zigmini 0.8.0-beta.7 → 0.9.0-beta.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zigmini",
-  "version": "0.8.0-beta.7",
+  "version": "0.9.0-beta.1",
   "type": "module",
   "bin": {
     "zigmini": "bin/zigmini"

package/src/decisions.ts

@@ -1,6 +1,7 @@
 import { isDeepStrictEqual } from "node:util";
 import { decisionContext } from "./decision-context.ts";
 import { SecurityCheckError, type MessageGuard } from "./security-check.ts";
+import { securityDecision, SecurityRuntimeError } from "./security-allow.ts";
 import type { OmoEvent } from "./omo/client.ts";
 import type { ActionAnswerData, DecisionAnswerRequest, DecisionInfo, DecisionsPageData, DecisionUpdatedData } from "./protocol.ts";
 import { blockedMainQuestion, blockedQuestion, DecisionStoreError, RESUMABLE_CLOSED, Store, type Decision, type DecisionMethod, type DecisionSubmission, type StoredEvent } from "./store.ts";
@@ -163,6 +164,10 @@ export class DecisionService {
 	}
 
 	info(decision: Decision): DecisionInfo {
+		if (securityDecision(decision)) {
+			const security = this.store.securityHold(decision.id)?.state;
+			return { ...decision, work: null, allowedActions: [], ...(security ? { security } : {}) };
+		}
 		const work = decision.workId === null ? null : this.store.getWork(decision.workId);
 		let allowedActions: DecisionInfo["allowedActions"] = [];
 		if (unresolved(decision) && !["completed", "failed", "cancelled"].includes(work?.status ?? "") &&
@@ -200,12 +205,17 @@ export class DecisionService {
 	}
 
 	answer(id: string, input: unknown, checked = false): DecisionInfo {
+		const original = this.store.getDecision(id);
+		if (original && securityDecision(original)) throw new DecisionStoreError("security_endpoint_required");
 		const request = parseDecisionAnswer(input);
 		if (!checked) {
 			const owner = this.store.getDecision(id)?.ownerConv ?? "main";
-			this.options.guard?.holdOrPass(owner, "answer", answerTexts(request), async () => {
-				this.answer(id, input, true);
-			});
+			const snapshot = structuredClone(request);
+			this.options.guard?.holdOrPass(owner, "answer", answerTexts(request), async (receipt) => {
+				receipt({ kind: "answer", decisionId: id, submissionId: snapshot.submissionId });
+				this.answer(id, snapshot, true);
+			}, { key: JSON.stringify(["answer", id, request.submissionId]), snapshot,
+				originalDecisionId: id, submissionId: request.submissionId });
 		}
 		this.refresh();
 		const before = this.required(id);
@@ -228,15 +238,15 @@ export class DecisionService {
 			try {
 				if (!this.ports.sendLive(decision)) this.review(id, "receipt_unknown");
 			} catch (error) {
-				this.error(error);
+				this.error(checked ? new SecurityRuntimeError("dispatch_unknown") : error);
 				this.review(id, "receipt_unknown");
 			}
 		} else if (operation?.data.mainInputSeq !== null && operation?.data.mainInputSeq !== undefined) {
 			const inputEvent = this.store.getEvent(operation.data.mainInputSeq);
 			if (!inputEvent) throw new Error("decision_main_intent_missing");
-			this.dispatch(id, () => this.ports.dispatchMain(inputEvent));
+			this.dispatch(id, () => this.ports.dispatchMain(inputEvent), checked);
 		} else if (operation?.data.commandId && decision.workId) {
-			this.dispatch(id, () => this.ports.dispatchWork(decision.workId!));
+			this.dispatch(id, () => this.ports.dispatchWork(decision.workId!), checked);
 		}
 		this.refresh();
 		return this.info(this.required(id));
@@ -247,6 +257,7 @@ export class DecisionService {
 	 * 취소 button; a later answer to the closed decision is rejected as a conflict.
 	 */
 	dismiss(id: string, input: unknown): DecisionInfo {
+		if (securityDecision(this.required(id))) throw new DecisionStoreError("security_endpoint_required");
 		const expectedRevision = parseDecisionDismiss(input);
 		this.refresh();
 		let dismissal;
@@ -274,9 +285,9 @@ export class DecisionService {
 		return this.info(this.required(id));
 	}
 
