zigmini 0.9.0-beta.3 → 1.0.0-beta.2

package/docs/manual.md

@@ -19,7 +19,7 @@ zigmini has two surfaces.
 
 The web screen has three parts.
 
-- Left sidebar: the conversation list, the new conversation button (+), the work status area, your profile and the agent profile. The "엔진" (engine) badge at the top shows the engine connection.
+- Left sidebar: the default agent (main) conversation, the agent group with one conversation per agent, the work status area, your profile and the default agent profile. The "엔진" (engine) badge at the top shows the engine connection.
 - Center chat: the header, the message list and the input box.
 - Right panels: the inbox, settings and the event panel open here.
 
@@ -65,9 +65,11 @@ No new setting is required. With `compaction.model` absent or set to `"auto"`, t
 
 If a summary fails, the engine keeps the previous working context and stops instead of applying an emergency shortened substitute. The notice tells you what to do: check the model setting, log in to the summary provider again, wait for the usage limit to recover, or check account and organization permissions. Other failures require you to resolve the cause and explicitly continue or retry. The gateway does not resend the previous input or start a new session. A cancellation is separate from a failure. A successful summary is not a guarantee that every detail survives; check critical requirements when you continue.
 
+To summarize on demand, send `/compact` in a gateway chat (main or another web or app chat). The gateway asks the engine to summarize that chat's session right away, and the text never goes to the model as a prompt. Add text after the command to give extra instructions for the summary, for example `/compact 결정 사항 위주로`. The gateway refuses `/compact` while an answer is running, a summary is already running, the engine is retrying a model request, the session is being replaced, or the engine is disconnected. A one-line warning says why and what to do. A refused `/compact` isn't queued, so send it again later. You get the usual start notice and one completed, cancelled or failed notice. If the engine refuses before a summary starts, for example with no model selected, chat shows one error that keeps the previous content. A very short or already summarized session shows the usual failure notice. A failed `/compact` doesn't count toward the rule that two failed summaries in a row open a fresh session. It works even with automatic compaction off. Work sessions don't get `/compact`. With a quoted message or an image attached, `/compact` is ordinary input.
+
 The gateway opens main and work sessions in the engine's existing app mode, so replies are shaped for the chat screen rather than a terminal. You don't need to change any setting. App mode doesn't guarantee that every model answer follows a requested format such as valid JSON, and it doesn't change the summary recovery above.
 
-To start a new conversation, click + in the sidebar. A prompt asks for its name.
+The sidebar lists only the main conversation and one conversation per agent. For another role conversation, create an agent (see Agents). Conversations made with the "+" button of earlier versions no longer appear anywhere; the gateway keeps their data.
 
 #### Slash command menu
 
@@ -90,6 +92,8 @@ With voice off, the voice commands leave the menu. Typed by hand, they get the r
 
 The README's Commands section says that sending `/usage` in chat makes the gateway reply with the model account's usage.
 
+The menu also lists the gateway command `/compact`, which summarizes the conversation on demand. See Conversation summaries above.
+
 ### 2.3 Attachments and references
 
 #### Flow and structure diagrams
@@ -142,7 +146,7 @@ Right-click a message to attach it as a reference tag above the input box. The m
 
 #### Memo
 
-The 쪽지 (memo) button opens and closes the memo. Keep frequent prompts or notes there. It saves on its own. 이미지 보관 keeps up to 2 images in it.
+The 쪽지 (memo) button opens and closes the memo. Keep frequent prompts or notes there. It saves on its own. 이미지 보관 keeps up to 2 images in it. In the phone app the open memo takes the whole chat area and hides the chat input and the "새 앱 버전" row; close it with its 닫기 button or Back.
 
 #### Auto copy
 
@@ -197,21 +201,34 @@ At phone width the sidebar is hidden. Click the Zig face in the header to switch
 
 Open it with the header's 설정 button. Close it with Esc, the × button, or a click outside the card.
 
+#### Language
+
+The Language selector picks the screen language for the whole gateway: English or 한국어 (Korean). The default is English. The choice changes the web screen text, its tooltips and the app screen text, and the web and the app switch together. The manual opens in the selected language. Fixed messages from the gateway (chat notices and errors, update messages, `/version` and `/usage` replies, notification titles) also use it from the next message on; messages already in the chat keep their language. Agent replies and your own content aren't translated.
+
 #### Profile
 
 The profile sits at the bottom of the sidebar.
 
 | Target | How | Rules |
 | --- | --- | --- |
-| Your nickname | Double-click your profile. | Up to 20 characters. Blank becomes "나" (me). |
-| Agent name | Double-click the agent profile. | Up to 10 Korean or 20 Latin characters. Too long and it isn't changed. Blank becomes "지그" (Zig). |
-| Agent icon | Double-click the agent icon. | PNG, JPEG or WebP, 1 MB at most. The center is cropped to a square. You can go back to the default icon. |
+| Your nickname | Double-click your profile. | Up to 20 characters. Blank shows the default of the screen language: "Me" in English, "나" in Korean. |
+| Default agent name | Double-click the default agent profile. | Up to 10 Korean or 20 Latin characters. Too long and it isn't changed. Blank shows the default of the screen language: "Zig" in English, "지그" in Korean. A name you set stays as you wrote it in both languages. |
+| Default agent icon | Double-click the default agent icon. | PNG, JPEG or WebP, 1 MB at most. The center is cropped to a square. You can go back to the default icon. |
 
 In a name field, Enter saves and Esc cancels. Leaving the field also saves. Names are stored on the gateway. If that fails, only this browser shows the new name.
 
