but no JSON fence found");
   }
 
   let cut = text.length;
@@ -77,7 +128,7 @@ function parseDelegateBlock(text) {
     cut = idx; // 펜스 없으면 dangling heading 도 제거 (Desktop 과 동일)
   }
   const cleanedText = (text.slice(0, idx) + text.slice(cut)).trim();
-  return { delegations, synthesisAllocation, cleanedText };
+  return { delegations, synthesisAllocation, cleanedText, errors };
 }
 
 /* ── ## Automation (automation-emitter.ts parseAutomations 포팅, 정직 거부판) ── */
@@ -182,28 +233,58 @@ function parseAutomationBlock(text) {
   let automations = [];
 
   if (fence) {
-    try {
-      const data = JSON.parse(fence[1].trim());
+    const jsonText = fence[1].trim();
+    if (utf8Bytes(jsonText) > MAX_FENCE_JSON_BYTES) {
+      errors.push("Automation JSON exceeds " + MAX_FENCE_JSON_BYTES + " bytes");
+    } else try {
+      const data = JSON.parse(jsonText);
       if (Array.isArray(data)) {
-        automations = data
-          .map((d) => {
+        if (data.length > MAX_AUTOMATIONS) {
+          errors.push("Automation block exceeds maximum of " + MAX_AUTOMATIONS + " entries");
+        } else {
+          automations = data
+          .map((d, index) => {
             if (!d || typeof d !== "object") {
               errors.push("Automation entry was not an object");
               return null;
             }
-            const name = typeof d.name === "string" ? d.name.trim() : "";
-            const prompt = typeof d.prompt === "string" ? d.prompt.trim() : "";
-            const agent = typeof d.agent === "string" ? d.agent.trim() : "";
-            const hubAgent = typeof d.hubAgent === "string" ? d.hubAgent.trim() : "";
+            if (jsonBytes(d) > MAX_AUTOMATION_ENTRY_BYTES) {
+              errors.push("Automation entry " + (index + 1) + " exceeds " + MAX_AUTOMATION_ENTRY_BYTES + " bytes");
+              return null;
+            }
+            const name = boundedString(d.name, MAX_NAME_BYTES);
+            const prompt = boundedString(d.prompt, MAX_PROMPT_BYTES);
+            const agent = boundedString(d.agent, MAX_AGENT_BYTES);
+            const hubAgent = boundedString(d.hubAgent, MAX_AGENT_BYTES);
+            if (name === null || prompt === null || agent === null || hubAgent === null) {
+              errors.push("Automation entry " + (index + 1) + " contains an oversized string");
+              return null;
+            }
             if (!name || !prompt) {
               errors.push(`Automation "${name || "(unnamed)"}" missing name/prompt`);
               return null;
             }
+            if (typeof d.schedule === "string" && utf8Bytes(d.schedule.trim()) > MAX_SCHEDULE_BYTES) {
+              errors.push("Automation " + name + " schedule exceeds " + MAX_SCHEDULE_BYTES + " bytes");
+              return null;
+            }
+            if (d.schedule && typeof d.schedule === "object" && jsonBytes(d.schedule) > MAX_SCHEDULE_BYTES) {
+              errors.push("Automation " + name + " schedule exceeds " + MAX_SCHEDULE_BYTES + " bytes");
+              return null;
+            }
             const resolved = resolveScheduleHonest(d.schedule, errors);
             if (!resolved) return null; // 정직 거부 — 스케줄 추측 금지
             // steps[] 는 wire 패리티로 보존만 한다. Desktop 은 stepsToGraph 로
             // 그래프를 합성하지만 터미널 데몬은 prompt_template 단일 실행이다 —
             // 그래프 합성을 위장하지 않는다(비합성은 apply 쪽 영수증에 표기).
+            if (Array.isArray(d.steps) && d.steps.length > MAX_STEPS) {
+              errors.push("Automation " + name + " exceeds maximum of " + MAX_STEPS + " steps");
+              return null;
+            }
+            if (Array.isArray(d.steps) && jsonBytes(d.steps) > MAX_STEPS_BYTES) {
+              errors.push("Automation " + name + " steps exceed " + MAX_STEPS_BYTES + " bytes");
+              return null;
+            }
             const steps = Array.isArray(d.steps) && d.steps.length
               ? d.steps.filter((s) => !!s && typeof s === "object")
               : undefined;
@@ -218,6 +299,7 @@ function parseAutomationBlock(text) {
             };
           })
           .filter(Boolean);
+        }
       } else {
         errors.push("Automation block was not a JSON array");
       }
@@ -241,6 +323,7 @@ function parseAutomationBlock(text) {
 /* ── <<agentlas-ask>> (renderer/lib/ask-question.ts extractQuestions 포팅) ── */
 
