@byh3071/vhk 1.0.2 → 1.3.1

package/dist/index.js

@@ -1,479 +1,28 @@
 #!/usr/bin/env node
 import {
-  __commonJS,
-  __toESM,
+  MAX_SCAN_FILE_BYTES,
+  MAX_SECRET_FINDINGS,
+  audit,
+  deploy,
   env,
   envCheck,
+  filterSevereFindings,
+  filterTrackedPaths,
+  getVhkVersion,
   ko,
   printNextStep,
+  printSecurityWarnings,
+  publish,
   readJsonFile,
   safeExecFile,
-  safeExecFileStream,
+  scanProjectForSecrets,
   startMcpServer,
   t
-} from "./chunk-SD7O6HO7.js";
-
-// node_modules/.pnpm/ignore@7.0.5/node_modules/ignore/index.js
-var require_ignore = __commonJS({
-  "node_modules/.pnpm/ignore@7.0.5/node_modules/ignore/index.js"(exports, module) {
-    "use strict";
-    function makeArray(subject) {
-      return Array.isArray(subject) ? subject : [subject];
-    }
-    var UNDEFINED = void 0;
-    var EMPTY = "";
-    var SPACE = " ";
-    var ESCAPE = "\\";
-    var REGEX_TEST_BLANK_LINE = /^\s+$/;
-    var REGEX_INVALID_TRAILING_BACKSLASH = /(?:[^\\]|^)\\$/;
-    var REGEX_REPLACE_LEADING_EXCAPED_EXCLAMATION = /^\\!/;
-    var REGEX_REPLACE_LEADING_EXCAPED_HASH = /^\\#/;
-    var REGEX_SPLITALL_CRLF = /\r?\n/g;
-    var REGEX_TEST_INVALID_PATH = /^\.{0,2}\/|^\.{1,2}$/;
-    var REGEX_TEST_TRAILING_SLASH = /\/$/;
-    var SLASH = "/";
-    var TMP_KEY_IGNORE = "node-ignore";
-    if (typeof Symbol !== "undefined") {
-      TMP_KEY_IGNORE = /* @__PURE__ */ Symbol.for("node-ignore");
-    }
-    var KEY_IGNORE = TMP_KEY_IGNORE;
-    var define = (object, key, value) => {
-      Object.defineProperty(object, key, { value });
-      return value;
-    };
-    var REGEX_REGEXP_RANGE = /([0-z])-([0-z])/g;
-    var RETURN_FALSE = () => false;
-    var sanitizeRange = (range) => range.replace(
-      REGEX_REGEXP_RANGE,
-      (match, from, to) => from.charCodeAt(0) <= to.charCodeAt(0) ? match : EMPTY
-    );
-    var cleanRangeBackSlash = (slashes) => {
-      const { length } = slashes;
-      return slashes.slice(0, length - length % 2);
-    };
-    var REPLACERS = [
-      [
-        // Remove BOM
-        // TODO:
-        // Other similar zero-width characters?
-        /^\uFEFF/,
-        () => EMPTY
-      ],
-      // > Trailing spaces are ignored unless they are quoted with backslash ("\")
-      [
-        // (a\ ) -> (a )
-        // (a  ) -> (a)
-        // (a ) -> (a)
-        // (a \ ) -> (a  )
-        /((?:\\\\)*?)(\\?\s+)$/,
-        (_, m1, m2) => m1 + (m2.indexOf("\\") === 0 ? SPACE : EMPTY)
-      ],
-      // Replace (\ ) with ' '
-      // (\ ) -> ' '
-      // (\\ ) -> '\\ '
-      // (\\\ ) -> '\\ '
-      [
-        /(\\+?)\s/g,
-        (_, m1) => {
-          const { length } = m1;
-          return m1.slice(0, length - length % 2) + SPACE;
-        }
-      ],
-      // Escape metacharacters
-      // which is written down by users but means special for regular expressions.
-      // > There are 12 characters with special meanings:
-      // > - the backslash \,
-      // > - the caret ^,
-      // > - the dollar sign $,
-      // > - the period or dot .,
-      // > - the vertical bar or pipe symbol |,
-      // > - the question mark ?,
-      // > - the asterisk or star *,
-      // > - the plus sign +,
-      // > - the opening parenthesis (,
-      // > - the closing parenthesis ),
-      // > - and the opening square bracket [,
-      // > - the opening curly brace {,
-      // > These special characters are often called "metacharacters".
-      [
-        /[\\$.|*+(){^]/g,
-        (match) => `\\${match}`
-      ],
-      [
-        // > a question mark (?) matches a single character
-        /(?!\\)\?/g,
-        () => "[^/]"
-      ],
-      // leading slash
-      [
-        // > A leading slash matches the beginning of the pathname.
-        // > For example, "/*.c" matches "cat-file.c" but not "mozilla-sha1/sha1.c".
-        // A leading slash matches the beginning of the pathname
-        /^\//,
-        () => "^"
-      ],
-      // replace special metacharacter slash after the leading slash
-      [
-        /\//g,
-        () => "\\/"
-      ],
-      [
-        // > A leading "**" followed by a slash means match in all directories.
-        // > For example, "**/foo" matches file or directory "foo" anywhere,
-        // > the same as pattern "foo".
-        // > "**/foo/bar" matches file or directory "bar" anywhere that is directly
-        // >   under directory "foo".
-        // Notice that the '*'s have been replaced as '\\*'
-        /^\^*\\\*\\\*\\\//,
-        // '**/foo' <-> 'foo'
-        () => "^(?:.*\\/)?"
-      ],
-      // starting
-      [
-        // there will be no leading '/'
-        //   (which has been replaced by section "leading slash")
-        // If starts with '**', adding a '^' to the regular expression also works
-        /^(?=[^^])/,
-        function startingReplacer() {
-          return !/\/(?!$)/.test(this) ? "(?:^|\\/)" : "^";
-        }
-      ],
-      // two globstars
-      [
-        // Use lookahead assertions so that we could match more than one `'/**'`
-        /\\\/\\\*\\\*(?=\\\/|$)/g,
-        // Zero, one or several directories
-        // should not use '*', or it will be replaced by the next replacer
-        // Check if it is not the last `'/**'`
-        (_, index, str) => index + 6 < str.length ? "(?:\\/[^\\/]+)*" : "\\/.+"
-      ],
-      // normal intermediate wildcards
-      [
-        // Never replace escaped '*'
-        // ignore rule '\*' will match the path '*'
-        // 'abc.*/' -> go
-        // 'abc.*'  -> skip this rule,
-        //    coz trailing single wildcard will be handed by [trailing wildcard]
-        /(^|[^\\]+)(\\\*)+(?=.+)/g,
-        // '*.js' matches '.js'
-        // '*.js' doesn't match 'abc'
-        (_, p1, p2) => {
-          const unescaped = p2.replace(/\\\*/g, "[^\\/]*");
-          return p1 + unescaped;
-        }
-      ],
-      [
-        // unescape, revert step 3 except for back slash
-        // For example, if a user escape a '\\*',
-        // after step 3, the result will be '\\\\\\*'
-        /\\\\\\(?=[$.|*+(){^])/g,
-        () => ESCAPE
-      ],
-      [
-        // '\\\\' -> '\\'
-        /\\\\/g,
-        () => ESCAPE
-      ],
-      [
-        // > The range notation, e.g. [a-zA-Z],
-        // > can be used to match one of the characters in a range.
-        // `\` is escaped by step 3
-        /(\\)?\[([^\]/]*?)(\\*)($|\])/g,
-        (match, leadEscape, range, endEscape, close) => leadEscape === ESCAPE ? `\\[${range}${cleanRangeBackSlash(endEscape)}${close}` : close === "]" ? endEscape.length % 2 === 0 ? `[${sanitizeRange(range)}${endEscape}]` : "[]" : "[]"
-      ],
-      // ending
-      [
-        // 'js' will not match 'js.'
-        // 'ab' will not match 'abc'
-        /(?:[^*])$/,
-        // WTF!
-        // https://git-scm.com/docs/gitignore
-        // changes in [2.22.1](https://git-scm.com/docs/gitignore/2.22.1)
-        // which re-fixes #24, #38
-        // > If there is a separator at the end of the pattern then the pattern
-        // > will only match directories, otherwise the pattern can match both
-        // > files and directories.
-        // 'js*' will not match 'a.js'
-        // 'js/' will not match 'a.js'
-        // 'js' will match 'a.js' and 'a.js/'
-        (match) => /\/$/.test(match) ? `${match}$` : `${match}(?=$|\\/$)`
-      ]
-    ];
-    var REGEX_REPLACE_TRAILING_WILDCARD = /(^|\\\/)?\\\*$/;
-    var MODE_IGNORE = "regex";
-    var MODE_CHECK_IGNORE = "checkRegex";
-    var UNDERSCORE = "_";
-    var TRAILING_WILD_CARD_REPLACERS = {
-      [MODE_IGNORE](_, p1) {
-        const prefix = p1 ? `${p1}[^/]+` : "[^/]*";
-        return `${prefix}(?=$|\\/$)`;
-      },
-      [MODE_CHECK_IGNORE](_, p1) {
-        const prefix = p1 ? `${p1}[^/]*` : "[^/]*";
-        return `${prefix}(?=$|\\/$)`;
-      }
-    };
-    var makeRegexPrefix = (pattern) => REPLACERS.reduce(
-      (prev, [matcher, replacer]) => prev.replace(matcher, replacer.bind(pattern)),
-      pattern
-    );
-    var isString = (subject) => typeof subject === "string";
-    var checkPattern = (pattern) => pattern && isString(pattern) && !REGEX_TEST_BLANK_LINE.test(pattern) && !REGEX_INVALID_TRAILING_BACKSLASH.test(pattern) && pattern.indexOf("#") !== 0;
-    var splitPattern = (pattern) => pattern.split(REGEX_SPLITALL_CRLF).filter(Boolean);
-    var IgnoreRule = class {
-      constructor(pattern, mark, body, ignoreCase, negative, prefix) {
-        this.pattern = pattern;
-        this.mark = mark;
-        this.negative = negative;
-        define(this, "body", body);
-        define(this, "ignoreCase", ignoreCase);
-        define(this, "regexPrefix", prefix);
-      }
-      get regex() {
-        const key = UNDERSCORE + MODE_IGNORE;
-        if (this[key]) {
-          return this[key];
-        }
-        return this._make(MODE_IGNORE, key);
-      }
-      get checkRegex() {
-        const key = UNDERSCORE + MODE_CHECK_IGNORE;
-        if (this[key]) {
-          return this[key];
-        }
-        return this._make(MODE_CHECK_IGNORE, key);
-      }
-      _make(mode, key) {
-        const str = this.regexPrefix.replace(
-          REGEX_REPLACE_TRAILING_WILDCARD,
-          // It does not need to bind pattern
-          TRAILING_WILD_CARD_REPLACERS[mode]
-        );
-        const regex = this.ignoreCase ? new RegExp(str, "i") : new RegExp(str);
-        return define(this, key, regex);
-      }
-    };
-    var createRule = ({
-      pattern,
-      mark
-    }, ignoreCase) => {
-      let negative = false;
-      let body = pattern;
-      if (body.indexOf("!") === 0) {
-        negative = true;
-        body = body.substr(1);
-      }
-      body = body.replace(REGEX_REPLACE_LEADING_EXCAPED_EXCLAMATION, "!").replace(REGEX_REPLACE_LEADING_EXCAPED_HASH, "#");
-      const regexPrefix = makeRegexPrefix(body);
-      return new IgnoreRule(
-        pattern,
-        mark,
-        body,
-        ignoreCase,
-        negative,
-        regexPrefix
-      );
-    };
-    var RuleManager = class {
-      constructor(ignoreCase) {
-        this._ignoreCase = ignoreCase;
-        this._rules = [];
-      }
-      _add(pattern) {
-        if (pattern && pattern[KEY_IGNORE]) {
-          this._rules = this._rules.concat(pattern._rules._rules);
-          this._added = true;
-          return;
-        }
-        if (isString(pattern)) {
-          pattern = {
-            pattern
-          };
-        }
-        if (checkPattern(pattern.pattern)) {
-          const rule = createRule(pattern, this._ignoreCase);
-          this._added = true;
-          this._rules.push(rule);
-        }
-      }
-      // @param {Array<string> | string | Ignore} pattern
-      add(pattern) {
-        this._added = false;
-        makeArray(
-          isString(pattern) ? splitPattern(pattern) : pattern
-        ).forEach(this._add, this);
-        return this._added;
-      }
-      // Test one single path without recursively checking parent directories
-      //
-      // - checkUnignored `boolean` whether should check if the path is unignored,
-      //   setting `checkUnignored` to `false` could reduce additional
-      //   path matching.
-      // - check `string` either `MODE_IGNORE` or `MODE_CHECK_IGNORE`
-      // @returns {TestResult} true if a file is ignored
-      test(path15, checkUnignored, mode) {
-        let ignored = false;
-        let unignored = false;
-        let matchedRule;
-        this._rules.forEach((rule) => {
-          const { negative } = rule;
-          if (unignored === negative && ignored !== unignored || negative && !ignored && !unignored && !checkUnignored) {
-            return;
-          }
-          const matched = rule[mode].test(path15);
-          if (!matched) {
-            return;
-          }
-          ignored = !negative;
-          unignored = negative;
-          matchedRule = negative ? UNDEFINED : rule;
-        });
-        const ret = {
-          ignored,
-          unignored
-        };
-        if (matchedRule) {
-          ret.rule = matchedRule;
-        }
-        return ret;
-      }
-    };
-    var throwError = (message, Ctor) => {
-      throw new Ctor(message);
-    };
-    var checkPath = (path15, originalPath, doThrow) => {
-      if (!isString(path15)) {
-        return doThrow(
-          `path must be a string, but got \`${originalPath}\``,
-          TypeError
-        );
-      }
-      if (!path15) {
-        return doThrow(`path must not be empty`, TypeError);
-      }
-      if (checkPath.isNotRelative(path15)) {
-        const r = "`path.relative()`d";
-        return doThrow(
-          `path should be a ${r} string, but got "${originalPath}"`,
-          RangeError
-        );
-      }
-      return true;
-    };
-    var isNotRelative = (path15) => REGEX_TEST_INVALID_PATH.test(path15);
-    checkPath.isNotRelative = isNotRelative;
-    checkPath.convert = (p) => p;
-    var Ignore = class {
-      constructor({
-        ignorecase = true,
-        ignoreCase = ignorecase,
-        allowRelativePaths = false
-      } = {}) {
-        define(this, KEY_IGNORE, true);
-        this._rules = new RuleManager(ignoreCase);
-        this._strictPathCheck = !allowRelativePaths;
-        this._initCache();
-      }
-      _initCache() {
-        this._ignoreCache = /* @__PURE__ */ Object.create(null);
-        this._testCache = /* @__PURE__ */ Object.create(null);
-      }
-      add(pattern) {
-        if (this._rules.add(pattern)) {
-          this._initCache();
-        }
-        return this;
-      }
-      // legacy
-      addPattern(pattern) {
-        return this.add(pattern);
-      }
-      // @returns {TestResult}
-      _test(originalPath, cache, checkUnignored, slices) {
-        const path15 = originalPath && checkPath.convert(originalPath);
-        checkPath(
-          path15,
-          originalPath,
-          this._strictPathCheck ? throwError : RETURN_FALSE
-        );
-        return this._t(path15, cache, checkUnignored, slices);
-      }
-      checkIgnore(path15) {
-        if (!REGEX_TEST_TRAILING_SLASH.test(path15)) {
-          return this.test(path15);
-        }
-        const slices = path15.split(SLASH).filter(Boolean);
-        slices.pop();
-        if (slices.length) {
-          const parent = this._t(
-            slices.join(SLASH) + SLASH,
-            this._testCache,
-            true,
-            slices
-          );
-          if (parent.ignored) {
-            return parent;
-          }
-        }
-        return this._rules.test(path15, false, MODE_CHECK_IGNORE);
-      }
-      _t(path15, cache, checkUnignored, slices) {
-        if (path15 in cache) {
-          return cache[path15];
-        }
-        if (!slices) {
-          slices = path15.split(SLASH).filter(Boolean);
-        }
-        slices.pop();
-        if (!slices.length) {
-          return cache[path15] = this._rules.test(path15, checkUnignored, MODE_IGNORE);
-        }
-        const parent = this._t(
-          slices.join(SLASH) + SLASH,
-          cache,
-          checkUnignored,
-          slices
-        );
-        return cache[path15] = parent.ignored ? parent : this._rules.test(path15, checkUnignored, MODE_IGNORE);
-      }
-      ignores(path15) {
-        return this._test(path15, this._ignoreCache, false).ignored;
-      }
-      createFilter() {
-        return (path15) => !this.ignores(path15);
-      }
-      filter(paths) {
-        return makeArray(paths).filter(this.createFilter());
-      }
-      // @returns {TestResult}
-      test(path15) {
-        return this._test(path15, this._testCache, true);
-      }
-    };
-    var factory = (options) => new Ignore(options);
-    var isPathValid = (path15) => checkPath(path15 && checkPath.convert(path15), path15, RETURN_FALSE);
-    var setupWindows = () => {
-      const makePosix = (str) => /^\\\\\?\\/.test(str) || /["<>|\u0000-\u001F]+/u.test(str) ? str : str.replace(/\\/g, "/");
-      checkPath.convert = makePosix;
-      const REGEX_TEST_WINDOWS_PATH_ABSOLUTE = /^[a-z]:\//i;
-      checkPath.isNotRelative = (path15) => REGEX_TEST_WINDOWS_PATH_ABSOLUTE.test(path15) || isNotRelative(path15);
-    };
-    if (
-      // Detect `process` so that it can run in browsers.
-      typeof process !== "undefined" && process.platform === "win32"
-    ) {
-      setupWindows();
-    }
-    module.exports = factory;
-    factory.default = factory;
-    module.exports.isPathValid = isPathValid;
-    define(module.exports, /* @__PURE__ */ Symbol.for("setupWindows"), setupWindows);
-  }
-});
+} from "./chunk-6S3JYYZ3.js";
 
 // src/index.ts
 import { Command, Help } from "commander";
-import inquirer14 from "inquirer";
+import inquirer12 from "inquirer";
 
 // src/lib/nlp-router.ts
 function normalize(input) {
@@ -492,24 +41,23 @@ function matchesKeywords(text, command) {
 }
 var RULES = [
   {
-    command: "init",
-    explanation: "\uAC80\uC99D \uC2A4\uD0B5\uD558\uACE0 \uBC14\uB85C \uD504\uB85C\uC81D\uD2B8 \uC2DC\uC791 (vhk \uC2DC\uC791 --skip-gate)",
-    confidence: "high",
-    args: ["--skip-gate"],
-    test: (t2) => /기획.*(끝|완료)|노션.*(기획|완료)|검증.*(스킵|건너)|gate.*(스킵|건너)|바로.*시작/.test(t2)
-  },
-  {
-    command: "init",
-    explanation: "Notion\uC5D0\uC11C \uAC00\uC838\uC640 \uD504\uB85C\uC81D\uD2B8 \uC2DC\uC791 (vhk \uC2DC\uC791 --from-notion)",
+    command: "start",
+    explanation: "\uB178\uC158\uC5D0\uC11C \uAC00\uC838\uC640 \uC0C8 \uD504\uB85C\uC81D\uD2B8 \uC2DC\uC791 \uB9C8\uBC95\uC0AC (vhk start --from-notion)",
     confidence: "low",
     args: ["--from-notion"],
     test: (t2) => /노션|notion/.test(t2) && /(시작|만들|import|가져)/.test(t2)
   },
+  {
+    command: "start",
+    explanation: "\uC0C8 \uD504\uB85C\uC81D\uD2B8 \uC2DC\uC791 \uB9C8\uBC95\uC0AC \u2014 git+\uBB38\uC11C+MCP+\uCEE8\uD14D\uC2A4\uD2B8 (vhk start)",
+    confidence: "high",
+    test: (t2) => /프로젝트.*(만들|시작)|폴더.*만들|만들고\s*싶|새\s*프로젝트|^시작$|마법사|기획.*(끝|완료)|검증.*(스킵|건너)|gate.*(스킵|건너)|바로.*시작/.test(t2) && !/디자인|design|팔레트|palette|테마|theme|레퍼런스|reference|다크\s*모드|라이트\s*모드|색상\s*모드|브리핑|brief|컨텍스트|context|맥락|기억|memory|^초기화$|하네스.*만/.test(t2)
+  },
   {
     command: "init",
-    explanation: "\uD504\uB85C\uC81D\uD2B8 \uC2DC\uC791 (vhk \uC2DC\uC791)",
+    explanation: "\uBB38\uC11C/\uD558\uB124\uC2A4 \uD30C\uC77C\uB9CC \uC0DD\uC131 (vhk init) \u2014 git/MCP/context\uB294 \uC81C\uC678",
     confidence: "high",
-    test: (t2) => (/프로젝트.*(만들|시작)|폴더.*만들|만들고\s*싶|하네스|초기화/.test(t2) || /^시작$/.test(t2)) && !/디자인|design|팔레트|palette|테마|theme|레퍼런스|reference|다크\s*모드|라이트\s*모드|색상\s*모드|브리핑|brief|컨텍스트|context|맥락|기억|memory/.test(t2)
+    test: (t2) => /^init$|^초기화$|하네스\s*만|문서\s*만\s*만들|init\s*만/.test(t2)
   },
   {
     command: "mcp-init",
@@ -678,6 +226,36 @@ var RULES = [
     explanation: "npm \uBC30\uD3EC (vhk publish)",
     confidence: "high",
     test: (t2) => /^출시$|출시\s*해|^publish$|퍼블리시|npm\s*(배포|출시)|버전\s*올|^릴리즈$|^release$/.test(t2) && !/체크|준비|회고/.test(t2)
+  },
+  // NLP 규칙은 한국어 표현만 매칭. 영문 `goal <sub>` 은 commander 가 직접 처리하도록
+  // 가로채기 금지 — vhk goal list / next / check / done 그대로 동작.
+  {
+    command: "goal",
+    explanation: "\uB2E4\uC74C goal \uC790\uB3D9 \uC120\uD0DD (vhk goal next)",
+    confidence: "high",
+    args: ["next"],
+    test: (t2) => /다음\s*목표|목표\s*다음/.test(t2)
+  },
+  {
+    command: "goal",
+    explanation: "\uBAA9\uD45C \uAC8C\uC774\uD2B8 \uAC80\uC99D (vhk goal check)",
+    confidence: "high",
+    args: ["check"],
+    test: (t2) => /목표\s*(점검|검증|체크)/.test(t2)
+  },
+  {
+    command: "goal",
+    explanation: "\uBAA9\uD45C \uC644\uB8CC \uCC98\uB9AC (vhk goal done)",
+    confidence: "high",
+    args: ["done"],
+    test: (t2) => /목표\s*(완료|마감)/.test(t2)
+  },
+  {
+    command: "goal",
+    explanation: "\uBAA9\uD45C \uBAA9\uB85D (vhk goal list)",
+    confidence: "high",
+    args: ["list"],
+    test: (t2) => /목표\s*(목록|리스트)/.test(t2)
   }
 ];
 function routeNaturalLanguage(input) {
@@ -705,8 +283,11 @@ var KNOWN_COMMAND_TOKENS = /* @__PURE__ */ new Set([
   "gate",
   "\uAC80\uC99D",
   "\uC544\uC774\uB514\uC5B4",
-  "init",
+  "start",
   "\uC2DC\uC791",
+  "\uC0C8\uD504\uB85C\uC81D\uD2B8",
+  "init",
+  "\uCD08\uAE30\uD654",
   "\uB9CC\uB4E4\uAE30",
   "recap",
   "\uC815\uB9AC",
@@ -771,6 +352,14 @@ var KNOWN_COMMAND_TOKENS = /* @__PURE__ */ new Set([
   "\uAE30\uC5B5",
   "brief",
   "\uBE0C\uB9AC\uD551",
+  "goal",
+  "\uBAA9\uD45C",
+  "blocker",
+  "\uBE14\uB85C\uCEE4",
+  "learn",
+  "\uAD50\uD6C8",
+  "resume",
+  "\uC7AC\uAC1C",
   "help"
 ]);
 function isOptionToken(token) {
@@ -794,8 +383,8 @@ function detectNaturalLanguageInput(argv) {
 }
 