-	private dispatch(id: string, send: () => Promise<void>): void {
+	private dispatch(id: string, send: () => Promise<void>, protectedPayload = false): void {
 		void send().catch((error: unknown) => {
-			this.error(error);
+			this.error(protectedPayload ? new SecurityRuntimeError("dispatch_unknown") : error);
 			if (!this.stopped) this.review(id, "receipt_unknown");
 		}).finally(() => {
 			if (!this.stopped) this.refresh();
@@ -523,6 +534,7 @@ export class DecisionService {
 			this.store.reconcileDecisionReceipts();
 			const now = Date.now();
 			for (let decision of this.store.allDecisions()) {
+				if (securityDecision(decision)) continue;
 				if (!unresolved(decision)) continue;
 				const context = this.store.decisionContextReason(decision);
 				if (context === "work_failed" || context === "work_cancelled") {
@@ -550,16 +562,18 @@ export class DecisionService {
 				}
 			}
 			for (const decision of this.store.allDecisions()) {
+				if (securityDecision(decision)) continue;
 				if (decision.method === "question" && decision.status === "pending" && decision.bindingState === "live") {
 					this.store.reconcileReissuedQuestion(decision.id, this.ports.liveBinding(decision));
 				}
 			}
+			this.store.notifySecurityReceipts();
 			const all = this.store.allDecisions();
 			for (const decision of all) {
 				const previous = this.known.get(decision.id);
 				this.known.set(decision.id, decision);
 				if (!previous || previous.revision < decision.revision) {
-					if (previous && previous.status !== decision.status && !unresolved(decision)) {
+					if (!securityDecision(decision) && previous && previous.status !== decision.status && !unresolved(decision)) {
 						const answer = record(decision.answer) ? decision.answer : {};
 						const kind = decision.method === "question" ? "question" : decision.method === "confirm" ? "confirm" : "value";
 						const dismissed = decision.status === "closed" ? DISMISSED_REASONS[decision.reason ?? ""] : undefined;
@@ -580,7 +594,7 @@ export class DecisionService {
 				}
 				const times: number[] = [];
 				if (unresolved(decision) && decision.bindingState === "live" && decision.deadlineAt !== null) times.push(decision.deadlineAt);
-				if (decision.status === "submitted") {
+				if (!securityDecision(decision) && decision.status === "submitted") {
 					const operation = this.store.latestDecisionOperation(decision.id);
 					times.push(Date.parse(operation?.ts ?? decision.updatedAt) + this.receiptMs);
 				}
@@ -626,7 +640,7 @@ export class DecisionService {
 			}
 			if (!route[2] && req.method === "GET") {
 				const decision = this.required(id);
-				if (unresolved(decision)) {
+				if (!securityDecision(decision) && unresolved(decision)) {
 					let timer: ReturnType<typeof setTimeout> | undefined;
 					try {
 						await Promise.race([
@@ -647,12 +661,17 @@ export class DecisionService {
 			return Response.json({ error: "method_not_allowed" }, { status: 405 });
 		} catch (error) {
 			if (error instanceof SecurityCheckError) {
-				return Response.json({ error: error.code, message: error.message, held: error.held }, { status: 422 });
+				return Response.json({ error: error.code, message: error.message, held: error.held }, { status: 422, headers: { "Cache-Control": "no-store" } });
+			}
+			if (error instanceof SecurityRuntimeError) {
+				return Response.json({ error: error.code, ...(error.held ? { held: error.held } : {}) }, {
+					status: error.code === "held_conflict" ? 409 : 503, headers: { "Cache-Control": "no-store" },
+				});
 			}
 			if (error instanceof DecisionStoreError) {
 				return Response.json({
 					error: error.code, decision: error.decision ? this.info(error.decision) : null,
-				}, { status: error.code === "decision_not_found" ? 404 : error.code.startsWith("invalid_") ? 400 : 409 });
+				}, { status: error.code === "decision_not_found" ? 404 : error.code === "security_endpoint_required" || error.code.startsWith("invalid_") ? 400 : 409 });
 			}
 			if (error instanceof URIError) return Response.json({ error: "invalid_decision" }, { status: 400 });
 			this.error(error);

package/src/engine/compat.json

@@ -1,6 +1,6 @@
 {
-  "omo": "5.1.35",
-  "senpi": "2026.10.16",
+  "omo": "5.1.44",
+  "senpi": "2026.10.21-3",
   "threadSchema": 7,
-  "verifiedAt": "2026-10-19"
+  "verifiedAt": "2026-10-23"
 }

