zigmini 0.9.0-beta.2 → 1.0.0-beta.1

package/src/security-baseline.ts

@@ -0,0 +1,113 @@
+import { randomUUID } from "node:crypto";
+import { homedir, userInfo } from "node:os";
+import { join } from "node:path";
+import { SCHEMA_VERSION, writeBaselineAtomic, type BaselineFile } from "./security/baseline.ts";
+import { machineTerms, normalizeTerm } from "./security/terms.ts";
+import type { Store } from "./store.ts";
+
+interface AutomaticValues {
+	readonly home: string;
+	readonly user: string;
+}
+
+interface BaselineExportOptions {
+	readonly secrets: string;
+	readonly gatewayVersion: string;
+}
+
+interface BaselineExportDeps {
+	readonly home?: string;
+	readonly user?: string;
+	readonly now?: () => Date;
+	readonly log?: (code: "write_failed") => void;
+}
+
+/** Account names and home paths remain protected even when an old allow row grants repo access. */
+export function isAutomaticBaselineValue(value: string, automatic: AutomaticValues): boolean {
+	const normalized = normalizeTerm(value.trim());
+	return normalized === normalizeTerm(automatic.home) || normalized === normalizeTerm(automatic.user);
+}
+
+/** Automatic values stay in home/user; terms contain only explicit registrations. */
+export function projectBaseline(input: Omit<BaselineFile, "schemaVersion">): BaselineFile {
+	const automatic = machineTerms(input);
+	return {
+		...input, schemaVersion: SCHEMA_VERSION, revision: input.revision,
+		home: automatic.home,
+		terms: [...new Set(input.terms)],
+		allow: input.allow.map((entry) => ({
+			value: entry.value,
+			scopes: isAutomaticBaselineValue(entry.value, input)
+				? entry.scopes.filter((scope) => scope !== "repo") : entry.scopes,
+		})),
+	};
+}
+
+/** The gateway's post-commit export boundary. File failure never rolls back a successful DB write. */
+export class SecurityBaseline {
+	readonly baselineId: string;
+	exportedAt: string | null = null;
+	private exportError: "write_failed" | null = null;
+
+	constructor(private readonly store: Store, private readonly options: BaselineExportOptions,
+		private readonly deps: BaselineExportDeps = {}) {
+		const existing = store.getSetting("security.baselineId");
+		this.baselineId = existing ?? randomUUID();
+		if (existing === null) store.setSetting("security.baselineId", this.baselineId);
+		this.export();
+	}
+
+	auto(): AutomaticValues {
+		return { home: this.deps.home ?? homedir(), user: this.deps.user ?? userInfo().username };
+	}
+
+	isAutomaticValue(value: string): boolean {
+		return isAutomaticBaselineValue(value, this.auto());
+	}
+
+	status() {
+		return { baselineRevision: this.store.securityAllowedValues().revision,
+			baselineId: this.baselineId, exportError: this.exportError };
+	}
+
+	/** Called at startup and synchronously after each committed baseline or allow-list change. */
+	export(): void {
+		const { revision, values } = this.store.securityAllowedValues();
+		const file = projectBaseline({
+			baselineId: this.baselineId, revision,
+			terms: this.store.securityBaselineTerms().terms.map((term) => term.value),
+			...this.auto(),
+			allow: values.map((entry) => ({ value: entry.value, scopes: entry.scopes ?? ["transport"] })),
+			exportedAt: (this.deps.now?.() ?? new Date()).toISOString(),
+			gatewayVersion: this.options.gatewayVersion,
+		});
+		// The writer always belongs to this gateway home, not a scanner's input-file override.
+		const result = writeBaselineAtomic(join(this.options.secrets, "security-baseline.json"), file);
+		if (!result.ok) {
+			this.exportError = result.error;
+			if (this.deps.log) this.deps.log(result.error);
+			else console.error("security baseline export failed", result.error);
+			return;
+		}
+		this.exportError = null;
+		this.exportedAt = file.exportedAt;
+	}
+
+	addTerm(value: string, expectedRevision?: number) {
+		const result = this.store.addSecurityBaselineTerm(value, expectedRevision);
+		this.export();
+		return result;
+	}
+
+	removeTerm(id: string, expectedRevision?: number) {
+		const result = this.store.removeSecurityBaselineTerm(id, expectedRevision);
+		if (result.removed > 0) this.export();
+		return result;
+	}
+
+	setAllowScopes(id: string, scopes: readonly string[], expectedRevision?: number) {
+		const result = this.store.setSecurityAllowScopes(id, scopes, expectedRevision);
+		this.export();
+		return result;
+	}
+}

package/src/security-check.ts

@@ -4,7 +4,9 @@ import allowConfig from "../scripts/secret-scan.allow.json";
 import { readVoiceSetting, writeVoiceSetting } from "./voice-setting.ts";
 import { isDeepStrictEqual } from "node:util";
 import { canonicalSecurityValue, SecurityRuntimeError, type HeldState, type SecurityApprover, type SecurityHoldRecord, type SecurityIntent, type SecurityReceipt } from "./security-allow.ts";
-import type { Store } from "./store.ts";
+import { SecurityBaselineError, type Store } from "./store.ts";
+import type { SecurityBaseline } from "./security-baseline.ts";
+import { say, type Text } from "./server-text.ts";
 export type { HeldState, AllowedValue } from "./security-allow.ts";
 
