zigmini 0.9.0-beta.3 → 1.0.0-beta.2

package/src/main.ts

@@ -1,10 +1,15 @@
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync, realpathSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join, normalize } from "node:path";
 import type { Server, ServerWebSocket, WebSocketHandler } from "bun";
 import { createSttProvider } from "./adapters/voice/stt.ts";
 import { createTtsProvider, speakableText, splitForTts } from "./adapters/voice/tts.ts";
-import { handleHeld, handleSecurityAllowedValues, handleSecurityCheckSetting, MessageGuard, SECURITY_CHECK_PATH, SECURITY_HELD_PATH, SECURITY_ALLOWED_PATH, SecurityCheckError, defaultChecker } from "./security-check.ts";
+import { handleHeld, handleSecurityAllowedValues, handleSecurityBaseline, handleSecurityCheckSetting, MessageGuard, SECURITY_BASELINE_PATH, SECURITY_CHECK_PATH, SECURITY_HELD_PATH, SECURITY_ALLOWED_PATH, SecurityCheckError, defaultChecker } from "./security-check.ts";
+import { defaultFormalDeps, FormalVerification, handleFormalVerification } from "./formal-verification.ts";
+import { handleRepoSecurityCheckSetting, REPO_SECURITY_CHECK_PATH } from "./repo-security-setting.ts";
+import { handleUiLanguage, readUiLanguage, UI_LANGUAGE_EVENT, UI_LANGUAGE_PATH } from "./ui-language.ts";
+import { say, setServerLanguage } from "./server-text.ts";
+import { SecurityBaseline } from "./security-baseline.ts";
 import { handleVoiceInstall, handleVoiceSetting, routeVoiceApi, VOICE_INSTALL_PATH, VOICE_SETTING_PATH, voiceGate, voiceUpdated } from "./voice-api.ts";
 import { readVoiceSetting, VoiceSetting } from "./voice-setting.ts";
 import { applyVoiceAgents } from "./voice/agents.ts";
@@ -65,13 +70,18 @@ import { engine } from "./engine/index.ts";
 import { manifestOf } from "./engine/install.ts";
 import { launchUpdater, systemContext, systemDeps } from "./cli/launchd.ts";
 import { acceptUpdateConsent, requestUpdate, type UpdateApiDeps } from "./update/request.ts";
-import { PHASE_LABELS, readState, UPDATE_CONSENT_PATH, UPDATE_PATH, UPDATE_STATE_PATH, updateDir, UpdateWatcher } from "./update/state.ts";
+import { phaseLabel, readState, UPDATE_CONSENT_PATH, UPDATE_PATH, UPDATE_STATE_PATH, updateDir, UpdateWatcher } from "./update/state.ts";
 import { resolveTarget, tarEntry } from "./update/target.ts";
 import { registryUrl, UPDATE_CHECK_PATH, UPDATE_STATUS_PATH, UpdateChecker, versionAvailableEnvelope } from "./update/check.ts";
 import { MANUAL_PATH, serveManual } from "./manual.ts";
 import { clean as gcClean, GC_CLEAN_PATH, GC_PATH, type GcRoots, parseSelection as parseGcSelection, report as gcReport, systemGcDeps } from "./gc.ts";
+import { mergeAgentDefinition, parseAgentDefinition, AgentDefinitionError } from "./agent/definition.ts";
+import { AgentApi } from "./agent/api.ts";
+import { AgentFileStore } from "./agent/files.ts";
+import { agentList } from "./agent/list.ts";
 