 function tryParseAsk(body) {
+  if (utf8Bytes(body) > MAX_ASK_BODY_BYTES) return null;
   // body 가 ```json 펜스로 감싸진 경우도 허용 (Desktop confirm/index.ts:77-80 동일)
   const stripped = body
     .replace(/^```(?:json)?\s*/i, "")
@@ -297,7 +380,7 @@ function extractAsks(text) {
       break;
     }
     const parsed = tryParseAsk(afterOpen.slice(0, close).trim());
-    if (parsed) asks.push(parsed);
+    if (parsed && asks.length < MAX_ASKS) asks.push(parsed);
     // 파싱 실패해도 닫힌 펜스는 본문에서 제거 — malformed JSON raw 를 사용자에게 노출하지 않는다.
     remaining = afterOpen.slice(close + ASK_CLOSE.length);
   }
@@ -328,6 +411,7 @@ function parseReplyFences(text) {
   // 2. Delegate
   const del = parseDelegateBlock(working);
   working = del.cleanedText;
+  errors.push(...(del.errors || []));
 
   // 3. Automation
   const auto = parseAutomationBlock(working);

package/engine/sessions/memory-turn.cjs

@@ -64,6 +64,52 @@ function curatorRuntimeEnv() {
   return env;
 }
 
+const OLLAMA_CURATOR_TIMEOUT_MS = 120_000;
+const OLLAMA_JUDGMENT_TIMEOUT_MS = 60_000;
+
+/**
+ * API-backed memory decisions run after the main Session turn, so Session's
+ * provider abort slot is no longer active. Keep this boundary self-contained:
+ * the race releases the turn even if a custom/fake fetch ignores AbortSignal,
+ * while the signal lets a real fetch stop immediately on timeout.
+ */
+async function runBoundedOllama(session, system, prompt, operation, timeoutMs) {
+  const limit = Number.isFinite(Number(timeoutMs)) && Number(timeoutMs) > 0
+    ? Number(timeoutMs)
+    : OLLAMA_JUDGMENT_TIMEOUT_MS;
+  const controller = new AbortController();
+  let timer = null;
+  let timedOut = false;
+  let timeoutError = null;
+  const call = Promise.resolve().then(() => capture.runApi(
+    "ollama",
+    session.runtime.model,
+    system,
+    prompt,
+    { signal: controller.signal },
+  ));
+  const deadline = new Promise((_, reject) => {
+    timer = setTimeout(() => {
+      timedOut = true;
+      timeoutError = new Error(`Ollama ${operation} timed out after ${limit}ms.`);
+      timeoutError.code = "AGENTLAS_MEMORY_JUDGMENT_TIMEOUT";
+      try { controller.abort(timeoutError); } catch { /* already aborted */ }
+      reject(timeoutError);
+    }, limit);
+  });
+  try {
+    return await Promise.race([call, deadline]);
+  } catch (error) {
+    if (timedOut) throw timeoutError;
+    throw error;
+  } finally {
+    if (timer) clearTimeout(timer);
+    if (!controller.signal.aborted) {
+      try { controller.abort(new Error(`Ollama ${operation} finished`)); } catch { /* already aborted */ }
+    }
+  }
+}
+
 function ensureGeminiNoToolsPolicy() {
   const dir = curatorRuntimeDir();
   const file = path.join(dir, "gemini-no-tools-policy.toml");
@@ -101,7 +147,7 @@ async function invokeCurator(session, payload, systemPrompt) {
     throw new Error("Memory Curator payload failed the pre-invocation privacy gate");
   }
   if (session.runtime.kind === "ollama") {
-    return capture.runApi("ollama", session.runtime.model, systemPrompt, serialized);
+    return runBoundedOllama(session, systemPrompt, serialized, "memory curator", OLLAMA_CURATOR_TIMEOUT_MS);
   }
   return capture.captureRuntime(session.runtime.kind, systemPrompt, serialized, {
     cwd: curatorRuntimeDir(),
@@ -146,7 +192,13 @@ async function resolveSessionTaskSignatures(session, prompt) {
   ].join("\n");
   let raw;
   if (session.runtime.kind === "ollama") {
-    raw = await capture.runApi("ollama", session.runtime.model, system, String(prompt || ""));
+    raw = await runBoundedOllama(
+      session,
+      system,
+      String(prompt || ""),
+      "task judgment",
+      OLLAMA_JUDGMENT_TIMEOUT_MS,
+    );
   } else {
     raw = await capture.captureRuntime(session.runtime.kind, system, String(prompt || ""), {
       cwd: curatorRuntimeDir(),
@@ -183,7 +235,13 @@ async function judgeGlobalMemoryAuthorization(session, promptText) {
   ].join("\n");
   let raw;
   if (session.runtime.kind === "ollama") {
-    raw = await capture.runApi("ollama", session.runtime.model, system, String(promptText || ""));
+    raw = await runBoundedOllama(
+      session,
+      system,
+      String(promptText || ""),
+      "global-memory judgment",
+      OLLAMA_JUDGMENT_TIMEOUT_MS,
+    );
   } else {
     raw = await capture.captureRuntime(session.runtime.kind, system, String(promptText || ""), {
       cwd: curatorRuntimeDir(),
@@ -242,4 +300,5 @@ module.exports = {
   beginSessionMemoryTurn,
   completeSessionMemoryTurn,
   resolveSessionTaskSignatures,
+  runBoundedOllama,
 };