 // Improvement 165: every user text bound for the engine passes one security check first (work 779e5b0e).
@@ -56,7 +58,7 @@ export const SECURITY_CHECK_PATH = "/api/settings/security-check";
 export const SECURITY_BLOCKED = "security_check_blocked";
 export const SECURITY_HELD_PATH = "/api/security-check/held";
 
-/** User-facing names of the finding kinds; rule ids without an entry fall back to "기타 보안 값". */
+/** User-facing names of the finding kinds; rule ids without an entry fall back to "other". */
 const KIND_OF_RULE: Readonly<Record<string, string>> = {
 	"private-key": "private-key",
 	"ssh-public-key": "private-key",
@@ -69,16 +71,21 @@ const KIND_OF_RULE: Readonly<Record<string, string>> = {
 	"email": "email", "phone-number": "phone",
 	"adb-device": "device-id", "device-serial": "device-id",
 };
-export const KIND_LABELS: Readonly<Record<string, string>> = {
-	"private-key": "비밀키",
-	"token": "토큰·API 키",
-	"credential": "비밀번호·인증·쿠키 값",
-	"home-path": "홈 폴더 경로",
-	"internal-address": "내부 IP·호스트",
-	"email": "이메일 주소",
-	"phone": "전화번호",
-	"device-id": "기기 식별값",
-	"other": "기타 보안 값",
+export const KIND_LABELS: Readonly<Record<string, Text>> = {
+	"private-key": { en: "Private key", ko: "비밀키" },
+	"token": { en: "Token / API key", ko: "토큰·API 키" },
+	"credential": { en: "Password / auth / cookie value", ko: "비밀번호·인증·쿠키 값" },
+	"home-path": { en: "Home folder path", ko: "홈 폴더 경로" },
+	"internal-address": { en: "Internal IP / host", ko: "내부 IP·호스트" },
+	"email": { en: "Email address", ko: "이메일 주소" },
+	"phone": { en: "Phone number", ko: "전화번호" },
+	"device-id": { en: "Device identifier", ko: "기기 식별값" },
+	"other": { en: "Other security value", ko: "기타 보안 값" },
+};
+const FINDING_COUNT: Text = { en: "{label}: {count}", ko: "{label} {count}건" };
+const HOLD_MESSAGE: Text = {
+	en: "The security check held this message and did not send it to the engine: {summary}.",
+	ko: "보안검사에 걸려 엔진에 보내지 않고 보류했습니다: {summary}.",
 };
 
 interface Compiled { readonly id: string; readonly kind: string; readonly regex: RegExp; readonly group: number; readonly minEntropy?: number }
@@ -135,7 +142,7 @@ export class SecurityChecker {
 					const end = match.indices?.[rule.group]?.[1] ?? start + value.length;
 					const before = text.slice(0, at);
 					const line = before.split("\n").length;
-					found.push({ kind: rule.kind, label: KIND_LABELS[rule.kind]!, value, text: index, line, column: at - before.lastIndexOf("\n"),
+					found.push({ kind: rule.kind, label: say(KIND_LABELS[rule.kind]!), value, text: index, line, column: at - before.lastIndexOf("\n"),
 						...(runtime ? { ruleId: rule.id, start, end,
 							canonicalValue: canonicalSecurityValue(text, rule.id, start, end) } : {}),
 					});
@@ -150,16 +157,16 @@ export function countFindings(occurrences: readonly SecurityOccurrence[]): Secur
 	const counts = new Map<string, number>();
 	for (const occurrence of occurrences) counts.set(occurrence.kind, (counts.get(occurrence.kind) ?? 0) + 1);
 	return Object.keys(KIND_LABELS).filter((kind) => counts.has(kind))
-		.map((kind) => ({ kind, label: KIND_LABELS[kind]!, count: counts.get(kind)! }));
+		.map((kind) => ({ kind, label: say(KIND_LABELS[kind]!), count: counts.get(kind)! }));
 }
 