 // src/lib/nlp-run.ts
-import chalk28 from "chalk";
-import inquirer13 from "inquirer";
+import chalk26 from "chalk";
+import inquirer11 from "inquirer";
 
 // src/commands/gate.ts
 import inquirer from "inquirer";
@@ -929,9 +518,9 @@ ${ko.gate.verdictTitle}
 
 // src/commands/init.ts
 import inquirer2 from "inquirer";
-import chalk4 from "chalk";
-import fs3 from "fs";
-import path3 from "path";
+import chalk3 from "chalk";
+import fs2 from "fs";
+import path2 from "path";
 
 // src/templates/claude-md.ts
 function CLAUDE_MD_TEMPLATE(name, _stack) {
@@ -1119,6 +708,14 @@ function COMMANDS_MD_TEMPLATE() {
     "\uC774 \uD504\uB85C\uC81D\uD2B8\uC5D0\uC11C \uC790\uC8FC \uC4F0\uB294 \uBA85\uB839\uC5B4\uC785\uB2C8\uB2E4.",
     "Cursor\uC5D0\uAC8C \uD55C\uAD6D\uC5B4\uB85C \uB9D0\uD574\uB3C4 \uB429\uB2C8\uB2E4.",
     "",
+    "## \uC0C8 \uD504\uB85C\uC81D\uD2B8 \uC2DC\uC791",
+    "",
+    "| \uD558\uACE0 \uC2F6\uC740 \uAC83 | \uD130\uBBF8\uB110 \uBA85\uB839 | Cursor\uC5D0\uAC8C \uB9D0\uD558\uAE30 |",
+    "|-------------|-----------|------------------|",
+    '| \uC0C8 \uD504\uB85C\uC81D\uD2B8 \uC2DC\uC791 (\uC62C\uC778\uC6D0) | `vhk start` | "\uC0C8 \uD504\uB85C\uC81D\uD2B8 \uC2DC\uC791\uD574\uC918" |',
+    "",
+    "> `vhk start` \uD558\uB098\uB85C `git init` + \uBB38\uC11C \uC0DD\uC131 + Cursor MCP \uB4F1\uB85D + AI \uCEE8\uD14D\uC2A4\uD2B8 \uC0DD\uC131\uC744 \uD55C \uBC88\uC5D0 \uCC98\uB9AC\uD569\uB2C8\uB2E4. \uBA85\uB839\uC5B4 \uC678\uC6B8 \uD544\uC694 \uC5C6\uC5B4\uC694.",
+    "",
     "## \uB9E4\uC77C \uC4F0\uB294 \uBA85\uB839\uC5B4",
     "",
     "| \uD558\uACE0 \uC2F6\uC740 \uAC83 | \uD130\uBBF8\uB110 \uBA85\uB839 | Cursor\uC5D0\uAC8C \uB9D0\uD558\uAE30 |",
@@ -1141,113 +738,27 @@ function COMMANDS_MD_TEMPLATE() {
   ].join("\n");
 }
 
-// src/lib/check-secure.ts
-var import_ignore = __toESM(require_ignore(), 1);
-import fs from "fs";
-import path from "path";
-import chalk2 from "chalk";
-function loadGitignore(rootDir) {
-  const ig = (0, import_ignore.default)();
-  const gitignorePath = path.join(rootDir, ".gitignore");
-  if (fs.existsSync(gitignorePath)) {
-    const content = fs.readFileSync(gitignorePath, "utf-8");
-    ig.add(content);
-  }
-  return ig;
-}
-function isPathIgnored(ig, relativePath) {
-  const normalized = relativePath.replace(/\\/g, "/");
-  return ig.ignores(normalized);
-}
-function findExposedSensitiveFiles(rootDir, ig = loadGitignore(rootDir), maxDepth = 8) {
-  const exposed = [];
-  function walk(dir, depth) {
-    if (depth > maxDepth) return;
-    let entries;
-    try {
-      entries = fs.readdirSync(dir, { withFileTypes: true });
-    } catch {
-      return;
-    }
-    for (const entry of entries) {
-      if (entry.name === "node_modules" || entry.name === ".git") continue;
-      const fullPath = path.join(dir, entry.name);
-      const rel = path.relative(rootDir, fullPath).replace(/\\/g, "/");
-      if (entry.isDirectory()) {
-        if (!isPathIgnored(ig, rel + "/")) walk(fullPath, depth + 1);
-        continue;
-      }
-      if (isSensitiveName(entry.name) && !isPathIgnored(ig, rel)) {
-        exposed.push(rel);
-      }
-    }
-  }
-  walk(rootDir, 0);
-  return exposed;
-}
-function isSensitiveName(name) {
-  const lower = name.toLowerCase();
-  if (lower === ".env" || lower.startsWith(".env.")) return true;
-  if (lower.endsWith(".pem") || lower.endsWith(".key")) return true;
-  if (lower === "credentials.json" || lower === "secrets.json") return true;
-  if (lower.startsWith("id_rsa")) return true;
-  return false;
-}
-function checkProjectSecurity(rootDir = process.cwd()) {
-  const gitignorePath = path.join(rootDir, ".gitignore");
-  const missingGitignore = !fs.existsSync(gitignorePath);
-  const ig = loadGitignore(rootDir);
-  const exposedPaths = findExposedSensitiveFiles(rootDir, ig);
-  const warnings = [];
-  if (missingGitignore) {
-    warnings.push(".gitignore \uD30C\uC77C\uC774 \uC5C6\uC2B5\uB2C8\uB2E4. \uBBFC\uAC10\uD55C \uD30C\uC77C\uC774 \uC2E4\uC218\uB85C \uC62C\uB77C\uAC08 \uC218 \uC788\uC5B4\uC694.");
-  }
-  if (exposedPaths.length > 0) {
-    warnings.push(
-      `ignore\uB418\uC9C0 \uC54A\uC740 \uBBFC\uAC10 \uD30C\uC77C ${exposedPaths.length}\uAC1C: ${exposedPaths.join(", ")}`
-    );
-  }
-  return {
-    ok: !missingGitignore && exposedPaths.length === 0,
-    missingGitignore,
-    exposedPaths,
-    warnings
-  };
-}
-function printSecurityWarnings(rootDir = process.cwd()) {
-  const result = checkProjectSecurity(rootDir);
-  if (result.ok) return true;
-  for (const w of result.warnings) {
-    console.log(chalk2.yellow(`   \u26A0\uFE0F  ${w}`));
-  }
-  return false;
-}
-function filterTrackedPaths(paths, rootDir = process.cwd()) {
-  const ig = loadGitignore(rootDir);
-  return paths.filter((p) => !isPathIgnored(ig, p.replace(/\\/g, "/")));
-}
-
 // src/utils/logger.ts
-import chalk3 from "chalk";
+import chalk2 from "chalk";
 var log = {
-  success: (msg) => console.log(chalk3.green(`\u2705 ${msg}`)),
-  error: (msg) => console.log(chalk3.red(`\u274C ${msg}`)),
-  warn: (msg) => console.log(chalk3.yellow(`\u26A0\uFE0F ${msg}`)),
-  info: (msg) => console.log(chalk3.blue(`\u2139\uFE0F ${msg}`)),
-  step: (msg) => console.log(chalk3.bold(`
+  success: (msg) => console.log(chalk2.green(`\u2705 ${msg}`)),
+  error: (msg) => console.log(chalk2.red(`\u274C ${msg}`)),
+  warn: (msg) => console.log(chalk2.yellow(`\u26A0\uFE0F ${msg}`)),
+  info: (msg) => console.log(chalk2.blue(`\u2139\uFE0F ${msg}`)),
+  step: (msg) => console.log(chalk2.bold(`
 \u25B8 ${msg}`))
 };
 
 // src/utils/file.ts
-import fs2 from "fs";
-import path2 from "path";
+import fs from "fs";
+import path from "path";
 function writeFile(filePath, content) {
-  const dir = path2.dirname(filePath);
-  if (!fs2.existsSync(dir)) fs2.mkdirSync(dir, { recursive: true });
-  fs2.writeFileSync(filePath, content, "utf-8");
+  const dir = path.dirname(filePath);
+  if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
+  fs.writeFileSync(filePath, content, "utf-8");
 }
 function fileExists(filePath) {
-  return fs2.existsSync(filePath);
+  return fs.existsSync(filePath);
 }
 
 // src/lib/notion-import.ts
@@ -1439,11 +950,11 @@ async function collectAnswers(options, defaults = {}) {
 async function init(options = {}) {
   const skipGate = Boolean(options.skipGate || options.fromNotion);
   if (skipGate) {
-    console.log(chalk4.dim(`
+    console.log(chalk3.dim(`
 ${ko.init.skipGate}
 `));
   }
-  console.log(chalk4.bold(`
+  console.log(chalk3.bold(`
 ${ko.init.title}
 `));
   printSecurityWarnings();
@@ -1468,7 +979,7 @@ ${ko.init.title}
     process.exit(1);
   }
   const stack = STACK_PRESETS[answers.type];
-  console.log(chalk4.dim(`
+  console.log(chalk3.dim(`
 ${ko.init.recommendedStack} ${stack.join(" + ")}
 `));
   if (!options.yes) {
@@ -1487,7 +998,7 @@ ${ko.init.recommendedStack} ${stack.join(" + ")}
   const files = generateFiles(answers.name, answers.description, stack, prdContent);
   log.step(ko.init.filesGenerating);
   for (const [filePath, content] of Object.entries(files)) {
-    const fullPath = path3.join(cwd, filePath);
+    const fullPath = path2.join(cwd, filePath);
     if (fileExists(fullPath)) {
       const { overwrite } = await inquirer2.prompt([{
         type: "confirm",
@@ -1504,21 +1015,21 @@ ${ko.init.recommendedStack} ${stack.join(" + ")}
     log.success(filePath);
   }
   await writeInitExtras(cwd);
-  console.log(chalk4.bold.green(`
+  console.log(chalk3.bold.green(`
 ${ko.init.done}`));
-  console.log(chalk4.dim(`
+  console.log(chalk3.dim(`
 ${ko.init.nextSteps}`));
   if (options.fromNotion) {
     console.log(`  1. ${ko.init.notionReviewHint}`);
     console.log(`  2. ${ko.init.gitHintLabel}`);
-    console.log(`     ${chalk4.cyan(ko.init.gitHintCommand)}`);
+    console.log(`     ${chalk3.cyan(ko.init.gitHintCommand)}`);
     console.log(`  3. ${ko.init.startDev}
 `);
   } else {
     console.log(`  1. ${ko.init.fillHint}`);
     console.log(`  2. ${ko.init.prdHint}`);
     console.log(`  3. ${ko.init.gitHintLabel}`);
-    console.log(`     ${chalk4.cyan(ko.init.gitHintCommand)}`);
+    console.log(`     ${chalk3.cyan(ko.init.gitHintCommand)}`);
     console.log(`  4. ${ko.init.startDev}
 `);
   }
@@ -1566,15 +1077,15 @@ var VHK_PACKAGE_SCRIPTS = {
   doctor: "vhk doctor"
 };
 function enhancePackageScripts(projectDir) {
-  const pkgPath = path3.join(projectDir, "package.json");
-  if (!fs3.existsSync(pkgPath)) return false;
+  const pkgPath = path2.join(projectDir, "package.json");
+  if (!fs2.existsSync(pkgPath)) return false;
   const pkg = readJsonFile(pkgPath);
   pkg.scripts = { ...VHK_PACKAGE_SCRIPTS, ...pkg.scripts };
-  fs3.writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + "\n", "utf-8");
+  fs2.writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + "\n", "utf-8");
   return true;
 }
 async function writeInitExtras(projectDir) {
-  const commandsPath = path3.join(projectDir, "COMMANDS.md");
+  const commandsPath = path2.join(projectDir, "COMMANDS.md");
   if (fileExists(commandsPath)) {
     const { overwrite } = await inquirer2.prompt([{
       type: "confirm",
@@ -1599,16 +1110,16 @@ async function writeInitExtras(projectDir) {
 
 // src/commands/recap.ts
 import inquirer3 from "inquirer";
-import chalk5 from "chalk";
-import fs5 from "fs";
-import path6 from "path";
+import chalk4 from "chalk";
+import fs4 from "fs";
+import path5 from "path";
 
 // src/lib/git.ts
-import path4 from "path";
-import simpleGit from "simple-git";
+import path3 from "path";
+import { simpleGit } from "simple-git";
 var git = simpleGit();
 function isNoiseRecapPath(filePath) {
-  const base = path4.basename(filePath);
+  const base = path3.basename(filePath);
   if (base.includes("${") || base.includes("`")) return true;
   if (/^\d+(\.\d+)?$/.test(base)) return true;
   if (/^(pnpm|vhk|npm|node|yarn)$/i.test(base)) return true;
@@ -1647,7 +1158,16 @@ async function getSessionDiff(since) {
   const sinceDate = since || (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
   try {
     const diffSummary = await git.diffSummary([`--since=${sinceDate}`]);
-    return buildSessionDiffFromSummary(diffSummary);
+    const normalized = diffSummary.files.map((f) => ({
+      file: f.file,
+      insertions: "insertions" in f ? f.insertions : 0,
+      deletions: "deletions" in f ? f.deletions : 0
+    }));
+    return buildSessionDiffFromSummary({
+      insertions: diffSummary.insertions,
+      deletions: diffSummary.deletions,
+      files: normalized
+    });
   } catch {
     return { filesChanged: 0, insertions: 0, deletions: 0, files: [] };
   }
@@ -1685,8 +1205,8 @@ async function hasAnyCommits() {
 }
 
 // src/lib/adr.ts
-import fs4 from "fs";
-import path5 from "path";
+import fs3 from "fs";
+import path4 from "path";
 var ADR_RULES = [
   {
     title: "\uC758\uC874\uC131 \uBCC0\uACBD",
@@ -1729,20 +1249,20 @@ function detectAdrCandidates(diff2) {
   return candidates;
 }
 function nextAdrNumber(adrDir) {
-  if (!fs4.existsSync(adrDir)) return 1;
-  const nums = fs4.readdirSync(adrDir).map((name) => name.match(/^ADR-(\d+)/i)?.[1]).filter((n) => Boolean(n)).map((n) => parseInt(n, 10));
+  if (!fs3.existsSync(adrDir)) return 1;
+  const nums = fs3.readdirSync(adrDir).map((name) => name.match(/^ADR-(\d+)/i)?.[1]).filter((n) => Boolean(n)).map((n) => parseInt(n, 10));
   return nums.length ? Math.max(...nums) + 1 : 1;
 }
 function slugify(title) {
   return title.toLowerCase().replace(/\s+/g, "-").replace(/[^a-z0-9가-힣-]/g, "").slice(0, 40) || "decision";
 }
 function createAdrFile(cwd, title, context2, decision, consequences) {
-  const adrDir = path5.join(cwd, "docs", "adr");
-  if (!fs4.existsSync(adrDir)) fs4.mkdirSync(adrDir, { recursive: true });
+  const adrDir = path4.join(cwd, "docs", "adr");
+  if (!fs3.existsSync(adrDir)) fs3.mkdirSync(adrDir, { recursive: true });
   const num = nextAdrNumber(adrDir);
   const today = (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
   const fileName = `ADR-${String(num).padStart(3, "0")}-${slugify(title)}.md`;
-  const filePath = path5.join(adrDir, fileName);
+  const filePath = path4.join(adrDir, fileName);
   const content = [
     "---",
     `id: ADR-${String(num).padStart(3, "0")}`,
@@ -1768,51 +1288,51 @@ function createAdrFile(cwd, title, context2, decision, consequences) {
     "---",
     `*Generated by \`vhk recap\` at ${(/* @__PURE__ */ new Date()).toISOString()}*`
   ].join("\n");
-  fs4.writeFileSync(filePath, content, "utf-8");
+  fs3.writeFileSync(filePath, content, "utf-8");
   return filePath;
 }
 