package/engine/sessions/orchestrator.cjs

@@ -84,7 +84,17 @@ class Orchestrator extends EventEmitter {
 
   runningCount() {
     let n = 0;
-    for (const s of this.sessions.values()) if (s.isBusy()) n += 1;
+    for (const s of this.sessions.values()) {
+      if (s.isBusy()) {
+        n += 1;
+        continue;
+      }
+      // kill() fences the session immediately, but native/API cancellation is
+      // asynchronous. Keep the slot occupied until Session has released its
+      // child or abort controller; otherwise a replacement turn can start
+      // while the killed provider is still consuming a process/slot.
+      if (s.status === "killed" && (s._child || s._apiAbort)) n += 1;
+    }
     return n;
   }
 

package/engine/sessions/prompt.cjs

@@ -31,6 +31,63 @@ const TERMINAL_MEMORY_CORE = [
 ].join("\n");
 const MEMORY_DETAIL_RE = /\b(?:remember|memory|save this|record this|memory event)\b|기억|메모리|저장해|기록해|남겨/i;
 const CREDENTIAL_INDEX_RE = /\b(?:deploy|release|billing|auth|oauth|credential|api key|secret key|cloud)\b|배포|릴리스|출시|결제|인증|자격 증명|API\s*키|시크릿|클라우드/i;
+const PROJECT_SOUL_MAX_CHARS = 1_800;
+const ONE_STATE_MAX_CHARS = 64 * 1024;
+
+function sameFileIdentity(left, right) {
+  return left && right && String(left.dev) === String(right.dev) && String(left.ino) === String(right.ino);
+}
+
+/**
+ * Read a small local prompt file through one descriptor. The lstat/fstat
+ * identity check detects a path swap between the check and open; O_NOFOLLOW
+ * rejects symlink aliases, and the second fstat detects a concurrent rewrite.
+ * The byte cap is deliberately larger than the character cap for UTF-8 while
+ * still bounding the amount retained before decoding and slicing.
+ */
+function readBoundedText(file, maxChars) {
+  const charLimit = Math.max(0, Number(maxChars) || 0);
+  const byteLimit = Math.max(1, charLimit * 4 + 4);
+  const expected = fs.lstatSync(file);
+  if (!expected.isFile() || expected.isSymbolicLink() || expected.nlink !== 1) {
+    throw new Error(`prompt file is not a single-link regular file: ${file}`);
+  }
+  const flags = fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW || 0);
+  let fd = null;
+  try {
+    fd = fs.openSync(file, flags);
+    const opened = fs.fstatSync(fd);
+    if (!opened.isFile() || opened.nlink !== 1 || !sameFileIdentity(expected, opened)) {
+      throw new Error(`prompt file identity changed before read: ${file}`);
+    }
+    const size = Number.isSafeInteger(Number(opened.size)) ? Number(opened.size) : byteLimit;
+    const readLimit = Math.min(size, byteLimit);
+    const data = Buffer.allocUnsafe(readLimit);
+    let offset = 0;
+    while (offset < readLimit) {
+      const count = fs.readSync(fd, data, offset, readLimit - offset, null);
+      if (!count) break;
+      offset += count;
+    }
+    const after = fs.fstatSync(fd);
+    const changed = !sameFileIdentity(opened, after)
+      || after.nlink !== 1
+      || Number(after.size) !== Number(opened.size)
+      || (after.mtimeNs != null && opened.mtimeNs != null
+        ? String(after.mtimeNs) !== String(opened.mtimeNs)
+        : after.mtimeMs !== opened.mtimeMs);
+    if (changed) throw new Error(`prompt file changed while reading: ${file}`);
+    const text = data.subarray(0, offset).toString("utf8");
+    return {
+      text: text.slice(0, charLimit),
+      truncated: offset < Number(opened.size) || text.length > charLimit,
+    };
+  } finally {
+    if (fd != null) {
+      try { fs.closeSync(fd); } catch { /* already closed */ }
+    }
+  }
+}
 