 // Exit 0 so launchd (KeepAlive SuccessfulExit=false) does not restart a gateway that has no consent.
+setServerLanguage(() => readUiLanguage(runtimeHome()));
 const consentRefusal = startRefusal(runtimeHome(), installKind(), () => loadNotice());
 if (consentRefusal !== null) {
 	console.error(`${new Date().toISOString()} ${consentRefusal}`);
@@ -83,11 +93,16 @@ const runtime = runtimePaths();
 const schemaRun = runtimePaths().run;
 const gcHome = runtimePaths();
 const gcRoots: GcRoots = { kind: installKind(), home: gcHome.home, backups: join(config.dataDir, "backups"), omo: gcHome.omo,
-	update: join(gcHome.home, "update"), tmp: process.env.TMPDIR || tmpdir() };
+	update: join(gcHome.home, "update"), tmp: process.env.TMPDIR || tmpdir(), agents: gcHome.agents };
 const gcDeps = systemGcDeps(join(import.meta.dir, ".."), { ...process.env, ZIGMINI_HOME: gcHome.home });
 const store = new Store(config.dataDir);
 const GATEWAY_ID = gatewayId(store);
 const GATEWAY_VERSION = (JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")) as { version: string }).version;
+const securityBaseline = new SecurityBaseline(store, { secrets: runtime.secrets, gatewayVersion: GATEWAY_VERSION });
+// Improvement 250: formal verification switches; installs run in the gateway process and report through this event.
+const formalVerification = new FormalVerification(runtime.formalVerificationFile, runtime.formalToolsDir, defaultFormalDeps(), (state) => publish({
+	v: PROTOCOL_VERSION, id: crypto.randomUUID(), ts: new Date().toISOString(), conv: "*", type: "formal-verification.updated", data: state,
+}));
 const exchangeLimiter = new RateLimiter(EXCHANGE_LIMIT, EXCHANGE_WINDOW_MS);
 const apkSource = new ApkSource(APK_DIR);
 const downloadLinks = new DownloadLinks(Date.now);
@@ -154,12 +169,16 @@ let securityDecisionRefresh = () => {};
 const securityEvent = (type: string, data: unknown) => publish({
 	v: PROTOCOL_VERSION, id: crypto.randomUUID(), ts: new Date().toISOString(), conv: "*", type, data,
 });
+const securityAllowedUpdated = (revision: number) => {
+	securityBaseline.export();
+	securityEvent("security-check.allowed-values.updated", { revision });
+};
 const messageGuard = new MessageGuard(defaultChecker(), runtimePaths().securityCheckFile, (held) => publish({
 	v: PROTOCOL_VERSION, id: crypto.randomUUID(), ts: new Date().toISOString(), conv: held.conv, type: "security-check.held", data: held,
 }), { store, state: (state) => {
 	securityEvent("security-check.state", state);
 	if (state.status === "sent" || state.status === "cancelled") securityEvent("security-check.resolved", { id: state.id, outcome: state.status === "sent" ? "sent" : "dropped" });
-}, allowedUpdated: (revision) => securityEvent("security-check.allowed-values.updated", { revision }),
+}, allowedUpdated: securityAllowedUpdated,
 	decisionUpdated: () => securityDecisionRefresh() });
 const hub = new Hub(
 	store,
@@ -185,6 +204,8 @@ const hub = new Hub(
 	},
 	(e) => publish(e),
 );
+const agentFiles = new AgentFileStore();
+const agentApi = new AgentApi(agentFiles, store, hub);
 const watcher = new WorkWatcher(store, {
 	requestStatus: (workId, requestKey, instructions) => {
 		work.requestStatus(workId, requestKey, instructions);
@@ -513,7 +534,7 @@ async function handleClient(ws: ServerWebSocket<Conn>, raw: string): Promise<voi
 			return;
 		case "conversation.rotate":
 			await hub.rotateSession(msg.conv, "manual").catch((e) => {
-				const message = e instanceof Error && e.message === "turn_running" ? ROTATION_HELD_MESSAGE : String(e);
+				const message = e instanceof Error && e.message === "turn_running" ? say(ROTATION_HELD_MESSAGE) : String(e);
 				ws.send(envelope("error", { message }, msg.conv));
 			});
 			return;
@@ -580,9 +601,51 @@ function deviceAdmin(req: Request, url: URL): Response {
 