 // src/commands/recap.ts
 async function recap(options = {}) {
-  console.log(chalk5.bold(`
+  console.log(chalk4.bold(`
 ${ko.recap.title}
 `));
   if (!await isGitRepo()) {
-    console.log(chalk5.red(ko.recap.noRepo));
+    console.log(chalk4.red(ko.recap.noRepo));
     return;
   }
   if (!await hasAnyCommits()) {
-    console.log(chalk5.yellow("\u26A0\uFE0F  \uC544\uC9C1 \uCEE4\uBC0B\uC774 \uC5C6\uC5B4\uC694."));
-    console.log(chalk5.gray("   \uD30C\uC77C\uC744 \uCD94\uAC00\uD558\uACE0 `vhk save` \uB610\uB294 `git commit`\uC73C\uB85C \uCCAB \uCEE4\uBC0B\uC744 \uB9CC\uB4E4\uC5B4 \uBCF4\uC138\uC694."));
+    console.log(chalk4.yellow("\u26A0\uFE0F  \uC544\uC9C1 \uCEE4\uBC0B\uC774 \uC5C6\uC5B4\uC694."));
+    console.log(chalk4.gray("   \uD30C\uC77C\uC744 \uCD94\uAC00\uD558\uACE0 `vhk save` \uB610\uB294 `git commit`\uC73C\uB85C \uCCAB \uCEE4\uBC0B\uC744 \uB9CC\uB4E4\uC5B4 \uBCF4\uC138\uC694."));
     return;
   }
   printSecurityWarnings();
-  console.log(chalk5.dim(`${ko.recap.analyzing}
+  console.log(chalk4.dim(`${ko.recap.analyzing}
 `));
   const since = options.since || (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
   const diff2 = await getSessionDiff(since);
   const commits = await getRecentCommits(10, since);
   if (diff2.filesChanged === 0 && commits.length === 0) {
-    console.log(chalk5.yellow(ko.recap.noChanges));
+    console.log(chalk4.yellow(ko.recap.noChanges));
     return;
   }
-  console.log(chalk5.bold("\u{1F4CA} \uBCC0\uACBD \uC694\uC57D:"));
-  console.log(`  \uD30C\uC77C: ${chalk5.cyan(String(diff2.filesChanged))}\uAC1C \uBCC0\uACBD`);
-  console.log(`  \uCD94\uAC00: ${chalk5.green("+" + diff2.insertions)} / \uC0AD\uC81C: ${chalk5.red("-" + diff2.deletions)}`);
+  console.log(chalk4.bold("\u{1F4CA} \uBCC0\uACBD \uC694\uC57D:"));
+  console.log(`  \uD30C\uC77C: ${chalk4.cyan(String(diff2.filesChanged))}\uAC1C \uBCC0\uACBD`);
+  console.log(`  \uCD94\uAC00: ${chalk4.green("+" + diff2.insertions)} / \uC0AD\uC81C: ${chalk4.red("-" + diff2.deletions)}`);
   if (diff2.files.length > 0) {
-    console.log(chalk5.dim("\n  \uBCC0\uACBD \uD30C\uC77C:"));
+    console.log(chalk4.dim("\n  \uBCC0\uACBD \uD30C\uC77C:"));
     diff2.files.slice(0, 15).forEach((f) => {
-      const icon = f.status === "new" ? chalk5.green("\u{1F195}") : f.status === "deleted" ? chalk5.red("\u{1F5D1}\uFE0F") : chalk5.yellow("\u270F\uFE0F");
+      const icon = f.status === "new" ? chalk4.green("\u{1F195}") : f.status === "deleted" ? chalk4.red("\u{1F5D1}\uFE0F") : chalk4.yellow("\u270F\uFE0F");
       console.log(`  ${icon} ${f.file}`);
     });
     if (diff2.files.length > 15) {
-      console.log(chalk5.dim(`  ... \uC678 ${diff2.files.length - 15}\uAC1C`));
+      console.log(chalk4.dim(`  ... \uC678 ${diff2.files.length - 15}\uAC1C`));
     }
   }
   if (commits.length > 0) {
-    console.log(chalk5.dim("\n  \uCD5C\uADFC \uCEE4\uBC0B:"));
+    console.log(chalk4.dim("\n  \uCD5C\uADFC \uCEE4\uBC0B:"));
     commits.slice(0, 5).forEach((c) => {
-      console.log(chalk5.dim(`  \u2022 ${c.message}`));
+      console.log(chalk4.dim(`  \u2022 ${c.message}`));
     });
   }
   console.log("");
@@ -1841,12 +1361,12 @@ ${ko.recap.title}
     }
   ]);
   const today = (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
-  const logDir = path6.join(process.cwd(), "docs", "log");
-  if (!fs5.existsSync(logDir)) fs5.mkdirSync(logDir, { recursive: true });
-  const existing = fs5.readdirSync(logDir).filter((f) => f.startsWith(today));
+  const logDir = path5.join(process.cwd(), "docs", "log");
+  if (!fs4.existsSync(logDir)) fs4.mkdirSync(logDir, { recursive: true });
+  const existing = fs4.readdirSync(logDir).filter((f) => f.startsWith(today));
   const sessionNum = existing.length + 1;
   const fileName = `${today}-session-${sessionNum}.md`;
-  const filePath = path6.join(logDir, fileName);
+  const filePath = path5.join(logDir, fileName);
   const fileList = diff2.files.map((f) => `| ${f.file} | ${f.status} |`).join("\n");
   const commitList = commits.slice(0, 10).map((c) => `- \`${c.hash.slice(0, 7)}\` ${c.message}`).join("\n");
   const content = [
@@ -1877,14 +1397,14 @@ ${ko.recap.title}
     "---",
     `*Generated by \`vhk recap\` at ${(/* @__PURE__ */ new Date()).toISOString()}*`
   ].join("\n");
-  fs5.writeFileSync(filePath, content, "utf-8");
+  fs4.writeFileSync(filePath, content, "utf-8");
   const adrCandidates = detectAdrCandidates(diff2);
   if (adrCandidates.length > 0) {
-    console.log(chalk5.cyan.bold(`
+    console.log(chalk4.cyan.bold(`
 ${ko.recap.adrDetected} (${adrCandidates.length}\uAC74)`));
     for (const candidate of adrCandidates) {
-      console.log(chalk5.cyan(`  \u2022 ${candidate.title}: ${candidate.context}`));
-      candidate.files.forEach((f) => console.log(chalk5.dim(`    ${f}`)));
+      console.log(chalk4.cyan(`  \u2022 ${candidate.title}: ${candidate.context}`));
+      candidate.files.forEach((f) => console.log(chalk4.dim(`    ${f}`)));
     }
     const { createAdr } = await inquirer3.prompt([{
       type: "confirm",
@@ -1914,17 +1434,17 @@ ${ko.recap.adrDetected} (${adrCandidates.length}\uAC74)`));
           adrAnswers.decision,
           adrAnswers.consequences
         );
-        console.log(chalk5.green(`  \u2705 ADR \uC0DD\uC131: ${path6.relative(process.cwd(), adrPath)}`));
+        console.log(chalk4.green(`  \u2705 ADR \uC0DD\uC131: ${path5.relative(process.cwd(), adrPath)}`));
       }
     }
   }
   const troubleshootingKeywords = /fix|bug|error|crash|hotfix|patch|revert|트러블|에러|버그|수정|핫픽스/i;
   const troubleCommits = commits.filter((c) => troubleshootingKeywords.test(c.message));
   if (troubleCommits.length > 0) {
-    console.log(chalk5.yellow.bold(`
+    console.log(chalk4.yellow.bold(`
 ${ko.recap.troubleDetected} (${troubleCommits.length}\uAC74)`));
     troubleCommits.forEach((c) => {
-      console.log(chalk5.dim(`  \u2022 ${c.message}`));
+      console.log(chalk4.dim(`  \u2022 ${c.message}`));
     });
     const { createTroubleshoot } = await inquirer3.prompt([{
       type: "confirm",
@@ -1933,8 +1453,8 @@ ${ko.recap.troubleDetected} (${troubleCommits.length}\uAC74)`));
       default: true
     }]);
     if (createTroubleshoot) {
-      const tsDir = path6.join(process.cwd(), "docs", "troubleshooting");
-      if (!fs5.existsSync(tsDir)) fs5.mkdirSync(tsDir, { recursive: true });
+      const tsDir = path5.join(process.cwd(), "docs", "troubleshooting");
+      if (!fs4.existsSync(tsDir)) fs4.mkdirSync(tsDir, { recursive: true });
       const tsAnswers = await inquirer3.prompt([
         {
           type: "input",
@@ -1953,7 +1473,7 @@ ${ko.recap.troubleDetected} (${troubleCommits.length}\uAC74)`));
         }
       ]);
       const tsFileName = `${today}-${tsAnswers.problem.slice(0, 30).replace(/[^a-zA-Z0-9가-힣]/g, "-")}.md`;
-      const tsFilePath = path6.join(tsDir, tsFileName);
+      const tsFilePath = path5.join(tsDir, tsFileName);
       const tsContent = [
         `# \uD2B8\uB7EC\uBE14\uC288\uD305: ${tsAnswers.problem}`,
         "",
@@ -1974,15 +1494,15 @@ ${ko.recap.troubleDetected} (${troubleCommits.length}\uAC74)`));
         "---",
         `*Generated by \`vhk recap\` at ${(/* @__PURE__ */ new Date()).toISOString()}*`
       ].join("\n");
-      fs5.writeFileSync(tsFilePath, tsContent, "utf-8");
-      console.log(chalk5.green(`  \u2705 \uD2B8\uB7EC\uBE14\uC288\uD305 \uBB38\uC11C \uC0DD\uC131: ${path6.relative(process.cwd(), tsFilePath)}`));
+      fs4.writeFileSync(tsFilePath, tsContent, "utf-8");
+      console.log(chalk4.green(`  \u2705 \uD2B8\uB7EC\uBE14\uC288\uD305 \uBB38\uC11C \uC0DD\uC131: ${path5.relative(process.cwd(), tsFilePath)}`));
     }
   }
-  console.log(chalk5.green.bold(`
+  console.log(chalk4.green.bold(`
 ${ko.recap.done}`));
-  console.log(chalk5.dim(`  \u{1F4C4} ${path6.relative(process.cwd(), filePath)}`));
-  const claudeMdPath = path6.join(process.cwd(), "CLAUDE.md");
-  if (fs5.existsSync(claudeMdPath)) {
+  console.log(chalk4.dim(`  \u{1F4C4} ${path5.relative(process.cwd(), filePath)}`));
+  const claudeMdPath = path5.join(process.cwd(), "CLAUDE.md");
+  if (fs4.existsSync(claudeMdPath)) {
     const { updateClaude } = await inquirer3.prompt([{
       type: "confirm",
       name: "updateClaude",
@@ -1990,7 +1510,7 @@ ${ko.recap.done}`));
       default: true
     }]);
     if (updateClaude) {
-      let claudeContent = fs5.readFileSync(claudeMdPath, "utf-8");
+      let claudeContent = fs4.readFileSync(claudeMdPath, "utf-8");
       claudeContent = claudeContent.replace(
         /- \*\*마지막 업데이트:\*\*.*/,
         `- **\uB9C8\uC9C0\uB9C9 \uC5C5\uB370\uC774\uD2B8:** ${today}`
@@ -1999,8 +1519,8 @@ ${ko.recap.done}`));
         /- \*\*다음 액션:\*\*.*/,
         `- **\uB2E4\uC74C \uC561\uC158:** ${answers.nextTodo}`
       );
-      fs5.writeFileSync(claudeMdPath, claudeContent, "utf-8");
-      console.log(chalk5.green("  \u2705 CLAUDE.md \uC5C5\uB370\uC774\uD2B8 \uC644\uB8CC"));
+      fs4.writeFileSync(claudeMdPath, claudeContent, "utf-8");
+      console.log(chalk4.green("  \u2705 CLAUDE.md \uC5C5\uB370\uC774\uD2B8 \uC644\uB8CC"));
     }
   }
   const gitSaveCmd = process.platform === "win32" ? 'git add .; git commit -m "recap: \uC138\uC158 \uAE30\uB85D"' : 'git add . && git commit -m "recap: \uC138\uC158 \uAE30\uB85D"';
@@ -2012,9 +1532,9 @@ ${ko.recap.done}`));
 }
 
 // src/commands/sync.ts
-import chalk6 from "chalk";
-import fs6 from "fs";
-import path7 from "path";
+import chalk5 from "chalk";
+import fs5 from "fs";
+import path6 from "path";
 var CURSORRULES_KEYS = ["\uCF54\uB529 \uADDC\uCE59", "\uAE30\uC220 \uC2A4\uD0DD", "\uC544\uD0A4\uD14D\uCC98", "\uB514\uC790\uC778", "Anti-patterns", "\uCEE4\uBC0B"];
 var CLAUDE_MD_KEYS = ["\uAE30\uB85D", "\uB85C\uADF8", "ADR", "\uD2B8\uB7EC\uBE14\uC288\uD305", "TIL", "/done", "\uCCB4\uD06C\uB9AC\uC2A4\uD2B8"];
 function parseRulesMd(content) {
@@ -2082,46 +1602,46 @@ function toClaudeMd(sections, existing) {
   return lines.join("\n");
 }
 async function sync() {
-  console.log(chalk6.bold(`
+  console.log(chalk5.bold(`
 ${ko.sync.title}
 `));
   const cwd = process.cwd();
-  const rulesPath = path7.join(cwd, "RULES.md");
-  if (!fs6.existsSync(rulesPath)) {
-    console.log(chalk6.yellow(ko.sync.noRules));
-    console.log(chalk6.dim("  RULES.md\uB294 \uD504\uB85C\uC81D\uD2B8 \uADDC\uCE59\uC758 Single Source of Truth\uC785\uB2C8\uB2E4."));
-    console.log(chalk6.dim("  \uC0DD\uC131\uD558\uB824\uBA74: vhk init \uC2E4\uD589 \uD6C4 RULES.md\uB97C \uC791\uC131\uD558\uC138\uC694."));
+  const rulesPath = path6.join(cwd, "RULES.md");
+  if (!fs5.existsSync(rulesPath)) {
+    console.log(chalk5.yellow(ko.sync.noRules));
+    console.log(chalk5.dim("  RULES.md\uB294 \uD504\uB85C\uC81D\uD2B8 \uADDC\uCE59\uC758 Single Source of Truth\uC785\uB2C8\uB2E4."));
+    console.log(chalk5.dim("  \uC0DD\uC131\uD558\uB824\uBA74: vhk init \uC2E4\uD589 \uD6C4 RULES.md\uB97C \uC791\uC131\uD558\uC138\uC694."));
     console.log("");
-    console.log(chalk6.dim("  RULES.md \uAE30\uBCF8 \uAD6C\uC870:"));
-    console.log(chalk6.dim("  ## \uD504\uB85C\uC81D\uD2B8 \uC815\uCCB4\uC131"));
-    console.log(chalk6.dim("  ## \uAE30\uC220 \uC2A4\uD0DD"));
-    console.log(chalk6.dim("  ## \uCF54\uB529 \uADDC\uCE59"));
-    console.log(chalk6.dim("  ## \uAE30\uB85D \uADDC\uCE59"));
-    console.log(chalk6.dim("  ## \uCEE4\uBC0B \uCEE8\uBCA4\uC158"));
+    console.log(chalk5.dim("  RULES.md \uAE30\uBCF8 \uAD6C\uC870:"));
+    console.log(chalk5.dim("  ## \uD504\uB85C\uC81D\uD2B8 \uC815\uCCB4\uC131"));
+    console.log(chalk5.dim("  ## \uAE30\uC220 \uC2A4\uD0DD"));
+    console.log(chalk5.dim("  ## \uCF54\uB529 \uADDC\uCE59"));
+    console.log(chalk5.dim("  ## \uAE30\uB85D \uADDC\uCE59"));
+    console.log(chalk5.dim("  ## \uCEE4\uBC0B \uCEE8\uBCA4\uC158"));
     return;
   }
-  const rulesContent = fs6.readFileSync(rulesPath, "utf-8");
+  const rulesContent = fs5.readFileSync(rulesPath, "utf-8");
   const sections = parseRulesMd(rulesContent);
-  console.log(chalk6.dim(`  \u{1F4C4} RULES.md \uD30C\uC2F1 \uC644\uB8CC \u2014 ${sections.length}\uAC1C \uC139\uC158`));
+  console.log(chalk5.dim(`  \u{1F4C4} RULES.md \uD30C\uC2F1 \uC644\uB8CC \u2014 ${sections.length}\uAC1C \uC139\uC158`));
   const firstLine = rulesContent.split("\n")[0];
   const projectName = firstLine.replace(/^#\s*/, "").replace(/\s*—.*/, "").trim() || "Project";
-  const cursorrulesPath = path7.join(cwd, ".cursorrules");
-  fs6.writeFileSync(cursorrulesPath, toCursorrules(sections, projectName), "utf-8");
-  console.log(chalk6.green(`  ${ko.sync.cursorrulesDone}`));
-  const claudePath = path7.join(cwd, "CLAUDE.md");
-  const existingClaude = fs6.existsSync(claudePath) ? fs6.readFileSync(claudePath, "utf-8") : `# \uAE30\uB85D \uADDC\uCE59 (${projectName})
+  const cursorrulesPath = path6.join(cwd, ".cursorrules");
+  fs5.writeFileSync(cursorrulesPath, toCursorrules(sections, projectName), "utf-8");
+  console.log(chalk5.green(`  ${ko.sync.cursorrulesDone}`));
+  const claudePath = path6.join(cwd, "CLAUDE.md");
+  const existingClaude = fs5.existsSync(claudePath) ? fs5.readFileSync(claudePath, "utf-8") : `# \uAE30\uB85D \uADDC\uCE59 (${projectName})
 
 ## \uD604\uC7AC \uC0C1\uD0DC
 - **Phase:** __FILL__
 - **\uBE14\uB85C\uCEE4:** \uC5C6\uC74C
 - **\uB2E4\uC74C \uC561\uC158:** __FILL__
 - **\uB9C8\uC9C0\uB9C9 \uC5C5\uB370\uC774\uD2B8:** ${(/* @__PURE__ */ new Date()).toISOString().split("T")[0]}`;
-  fs6.writeFileSync(claudePath, toClaudeMd(sections, existingClaude), "utf-8");
-  console.log(chalk6.green(`  ${ko.sync.claudeDone}`));
-  console.log(chalk6.bold.green(`
+  fs5.writeFileSync(claudePath, toClaudeMd(sections, existingClaude), "utf-8");
+  console.log(chalk5.green(`  ${ko.sync.claudeDone}`));
+  console.log(chalk5.bold.green(`
 ${ko.sync.done}`));
-  console.log(chalk6.dim("  RULES.md (\uC6D0\uBCF8) \u2192 .cursorrules + CLAUDE.md (\uC790\uB3D9 \uC0DD\uC131)"));
-  console.log(chalk6.dim("  \uADDC\uCE59 \uBCC0\uACBD\uC740 \uD56D\uC0C1 RULES.md\uC5D0\uC11C\uB9CC \uD558\uC138\uC694."));
+  console.log(chalk5.dim("  RULES.md (\uC6D0\uBCF8) \u2192 .cursorrules + CLAUDE.md (\uC790\uB3D9 \uC0DD\uC131)"));
+  console.log(chalk5.dim("  \uADDC\uCE59 \uBCC0\uACBD\uC740 \uD56D\uC0C1 RULES.md\uC5D0\uC11C\uB9CC \uD558\uC138\uC694."));
   printNextStep({
     message: "\uADDC\uCE59 \uB3D9\uAE30\uD654 \uC644\uB8CC! \uC774\uC81C Cursor\uAC00 \uC0C8 \uADDC\uCE59\uC744 \uB530\uB985\uB2C8\uB2E4.",
     command: "vhk \uC810\uAC80",
@@ -2131,15 +1651,15 @@ ${ko.sync.done}`));
 
 // src/commands/check.ts
 import chalk7 from "chalk";
-import path9 from "path";
-import fs8 from "fs";
+import path8 from "path";
+import fs7 from "fs";
 