+The gateway tells main, work and agent sessions your nickname at each turn, so every session calls you by it from the next turn. Main also learns the default agent name, and each agent learns the name you gave it in the Agents screen.
+
 #### Security check (보안검사)
 
-- "보안검사 켜짐/꺼짐" (security check on/off) turns the check of your messages on or off. It is on by default and the gateway keeps the choice.
+"Message check before the engine", "Output check" and each tool row under the "Formal verification" group are switches. Each item shows a one or two line summary. For the full description, hover over or focus the info icon (i) on the web, or tap the info icon in the app to open a dialog. The Android settings screen has the same switches.
+
+- "Message check before the engine" turns the check of your messages on or off. It is on by default and the gateway keeps the choice.
+- "Output check" turns the check of work output on or off. On (the default), `zigmini scan` looks for secret-like values and your baseline values, and new sessions get the rule to run it before a merge. Off makes `zigmini scan` stop without scanning (exit code 4) and removes that rule. The message check has its own switch.
+- "Formal verification" is a group title with one row per tool (TLA+ today). Each row shows the tool name and its status, an info icon and the tool's switch. The switch chooses whether checks (`bun run formal:check`) use the tool once it's installed; it never installs anything.
+- A tool that isn't installed shows "Not installed" and an "Install" button. Pressing Install installs only that tool with Homebrew (`openjdk@21` without `brew link`, and tla2tools.jar 1.7.4 checked by size and SHA-256). While it runs, the row shows "Installing…" and hides the button. Once installed, the button goes away. Nothing is installed until you press Install.
+- A failed install shows "Install failed", "Failure reason: …" under the row and the Install button again. Without Homebrew, the reason tells you to install Homebrew from https://brew.sh and press Install again. A failed install keeps the switch as you set it.
+- If your old overall formal verification setting was off, every tool switch stays off after the update.
 - When a message or inbox answer contains a detected value that is not allowed, the gateway holds it before sending it to the agent. The same security item appears in the inbox and chat. It shows the complete values to be remembered and their types.
 - Approving sends the original message and remembers the displayed exact values on this gateway. The same values do not prompt again. A different value still needs approval. Existing held messages do not send automatically.
 - Cancel stops only this transmission. It does not stop the existing work. If the held transmission is an inbox answer, the original question remains unanswered and its answer form stays available.
@@ -221,7 +238,8 @@ In a name field, Enter saves and Esc cancels. Leaving the field also saves. Name
 - The allowed-value list is private to this installation and survives gateway restarts. Web settings show the list under Security check. On Android, open the gateway settings screen that contains Manual, then open the allowed values.
 - Each entry shows its full value, type, approval time and approving client. Remove one entry or clear the list to check those values again on future transmissions. Removal does not cancel a transmission already approved or erase a sent message.
 - An older app's send-only approval still sends once without remembering values. Remembering requires the new send-and-remember choice. Unapproved original messages are not saved in ordinary question records or history; pending originals are lost on gateway restart.
-- This list affects runtime message and answer checking only. It does not change repository or release security checks.
+- By default a remembered value is allowed only for transmission. Each entry has a "저장소 검사에도 허용" (also allow in repository scan) switch. Only values with the switch on pass `zigmini scan`. A value equal to this Mac's home path or account name can't be switched on.
+- "보안 기준" (security baseline) lists the terms that the repository scan always looks for. Add a term on the web; the web and Android can remove one after a confirmation. Rows for this Mac's home path and account name are automatic and read-only. The status line shows when the gateway last exported the baseline file.
 
 #### Update (업데이트)
 
@@ -294,10 +312,39 @@ Voice features work only while voice is on (음성 켜짐).
 
 ### 2.10 Viewing the manual
 
-- Web: click the 매뉴얼 (manual) button at the top of the settings dialog. The Korean version opens first. The "English" button or the link on the first line of the document switches to the English version. Esc, the close button (×) or a click outside the dialog closes it.
+- Web: click the 매뉴얼 (manual) button at the top of the settings dialog. The version in the selected screen language opens first. The "English" button or the link on the first line of the document switches to the English version. Esc, the close button (×) or a click outside the dialog closes it.
 - App: short press the header status tag (for example "작업 상태 확인 중") to open the gateway connection screen, then tap its 매뉴얼 button. The "English" button switches to the English version. 닫기 (close) or Back returns to the connection screen.
 - When the gateway does not serve the manual, the notice "이 게이트웨이 버전에는 매뉴얼이 없습니다" (this gateway version has no manual) shows. Update the gateway to read it.
 
+### 2.11 Agents
+
+An agent is a conversation with a role, which you create on the web. Each agent has its own conversation, history, engine session and knowledge folder. It's separate from the default agent (main, Zig). The default agent stays your assistant and keeps managing work and the inbox. An agent does one job, like interview practice, and doesn't manage work or other sessions. No agents come built in.
+
+Terms: the default agent (main, Zig) is the conversation the gateway has from the start. An agent is a role conversation that you create. A work session or a sub-task is a separate engine session that runs one job; it is not an agent.
+
+```zigmini-diagram
+{"version":1,"title":"Default agent, agents and work sessions","nodes":[{"id":"user","label":"You"},{"id":"main","label":"Default agent (main, Zig)"},{"id":"agent","label":"Agent conversation"},{"id":"work","label":"Work"},{"id":"knowledge","label":"Agent knowledge folder"}],"edges":[{"from":"user","to":"main"},{"from":"user","to":"agent"},{"from":"main","to":"work"},{"from":"agent","to":"knowledge"}]}
+```
+
+- **Sidebar.** Agents appear in their own group. The **⋯** button beside the group name (or **Agents** at the top of the chat) opens the Agents screen with three views: **List**, **Shared defaults** and **Archive**. You create and edit agents only on this screen: **+ Agent** in **List** creates one, and **Edit** on a row opens its editor. The sidebar and the chat header have no add or edit button. Each agent has exactly one conversation.
+- **Editor.** Name and a one-line purpose are required. Optional fields: icon, model (provider and model ID, both filled or both empty; empty means the gateway's current model), thinking level, skill allow list, web research (web_search, webfetch), app notification when a reply ends, gateway and install rules on or off, and the MEMORY.md size limit (0 to 32768 bytes). Shell and code execution are always off. Each field shows where its value comes from: package default, shared default or this agent. The body is the role instruction.
+- **Changes apply from the next session.** After you edit an agent, its header shows **Definition changed · applies from the next session**. The open session keeps the old definition. Click the badge to start a new session with the edited one.
+- **Skills.** The "/" menu in an agent conversation hides skills outside its allow list.
+- **Knowledge.** The agent's file tools work only inside its knowledge folder. Upload source files in the agent's editor (**Agents** screen, **List**, **Edit**). With web research on, research notes are saved under `knowledge/notes/` with the source URL beside each fact. An agent can search only its own conversation history.
+- **Clone.** Cloning copies the definition, source files and MEMORY.md into a new agent named "<name> 사본". The conversation isn't copied.
+- **Delete and restore.** To delete, type the agent's exact name. The conversation is hidden, and the definition and knowledge move to **Archive** for 30 days. You can't delete during a running turn or an open question. **Restore** in **Archive** brings the conversation back.
+- **Default agent.** Zig can list agents (name, purpose, link) but can't talk to them. Trashed agents aren't listed.
+- **Android.** The app stays on the default agent (main) conversation. Agent conversations are web only for now.
+
+### 2.12 Agent rules
+
+The gateway adds the common rules of the package and this installation's `~/.zigmini/rules.md` to every main and work session.
+
+Replacing a common rule item: each item in the common rules file has a fixed id in a comment (for example `<!--id:f2468e-->`). The id is set once when the item is made and stays the same when its text changes. The item numbers are only a reading order, not a priority. To replace a whole common item, put `<!--replaces:<id>-->` inside an item of `rules.md`. The gateway then leaves out that common item and uses your item. An item without `replaces` is a new rule and goes after the common rules, as before; `rules.md` still wins on a conflict. If an id no longer exists in the common rules (for example after an update), the item is added as a new rule and `zigmini doctor` shows a warning.
+
+- `zigmini rules`: lists the common items with number, id and first line.
+- `zigmini rules check`: shows each `rules.md` item as "replaces common N", "new rule" or "unknown id" (exit code 1 when an unknown id exists).
+
 ## 3. Keyboard shortcuts
 