 /** "토큰·API 키 2건, 홈 폴더 경로 1건" */
 export function findingSummary(findings: readonly SecurityFinding[]): string {
-	return findings.map((finding) => `${finding.label} ${finding.count}건`).join(", ");
+	return findings.map((finding) => say(FINDING_COUNT, { label: finding.label, count: finding.count })).join(", ");
 }
 
 export function blockedMessage(findings: readonly SecurityFinding[]): string {
-	return `보안검사에 걸려 엔진에 보내지 않고 보류했습니다: ${findingSummary(findings)}.`;
+	return say(HOLD_MESSAGE, { summary: findingSummary(findings) });
 }
 
 /** Thrown for a held decision answer; `held` (with the values) goes only to the user's screen that sent it. */
@@ -539,6 +546,74 @@ export async function handleHeld(
 }
 
 export const SECURITY_ALLOWED_PATH = `${SECURITY_CHECK_PATH}/allowed-values`;
+export const SECURITY_BASELINE_PATH = `${SECURITY_CHECK_PATH}/baseline`;
+
+/** Baseline reads/deletes use both authenticated ports; adding terms and changing scopes require the web port. */
+export async function handleSecurityBaseline(
+	req: Request, url: URL, trusted: boolean, store: Store, baseline: SecurityBaseline,
+	publish: (revision: number) => void,
+): Promise<Response | null> {
+	const root = url.pathname === SECURITY_BASELINE_PATH;
+	const revision = url.pathname === `${SECURITY_BASELINE_PATH}/revision`;
+	const term = url.pathname.startsWith(`${SECURITY_BASELINE_PATH}/`) && !revision;
+	const scopes = req.method === "PATCH" && url.pathname.startsWith(`${SECURITY_ALLOWED_PATH}/`);
+	if (!root && !revision && !term && !scopes) return null;
+	const json = (value: unknown, status = 200) => Response.json(value, { status, headers: { "Cache-Control": "no-store" } });
+	if ((req.method === "POST" || req.method === "PATCH") && !trusted) return json({ error: "forbidden" }, 403);
+	try {
+		if (req.method === "GET") {
+			if (revision) return json({ revision: baseline.status().baselineRevision, baselineId: baseline.baselineId });
+			if (root) return json({
+				...store.securityBaselineTerms(), baselineId: baseline.baselineId, auto: baseline.auto(),
+				exportedAt: baseline.exportedAt, exportError: baseline.status().exportError,
+			});
+			return null;
+		}
+		if (!(root && req.method === "POST") && !(term && req.method === "DELETE") && !scopes) return null;
+		const body: unknown = await req.json().catch(() => null);
+		if (typeof body !== "object" || body === null || !("expectedRevision" in body) ||
+			typeof body.expectedRevision !== "number" || !Number.isSafeInteger(body.expectedRevision) || body.expectedRevision < 0) {
+			return json({ error: "invalid_held_request" }, 400);
+		}
+		if (scopes) {
+			if (!("scopes" in body) || !Array.isArray(body.scopes) || !body.scopes.every((scope): scope is string => typeof scope === "string")) {
+				return json({ error: "scopes_invalid" }, 400);
+			}
+			const id = decodeURIComponent(url.pathname.slice(SECURITY_ALLOWED_PATH.length + 1));
+			const current = store.securityAllowedValues().values.find((entry) => entry.id === id);
+			if (body.scopes.includes("repo") && current && baseline.isAutomaticValue(current.value)) {
+				return json({ error: "scopes_invalid" }, 400);
+			}
+			const result = baseline.setAllowScopes(id, body.scopes, body.expectedRevision);
+			publish(result.revision);
+			return json(result);
+		}
+		if (root) {
+			if (!("value" in body) || typeof body.value !== "string") return json({ error: "term_invalid", reason: "empty" }, 400);
+			const result = baseline.addTerm(body.value, body.expectedRevision);
+			publish(result.revision);
+			return json(result);
+		}
+		const id = decodeURIComponent(url.pathname.slice(SECURITY_BASELINE_PATH.length + 1));
+		const result = baseline.removeTerm(id, body.expectedRevision);
+		if (result.removed === 0) return json({ error: "term_not_found" }, 404);
+		publish(result.revision);
+		return json(result);
+	} catch (error) {
+		if (error instanceof SecurityBaselineError) {
+			switch (error.code) {
+				case "baseline_conflict": return json({ error: error.code, revision: error.revision }, 409);
+				case "term_invalid": return json({ error: error.code, reason: error.reason }, 400);
+				case "term_duplicate":
+				case "scopes_invalid": return json({ error: error.code }, 400);
+				case "allowlist_not_found": return json({ error: error.code }, 404);
+			}
+		}
+		if (error instanceof SecurityRuntimeError && error.code === "allowlist_conflict") return json({ error: error.code, revision: error.revision }, 409);
+		return json({ error: scopes ? "allowlist_persist_failed" : "baseline_persist_failed" }, 503);
+	}
+}
+
 export async function handleSecurityAllowedValues(req: Request, url: URL, store: Store, publish: (revision: number) => void): Promise<Response | null> {
 	if (url.pathname !== SECURITY_ALLOWED_PATH && !url.pathname.startsWith(`${SECURITY_ALLOWED_PATH}/`)) return null;
 	const json = (value: unknown, status = 200) => Response.json(value, { status, headers: { "Cache-Control": "no-store" } });