 async function handle(req: Request, srv: Server<Conn>, trusted: boolean): Promise<Response | undefined> {
 	const url = new URL(req.url);
+	if (url.pathname === "/api/agents" || url.pathname.startsWith("/api/agents/")) {
+		return agentApi.handle(req, trusted);
+	}
 	if (url.pathname === "/internal/maintenance") return maintenance.handle(req, trusted);
 	if (url.pathname === "/internal/runtime") return runtimeApi(req, trusted);
 	if (url.pathname === "/internal/work") return hub.admitWorkRequest(() => work.handleHttp(req, trusted, omoToken));
+	if (url.pathname === "/internal/agent-list") {
+		const denied = maintenanceAuth(req, trusted, omoToken);
+		if (denied) return denied;
+		if (req.method !== "GET") return Response.json({ error: "method_not_allowed" }, { status: 405 });
+		return Response.json(agentList(agentFiles.list(), store.listConversations(false)));
+	}
+	if (url.pathname === "/internal/agent-history") {
+		const denied = maintenanceAuth(req, trusted, omoToken);
+		if (denied) return denied;
+		if (req.method !== "GET") return Response.json({ error: "method_not_allowed" }, { status: 405 });
+		const agent = url.searchParams.get("agent") ?? "";
+		const query = url.searchParams.get("query") ?? "";
+		if (!/^[a-zA-Z0-9_-]+$/.test(agent)) return Response.json({ error: "invalid_agent_id" }, { status: 400 });
+		if (query === "" || query.length > 200) return Response.json({ error: "invalid_query" }, { status: 400 });
+		const requested = Number(url.searchParams.get("limit") ?? "20");
+		const limit = Number.isInteger(requested) ? Math.min(Math.max(requested, 1), 50) : 20;
+		return Response.json({ hits: store.searchAgentHistory(agent, query, limit) });
+	}
+	if (url.pathname.startsWith("/internal/agent/")) {
+		const denied = maintenanceAuth(req, trusted, omoToken);
+		if (denied) return denied;
+		if (req.method !== "GET") return Response.json({ error: "method_not_allowed" }, { status: 405 });
+		const id = url.pathname.slice("/internal/agent/".length);
+		if (!/^[a-zA-Z0-9_-]+$/.test(id)) return Response.json({ error: "invalid_agent_id" }, { status: 400 });
+		try {
+			const root = realpathSync(join(runtimeHome(), "agents"));
+			const file = realpathSync(join(root, id, "agent.md"));
+			if (!file.startsWith(`${root}/${id}/`)) return Response.json({ error: "agent_path_outside_root" }, { status: 400 });
+			const agent = parseAgentDefinition(readFileSync(file, "utf8"));
+			const defaultsPath = join(root, "defaults.md");
+			if (existsSync(defaultsPath) && realpathSync(defaultsPath) !== defaultsPath) return Response.json({ error: "agent_defaults_symlink" }, { status: 400 });
+			const defaults = existsSync(defaultsPath) ? parseAgentDefinition(readFileSync(defaultsPath, "utf8"), "defaults") : undefined;
+			return Response.json(mergeAgentDefinition(agent, defaults));
+		} catch (error) {
+			if (error instanceof AgentDefinitionError) return Response.json({ error: "invalid_agent_definition", field: error.field }, { status: 400 });
+			if (error instanceof Error && "code" in error && error.code === "ENOENT") return Response.json({ error: "agent_not_found" }, { status: 404 });
+			throw error;
+		}
+	}
 	if (url.pathname === "/internal/omo-check") return hub.admitWorkRequest(() => omoCheck.handle(req, trusted));
 	let deviceId: string | null = null;
 	if (trusted) {
@@ -666,8 +729,30 @@ async function handle(req: Request, srv: Server<Conn>, trusted: boolean): Promis
 		const response = await handleHeld(req, url, messageGuard, () => {}, { client: trusted ? "web" : "android", deviceId });
 		if (response) return response;
 	}
+	if (url.pathname === SECURITY_BASELINE_PATH || url.pathname.startsWith(`${SECURITY_BASELINE_PATH}/`) ||
+		(req.method === "PATCH" && url.pathname.startsWith(`${SECURITY_ALLOWED_PATH}/`))) {
+		const response = await handleSecurityBaseline(req, url, trusted, store, securityBaseline,
+			(revision) => securityEvent("security-check.allowed-values.updated", { revision }));
+		if (response) return response;
+	}
 	if (url.pathname === SECURITY_ALLOWED_PATH || url.pathname.startsWith(`${SECURITY_ALLOWED_PATH}/`)) {
-		const response = await handleSecurityAllowedValues(req, url, store, (revision) => securityEvent("security-check.allowed-values.updated", { revision }));
+		const response = await handleSecurityAllowedValues(req, url, store, securityAllowedUpdated);
+		if (response) return response;
+	}
+	if (url.pathname === REPO_SECURITY_CHECK_PATH) {
+		const response = await handleRepoSecurityCheckSetting(req, trusted, runtime.repoSecurityCheckFile, (enabled) => publish({
+			v: PROTOCOL_VERSION, id: crypto.randomUUID(), ts: new Date().toISOString(), conv: "*", type: "repo-security-check.updated", data: { enabled },
+		}));
+		if (response) return response;
+	}
+	{
+		const response = await handleFormalVerification(req, url, trusted, formalVerification);
+		if (response) return response;
+	}
+	if (url.pathname === UI_LANGUAGE_PATH) {
+		const response = await handleUiLanguage(req, runtimeHome(), (language) => publish({
+			v: PROTOCOL_VERSION, id: crypto.randomUUID(), ts: new Date().toISOString(), conv: "*", type: UI_LANGUAGE_EVENT, data: { language },
+		}));
 		if (response) return response;
 	}
 	if (url.pathname === SECURITY_CHECK_PATH) {
@@ -688,13 +773,13 @@ async function handle(req: Request, srv: Server<Conn>, trusted: boolean): Promis
 		return Response.json(answer.body, { status: answer.status });
 	}
 	if (url.pathname === UPDATE_CONSENT_PATH && req.method === "POST") {
-		if (!trusted) return Response.json({ ok: false, code: "forbidden", message: "권한 동의는 맥에서만 받습니다" }, { status: 403 });
+		if (!trusted) return Response.json({ ok: false, code: "forbidden", message: say({ en: "Permission consent is only accepted on the Mac", ko: "권한 동의는 맥에서만 받습니다" }) }, { status: 403 });
 		const answer = await acceptUpdateConsent(await req.json().catch(() => null), updateApi);
 		return Response.json(answer.body, { status: answer.status });
 	}
 	if (url.pathname === UPDATE_STATE_PATH && req.method === "GET") {
 		const state = readState(runtime.home);
-		return Response.json(state === null ? null : { ...state, label: PHASE_LABELS[state.phase] });
+		return Response.json(state === null ? null : { ...state, label: phaseLabel(state.phase) });
 	}
 	// Reserve before parsing bodies: decisions, voice and auxiliary workers can
 	// otherwise cross native admission after a maintenance check.
@@ -746,6 +831,7 @@ async function routeApi(req: Request, url: URL): Promise<Response> {
 		return Response.json({
 			ok: true,
 			omo: omoHealth,
+			security: securityBaseline.status(),
 			...(omoHealth === SCHEMA_TOO_NEW ? { schemaGuard: schema?.message } : {}),
 			stt: stt.name,
 			tts: tts.name,