 | Key | Where | What it does |
@@ -322,9 +369,9 @@ Voice features work only while voice is on (음성 켜짐).
 | Tab, Shift+Tab | Settings | Focus cycles inside settings. |
 | Esc | Manual | Closes the manual and returns to settings. |
 | Tab, Shift+Tab | Manual | Focus cycles inside the manual. |
-| Enter | Nickname or agent name field | Saves. |
-| Esc | Nickname or agent name field | Closes without change. |
-| Esc | Agent icon editor | Closes without change. |
+| Enter | Nickname or default agent name field | Saves. |
+| Esc | Nickname or default agent name field | Closes without change. |
+| Esc | Default agent icon editor | Closes without change. |
 
 Ctrl shortcuts do nothing with Cmd, Alt or Shift held. They match by key position, so a Korean layout works too.
 
@@ -451,6 +498,8 @@ Main commands for the Mac terminal:
 - `zigmini pair [--apk]`: shows the phone registration QR or the app download QR.
 - `zigmini consent`: shows the permission notice and records consent.
 - `zigmini update [version]`: updates.
+- `zigmini scan [<repo>]`: checks a repository with the security baseline. Exit 0 clean, 1 findings, 2 error, 3 baseline missing, empty or out of date.
+- `zigmini security import-baseline [--dry-run]`: adds an old plain-text list to the security baseline while the gateway runs.
 - `zigmini rotate-main [--restart]`: moves the main conversation to a new session, like "새 세션" (new session). Ask the operator first. See the operator guide.
 
 For the full list, see the README's Commands section.