 // src/lib/rules-parser.ts
-import fs7 from "fs";
-import path8 from "path";
+import fs6 from "fs";
+import path7 from "path";
 function parseRules(rulesPath) {
-  if (!fs7.existsSync(rulesPath)) return [];
-  const content = fs7.readFileSync(rulesPath, "utf-8");
+  if (!fs6.existsSync(rulesPath)) return [];
+  const content = fs6.readFileSync(rulesPath, "utf-8");
   const lines = content.split("\n");
   const rules = [];
   let currentSection = "";
@@ -2200,17 +1720,17 @@ function createNamingRule(id, section, desc, convention) {
     description: desc,
     check: (cwd) => {
       const violations = [];
-      const srcDir = path8.join(cwd, "src");
-      if (!fs7.existsSync(srcDir)) return violations;
+      const srcDir = path7.join(cwd, "src");
+      if (!fs6.existsSync(srcDir)) return violations;
       walkFiles(srcDir, (filePath) => {
-        const name = path8.basename(filePath, path8.extname(filePath));
+        const name = path7.basename(filePath, path7.extname(filePath));
         if (convention === "kebab-case" && !/^[a-z0-9]+(-[a-z0-9]+)*$/.test(name)) {
           if (!["index", "vite.config", "tsconfig"].includes(name)) {
             violations.push({
               ruleId: id,
               severity: "warning",
               message: `\uD30C\uC77C\uBA85\uC774 kebab-case\uAC00 \uC544\uB2D8: ${name}`,
-              file: path8.relative(cwd, filePath)
+              file: path7.relative(cwd, filePath)
             });
           }
         }
@@ -2226,8 +1746,8 @@ function createStructureRule(id, section, desc, expectedPath) {
     type: "structure",
     description: desc,
     check: (cwd) => {
-      const fullPath = path8.join(cwd, expectedPath);
-      if (!fs7.existsSync(fullPath)) {
+      const fullPath = path7.join(cwd, expectedPath);
+      if (!fs6.existsSync(fullPath)) {
         return [{
           ruleId: id,
           severity: "error",
@@ -2247,11 +1767,11 @@ function createContentRule(id, section, desc, pattern, type) {
     pattern: new RegExp(escapeRegex(pattern), "i"),
     check: (cwd) => {
       const violations = [];
-      const srcDir = path8.join(cwd, "src");
-      if (!fs7.existsSync(srcDir)) return violations;
+      const srcDir = path7.join(cwd, "src");
+      if (!fs6.existsSync(srcDir)) return violations;
       const regex = new RegExp(escapeRegex(pattern), "i");
       walkFiles(srcDir, (filePath) => {
-        const fileContent = fs7.readFileSync(filePath, "utf-8");
+        const fileContent = fs6.readFileSync(filePath, "utf-8");
         const fileLines = fileContent.split("\n");
         fileLines.forEach((line, idx) => {
           if (regex.test(line)) {
@@ -2259,7 +1779,7 @@ function createContentRule(id, section, desc, pattern, type) {
               ruleId: id,
               severity: type === "banned" ? "error" : "warning",
               message: type === "banned" ? `\uAE08\uC9C0 \uD328\uD134 \uBC1C\uACAC: \`${pattern}\`` : `\uD544\uC218 \uD328\uD134 \uB204\uB77D: \`${pattern}\``,
-              file: path8.relative(cwd, filePath),
+              file: path7.relative(cwd, filePath),
               line: idx + 1
             });
           }
@@ -2271,9 +1791,9 @@ function createContentRule(id, section, desc, pattern, type) {
   };
 }
 function walkFiles(dir, callback) {
-  const entries = fs7.readdirSync(dir, { withFileTypes: true });
+  const entries = fs6.readdirSync(dir, { withFileTypes: true });
   for (const entry of entries) {
-    const fullPath = path8.join(dir, entry.name);
+    const fullPath = path7.join(dir, entry.name);
     if (entry.isDirectory()) {
       if (!["node_modules", ".git", "dist", ".next"].includes(entry.name)) {
         walkFiles(fullPath, callback);
@@ -2287,45 +1807,401 @@ function escapeRegex(str) {
   return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 
-// src/commands/check.ts
-async function check() {
-  console.log(chalk7.bold(`
-${ko.check.title}
+// src/commands/goal.ts
+import { existsSync as existsSync2, mkdirSync, writeFileSync, readFileSync as readFileSync2 } from "fs";
+import { join as join2 } from "path";
+import chalk6 from "chalk";
+
+// src/lib/goal-frontmatter.ts
+import { existsSync, readFileSync, readdirSync, statSync } from "fs";
+import { join } from "path";
+var FRONTMATTER_RE = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/;
+function parseFrontmatter(content) {
+  const m = content.match(FRONTMATTER_RE);
+  if (!m) return { frontmatter: {}, body: content };
+  const fm = parseSimpleYaml(m[1]);
+  const body = (m[2] ?? "").replace(/^\r?\n+/, "");
+  return { frontmatter: fm, body };
+}
+function parseSimpleYaml(yaml) {
+  const out = {};
+  const lines = yaml.split(/\r?\n/);
+  for (const raw of lines) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#")) continue;
+    const idx = line.indexOf(":");
+    if (idx <= 0) continue;
+    const key = line.slice(0, idx).trim();
+    let value = line.slice(idx + 1).trim();
+    if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+      value = value.slice(1, -1);
+    }
+    if (key === "id" || key === "vhk_format") {
+      const n = Number(value);
+      out[key] = Number.isFinite(n) ? n : void 0;
+    } else {
+      out[key] = value;
+    }
+  }
+  return out;
+}
+function parseGoalFile(filePath) {
+  if (!existsSync(filePath)) return null;
+  try {
+    const content = readFileSync(filePath, "utf-8");
+    const { frontmatter, body } = parseFrontmatter(content);
+    return { filePath, frontmatter, body };
+  } catch {
+    return null;
+  }
+}
+function listGoals(goalsDir) {
+  if (!existsSync(goalsDir)) return [];
+  let entries;
+  try {
+    entries = readdirSync(goalsDir);
+  } catch {
+    return [];
+  }
+  const parsed = [];
+  for (const name of entries) {
+    if (!name.endsWith(".md")) continue;
+    if (name === "_meta.md") continue;
+    const fp = join(goalsDir, name);
+    try {
+      if (!statSync(fp).isFile()) continue;
+    } catch {
+      continue;
+    }
+    const g = parseGoalFile(fp);
+    if (!g) continue;
+    if (g.frontmatter.type !== "goal") continue;
+    if (typeof g.frontmatter.id !== "number") continue;
+    parsed.push(g);
+  }
+  parsed.sort((a, b) => a.frontmatter.id - b.frontmatter.id);
+  return parsed;
+}
+function updateFrontmatterStatus(content, newStatus, extraFields) {
+  const m = content.match(FRONTMATTER_RE);
+  if (!m) return content;
+  const fmRaw = m[1];
+  const body = m[2] ?? "";
+  const lines = fmRaw.split(/\r?\n/);
+  const seenKeys = /* @__PURE__ */ new Set();
+  let hadStatus = false;
+  const updated = lines.map((raw) => {
+    const trimmed = raw.trim();
+    if (!trimmed || trimmed.startsWith("#")) return raw;
+    const idx = trimmed.indexOf(":");
+    if (idx <= 0) return raw;
+    const key = trimmed.slice(0, idx).trim();
+    seenKeys.add(key);
+    if (key === "status") {
+      hadStatus = true;
+      return `status: ${newStatus}`;
+    }
+    if (extraFields && key in extraFields) {
+      return `${key}: ${extraFields[key]}`;
+    }
+    return raw;
+  });
+  if (!hadStatus) updated.push(`status: ${newStatus}`);
+  if (extraFields) {
+    for (const [k, v] of Object.entries(extraFields)) {
+      if (!seenKeys.has(k)) updated.push(`${k}: ${v}`);
+    }
+  }
+  return `---
+${updated.join("\n")}
+---
+${body}`;
+}
+
+// src/commands/goal.ts
+var GOALS_DIR = "goals";
+var STATE_DIR = "docs/state";
+var SCRIPTS_DIR = "scripts";
+var STATUS_ICON = {
+  NOT_STARTED: "\u26AA",
+  IN_PROGRESS: "\u{1F7E1}",
+  DONE: "\u2705",
+  BLOCKED: "\u{1F6D1}"
+};
+function selectActiveId(goals) {
+  const ip = goals.find((g) => g.frontmatter.status === "IN_PROGRESS");
+  if (ip && typeof ip.frontmatter.id === "number") return ip.frontmatter.id;
+  const ns = goals.find(
+    (g) => g.frontmatter.status === "NOT_STARTED" || g.frontmatter.status === void 0
+  );
+  if (ns && typeof ns.frontmatter.id === "number") return ns.frontmatter.id;
+  return null;
+}
+function resolveGoalId(optId, goals) {
+  if (optId !== void 0) {
+    const n = Number(optId);
+    if (!Number.isFinite(n)) return null;
+    return n;
+  }
+  return selectActiveId(goals);
+}
+async function goalList() {
+  console.log(chalk6.bold(`
+${ko.goal.listTitle}
 `));
-  const cwd = process.cwd();
-  const rulesPath = path9.join(cwd, "RULES.md");
-  if (!fs8.existsSync(rulesPath)) {
-    console.log(chalk7.yellow(ko.check.noRules));
-    console.log(chalk7.dim("  vhk init\uC73C\uB85C \uC2DC\uC791\uD558\uAC70\uB098 RULES.md\uB97C \uB9CC\uB4E4\uC5B4 \uBCF4\uC138\uC694."));
+  const goals = listGoals(GOALS_DIR);
+  if (goals.length === 0) {
+    console.log(chalk6.yellow("  \u{1F4ED} goals/ \uB514\uB809\uD1A0\uB9AC\uC5D0 goal \uD30C\uC77C\uC774 \uC5C6\uC2B5\uB2C8\uB2E4."));
+    console.log(chalk6.dim("  vhk goal init \uC73C\uB85C \uC2DC\uC791\uD558\uC138\uC694."));
     return;
   }
-  const rules = parseRules(rulesPath);
-  console.log(chalk7.dim(`  \u{1F4CF} ${rules.length}\uAC1C \uAC80\uC99D \uAC00\uB2A5\uD55C \uADDC\uCE59 \uAC10\uC9C0
+  for (const g of goals) {
+    const fm = g.frontmatter;
+    const status2 = fm.status ?? "NOT_STARTED";
+    const icon = STATUS_ICON[status2] ?? "?";
+    const id = String(fm.id).padStart(2);
+    const pri = String(fm.priority ?? "--").padEnd(3);
+    const ver = String(fm.version ?? "----").padEnd(6);
+    console.log(
+      `  [${id}] ${icon} ${status2.padEnd(11)} ${pri} ${ver} ${fm.title ?? "(untitled)"}`
+    );
+  }
+}
+async function goalNext() {
+  console.log(chalk6.bold(`
+${ko.goal.nextTitle}
 `));
-  if (rules.length === 0) {
-    console.log(chalk7.yellow(ko.check.noAutoRules));
-    console.log(chalk7.dim("  RULES.md\uC5D0 \uD30C\uC77C \uC774\uB984\xB7\uD3F4\uB354 \uADDC\uCE59\uC744 \uC801\uC73C\uBA74 \uC790\uB3D9\uC73C\uB85C \uC810\uAC80\uD574\uC694."));
+  const goals = listGoals(GOALS_DIR);
+  const activeId = selectActiveId(goals);
+  if (activeId === null) {
+    console.log(chalk6.green("  \u{1F389} \uBAA8\uB4E0 goal \uC774 \uC644\uB8CC\uB418\uC5C8\uC2B5\uB2C8\uB2E4!"));
     return;
   }
-  const allViolations = [];
-  let passCount = 0;
-  for (const rule of rules) {
-    const violations = rule.check(cwd);
-    if (violations.length === 0) {
-      console.log(chalk7.green(`  \u2705 ${rule.id}`) + chalk7.dim(` \u2014 ${rule.description.slice(0, 60)}`));
-      passCount++;
+  const active = goals.find((g) => g.frontmatter.id === activeId);
+  if (!active) return;
+  const ts = (/* @__PURE__ */ new Date()).toISOString();
+  const text = [
+    "# Next Task",
+    "",
+    `_Auto-updated ${ts} via \`vhk goal next\`._`,
+    "",
+    "```",
+    `TASK: Goal ${activeId} \u2014 ${active.frontmatter.title ?? ""}`,
+    `  status: ${active.frontmatter.status ?? "NOT_STARTED"}`,
+    `  priority: ${active.frontmatter.priority ?? "--"}`,
+    `  file: ${active.filePath}`,
+    "```",
+    ""
+  ].join("\n");
+  mkdirSync(STATE_DIR, { recursive: true });
+  writeFileSync(join2(STATE_DIR, "next-task.md"), text, "utf-8");
+  console.log(
+    chalk6.green(
+      `  \u2705 next-task.md \uAC31\uC2E0 \u2014 Goal ${activeId}: ${active.frontmatter.title ?? ""}`
+    )
+  );
+}
+var META_TEMPLATE = `---
+vhk_format: 1
+type: meta
+project: __FILL__
+version: v0.1
+---
+
+# Common Gates
+
+1. (\uD504\uB85C\uC81D\uD2B8\uBCC4 \uAC8C\uC774\uD2B8 \u2014 \uC608: pnpm test:run)
+
+## Forbidden Actions (\uC804\uC5ED)
+
+- (\uD574\uB2F9 \uC0AC\uD56D)
+`;
+var STATE_NEXT_TASK_TEMPLATE = "# Next Task\n\n```\nTASK: (vhk goal next \uB85C \uC790\uB3D9 \uAC31\uC2E0)\n```\n";
+var STATE_BLOCKERS_TEMPLATE = "# Blockers\n\n_Append-only. \uD574\uACB0 \uD56D\uBAA9\uC740 ~~\uCDE8\uC18C\uC120~~\uC73C\uB85C \uD45C\uAE30._\n";
+var STATE_LEARNINGS_TEMPLATE = "# Learnings\n\n_Append-only. \uD55C \uC904 = \uD55C \uAD50\uD6C8._\n";
+async function goalInit() {
+  console.log(chalk6.bold(`
+${ko.goal.initTitle}
+`));
+  const targets = [
+    { path: join2(GOALS_DIR, "_meta.md"), content: META_TEMPLATE },
+    { path: join2(STATE_DIR, "next-task.md"), content: STATE_NEXT_TASK_TEMPLATE },
+    { path: join2(STATE_DIR, "blockers.md"), content: STATE_BLOCKERS_TEMPLATE },
+    { path: join2(STATE_DIR, "learnings.md"), content: STATE_LEARNINGS_TEMPLATE }
+  ];
+  mkdirSync(GOALS_DIR, { recursive: true });
+  mkdirSync(STATE_DIR, { recursive: true });
+  let created = 0;
+  let skipped = 0;
+  for (const t2 of targets) {
+    if (existsSync2(t2.path)) {
+      console.log(chalk6.gray(`  \u2298 skip (\uC774\uBBF8 \uC874\uC7AC): ${t2.path}`));
+      skipped++;
     } else {
-      console.log(chalk7.red(`  \u274C ${rule.id}`) + chalk7.dim(` \u2014 ${violations.length}\uAC74 \uC704\uBC18`));
-      violations.forEach((v) => {
-        const loc = v.file ? chalk7.dim(` (${v.file}${v.line ? ":" + v.line : ""})`) : "";
-        const icon = v.severity === "error" ? chalk7.red("\u2716") : v.severity === "warning" ? chalk7.yellow("\u26A0") : chalk7.blue("\u2139");
-        console.log(`    ${icon} ${v.message}${loc}`);
-      });
-      allViolations.push(...violations);
+      writeFileSync(t2.path, t2.content, "utf-8");
+      console.log(chalk6.green(`  \u2713 created: ${t2.path}`));
+      created++;
     }
   }
-  console.log("");
-  const errors = allViolations.filter((v) => v.severity === "error").length;
+  console.log(chalk6.bold(`
+  \u{1F4CA} created=${created} skipped=${skipped}`));
+  if (created > 0) {
+    printNextStep({
+      message: "goals/ \uAD6C\uC870 \uC2A4\uCE90\uD3F4\uB529 \uC644\uB8CC!",
+      command: "vhk goal list",
+      cursorHint: "goal \uBAA9\uB85D \uBCF4\uC5EC\uC918"
+    });
+  }
+}
+function findGateScript(id) {
+  const mjs = join2(SCRIPTS_DIR, `check-goal-${id}.mjs`);
+  if (existsSync2(mjs)) return mjs;
+  const sh = join2(SCRIPTS_DIR, `check-goal-${id}.sh`);
+  if (existsSync2(sh)) return sh;
+  return null;
+}
+function runGate(scriptPath) {
+  const isMjs = scriptPath.endsWith(".mjs");
+  const runner = isMjs ? "node" : "bash";
+  const r = safeExecFile(runner, [scriptPath]);
+  return { ok: r.ok, out: r.out, err: r.ok ? "" : r.err, runner };
+}
+async function goalCheck(opts) {
+  console.log(chalk6.bold(`
+${ko.goal.checkTitle}
+`));
+  const goals = listGoals(GOALS_DIR);
+  const id = resolveGoalId(opts.id, goals);
+  if (id === null) {
+    console.log(
+      chalk6.yellow("  \u26A0 \uB300\uC0C1 goal \uC744 \uACB0\uC815\uD560 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4 (--id \uBA85\uC2DC \uB610\uB294 active goal \uD544\uC694).")
+    );
+    process.exitCode = 1;
+    return;
+  }
+  const scriptPath = findGateScript(id);
+  if (!scriptPath) {
+    console.log(
+      chalk6.red(`  \u274C \uAC8C\uC774\uD2B8 \uC2A4\uD06C\uB9BD\uD2B8 \uC5C6\uC74C: scripts/check-goal-${id}.{mjs,sh}`)
+    );
+    process.exitCode = 1;
+    return;
+  }
+  const gate2 = runGate(scriptPath);
+  console.log(chalk6.dim(`  \u25B6 ${gate2.runner} ${scriptPath}
+`));
+  if (gate2.out) console.log(gate2.out);
+  if (gate2.ok) {
+    console.log(chalk6.green(`
+  \u2705 Goal ${id} \uAC8C\uC774\uD2B8 \uD1B5\uACFC`));
+  } else {
+    console.log(chalk6.red(`
+  \u274C Goal ${id} \uAC8C\uC774\uD2B8 \uC2E4\uD328`));
+    if (gate2.err && !gate2.out) console.log(chalk6.dim(gate2.err.slice(0, 500)));
+    process.exitCode = 1;
+  }
+}
+async function goalDone(opts) {
+  console.log(chalk6.bold(`
+${ko.goal.doneTitle}
+`));
+  const goals = listGoals(GOALS_DIR);
+  const id = resolveGoalId(opts.id, goals);
+  if (id === null) {
+    console.log(
+      chalk6.yellow("  \u26A0 \uB300\uC0C1 goal \uC744 \uACB0\uC815\uD560 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4 (--id \uBA85\uC2DC \uB610\uB294 active goal \uD544\uC694).")
+    );
+    process.exitCode = 1;
+    return;
+  }
+  const target = goals.find((g) => g.frontmatter.id === id);
+  if (!target) {
+    console.log(chalk6.red(`  \u274C goal id ${id} \uD30C\uC77C \uC5C6\uC74C.`));
+    process.exitCode = 1;
+    return;
+  }
+  const scriptPath = findGateScript(id);
+  if (!scriptPath) {
+    console.log(
+      chalk6.red(
+        `  \u274C \uAC8C\uC774\uD2B8 \uC2A4\uD06C\uB9BD\uD2B8 \uC5C6\uC74C \u2014 done \uCC98\uB9AC \uAC70\uBD80: scripts/check-goal-${id}.{mjs,sh}`
+      )
+    );
+    process.exitCode = 1;
+    return;
+  }
+  const gate2 = runGate(scriptPath);
+  console.log(chalk6.dim(`  \u25B6 \uAC8C\uC774\uD2B8 \uAC80\uC99D: ${gate2.runner} ${scriptPath}
+`));
+  if (gate2.out) console.log(gate2.out);
+  if (!gate2.ok) {
+    console.log(
+      chalk6.red(
+        `
+  \u274C \uAC8C\uC774\uD2B8 \uC2E4\uD328 \u2014 frontmatter \uBCC0\uACBD \uC5C6\uC774 \uC885\uB8CC. (Forbidden: \uC2E4\uD328 = \uBCF4\uC874)`
+      )
+    );
+    process.exitCode = 1;
+    return;
+  }
+  const content = readFileSync2(target.filePath, "utf-8");
+  const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+  const updated = updateFrontmatterStatus(content, "DONE", { completed: today });
+  writeFileSync(target.filePath, updated, "utf-8");
+  console.log(chalk6.green(`
+  \u2705 Goal ${id} \u2192 DONE (completed: ${today})`));
+  printNextStep({
+    message: `Goal ${id} \uC644\uB8CC! \uB2E4\uC74C goal \uB85C:`,
+    command: "vhk goal next",
+    cursorHint: "\uB2E4\uC74C goal \uC54C\uB824\uC918"
+  });
+}
+
+// src/commands/check.ts
+async function check(opts = {}) {
+  if (opts.goal !== void 0) {
+    return goalCheck({ id: opts.goal });
+  }
+  return checkRules();
+}
+async function checkRules() {
+  console.log(chalk7.bold(`
+${ko.check.title}
+`));
+  const cwd = process.cwd();
+  const rulesPath = path8.join(cwd, "RULES.md");
+  if (!fs7.existsSync(rulesPath)) {
+    console.log(chalk7.yellow(ko.check.noRules));
+    console.log(chalk7.dim("  vhk init\uC73C\uB85C \uC2DC\uC791\uD558\uAC70\uB098 RULES.md\uB97C \uB9CC\uB4E4\uC5B4 \uBCF4\uC138\uC694."));
+    return;
+  }
+  const rules = parseRules(rulesPath);
+  console.log(chalk7.dim(`  \u{1F4CF} ${rules.length}\uAC1C \uAC80\uC99D \uAC00\uB2A5\uD55C \uADDC\uCE59 \uAC10\uC9C0
+`));
+  if (rules.length === 0) {
+    console.log(chalk7.yellow(ko.check.noAutoRules));
+    console.log(chalk7.dim("  RULES.md\uC5D0 \uD30C\uC77C \uC774\uB984\xB7\uD3F4\uB354 \uADDC\uCE59\uC744 \uC801\uC73C\uBA74 \uC790\uB3D9\uC73C\uB85C \uC810\uAC80\uD574\uC694."));
+    return;
+  }
+  const allViolations = [];
+  let passCount = 0;
+  for (const rule of rules) {
+    const violations = rule.check(cwd);
+    if (violations.length === 0) {
+      console.log(chalk7.green(`  \u2705 ${rule.id}`) + chalk7.dim(` \u2014 ${rule.description.slice(0, 60)}`));
+      passCount++;
+    } else {
+      console.log(chalk7.red(`  \u274C ${rule.id}`) + chalk7.dim(` \u2014 ${violations.length}\uAC74 \uC704\uBC18`));
+      violations.forEach((v) => {
+        const loc = v.file ? chalk7.dim(` (${v.file}${v.line ? ":" + v.line : ""})`) : "";
+        const icon = v.severity === "error" ? chalk7.red("\u2716") : v.severity === "warning" ? chalk7.yellow("\u26A0") : chalk7.blue("\u2139");
+        console.log(`    ${icon} ${v.message}${loc}`);
+      });
+      allViolations.push(...violations);
+    }
+  }
+  console.log("");
+  const errors = allViolations.filter((v) => v.severity === "error").length;
   const warnings = allViolations.filter((v) => v.severity === "warning").length;
   if (allViolations.length === 0) {
     console.log(chalk7.green.bold(`${ko.check.allPassed} (${passCount}/${rules.length})`));
@@ -2352,217 +2228,20 @@ ${ko.check.title}
 
 // src/commands/secure.ts
 import chalk8 from "chalk";
-import fs11 from "fs";
-import path11 from "path";
-
-// src/lib/scan-secrets.ts
-import fs10 from "fs";
-
-// src/lib/secret-patterns.ts
-var SECRET_PATTERNS = [
-  {
-    id: "aws-access-key",
-    name: "AWS Access Key",
-    severity: "critical",
-    pattern: /AKIA[0-9A-Z]{16}/
-  },
-  {
-    id: "aws-secret-key",
-    name: "AWS Secret Key",
-    severity: "critical",
-    pattern: /aws_secret_access_key\s*=\s*['"]?[A-Za-z0-9/+=]{40}['"]?/i
-  },
-  {
-    id: "private-key",
-    name: "Private Key",
-    severity: "critical",
-    pattern: /-----BEGIN (RSA |EC |OPENSSH )?PRIVATE KEY-----/
-  },
-  {
-    id: "notion-token",
-    name: "Notion Integration Token",
-    severity: "critical",
-    pattern: /secret_[A-Za-z0-9]{40,50}/
-  },
-  {
-    id: "github-token",
-    name: "GitHub Token",
-    severity: "critical",
-    pattern: /ghp_[A-Za-z0-9]{36,}/
-  },
-  {
-    id: "openai-key",
-    name: "OpenAI API Key",
-    severity: "critical",
-    pattern: /\bsk-(?:proj-|ant-api03-|live-)[A-Za-z0-9_-]{16,}\b/
-  },
-  {
-    id: "generic-api-key",
-    name: "Generic API Key",
-    severity: "high",
-    pattern: /(?:api[_-]?key|apikey|access[_-]?token)\s*[:=]\s*['"]?[A-Za-z0-9_\-]{16,}['"]?/i
-  },
-  {
-    id: "password-inline",
-    name: "Inline Password",
-    severity: "high",
-    pattern: /(?:password|passwd|pwd)\s*[:=]\s*['"][^'"]{8,}['"]/i
-  },
-  {
-    id: "jwt",
-    name: "JWT Token",
-    severity: "medium",
-    pattern: /eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/
-  }
-];
-function maskSecret(value) {
-  if (value.length <= 8) return "****";
-  const visible = Math.min(8, value.length - 4);
-  return value.slice(0, visible) + "****";
-}
-
-// src/lib/scan-files.ts
-import fs9 from "fs";
-import path10 from "path";
-var IGNORE_DIRS = /* @__PURE__ */ new Set([
-  "node_modules",
-  ".git",
-  "dist",
-  ".next",
-  ".nuxt",
-  "build",
-  "coverage",
-  "out",
-  ".turbo",
-  ".vercel",
-  ".cache",
-  ".pnpm",
-  ".idea",
-  ".claude",
-  ".cursor"
-]);
-var SKIP_FILE_NAMES = /* @__PURE__ */ new Set([
-  "pnpm-lock.yaml",
-  "package-lock.json",
-  "yarn.lock"
-]);
-var SCAN_EXTENSIONS = /* @__PURE__ */ new Set([
-  ".ts",
-  ".tsx",
-  ".js",
-  ".jsx",
-  ".mjs",
-  ".cjs",
-  ".json",
-  ".yaml",
-  ".yml",
-  ".toml"
-]);
-var MAX_SCAN_FILE_BYTES = 512 * 1024;
-function isScannableFileName(fileName) {
-  if (SKIP_FILE_NAMES.has(fileName)) return false;
-  if (fileName.startsWith(".env")) return true;
-  return SCAN_EXTENSIONS.has(path10.extname(fileName).toLowerCase());
-}
-function walkProjectFiles(rootDir, onFile, ig = loadGitignore(rootDir)) {
-  function walk(dir) {
-    let entries;
-    try {
-      entries = fs9.readdirSync(dir, { withFileTypes: true });
-    } catch {
-      return;
-    }
-    for (const entry of entries) {
-      const fullPath = path10.join(dir, entry.name);
-      const rel = path10.relative(rootDir, fullPath).replace(/\\/g, "/");
-      if (entry.isDirectory()) {
-        if (IGNORE_DIRS.has(entry.name)) continue;
-        if (isPathIgnored(ig, `${rel}/`)) continue;
-        walk(fullPath);
-        continue;
-      }
-      if (!isScannableFileName(entry.name)) continue;
-      if (isPathIgnored(ig, rel)) continue;
-      let size = 0;
-      try {
-        size = fs9.statSync(fullPath).size;
-      } catch {
-        continue;
-      }
-      if (size > MAX_SCAN_FILE_BYTES) continue;
-      onFile(fullPath, rel);
-    }
-  }
-  walk(rootDir);
-}
-
-// src/lib/scan-secrets.ts
-var MAX_SECRET_FINDINGS = 200;
-var MAX_LINE_CHARS = 4e3;
-function globalPattern(pattern) {
-  const flags = pattern.flags.includes("g") ? pattern.flags : `${pattern.flags}g`;
-  return new RegExp(pattern.source, flags);
-}
-function findSecretsInLine(line, relPath, lineNum) {
-  const found = [];
-  const trimmed = line.trim();
-  if (trimmed.startsWith("//") && trimmed.includes("example")) return found;
-  if (trimmed.startsWith("#") && trimmed.includes("example")) return found;
-  if (line.length > MAX_LINE_CHARS) return found;
-  for (const pattern of SECRET_PATTERNS) {
-    const regex = globalPattern(pattern.pattern);
-    for (const match of line.matchAll(regex)) {
-      found.push({
-        patternId: pattern.id,
-        patternName: pattern.name,
-        severity: pattern.severity,
-        file: relPath,
-        line: lineNum,
-        match: maskSecret(match[0])
-      });
-    }
-  }
-  return found;
-}
-function scanProjectForSecrets(cwd) {
-  const findings = [];
-  let scannedFiles = 0;
-  let truncated = false;
-  walkProjectFiles(cwd, (filePath, relPath) => {
-    scannedFiles++;
-    const content = fs10.readFileSync(filePath, "utf-8");
-    const lines = content.split("\n");
-    lines.forEach((line, idx) => {
-      if (truncated) return;
-      const lineFindings = findSecretsInLine(line, relPath, idx + 1);
-      for (const f of lineFindings) {
-        findings.push(f);
-        if (findings.length >= MAX_SECRET_FINDINGS) {
-          truncated = true;
-          return;
-        }
-      }
-    });
-  });
-  return { findings, scannedFiles, truncated };
-}
-function filterSevereFindings(findings) {
-  return findings.filter((f) => f.severity === "critical" || f.severity === "high");
-}
-
-// src/commands/secure.ts
+import fs8 from "fs";
+import path9 from "path";
 async function secure() {
   console.log(chalk8.bold(`
 ${ko.secure.title}
 `));
   const cwd = process.cwd();
-  const gitignorePath = path11.join(cwd, ".gitignore");
-  const hasGitignore = fs11.existsSync(gitignorePath);
+  const gitignorePath = path9.join(cwd, ".gitignore");
+  const hasGitignore = fs8.existsSync(gitignorePath);
   if (!hasGitignore) {
     console.log(chalk8.yellow(`  ${ko.secure.noGitignore}`));
     console.log(chalk8.dim("  .env \uD30C\uC77C\uC774 \uCEE4\uBC0B\uB420 \uC218 \uC788\uC2B5\uB2C8\uB2E4.\n"));
   } else {
-    const gitignoreContent = fs11.readFileSync(gitignorePath, "utf-8");
+    const gitignoreContent = fs8.readFileSync(gitignorePath, "utf-8");
     if (!gitignoreContent.includes(".env")) {
       console.log(chalk8.yellow(`  ${ko.secure.noEnvInGitignore}`));
       console.log(chalk8.dim("  \uCD94\uAC00\uB97C \uAD8C\uC7A5\uD569\uB2C8\uB2E4.\n"));
@@ -2626,27 +2305,24 @@ ${ko.secure.title}
 
