zigmini 0.8.0-beta.7 → 0.9.0-beta.2

package/host/omo-check/patches/omo-5.1.48-runtime-compat.patch

@@ -0,0 +1,31 @@
+--- a/@code-yeongyu/senpi/dist/core/extensions/builtin/compaction/speculative-summary.js
++++ b/@code-yeongyu/senpi/dist/core/extensions/builtin/compaction/speculative-summary.js
+@@ -124,6 +124,7 @@
+             headers,
+             extraBody: options.auth.extraBody,
+             env: options.auth.env,
++            cwd: options.context.cwd,
+             streamKind: "auxiliary",
+             onPayload: async (payload, model) => {
+                 const sanitized = model.api === "anthropic-messages" ? sanitizeAnthropicPayload(payload) : payload;
+--- a/@code-yeongyu/senpi/dist/modes/rpc/multi-session-host.js
++++ b/@code-yeongyu/senpi/dist/modes/rpc/multi-session-host.js
+@@ -227,7 +227,7 @@
+         onHandoffParked: async (ids) => {
+             await Promise.all(ids.map(async (id) => {
+                 await writer.flushConnection(id);
+-                connections.get(id)?.close();
++                await connections.get(id)?.finish();
+             }));
+         },
+     }, hostContext, {
+@@ -342,7 +342,8 @@
+                     process.stderr.write(`senpi rpc connection ${id} release failed: ${errorMessage(cause)}\n`);
+                 });
+             };
+-            connections.set(id, { id, sink, detach, close: () => socket.destroy() });
++            connections.set(id, { id, sink, detach, close: () => socket.destroy(),
++                finish: () => new Promise((resolve) => socket.end(resolve)) });
+             socket.once("close", detach);
+             socket.once("error", () => detach());
+         };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zigmini",
-  "version": "0.8.0-beta.7",
+  "version": "0.9.0-beta.2",
   "type": "module",
   "bin": {
     "zigmini": "bin/zigmini"

package/src/cli/setup.ts

@@ -49,7 +49,7 @@ export interface SetupDeps {
 	readonly env: Env;
 	readonly paths: RuntimePaths;
 	readonly bunPath: string;
-	readonly installEngine: (options: { home: string; acceptLicense: boolean; engineOnly: boolean; confirmLicense?: (summary: string, path: string) => Promise<boolean> }) => Promise<string>;
+	readonly installEngine: (options: { home: string; agentDir: string; acceptLicense: boolean; engineOnly: boolean; confirmLicense?: (summary: string, path: string) => Promise<boolean> }) => Promise<string>;
 	readonly globalOmoVersion: () => Promise<string | null>;
 	readonly installGlobalOmo: (version: string) => Promise<void>;
 	/** The executable checked or installed above; injected installers may keep the plain omo command. */
@@ -221,7 +221,11 @@ async function engineStep(options: SetupOptions, deps: SetupDeps): Promise<numbe
 		return answer?.trim().toLowerCase() === "y";
 	};
 	try {
-		const target = await deps.installEngine({ home: deps.paths.home, acceptLicense: options.acceptLicense, engineOnly: options.engineOnly, confirmLicense });
+		// Findings 214-217: the candidate is checked against the store of the agent folder the bridge will use.
+		const configFile = join(deps.paths.home, "config.env");
+		const dedicated = options.agentDir ?? (existsSync(configFile) ? parseConfigEnv(readFileSync(configFile, "utf8")).ZGW_OMO_AGENT_DIR : undefined);
+		const agentDir = dedicated ? resolve(dedicated) : defaultAgentDir(deps.env);
+		const target = await deps.installEngine({ home: deps.paths.home, agentDir, acceptLicense: options.acceptLicense, engineOnly: options.engineOnly, confirmLicense });
 		deps.out(message(lang, "engineDone", { target }));
 		return 0;
 	} catch (error) {

package/src/decisions.ts

@@ -1,6 +1,7 @@
 import { isDeepStrictEqual } from "node:util";
 import { decisionContext } from "./decision-context.ts";
 import { SecurityCheckError, type MessageGuard } from "./security-check.ts";
+import { securityDecision, SecurityRuntimeError } from "./security-allow.ts";
 import type { OmoEvent } from "./omo/client.ts";
 import type { ActionAnswerData, DecisionAnswerRequest, DecisionInfo, DecisionsPageData, DecisionUpdatedData } from "./protocol.ts";
 import { blockedMainQuestion, blockedQuestion, DecisionStoreError, RESUMABLE_CLOSED, Store, type Decision, type DecisionMethod, type DecisionSubmission, type StoredEvent } from "./store.ts";
@@ -163,6 +164,10 @@ export class DecisionService {
 	}
 