package/src/hub.ts

@@ -14,7 +14,9 @@ import { isUsageCommand, USAGE_COMMAND } from "./usage.ts";
 import { MessageReferenceError, referencedInput, resolveMessageReferences } from "./message-references.ts";
 import { readProfile } from "./profile.ts";
 import type { MessageGuard } from "./security-check.ts";
+import { SecurityRuntimeError, type SecurityReceipt } from "./security-allow.ts";
 import { nativeReplyEntry, type NativeReplyObserver } from "./reply-notifications.ts";
+import { notificationHistory } from "./notification-history.ts";
 import { messageTimestamp, nativeTurnStarted, nativeTurnStats } from "./turn-stats.ts";
 
 export type Broadcast = (envelope: Envelope) => void;
@@ -64,7 +66,7 @@ export interface HubOptions {
 	/** Answers `/usage` (model account usage) as a notice; the command never reaches omo. */
 	usageReport?: () => Promise<string>;
 	/** Improvement 165: the security check of user text; a finding keeps the text from omo and the store. */
-	guard?: Pick<MessageGuard, "check" | "hold">;
+	guard?: Pick<MessageGuard, "check" | "hold" | "existing">;
 }
 
 /** Anthropic rejects images over 5 MB; bigger attachments reach the agent as a file path only. */
@@ -371,13 +373,16 @@ export class Hub {
 	async notificationBaseline(): Promise<void> {
 		for (const conv of this.store.listConversations()) {
 			if (!conv.threadId) continue;
-			const { sessionId } = await this.ensureSession(conv);
+			const sessionPath = conv.threadId;
 			const generation = this.generation;
 			const revision = this.options.replies?.revision();
-			const result = await this.requireOmo().command<EntriesResult>("get_entries", { sessionId });
-			if (generation !== this.generation || this.omoStatus !== "ready" || this.rt(conv.id).sessionId !== sessionId ||
-				this.store.getConversation(conv.id)?.threadId !== conv.threadId) throw new Error("reply_baseline_discarded");
-			if (revision !== undefined) this.options.replies?.observe({ sessionPath: conv.threadId, conv: conv.id, title: conv.title }, result.entries, revision);
+			const current = () => generation === this.generation &&
+				this.store.getConversation(conv.id)?.threadId === conv.threadId;
+			await notificationHistory(conv.threadId, (entry) => {
+				if (!current()) throw new Error("reply_baseline_discarded");
+				if (revision !== undefined) this.options.replies?.observe({ sessionPath, conv: conv.id, title: conv.title }, [entry], revision);
+			}, true);
+			if (!current()) throw new Error("reply_baseline_discarded");
 		}
 	}
 
@@ -799,8 +804,16 @@ export class Hub {
 				else if (this.openQuestionCards(conv.id, this.conversationScope(conv.id)).size > 0) await this.ensureSession(current);
 				else if (this.store.unreportedWorkUpdates(conv.id).length > 0 || this.workSummary(conv.id).length > 0) await this.ensureSession(current);
 				if (this.options.replies?.settings().mode === "all-replies" && current.threadId) {
-					await this.ensureSession(this.store.getConversation(conv.id) ?? current);
-					await this.syncLedger(conv.id);
+					if (this.rt(conv.id).sessionId) await this.syncLedger(conv.id);
+					else {
+						const sessionPath = current.threadId;
+						const revision = this.options.replies.revision();
+						await notificationHistory(sessionPath, (entry) => {
+							if (generation !== this.generation || this.omoStatus !== "ready" ||
+								this.store.getConversation(conv.id)?.threadId !== sessionPath) throw new Error("reply_history_discarded");
+							this.options.replies?.observe({ sessionPath, conv: conv.id, title: current.title }, [entry], revision);
+						});
+					}
 				}
 				// Opening main comes first. A notification ACK or worker reconciliation cannot hold readiness.
 				void this.notifyWorkUpdates(conv.id);
@@ -815,12 +828,17 @@ export class Hub {
 	}
 