 function approximatePromptTokens(text) {
   return Math.ceil(Buffer.byteLength(String(text || ""), "utf8") / 3);
@@ -130,11 +187,10 @@ function cliMemoryContext(db, projectPath, agentId = null, task = "") {
   if (projectPath) {
     try {
       const soulPath = path.join(projectPath, arch.memoryDir || ".agentlas", arch.soulFile || "project-soul-memory.md");
-      if (fs.existsSync(soulPath)) {
-        let s = fs.readFileSync(soulPath, "utf8");
-        if (s.length > 1800) s = s.slice(0, 1800) + "\n…(truncated)";
-        if (s.trim()) sections.push(`### Project memory (${projectPath})\n${s.trim()}`);
-      }
+      const bounded = readBoundedText(soulPath, PROJECT_SOUL_MAX_CHARS);
+      let s = bounded.text;
+      if (bounded.truncated) s += "\n…(truncated)";
+      if (s.trim()) sections.push(`### Project memory (${projectPath})\n${s.trim()}`);
     } catch { /* ignore */ }
     const contextSlice = cliProjectContextSlice(projectPath, task);
     if (contextSlice) sections.push(contextSlice);
@@ -188,13 +244,13 @@ function loadOneDirective() {
   try {
     const root = process.env.AGENTLAS_ONE_DIR
       || require("node:path").join(require("node:os").homedir(), ".agentlas", "one");
-    const fs = require("node:fs");
     const path = require("node:path");
-    const state = JSON.parse(fs.readFileSync(path.join(root, "state.json"), "utf8"));
+    const state = JSON.parse(readBoundedText(path.join(root, "state.json"), ONE_STATE_MAX_CHARS).text);
     if (!state || state.on !== true) return "";
-    const text = fs.readFileSync(path.join(root, "directive.md"), "utf8").trim();
+    const bounded = readBoundedText(path.join(root, "directive.md"), ONE_DIRECTIVE_MAX_CHARS);
+    const text = bounded.text.trim();
     // 상한을 둔다 — 지시문이 남의 토큰 예산을 잠식하면 안 된다(메모리 예산과 같은 규칙).
-    return text.length > ONE_DIRECTIVE_MAX_CHARS ? text.slice(0, ONE_DIRECTIVE_MAX_CHARS) : text;
+    return text;
   } catch {
     return "";
   }
@@ -251,4 +307,5 @@ module.exports = {
   cliProjectContextSlice,
   augmentSystem,
   loadGlobalConnectionSkill,
+  readBoundedText,
 };