 	info(decision: Decision): DecisionInfo {
+		if (securityDecision(decision)) {
+			const security = this.store.securityHold(decision.id)?.state;
+			return { ...decision, work: null, allowedActions: [], ...(security ? { security } : {}) };
+		}
 		const work = decision.workId === null ? null : this.store.getWork(decision.workId);
 		let allowedActions: DecisionInfo["allowedActions"] = [];
 		if (unresolved(decision) && !["completed", "failed", "cancelled"].includes(work?.status ?? "") &&
@@ -200,12 +205,17 @@ export class DecisionService {
 	}
 
 	answer(id: string, input: unknown, checked = false): DecisionInfo {
+		const original = this.store.getDecision(id);
+		if (original && securityDecision(original)) throw new DecisionStoreError("security_endpoint_required");
 		const request = parseDecisionAnswer(input);
 		if (!checked) {
 			const owner = this.store.getDecision(id)?.ownerConv ?? "main";
-			this.options.guard?.holdOrPass(owner, "answer", answerTexts(request), async () => {
-				this.answer(id, input, true);
-			});
+			const snapshot = structuredClone(request);
+			this.options.guard?.holdOrPass(owner, "answer", answerTexts(request), async (receipt) => {
+				receipt({ kind: "answer", decisionId: id, submissionId: snapshot.submissionId });
+				this.answer(id, snapshot, true);
+			}, { key: JSON.stringify(["answer", id, request.submissionId]), snapshot,
+				originalDecisionId: id, submissionId: request.submissionId });
 		}
 		this.refresh();
 		const before = this.required(id);
@@ -228,15 +238,15 @@ export class DecisionService {
 			try {
 				if (!this.ports.sendLive(decision)) this.review(id, "receipt_unknown");
 			} catch (error) {
-				this.error(error);
+				this.error(checked ? new SecurityRuntimeError("dispatch_unknown") : error);
 				this.review(id, "receipt_unknown");
 			}
 		} else if (operation?.data.mainInputSeq !== null && operation?.data.mainInputSeq !== undefined) {
 			const inputEvent = this.store.getEvent(operation.data.mainInputSeq);
 			if (!inputEvent) throw new Error("decision_main_intent_missing");
-			this.dispatch(id, () => this.ports.dispatchMain(inputEvent));
+			this.dispatch(id, () => this.ports.dispatchMain(inputEvent), checked);
 		} else if (operation?.data.commandId && decision.workId) {
-			this.dispatch(id, () => this.ports.dispatchWork(decision.workId!));
+			this.dispatch(id, () => this.ports.dispatchWork(decision.workId!), checked);
 		}
 		this.refresh();
 		return this.info(this.required(id));
@@ -247,6 +257,7 @@ export class DecisionService {
 	 * 취소 button; a later answer to the closed decision is rejected as a conflict.
 	 */
 	dismiss(id: string, input: unknown): DecisionInfo {
+		if (securityDecision(this.required(id))) throw new DecisionStoreError("security_endpoint_required");
 		const expectedRevision = parseDecisionDismiss(input);
 		this.refresh();
 		let dismissal;
@@ -274,9 +285,9 @@ export class DecisionService {
 		return this.info(this.required(id));
 	}
 