package/host/omo-bridge/agent-control.ts

@@ -0,0 +1,274 @@
+import { existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, rmdirSync, statSync, unlinkSync, writeFileSync } from "node:fs";
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { homedir } from "node:os";
+import { INSTALL_RULES_FILE, INSTALL_RULES_HEADING, packageRulesDrop, PACKAGE_RULES_FILE, PACKAGE_RULES_HEADING, readRulesFile } from "../../src/agent-rules.ts";
+import { applyRequestRules, loadRequestRules, type ProviderRequestEvent } from "../../src/agent-request-rules.ts";
+import { loadEngineSdk } from "../../src/engine/index.ts";
+import { validateAgentFields } from "../../src/agent/definition.ts";
+import { runtimeHome, runtimePaths } from "../../src/runtime/paths.ts";
+import { agentNamePrompt, nicknamePrompt, readAgentPromptName, readPromptProfile, type PromptProfile } from "../../src/profile-prompt.ts";
+
+type Context = { readonly cwd: string; readonly sessionManager: { getSessionId(): string }; readonly ui: { notify(message: string, level: "warning"): void } };
+type ToolCall = { readonly toolName: string; readonly toolCallId: string; readonly input: Record<string, unknown> };
+type Block = { readonly block: true; readonly reason: string };
+type Skill = { readonly name: string; readonly filePath: string };
+type Start = { readonly systemPrompt: string; readonly systemPromptOptions: { readonly skills?: readonly Skill[] } };
+type Events = {
+	session_start: unknown; session_shutdown: unknown; before_agent_start: Start;
+	before_provider_request: ProviderRequestEvent; tool_call: ToolCall; tool_result: { readonly toolCallId: string };
+	input: { readonly text: string }; agent_end: unknown; session_abort: unknown;
+};
+interface ExtensionApi {
+	readonly sessionKind: string;
+	readonly sessionContext: Readonly<Record<string, string>>;
+	readonly rpc: { emit(name: string, data: unknown): void; handle(name: string, handler: () => unknown): void };
+	on<K extends keyof Events>(event: K, handler: (event: Events[K], ctx: Context) => unknown, options?: { previewSafe: boolean }): void;
+	setActiveTools(names: string[]): void;
+	getCommands(): readonly { readonly name: string; readonly source: string }[];
+	appendEntry(name: string, data: unknown): void;
+	registerTool(tool: HistoryTool): void;
+	registerFilesystemPolicy(policy: { check(request: { operation: string; canonicalPath: string }): { allow: true } | { allow: false; reason: string } }): void;
+}
+type HistoryTool = {
+	name: string; label: string; description: string; parameters: unknown;
+	execute(id: string, params: Record<string, unknown>, signal: AbortSignal | undefined): Promise<unknown>;
+};
+type Edit = { readonly oldText: string; readonly newText: string };
+/** The runtime supplies this public SDK. Tests use the same native editor, not a replacement algorithm. */
+export interface AgentSdk {
+	createEditTool(cwd: string, options: { operations: {
+		readFile(path: string): Promise<Buffer>; writeFile(path: string, content: string): Promise<void>; access(path: string): Promise<void>;
+	} }): { execute(id: string, input: { path: string; edits: Edit[] }): Promise<unknown> };
+}
+const BASE_TOOLS = ["read", "write", "edit", "ask_user_question", "zgw_agent_history_search"];
+export const MEMORY_CAP_MESSAGE = "MEMORY.md를 요약해 줄인 뒤 다시 쓰세요.";
+const DAILY_RULES = "Record each day's facts, results and decisions chronologically in notes/daily/YYYY-MM-DD.md (KST). " +
+	"Keep only long-lived preferences, established facts and ongoing goals summarized in MEMORY.md; do not copy daily logs into it.";
+export const RESEARCH_RULES = "When you research on the web, write the results to knowledge/notes/companies/<company>.md " +
+	"(other topics knowledge/notes/research/<topic>.md) and put each source URL on the line of the fact it supports.";
+const HISTORY_LIMIT = 50;
+const blocked = (reason: string): Block => ({ block: true, reason });
+function record(value: unknown): value is Record<string, unknown> { return typeof value === "object" && value !== null && !Array.isArray(value); }
+function missing(error: unknown): boolean { return error instanceof Error && "code" in error && error.code === "ENOENT"; }
+function inside(root: string, path: string): boolean {
+	const part = relative(root, path);
+	return part === "" || (!isAbsolute(part) && part !== ".." && !part.startsWith(`..${sep}`));
+}
+/** Resolve existing links, including a new target's nearest existing parent. Dangling links fail closed. */
+export function agentPath(path: string): string {
+	try { lstatSync(path); } catch (error) {
+		if (!missing(error)) throw error;
+		return join(agentPath(dirname(path)), basename(path));
+	}
+	return realpathSync(path);
+}
+function owner(path: string): { sessionId: string; pid: number } | undefined {
+	try {
+		const data: unknown = JSON.parse(readFileSync(path, "utf8"));
+		if (record(data) && typeof data.sessionId === "string" && Number.isSafeInteger(data.pid) && typeof data.pid === "number" && data.pid > 0) return { sessionId: data.sessionId, pid: data.pid };
+		throw new Error("agent_lock_invalid");
+	} catch (error) { if (missing(error)) return undefined; throw error; }
+}
+function live(pid: number): boolean {
+	try { process.kill(pid, 0); return true; } catch (error) {
+		if (error instanceof Error && "code" in error && error.code === "ESRCH") return false;
+		throw error;
+	}
+}
+/** All lock changes share one exclusive claim directory; a conflicting claimant never removes a newer lock. */
+function claimLock(root: string, sessionId: string, release = false): boolean {
+	const claim = join(root, ".lock.claim");
+	try { mkdirSync(claim); } catch (error) {
+		if (error instanceof Error && "code" in error && error.code === "EEXIST") return false;
+		throw error;
+	}
+	try {
+		const path = join(root, ".lock");
+		const held = owner(path);
+		const ours = held?.sessionId === sessionId && held.pid === process.pid;
+		if (release) { if (ours) unlinkSync(path); return ours; }
+		if (held && !ours && live(held.pid)) return false;
+		if (!ours) writeFileSync(path, JSON.stringify({ sessionId, pid: process.pid }), { mode: 0o600 });
+		return true;
+	} finally { rmdirSync(claim); }
+}
+
+export default function agentControl(pi: ExtensionApi, loadSdk: () => Promise<AgentSdk> = () => loadEngineSdk<AgentSdk>()): void {
+	const id = pi.sessionContext.zgw_agent;
+	if (pi.sessionContext.zgw_role !== "agent" || pi.sessionKind !== "interactive" || !id) return;
+	pi.registerTool({
+		name: "zgw_agent_history_search", label: "Agent history search",
+		description: "Search this agent's own past conversation messages for a text. Returns the newest matches first (at most 50). Other conversations are never searched.",
+		parameters: { type: "object", properties: { query: { type: "string", minLength: 1, maxLength: 200 }, limit: { type: "integer", minimum: 1, maximum: HISTORY_LIMIT } }, required: ["query"], additionalProperties: false },
+		async execute(_toolCallId, params, signal) {
+			if (typeof params.query !== "string" || params.query === "") throw new Error("agent_history_query_required");
+			const limit = typeof params.limit === "number" && Number.isInteger(params.limit) ? Math.min(Math.max(params.limit, 1), HISTORY_LIMIT) : 20;
+			const token = readFileSync(runtimePaths().omoTokenFile, "utf8").trim();
+			const base = process.env.ZGW_WORK_URL ?? `http://127.0.0.1:${process.env.ZGW_PORT ?? "8700"}`;
+			const url = new URL("/internal/agent-history", base);
+			// The agent id comes from the session context, never from the model's arguments.
+			url.search = new URLSearchParams({ agent: id, query: params.query, limit: String(limit) }).toString();
+			const response = await fetch(url, {
+				headers: { authorization: `Bearer ${token}` }, redirect: "error",
+				signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(10_000)]) : AbortSignal.timeout(10_000),
+			});
+			const result: unknown = await response.json();
+			if (!response.ok) throw new Error(`agent_history_http_${response.status}`);
+			return { content: [{ type: "text", text: JSON.stringify(result) }], details: result };
+		},
+	});
+	let root = "", sessionId = "", prompt = "", ready = false, agentName = "";
+	let maxBytes = 0;
+	let tools: string[] = [], skills: string[] = [];
+	const skillSnapshots = new Map<string, string>();
+	let memoryCall: string | undefined;
+	let ui: Context["ui"] | undefined;
+	let startupWarnings: { code: string; message: string }[] = [];
+	// session_start precedes the gateway's open_session attachment. Read this snapshot after binding the owner.
+	pi.rpc.handle("zgw.agent_warnings", () => ({ warnings: startupWarnings }));
+	const warn = (code: string) => {
+		const data = { agentId: id, code };