package/src/maintenance.ts

@@ -186,7 +186,7 @@ export async function nativeMaintenanceBlocker(
 			row.kind !== "interactive" ||
 			owners.get(row.sessionId) !== row.sessionPath ||
 			!record(row.context) ||
-			row.context.zgw_role !== "main"
+			(row.context.zgw_role !== "main" && row.context.zgw_role !== "agent")
 		) {
 			return "native_owner_unverified";
 		}

package/src/manual.ts

@@ -1,4 +1,5 @@
 import { join } from "node:path";
+import { say, type Text } from "./server-text.ts";
 
 /**
  * The user manual (docs/manual.md, docs/manual.ko.md) for the web 설정 "매뉴얼" button and the app's work status screen.
@@ -8,6 +9,12 @@ export const MANUAL_PATH = "/api/manual";
 export const MANUAL_DIR = join(import.meta.dir, "..", "docs");
 export type ManualLang = "ko" | "en";
 
+const UNKNOWN_LANG: Text = { en: "lang must be ko or en.", ko: "lang은 ko 또는 en입니다." };
+const MANUAL_MISSING: Text = {
+	en: "This installation has no manual file. Update the gateway.",
+	ko: "이 설치에는 매뉴얼 파일이 없습니다. 게이트웨이를 업데이트하세요.",
+};
+
 /** The `lang` query value as a language: missing or empty is Korean; anything but `ko` or `en` is null. */
 export function manualLang(value: string | null): ManualLang | null {
 	if (value === null || value === "" || value === "ko") return "ko";
@@ -22,10 +29,10 @@ export function manualFile(lang: ManualLang): string {
 export async function serveManual(req: Request, url: URL, dir: string = MANUAL_DIR): Promise<Response> {
 	if (req.method !== "GET") return Response.json({ error: "method_not_allowed" }, { status: 405 });
 	const lang = manualLang(url.searchParams.get("lang"));
-	if (lang === null) return Response.json({ error: "unknown_lang", message: "lang은 ko 또는 en입니다." }, { status: 400 });
+	if (lang === null) return Response.json({ error: "unknown_lang", message: say(UNKNOWN_LANG) }, { status: 400 });
 	const file = Bun.file(join(dir, manualFile(lang)));
 	if (!(await file.exists())) {
-		return Response.json({ error: "manual_missing", message: "이 설치에는 매뉴얼 파일이 없습니다. 게이트웨이를 업데이트하세요." }, { status: 404 });
+		return Response.json({ error: "manual_missing", message: say(MANUAL_MISSING) }, { status: 404 });
 	}
 	return new Response(file, { headers: { "content-type": "text/markdown; charset=utf-8", "cache-control": "no-cache", "content-language": lang } });
 }