-	private dispatch(id: string, send: () => Promise<void>): void {
+	private dispatch(id: string, send: () => Promise<void>, protectedPayload = false): void {
 		void send().catch((error: unknown) => {
-			this.error(error);
+			this.error(protectedPayload ? new SecurityRuntimeError("dispatch_unknown") : error);
 			if (!this.stopped) this.review(id, "receipt_unknown");
 		}).finally(() => {
 			if (!this.stopped) this.refresh();
@@ -523,6 +534,7 @@ export class DecisionService {
 			this.store.reconcileDecisionReceipts();
 			const now = Date.now();
 			for (let decision of this.store.allDecisions()) {
+				if (securityDecision(decision)) continue;
 				if (!unresolved(decision)) continue;
 				const context = this.store.decisionContextReason(decision);
 				if (context === "work_failed" || context === "work_cancelled") {
@@ -550,16 +562,18 @@ export class DecisionService {
 				}
 			}
 			for (const decision of this.store.allDecisions()) {
+				if (securityDecision(decision)) continue;
 				if (decision.method === "question" && decision.status === "pending" && decision.bindingState === "live") {
 					this.store.reconcileReissuedQuestion(decision.id, this.ports.liveBinding(decision));
 				}
 			}
+			this.store.notifySecurityReceipts();
 			const all = this.store.allDecisions();
 			for (const decision of all) {
 				const previous = this.known.get(decision.id);
 				this.known.set(decision.id, decision);
 				if (!previous || previous.revision < decision.revision) {
-					if (previous && previous.status !== decision.status && !unresolved(decision)) {
+					if (!securityDecision(decision) && previous && previous.status !== decision.status && !unresolved(decision)) {
 						const answer = record(decision.answer) ? decision.answer : {};
 						const kind = decision.method === "question" ? "question" : decision.method === "confirm" ? "confirm" : "value";
 						const dismissed = decision.status === "closed" ? DISMISSED_REASONS[decision.reason ?? ""] : undefined;
@@ -580,7 +594,7 @@ export class DecisionService {
 				}
 				const times: number[] = [];
 				if (unresolved(decision) && decision.bindingState === "live" && decision.deadlineAt !== null) times.push(decision.deadlineAt);
-				if (decision.status === "submitted") {
+				if (!securityDecision(decision) && decision.status === "submitted") {
 					const operation = this.store.latestDecisionOperation(decision.id);
 					times.push(Date.parse(operation?.ts ?? decision.updatedAt) + this.receiptMs);
 				}
@@ -626,7 +640,7 @@ export class DecisionService {
 			}
 			if (!route[2] && req.method === "GET") {
 				const decision = this.required(id);
-				if (unresolved(decision)) {
+				if (!securityDecision(decision) && unresolved(decision)) {
 					let timer: ReturnType<typeof setTimeout> | undefined;
 					try {
 						await Promise.race([
@@ -647,12 +661,17 @@ export class DecisionService {
 			return Response.json({ error: "method_not_allowed" }, { status: 405 });
 		} catch (error) {
 			if (error instanceof SecurityCheckError) {
-				return Response.json({ error: error.code, message: error.message, held: error.held }, { status: 422 });
+				return Response.json({ error: error.code, message: error.message, held: error.held }, { status: 422, headers: { "Cache-Control": "no-store" } });
+			}
+			if (error instanceof SecurityRuntimeError) {
+				return Response.json({ error: error.code, ...(error.held ? { held: error.held } : {}) }, {
+					status: error.code === "held_conflict" ? 409 : 503, headers: { "Cache-Control": "no-store" },
+				});
 			}
 			if (error instanceof DecisionStoreError) {
 				return Response.json({
 					error: error.code, decision: error.decision ? this.info(error.decision) : null,
-				}, { status: error.code === "decision_not_found" ? 404 : error.code.startsWith("invalid_") ? 400 : 409 });
+				}, { status: error.code === "decision_not_found" ? 404 : error.code === "security_endpoint_required" || error.code.startsWith("invalid_") ? 400 : 409 });
 			}
 			if (error instanceof URIError) return Response.json({ error: "invalid_decision" }, { status: 400 });
 			this.error(error);

package/src/engine/compat.json

@@ -1,6 +1,6 @@
 {
-  "omo": "5.1.35",
-  "senpi": "2026.10.16",
-  "threadSchema": 7,
-  "verifiedAt": "2026-10-19"
+  "omo": "5.1.48",
+  "senpi": "2026.10.25-2",
+  "threadSchema": 10,
+  "verifiedAt": "2026-10-28"
 }

package/src/engine/install.ts

@@ -1,10 +1,13 @@
 import { cpSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
 import { dirname, isAbsolute, join, relative, resolve } from "node:path";
-import { createConnection } from "node:net";
+import type { Socket } from "node:net";
+import { connectEngineSocket } from "./rpc-socket.ts";
 import type { ServerWebSocket } from "bun";
 import { OmoClient } from "../omo/client.ts";
 import { applyPatch, patchPath } from "./apply-patch.ts";
 import { engineBuildId, engineRevision } from "./build-id.ts";
+import { readStoreSchema, storeIncompatibility } from "./schema-guard.ts";
+import { supportedSchema } from "./thread-schema.ts";
 