+		const message = code === "memory_over_cap" ? `MEMORY.md가 크기 상한을 넘어 이번 세션에서 생략되었습니다. ${MEMORY_CAP_MESSAGE}` : `에이전트 요청이 제한되었습니다: ${code}`;
+		if (!ready) startupWarnings.push({ code, message });
+		pi.appendEntry("zgw.agent_warning", data);
+		pi.rpc.emit("zgw.agent_warning", data);
+		ui?.notify(message, "warning");
+	};
+	const pathDenial = (path: string, write: boolean): string | undefined => {
+		if (!ready) return "agent_not_ready";
+		if (!inside(root, path)) return "agent_path_outside_knowledge";
+		if (!write) return undefined;
+		if (inside(join(root, "source"), path)) return "agent_source_read_only";
+		if (path === root || inside(join(root, ".lock"), path) || inside(join(root, ".lock.claim"), path)) return "agent_lock_protected";
+		if (!claimLock(root, sessionId)) return "agent_knowledge_locked";
+		return undefined;
+	};
+	pi.registerFilesystemPolicy({ check: ({ operation, canonicalPath }) => {
+		try {
+			const reason = pathDenial(canonicalPath, operation === "write");
+			return reason ? { allow: false, reason } : { allow: true };
+		} catch { return { allow: false, reason: "agent_path_unavailable" }; }
+	} });
+	pi.on("session_start", async (_event, ctx) => {
+		ready = false;
+		startupWarnings = [];
+		ui = ctx.ui;
+		pi.setActiveTools([]);
+		const token = readFileSync(runtimePaths().omoTokenFile, "utf8").trim();
+		const base = process.env.ZGW_WORK_URL ?? `http://127.0.0.1:${process.env.ZGW_PORT ?? "8700"}`;
+		const response = await fetch(new URL(`/internal/agent/${encodeURIComponent(id)}`, base), {
+			headers: { authorization: `Bearer ${token}` }, redirect: "error", signal: AbortSignal.timeout(5_000),
+		});
+		if (!response.ok) throw new Error(`agent_definition_http_${response.status}`);
+		const definition: unknown = await response.json();
+		if (!record(definition) || !record(definition.fields) || typeof definition.body !== "string" || typeof definition.defaultsBody !== "string") throw new Error("agent_definition_invalid");
+		validateAgentFields(definition.fields);
+		if (typeof definition.fields.name !== "string") throw new Error("agent_name_invalid");
+		agentName = definition.fields.name;
+		const { memory, rules, tools: toolSettings, skills: allowedSkills } = definition.fields;
+		if (!record(memory) || typeof memory.maxBytes !== "number" || !record(rules) || !record(toolSettings) ||
+			!Array.isArray(allowedSkills) || !allowedSkills.every((s): s is string => typeof s === "string")) throw new Error("agent_definition_unmerged");
+		const expected = join(realpathSync(join(runtimeHome(), "agents")), id, "knowledge");
+		root = realpathSync(expected);
+		if (root !== expected) throw new Error("agent_knowledge_symlink");
+		if (realpathSync(ctx.cwd) !== root) throw new Error("agent_cwd_mismatch");
+		sessionId = ctx.sessionManager.getSessionId();
+		maxBytes = memory.maxBytes;
+		skills = allowedSkills;
+		tools = [...BASE_TOOLS, ...(toolSettings.web === true ? ["web_search", "webfetch"] : [])];
+		const sections: string[] = [];
+		for (const [enabled, path, heading] of [
+			[rules.gateway, PACKAGE_RULES_FILE, PACKAGE_RULES_HEADING],
+			[rules.install, join(runtimeHome(), INSTALL_RULES_FILE), INSTALL_RULES_HEADING],
+		] as const) {
+			if (enabled) { const source = readRulesFile(path, path === PACKAGE_RULES_FILE ? packageRulesDrop() : undefined); if (source.text) sections.push(`${heading}\n\n${source.text}`); }
+		}
+		// body already includes defaultsBody. Put the package daily rule first so defaults can override it.
+		sections.push(DAILY_RULES, definition.body);
+		if (toolSettings.web === true) sections.push(RESEARCH_RULES);
+		const memoryPath = agentPath(join(root, "MEMORY.md"));
+		if (!inside(root, memoryPath)) throw new Error("agent_memory_outside_knowledge");
+		if (existsSync(memoryPath)) {
+			if (statSync(memoryPath).size > maxBytes) warn("memory_over_cap");
+			else {
+				const snapshot = readFileSync(memoryPath);
+				if (snapshot.byteLength > maxBytes) warn("memory_over_cap");
+				else sections.push(`<agent-memory>\n${snapshot.toString("utf8")}\n</agent-memory>`);
+			}
+		}
+		prompt = sections.join("\n\n");
+		if (!claimLock(root, sessionId)) warn("knowledge_locked");
+		ready = true;
+		pi.setActiveTools(tools);
+	});
+	pi.on("session_shutdown", () => { if (root && sessionId) claimLock(root, sessionId, true); ready = false; });
+	const requestRules = loadRequestRules();
+	pi.on("before_provider_request", (event) => applyRequestRules(event, requestRules));
+	let profile: PromptProfile = { nickname: undefined, agentName: "" };
+	pi.on("before_agent_start", async (event) => {
+		if (!ready) throw new Error("agent_not_ready");
+		[profile, agentName] = await Promise.all([readPromptProfile(profile), readAgentPromptName(id, agentName)]);
+		pi.setActiveTools(tools);
+		// File tools remain confined to knowledge. Approved skill bodies are loaded here, not through a read exception.
+		for (const skill of event.systemPromptOptions.skills ?? []) {
+			if (skills.includes(skill.name) && !skillSnapshots.has(skill.name)) skillSnapshots.set(skill.name, readFileSync(skill.filePath, "utf8"));
+		}
+		const base = event.systemPrompt.replace(/<available_skills>[\s\S]*?<\/available_skills>/g, "")
+			.replace(/<skill_roots>[\s\S]*?<\/skill_roots>/g, "");
+		const selected = [...skillSnapshots].map(([name, text]) => `<agent-skill name="${name}">\n${text}\n</agent-skill>`).join("\n\n");
+		return { systemPrompt: [base, prompt, selected, agentNamePrompt(agentName), nicknamePrompt(profile.nickname)].filter(Boolean).join("\n\n") };
+	});
+	pi.on("input", (event) => {
+		if (!ready) { warn("agent_not_ready"); return { action: "handled" }; }
+		const known = new Set(pi.getCommands().filter((command) => command.source === "skill").map((command) => command.name.replace(/^skill:/, "")));
+		for (const match of event.text.matchAll(/(?:^|\s)(\/skill:|\$(?:skill:)?)([a-zA-Z][a-zA-Z0-9:_-]*)(?=\s|$)/g)) {
+			const name = match[2] ?? "";
+			if (known.has(name) && !skills.includes(name)) { warn("skill_not_allowed"); return { action: "handled" }; }
+		}
+		return { action: "continue" };
+	});
+	pi.on("tool_call", async (event) => {
+		if (!ready || !tools.includes(event.toolName)) return blocked("agent_tool_not_allowed");
+		if (!["read", "write", "edit"].includes(event.toolName)) return;
+		try {
+			if (typeof event.input.path !== "string" || event.input.path === "") return blocked("agent_path_required");
+			const expanded = event.input.path.replace(/^~(?=\/|$)/, homedir());
+			const lexical = resolve(root, expanded);
+			const path = agentPath(lexical);
+			const write = event.toolName !== "read";
+			const reason = pathDenial(lexical, write) ?? pathDenial(path, write);
+			if (reason) return blocked(reason);
+			if (write && existsSync(path) && lstatSync(path).nlink > 1) return blocked("agent_linked_file_read_only");
+			// Canonicalize the actual argument too; do not leave a checked symlink for the native tool to follow.
+			event.input.path = path;
+			if (!write || path !== agentPath(join(root, "MEMORY.md"))) return;
+			if (memoryCall !== undefined) return blocked("agent_memory_busy");
+			memoryCall = event.toolCallId;
+			let bytes: number;
+			if (event.toolName === "write") {
+				if (typeof event.input.content !== "string") throw new Error("agent_write_content_required");
+				bytes = Buffer.byteLength(event.input.content);
+			} else {
+				const edits = event.input.edits;
+				if (!Array.isArray(edits) || !edits.every((e): e is Edit => record(e) && typeof e.oldText === "string" && typeof e.newText === "string")) throw new Error("agent_edit_input_invalid");
+				// Run the pinned native editor against memory-only operations: BOM, CRLF, fuzzy and multi-edit semantics stay exact.
+				const sdk = await loadSdk();
+				let result: string | undefined;
+				await sdk.createEditTool(root, { operations: {
+					readFile: async () => readFileSync(path), access: async () => {},
+					writeFile: async (_path, content) => { result = content; },
+				} }).execute(event.toolCallId, { path, edits });
+				if (result === undefined) throw new Error("agent_edit_result_missing");
+				bytes = Buffer.byteLength(result);
+			}
+			if (bytes > maxBytes) { memoryCall = undefined; return blocked(MEMORY_CAP_MESSAGE); }
+		} catch (error) {
+			if (memoryCall === event.toolCallId) memoryCall = undefined;
+			return blocked(error instanceof Error ? error.message : "agent_path_unavailable");
+		}
+	});
+	pi.on("tool_result", (event) => { if (memoryCall === event.toolCallId) memoryCall = undefined; });
+	// A later hook/permission can refuse a call without a tool_result. Its turn end also releases the reservation.
+	pi.on("agent_end", () => { memoryCall = undefined; });
+	pi.on("session_abort", () => { memoryCall = undefined; });
+}