 	/** `images` are names of files already uploaded to the media folder; unknown names are dropped. */
-	async sendText(convId: string, text: string, src: Source, trust: Trust, images: string[] = [], referenceIds?: unknown, checked = false): Promise<void> {
+	async sendText(convId: string, text: string, src: Source, trust: Trust, images: string[] = [], referenceIds?: unknown, checked = false, submissionId?: string): Promise<void> {
 		if (this.maintenanceId) throw new MaintenanceError("maintenance_held");
+		if (submissionId !== undefined && !/^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i.test(submissionId)) throw new SecurityRuntimeError("held_conflict");
+		const context = { ...(submissionId ? { key: JSON.stringify(["message", convId, submissionId]), submissionId } : {}),
+			snapshot: structuredClone({ text, src, trust, images, referenceIds }) };
+		if (this.options.guard?.existing(context)) return;
 		const conv = this.store.getConversation(convId);
 		if (!conv) throw new Error(`unknown_conversation:${convId}`);
 		const body = text.trim();
-		const references = resolveMessageReferences(this.store, convId, referenceIds);
+		const source = structuredClone(src);
+		const references = structuredClone(resolveMessageReferences(this.store, convId, referenceIds));
 		if (this.options.versionReport && images.length === 0 && references.length === 0 && isVersionCommand(body)) {
 			this.emit(convId, "notice", { kind: "version", level: "info", message: await this.options.versionReport() });
 			return;
@@ -837,29 +855,36 @@ export class Hub {
 			throw new MessageReferenceError("message_reference_images_unavailable");
 		}
 		if (!body && attached.length === 0 && references.length === 0) return;
-		// Improvement 165: a finding holds the message in gateway memory. The guard sends the card with the values to the
-		// user's screens only (never stored, never in a prompt); the user's "send" runs this call again with checked.
+		const attachmentSnapshot = this.attachments(prompt.images);
+		const send = async (receipt?: (ref: SecurityReceipt) => void) => {
+			if (receipt && prompt.images.some((name) => !dir || !mediaFile(dir, name))) throw new SecurityRuntimeError("dispatch_failed");
+			const input = this.store.acceptMainUser(convId, {
+				text: body, src: source, trust, ...(attached.length ? { images: attached } : {}),
+				...(references.length ? { references } : {}),
+			}, receipt);
+			this.publishStored(input);
+			this.decisions?.refresh();
+			const rotationDone = this.rt(convId).rotationDone;
+			if (rotationDone) await rotationDone;
+			if (this.closeUncertain(convId)) {
+				if (this.closeRecoveries.get(convId)?.exhausted) {
+					if (receipt) throw new SecurityRuntimeError("dispatch_unknown");
+					throw new Error("session_close_recovery_exhausted");
+				}
+				this.scheduleCloseRecovery(convId);
+				this.emit(convId, "notice", { kind: "session-close-recovery", level: "info",
+					message: "세션 닫기 상태를 확인하고 있습니다. 메시지는 확인 후 전달합니다." });
+				return;
+			}
+			await this.prompt(convId, prompt.text, prompt.images, input.seq, true, attachmentSnapshot, receipt !== undefined);
+		};
+		// The approved closure owns the inspected references, body and image bytes. Never re-resolve reference ids.
 		const found = checked ? null : this.options.guard?.check([prompt.text]);
 		if (found) {
-			this.options.guard!.hold(convId, "message", found, () => this.sendText(convId, text, src, trust, images, referenceIds, true), body);
-			return;
-		}
-		const input = this.store.acceptMainUser(convId, {
-			text: body, src, trust, ...(attached.length ? { images: attached } : {}),
-			...(references.length ? { references } : {}),
-		});
-		this.publishStored(input);
-		this.decisions?.refresh();
-		const rotationDone = this.rt(convId).rotationDone;
-		if (rotationDone) await rotationDone;
-		if (this.closeUncertain(convId)) {
-			if (this.closeRecoveries.get(convId)?.exhausted) throw new Error("session_close_recovery_exhausted");
-			this.scheduleCloseRecovery(convId);
-			this.emit(convId, "notice", { kind: "session-close-recovery", level: "info",
-				message: "세션 닫기 상태를 확인하고 있습니다. 메시지는 확인 후 전달합니다." });
+			this.options.guard!.hold(convId, "message", found, send, body, context);
 			return;
 		}
-		await this.prompt(convId, prompt.text, prompt.images, input.seq, true);
+		await send();
 	}
 
 	/** Reserve gateway report admission before its HTTP body is parsed. The source
@@ -1604,7 +1629,7 @@ export class Hub {
 	}
 