 const PATCHES = new URL("../../host/omo-check/patches/", import.meta.url).pathname;
 const LICENSE = "Sustainable Use License 1.0";
@@ -219,34 +222,54 @@ export async function smokeEngine(home: string, candidate: string, options: { re
 	void proc.exited.then((code) => ready.reject(new Error(`engine_smoke_exit:${code}`)));
 	let server: ReturnType<typeof Bun.serve> | undefined;
 	let client: OmoClient | undefined;
-	const sockets = new Set<ReturnType<typeof createConnection>>();
+	const sockets = new Set<Socket>();
+	const handshake = Promise.withResolvers<void>();
 	try {
 		await bounded(ready.promise, timeout);
 		server = Bun.serve({
 			hostname: "127.0.0.1", port: options.port ?? 0,
-			fetch: (req, srv) => srv.upgrade(req, { data: {} }) ? undefined : new Response("", { status: 400 }),
+			fetch: (req, srv) => srv.upgrade(req, { data: { queue: [], closed: false } }) ? undefined : new Response("", { status: 400 }),
 			websocket: {
-				open(ws: ServerWebSocket<{ upstream?: ReturnType<typeof createConnection> }>) {
-					const upstream = createConnection(socket);
-					sockets.add(upstream);
-					ws.data = { upstream };
-					let pending = "";
-					upstream.on("data", (chunk) => {
-						pending += chunk.toString();
-						let newline: number;
-						while ((newline = pending.indexOf("\n")) !== -1) {
-							ws.send(pending.slice(0, newline));
-							pending = pending.slice(newline + 1);
+				// The engine's own authenticated connection (socket_auth, key root = the smoke agent folder). Frames the client
+				// sends while authentication runs are queued in order; a failed authentication fails the smoke, never falls back.
+				open(ws: ServerWebSocket<{ upstream?: Socket; queue: string[]; closed: boolean }>) {
+					void connectEngineSocket({ socketPath: socket, binary: join(candidate, "node_modules/.bin/omo"), agentDir: join(scratch, "agent") }).then((upstream) => {
+						if (ws.data.closed) {
+							upstream.destroy();
+							return;
 						}
+						sockets.add(upstream);
+						ws.data.upstream = upstream;
+						relay(ws, upstream);
+						for (const frame of ws.data.queue.splice(0)) upstream.write(`${frame}\n`);
+					}, (error: unknown) => {
+						handshake.reject(error instanceof Error ? error : new Error(String(error)));
+						ws.close();
 					});
-					upstream.once("error", () => ws.close());
-					upstream.once("close", () => { sockets.delete(upstream); ws.close(); });
 				},
-				message(ws, message) { ws.data.upstream?.write(`${message}\n`); },
-				close(ws) { ws.data.upstream?.destroy(); },
+				message(ws, message) {
+					if (ws.data.upstream) ws.data.upstream.write(`${message}\n`);
+					else ws.data.queue.push(String(message));
+				},
+				close(ws) {
+					ws.data.closed = true;
+					ws.data.upstream?.destroy();
+				},
 			},
 		});
-		const handshake = Promise.withResolvers<void>();
+		const relay = (ws: ServerWebSocket<{ upstream?: Socket; queue: string[]; closed: boolean }>, upstream: Socket) => {
+			let pending = "";
+			upstream.on("data", (chunk) => {
+				pending += chunk.toString();
+				let newline: number;
+				while ((newline = pending.indexOf("\n")) !== -1) {
+					ws.send(pending.slice(0, newline));
+					pending = pending.slice(newline + 1);
+				}
+			});
+			upstream.once("error", () => ws.close());
+			upstream.once("close", () => { sockets.delete(upstream); ws.close(); });
+		};
 		client = new OmoClient(`ws://127.0.0.1:${server.port}`, "", {
 			onEvent() {},
 			onStatus(status) {
@@ -271,8 +294,27 @@ export async function smokeEngine(home: string, candidate: string, options: { re
 	}
 }
 