package/host/omo-bridge/bridge.ts

@@ -85,7 +85,7 @@ function spawnOmo(): Subprocess {
 	if (existsSync(socketPath)) rmSync(socketPath);
 	const child = Bun.spawn(engine.launchCommand({
 		home, socket: socketPath, sessionDir,
-		extensions: [join(import.meta.dir, "model-control.ts"), join(import.meta.dir, "task-control.ts")],
+		extensions: [join(import.meta.dir, "model-control.ts"), join(import.meta.dir, "task-control.ts"), join(import.meta.dir, "agent-control.ts")],
 		...(engineRoot ? { engineRoot } : {}),
 	}), {
 		cwd: process.env.HOME ?? home,

package/host/omo-bridge/continuity-control.ts

@@ -122,7 +122,7 @@ export default function continuityControl<Context extends ContinuityContext>(
 	const role = pi.sessionContext.zgw_role;
 	const isMain =
 		pi.sessionKind === "interactive" &&
-		(role === "main" || role === undefined) &&
+		(role === "main" || role === "agent" || role === undefined) &&
 		Boolean(pi.sessionContext.zgw_conv);
 	if (!isMain) return;
 

package/host/omo-bridge/task-control.ts

@@ -3,6 +3,7 @@ import { isDeepStrictEqual } from "node:util";
 import { runtimePaths } from "../../src/runtime/paths.ts";
 import { agentRules } from "../../src/agent-rules.ts";
 import { applyRequestRules, loadRequestRules, type ProviderRequestEvent } from "../../src/agent-request-rules.ts";
+import { nicknamePrompt, PROFILE_TIMEOUT_MS, readPromptProfile, type PromptProfile } from "../../src/profile-prompt.ts";
 
 // The pinned runtime supplies this SDK surface, just as it does for model-control.ts.
 type Entry = { id: string; type: string; customType?: string; data?: unknown; message?: { role: string; content: unknown; toolName?: string; details?: unknown; toolCallId?: string } };
@@ -107,21 +108,11 @@ function gatewayBase(): string {
 }
 
 export const DEFAULT_AGENT_NAME = "지그";
-export const AGENT_NAME_TIMEOUT_MS = 1_000;
+export const AGENT_NAME_TIMEOUT_MS = PROFILE_TIMEOUT_MS;
 