 // src/commands/doctor.ts
 import chalk9 from "chalk";
-import { execSync } from "child_process";
-import fs12 from "fs";
-import path12 from "path";
+import fs9 from "fs";
+import path10 from "path";
 import { fileURLToPath } from "url";
 function checkCommand(name, command, hint) {
-  try {
-    const version = execSync(`${command} --version`, { encoding: "utf-8" }).trim().split("\n")[0];
-    return { name, command, version, ok: true, hint };
-  } catch {
-    return { name, command, ok: false, hint };
-  }
+  const result = safeExecFile(command, ["--version"]);
+  if (!result.ok) return { name, command, ok: false, hint };
+  const version = result.out.split("\n")[0];
+  return { name, command, version, ok: true, hint };
 }
-function getVhkVersion() {
-  const dir = path12.dirname(fileURLToPath(import.meta.url));
+function getVhkVersion2() {
+  const dir = path10.dirname(fileURLToPath(import.meta.url));
   const candidates = [
-    path12.join(dir, "../package.json"),
-    path12.join(dir, "../../package.json")
+    path10.join(dir, "../package.json"),
+    path10.join(dir, "../../package.json")
   ];
   for (const pkgPath of candidates) {
     try {
-      if (fs12.existsSync(pkgPath)) {
+      if (fs9.existsSync(pkgPath)) {
         const pkg = readJsonFile(pkgPath);
         return pkg.version;
       }
@@ -2657,17 +2333,11 @@ function getVhkVersion() {
   return void 0;
 }
 function fetchLatestNpmVersion(packageName) {
-  try {
-    const result = execSync(`npm view ${packageName} version`, {
-      encoding: "utf-8",
-      timeout: 5e3,
-      stdio: ["ignore", "pipe", "ignore"]
-    }).trim();
-    if (/^\d+\.\d+\.\d+/.test(result)) return result;
-    return void 0;
-  } catch {
-    return void 0;
-  }
+  const result = safeExecFile("npm", ["view", packageName, "version"]);
+  if (!result.ok) return void 0;
+  const out = result.out;
+  if (/^\d+\.\d+\.\d+/.test(out)) return out;
+  return void 0;
 }
 function compareSemver(a, b) {
   const parse = (v) => v.replace(/^v/i, "").split("-")[0].split(".").map((n) => parseInt(n, 10) || 0);
@@ -2698,7 +2368,7 @@ ${ko.doctor.title}
     }
   }
   console.log("");
-  const vhkVersion = getVhkVersion();
+  const vhkVersion = getVhkVersion2();
   if (vhkVersion) {
     console.log(chalk9.green("  \u2705 VHK") + chalk9.dim(` \u2014 v${vhkVersion}`));
   } else {
@@ -2723,13 +2393,13 @@ ${ko.doctor.title}
     { name: ".env", hint: ".gitignore\uC5D0 \uD3EC\uD568\uB418\uC5B4 \uC788\uB294\uC9C0 \uD655\uC778" }
   ];
   for (const file of projectFiles) {
-    const exists = fs12.existsSync(path12.join(cwd, file.name));
+    const exists = fs9.existsSync(path10.join(cwd, file.name));
     if (exists) {
       console.log(chalk9.green(`    \u2705 ${file.name}`));
       if (file.name === ".env") {
-        const gitignorePath = path12.join(cwd, ".gitignore");
-        if (fs12.existsSync(gitignorePath)) {
-          const gitignore = fs12.readFileSync(gitignorePath, "utf-8");
+        const gitignorePath = path10.join(cwd, ".gitignore");
+        if (fs9.existsSync(gitignorePath)) {
+          const gitignore = fs9.readFileSync(gitignorePath, "utf-8");
           if (!gitignore.includes(".env")) {
             console.log(chalk9.yellow(`    ${ko.doctor.envNotIgnored}`));
           }
@@ -2761,8 +2431,8 @@ ${ko.doctor.title}
 // src/commands/ship.ts
 import chalk10 from "chalk";
 import inquirer4 from "inquirer";
-import fs13 from "fs";
-import path13 from "path";
+import fs10 from "fs";
+import path11 from "path";
 var CHECKLIST = [
   { id: "build", questionKey: "checkBuild", hintKey: "hintBuild" },
   { id: "test", questionKey: "checkTest", hintKey: "hintTest" },
@@ -2775,9 +2445,9 @@ function sanitizeVersion(version) {
   return version.trim().replace(/^v/i, "").replace(/[^a-zA-Z0-9._-]/g, "-") || "0.0.0";
 }
 function updateChangelogUnreleased(cwd, version, date) {
-  const changelogPath = path13.join(cwd, "CHANGELOG.md");
-  if (!fs13.existsSync(changelogPath)) return { status: "missing" };
-  const content = fs13.readFileSync(changelogPath, "utf-8");
+  const changelogPath = path11.join(cwd, "CHANGELOG.md");
+  if (!fs10.existsSync(changelogPath)) return { status: "missing" };
+  const content = fs10.readFileSync(changelogPath, "utf-8");
   const unreleasedHeading = /^## \[Unreleased\][^\n]*$/m;
   if (!unreleasedHeading.test(content)) return { status: "no-unreleased" };
   const blankUnreleased = [
@@ -2794,7 +2464,7 @@ function updateChangelogUnreleased(cwd, version, date) {
     `## [${version}] \u2014 ${date}`
   ].join("\n");
   const updated = content.replace(unreleasedHeading, blankUnreleased);
-  fs13.writeFileSync(changelogPath, updated, "utf-8");
+  fs10.writeFileSync(changelogPath, updated, "utf-8");
   return { status: "updated", version };
 }
 async function ship() {
@@ -2851,12 +2521,12 @@ ${ko.ship.title}
     { type: "input", name: "learned", message: ko.ship.questionLearned },
     { type: "input", name: "nextVersion", message: ko.ship.questionNext }
   ]);
-  const buildLogDir = path13.join(cwd, "docs", "build-log");
-  if (!fs13.existsSync(buildLogDir)) fs13.mkdirSync(buildLogDir, { recursive: true });
+  const buildLogDir = path11.join(cwd, "docs", "build-log");
+  if (!fs10.existsSync(buildLogDir)) fs10.mkdirSync(buildLogDir, { recursive: true });
   const today = (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
   const versionSlug = sanitizeVersion(retro.version);
   const fileName = `${today}-v${versionSlug}.md`;
-  const filePath = path13.join(buildLogDir, fileName);
+  const filePath = path11.join(buildLogDir, fileName);
   const content = [
     `# \uBE4C\uB4DC \uB85C\uADF8: v${versionSlug}`,
     "",
@@ -2885,9 +2555,9 @@ ${ko.ship.title}
     "---",
     `*Generated by \`vhk ship\` at ${(/* @__PURE__ */ new Date()).toISOString()}*`
   ].join("\n");
-  fs13.writeFileSync(filePath, content, "utf-8");
+  fs10.writeFileSync(filePath, content, "utf-8");
   console.log(chalk10.green(`
-  ${ko.ship.buildLogDone(path13.relative(cwd, filePath))}`));
+  ${ko.ship.buildLogDone(path11.relative(cwd, filePath))}`));
   const changelogResult = updateChangelogUnreleased(cwd, versionSlug, today);
   if (changelogResult.status === "updated") {
     log.success(ko.ship.changelogUpdated(changelogResult.version));
@@ -3055,9 +2725,19 @@ async function save() {
     if (process.exitCode !== 1) {
       console.log(chalk11.green(`
 \u2705 ${t("save.done", lines.length)}`));
+      printNextStep({
+        message: t("save.nextOkMessage"),
+        command: "vhk recap",
+        cursorHint: t("save.nextOkCursor")
+      });
     } else {
       console.log(chalk11.green(`
 \u2705 ${t("save.doneLocalOnly", lines.length)}`));
+      printNextStep({
+        message: t("save.nextPushFailMessage"),
+        command: "vhk doctor",
+        cursorHint: t("save.nextPushFailCursor")
+      });
     }
   } catch (err) {
     spinner.fail(t("save.failed"));
@@ -3177,6 +2857,11 @@ ${t("undo.recentHeader")}`));
       console.log(chalk12.yellow(`
 \u{1F4A1} ${t("undo.forcePushHint")}`));
     }
+    printNextStep({
+      message: t("undo.nextMessage"),
+      command: "vhk save",
+      cursorHint: t("undo.nextCursor")
+    });
   } catch (err) {
     console.log(chalk12.red(`\u274C ${t("undo.failed")}`));
     const msg = err instanceof Error ? err.message : String(err);
@@ -3187,8 +2872,8 @@ ${t("undo.recentHeader")}`));
 
 // src/commands/status.ts
 import { execFileSync as execFileSync4 } from "child_process";
-import fs14 from "fs";
-import path14 from "path";
+import fs11 from "fs";
+import path12 from "path";
 import chalk13 from "chalk";
 function countFileChanges(porcelain) {
   const lines = porcelain.split("\n").filter(Boolean);
@@ -3227,8 +2912,8 @@ function parseRecentCommitLines(logOutput) {
   return logOutput.split("\n").map((l) => l.trim()).filter(Boolean);
 }
 function readProjectPackage(cwd = process.cwd()) {
-  const pkgPath = path14.join(cwd, "package.json");
-  if (!fs14.existsSync(pkgPath)) return null;
+  const pkgPath = path12.join(cwd, "package.json");
+  if (!fs11.existsSync(pkgPath)) return null;
   try {
     const pkg = readJsonFile(pkgPath);
     if (!pkg.name && !pkg.version) return null;
@@ -3300,18 +2985,27 @@ async function status() {
   } else {
     console.log(chalk13.dim(`\u{1F4E6} ${t("status.noPackage")}`));
   }
-  console.log("");
+  const hasChanges = counts.staged + counts.unstaged + counts.untracked > 0;
+  if (hasChanges) {
+    printNextStep({
+      message: t("status.nextWithChangesMessage"),
+      command: "vhk save",
+      cursorHint: t("status.nextWithChangesCursor")
+    });
+  } else {
+    printNextStep({
+      message: t("status.nextCleanMessage"),
+      command: "vhk goal next",
+      cursorHint: t("status.nextCleanCursor")
+    });
+  }
 }
 
 // src/commands/diff.ts
-import { execFileSync as execFileSync5, execSync as execSync2 } from "child_process";
 import chalk14 from "chalk";
 function gitOut2(args) {
-  try {
-    return execFileSync5("git", args, { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
-  } catch {
-    return "";
-  }
+  const r = safeExecFile("git", args);
+  return r.ok ? r.out : "";
 }
 function parseDiffStat(stat) {
   const files = [];
@@ -3354,9 +3048,7 @@ async function diff() {
   console.log(chalk14.bold(`
 \u{1F50D} ${t("diff.title")}`));
   console.log(chalk14.gray("\u2500".repeat(40)));
-  try {
-    execSync2("git rev-parse --is-inside-work-tree", { stdio: "pipe" });
-  } catch {
+  if (!safeExecFile("git", ["rev-parse", "--is-inside-work-tree"]).ok) {
     console.log(chalk14.red(`\u274C ${t("diff.notGitRepo")}`));
     return;
   }
@@ -3397,8 +3089,8 @@ ${t("diff.summaryHeader")}`));
 }
 
 // src/commands/mcp-init.ts
-import { existsSync, mkdirSync, writeFileSync } from "fs";
-import { join, dirname } from "path";
+import { existsSync as existsSync3, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "fs";
+import { join as join3, dirname } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import chalk15 from "chalk";
 function resolveMcpEntryPoint() {
@@ -3406,8 +3098,8 @@ function resolveMcpEntryPoint() {
     const here = fileURLToPath2(import.meta.url);
     const dir = dirname(here);
     for (const rel of [["mcp", "index.js"], ["..", "mcp", "index.js"]]) {
-      const candidate = join(dir, ...rel);
-      if (existsSync(candidate)) return candidate;
+      const candidate = join3(dir, ...rel);
+      if (existsSync3(candidate)) return candidate;
     }
   } catch {
   }
@@ -3415,17 +3107,17 @@ function resolveMcpEntryPoint() {
     const url = import.meta.resolve?.("@byh3071/vhk/dist/mcp/index.js");
     if (typeof url === "string") {
       const p = fileURLToPath2(url);
-      if (existsSync(p)) return p;
+      if (existsSync3(p)) return p;
     }
   } catch {
   }
   try {
-    const pkgPath = join(process.cwd(), "package.json");
-    if (existsSync(pkgPath)) {
+    const pkgPath = join3(process.cwd(), "package.json");
+    if (existsSync3(pkgPath)) {
       const pkg = readJsonFile(pkgPath);
       if (pkg.name === "@byh3071/vhk") {
-        const local = join(process.cwd(), "dist", "mcp", "index.js");
-        if (existsSync(local)) return local;
+        const local = join3(process.cwd(), "dist", "mcp", "index.js");
+        if (existsSync3(local)) return local;
       }
     }
   } catch {
@@ -3442,14 +3134,14 @@ function resolveVhkMcpEntry() {
 async function mcpInit() {
   console.log(chalk15.bold("\n\u{1F50C} " + t("mcp.initTitle")));
   console.log(chalk15.gray("\u2500".repeat(40)));
-  const cursorDir = join(process.cwd(), ".cursor");
-  if (!existsSync(cursorDir)) {
-    mkdirSync(cursorDir, { recursive: true });
+  const cursorDir = join3(process.cwd(), ".cursor");
+  if (!existsSync3(cursorDir)) {
+    mkdirSync2(cursorDir, { recursive: true });
   }
-  const configPath = join(cursorDir, "mcp.json");
+  const configPath = join3(cursorDir, "mcp.json");
   const vhkEntry = resolveVhkMcpEntry();
   let config;
-  if (existsSync(configPath)) {
+  if (existsSync3(configPath)) {
     try {
       const parsed = readJsonFile(configPath);
       config = {
@@ -3462,246 +3154,21 @@ async function mcpInit() {
   } else {
     config = { mcpServers: { vhk: vhkEntry } };
   }
-  writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n", "utf-8");
+  writeFileSync2(configPath, JSON.stringify(config, null, 2) + "\n", "utf-8");
   console.log(chalk15.green("\n\u2705 Cursor MCP \uC124\uC815 \uC644\uB8CC!"));
   console.log(chalk15.cyan("\u{1F4C1} \uC0DD\uC131\uB41C \uD30C\uC77C:"));
   console.log(`   ${configPath}`);
-  console.log(chalk15.cyan("\n\u{1F504} \uB2E4\uC74C \uB2E8\uACC4:"));
-  console.log("   1. Cursor\uB97C \uC7AC\uC2DC\uC791\uD558\uC138\uC694");
-  console.log("   2. Cursor \uCC44\uD305\uC5D0\uC11C vhk \uB3C4\uAD6C\uB97C \uC0AC\uC6A9\uD560 \uC218 \uC788\uC2B5\uB2C8\uB2E4");
-  console.log(chalk15.gray('\n\u{1F4A1} \uC608: "\uD504\uB85C\uC81D\uD2B8 \uC0C1\uD0DC \uC54C\uB824\uC918" \u2192 Cursor\uAC00 vhk status \uD638\uCD9C'));
-}
-
-// src/commands/deploy.ts
-import { existsSync as existsSync2 } from "fs";
-import chalk16 from "chalk";
-import inquirer7 from "inquirer";
-var PLATFORMS = {
-  vercel: {
-    name: "Vercel",
-    detectFiles: ["vercel.json", ".vercel"],
-    command: "vercel",
-    commandArgs: ["--prod"],
-    checkArgs: ["--version"],
-    installHint: "npm i -g vercel"
-  },
-  netlify: {
-    name: "Netlify",
-    detectFiles: ["netlify.toml", ".netlify"],
-    command: "netlify",
-    commandArgs: ["deploy", "--prod"],
-    checkArgs: ["--version"],
-    installHint: "npm i -g netlify-cli"
-  },
-  cloudflare: {
-    name: "Cloudflare Workers",
-    detectFiles: ["wrangler.toml"],
-    command: "wrangler",
-    commandArgs: ["deploy"],
-    checkArgs: ["--version"],
-    installHint: "npm i -g wrangler"
-  }
-};
-function detectPlatform() {
-  for (const [key, config] of Object.entries(PLATFORMS)) {
-    for (const file of config.detectFiles) {
-      if (existsSync2(file)) return key;
-    }
-  }
-  return null;
-}
-function isCLIAvailable(cmd, checkArgs) {
-  return safeExecFile(cmd, checkArgs).ok;
-}
-async function deploy() {
-  console.log(chalk16.bold("\n\u{1F680} " + t("deploy.title")));
-  console.log(chalk16.gray("\u2500".repeat(40)));
-  let platform = detectPlatform();
-  if (platform) {
-    console.log(chalk16.cyan(`
-\u{1F50D} \uAC10\uC9C0\uB41C \uD50C\uB7AB\uD3FC: ${PLATFORMS[platform].name}`));
-  } else {
-    const { selected } = await inquirer7.prompt([
-      {
-        type: "list",
-        name: "selected",
-        message: t("deploy.selectPlatform"),
-        choices: [
-          { name: "\u25B2 Vercel", value: "vercel" },
-          { name: "\u25C6 Netlify", value: "netlify" },
-          { name: "\u2601 Cloudflare Workers", value: "cloudflare" }
-        ]
-      }
-    ]);
-    platform = selected;
-  }
-  const config = PLATFORMS[platform];
-  if (!isCLIAvailable(config.command, config.checkArgs)) {
-    console.log(chalk16.red(`
-\u274C ${config.name} CLI\uAC00 \uC124\uCE58\uB418\uC5B4 \uC788\uC9C0 \uC54A\uC2B5\uB2C8\uB2E4.`));
-    console.log(chalk16.yellow(`   \u2192 ${config.installHint}`));
-    return;
-  }
-  const { confirm } = await inquirer7.prompt([
-    {
-      type: "confirm",
-      name: "confirm",
-      message: `${config.name}\uC5D0 \uD504\uB85C\uB355\uC158 \uBC30\uD3EC\uD560\uAE4C\uC694?`,
-      default: true
-    }
-  ]);
-  if (!confirm) {
-    console.log(chalk16.gray("\uCDE8\uC18C\uB428"));
-    return;
-  }
-  console.log(chalk16.cyan(`
-${t("deploy.deploying")}
-`));
-  const result = safeExecFileStream(config.command, config.commandArgs);
-  if (result.ok) {
-    console.log(chalk16.green(`
-\u2705 ${t("deploy.success")}`));
-    printNextStep({
-      message: "\uBC30\uD3EC \uC644\uB8CC! \uC0AC\uC774\uD2B8\uB97C \uD655\uC778\uD558\uC138\uC694.",
-      command: "vhk status",
-      cursorHint: "\uC0C1\uD0DC \uD655\uC778\uD574\uC918"
-    });
-  } else {
-    console.log(chalk16.red(`
-\u274C ${t("deploy.failed")}`));
-    console.log(chalk16.red(result.err));
-  }
-}
-
-// src/commands/publish.ts
-import { existsSync as existsSync3, writeFileSync as writeFileSync2 } from "fs";
-import chalk17 from "chalk";
-import inquirer8 from "inquirer";
-import ora2 from "ora";
-function bumpVersion(current, type) {
-  const [major, minor, patch] = current.split(".").map((n) => parseInt(n, 10) || 0);
-  switch (type) {
-    case "major":
-      return `${major + 1}.0.0`;
-    case "minor":
-      return `${major}.${minor + 1}.0`;
-    case "patch":
-      return `${major}.${minor}.${patch + 1}`;
-  }
-}
-async function publish() {
-  console.log(chalk17.bold("\n\u{1F4E6} " + t("publish.title")));
-  console.log(chalk17.gray("\u2500".repeat(40)));
-  if (!existsSync3("package.json")) {
-    console.log(chalk17.red("\u274C package.json\uC744 \uCC3E\uC744 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4."));
-    return;
-  }
-  let pkg;
-  try {
-    pkg = readJsonFile("package.json");
-  } catch {
-    console.log(chalk17.red("\u274C package.json \uD30C\uC2F1 \uC2E4\uD328"));
-    return;
-  }
-  const currentVersion = pkg.version || "0.0.0";
-  console.log(chalk17.cyan(`
-\u{1F4CC} \uD604\uC7AC \uBC84\uC804: v${currentVersion}`));
-  const { bumpType } = await inquirer8.prompt([
-    {
-      type: "list",
-      name: "bumpType",
-      message: t("publish.selectBump"),
-      choices: [
-        { name: `\u{1F527} patch (${bumpVersion(currentVersion, "patch")}) \u2014 \uBC84\uADF8 \uC218\uC815`, value: "patch" },
-        { name: `\u2728 minor (${bumpVersion(currentVersion, "minor")}) \u2014 \uC0C8 \uAE30\uB2A5`, value: "minor" },
-        { name: `\u{1F4A5} major (${bumpVersion(currentVersion, "major")}) \u2014 \uD638\uD658\uC131 \uBCC0\uACBD`, value: "major" }
-      ]
-    }
-  ]);
-  const newVersion = bumpVersion(currentVersion, bumpType);
-  console.log(chalk17.cyan(`
-\u{1F195} \uC0C8 \uBC84\uC804: v${newVersion}`));
-  pkg.version = newVersion;
-  writeFileSync2("package.json", JSON.stringify(pkg, null, 2) + "\n", "utf-8");
-  console.log(chalk17.green("\u2705 package.json \uBC84\uC804 \uC5C5\uB370\uC774\uD2B8"));
-  const buildSpinner = ora2(t("publish.building")).start();
-  const buildResult = safeExecFile("pnpm", ["build"]);
-  if (!buildResult.ok) {
-    buildSpinner.fail(t("publish.buildFailed"));
-    console.log(chalk17.red(buildResult.err.slice(0, 500)));
-    pkg.version = currentVersion;
-    writeFileSync2("package.json", JSON.stringify(pkg, null, 2) + "\n", "utf-8");
-    return;
-  }
-  buildSpinner.succeed(t("publish.buildSuccess"));
-  const testSpinner = ora2(t("publish.testing")).start();
-  const testResult = safeExecFile("pnpm", ["test", "--run"]);
-  if (!testResult.ok) {
-    testSpinner.fail(t("publish.testFailed"));
-    console.log(chalk17.red(testResult.err.slice(0, 500)));
-    pkg.version = currentVersion;
-    writeFileSync2("package.json", JSON.stringify(pkg, null, 2) + "\n", "utf-8");
-    return;
-  }
-  testSpinner.succeed(t("publish.testSuccess"));
-  const { confirm } = await inquirer8.prompt([
-    {
-      type: "confirm",
-      name: "confirm",
-      message: `v${newVersion}\uC744 npm\uC5D0 \uBC30\uD3EC\uD560\uAE4C\uC694?`,
-      default: true
-    }
-  ]);
-  if (!confirm) {
-    pkg.version = currentVersion;
-    writeFileSync2("package.json", JSON.stringify(pkg, null, 2) + "\n", "utf-8");
-    console.log(chalk17.gray("\uCDE8\uC18C\uB428. \uBC84\uC804\uC774 \uC6D0\uB798\uB300\uB85C \uBCF5\uAD6C\uB429\uB2C8\uB2E4."));
-    return;
-  }
-  console.log(chalk17.cyan(`
-\u{1F4E4} ${t("publish.publishing")}`));
-  console.log(chalk17.gray("   2FA \uD65C\uC131\uD654 \uC2DC: OTP 6\uC790\uB9AC \uC785\uB825 \uB610\uB294 \uBE0C\uB77C\uC6B0\uC800 \uC778\uC99D URL \uD074\uB9AD (Windows Hello / PIN \uC9C0\uC6D0)"));
-  const pubResult = safeExecFileStream("npm", ["publish", "--access", "public"]);
-  if (!pubResult.ok) {
-    console.log(chalk17.red(`
-\u2716 ${t("publish.publishFailed")}`));
-    console.log(chalk17.red(pubResult.err.slice(0, 500)));
-    pkg.version = currentVersion;
-    writeFileSync2("package.json", JSON.stringify(pkg, null, 2) + "\n", "utf-8");
-    console.log(chalk17.gray(`\u{1F4E6} package.json \uBC84\uC804\uC744 v${currentVersion}\uB85C \uBCF5\uAD6C\uD588\uC2B5\uB2C8\uB2E4.`));
-    return;
-  }
-  console.log(chalk17.green(`
-\u2714 ${t("publish.publishSuccess")}`));
-  const addResult = safeExecFile("git", ["add", "package.json"]);
-  if (addResult.ok) {
-    safeExecFile("git", ["commit", "-m", `chore: release v${newVersion}`]);
-    const tagResult = safeExecFile("git", ["tag", `v${newVersion}`]);
-    if (tagResult.ok) {
-      const pushResult = safeExecFile("git", ["push"]);
-      const pushTagsResult = safeExecFile("git", ["push", "--tags"]);
-      if (pushResult.ok && pushTagsResult.ok) {
-        console.log(chalk17.green(`
-\u{1F3F7}\uFE0F  git tag v${newVersion} \uC0DD\uC131 + push \uC644\uB8CC`));
-      } else {
-        console.log(chalk17.yellow(`
-\u{1F3F7}\uFE0F  git tag v${newVersion} \uC0DD\uC131\uB428 (push\uB294 \uC218\uB3D9\uC73C\uB85C)`));
-      }
-    }
-  }
-  console.log(chalk17.green.bold(`
-\u{1F389} v${newVersion} \uBC30\uD3EC \uC644\uB8CC!`));
   printNextStep({
-    message: "npm \uBC30\uD3EC \uC644\uB8CC!",
-    command: "vhk status",
-    cursorHint: "\uC0C1\uD0DC \uD655\uC778\uD574\uC918"
+    message: t("mcp.nextMessage"),
+    command: "vhk mcp",
+    cursorHint: t("mcp.nextCursor")
   });
 }
 