 	/** Sends input once. Native same-session compaction owns overflow recovery, never gateway replay. */
-	private async prompt(convId: string, body: string, images: string[] = [], messageSeq?: number, admitted = false): Promise<void> {
+	private async prompt(convId: string, body: string, images: string[] = [], messageSeq?: number, admitted = false, attachmentSnapshot?: ReturnType<Hub["attachments"]>, protectedPayload = false): Promise<void> {
 		const conv = this.store.getConversation(convId);
 		if (!conv) return;
 		const rt = this.rt(convId);
@@ -1622,7 +1647,7 @@ export class Hub {
 			if (generation !== this.generation || this.omoStatus !== "ready" || rt.sessionId !== sessionId) return;
 			if (admitted && this.store.mainUserDispatched(convId, reference)) return;
 			const handoff = nativeCommand ? null : this.store.getSessionMeta(convId).handoff;
-			const attached = this.attachments(images);
+			const attached = attachmentSnapshot ?? this.attachments(images);
 			const text = [body, attached.note].filter(Boolean).join("\n\n");
 			const context = handoff ? `${handoff}\n\nZGW_WORK_STATE ${JSON.stringify(this.workSummary(convId))}` : null;
 			const inputId = crypto.randomUUID();
@@ -1652,6 +1677,7 @@ export class Hub {
 			this.decisions?.refresh();
 		} catch (error) {
 			if (generation !== this.generation || this.omoStatus !== "ready") return;
+			if (protectedPayload) throw new SecurityRuntimeError("dispatch_unknown");
 			const message = errorMessage(error);
 			this.emit(convId, "error", this.continuityError(message));
 		}

package/src/main.ts

@@ -4,7 +4,7 @@ import { join, normalize } from "node:path";
 import type { Server, ServerWebSocket, WebSocketHandler } from "bun";
 import { createSttProvider } from "./adapters/voice/stt.ts";
 import { createTtsProvider, speakableText, splitForTts } from "./adapters/voice/tts.ts";
-import { handleHeld, handleSecurityCheckSetting, MessageGuard, SECURITY_CHECK_PATH, SECURITY_HELD_PATH, SecurityCheckError, defaultChecker } from "./security-check.ts";
+import { handleHeld, handleSecurityAllowedValues, handleSecurityCheckSetting, MessageGuard, SECURITY_CHECK_PATH, SECURITY_HELD_PATH, SECURITY_ALLOWED_PATH, SecurityCheckError, defaultChecker } from "./security-check.ts";
 import { handleVoiceInstall, handleVoiceSetting, routeVoiceApi, VOICE_INSTALL_PATH, VOICE_SETTING_PATH, voiceGate, voiceUpdated } from "./voice-api.ts";
 import { readVoiceSetting, VoiceSetting } from "./voice-setting.ts";
 import { applyVoiceAgents } from "./voice/agents.ts";
@@ -150,9 +150,17 @@ let publish: (envelope: Envelope) => void = () => {};
 const replyNotifications = new ReplyNotifications<ServerWebSocket<Conn>>(store, (ws, notification) => {
 	if (ws.data.deviceId && store.getDevice(ws.data.deviceId)?.status === "approved") ws.send(envelope("reply.notification", notification, notification.conv));
 });
+let securityDecisionRefresh = () => {};
+const securityEvent = (type: string, data: unknown) => publish({
+	v: PROTOCOL_VERSION, id: crypto.randomUUID(), ts: new Date().toISOString(), conv: "*", type, data,
+});
 const messageGuard = new MessageGuard(defaultChecker(), runtimePaths().securityCheckFile, (held) => publish({
 	v: PROTOCOL_VERSION, id: crypto.randomUUID(), ts: new Date().toISOString(), conv: held.conv, type: "security-check.held", data: held,
-}));
+}), { store, state: (state) => {
+	securityEvent("security-check.state", state);
+	if (state.status === "sent" || state.status === "cancelled") securityEvent("security-check.resolved", { id: state.id, outcome: state.status === "sent" ? "sent" : "dropped" });
+}, allowedUpdated: (revision) => securityEvent("security-check.allowed-values.updated", { revision }),
+	decisionUpdated: () => securityDecisionRefresh() });
 const hub = new Hub(
 	store,
 	dialogs,
@@ -321,6 +329,7 @@ const decisions = new DecisionService(store, {
 	v: PROTOCOL_VERSION, id: crypto.randomUUID(), ts: new Date().toISOString(),
 	conv: data.decision.ownerConv, type: "decision.updated", data,
 }), { onHistory: (event) => hub.publishStored(event), guard: messageGuard });
+securityDecisionRefresh = () => decisions.refresh();
 hub.attachDecisions(decisions);
 const summarizer = new SpeechSummarizer(omo, {
 	sessionDir: config.omoSessionDir,
@@ -476,6 +485,8 @@ async function handleClient(ws: ServerWebSocket<Conn>, raw: string): Promise<voi
 					"owner",
 					Array.isArray(msg.data.images) ? msg.data.images.filter((n): n is string => typeof n === "string") : [],
 					msg.data.references,
+					false,
+					msg.data.submissionId,
 				),
 			);
 			return;
@@ -652,9 +663,11 @@ async function handle(req: Request, srv: Server<Conn>, trusted: boolean): Promis
 		if (response) return response;
 	}
 	if (url.pathname === SECURITY_HELD_PATH || url.pathname.startsWith(`${SECURITY_HELD_PATH}/`)) {
-		const response = await handleHeld(req, url, messageGuard, (id, outcome) => publish({
-			v: PROTOCOL_VERSION, id: crypto.randomUUID(), ts: new Date().toISOString(), conv: "*", type: "security-check.resolved", data: { id, outcome },
-		}));
+		const response = await handleHeld(req, url, messageGuard, () => {}, { client: trusted ? "web" : "android", deviceId });
+		if (response) return response;
+	}
+	if (url.pathname === SECURITY_ALLOWED_PATH || url.pathname.startsWith(`${SECURITY_ALLOWED_PATH}/`)) {
+		const response = await handleSecurityAllowedValues(req, url, store, (revision) => securityEvent("security-check.allowed-values.updated", { revision }));
 		if (response) return response;
 	}
 	if (url.pathname === SECURITY_CHECK_PATH) {
@@ -878,8 +891,9 @@ const lanServer = config.lanPort
 	: null;
 