package/engine/sessions/session.cjs

@@ -15,12 +15,44 @@ const nativeHost = require("../agentlas-native-host.cjs");
 const permissions = require("../agentlas-permissions.cjs");
 const { RUNTIME_BIN, whichSync } = require("../runtimes/detect.cjs");
 const { CLI_EXECUTABLE_KINDS } = require("../runtimes/resolve.cjs");
+const ACP_RUNTIME_KINDS = new Set(require("../runtimes/kinds.cjs").ACP_CLI_KINDS);
 const { roleMembers } = require("../runtimes/roles.cjs");
 const { EventSink } = require("./sink.cjs");
 const store = require("./store.cjs");
 const memoryTurn = require("./memory-turn.cjs");
 
 const RING_LIMIT = 2000;
+const RING_BYTE_LIMIT = 8 * 1024 * 1024;
+
+function eventBytes(event) {
+  try { return Buffer.byteLength(JSON.stringify(event), "utf8"); }
+  catch { return 1024; }
+}
+
+/**
+ * Provider resume ids belong to the model that created them. Effort and other
+ * per-turn controls can safely change on the same thread, but a model switch
+ * must start a fresh provider session and let Agentlas history preserve the
+ * visible conversation. Otherwise the CLI receives `--model new` together
+ * with `--resume old-session` and the dashboard selection is not authoritative.
+ */
+function runtimeSessionFingerprint(runtime, agent, permission) {
+  const digest = crypto.createHash("sha256")
+    .update("agentlas-terminal-runtime-session.v2\0")
+    .update(String((runtime && runtime.kind) || ""))
+    .update("\0model\0")
+    .update(String((runtime && runtime.model) || ""))
+    .update("\0agent\0")
+    .update(String((agent && agent.id) || ""))
+    .update("\0prompt\0")
+    .update(String((agent && agent.systemPrompt) || ""));
+  // ACP chooses its session mode at session/new. Unlike native Codex/Claude
+  // flags, a later turn cannot safely retrofit that mode onto an old id.
+  if (ACP_RUNTIME_KINDS.has(runtime && runtime.kind)) {
+    digest.update("\0permission\0").update(permissions.normalize(permission));
+  }
+  return digest.digest("hex");
+}
 
 class Session extends EventEmitter {
   /**
@@ -48,6 +80,7 @@ class Session extends EventEmitter {
     this.queue = [];
     this._child = null;
     this._events = [];
+    this._eventBytes = 0;
     this._turnPromise = null;
     // 계약 테스트용 spawn 주입(runNativeTurn의 req.spawn). 프로덕션 경로에선 null.
     this._spawnImpl = opts.spawnImpl || null;
@@ -73,9 +106,7 @@ class Session extends EventEmitter {
       } catch { /* kind 열이 없는 구형 DB — user 취급(레거시 NULL=user 계약) */ }
     }
 
-    this.fingerprint = crypto.createHash("sha256")
-      .update(`${this.runtime.kind}\n${this.agent.id}\n${this.agent.systemPrompt || ""}`)
-      .digest("hex");
+    this.fingerprint = runtimeSessionFingerprint(this.runtime, this.agent, this.permission);
     this.runtimeSession = store.loadRuntimeSession(this.db, this.chatId, this.runtime.kind, this.fingerprint, this.agent.id);
 
     this._sink = new EventSink({
@@ -91,7 +122,11 @@ class Session extends EventEmitter {
 
   _record(ev) {
     this._events.push(ev);
-    if (this._events.length > RING_LIMIT) this._events.splice(0, this._events.length - RING_LIMIT);
+    this._eventBytes += eventBytes(ev);
+    while (this._events.length > RING_LIMIT || this._eventBytes > RING_BYTE_LIMIT) {
+      const removed = this._events.shift();
+      this._eventBytes = Math.max(0, this._eventBytes - eventBytes(removed));
+    }
     if (ev.type === "stream-delta") {
       const tail = (this.lastLine + ev.text).split(/\r?\n/).filter((l) => l.trim());
       this.lastLine = tail.length ? tail[tail.length - 1].slice(0, 200) : this.lastLine;
@@ -154,6 +189,10 @@ class Session extends EventEmitter {
   }
 