 /** The agent name the gateway keeps (GET /api/profile, improvement 59); `fallback` when the gateway does not answer. */
 export async function readAgentName(fallback: string): Promise<string> {
-	try {
-		const response = await fetch(new URL("/api/profile", gatewayBase()), { signal: AbortSignal.timeout(AGENT_NAME_TIMEOUT_MS) });
-		if (!response.ok) throw new Error(`profile_http_${response.status}`);
-		const data: unknown = await response.json();
-		const name = record(data) && typeof data.agentName === "string" ? data.agentName.replace(/\s+/g, " ").trim() : "";
-		if (!name) throw new Error("profile_agent_name_missing");
-		return name;
-	} catch (error) {
-		console.warn(`agent name: keeping "${fallback}":`, error instanceof Error ? error.message : String(error));
-		return fallback;
-	}
+	return (await readPromptProfile({ nickname: undefined, agentName: fallback })).agentName;
 }
 
 async function postWork(operation: string, requestKey: string, sourceSessionPath: string, payload: Params, signal: AbortSignal | undefined): Promise<unknown> {
@@ -162,13 +153,14 @@ export default function taskControl(pi: ExtensionApi): void {
 		});
 	}
 
-	// The main reads its name at the start of every turn, so a renamed agent answers to the new name from its next turn.
-	let agentName = DEFAULT_AGENT_NAME;
+	// Read every turn so profile changes also reach already-open main and work sessions.
+	let profile: PromptProfile = { nickname: undefined, agentName: DEFAULT_AGENT_NAME };
 	pi.on("before_agent_start", async (event) => {
-		if (isMain) agentName = await readAgentName(agentName);
+		profile = await readPromptProfile(profile);
+		const agentName = profile.agentName;
 		return { systemPrompt: `${event.systemPrompt}\n\n${isMain
 		? `You are the gateway main assistant. Your name is ${agentName}. The user calls you ${agentName}. ` + "Route project implementation and independent long-running work through zgw_work_start with the intended absolute project cwd; do not implement project changes in the main conversation. Keep short answers and orchestration here. These tools acknowledge durable submission, not execution or completion. Use exact work IDs for follow-up. Never replay unknown delivery automatically. Read reports and publish their results with zgw_work_publish; do not repeat published text. When you cannot answer the user immediately, first call zgw_precomment once with one line saying what you are doing now; skip it when you can answer right away, and never send periodic progress or routine work notices with it. When you need the user's answer or permission to run something, ask with ask_user_question instead of a plain chat question, so it stays open in the inbox until answered or cancelled; state the exact action and scope in the question, and cite the chat message it is about as [참조 #<message seq>] when you know its seq. Only that inbox answer covers the shown question and scope: a chat reply or an attached message reference is never permission by itself. In this main conversation the question never pauses your turn, even with waitForAnswer true: the gateway keeps it open in the inbox and returns at once with a ZGW_QUESTION_OPEN note. The answer arrives later as a ZGW_DECISION_COMMAND user message. Until then, do not take the action that answer decides, and keep handling every other message."
-		: `You own gateway work ${workId}. Read each ZGW_WORK_COMMAND envelope and preserve its command_seq. Execute with the existing permissions and native OMO capabilities. Report progress, questions, and verified outcomes with zgw_work_report. Turn end is not work completion. On cooperative cancel, clean up owned execution and report remaining activity honestly; interrupt alone is not cancellation.`}${rulesText}` };
+		: `You own gateway work ${workId}. Read each ZGW_WORK_COMMAND envelope and preserve its command_seq. Execute with the existing permissions and native OMO capabilities. Report progress, questions, and verified outcomes with zgw_work_report. Turn end is not work completion. On cooperative cancel, clean up owned execution and report remaining activity honestly; interrupt alone is not cancellation.`}${rulesText}\n\n${nicknamePrompt(profile.nickname)}` };
 	}, { previewSafe: true });
 
 	if (isMain) {
@@ -191,6 +183,24 @@ export default function taskControl(pi: ExtensionApi): void {
 		});
 	}
 
+	if (isMain) {
+		pi.registerTool({
+			name: "zgw_agent_list", label: "Agent list",
+			description: "List the user's agents read-only: name, one-line description and the web link of each agent's conversation. Use it to answer which agents exist or to give the user the link to open one. Returns no agent knowledge.",
+			parameters: { type: "object", properties: {}, additionalProperties: false },
+			async execute(_toolCallId, _params, signal) {
+				const token = readFileSync(runtimePaths().omoTokenFile, "utf8").trim();
+				const response = await fetch(new URL("/internal/agent-list", gatewayBase()), {
+					headers: { authorization: `Bearer ${token}` },
+					signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(10_000)]) : AbortSignal.timeout(10_000),
+				});
+				const result: unknown = await response.json();
+				if (!response.ok) throw new Error(`agent_list_http_${response.status}:${JSON.stringify(result)}`);
+				return { content: [{ type: "text", text: JSON.stringify(result) }], details: result };
+			},
+		});
+	}
+
 	for (const operation of isMain ? ["start", "send", "list", "get", "cancel", "publish", "report"] : ["report"]) {
 		const spec = isMain && operation === "report" ? {
 			fields: { kind: { type: "string", enum: ["question"] }, summary: string, details: {} },