package/src/server-text.ts

@@ -0,0 +1,38 @@
+import type { Language } from "./cli/messages.ts";
+import { DEFAULT_UI_LANGUAGE } from "./ui-language.ts";
+
+/**
+ * Fixed text the gateway server writes for people (HTTP `message` fields, chat notices and errors, notifications,
+ * gateway-answered commands), in English and Korean (improvement 253). The language is the gateway-wide UI language
+ * (the install home's `language` file, src/ui-language.ts); main.ts sets the source once at startup. Machine values
+ * (`error`/`code` fields, event types) never go through here. Text is chosen when it is made: a notice already stored
+ * in the chat history keeps the language it was made in.
+ */
+
+export type { Language };
+export type Text = Readonly<Record<Language, string>>;
+
+let source: () => Language = () => DEFAULT_UI_LANGUAGE;
+
+/** main.ts: read the saved UI language each time text is made. Tests set a fixed language and restore it after. */
+export function setServerLanguage(next: () => Language): void {
+	source = next;
+}
+
+export function serverLanguage(): Language {
+	return source();
+}
+
+/** The text in `lang`, with each `{name}` replaced by `values[name]`; an unknown placeholder stays as written. */
+export function textIn(lang: Language, text: Text, values: Readonly<Record<string, string | number>> = {}): string {
+	return text[lang].replace(/\{(\w+)\}/g, (placeholder, name: string) => Object.hasOwn(values, name) ? String(values[name]) : placeholder);
+}
+
+export function say(text: Text, values: Readonly<Record<string, string | number>> = {}): string {
+	return textIn(source(), text, values);
+}
+
+/** True when `value` is the text in any language (for a reader that must recognize text made earlier or elsewhere). */
+export function isTextOf(value: string, text: Text): boolean {
+	return value === text.en || value === text.ko;
+}

package/src/store.ts

@@ -1,4 +1,5 @@
 import { Database } from "bun:sqlite";
+import { say, type Text } from "./server-text.ts";
 import { OMO_CHECK_BASELINE, omoCheckActionable, omoCheckDaytime } from "./omo-check-policy.ts";
 import { chmodSync, existsSync, mkdirSync } from "node:fs";
 import { join } from "node:path";
@@ -6,6 +7,23 @@ import { isDeepStrictEqual } from "node:util";
 import type { ConversationInfo, DecisionAnswerRequest, NotificationMode, ReplyNotification } from "./protocol.ts";
 import type { NativeTurnStats } from "./turn-stats.ts";
 import { SecurityRuntimeError, securityDecision, type AllowedValue, type HeldState, type SecurityApprover, type SecurityHoldRecord, type SecurityIntent, type SecurityReceipt } from "./security-allow.ts";
+import { findPrivate, normalizeTerm, PUBLIC_ACCOUNT } from "./security/terms.ts";
+
+export interface SecurityBaselineTerm {
+	readonly id: string;
+	readonly value: string;
+	readonly addedAt: string;
+}
+
+const UNTITLED_QUESTION: Text = { en: "Untitled question", ko: "제목 없는 질문" };
+
+export class SecurityBaselineError extends Error {
+	constructor(
+		readonly code: "term_invalid" | "term_duplicate" | "baseline_conflict" | "scopes_invalid" | "allowlist_not_found",
+		readonly reason?: "empty" | "too_short" | "loopback",
+		readonly revision?: number,
+	) { super(code); }
+}
 