package/src/profile-prompt.ts

@@ -0,0 +1,73 @@
+import { NICKNAME_DEFAULT, type Profile } from "./profile.ts";
+import { isTextOf } from "./server-text.ts";
+import { readFileSync } from "node:fs";
+import { runtimePaths } from "./runtime/paths.ts";
+
+export type PromptProfile = {
+	readonly nickname: string | undefined;
+	readonly agentName: string;
+};
+export const PROFILE_TIMEOUT_MS = 1_000;
+
+/** Read once per turn; a failed request keeps this session's last known profile. */
+export async function readPromptProfile(fallback: PromptProfile): Promise<PromptProfile> {
+	try {
+		const base = process.env.ZGW_WORK_URL ?? `http://127.0.0.1:${process.env.ZGW_PORT ?? "8700"}`;
+		const response = await fetch(new URL("/api/profile", base), { signal: AbortSignal.timeout(PROFILE_TIMEOUT_MS) });
+		if (!response.ok) throw new Error("profile_http");
+		const data: unknown = await response.json();
+		const profile = parseProfile(data);
+		if (!profile) throw new Error("profile_invalid");
+		return profile;
+	} catch { // This HTTP boundary deliberately handles unavailable or invalid gateway responses.
+		console.warn("gateway profile: keeping last known values");
+		return fallback;
+	}
+}
+
+function parseProfile(data: unknown): Profile | undefined {
+	if (typeof data !== "object" || data === null || !("nickname" in data) || !("agentName" in data)) return undefined;
+	if (typeof data.nickname !== "string" || typeof data.agentName !== "string") return undefined;
+	const agentName = data.agentName.replace(/\s+/g, " ").trim();
+	if (!agentName) return undefined;
+	return { nickname: data.nickname, agentName };
+}
+
+/** Profile data is quoted and kept on one line, independently of rule-file toggles. */
+export function nicknamePrompt(nickname: string | undefined): string {
+	if (nickname === undefined) return "The user's gateway profile nickname is unavailable.";
+	const name = promptName(nickname);
+	if (!name || isTextOf(name, NICKNAME_DEFAULT)) return "The user has not set a gateway profile nickname. Do not use the built-in default as their name.";
+	return `The user's gateway profile nickname is ${JSON.stringify(name)}. Address the user by it as the rules say.`;
+}
+
+function promptName(name: string): string {
+	return name.replace(/[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/gu, "").trim();
+}
+
+/** Only the name refreshes; the agent's definition, tools and memory keep their session snapshots. */
+export async function readAgentPromptName(id: string, fallback: string): Promise<string> {
+	try {
+		const token = readFileSync(runtimePaths().omoTokenFile, "utf8").trim();
+		const base = process.env.ZGW_WORK_URL ?? `http://127.0.0.1:${process.env.ZGW_PORT ?? "8700"}`;
+		const response = await fetch(new URL(`/internal/agent/${encodeURIComponent(id)}`, base), {
+			headers: { authorization: `Bearer ${token}` }, redirect: "error", signal: AbortSignal.timeout(5_000),
+		});
+		if (!response.ok) throw new Error("agent_profile_http");
+		const data: unknown = await response.json();
+		if (typeof data !== "object" || data === null || !("fields" in data) ||
+			typeof data.fields !== "object" || data.fields === null || !("name" in data.fields) ||
+			typeof data.fields.name !== "string") throw new Error("agent_profile_invalid");
+		const name = promptName(data.fields.name);
+		if (!name) throw new Error("agent_profile_name_missing");
+		return name;
+	} catch { // This HTTP boundary retains the validated session-start name on refresh failure.
+		console.warn("agent profile: keeping last known name");
+		return fallback;
+	}
+}
+
+export function agentNamePrompt(name: string): string {
+	const quoted = JSON.stringify(promptName(name));
+	return `Your name is ${quoted}. The user calls you ${quoted}.`;
+}

package/src/profile.ts

@@ -1,13 +1,15 @@
 // The owner's profile nickname and the agent's (gateway main) name, kept in the gateway settings so every web browser,
 // the phone and the main session see the same names. The web (web/profile.js) applies the same rules for its local cache.
+import { isTextOf, say, type Text } from "./server-text.ts";
 import type { Store } from "./store.ts";
 