 // src/commands/design.ts
-import { existsSync as existsSync4, mkdirSync as mkdirSync2, writeFileSync as writeFileSync3 } from "fs";
-import chalk18 from "chalk";
-import inquirer9 from "inquirer";
+import { existsSync as existsSync4, mkdirSync as mkdirSync3, writeFileSync as writeFileSync3 } from "fs";
+import chalk16 from "chalk";
+import inquirer7 from "inquirer";
 var PALETTES = [
   {
     name: "Minimal",
@@ -3774,9 +3241,9 @@ export default vhkColors
 `;
 }
 async function design() {
-  console.log(chalk18.bold("\n\u{1F3A8} " + t("design.title")));
-  console.log(chalk18.gray("\u2500".repeat(40)));
-  const { paletteIndex } = await inquirer9.prompt([
+  console.log(chalk16.bold("\n\u{1F3A8} " + t("design.title")));
+  console.log(chalk16.gray("\u2500".repeat(40)));
+  const { paletteIndex } = await inquirer7.prompt([
     {
       type: "list",
       name: "paletteIndex",
@@ -3788,32 +3255,32 @@ async function design() {
     }
   ]);
   const palette = PALETTES[paletteIndex];
-  console.log(chalk18.cyan(`
+  console.log(chalk16.cyan(`
 \u{1F3A8} \uC120\uD0DD\uB41C \uD314\uB808\uD2B8: ${palette.name}`));
   const targetPath = hasTailwind() ? "src/styles/vhk-colors.ts" : "src/styles/tokens.css";
   const content = hasTailwind() ? generateTailwindExtend(palette) : generateCSSTokens(palette);
   if (existsSync4(targetPath)) {
-    const { overwrite } = await inquirer9.prompt([{
+    const { overwrite } = await inquirer7.prompt([{
       type: "confirm",
       name: "overwrite",
       message: `${targetPath} \uC774\uBBF8 \uC788\uC5B4\uC694. \uB36E\uC5B4\uC4F8\uAE4C\uC694?`,
       default: false
     }]);
     if (!overwrite) {
-      console.log(chalk18.yellow("\n\u23ED\uFE0F  \uC0DD\uC131 \uCDE8\uC18C \u2014 \uAE30\uC874 \uD30C\uC77C \uC720\uC9C0."));
+      console.log(chalk16.yellow("\n\u23ED\uFE0F  \uC0DD\uC131 \uCDE8\uC18C \u2014 \uAE30\uC874 \uD30C\uC77C \uC720\uC9C0."));
       return;
     }
   }
-  mkdirSync2("src/styles", { recursive: true });
+  mkdirSync3("src/styles", { recursive: true });
   writeFileSync3(targetPath, content, "utf-8");
   if (hasTailwind()) {
-    console.log(chalk18.green("\n\u2705 src/styles/vhk-colors.ts \uC0DD\uC131"));
-    console.log(chalk18.gray("   tailwind.config\uC758 extend.colors\uC5D0 import \uD574\uC11C \uC0AC\uC6A9\uD558\uC138\uC694."));
+    console.log(chalk16.green("\n\u2705 src/styles/vhk-colors.ts \uC0DD\uC131"));
+    console.log(chalk16.gray("   tailwind.config\uC758 extend.colors\uC5D0 import \uD574\uC11C \uC0AC\uC6A9\uD558\uC138\uC694."));
   } else {
-    console.log(chalk18.green("\n\u2705 src/styles/tokens.css \uC0DD\uC131"));
-    console.log(chalk18.gray("   HTML\uC5D0 <link>\uB85C \uCD94\uAC00\uD558\uAC70\uB098 CSS\uC5D0\uC11C @import \uD558\uC138\uC694."));
+    console.log(chalk16.green("\n\u2705 src/styles/tokens.css \uC0DD\uC131"));
+    console.log(chalk16.gray("   HTML\uC5D0 <link>\uB85C \uCD94\uAC00\uD558\uAC70\uB098 CSS\uC5D0\uC11C @import \uD558\uC138\uC694."));
   }
-  console.log(chalk18.bold("\n\u{1F308} \uCEEC\uB7EC \uBBF8\uB9AC\uBCF4\uAE30:"));
+  console.log(chalk16.bold("\n\u{1F308} \uCEEC\uB7EC \uBBF8\uB9AC\uBCF4\uAE30:"));
   for (const [key, value] of Object.entries(palette.colors)) {
     console.log(`   ${key.padEnd(12)} ${value}`);
   }
@@ -3828,9 +3295,9 @@ async function designPalette() {
 }
 
 // src/commands/theme.ts
-import { existsSync as existsSync5, mkdirSync as mkdirSync3, writeFileSync as writeFileSync4 } from "fs";
-import chalk19 from "chalk";
-import inquirer10 from "inquirer";
+import { existsSync as existsSync5, mkdirSync as mkdirSync4, writeFileSync as writeFileSync4 } from "fs";
+import chalk17 from "chalk";
+import inquirer8 from "inquirer";
 function generateDarkCSS() {
   return `/* vhk theme \u2014 \uB2E4\uD06C/\uB77C\uC774\uD2B8 \uBAA8\uB4DC CSS \uBCC0\uC218 */
 
@@ -3886,13 +3353,13 @@ export function initTheme(): void {
 `;
 }
 async function theme() {
-  console.log(chalk19.bold("\n\u{1F319} " + t("theme.title")));
-  console.log(chalk19.gray("\u2500".repeat(40)));
+  console.log(chalk17.bold("\n\u{1F319} " + t("theme.title")));
+  console.log(chalk17.gray("\u2500".repeat(40)));
   const cssPath = "src/styles/theme.css";
   const togglePath = "src/lib/theme-toggle.ts";
   const conflicts = [cssPath, togglePath].filter((p) => existsSync5(p));
   if (conflicts.length > 0) {
-    const { overwrite } = await inquirer10.prompt([{
+    const { overwrite } = await inquirer8.prompt([{
       type: "confirm",
       name: "overwrite",
       message: `\uB2E4\uC74C \uD30C\uC77C\uC774 \uC774\uBBF8 \uC788\uC5B4\uC694. \uB36E\uC5B4\uC4F8\uAE4C\uC694?
@@ -3900,21 +3367,21 @@ async function theme() {
       default: false
     }]);
     if (!overwrite) {
-      console.log(chalk19.yellow("\n\u23ED\uFE0F  \uC0DD\uC131 \uCDE8\uC18C \u2014 \uAE30\uC874 \uD30C\uC77C \uC720\uC9C0."));
+      console.log(chalk17.yellow("\n\u23ED\uFE0F  \uC0DD\uC131 \uCDE8\uC18C \u2014 \uAE30\uC874 \uD30C\uC77C \uC720\uC9C0."));
       return;
     }
   }
-  mkdirSync3("src/styles", { recursive: true });
-  mkdirSync3("src/lib", { recursive: true });
+  mkdirSync4("src/styles", { recursive: true });
+  mkdirSync4("src/lib", { recursive: true });
   writeFileSync4(cssPath, generateDarkCSS(), "utf-8");
-  console.log(chalk19.green("\n\u2705 src/styles/theme.css \uC0DD\uC131 (\uB2E4\uD06C/\uB77C\uC774\uD2B8 \uBAA8\uB4DC)"));
+  console.log(chalk17.green("\n\u2705 src/styles/theme.css \uC0DD\uC131 (\uB2E4\uD06C/\uB77C\uC774\uD2B8 \uBAA8\uB4DC)"));
   writeFileSync4(togglePath, generateToggleUtil(), "utf-8");
-  console.log(chalk19.green("\u2705 src/lib/theme-toggle.ts \uC0DD\uC131 (\uD1A0\uAE00 \uC720\uD2F8\uB9AC\uD2F0)"));
-  console.log(chalk19.bold("\n\u{1F4D6} \uC0AC\uC6A9\uBC95:"));
-  console.log(chalk19.gray("   1. theme.css\uB97C \uAE00\uB85C\uBC8C \uC2A4\uD0C0\uC77C\uC5D0 \uCD94\uAC00"));
-  console.log(chalk19.gray('   2. import { initTheme, toggleTheme } from "./lib/theme-toggle"'));
-  console.log(chalk19.gray("   3. \uC571 \uC9C4\uC785\uC810\uC5D0\uC11C initTheme() \uD638\uCD9C"));
-  console.log(chalk19.gray("   4. \uD1A0\uAE00 \uBC84\uD2BC\uC5D0\uC11C toggleTheme() \uD638\uCD9C"));
+  console.log(chalk17.green("\u2705 src/lib/theme-toggle.ts \uC0DD\uC131 (\uD1A0\uAE00 \uC720\uD2F8\uB9AC\uD2F0)"));
+  console.log(chalk17.bold("\n\u{1F4D6} \uC0AC\uC6A9\uBC95:"));
+  console.log(chalk17.gray("   1. theme.css\uB97C \uAE00\uB85C\uBC8C \uC2A4\uD0C0\uC77C\uC5D0 \uCD94\uAC00"));
+  console.log(chalk17.gray('   2. import { initTheme, toggleTheme } from "./lib/theme-toggle"'));
+  console.log(chalk17.gray("   3. \uC571 \uC9C4\uC785\uC810\uC5D0\uC11C initTheme() \uD638\uCD9C"));
+  console.log(chalk17.gray("   4. \uD1A0\uAE00 \uBC84\uD2BC\uC5D0\uC11C toggleTheme() \uD638\uCD9C"));
   printNextStep({
     message: "\uD14C\uB9C8 \uC124\uC815 \uC644\uB8CC!",
     command: "vhk ref list",
@@ -3923,8 +3390,8 @@ async function theme() {
 }
 
 // src/commands/ref.ts
-import { existsSync as existsSync6, mkdirSync as mkdirSync4, writeFileSync as writeFileSync5 } from "fs";
-import chalk20 from "chalk";
+import { existsSync as existsSync6, mkdirSync as mkdirSync5, writeFileSync as writeFileSync5 } from "fs";
+import chalk18 from "chalk";
 var REFS_PATH = ".vhk/refs.json";
 function loadRefs() {
   if (!existsSync6(REFS_PATH)) return [];
@@ -3936,28 +3403,28 @@ function loadRefs() {
   }
 }
 function saveRefs(refs) {
-  mkdirSync4(".vhk", { recursive: true });
+  mkdirSync5(".vhk", { recursive: true });
   writeFileSync5(REFS_PATH, JSON.stringify(refs, null, 2) + "\n", "utf-8");
 }
 async function refAdd(url, memo = "") {
-  console.log(chalk20.bold("\n\u{1F517} " + t("ref.addTitle")));
-  console.log(chalk20.gray("\u2500".repeat(40)));
+  console.log(chalk18.bold("\n\u{1F517} " + t("ref.addTitle")));
+  console.log(chalk18.gray("\u2500".repeat(40)));
   if (!url) {
-    console.log(chalk20.red("\u274C URL\uC744 \uC785\uB825\uD574\uC8FC\uC138\uC694."));
-    console.log(chalk20.gray('   \uC608: vhk ref add https://example.com --memo "\uCC38\uACE0 \uC0AC\uC774\uD2B8"'));
+    console.log(chalk18.red("\u274C URL\uC744 \uC785\uB825\uD574\uC8FC\uC138\uC694."));
+    console.log(chalk18.gray('   \uC608: vhk ref add https://example.com --memo "\uCC38\uACE0 \uC0AC\uC774\uD2B8"'));
     return;
   }
   const refs = loadRefs();
   if (refs.some((r) => r.url === url)) {
-    console.log(chalk20.yellow("\u26A0\uFE0F  \uC774\uBBF8 \uC800\uC7A5\uB41C URL\uC785\uB2C8\uB2E4."));
+    console.log(chalk18.yellow("\u26A0\uFE0F  \uC774\uBBF8 \uC800\uC7A5\uB41C URL\uC785\uB2C8\uB2E4."));
     return;
   }
   refs.push({ url, memo, addedAt: (/* @__PURE__ */ new Date()).toISOString() });
   saveRefs(refs);
-  console.log(chalk20.green(`
+  console.log(chalk18.green(`
 \u2705 \uB808\uD37C\uB7F0\uC2A4 \uCD94\uAC00\uB428 (#${refs.length})`));
-  console.log(chalk20.cyan(`   ${url}`));
-  if (memo) console.log(chalk20.gray(`   \u{1F4DD} ${memo}`));
+  console.log(chalk18.cyan(`   ${url}`));
+  if (memo) console.log(chalk18.gray(`   \u{1F4DD} ${memo}`));
   printNextStep({
     message: "\uB808\uD37C\uB7F0\uC2A4 \uC800\uC7A5 \uC644\uB8CC!",
     command: "vhk ref list",
@@ -3965,22 +3432,22 @@ async function refAdd(url, memo = "") {
   });
 }
 async function refList() {
-  console.log(chalk20.bold("\n\u{1F4DA} " + t("ref.listTitle")));
-  console.log(chalk20.gray("\u2500".repeat(40)));
+  console.log(chalk18.bold("\n\u{1F4DA} " + t("ref.listTitle")));
+  console.log(chalk18.gray("\u2500".repeat(40)));
   const refs = loadRefs();
   if (refs.length === 0) {
-    console.log(chalk20.yellow("\n\u{1F4ED} \uC800\uC7A5\uB41C \uB808\uD37C\uB7F0\uC2A4\uAC00 \uC5C6\uC2B5\uB2C8\uB2E4."));
-    console.log(chalk20.gray('   vhk ref add <url> --memo "\uBA54\uBAA8"\uB85C \uCD94\uAC00\uD558\uC138\uC694.'));
+    console.log(chalk18.yellow("\n\u{1F4ED} \uC800\uC7A5\uB41C \uB808\uD37C\uB7F0\uC2A4\uAC00 \uC5C6\uC2B5\uB2C8\uB2E4."));
+    console.log(chalk18.gray('   vhk ref add <url> --memo "\uBA54\uBAA8"\uB85C \uCD94\uAC00\uD558\uC138\uC694.'));
     return;
   }
-  console.log(chalk20.cyan(`
+  console.log(chalk18.cyan(`
 \uCD1D ${refs.length}\uAC1C\uC758 \uB808\uD37C\uB7F0\uC2A4:
 `));
   refs.forEach((ref, index) => {
     const date = new Date(ref.addedAt).toLocaleDateString("ko-KR");
-    console.log(chalk20.white(`  [${index + 1}] ${ref.url}`));
-    if (ref.memo) console.log(chalk20.gray(`      \u{1F4DD} ${ref.memo}`));
-    console.log(chalk20.gray(`      \u{1F4C5} ${date}`));
+    console.log(chalk18.white(`  [${index + 1}] ${ref.url}`));
+    if (ref.memo) console.log(chalk18.gray(`      \u{1F4DD} ${ref.memo}`));
+    console.log(chalk18.gray(`      \u{1F4C5} ${date}`));
     console.log("");
   });
 }
@@ -3988,7 +3455,7 @@ async function refOpen(indexStr) {
   const refs = loadRefs();
   const idx = parseInt(indexStr, 10) - 1;
   if (Number.isNaN(idx) || idx < 0 || idx >= refs.length) {
-    console.log(chalk20.red(`\u274C \uC720\uD6A8\uD558\uC9C0 \uC54A\uC740 \uBC88\uD638\uC785\uB2C8\uB2E4. (1~${refs.length || 0})`));
+    console.log(chalk18.red(`\u274C \uC720\uD6A8\uD558\uC9C0 \uC54A\uC740 \uBC88\uD638\uC785\uB2C8\uB2E4. (1~${refs.length || 0})`));
     return;
   }
   const ref = refs[idx];
@@ -3996,34 +3463,34 @@ async function refOpen(indexStr) {
   try {
     parsed = new URL(ref.url);
   } catch {
-    console.log(chalk20.red(`\u274C \uC720\uD6A8\uD558\uC9C0 \uC54A\uC740 URL: ${ref.url}`));
+    console.log(chalk18.red(`\u274C \uC720\uD6A8\uD558\uC9C0 \uC54A\uC740 URL: ${ref.url}`));
     return;
   }
   if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-    console.log(chalk20.red(`\u274C http(s) URL\uB9CC \uC5F4 \uC218 \uC788\uC2B5\uB2C8\uB2E4 (${parsed.protocol})`));
+    console.log(chalk18.red(`\u274C http(s) URL\uB9CC \uC5F4 \uC218 \uC788\uC2B5\uB2C8\uB2E4 (${parsed.protocol})`));
     return;
   }
-  console.log(chalk20.cyan(`
+  console.log(chalk18.cyan(`
 \u{1F310} \uC5F4\uAE30: ${ref.url}`));
   let result;
   if (process.platform === "darwin") {
     result = safeExecFile("open", [ref.url]);
   } else if (process.platform === "win32") {
-    result = safeExecFile("cmd.exe", ["/c", "start", "", ref.url]);
+    result = safeExecFile("rundll32.exe", ["url.dll,FileProtocolHandler", ref.url]);
   } else {
     result = safeExecFile("xdg-open", [ref.url]);
   }
   if (result.ok) {
-    console.log(chalk20.green("\u2705 \uBE0C\uB77C\uC6B0\uC800\uC5D0\uC11C \uC5F4\uC5C8\uC2B5\uB2C8\uB2E4."));
+    console.log(chalk18.green("\u2705 \uBE0C\uB77C\uC6B0\uC800\uC5D0\uC11C \uC5F4\uC5C8\uC2B5\uB2C8\uB2E4."));
   } else {
-    console.log(chalk20.yellow("\u26A0\uFE0F  \uBE0C\uB77C\uC6B0\uC800\uB97C \uC5F4 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4. URL\uC744 \uC9C1\uC811 \uBC29\uBB38\uD574\uC8FC\uC138\uC694."));
+    console.log(chalk18.yellow("\u26A0\uFE0F  \uBE0C\uB77C\uC6B0\uC800\uB97C \uC5F4 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4. URL\uC744 \uC9C1\uC811 \uBC29\uBB38\uD574\uC8FC\uC138\uC694."));
   }
 }
 