 export interface StoredEvent {
 	seq: number;
@@ -566,6 +584,22 @@ export class Store {
 		if (!columns.some((c) => c.name === "omo_cursor")) this.db.exec("ALTER TABLE conversations ADD COLUMN omo_cursor TEXT");
 		if (!columns.some((c) => c.name === "session_started_at")) this.db.exec("ALTER TABLE conversations ADD COLUMN session_started_at TEXT");
 		if (!columns.some((c) => c.name === "handoff")) this.db.exec("ALTER TABLE conversations ADD COLUMN handoff TEXT");
+		if (!columns.some((c) => c.name === "agent_id")) this.db.exec("ALTER TABLE conversations ADD COLUMN agent_id TEXT");
+		if (!columns.some((c) => c.name === "hidden")) this.db.exec("ALTER TABLE conversations ADD COLUMN hidden INTEGER NOT NULL DEFAULT 0");
+		if (columns.some((c) => c.name === "persona_id")) {
+			this.db.transaction(() => {
+				const legacy = this.db.query<{ id: string; persona_id: string }, []>(
+					"SELECT id, persona_id FROM conversations WHERE agent_id IS NULL AND persona_id IS NOT NULL ORDER BY id",
+				).all();
+				let collisions = 0;
+				for (const row of legacy) {
+					const existing = this.db.query<{ id: string }, [string]>("SELECT id FROM conversations WHERE agent_id = ?").get(row.persona_id);
+					if (existing) { collisions++; continue; }
+					this.db.query("UPDATE conversations SET agent_id = ? WHERE id = ?").run(row.persona_id, row.id);
+				}
+				if (collisions > 0) console.warn("agent_legacy_conversation_collisions", { count: collisions });
+			}).immediate();
+		}
 		const memoColumns = this.db.query<{ name: string }, []>("PRAGMA table_info(memo)").all();
 		if (!memoColumns.some((c) => c.name === "images")) this.db.exec("ALTER TABLE memo ADD COLUMN images TEXT NOT NULL DEFAULT '[]'");
 		const deviceColumns = this.db.query<{ name: string }, []>("PRAGMA table_info(devices)").all();
@@ -642,6 +676,9 @@ export class Store {
 			throw error;
 		}
 		this.db.exec(`
+			CREATE TABLE IF NOT EXISTS security_baseline_terms (
+				id TEXT PRIMARY KEY, value TEXT COLLATE BINARY NOT NULL UNIQUE, data TEXT NOT NULL
+			);
 			CREATE TABLE IF NOT EXISTS security_allowed_values (
 				id TEXT PRIMARY KEY, value TEXT COLLATE BINARY NOT NULL UNIQUE, data TEXT NOT NULL
 			);
@@ -663,10 +700,70 @@ export class Store {
 		return this.db.transaction(() => ({
 			revision: this.db.query<{ revision: number }, []>("SELECT revision FROM security_allow_revision WHERE id = 1").get()!.revision,
 			values: this.db.query<{ data: string }, []>("SELECT data FROM security_allowed_values ORDER BY json_extract(data, '$.approvedAt'), id").all()
-				.map((row): AllowedValue => JSON.parse(row.data)),
+				.map((row): AllowedValue => {
+					const value: AllowedValue = JSON.parse(row.data);
+					return { ...value, scopes: value.scopes ?? ["transport"] };
+				}),
 		})).immediate();
 	}
 
+	securityBaselineTerms(): { revision: number; terms: SecurityBaselineTerm[] } {
+		return this.db.transaction(() => ({
+			revision: this.securityAllowedValues().revision,
+			terms: this.db.query<{ data: string }, []>("SELECT data FROM security_baseline_terms ORDER BY rowid").all()
+				.map((row): SecurityBaselineTerm => JSON.parse(row.data)),
+		})).immediate();
+	}
+
+	addSecurityBaselineTerm(value: string, expectedRevision?: number): { revision: number; term: SecurityBaselineTerm } {
+		const normalized = normalizeTerm(value.trim());
+		if (normalized.length === 0) throw new SecurityBaselineError("term_invalid", "empty");
+		if (normalized.length < 3) throw new SecurityBaselineError("term_invalid", "too_short");
+		// The private-list predicate owns LOOPBACK. Public-account masking is not a loopback rejection.
+		if (!normalized.match(PUBLIC_ACCOUNT) &&
+			!findPrivate(normalized, { terms: [normalized], hashes: new Set() }).some((hit) => hit.rule === "private-list")) {
+			throw new SecurityBaselineError("term_invalid", "loopback");
+		}
+		return this.db.transaction(() => {
+			const revision = this.securityAllowedValues().revision;
+			if (expectedRevision !== undefined && revision !== expectedRevision) throw new SecurityBaselineError("baseline_conflict", undefined, revision);
+			if (this.db.query("SELECT id FROM security_baseline_terms WHERE value = ?").get(normalized)) throw new SecurityBaselineError("term_duplicate");
+			const term: SecurityBaselineTerm = { id: crypto.randomUUID(), value: normalized, addedAt: new Date().toISOString() };
+			this.db.query("INSERT INTO security_baseline_terms VALUES (?, ?, ?)").run(term.id, normalized, JSON.stringify(term));
+			this.db.query("UPDATE security_allow_revision SET revision = revision + 1 WHERE id = 1").run();
+			return { revision: revision + 1, term };
+		}).immediate();
+	}
+
+	removeSecurityBaselineTerm(id: string, expectedRevision?: number): { revision: number; removed: number } {
+		return this.db.transaction(() => {
+			let revision = this.securityAllowedValues().revision;
+			if (expectedRevision !== undefined && revision !== expectedRevision) throw new SecurityBaselineError("baseline_conflict", undefined, revision);
+			const removed = this.db.query("DELETE FROM security_baseline_terms WHERE id = ?").run(id).changes;
+			if (removed > 0) {
+				this.db.query("UPDATE security_allow_revision SET revision = revision + 1 WHERE id = 1").run();
+				revision++;
+			}
+			return { revision, removed };
+		}).immediate();
+	}
+
+	setSecurityAllowScopes(id: string, scopes: readonly string[], expectedRevision?: number): { revision: number; value: AllowedValue } {
+		if (scopes[0] !== "transport" || (scopes.length !== 1 && (scopes.length !== 2 || scopes[1] !== "repo"))) {
+			throw new SecurityBaselineError("scopes_invalid");
+		}
+		return this.db.transaction(() => {
+			const { revision, values } = this.securityAllowedValues();
+			if (expectedRevision !== undefined && revision !== expectedRevision) throw new SecurityRuntimeError("allowlist_conflict", undefined, revision);
+			const current = values.find((value) => value.id === id);
+			if (!current) throw new SecurityBaselineError("allowlist_not_found");
+			const value: AllowedValue = { ...current, scopes: scopes.length === 1 ? ["transport"] : ["transport", "repo"] };
+			this.db.query("UPDATE security_allowed_values SET data = ? WHERE id = ?").run(JSON.stringify(value), id);
+			this.db.query("UPDATE security_allow_revision SET revision = revision + 1 WHERE id = 1").run();
+			return { revision: revision + 1, value };
+		}).immediate();
+	}
+
 	securityHolds(): SecurityHoldRecord[] {
 		return this.db.query<{ data: string }, []>("SELECT data FROM security_holds ORDER BY rowid").all().map((row) => JSON.parse(row.data));
 	}
@@ -736,7 +833,7 @@ export class Store {
 				for (const occurrence of occurrences) {
 					const value = occurrence.canonicalValue ?? occurrence.value;
 					const entry: AllowedValue = { id: crypto.randomUUID(), value, kind: occurrence.kind, label: occurrence.label,
-						approvedAt: new Date().toISOString(), approvedBy: approver, heldId: id };
+						approvedAt: new Date().toISOString(), approvedBy: approver, heldId: id, scopes: ["transport"] };
 					added += this.db.query("INSERT OR IGNORE INTO security_allowed_values VALUES (?, ?, ?)").run(entry.id, value, JSON.stringify(entry)).changes;
 				}
 				if (added > 0) {
@@ -1116,25 +1213,35 @@ export class Store {
 		return rows.map((r) => ({ ...r, data: JSON.parse(r.data) as unknown }));
 	}
 