 export const NICKNAME_SETTING = "profile.nickname";
-export const DEFAULT_NICKNAME = "나";
+/** Built-in default names. They follow the saved UI language; a stored built-in default of either language reads as the current one. */
+export const NICKNAME_DEFAULT: Text = { en: "Me", ko: "나" };
 export const NICKNAME_MAX = 20;
 
 export const AGENT_NAME_SETTING = "profile.agentName";
-export const DEFAULT_AGENT_NAME = "지그";
+export const AGENT_NAME_DEFAULT: Text = { en: "Zig", ko: "지그" };
 /** Display-width units: Hangul, CJK and full-width characters count 2, ASCII and half-width characters 1. */
 export const AGENT_NAME_WIDTH = 20;
 
@@ -19,10 +21,31 @@ export interface Profile {
 export type ProfileError = "nickname_required" | "agent_name_required" | "agent_name_too_long";
 export type ProfileSave = { readonly profile: Profile } | { readonly error: ProfileError };
 
-/** Whitespace collapsed and trimmed, at most NICKNAME_MAX characters; blank becomes the default. */
-export function normalizeNickname(value: string): string {
+/** The nickname default in the current UI language. */
+export function defaultNickname(): string {
+	return say(NICKNAME_DEFAULT);
+}
+
+/** The agent name default in the current UI language. */
+export function defaultAgentName(): string {
+	return say(AGENT_NAME_DEFAULT);
+}
+
+/** The user's own nickname: whitespace collapsed and trimmed, at most NICKNAME_MAX characters; "" for blank or a built-in default. */
+function ownNickname(value: string): string {
+	const name = [...value.replace(/\s+/g, " ").trim()].slice(0, NICKNAME_MAX).join("");
+	return isTextOf(name, NICKNAME_DEFAULT) ? "" : name;
+}
+
+/** The user's own agent name: whitespace collapsed and trimmed; "" for blank or a built-in default. */
+function ownAgentName(value: string): string {
 	const name = value.replace(/\s+/g, " ").trim();
-	return name ? [...name].slice(0, NICKNAME_MAX).join("") : DEFAULT_NICKNAME;
+	return isTextOf(name, AGENT_NAME_DEFAULT) ? "" : name;
+}
+
+/** The nickname to show: the user's own, else the current language's default. */
+export function normalizeNickname(value: string): string {
+	return ownNickname(value) || defaultNickname();
 }
 
 /** True for a code point shown two columns wide: Hangul, CJK, full-width forms and wide emoji. */
@@ -41,12 +64,12 @@ export function displayWidth(text: string): number {
 }
 
 export function normalizeAgentName(value: string): string {
-	return value.replace(/\s+/g, " ").trim() || DEFAULT_AGENT_NAME;
+	return ownAgentName(value) || defaultAgentName();
 }
 
 function storedAgentName(value: string | null): string {
-	const name = normalizeAgentName(value ?? "");
-	return displayWidth(name) <= AGENT_NAME_WIDTH ? name : DEFAULT_AGENT_NAME;
+	const name = ownAgentName(value ?? "");
+	return name && displayWidth(name) <= AGENT_NAME_WIDTH ? name : defaultAgentName();
 }
 
 export function readProfile(store: Pick<Store, "getSetting">): Profile {
@@ -66,9 +89,9 @@ export function saveProfile(store: Pick<Store, "getSetting" | "setSetting">, bod
 	if (nickname === undefined && agentName === undefined) return { error: "nickname_required" };
 	if (nickname !== undefined && typeof nickname !== "string") return { error: "nickname_required" };
 	if (agentName !== undefined && typeof agentName !== "string") return { error: "agent_name_required" };
-	const name = agentName === undefined ? undefined : normalizeAgentName(agentName);
+	const name = agentName === undefined ? undefined : ownAgentName(agentName);
 	if (name !== undefined && displayWidth(name) > AGENT_NAME_WIDTH) return { error: "agent_name_too_long" };
-	if (nickname !== undefined) store.setSetting(NICKNAME_SETTING, normalizeNickname(nickname));
+	if (nickname !== undefined) store.setSetting(NICKNAME_SETTING, ownNickname(nickname));
 	if (name !== undefined) store.setSetting(AGENT_NAME_SETTING, name);
 	return { profile: readProfile(store) };
 }

package/src/protocol.ts

@@ -1,7 +1,15 @@
+import type { Text } from "./server-text.ts";
+
 export const PROTOCOL_VERSION = 1;
 