package/host/omo-check/patches/omo-5.1.51-compaction-long-context.patch

@@ -0,0 +1,92 @@
+--- a/@code-yeongyu/senpi/dist/core/agent-session.js
++++ b/@code-yeongyu/senpi/dist/core/agent-session.js
+@@ -65,6 +65,7 @@ import { exportSessionToHtml, renderSessionToHtml, } from "./export-html/index.j
+ import { createToolHtmlRenderer } from "./export-html/tool-renderer.js";
+ import { reportExtensionHandlerStall } from "./extension-handler-stall-report.js";
+ import { ANTHROPIC_SUBSCRIPTION_PROVIDER_ID } from "./extensions/builtin/anthropic-subscription/account-management.js";
++import { CLAUDE_CODE_DEFAULT_CONTEXT_WINDOW, LEGACY_LONG_CONTEXT_MODEL_IDS } from "./extensions/builtin/anthropic-subscription/context-window.js";
+ import { askUserAnswerDisplayText } from "./extensions/builtin/ask-user/format.js";
+ import { getPromptCachePrewarmUsage } from "./extensions/builtin/cache-keepalive/prewarm-entry.js";
+ import { ModelUsabilityBudgetError, projectModelUsabilityBudget, } from "./extensions/builtin/compaction/model-usability-budget.js";
+@@ -1053,9 +1054,9 @@ export class AgentSession {
+         const usable = (model) => chat.some((entry) => same(entry, model)) && (!available.some((entry) => entry.provider === model.provider) || available.some((entry) => same(entry, model))) &&
+             !this._retryFallback.isProviderSpent(model.provider) &&
+             this._modelRuntime.isFallbackEligible(model.provider);
+-        const fits = (model) => {
+-            const output = Math.min(32768, model.maxTokens > 0 ? model.maxTokens : 32768, Math.floor(model.contextWindow / 2));
+-            return model.contextWindow > 0 && inputTokens + Math.max(settings.reserveTokens, output) <= model.contextWindow;
++        const fits = (model, window = model.contextWindow) => {
++            const output = Math.min(32768, model.maxTokens > 0 ? model.maxTokens : 32768, Math.floor(window / 2));
++            return window > 0 && inputTokens + Math.max(settings.reserveTokens, output) <= window;
+         };
+         if (explicit) {
+             if (typeof override !== "string" || !/^[^/\s]+\/\S+$/.test(override))
+@@ -1080,11 +1081,32 @@ export class AgentSession {
+             model.provider === sessionModel.provider && family.test(model.id)) : [];
+         // Stable sort preserves registry order within the regular and fast Luna groups.
+         preferred.sort((left, right) => Number(/-luna-fast$/.test(left.id)) - Number(/-luna-fast$/.test(right.id)));
+-        const candidates = [...(family?.test(sessionModel.id) ? [sessionModel] : []), ...preferred, sessionModel];
++        // A subscription opens a legacy model's 1M window only with usage credits; a native-1M model needs none.
++        // Subscription order: the newest Sonnet of the catalog, the main model, the other Sonnets newest first, then any
++        // other available model, each within the window it opens without credits. Other providers keep light, then main.
++        const subscription = sessionModel.provider === ANTHROPIC_SUBSCRIPTION_PROVIDER_ID;
++        const creditFreeWindow = (model) => subscription && LEGACY_LONG_CONTEXT_MODEL_IDS.has(model.id) ? Math.min(model.contextWindow, CLAUDE_CODE_DEFAULT_CONTEXT_WINDOW) : model.contextWindow;
++        const version = (model) => {
++            const match = /^claude-sonnet-(\d{1,3})(?:-(\d{1,3}))?(?=-|$)/.exec(model.id);
++            return match ? Number(match[1]) * 1000 + Number(match[2] ?? 0) : 0;
++        };
++        const light = [...(family?.test(sessionModel.id) ? [sessionModel] : []), ...preferred];
++        const sonnets = subscription ? chat.filter((model) => model.provider === sessionModel.provider && family?.test(model.id)).sort((left, right) => version(right) - version(left)) : [];
++        const candidates = subscription ? [...sonnets.slice(0, 1), sessionModel, ...sonnets.slice(1), ...available] : [...light, sessionModel];
++        // A subscription candidate with a recorded summary block yields to the next one; if every fitting
++        // candidate is blocked, the first block is the reported cause.
++        let blocked;
+         for (const candidate of candidates) {
+-            if (candidate.provider === sessionModel.provider && usable(candidate) && fits(candidate))
++            if (candidate.provider === sessionModel.provider && usable(candidate) && fits(candidate, creditFreeWindow(candidate))) {
++                if (subscription && summaryUnavailable(this.sessionManager, candidate)) {
++                    blocked ??= candidate;
++                    continue;
++                }
+                 return admit(candidate);
++            }
+         }
++        if (blocked)
++            return admit(blocked);
+         return fail(usable(sessionModel) ? "context_budget" : "model_unavailable");
+     }
+     _logCompactionModelFallback(override, reason, sessionModel) {
+--- a/@code-yeongyu/senpi/dist/core/extensions/builtin/compaction/speculative.js
++++ b/@code-yeongyu/senpi/dist/core/extensions/builtin/compaction/speculative.js
+@@ -252,7 +252,31 @@ export function canStartSummary(context, snapshot) {
+         return true;
+     }
+ }
++/**
++ * Gateway: a summary that a quota or account block stops moves once to the next model the resolver offers.
++ * The failed request recorded its block, so automatic selection skips that model; an explicit model, a model
++ * already tried and every other failure end the run. When every candidate is blocked the first error is thrown.
++ */
+ export async function runExtensionCompaction(context, snapshot, signal, onProgress) {
++    const tried = new Set();
++    let first;
++    for (;;) {
++        let selectedModel;
++        try { ({ selectedModel } = selectSummaryModel(context, snapshot)); }
++        catch (error) { throw first ?? error; }
++        const key = selectedModel.provider + "/" + selectedModel.id;
++        if (tried.has(key))
++            throw first;
++        tried.add(key);
++        try { return await runExtensionCompactionOnce(context, snapshot, signal, onProgress); }
++        catch (error) {
++            if (signal?.aborted || (error?.failure?.kind !== "quota" && error?.failure?.kind !== "account_blocked"))
++                throw error;
++            first ??= error;
++        }
++    }
++}
++async function runExtensionCompactionOnce(context, snapshot, signal, onProgress) {
+     if (signal?.aborted)
+         return undefined;
+     const { prompt, messages, inputTokens, selectedModel } = selectSummaryModel(context, snapshot);