+/**
+ * Findings 214-217: the candidate must read the agent folder's shared store before it is selected. The store is read
+ * through the guard's temp copy; an unknown support value or an unreadable store is not a known incompatibility.
+ */
+export function assertStoreCompatible(agentDir: string, candidate: string): void {
+	let supported: number | null = null;
+	try {
+		supported = supportedSchema(candidate);
+	} catch {
+		supported = null;
+	}
+	const found = storeIncompatibility(readStoreSchema(agentDir), supported);
+	if (found !== null) throw new Error(`${ENGINE_SCHEMA_INCOMPATIBLE}:store=${found.store},supported=${found.supported}`);
+}
+
+export const ENGINE_SCHEMA_INCOMPATIBLE = "engine_schema_incompatible";
+
 export async function installEngine(options: {
 	readonly home: string;
+	/** The agent folder the bridge uses; when set, a candidate that cannot read its store is never selected. */
+	readonly agentDir?: string;
 	readonly version?: string;
 	readonly patchDir?: string;
 	readonly registry?: string;
@@ -281,11 +323,17 @@ export async function installEngine(options: {
 	readonly confirmLicense?: (summary: string, path: string) => Promise<boolean>;
 	readonly smoke?: { readonly port?: number; readonly timeoutMs?: number };
 }): Promise<string> {
-	const version = options.version ?? JSON.parse(readFileSync(new URL("./compat.json", import.meta.url), "utf8")).omo;
+	const pin: { readonly omo: string; readonly threadSchema?: number } = JSON.parse(readFileSync(new URL("./compat.json", import.meta.url), "utf8"));
+	const version = options.version ?? pin.omo;
+	if (options.agentDir !== undefined && version === pin.omo) {
+		const found = storeIncompatibility(readStoreSchema(options.agentDir), pin.threadSchema ?? null);
+		if (found !== null) throw new Error(`${ENGINE_SCHEMA_INCOMPATIBLE}:store=${found.store},supported=${found.supported}`);
+	}
 	const omoDir = join(resolve(options.home), "omo");
 	await installStock(version, omoDir, options.registry);
 	const target = buildPatched(version, omoDir, options.patchDir);
 	const candidate = join(omoDir, target);
+	if (options.agentDir !== undefined) assertStoreCompatible(options.agentDir, candidate);
 	await acceptEngineLicense(options.home, candidate, options);
 	await smokeEngine(options.home, candidate, options.smoke);
 	candidateExecutable(candidate);

package/src/engine/rpc-socket.ts

@@ -0,0 +1,36 @@
+import { existsSync, realpathSync } from "node:fs";
+import { createConnection, Socket } from "node:net";
+import { dirname, join } from "node:path";
+import { pathToFileURL } from "node:url";
+
+export interface EngineSocketOptions {
+	readonly socketPath: string;
+	readonly binary: string;
+	readonly agentDir: string;
+}
+
+/** Use the selected engine's key-record validation and challenge-response implementation. */
+export async function connectEngineSocket(options: EngineSocketOptions): Promise<Socket> {
+	const modules = dirname(dirname(dirname(realpathSync(options.binary))));
+	const authPath = join(modules, "@code-yeongyu/senpi/dist/modes/rpc/rpc-auth-client.js");
+	if (existsSync(authPath)) {
+		const auth: { readonly connectAuthenticatedRpcSocket?: unknown } = await import(pathToFileURL(authPath).href);
+		if (typeof auth.connectAuthenticatedRpcSocket !== "function") {
+			throw new Error("engine_rpc_auth_module_invalid");
+		}
+		const result: unknown = await auth.connectAuthenticatedRpcSocket(options.socketPath, undefined, { keyRoot: options.agentDir });
+		if (typeof result !== "object" || result === null || !("socket" in result) || !(result.socket instanceof Socket)) {
+			throw new Error("engine_rpc_auth_socket_invalid");
+		}
+		return result.socket;
+	}
+	// Retained pre-auth engines and the native transport fixture have no authentication module.
+	return await new Promise<Socket>((resolve, reject) => {
+		const socket = createConnection(options.socketPath);
+		socket.once("error", reject);
+		socket.once("connect", () => {
+			socket.off("error", reject);
+			resolve(socket);
+		});
+	});
+}

package/src/engine/schema-guard.ts

@@ -38,6 +38,15 @@ export interface SchemaCheck {
 export interface SavedGuard extends SchemaCheck {
 	readonly mode: GuardMode;
 	readonly at: string;
+	/** The refusing bridge's runtime slot and pinned engine folder; null for a bridge that did not say (findings 214-217). */
+	readonly slot?: string | null;
+	readonly engine?: string | null;
+}
+
+/** Which bridge start ran the guard: a slot bridge passes its slot and pinned engine folder. */
+export interface GuardOrigin {
+	readonly slot: string | null;
+	readonly engine: string | null;
 }
 
 export interface GuardInput {
@@ -48,6 +57,7 @@ export interface GuardInput {
 	readonly supported: () => number;
 	readonly bunInstall: string;
 	readonly now: () => Date;
+	readonly origin?: GuardOrigin;
 }
 
 export interface GuardResult {
@@ -116,11 +126,23 @@ export function compareVersions(a: string, b: string): number {
 	return preA < preB ? -1 : 1;
 }
 