 publish = (e) => {
-	if (!omoCheckNotifications.allow(e)) return;
-	questionNotifications.onEnvelope(e);
+	const sensitiveHeld = e.type === "security-check.held";
+	if (!sensitiveHeld && !omoCheckNotifications.allow(e)) return;
+	if (!sensitiveHeld) questionNotifications.onEnvelope(e);
 	const text = JSON.stringify(e);
 	const topic = topicOf(e.type);
 	trustedServer.publish(topic, text);
@@ -926,6 +940,7 @@ function shutdown(): void {
 	updateChecker.stop();
 	clearInterval(updateTick);
 	decisions.stop();
+	messageGuard.stop();
 	watcher.stop();
 	work.stop();
 	omo.stop();

package/src/notification-history.ts

@@ -0,0 +1,56 @@
+import { open, stat } from "node:fs/promises";
+import { nativeReplyEntry, type NativeReplyEntry } from "./reply-notifications.ts";
+
+/**
+ * Read only the owned native JSONL, never the disposable resident blobs or an opened native session.
+ * The byte snapshot is finite; memory is bounded by a chunk plus the largest JSONL record, not the history.
+ */
+export async function notificationHistory(
+	path: string,
+	visit: (entry: NativeReplyEntry) => void,
+	baseline = false,
+): Promise<void> {
+	let file;
+	try { file = await open(path, "r"); }
+	catch (error) {
+		// Native buffers setup-only sessions until the first user/assistant message.
+		if (error instanceof Error && "code" in error && error.code === "ENOENT") return;
+		throw error;
+	}
+	try {
+		const snapshot = await file.stat();
+		const chunk = Buffer.alloc(64 * 1024);
+		const decoder = new TextDecoder("utf-8", { fatal: true });
+		let offset = 0;
+		let tail = "";
+		let header = false;
+		while (offset < snapshot.size) {
+			const { bytesRead } = await file.read(chunk, 0, Math.min(chunk.length, snapshot.size - offset), offset);
+			if (bytesRead === 0) throw new Error("reply_history_truncated");
+			offset += bytesRead;
+			tail += decoder.decode(chunk.subarray(0, bytesRead), { stream: true });
+			let newline: number;
+			while ((newline = tail.indexOf("\n")) !== -1) {
+				const line = tail.slice(0, newline);
+				tail = tail.slice(newline + 1);
+				const value: unknown = JSON.parse(line);
+				const entry = nativeReplyEntry(value);
+				if (!entry) throw new Error("reply_history_invalid_entry");
+				if (!header) {
+					if (entry.type !== "session") throw new Error("reply_history_invalid_header");
+					header = true;
+				} else {
+					if (entry.type === "session") throw new Error("reply_history_duplicate_header");
+					visit(baseline ? { id: entry.id, type: entry.type } : entry);
+				}
+			}
+		}
+		tail += decoder.decode();
+		if (!header || tail.length !== 0) throw new Error("reply_history_incomplete");
+		const current = await stat(path);
+		if (current.dev !== snapshot.dev || current.ino !== snapshot.ino || current.size < snapshot.size ||
+			(current.size === snapshot.size && current.mtimeMs !== snapshot.mtimeMs)) throw new Error("reply_history_replaced");
+	} finally {
+		await file.close();
+	}
+}