-	listConversations(): ConversationInfo[] {
+	/** Internal callers retain access to hidden rows; snapshots request visible rows only. */
+	listConversations(includeHidden = true): ConversationInfo[] {
 		const rows = this.db
-			.query<{ id: string; title: string; thread_id: string | null; created_at: string }, []>(
-				"SELECT id, title, thread_id, created_at FROM conversations ORDER BY created_at",
+			.query<{ id: string; title: string; thread_id: string | null; created_at: string; agent_id: string | null }, [number]>(
+				"SELECT id, title, thread_id, created_at, agent_id FROM conversations WHERE ? OR hidden = 0 ORDER BY created_at",
 			)
-			.all();
-		return rows.map((r) => ({ id: r.id, title: r.title, threadId: r.thread_id, createdAt: r.created_at }));
+			.all(Number(includeHidden));
+		return rows.map((r) => ({ id: r.id, title: r.title, threadId: r.thread_id, createdAt: r.created_at, agentId: r.agent_id }));
 	}
 
 	getConversation(id: string): ConversationInfo | null {
 		return this.listConversations().find((c) => c.id === id) ?? null;
 	}
 
-	createConversation(id: string, title: string): ConversationInfo {
-		const createdAt = new Date().toISOString();
-		this.db.query("INSERT OR IGNORE INTO conversations (id, title, thread_id, created_at) VALUES (?, ?, NULL, ?)").run(id, title, createdAt);
-		const conv = this.getConversation(id);
-		if (!conv) throw new Error(`conversation_create_failed:${id}`);
-		return conv;
+	createConversation(id: string, title: string, agentId?: string): ConversationInfo {
+		return this.db.transaction(() => {
+			if (agentId !== undefined && this.db.query("SELECT id FROM conversations WHERE agent_id = ?").get(agentId)) {
+				throw new Error("agent_conversation_exists");
+			}
+			const createdAt = new Date().toISOString();
+			this.db.query("INSERT OR IGNORE INTO conversations (id, title, thread_id, created_at, agent_id) VALUES (?, ?, NULL, ?, ?)").run(id, title, createdAt, agentId ?? null);
+			const conv = this.getConversation(id);
+			if (!conv) throw new Error(`conversation_create_failed:${id}`);
+			return conv;
+		}).immediate();
+	}
+
+	setConversationHidden(id: string, hidden: boolean): void {
+		this.db.query("UPDATE conversations SET hidden = ? WHERE id = ?").run(Number(hidden), id);
 	}
 
 	setThread(convId: string, threadId: string): void {
@@ -1171,11 +1278,15 @@ export class Store {
 		}).immediate();
 	}
 