+/** Findings 214-217: the installed global version is an observation, not the proven actor of the schema change. */
 export function tooNewMessage(schema: number, globalVersion: string | null): string {
-	return `다른 OMO(전역 ${globalVersion ?? "버전 알 수 없음"})가 공유 폴더 스키마를 ${schema}으로 올렸습니다. ` +
+	return `공유 폴더 스키마가 ${schema}이라 이 게이트웨이 엔진이 읽지 못합니다(지금 설치된 전역 OMO: ${globalVersion ?? "버전 알 수 없음"}, 스키마를 올린 주체는 확인하지 않음). ` +
 		"`zigmini update`로 맞는 버전을 받거나, 이 게이트웨이 전용 에이전트 폴더를 쓰세요(`zigmini setup --agent-dir`)";
 }
 
+export const SCHEMA_INCOMPATIBLE = "schema_incompatible";
+
+/**
+ * Findings 214-217: a known incompatibility is a readable store newer than what the engine supports. A missing or
+ * unreadable store, or an engine whose support is unknown, is not known to be incompatible.
+ */
+export function storeIncompatibility(store: StoreReading, supported: number | null): { readonly store: number; readonly supported: number } | null {
+	if (store.state !== "ok" || supported === null || store.version <= supported) return null;
+	return { store: store.version, supported };
+}
+
 export function checkSchema(store: StoreReading, supported: number | null, globalVersion: string | null): SchemaCheck {
 	const version = store.state === "ok" ? store.version : null;
 	if (store.state === "missing") return { state: "missing", store: null, supported, globalVersion, message: null };
@@ -147,7 +169,7 @@ export function guardStart(input: GuardInput): GuardResult {
 	const file = join(input.run, GUARD_FILE);
 	if (refuse) {
 		mkdirSync(input.run, { recursive: true, mode: 0o700 });
-		const saved: SavedGuard = { ...check, mode: input.mode, at: input.now().toISOString() };
+		const saved: SavedGuard = { ...check, mode: input.mode, at: input.now().toISOString(), slot: input.origin?.slot ?? null, engine: input.origin?.engine ?? null };
 		writeFileSync(file, `${JSON.stringify(saved)}\n`, { mode: 0o600 });
 	} else rmSync(file, { force: true });
 	if (check.state === "too_new") {
@@ -170,6 +192,16 @@ export function readGuardState(run: string): SavedGuard | null {
 	}
 }
 
+/**
+ * Findings 214-217: the refusal of this start attempt only. The shared run/schema-guard.json may be left by another slot,
+ * engine or an earlier start, which must not fail (or explain) the current one.
+ */
+export function attemptRefusal(saved: SavedGuard | null, attempt: { readonly slot: string; readonly engine: string | null; readonly since: string }): string | null {
+	if (saved === null || saved.mode !== "enforce" || saved.slot !== attempt.slot || saved.engine !== attempt.engine) return null;
+	if (!(Date.parse(saved.at) >= Date.parse(attempt.since))) return null;
+	return `저장소 스키마 ${saved.store} > 엔진 ${attempt.engine ?? "current"} 지원 ${saved.supported}로 브리지가 시작을 거부했습니다. ${saved.message}`;
+}
+
 /** `/api/health` `omo`: a connected bridge wins over a stale file; otherwise an enforced refusal shows as schema_too_new. */
 export function healthOmo(status: string, saved: SavedGuard | null): string {
 	return status !== "ready" && saved?.mode === "enforce" ? SCHEMA_TOO_NEW : status;

package/src/hub.ts

@@ -14,7 +14,9 @@ import { isUsageCommand, USAGE_COMMAND } from "./usage.ts";
 import { MessageReferenceError, referencedInput, resolveMessageReferences } from "./message-references.ts";
 import { readProfile } from "./profile.ts";
 import type { MessageGuard } from "./security-check.ts";
+import { SecurityRuntimeError, type SecurityReceipt } from "./security-allow.ts";
 import { nativeReplyEntry, type NativeReplyObserver } from "./reply-notifications.ts";
+import { notificationHistory } from "./notification-history.ts";
 import { messageTimestamp, nativeTurnStarted, nativeTurnStats } from "./turn-stats.ts";
 
 export type Broadcast = (envelope: Envelope) => void;
@@ -64,7 +66,7 @@ export interface HubOptions {
 	/** Answers `/usage` (model account usage) as a notice; the command never reaches omo. */
 	usageReport?: () => Promise<string>;
 	/** Improvement 165: the security check of user text; a finding keeps the text from omo and the store. */
-	guard?: Pick<MessageGuard, "check" | "hold">;
+	guard?: Pick<MessageGuard, "check" | "hold" | "existing">;
 }
 