-/** The `error` message a refused `conversation.rotate` gets when a turn or an open wait holds the session (hub `turn_running`). */
-export const ROTATION_HELD_MESSAGE = "진행 중이거나 확인되지 않은 작업이 있어 같은 세션을 유지합니다.";
+/**
+ * The `error` message a refused `conversation.rotate` gets when a turn or an open wait holds the session (hub `turn_running`).
+ * The sender picks the language with say(); a reader compares with isTextOf() so both languages are recognized.
+ */
+export const ROTATION_HELD_MESSAGE: Text = {
+	en: "The same session is kept because some work is in progress or not yet confirmed.",
+	ko: "진행 중이거나 확인되지 않은 작업이 있어 같은 세션을 유지합니다.",
+};
 
 export type Channel = "web" | "app" | "home" | "hud" | "discord";
 export type Trust = "owner" | "owner-voice" | "unknown";
@@ -51,6 +59,7 @@ export interface ConversationInfo {
 	title: string;
 	threadId: string | null;
 	createdAt: string;
+	readonly agentId: string | null;
 }
 
 export interface ConversationActivity {

package/src/question-notifications.ts

@@ -1,4 +1,7 @@
 import type { Envelope } from "./protocol.ts";
+import { say, type Text } from "./server-text.ts";
+
+const DEFAULT_TITLE: Text = { en: "An answer is needed", ko: "답변이 필요합니다" };
 
 export interface QuestionNotification {
 	readonly id: string;
@@ -35,7 +38,7 @@ function questionText(data: Record<string, unknown>, fallback: string): string {
 function notificationOf(data: unknown, envelopeConv = "*"): QuestionNotification | null {
 	if (!isRecord(data) || data.method !== "question" || typeof data.actionId !== "string" || !data.actionId) return null;
 	const conv = typeof data.conv === "string" && data.conv ? data.conv : envelopeConv;
-	const title = typeof data.title === "string" && data.title.trim() ? data.title.trim() : "답변이 필요합니다";
+	const title = typeof data.title === "string" && data.title.trim() ? data.title.trim() : say(DEFAULT_TITLE);
 	return {
 		id: `question:${data.actionId}`,
 		conv,

package/src/reply-notifications.ts

@@ -64,10 +64,16 @@ export class ReplyNotifications<Connection extends object> {
 	/** The read's revision is captured before RPC, so a toggle cannot admit an older in-flight read. */
 	observe(source: NativeReplySource, entries: readonly NativeReplyEntry[], revision: string): void {
 		if (revision !== this.revision()) return;
+		const conv = this.store.getConversation(source.conv);
+		const applied = conv?.agentId
+			? this.store.getEvent(this.store.lastSeq(source.conv, "agent.applied")) : null;
+		const agentNotify = !conv?.agentId || (applied !== null &&
+			applied.seq > this.store.lastSeq(source.conv, "session.rotated") &&
+			typeof applied.data === "object" && applied.data !== null && "notify" in applied.data && applied.data.notify === true);
 		for (const entry of entries) {
 			if (typeof entry.id !== "string" || !entry.id) throw new Error("reply_history_entry_without_id");
 			const text = replyText(entry);
-			const notification = this.settings().mode === "all-replies" && text !== null ? {
+			const notification = this.settings().mode === "all-replies" && agentNotify && text !== null ? {
 				id: crypto.randomUUID(), conv: source.conv, title: source.title, text,
 				...(source.workId ? { workId: source.workId } : {}),
 			} : null;