 // src/commands/harness.ts
 import { existsSync as existsSync7 } from "fs";
-import chalk21 from "chalk";
-import ora3 from "ora";
+import chalk19 from "chalk";
+import ora2 from "ora";
 function detectPM() {
   if (existsSync7("pnpm-lock.yaml")) return "pnpm";
   if (existsSync7("yarn.lock")) return "yarn";
@@ -4063,30 +3530,30 @@ function detectChecks() {
   return checks;
 }
 async function harness() {
-  console.log(chalk21.bold("\n\u{1F527} " + t("harness.title")));
-  console.log(chalk21.gray("\u2500".repeat(40)));
+  console.log(chalk19.bold("\n\u{1F527} " + t("harness.title")));
+  console.log(chalk19.gray("\u2500".repeat(40)));
   const checks = detectChecks();
   if (checks.length === 0) {
-    console.log(chalk21.yellow("\n\u26A0\uFE0F  \uC2E4\uD589\uD560 \uC218 \uC788\uB294 \uC2A4\uD06C\uB9BD\uD2B8\uAC00 \uC5C6\uC2B5\uB2C8\uB2E4."));
-    console.log(chalk21.gray("   package.json\uC5D0 lint, test, build \uC2A4\uD06C\uB9BD\uD2B8\uB97C \uCD94\uAC00\uD574\uC8FC\uC138\uC694."));
+    console.log(chalk19.yellow("\n\u26A0\uFE0F  \uC2E4\uD589\uD560 \uC218 \uC788\uB294 \uC2A4\uD06C\uB9BD\uD2B8\uAC00 \uC5C6\uC2B5\uB2C8\uB2E4."));
+    console.log(chalk19.gray("   package.json\uC5D0 lint, test, build \uC2A4\uD06C\uB9BD\uD2B8\uB97C \uCD94\uAC00\uD574\uC8FC\uC138\uC694."));
     return;
   }
-  console.log(chalk21.cyan(`
+  console.log(chalk19.cyan(`
 \u{1F3C3} ${checks.length}\uAC1C \uC810\uAC80 \uC2DC\uC791:
 `));
   const results = [];
   for (const check2 of checks) {
     const display = `${check2.bin} ${check2.args.join(" ")}`;
-    const spinner = ora3(`${check2.name} \uC2E4\uD589 \uC911...`).start();
-    const start = Date.now();
+    const spinner = ora2(`${check2.name} \uC2E4\uD589 \uC911...`).start();
+    const start2 = Date.now();
     const result = safeExecFile(check2.bin, check2.args);
-    const duration = Date.now() - start;
+    const duration = Date.now() - start2;
     const sec = (duration / 1e3).toFixed(1);
     if (result.ok) {
-      spinner.succeed(`${check2.name} ${chalk21.gray(`(${sec}s)`)}`);
+      spinner.succeed(`${check2.name} ${chalk19.gray(`(${sec}s)`)}`);
       results.push({ name: check2.name, command: display, passed: true, duration });
     } else {
-      spinner.fail(`${check2.name} ${chalk21.gray(`(${sec}s)`)}`);
+      spinner.fail(`${check2.name} ${chalk19.gray(`(${sec}s)`)}`);
       results.push({
         name: check2.name,
         command: display,
@@ -4096,22 +3563,22 @@ async function harness() {
       });
     }
   }
-  console.log(chalk21.bold("\n\u{1F4CA} \uD1B5\uD569 \uB9AC\uD3EC\uD2B8:"));
-  console.log(chalk21.gray("\u2500".repeat(40)));
+  console.log(chalk19.bold("\n\u{1F4CA} \uD1B5\uD569 \uB9AC\uD3EC\uD2B8:"));
+  console.log(chalk19.gray("\u2500".repeat(40)));
   for (const r of results) {
-    const icon = r.passed ? chalk21.green("\u2705") : chalk21.red("\u274C");
+    const icon = r.passed ? chalk19.green("\u2705") : chalk19.red("\u274C");
     const sec = (r.duration / 1e3).toFixed(1);
-    console.log(`  ${icon} ${r.name.padEnd(15)} ${chalk21.gray(`${sec}s`)}`);
+    console.log(`  ${icon} ${r.name.padEnd(15)} ${chalk19.gray(`${sec}s`)}`);
   }
   const passed = results.filter((r) => r.passed).length;
   const all = passed === results.length;
-  console.log(chalk21.gray("\u2500".repeat(40)));
+  console.log(chalk19.gray("\u2500".repeat(40)));
   if (all) {
-    console.log(chalk21.green.bold(`
+    console.log(chalk19.green.bold(`
 \u{1F389} \uC804\uCCB4 \uD1B5\uACFC! (${passed}/${results.length})`));
   } else {
     console.log(
-      chalk21.red.bold(`
+      chalk19.red.bold(`
 \u26A0\uFE0F  ${results.length - passed}\uAC1C \uC2E4\uD328 (${passed}/${results.length} \uD1B5\uACFC)`)
     );
   }
@@ -4122,127 +3589,37 @@ async function harness() {
   });
 }
 
-// src/commands/audit.ts
-import { existsSync as existsSync8 } from "fs";
-import chalk22 from "chalk";
-import inquirer11 from "inquirer";
-import ora4 from "ora";
-function detectCurrentPM() {
-  if (existsSync8("pnpm-lock.yaml")) return "pnpm";
-  if (existsSync8("yarn.lock")) return "yarn";
-  return "npm";
-}
-function parseAuditOutput(output, pm) {
-  const empty = { critical: 0, high: 0, moderate: 0, low: 0, total: 0 };
-  if (!output) return empty;
-  try {
-    const json = JSON.parse(output);
-    const meta = json.metadata?.vulnerabilities;
-    if (meta) {
-      const summary = {
-        critical: meta.critical ?? 0,
-        high: meta.high ?? 0,
-        moderate: meta.moderate ?? 0,
-        low: meta.low ?? 0,
-        total: meta.total ?? 0
-      };
-      if (!summary.total) {
-        summary.total = summary.critical + summary.high + summary.moderate + summary.low;
-      }
-      return summary;
-    }
-    void pm;
-    return empty;
-  } catch {
-    return empty;
-  }
-}
-function runAuditJson(pm) {
-  const result = safeExecFile(pm, ["audit", "--json"]);
-  return result.out;
-}
-function runAuditFix(pm) {
-  if (pm !== "npm") {
-    return { ok: false, err: `${pm}\uC740 \uC790\uB3D9 fix\uB97C \uC9C0\uC6D0\uD558\uC9C0 \uC54A\uC2B5\uB2C8\uB2E4. npm \uD658\uACBD\uC5D0\uC11C\uB9CC \uB3D9\uC791\uD569\uB2C8\uB2E4.` };
-  }
-  const result = safeExecFile("npm", ["audit", "fix"]);
-  return result.ok ? { ok: true } : { ok: false, err: result.err };
-}
-async function audit(autoFix = false) {
-  console.log(chalk22.bold("\n\u{1F6E1}\uFE0F  " + t("audit.title")));
-  console.log(chalk22.gray("\u2500".repeat(40)));
-  const pm = detectCurrentPM();
-  console.log(chalk22.cyan(`\u{1F4E6} \uD328\uD0A4\uC9C0 \uB9E4\uB2C8\uC800: ${pm}`));
-  const spinner = ora4("\uBCF4\uC548 \uAC10\uC0AC \uC2E4\uD589 \uC911...").start();
-  const output = runAuditJson(pm);
-  spinner.stop();
-  const summary = parseAuditOutput(output, pm);
-  if (summary.total === 0) {
-    console.log(chalk22.green.bold("\n\u{1F389} \uCDE8\uC57D\uC810\uC774 \uBC1C\uACAC\uB418\uC9C0 \uC54A\uC558\uC2B5\uB2C8\uB2E4!"));
-    return;
-  }
-  console.log(chalk22.bold("\n\u{1F4CA} \uCDE8\uC57D\uC810 \uC694\uC57D:"));
-  if (summary.critical > 0) console.log(chalk22.red(`  \u{1F534} Critical: ${summary.critical}`));
-  if (summary.high > 0) console.log(chalk22.red(`  \u{1F7E0} High: ${summary.high}`));
-  if (summary.moderate > 0) console.log(chalk22.yellow(`  \u{1F7E1} Moderate: ${summary.moderate}`));
-  if (summary.low > 0) console.log(chalk22.gray(`  \u26AA Low: ${summary.low}`));
-  console.log(chalk22.bold(`
-  \uCD1D ${summary.total}\uAC1C\uC758 \uCDE8\uC57D\uC810`));
-  const shouldRunFix = autoFix ? true : summary.critical > 0 || summary.high > 0 ? (await inquirer11.prompt([
-    {
-      type: "confirm",
-      name: "shouldFix",
-      message: "\uC790\uB3D9 \uC218\uC815\uC744 \uC2DC\uB3C4\uD560\uAE4C\uC694? (npm audit fix)",
-      default: true
-    }
-  ])).shouldFix : false;
-  if (shouldRunFix) {
-    const fixSpinner = ora4("\uC790\uB3D9 \uC218\uC815 \uC911...").start();
-    const result = runAuditFix(pm);
-    if (result.ok) {
-      fixSpinner.succeed("\uC790\uB3D9 \uC218\uC815 \uC644\uB8CC!");
-    } else {
-      fixSpinner.warn(result.err ?? "\uC77C\uBD80 \uCDE8\uC57D\uC810\uC740 \uC218\uB3D9 \uC218\uC815\uC774 \uD544\uC694\uD569\uB2C8\uB2E4.");
-    }
-  }
-  printNextStep({
-    message: "\uBCF4\uC548 \uAC10\uC0AC \uC644\uB8CC.",
-    command: "vhk harness",
-    cursorHint: "\uD488\uC9C8 \uC810\uAC80\uD574\uC918"
-  });
-}
-
 // src/commands/migrate.ts
-import { existsSync as existsSync9, unlinkSync, rmSync } from "fs";
-import chalk23 from "chalk";
-import inquirer12 from "inquirer";
-import ora5 from "ora";
+import { existsSync as existsSync8, unlinkSync, rmSync } from "fs";
+import chalk20 from "chalk";
+import inquirer9 from "inquirer";
+import ora3 from "ora";
 var LOCK_FILES = {
   npm: "package-lock.json",
   yarn: "yarn.lock",
   pnpm: "pnpm-lock.yaml"
 };
-function detectCurrentPM2() {
-  if (existsSync9("pnpm-lock.yaml")) return "pnpm";
-  if (existsSync9("yarn.lock")) return "yarn";
-  if (existsSync9("package-lock.json")) return "npm";
+function detectCurrentPM() {
+  if (existsSync8("pnpm-lock.yaml")) return "pnpm";
+  if (existsSync8("yarn.lock")) return "yarn";
+  if (existsSync8("package-lock.json")) return "npm";
   return null;
 }
-function isCLIAvailable2(pm) {
+function isCLIAvailable(pm) {
   return safeExecFile(pm, ["--version"]).ok;
 }
 async function migrate(target) {
-  console.log(chalk23.bold("\n\u{1F504} " + t("migrate.title")));
-  console.log(chalk23.gray("\u2500".repeat(40)));
-  const current = detectCurrentPM2();
-  console.log(chalk23.cyan(`
+  console.log(chalk20.bold("\n\u{1F504} " + t("migrate.title")));
+  console.log(chalk20.gray("\u2500".repeat(40)));
+  const current = detectCurrentPM();
+  console.log(chalk20.cyan(`
 \uD604\uC7AC \uD328\uD0A4\uC9C0 \uB9E4\uB2C8\uC800: ${current ?? "\uAC10\uC9C0 \uBD88\uAC00"}`));
   let targetPM;
   if (target && ["npm", "yarn", "pnpm"].includes(target)) {
     targetPM = target;
   } else {
     const choices = ["npm", "yarn", "pnpm"].filter((pm) => pm !== current).map((pm) => ({ name: pm, value: pm }));
-    const { selected } = await inquirer12.prompt([
+    const { selected } = await inquirer9.prompt([
       {
         type: "list",
         name: "selected",
@@ -4253,17 +3630,17 @@ async function migrate(target) {
     targetPM = selected;
   }
   if (targetPM === current) {
-    console.log(chalk23.yellow(`
+    console.log(chalk20.yellow(`
 \u26A0\uFE0F  \uC774\uBBF8 ${targetPM}\uC744 \uC0AC\uC6A9 \uC911\uC785\uB2C8\uB2E4.`));
     return;
   }
-  if (!isCLIAvailable2(targetPM)) {
-    console.log(chalk23.red(`
+  if (!isCLIAvailable(targetPM)) {
+    console.log(chalk20.red(`
 \u274C ${targetPM}\uC774 \uC124\uCE58\uB418\uC5B4 \uC788\uC9C0 \uC54A\uC2B5\uB2C8\uB2E4.`));
-    console.log(chalk23.yellow(`   npm i -g ${targetPM}`));
+    console.log(chalk20.yellow(`   npm i -g ${targetPM}`));
     return;
   }
-  const { confirm } = await inquirer12.prompt([
+  const { confirm } = await inquirer9.prompt([
     {
       type: "confirm",
       name: "confirm",
@@ -4272,30 +3649,30 @@ async function migrate(target) {
     }
   ]);
   if (!confirm) {
-    console.log(chalk23.gray("\uCDE8\uC18C\uB428"));
+    console.log(chalk20.gray("\uCDE8\uC18C\uB428"));
     return;
   }
-  const cleanup = ora5("\uAE30\uC874 lock \uD30C\uC77C \uC815\uB9AC \uC911...").start();
+  const cleanup = ora3("\uAE30\uC874 lock \uD30C\uC77C \uC815\uB9AC \uC911...").start();
   for (const lockFile of Object.values(LOCK_FILES)) {
-    if (existsSync9(lockFile)) {
+    if (existsSync8(lockFile)) {
       unlinkSync(lockFile);
     }
   }
-  if (existsSync9("node_modules")) {
+  if (existsSync8("node_modules")) {
     cleanup.text = "node_modules \uC0AD\uC81C \uC911...";
     rmSync("node_modules", { recursive: true, force: true });
   }
   cleanup.succeed("\uAE30\uC874 \uD30C\uC77C \uC815\uB9AC \uC644\uB8CC");
-  const install = ora5(`${targetPM} install \uC2E4\uD589 \uC911...`).start();
+  const install = ora3(`${targetPM} install \uC2E4\uD589 \uC911...`).start();
   const installResult = safeExecFile(targetPM, ["install"]);
   if (installResult.ok) {
     install.succeed(`${targetPM} install \uC644\uB8CC!`);
   } else {
     install.fail(`${targetPM} install \uC2E4\uD328`);
-    console.log(chalk23.red(installResult.err.slice(0, 300)));
+    console.log(chalk20.red(installResult.err.slice(0, 300)));
     return;
   }
-  console.log(chalk23.green.bold(`
+  console.log(chalk20.green.bold(`
 \u{1F389} ${current ?? "\uC774\uC804"} \u2192 ${targetPM} \uC804\uD658 \uC644\uB8CC!`));
   printNextStep({
     message: "\uD328\uD0A4\uC9C0 \uB9E4\uB2C8\uC800 \uC804\uD658 \uC644\uB8CC!",
@@ -4305,18 +3682,17 @@ async function migrate(target) {
 }
 
 // src/commands/update.ts
-import { execSync as execSync3 } from "child_process";
-import { existsSync as existsSync10 } from "fs";
-import { dirname as dirname2, join as join2 } from "path";
+import { existsSync as existsSync9 } from "fs";
+import { dirname as dirname2, join as join4 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
-import chalk24 from "chalk";
-import ora6 from "ora";
+import chalk21 from "chalk";
+import ora4 from "ora";
 var PACKAGE = "@byh3071/vhk";
 function getCurrentVersion() {
   const dir = dirname2(fileURLToPath3(import.meta.url));
-  for (const pkgPath of [join2(dir, "../package.json"), join2(dir, "../../package.json")]) {
+  for (const pkgPath of [join4(dir, "../package.json"), join4(dir, "../../package.json")]) {
     try {
-      if (existsSync10(pkgPath)) {
+      if (existsSync9(pkgPath)) {
         const pkg = readJsonFile(pkgPath);
         if (pkg.version) return pkg.version;
       }
@@ -4327,15 +3703,8 @@ function getCurrentVersion() {
   return "0.0.0";
 }
 function getLatestVersion() {
-  try {
-    const out = execSync3(`npm view ${PACKAGE} version`, {
-      encoding: "utf-8",
-      stdio: ["pipe", "pipe", "pipe"]
-    }).toString();
-    return out.trim();
-  } catch {
-    return null;
-  }
+  const r = safeExecFile("npm", ["view", PACKAGE, "version"]);
+  return r.ok ? r.out : null;
 }
 function isUpToDate(current, latest) {
   const parse = (v) => v.split(".").map((n) => parseInt(n, 10) || 0);
@@ -4346,54 +3715,169 @@ function isUpToDate(current, latest) {
   return cc >= lc;
 }
 async function update() {
-  console.log(chalk24.bold("\n\u2B06\uFE0F  " + t("update.title")));
-  console.log(chalk24.gray("\u2500".repeat(40)));
+  console.log(chalk21.bold("\n\u2B06\uFE0F  " + t("update.title")));
+  console.log(chalk21.gray("\u2500".repeat(40)));
   const current = getCurrentVersion();
-  console.log(chalk24.cyan(`
+  console.log(chalk21.cyan(`
 \u{1F4CC} \uD604\uC7AC \uBC84\uC804: v${current}`));
-  const spinner = ora6("\uCD5C\uC2E0 \uBC84\uC804 \uD655\uC778 \uC911...").start();
+  const spinner = ora4("\uCD5C\uC2E0 \uBC84\uC804 \uD655\uC778 \uC911...").start();
   const latest = getLatestVersion();
   if (!latest) {
     spinner.fail("\uCD5C\uC2E0 \uBC84\uC804\uC744 \uD655\uC778\uD560 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4.");
-    console.log(chalk24.yellow("   \uB124\uD2B8\uC6CC\uD06C\uB97C \uD655\uC778\uD558\uAC70\uB098 \uC218\uB3D9\uC73C\uB85C \uC5C5\uB370\uC774\uD2B8\uD558\uC138\uC694:"));
-    console.log(chalk24.gray(`   npm update -g ${PACKAGE}`));
+    console.log(chalk21.yellow("   \uB124\uD2B8\uC6CC\uD06C\uB97C \uD655\uC778\uD558\uAC70\uB098 \uC218\uB3D9\uC73C\uB85C \uC5C5\uB370\uC774\uD2B8\uD558\uC138\uC694:"));
+    console.log(chalk21.gray(`   npm update -g ${PACKAGE}`));
     return;
   }
   spinner.stop();
-  console.log(chalk24.cyan(`\u{1F195} \uCD5C\uC2E0 \uBC84\uC804: v${latest}`));
+  console.log(chalk21.cyan(`\u{1F195} \uCD5C\uC2E0 \uBC84\uC804: v${latest}`));
   if (isUpToDate(current, latest)) {
-    console.log(chalk24.green("\n\u2705 \uC774\uBBF8 \uCD5C\uC2E0 \uBC84\uC804\uC785\uB2C8\uB2E4!"));
+    console.log(chalk21.green("\n\u2705 \uC774\uBBF8 \uCD5C\uC2E0 \uBC84\uC804\uC785\uB2C8\uB2E4!"));
     return;
   }
-  const updateSpinner = ora6(`v${latest}\uC73C\uB85C \uC5C5\uB370\uC774\uD2B8 \uC911...`).start();
-  try {
-    execSync3(`npm update -g ${PACKAGE}`, { stdio: ["pipe", "pipe", "pipe"] });
+  const updateSpinner = ora4(`v${latest}\uC73C\uB85C \uC5C5\uB370\uC774\uD2B8 \uC911...`).start();
+  const upd = safeExecFile("npm", ["update", "-g", PACKAGE]);
+  if (upd.ok) {
     updateSpinner.succeed(`v${latest}\uC73C\uB85C \uC5C5\uB370\uC774\uD2B8 \uC644\uB8CC!`);
-    console.log(chalk24.green.bold(`
+    console.log(chalk21.green.bold(`
 \u{1F389} VHK CLI v${latest} \uC5C5\uB370\uC774\uD2B8 \uC644\uB8CC!`));
-    console.log(chalk24.gray("   \uBCC0\uACBD \uC0AC\uD56D\uC740 GitHub Releases\uB97C \uD655\uC778\uD558\uC138\uC694."));
-  } catch (err) {
+    console.log(chalk21.gray("   \uBCC0\uACBD \uC0AC\uD56D\uC740 GitHub Releases\uB97C \uD655\uC778\uD558\uC138\uC694."));
+    printNextStep({
+      message: t("update.nextOkMessage"),
+      command: "vhk --version",
+      cursorHint: t("update.nextOkCursor")
+    });
+  } else {
     updateSpinner.fail("\uC5C5\uB370\uC774\uD2B8 \uC2E4\uD328");
-    const msg = err instanceof Error ? err.message.slice(0, 300) : String(err);
-    console.log(chalk24.red(msg));
-    console.log(chalk24.yellow("\n\uC218\uB3D9\uC73C\uB85C \uC5C5\uB370\uC774\uD2B8\uD558\uC138\uC694:"));
-    console.log(chalk24.gray(`   npm update -g ${PACKAGE}`));
+    console.log(chalk21.red(upd.err.slice(0, 300)));
+    console.log(chalk21.yellow("\n\uC218\uB3D9\uC73C\uB85C \uC5C5\uB370\uC774\uD2B8\uD558\uC138\uC694:"));
+    console.log(chalk21.gray(`   npm update -g ${PACKAGE}`));
+    printNextStep({
+      message: t("update.nextFailMessage"),
+      command: "vhk doctor",
+      cursorHint: t("update.nextFailCursor")
+    });
   }
 }
 