 /** Anthropic rejects images over 5 MB; bigger attachments reach the agent as a file path only. */
@@ -371,13 +373,16 @@ export class Hub {
 	async notificationBaseline(): Promise<void> {
 		for (const conv of this.store.listConversations()) {
 			if (!conv.threadId) continue;
-			const { sessionId } = await this.ensureSession(conv);
+			const sessionPath = conv.threadId;
 			const generation = this.generation;
 			const revision = this.options.replies?.revision();
-			const result = await this.requireOmo().command<EntriesResult>("get_entries", { sessionId });
-			if (generation !== this.generation || this.omoStatus !== "ready" || this.rt(conv.id).sessionId !== sessionId ||
-				this.store.getConversation(conv.id)?.threadId !== conv.threadId) throw new Error("reply_baseline_discarded");
-			if (revision !== undefined) this.options.replies?.observe({ sessionPath: conv.threadId, conv: conv.id, title: conv.title }, result.entries, revision);
+			const current = () => generation === this.generation &&
+				this.store.getConversation(conv.id)?.threadId === conv.threadId;
+			await notificationHistory(conv.threadId, (entry) => {
+				if (!current()) throw new Error("reply_baseline_discarded");
+				if (revision !== undefined) this.options.replies?.observe({ sessionPath, conv: conv.id, title: conv.title }, [entry], revision);
+			}, true);
+			if (!current()) throw new Error("reply_baseline_discarded");
 		}
 	}
 
@@ -799,8 +804,16 @@ export class Hub {
 				else if (this.openQuestionCards(conv.id, this.conversationScope(conv.id)).size > 0) await this.ensureSession(current);
 				else if (this.store.unreportedWorkUpdates(conv.id).length > 0 || this.workSummary(conv.id).length > 0) await this.ensureSession(current);
 				if (this.options.replies?.settings().mode === "all-replies" && current.threadId) {
-					await this.ensureSession(this.store.getConversation(conv.id) ?? current);
-					await this.syncLedger(conv.id);
+					if (this.rt(conv.id).sessionId) await this.syncLedger(conv.id);
+					else {
+						const sessionPath = current.threadId;
+						const revision = this.options.replies.revision();
+						await notificationHistory(sessionPath, (entry) => {
+							if (generation !== this.generation || this.omoStatus !== "ready" ||
+								this.store.getConversation(conv.id)?.threadId !== sessionPath) throw new Error("reply_history_discarded");
+							this.options.replies?.observe({ sessionPath, conv: conv.id, title: current.title }, [entry], revision);
+						});
+					}
 				}
 				// Opening main comes first. A notification ACK or worker reconciliation cannot hold readiness.
 				void this.notifyWorkUpdates(conv.id);
@@ -815,12 +828,17 @@ export class Hub {
 	}
 