package/src/repo-security-setting.ts

@@ -0,0 +1,33 @@
+import { readVoiceSetting, writeVoiceSetting } from "./voice-setting.ts";
+import type { Language } from "./cli/messages.ts";
+
+/**
+ * Improvement 250: the output check switch ("결과물 검사", the repository security check), separate from the check of
+ * messages to the engine (security-check.ts). On (the default) `zigmini scan` runs and the package agent rules tell
+ * sessions to run it before a merge. Off makes `zigmini scan` stop with SCAN_DISABLED_EXIT and removes that rule from
+ * new sessions. This repository's test:all security checks use the scan library directly and do not read this switch:
+ * the "check before a dev merge" duty is the operator's rule, not a gateway feature.
+ */
+export const SCAN_DISABLED_EXIT = 4;
+const DISABLED_TEXT = {
+	en: "Output check is off in the gateway settings; zigmini scan did not run (exit 4). Turn on \"Output check\" to scan.",
+	ko: "게이트웨이 설정에서 결과물 검사가 꺼져 있어 zigmini scan을 실행하지 않았습니다(종료 코드 4). 검사하려면 \"결과물 검사\"를 켜세요.",
+} as const;
+
+/** The notice when the switch is off, else null; --help still works while it is off. */
+export function scanDisabledNotice(file: string, argv: readonly string[], lang: Language): string | null {
+	if (argv.includes("--help") || argv.includes("-h") || readVoiceSetting(file)) return null;
+	return DISABLED_TEXT[lang];
+}
+export const REPO_SECURITY_CHECK_PATH = "/api/settings/repo-security-check";
+
+export async function handleRepoSecurityCheckSetting(req: Request, trusted: boolean, file: string, publish: (enabled: boolean) => void): Promise<Response | null> {
+	if (req.method === "GET") return Response.json({ enabled: readVoiceSetting(file) });
+	if (req.method !== "PUT") return null;
+	if (!trusted) return Response.json({ error: "forbidden" }, { status: 403 });
+	const body = (await req.json().catch(() => null)) as { enabled?: unknown } | null;
+	if (typeof body?.enabled !== "boolean") return Response.json({ error: "enabled_required" }, { status: 400 });
+	writeVoiceSetting(file, body.enabled);
+	publish(body.enabled);
+	return Response.json({ enabled: body.enabled });
+}

package/src/runtime/paths.ts

@@ -34,6 +34,7 @@ export interface RuntimePorts {
 
 export interface RuntimePaths {
 	readonly home: string;
+	readonly agents: string;
 	readonly layout: Layout;
 	readonly data: string;
 	readonly transcripts: string;
@@ -42,6 +43,9 @@ export interface RuntimePaths {
 	readonly scheduleFile: string;
 	readonly voiceSettingFile: string;
 	readonly securityCheckFile: string;
+	readonly repoSecurityCheckFile: string;
+	readonly formalVerificationFile: string;
+	readonly formalToolsDir: string;
 	readonly logs: string;
 	readonly secrets: string;
 	readonly omoTokenFile: string;
@@ -102,6 +106,7 @@ export function runtimePaths(env: Env = process.env, exists: (path: string) => b
 	const suffix = slotSuffix(slot);
 	return {
 		home,
+		agents: join(home, "agents"),
 		layout,
 		data,
 		transcripts: value(env, "ZGW_TRANSCRIPT_DIR") ?? join(data, "transcripts"),
@@ -110,6 +115,9 @@ export function runtimePaths(env: Env = process.env, exists: (path: string) => b
 		scheduleFile: value(env, "ZGW_SCHEDULE_FILE") ?? join(data, "schedule.json"),
 		voiceSettingFile: value(env, "ZGW_VOICE_SETTING_FILE") ?? join(data, "voice-setting"),
 		securityCheckFile: value(env, "ZGW_SECURITY_CHECK_FILE") ?? join(data, "security-check"),
+		repoSecurityCheckFile: value(env, "ZGW_REPO_SECURITY_CHECK_FILE") ?? join(data, "repo-security-check"),
+		formalVerificationFile: value(env, "ZGW_FORMAL_VERIFICATION_FILE") ?? join(data, "formal-verification.json"),
+		formalToolsDir: value(env, "ZGW_FORMAL_TOOLS_DIR") ?? join(home, "formal-tools"),
 		logs: join(home, "logs"),
 		secrets,
 		omoTokenFile: value(env, "ZGW_OMO_TOKEN_FILE") ?? join(secrets, "omo-ws-token"),
@@ -135,3 +143,11 @@ export function runtimePaths(env: Env = process.env, exists: (path: string) => b
 		},
 	};
 }
+
+/** Baseline consumers share runtime home resolution without changing the gateway's existing path object. */
+export function securityBaselinePaths(env: Env = process.env, paths: Pick<RuntimePaths, "secrets"> = runtimePaths(env)) {
+	return {
+		securityBaselineFile: value(env, "ZGW_SECURITY_BASELINE_FILE") ?? join(paths.secrets, "security-baseline.json"),
+		legacyPrivateStringsFile: value(env, "ZIGMINI_PRIVATE_STRINGS") ?? join(value(env, "HOME") ?? homedir(), ".zigmini-release", "private-strings"),
+	};
+}