package/src/protocol.ts

@@ -85,6 +85,7 @@ export type DecisionAnswerRequest = { readonly expectedRevision: number; readonl
 
 /** HTTP/event DTOs are separate from storage records; payload retains the existing action-card structure. */
 export interface DecisionInfo {
+	readonly security?: import("./security-allow.ts").HeldState;
 	readonly id: string;
 	readonly revision: number;
 	readonly ownerConv: string;
@@ -151,7 +152,7 @@ export type ClientMessage =
 	| { type: "client.presence"; data: { visible: boolean } }
 	| { type: "history.get"; conv: string; before?: number; after?: number; limit?: number }
 	| { type: "conversation.create"; data: { title: string } }
-	| { type: "input.text"; conv: string; data: { text: string; images?: string[]; references?: number[] } }
+	| { type: "input.text"; conv: string; data: { text: string; images?: string[]; references?: number[]; submissionId?: string } }
 	| { type: "input.action"; conv: string; data: ActionAnswerData }
 	| { type: "input.interrupt"; conv: string; data: Record<string, never> }
 	| { type: "conversation.rotate"; conv: string }

package/src/security-allow.ts

@@ -0,0 +1,126 @@
+/** Runtime-only contract. Repository and release scanners never import this module. */
+export type HeldStatus = "pending" | "processing" | "sent" | "cancelled" | "failed" | "unconfirmed";
+export type SecurityErrorCode = "allowlist_persist_failed" | "state_persist_failed" | "payload_lost" | "dispatch_failed" | "dispatch_unknown" | "original_decision_conflict";
+export interface HeldState {
+	readonly id: string;
+	readonly decisionId: string;
+	readonly revision: number;
+	readonly conv: string;
+	readonly source: "message" | "answer";
+	readonly createdAt: string;
+	readonly originalDecisionId: string | null;
+	readonly status: HeldStatus;
+	readonly submissionId: string | null;
+	readonly remembered: boolean;
+	readonly allowlistRevision: number;
+	readonly errorCode: SecurityErrorCode | null;
+}
+export interface SecurityApprover {
+	readonly client: "web" | "android";
+	readonly deviceId: string | null;
+}
+export interface AllowedValue {
+	readonly id: string;
+	readonly value: string;
+	readonly kind: string;
+	readonly label: string;
+	readonly approvedAt: string;
+	readonly approvedBy: SecurityApprover;
+	readonly heldId: string;
+}
+export interface SecurityIntent {
+	readonly send: boolean;
+	readonly remember: boolean;
+	readonly expectedRevision: number | null;
+	readonly submissionId: string | null;
+}
+export type SecurityReceipt =
+	| { readonly kind: "message"; readonly conv: string; readonly messageSeq: number }
+	| { readonly kind: "answer"; readonly decisionId: string; readonly submissionId: string };
+export interface SecurityHoldRecord {
+	readonly state: HeldState;
+	readonly key: string | null;
+	readonly intent: SecurityIntent | null;
+	readonly dispatchReserved: boolean;
+	readonly receipt: SecurityReceipt | null;
+}
+export class SecurityRuntimeError extends Error {
+	constructor(
+		readonly code: "held_conflict" | "allowlist_conflict" | SecurityErrorCode,
+		readonly held?: HeldState,
+		readonly revision?: number,
+	) { super(code); }
+}
+export const securityDecision = (decision: { readonly payload: unknown }): boolean =>
+	typeof decision.payload === "object" && decision.payload !== null &&
+	"kind" in decision.payload && decision.payload.kind === "security-check";
+
+/** A delimiter is meaningful only if its matching quote can be proved. No decoding or normalization. */
+function quotedEnd(text: string, start: number, quote: string): number | null {
+	for (let i = start; i < text.length; i++) {
+		if (text[i] === "\\") { i++; continue; }