-	/** Acceptance, unsent intent and the optional receipt link commit together before session admission. */
-	acceptMainUser(conv: string, data: unknown, receipt?: (ref: SecurityReceipt) => void): StoredEvent {
+	/**
+	 * Acceptance, unsent intent and the optional receipt link commit together before session admission. A `handled`
+	 * message (improvement 230: `/compact`) is closed in the same transaction, so recovery never sends it as a prompt.
+	 */
+	acceptMainUser(conv: string, data: unknown, receipt?: (ref: SecurityReceipt) => void, handled = false): StoredEvent {
 		return this.db.transaction(() => {
 			const message = this.appendEvent(conv, "message.user", data);
 			this.appendEvent(conv, "main.user.pending", { message_seq: message.seq });
+			if (handled) this.appendEvent(conv, "main.user.dispatched", { message_seq: message.seq, reason: "compact" });
 			receipt?.({ kind: "message", conv, messageSeq: message.seq });
 			return message;
 		}).immediate();
@@ -1230,6 +1341,21 @@ export class Store {
 		return rows.map((r) => ({ ...r, data: JSON.parse(r.data) as unknown }));
 	}
 
+	/**
+	 * Text of the user and assistant messages in the one conversation that belongs to `agentId`.
+	 * The agent join is the only scope: no caller-supplied conversation id exists. `%`, `_` and `\` in the query match literally.
+	 */
+	searchAgentHistory(agentId: string, query: string, limit: number): { seq: number; type: string; ts: string; text: string }[] {
+		if (query === "" || limit < 1) return [];
+		const pattern = `%${query.replace(/[\\%_]/g, "\\$&")}%`;
+		return this.db.query<{ seq: number; type: string; ts: string; text: string }, [string, string, number]>(`
+			SELECT e.seq, e.type, e.ts, json_extract(e.data, '$.text') AS text
+			FROM events AS e JOIN conversations AS c ON c.id = e.conv
+			WHERE c.agent_id = ? AND e.type IN ('message.user', 'message.final')
+				AND json_extract(e.data, '$.text') LIKE ? ESCAPE '\\'
+			ORDER BY e.seq DESC LIMIT ?`).all(agentId, pattern, Math.min(limit, 50));
+	}
+
 	getSetting(key: string): string | null {
 		return this.db.query<{ value: string }, [string]>("SELECT value FROM settings WHERE key = ?").get(key)?.value ?? null;
 	}
@@ -2509,7 +2635,7 @@ export class Store {
 			.map((row) => {
 				const payload: unknown = JSON.parse(row.payload);
 				const title = object(payload) ? payload.title : null;
-				return typeof title === "string" && title.trim() !== "" ? title : "제목 없는 질문";
+				return typeof title === "string" && title.trim() !== "" ? title : say(UNTITLED_QUESTION);
 			});
 	}
 

package/src/transcript.ts

@@ -1,5 +1,6 @@
 import { appendFileSync, existsSync, mkdirSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
+import { say, type Text } from "./server-text.ts";
 import type { Store } from "./store.ts";
 
 export interface TranscriptRecord {
@@ -15,6 +16,8 @@ export interface TranscriptRecord {
 }
 
 const BACKFILL_MARKER = ".backfilled-v1";
+/** Improvement 253: the transcript line of a session change, in the UI language when the line is written. */
+export const SESSION_ROTATED_TEXT: Text = { en: "Engine session switched ({reason}): {from} -> {to}", ko: "엔진 세션 교체 ({reason}): {from} -> {to}" };
 
 /**
  * Append-only conversation log: `<dir>/<conv>/<YYYY-MM-DD>.jsonl`, one JSON record per line, dated in `timeZone`.
@@ -62,7 +65,10 @@ export function toRecord(type: string, data: unknown, base: { ts: string; conv:
 	if (type === "message.user" && typeof d.text === "string") return { ...base, role: "user", text: d.text, src: d.src, trust: d.trust };
 	if (type === "message.final" && typeof d.text === "string") return { ...base, role: "assistant", text: d.text };
 	if (type === "session.rotated") {
-		return { ...base, role: "system", event: "session.rotated", text: `엔진 세션 교체 (${String(d.reason)}): ${String(d.from)} -> ${String(d.to)}` };
+		return { ...base, role: "system", event: "session.rotated", text: say(SESSION_ROTATED_TEXT, { reason: String(d.reason), from: String(d.from), to: String(d.to) }) };
+	}
+	if (type === "agent.applied") {
+		return { ...base, role: "system", event: "agent.applied", text: JSON.stringify({ sha: d.sha, at: d.at }) };
 	}
 	return null;
 }