   _nextRecoveryRuntime() {
+    // Per-automation exact pins are authoritative. A provider/model failure is
+    // surfaced to the run receipt; it must never jump into a Dashboard role
+    // pool and make the unattended run use a different provider.
+    if (this.runtime.pinAuthoritative) return null;
     const role = this.runtime.role === "worker" ? "worker" : "orchestrator";
     const members = roleMembers(this.db, role);
     const current = members.findIndex((member) =>
@@ -178,6 +217,10 @@ class Session extends EventEmitter {
   }
 
   async _runTurn(prompt) {
+    const runtimeSessionAtTurnStart = {
+      kind: this.runtime.kind,
+      id: this.runtimeSession && this.runtimeSession.id ? String(this.runtimeSession.id) : "",
+    };
     this.status = "running";
     this.startedAt = Date.now();
     this.lastError = null;
@@ -304,6 +347,7 @@ class Session extends EventEmitter {
       if (turnAbort) req.signal = turnAbort.signal;
       if (this._spawnImpl) req.spawn = this._spawnImpl;
       if (this._timeoutConfig) req.timeoutConfig = this._timeoutConfig;
+      let recoveryAbort = null;
       try {
         res = await nativeHost.runNativeTurn(req);
         /*
@@ -312,16 +356,21 @@ class Session extends EventEmitter {
          * 그래서 `!res.text`가 영원히 거짓이 되어, 예비 런타임이 등록돼 있는데도
          * 복구가 한 번도 발화하지 않았다. 실패는 error가 말하고, text는 표시용이다.
          */
-        if (res && res.error) {
+        // A user kill is terminal. The killed child normally unwinds with an
+        // error marker; treating that marker as provider failure would launch
+        // the next priority model after the user explicitly pressed stop.
+        if (res && res.error && this.status !== "killed") {
           const nextRuntime = this._nextRecoveryRuntime();
           if (nextRuntime) {
             const privateEvidence = [...this._privateRecoveryEvidence, String(res.error)]
               .filter(Boolean).join("\n").slice(0, 12000);
             this.runtime = nextRuntime;
             this.runtimeSession = {};
-            this.fingerprint = crypto.createHash("sha256")
-              .update(`${nextRuntime.kind}\n${this.agent.id}\n${this.agent.systemPrompt || ""}`)
-              .digest("hex");
+            this.fingerprint = runtimeSessionFingerprint(nextRuntime, this.agent, this.permission);
+            if (ACP_RUNTIME_KINDS.has(nextRuntime.kind)) {
+              recoveryAbort = new AbortController();
+              this._apiAbort = recoveryAbort;
+            }
             res = await nativeHost.runNativeTurn({
               ...req,
               kind: nextRuntime.kind,
@@ -329,6 +378,8 @@ class Session extends EventEmitter {
               model: nextRuntime.model,
               effort: nextRuntime.effort,
               session: {},
+              sessionFingerprintSeed: this.fingerprint,
+              ...(recoveryAbort ? { signal: recoveryAbort.signal } : {}),
               prompt: [
                 prompt,
                 "",
@@ -342,6 +393,7 @@ class Session extends EventEmitter {
       } catch (e) {
         res = { text: "", session: req.session, error: (e && e.message) || String(e) };
       } finally {
+        if (recoveryAbort && this._apiAbort === recoveryAbort) this._apiAbort = null;
         if (turnAbort && this._apiAbort === turnAbort) this._apiAbort = null;
       }
     }
@@ -396,7 +448,15 @@ class Session extends EventEmitter {
     if (persistText) store.appendMessage(this.db, this.chatId, "assistant", persistText);
     if (res && res.session && res.session.id) {
       this.runtimeSession = { id: res.session.id };
-      store.saveRuntimeSession(this.db, this.chatId, this.runtime.kind, this.runtimeSession, this.fingerprint, this.agent.id);
+      store.saveRuntimeSession(
+        this.db,
+        this.chatId,
+        this.runtime.kind,
+        this.runtimeSession,
+        this.fingerprint,
+        this.agent.id,
+        runtimeSessionAtTurnStart.kind === this.runtime.kind ? runtimeSessionAtTurnStart.id : "",
+      );
     }
     if (res && res.usage) this.usage = res.usage;
 
@@ -495,4 +555,4 @@ class Session extends EventEmitter {
   }
 }
 
-module.exports = { Session };
+module.exports = { Session, runtimeSessionFingerprint };