+		if (text[i] === quote) return i;
+	}
+	return null;
+}
+
+/** Expand an existing detector hit; this function never decides whether a hit exists. */
+export function canonicalSecurityValue(text: string, rule: string, start: number, end: number): string {
+	const lineStart = text.lastIndexOf("\n", start - 1) + 1;
+	const nextLine = text.indexOf("\n", end);
+	const lineEnd = nextLine < 0 ? text.length : nextLine;
+	// A PEM or SSH record owns every nested hit, including an address in its comment.
+	for (const match of text.matchAll(/-----BEGIN ([A-Z0-9 ]*PRIVATE KEY)-----/g)) {
+		const begin = match.index;
+		const closing = `-----END ${match[1]}-----`;
+		const at = text.indexOf(closing, begin + match[0].length);
+		const finish = at < 0 ? text.length : at + closing.length;
+		if (start >= begin && start < finish) return text.slice(begin, finish);
+	}
+	const line = text.slice(lineStart, lineEnd).replace(/\r$/, "");
+	if (/(?:ssh-(?:rsa|ed25519|dss)|ecdsa-sha2-[A-Za-z0-9-]+|sk-(?:ssh-ed25519|ecdsa-sha2-nistp256)@openssh\.com)[ \t]+[A-Za-z0-9+/]{20,}/.test(line)) return line;
+	// Locate quoted units and keep their original escape bytes.
+	let enclosing: { start: number; end: number | null } | undefined;
+	for (let i = lineStart; i < start; i++) {
+		const ch = text[i];
+		if (ch !== "'" && ch !== '"' && ch !== "`") continue;
+		const finish = quotedEnd(text, i + 1, ch);
+		if (finish === null || finish >= end) { enclosing = { start: i + 1, end: finish }; break; }
+		i = finish;
+	}
+	if (enclosing?.end === null) return text.slice(enclosing.start);
+	const header = /\b(?:authorization["']?\s*[:=]\s*["']?(?:Bearer|Basic)\s+|(?:set-cookie|cookie)["']?\s*[:=]\s*["']?)/i.exec(line);
+	if (header) {
+		const valueStart = lineStart + header.index + header[0].length;
+		if (start >= valueStart) return text.slice(valueStart, enclosing?.end ?? lineEnd).replace(/\r$/, "");
+	}
+	if (enclosing && enclosing.end !== null && /[:=]\s*$/.test(text.slice(lineStart, enclosing.start - 1))) {
+		return text.slice(enclosing.start, enclosing.end);
+	}
+	// URLs take precedence over addresses, token fragments and assignment captures inside them.
+	for (const match of text.matchAll(/[A-Za-z][A-Za-z0-9+.-]*:\/\/[^\s"'`<>]+/g)) {
+		if (start >= match.index && start < match.index + match[0].length) {
+			if (enclosing && enclosing.end !== null) return text.slice(match.index, enclosing.end);
+			return match[0];
+		}
+	}
+	// A path owns nested host/token captures. Quoted paths may contain spaces.
+	for (const match of text.matchAll(/\/(?:Users|home)\/[^\s"'`<>]*/g)) {
+		const finish = enclosing && enclosing.end !== null && match.index >= enclosing.start ?
+			enclosing.end : match.index + match[0].length;
+		if (start >= match.index && start < finish) return text.slice(match.index, finish);
+	}
+	if (["high-entropy-assignment", "credential-assignment", "device-serial", "authorization", "cookie-header"].includes(rule)) {
+		if (enclosing && enclosing.end !== null) return text.slice(start, enclosing.end);
+		if (rule === "authorization" || rule === "cookie-header") return text.slice(start, lineEnd).replace(/\r$/, "");
+		let finish = end;
+		while (finish < text.length && !/[\s,;}]/.test(text[finish] ?? "")) finish++;
+		return text.slice(start, finish);
+	}
+	if (["github-token", "npm-token", "anthropic-key", "openai-key", "notion-token", "slack-token", "aws-access-key", "gcp-api-key", "tailscale-key", "jwt"].includes(rule)) {
+		let finish = end;
+		while (finish < text.length && /[A-Za-z0-9_+/.=-]/.test(text[finish] ?? "")) finish++;
+		return text.slice(start, finish);
+	}
+	return text.slice(start, end);
+}