package/src/ui-language.ts

@@ -0,0 +1,33 @@
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { isLanguage, LANGUAGE_FILE, type Language, saveLanguage } from "./cli/messages.ts";
+
+/**
+ * The gateway-wide UI language of the web and the app (English or Korean). It lives in the install home's `language`
+ * file, the same file the setup wizard writes. A missing or invalid file means English; the locale is not consulted.
+ */
+
+export const UI_LANGUAGE_PATH = "/api/settings/language";
+export const UI_LANGUAGE_EVENT = "ui-language.updated";
+export const DEFAULT_UI_LANGUAGE: Language = "en";
+
+export function readUiLanguage(home: string): Language {
+	const file = join(home, LANGUAGE_FILE);
+	let saved: string | null = null;
+	try { saved = existsSync(file) ? readFileSync(file, "utf8").trim() : null; } catch { saved = null; }
+	return isLanguage(saved) ? saved : DEFAULT_UI_LANGUAGE;
+}
+
+/** GET and PUT of UI_LANGUAGE_PATH on both ports (the app port is already behind the device gate). */
+export async function handleUiLanguage(req: Request, home: string, publish: (language: Language) => void): Promise<Response | null> {
+	const json = (value: unknown, status = 200) => Response.json(value, { status, headers: { "Cache-Control": "no-store" } });
+	if (req.method === "GET") return json({ language: readUiLanguage(home) });
+	if (req.method !== "PUT") return null;
+	const body = (await req.json().catch(() => null)) as { language?: unknown } | null;
+	const language = body?.language;
+	if (!isLanguage(language)) return json({ error: "unknown_language" }, 400);
+	const before = readUiLanguage(home);
+	saveLanguage(home, language);
+	if (language !== before) publish(language);
+	return json({ language });
+}

package/src/update/check.ts

@@ -1,6 +1,7 @@
 import { PROTOCOL_VERSION, type Envelope } from "../protocol.ts";
 import type { InstallKind } from "../runtime/install-kind.ts";
 import type { Env } from "../runtime/paths.ts";
+import { say, type Text } from "../server-text.ts";
 
 /**
  * New version notice (plan Todo 22). The gateway reads `dist-tags.latest` of the `zigmini` package from the npm registry
@@ -14,6 +15,9 @@ export const PACKAGE_NAME = "zigmini";
 export const DEFAULT_REGISTRY = "https://registry.npmjs.org";
 export const CHECK_INTERVAL_MS = 6 * 60 * 60_000;
 export const LOOKUP_TIMEOUT_MS = 15_000;
+const REGISTRY_HTTP: Text = { en: "Registry HTTP {status}", ko: "레지스트리 HTTP {status}" };
+const NO_LATEST: Text = { en: "The registry response has no dist-tags.latest version", ko: "레지스트리 응답에 dist-tags.latest 버전이 없음" };
+const TIMED_OUT: Text = { en: "Timed out ({seconds} s)", ko: "시간 초과 ({seconds}초)" };
 export const RETRY_MS = 5 * 60_000;
 export const UPDATE_STATUS_PATH = "/api/update/status";
 export const UPDATE_CHECK_PATH = "/api/update/check";
@@ -77,13 +81,13 @@ export type LookupResult = { readonly ok: true; readonly latest: string } | { re
 export async function lookupLatest(url: string, fetcher: typeof fetch, timeoutMs: number): Promise<LookupResult> {
 	try {
 		const res = await fetcher(url, { signal: AbortSignal.timeout(timeoutMs), headers: { accept: "application/vnd.npm.install-v1+json, application/json" } });
-		if (!res.ok) return { ok: false, error: `레지스트리 HTTP ${res.status}` };
+		if (!res.ok) return { ok: false, error: say(REGISTRY_HTTP, { status: res.status }) };
 		const body = (await res.json()) as { "dist-tags"?: { latest?: unknown } } | null;
 		const latest = body?.["dist-tags"]?.latest;
-		if (typeof latest !== "string" || parseVersion(latest) === null) return { ok: false, error: "레지스트리 응답에 dist-tags.latest 버전이 없음" };
+		if (typeof latest !== "string" || parseVersion(latest) === null) return { ok: false, error: say(NO_LATEST) };
 		return { ok: true, latest };
 	} catch (error) {
-		if (error instanceof Error && (error.name === "TimeoutError" || error.name === "AbortError")) return { ok: false, error: `시간 초과 (${timeoutMs / 1000}초)` };
+		if (error instanceof Error && (error.name === "TimeoutError" || error.name === "AbortError")) return { ok: false, error: say(TIMED_OUT, { seconds: timeoutMs / 1000 }) };
 		return { ok: false, error: error instanceof Error ? error.message : String(error) };
 	}
 }