 	/** `images` are names of files already uploaded to the media folder; unknown names are dropped. */
-	async sendText(convId: string, text: string, src: Source, trust: Trust, images: string[] = [], referenceIds?: unknown, checked = false): Promise<void> {
+	async sendText(convId: string, text: string, src: Source, trust: Trust, images: string[] = [], referenceIds?: unknown, checked = false, submissionId?: string): Promise<void> {
 		if (this.maintenanceId) throw new MaintenanceError("maintenance_held");
+		if (submissionId !== undefined && !/^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i.test(submissionId)) throw new SecurityRuntimeError("held_conflict");
+		const context = { ...(submissionId ? { key: JSON.stringify(["message", convId, submissionId]), submissionId } : {}),
+			snapshot: structuredClone({ text, src, trust, images, referenceIds }) };
+		if (this.options.guard?.existing(context)) return;
 		const conv = this.store.getConversation(convId);
 		if (!conv) throw new Error(`unknown_conversation:${convId}`);
 		const body = text.trim();
-		const references = resolveMessageReferences(this.store, convId, referenceIds);
+		const source = structuredClone(src);
+		const references = structuredClone(resolveMessageReferences(this.store, convId, referenceIds));
 		if (this.options.versionReport && images.length === 0 && references.length === 0 && isVersionCommand(body)) {
 			this.emit(convId, "notice", { kind: "version", level: "info", message: await this.options.versionReport() });
 			return;
@@ -837,29 +855,36 @@ export class Hub {
 			throw new MessageReferenceError("message_reference_images_unavailable");
 		}
 		if (!body && attached.length === 0 && references.length === 0) return;
-		// Improvement 165: a finding holds the message in gateway memory. The guard sends the card with the values to the
-		// user's screens only (never stored, never in a prompt); the user's "send" runs this call again with checked.
+		const attachmentSnapshot = this.attachments(prompt.images);
+		const send = async (receipt?: (ref: SecurityReceipt) => void) => {
+			if (receipt && prompt.images.some((name) => !dir || !mediaFile(dir, name))) throw new SecurityRuntimeError("dispatch_failed");
+			const input = this.store.acceptMainUser(convId, {
+				text: body, src: source, trust, ...(attached.length ? { images: attached } : {}),
+				...(references.length ? { references } : {}),
+			}, receipt);
+			this.publishStored(input);
+			this.decisions?.refresh();
+			const rotationDone = this.rt(convId).rotationDone;
+			if (rotationDone) await rotationDone;
+			if (this.closeUncertain(convId)) {
+				if (this.closeRecoveries.get(convId)?.exhausted) {
+					if (receipt) throw new SecurityRuntimeError("dispatch_unknown");
+					throw new Error("session_close_recovery_exhausted");
+				}
+				this.scheduleCloseRecovery(convId);
+				this.emit(convId, "notice", { kind: "session-close-recovery", level: "info",
+					message: "세션 닫기 상태를 확인하고 있습니다. 메시지는 확인 후 전달합니다." });
+				return;
+			}
+			await this.prompt(convId, prompt.text, prompt.images, input.seq, true, attachmentSnapshot, receipt !== undefined);
+		};
+		// The approved closure owns the inspected references, body and image bytes. Never re-resolve reference ids.
 		const found = checked ? null : this.options.guard?.check([prompt.text]);
 		if (found) {
-			this.options.guard!.hold(convId, "message", found, () => this.sendText(convId, text, src, trust, images, referenceIds, true), body);
-			return;
-		}
-		const input = this.store.acceptMainUser(convId, {
-			text: body, src, trust, ...(attached.length ? { images: attached } : {}),
-			...(references.length ? { references } : {}),
-		});
-		this.publishStored(input);
-		this.decisions?.refresh();
-		const rotationDone = this.rt(convId).rotationDone;
-		if (rotationDone) await rotationDone;
-		if (this.closeUncertain(convId)) {
-			if (this.closeRecoveries.get(convId)?.exhausted) throw new Error("session_close_recovery_exhausted");
-			this.scheduleCloseRecovery(convId);
-			this.emit(convId, "notice", { kind: "session-close-recovery", level: "info",
-				message: "세션 닫기 상태를 확인하고 있습니다. 메시지는 확인 후 전달합니다." });
+			this.options.guard!.hold(convId, "message", found, send, body, context);
 			return;
 		}
-		await this.prompt(convId, prompt.text, prompt.images, input.seq, true);
+		await send();
 	}
 
 	/** Reserve gateway report admission before its HTTP body is parsed. The source
@@ -1604,7 +1629,7 @@ export class Hub {
 	}
 
 	/** Sends input once. Native same-session compaction owns overflow recovery, never gateway replay. */
-	private async prompt(convId: string, body: string, images: string[] = [], messageSeq?: number, admitted = false): Promise<void> {
+	private async prompt(convId: string, body: string, images: string[] = [], messageSeq?: number, admitted = false, attachmentSnapshot?: ReturnType<Hub["attachments"]>, protectedPayload = false): Promise<void> {
 		const conv = this.store.getConversation(convId);
 		if (!conv) return;
 		const rt = this.rt(convId);
@@ -1622,7 +1647,7 @@ export class Hub {
 			if (generation !== this.generation || this.omoStatus !== "ready" || rt.sessionId !== sessionId) return;
 			if (admitted && this.store.mainUserDispatched(convId, reference)) return;
 			const handoff = nativeCommand ? null : this.store.getSessionMeta(convId).handoff;
-			const attached = this.attachments(images);
+			const attached = attachmentSnapshot ?? this.attachments(images);
 			const text = [body, attached.note].filter(Boolean).join("\n\n");
 			const context = handoff ? `${handoff}\n\nZGW_WORK_STATE ${JSON.stringify(this.workSummary(convId))}` : null;
 			const inputId = crypto.randomUUID();
@@ -1652,6 +1677,7 @@ export class Hub {
 			this.decisions?.refresh();
 		} catch (error) {
 			if (generation !== this.generation || this.omoStatus !== "ready") return;
+			if (protectedPayload) throw new SecurityRuntimeError("dispatch_unknown");
 			const message = errorMessage(error);
 			this.emit(convId, "error", this.continuityError(message));
 		}