 // src/commands/context.ts
 import {
   existsSync as existsSync11,
-  mkdirSync as mkdirSync5,
-  readFileSync as readFileSync2,
-  readdirSync,
-  statSync,
-  writeFileSync as writeFileSync6
+  mkdirSync as mkdirSync7,
+  readFileSync as readFileSync4,
+  readdirSync as readdirSync2,
+  statSync as statSync2,
+  writeFileSync as writeFileSync7
 } from "fs";
-import { join as join3 } from "path";
-import chalk25 from "chalk";
+import { join as join6 } from "path";
+import chalk22 from "chalk";
+
+// src/lib/state-files.ts
+import { existsSync as existsSync10, mkdirSync as mkdirSync6, readFileSync as readFileSync3, writeFileSync as writeFileSync6, appendFileSync, rmSync as rmSync2 } from "fs";
+import { join as join5 } from "path";
+var STATE_DIR2 = "docs/state";
+var BLOCKERS_PATH = join5(STATE_DIR2, "blockers.md");
+var LEARNINGS_PATH = join5(STATE_DIR2, "learnings.md");
+var VHK_DIR = ".vhk";
+var HARD_STOP_PATH = join5(VHK_DIR, "HARD_STOP");
+var HARD_STOP_BLOCKER_THRESHOLD = 3;
+function ensureStateDir() {
+  mkdirSync6(STATE_DIR2, { recursive: true });
+}
+function ensureVhkDir() {
+  mkdirSync6(VHK_DIR, { recursive: true });
+}
+function isoDate() {
+  return (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+}
+var ACTIVE_BLOCKER_RE = /^- (?!~~)\[/;
+function countActiveBlockers(content) {
+  let count = 0;
+  for (const line of content.split(/\r?\n/)) {
+    if (ACTIVE_BLOCKER_RE.test(line)) count++;
+  }
+  return count;
+}
+function appendBlocker(description, goalId) {
+  ensureStateDir();
+  const tag = goalId !== void 0 ? `goal-${goalId}` : "no-goal";
+  const line = `- [${isoDate()} ${tag}] ${description.trim()}`;
+  if (!existsSync10(BLOCKERS_PATH)) {
+    writeFileSync6(
+      BLOCKERS_PATH,
+      `# Blockers
+
+_Append-only. \uD574\uACB0 \uD56D\uBAA9\uC740 ~~\uCDE8\uC18C\uC120~~\uC73C\uB85C \uD45C\uAE30._
+
+${line}
+`,
+      "utf-8"
+    );
+  } else {
+    appendFileSync(BLOCKERS_PATH, `${line}
+`, "utf-8");
+  }
+  const current = readFileSync3(BLOCKERS_PATH, "utf-8");
+  const count = countActiveBlockers(current);
+  let hardStopTripped = false;
+  if (count >= HARD_STOP_BLOCKER_THRESHOLD && !existsSync10(HARD_STOP_PATH)) {
+    writeHardStop(`auto: ${count} active blockers (threshold ${HARD_STOP_BLOCKER_THRESHOLD})`);
+    hardStopTripped = true;
+  }
+  return { count, hardStopTripped };
+}
+function appendLearning(lesson, goalId) {
+  ensureStateDir();
+  const tag = goalId !== void 0 ? `goal-${goalId}` : "no-goal";
+  const line = `- [${isoDate()} ${tag}] ${lesson.trim()}`;
+  if (!existsSync10(LEARNINGS_PATH)) {
+    writeFileSync6(
+      LEARNINGS_PATH,
+      `# Learnings
+
+_Append-only. \uD55C \uC904 = \uD55C \uAD50\uD6C8._
+
+${line}
+`,
+      "utf-8"
+    );
+  } else {
+    appendFileSync(LEARNINGS_PATH, `${line}
+`, "utf-8");
+  }
+}
+function getRecentLearnings(limit = 3) {
+  if (!existsSync10(LEARNINGS_PATH)) return [];
+  const lines = readFileSync3(LEARNINGS_PATH, "utf-8").split(/\r?\n/);
+  const entries = lines.filter((l) => l.startsWith("- ["));
+  return entries.slice(-limit);
+}
+function writeHardStop(reason) {
+  ensureVhkDir();
+  const ts = (/* @__PURE__ */ new Date()).toISOString();
+  writeFileSync6(HARD_STOP_PATH, `${ts}
+${reason}
+`, "utf-8");
+}
+function isHardStopActive() {
+  return existsSync10(HARD_STOP_PATH);
+}
+function readHardStopReason() {
+  if (!existsSync10(HARD_STOP_PATH)) return null;
+  try {
+    return readFileSync3(HARD_STOP_PATH, "utf-8").trim();
+  } catch {
+    return null;
+  }
+}
+function clearHardStop() {
+  if (!existsSync10(HARD_STOP_PATH)) return false;
+  rmSync2(HARD_STOP_PATH, { force: true });
+  return true;
+}
+
+// src/commands/context.ts
 var CONTEXT_PATH = ".vhk/context.md";
-var IGNORE_DIRS2 = /* @__PURE__ */ new Set([
+var IGNORE_DIRS = /* @__PURE__ */ new Set([
   "node_modules",
   ".git",
   "dist",
@@ -4409,15 +3893,15 @@ function buildTree(dir, prefix = "", maxDepth = 3, depth = 0) {
   if (depth >= maxDepth) return [];
   const lines = [];
   try {
-    const entries = readdirSync(dir);
+    const entries = readdirSync2(dir);
     const filtered = entries.filter(
-      (e) => (!e.startsWith(".") || e === ".env.example") && !IGNORE_DIRS2.has(e)
+      (e) => (!e.startsWith(".") || e === ".env.example") && !IGNORE_DIRS.has(e)
     );
     filtered.forEach((entry, index) => {
       const isLast = index === filtered.length - 1;
       const connector = isLast ? "\u2514\u2500\u2500 " : "\u251C\u2500\u2500 ";
-      const fullPath = join3(dir, entry);
-      const stat = statSync(fullPath);
+      const fullPath = join6(dir, entry);
+      const stat = statSync2(fullPath);
       const isDir = stat.isDirectory();
       lines.push(`${prefix}${connector}${entry}${isDir ? "/" : ""}`);
       if (isDir) {
@@ -4491,8 +3975,8 @@ function getVhkCommands() {
   ];
 }
 async function context() {
-  console.log(chalk25.bold("\n\u{1F9E0} " + t("context.title")));
-  console.log(chalk25.gray("\u2500".repeat(40)));
+  console.log(chalk22.bold("\n\u{1F9E0} " + t("context.title")));
+  console.log(chalk22.gray("\u2500".repeat(40)));
   const stack = extractTechStack();
   const tree = buildTree(".").join("\n");
   const commands = getVhkCommands();
@@ -4537,16 +4021,45 @@ async function context() {
     } catch {
     }
   }
+  const goals = listGoals("goals");
+  const activeId = selectActiveId(goals);
+  if (activeId !== null) {
+    const active = goals.find((g) => g.frontmatter.id === activeId);
+    if (active) {
+      lines.push("## Active Goal");
+      lines.push("");
+      lines.push(`- **id**: ${activeId}`);
+      lines.push(`- **title**: ${active.frontmatter.title ?? "(untitled)"}`);
+      lines.push(`- **status**: ${active.frontmatter.status ?? "NOT_STARTED"}`);
+      lines.push(`- **priority**: ${active.frontmatter.priority ?? "--"}`);
+      lines.push(`- **file**: ${active.filePath}`);
+      lines.push("");
+    }
+  }
+  const recent = getRecentLearnings(3);
+  if (recent.length > 0) {
+    lines.push("## Recent Learnings");
+    lines.push("");
+    for (const r of recent) lines.push(r);
+    lines.push("");
+  }
+  if (isHardStopActive()) {
+    lines.push("## \u26A0\uFE0F HARD_STOP \uD65C\uC131");
+    lines.push("");
+    lines.push("`.vhk/HARD_STOP` \uD30C\uC77C \uC874\uC7AC \u2014 \uBAA8\uB4E0 \uC790\uB3D9\uD654 \uC911\uB2E8 \uC0C1\uD0DC.");
+    lines.push("\uD574\uC81C: `vhk resume --confirm` (\uC0AC\uB78C \uD655\uC778 \uD6C4\uB9CC)");
+    lines.push("");
+  }
   lines.push("---");
   lines.push("");
   lines.push(`_\uC0DD\uC131: ${(/* @__PURE__ */ new Date()).toLocaleString("ko-KR")}_`);
   lines.push("");
-  mkdirSync5(".vhk", { recursive: true });
-  writeFileSync6(CONTEXT_PATH, lines.join("\n"), "utf-8");
-  console.log(chalk25.green(`
+  mkdirSync7(".vhk", { recursive: true });
+  writeFileSync7(CONTEXT_PATH, lines.join("\n"), "utf-8");
+  console.log(chalk22.green(`
 \u2705 ${CONTEXT_PATH} \uC0DD\uC131 \uC644\uB8CC!`));
-  console.log(chalk25.gray(`   \uAE30\uC220 \uC2A4\uD0DD ${Object.keys(stack).length}\uAC1C \uAC10\uC9C0`));
-  console.log(chalk25.gray("   AI \uC5B4\uC2DC\uC2A4\uD134\uD2B8\uC5D0\uAC8C \uC774 \uD30C\uC77C\uC744 \uCC38\uC870\uD558\uAC8C \uD558\uC138\uC694."));
+  console.log(chalk22.gray(`   \uAE30\uC220 \uC2A4\uD0DD ${Object.keys(stack).length}\uAC1C \uAC10\uC9C0`));
+  console.log(chalk22.gray("   AI \uC5B4\uC2DC\uC2A4\uD134\uD2B8\uC5D0\uAC8C \uC774 \uD30C\uC77C\uC744 \uCC38\uC870\uD558\uAC8C \uD558\uC138\uC694."));
   printNextStep({
     message: "\uCEE8\uD14D\uC2A4\uD2B8 \uD30C\uC77C \uC0DD\uC131 \uC644\uB8CC!",
     command: "vhk context-show",
@@ -4554,20 +4067,20 @@ async function context() {
   });
 }
 async function contextShow() {
-  console.log(chalk25.bold("\n\u{1F4C4} " + t("context.showTitle")));
-  console.log(chalk25.gray("\u2500".repeat(40)));
+  console.log(chalk22.bold("\n\u{1F4C4} " + t("context.showTitle")));
+  console.log(chalk22.gray("\u2500".repeat(40)));
   if (!existsSync11(CONTEXT_PATH)) {
-    console.log(chalk25.yellow("\n\u26A0\uFE0F  \uCEE8\uD14D\uC2A4\uD2B8 \uD30C\uC77C\uC774 \uC5C6\uC2B5\uB2C8\uB2E4."));
-    console.log(chalk25.gray("   vhk context\uB97C \uBA3C\uC800 \uC2E4\uD589\uD558\uC138\uC694."));
+    console.log(chalk22.yellow("\n\u26A0\uFE0F  \uCEE8\uD14D\uC2A4\uD2B8 \uD30C\uC77C\uC774 \uC5C6\uC2B5\uB2C8\uB2E4."));
+    console.log(chalk22.gray("   vhk context\uB97C \uBA3C\uC800 \uC2E4\uD589\uD558\uC138\uC694."));
     return;
   }
-  const content = readFileSync2(CONTEXT_PATH, "utf-8");
+  const content = readFileSync4(CONTEXT_PATH, "utf-8");
   console.log("\n" + content);
 }
 
 // src/commands/memory.ts
-import { existsSync as existsSync12, mkdirSync as mkdirSync6, writeFileSync as writeFileSync7 } from "fs";
-import chalk26 from "chalk";
+import { existsSync as existsSync12, mkdirSync as mkdirSync8, writeFileSync as writeFileSync8 } from "fs";
+import chalk23 from "chalk";
 var MEMORY_PATH = ".vhk/memory.json";
 function loadMemories() {
   if (!existsSync12(MEMORY_PATH)) return [];
@@ -4579,15 +4092,15 @@ function loadMemories() {
   }
 }
 function saveMemories(memories) {
-  mkdirSync6(".vhk", { recursive: true });
-  writeFileSync7(MEMORY_PATH, JSON.stringify(memories, null, 2) + "\n", "utf-8");
+  mkdirSync8(".vhk", { recursive: true });
+  writeFileSync8(MEMORY_PATH, JSON.stringify(memories, null, 2) + "\n", "utf-8");
 }
 async function memoryAdd(content, tags) {
-  console.log(chalk26.bold("\n\u{1F9E0} " + t("memory.addTitle")));
-  console.log(chalk26.gray("\u2500".repeat(40)));
+  console.log(chalk23.bold("\n\u{1F9E0} " + t("memory.addTitle")));
+  console.log(chalk23.gray("\u2500".repeat(40)));
   if (!content) {
-    console.log(chalk26.red("\u274C \uAE30\uC5B5\uD560 \uB0B4\uC6A9\uC744 \uC785\uB825\uD574\uC8FC\uC138\uC694."));
-    console.log(chalk26.gray('   \uC608: vhk memory add "API\uB294 tRPC \uC0AC\uC6A9\uD558\uAE30\uB85C \uACB0\uC815"'));
+    console.log(chalk23.red("\u274C \uAE30\uC5B5\uD560 \uB0B4\uC6A9\uC744 \uC785\uB825\uD574\uC8FC\uC138\uC694."));
+    console.log(chalk23.gray('   \uC608: vhk memory add "API\uB294 tRPC \uC0AC\uC6A9\uD558\uAE30\uB85C \uACB0\uC815"'));
     return;
   }
   const memories = loadMemories();
@@ -4597,9 +4110,9 @@ async function memoryAdd(content, tags) {
     tags: tags && tags.length > 0 ? tags : []
   });
   saveMemories(memories);
-  console.log(chalk26.green(`
+  console.log(chalk23.green(`
 \u2705 \uAE30\uC5B5 \uC800\uC7A5\uB428 (#${memories.length})`));
-  console.log(chalk26.cyan(`   \u{1F4DD} ${content}`));
+  console.log(chalk23.cyan(`   \u{1F4DD} ${content}`));
   printNextStep({
     message: "\uAE30\uC5B5 \uC800\uC7A5 \uC644\uB8CC!",
     command: "vhk memory list",
@@ -4607,24 +4120,24 @@ async function memoryAdd(content, tags) {
   });
 }
 async function memoryList() {
-  console.log(chalk26.bold("\n\u{1F9E0} " + t("memory.listTitle")));
-  console.log(chalk26.gray("\u2500".repeat(40)));
+  console.log(chalk23.bold("\n\u{1F9E0} " + t("memory.listTitle")));
+  console.log(chalk23.gray("\u2500".repeat(40)));
   const memories = loadMemories();
   if (memories.length === 0) {
-    console.log(chalk26.yellow("\n\u{1F4ED} \uC800\uC7A5\uB41C \uAE30\uC5B5\uC774 \uC5C6\uC2B5\uB2C8\uB2E4."));
-    console.log(chalk26.gray('   vhk memory add "\uB0B4\uC6A9"\uC73C\uB85C \uCD94\uAC00\uD558\uC138\uC694.'));
+    console.log(chalk23.yellow("\n\u{1F4ED} \uC800\uC7A5\uB41C \uAE30\uC5B5\uC774 \uC5C6\uC2B5\uB2C8\uB2E4."));
+    console.log(chalk23.gray('   vhk memory add "\uB0B4\uC6A9"\uC73C\uB85C \uCD94\uAC00\uD558\uC138\uC694.'));
     return;
   }
-  console.log(chalk26.cyan(`
+  console.log(chalk23.cyan(`
 \uCD1D ${memories.length}\uAC1C\uC758 \uAE30\uC5B5:
 `));
   memories.forEach((m, index) => {
     const date = new Date(m.addedAt).toLocaleDateString("ko-KR");
-    console.log(chalk26.white(`  [${index + 1}] ${m.content}`));
+    console.log(chalk23.white(`  [${index + 1}] ${m.content}`));
     if (m.tags && m.tags.length > 0) {
-      console.log(chalk26.blue(`      \u{1F3F7}\uFE0F  ${m.tags.join(", ")}`));
+      console.log(chalk23.blue(`      \u{1F3F7}\uFE0F  ${m.tags.join(", ")}`));
     }
-    console.log(chalk26.gray(`      \u{1F4C5} ${date}`));
+    console.log(chalk23.gray(`      \u{1F4C5} ${date}`));
     console.log("");
   });
 }
@@ -4632,26 +4145,26 @@ async function memoryRemove(indexStr) {
   const memories = loadMemories();
   const idx = parseInt(indexStr, 10) - 1;
   if (Number.isNaN(idx) || idx < 0 || idx >= memories.length) {
-    console.log(chalk26.red(`\u274C \uC720\uD6A8\uD558\uC9C0 \uC54A\uC740 \uBC88\uD638\uC785\uB2C8\uB2E4. (1~${memories.length || 0})`));
+    console.log(chalk23.red(`\u274C \uC720\uD6A8\uD558\uC9C0 \uC54A\uC740 \uBC88\uD638\uC785\uB2C8\uB2E4. (1~${memories.length || 0})`));
     return;
   }
   const removed = memories.splice(idx, 1)[0];
   saveMemories(memories);
-  console.log(chalk26.green("\n\u2705 \uAE30\uC5B5 \uC0AD\uC81C\uB428:"));
-  console.log(chalk26.gray(`   ${removed.content}`));
+  console.log(chalk23.green("\n\u2705 \uAE30\uC5B5 \uC0AD\uC81C\uB428:"));
+  console.log(chalk23.gray(`   ${removed.content}`));
 }
 
 // src/commands/brief.ts
-import { existsSync as existsSync13, mkdirSync as mkdirSync7, writeFileSync as writeFileSync8 } from "fs";
-import chalk27 from "chalk";
+import { existsSync as existsSync13, mkdirSync as mkdirSync9, writeFileSync as writeFileSync9 } from "fs";
+import chalk24 from "chalk";
 var BRIEF_PATH = ".vhk/brief.md";
 function git2(args) {
   const result = safeExecFile("git", args);
   return result.ok ? result.out : "";
 }
 async function brief() {
-  console.log(chalk27.bold("\n\u{1F4CB} " + t("brief.title")));
-  console.log(chalk27.gray("\u2500".repeat(40)));
+  console.log(chalk24.bold("\n\u{1F4CB} " + t("brief.title")));
+  console.log(chalk24.gray("\u2500".repeat(40)));
   const lines = [];
   lines.push("# \uD504\uB85C\uC81D\uD2B8 \uBE0C\uB9AC\uD551");
   lines.push("");
@@ -4732,10 +4245,10 @@ async function brief() {
   lines.push("");
   lines.push("_VHK CLI \uBE0C\uB9AC\uD551_");
   lines.push("");
-  mkdirSync7(".vhk", { recursive: true });
-  writeFileSync8(BRIEF_PATH, lines.join("\n"), "utf-8");
+  mkdirSync9(".vhk", { recursive: true });
+  writeFileSync9(BRIEF_PATH, lines.join("\n"), "utf-8");
   console.log("\n" + lines.join("\n"));
-  console.log(chalk27.green(`
+  console.log(chalk24.green(`
 \u2705 ${BRIEF_PATH} \uC800\uC7A5 \uC644\uB8CC`));
   printNextStep({
     message: "\uBE0C\uB9AC\uD551 \uC0DD\uC131 \uC644\uB8CC!",
@@ -4744,11 +4257,119 @@ async function brief() {
   });
 }
 
+// src/commands/start.ts
+import chalk25 from "chalk";
+import inquirer10 from "inquirer";
+import { simpleGit as simpleGit2 } from "simple-git";
+import { existsSync as existsSync14 } from "fs";
+import { join as join7 } from "path";
+var VHK_FOOTPRINT_FILES = [
+  "CLAUDE.md",
+  ".cursorrules",
+  ".cursor/mcp.json",
+  ".vhk/context.md",
+  "docs/PRD.md"
+];
+function detectExistingFootprint(cwd) {
+  return VHK_FOOTPRINT_FILES.filter((rel) => existsSync14(join7(cwd, rel)));
+}
+async function runGitInit(cwd) {
+  try {
+    const git3 = simpleGit2(cwd);
+    const isRepo = await git3.checkIsRepo().catch(() => false);
+    if (isRepo) {
+      log.info(ko.start.gitAlreadyInit);
+      return;
+    }
+    await git3.init();
+    log.success(ko.start.gitInitDone);
+  } catch (err) {
+    log.error(`git init \uC2E4\uD328: ${err instanceof Error ? err.message : String(err)}`);
+    throw new Error("step1-git-init");
+  }
+}
+async function runStep(label, fn) {
+  try {
+    return await fn();
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    log.error(`${label} \uC2E4\uD328: ${msg}`);
+    log.warn("\uB9C8\uBC95\uC0AC\uB97C \uC911\uB2E8\uD569\uB2C8\uB2E4. \uC774\uBBF8 \uC0DD\uC131\uB41C \uD30C\uC77C\uC740 \uADF8\uB300\uB85C \uB0A8\uC544\uC788\uC5B4\uC694.");
+    log.warn("\uBB38\uC81C\uB97C \uACE0\uCE5C \uB4A4 `vhk start`\uB97C \uB2E4\uC2DC \uC2E4\uD589\uD558\uAC70\uB098, \uAC1C\uBCC4 \uBA85\uB839(`vhk init`, `vhk mcp-init`, `vhk context`)\uC73C\uB85C \uC774\uC5B4 \uC9C4\uD589\uD558\uC138\uC694.");
+    throw err;
+  }
+}
+async function start(options = {}) {
+  console.log(chalk25.bold(`
+${ko.start.title}
+`));
+  console.log(chalk25.dim(ko.start.intro));
+  console.log(chalk25.dim(`  ${ko.start.step1}`));
+  console.log(chalk25.dim(`  ${ko.start.step2}`));
+  console.log(chalk25.dim(`  ${ko.start.step3}`));
+  console.log(chalk25.dim(`  ${ko.start.step4}`));
+  console.log();
+  const cwd = process.cwd();
+  const footprint = detectExistingFootprint(cwd);
+  if (footprint.length > 0 && !options.yes) {
+    console.log(chalk25.yellow("\u26A0\uFE0F  \uC774\uBBF8 VHK \uC124\uCE58 \uD754\uC801\uC774 \uAC10\uC9C0\uB410\uC5B4\uC694:"));
+    for (const f of footprint) console.log(chalk25.dim(`   - ${f}`));
+    console.log(chalk25.dim("   \uACC4\uC18D \uC9C4\uD589\uD558\uBA74 \uC77C\uBD80 \uD30C\uC77C(`.cursor/mcp.json`, `.vhk/context.md`)\uC740 \uAC31\uC2E0\xB7\uB36E\uC5B4\uC4F0\uAE30\uB429\uB2C8\uB2E4."));
+    const { proceedExisting } = await inquirer10.prompt([{
+      type: "confirm",
+      name: "proceedExisting",
+      message: "\uADF8\uB798\uB3C4 \uB2E4\uC2DC \uB9C8\uBC95\uC0AC\uB97C \uC9C4\uD589\uD560\uAE4C\uC694?",
+      default: false
+    }]);
+    if (!proceedExisting) {
+      log.warn(ko.start.cancelled);
+      return;
+    }
+  } else if (!options.yes) {
+    const { proceed } = await inquirer10.prompt([{
+      type: "confirm",
+      name: "proceed",
+      message: ko.start.confirmStart,
+      default: true
+    }]);
+    if (!proceed) {
+      log.warn(ko.start.cancelled);
+      return;
+    }
+  }
+  log.step(ko.start.step1Header);
+  await runStep("[1/4] git init", () => runGitInit(cwd));
+  log.step(ko.start.step2Header);
+  await runStep("[2/4] vhk init", () => init({
+    skipGate: true,
+    fromNotion: options.fromNotion,
+    name: options.name,
+    description: options.description,
+    type: options.type,
+    yes: options.yes
+  }));
+  log.step(ko.start.step3Header);
+  await runStep("[3/4] vhk mcp-init", () => mcpInit());
+  log.step(ko.start.step4Header);
+  await runStep("[4/4] vhk context", () => context());
+  console.log(chalk25.bold.green(`
+${ko.start.allDone}
+`));
+  printNextStep({
+    message: ko.start.nextHintMessage,
+    cursorHint: ko.start.nextHintCursor
+  });
+}
+
 // src/lib/nlp-run.ts
 async function dispatchNlpRoute(route, input) {
   switch (route.command) {
     case "gate":
       return gate();
+    case "start":
+      return start({
+        fromNotion: route.args?.includes("--from-notion") ? extractNotionUrl(input) : void 0
+      });
     case "init":
       return init({
         skipGate: route.args?.includes("--skip-gate"),
@@ -4808,28 +4429,35 @@ async function dispatchNlpRoute(route, input) {
       return memoryList();
     case "brief":
       return brief();
+    case "goal": {
+      const sub = route.args?.[0];
+      if (sub === "next") return goalNext();
+      if (sub === "check") return goalCheck({});
+      if (sub === "done") return goalDone({});
+      return goalList();
+    }
   }
 }
 async function runNaturalLanguageRoute(input) {
   const route = routeNaturalLanguage(input);
   if (!route) {
-    console.log(chalk28.yellow(`
+    console.log(chalk26.yellow(`
   \u2753 "${input}" \u2014 ${ko.nlp.notMatched}
 `));
     return;
   }
   console.log("");
-  console.log(chalk28.cyan(`  \u{1F4AC} "${input}"`));
-  console.log(chalk28.cyan(`  \u2192 ${route.explanation}`));
+  console.log(chalk26.cyan(`  \u{1F4AC} "${input}"`));
+  console.log(chalk26.cyan(`  \u2192 ${route.explanation}`));
   if (route.confidence === "low") {
-    const { confirm } = await inquirer13.prompt([{
+    const { confirm } = await inquirer11.prompt([{
       type: "confirm",
       name: "confirm",
       message: `${route.explanation} \u2014 ${ko.nlp.matched}`,
       default: true
     }]);
     if (!confirm) {
-      console.log(chalk28.dim(`  ${ko.nlp.menuHint}`));
+      console.log(chalk26.dim(`  ${ko.nlp.menuHint}`));
       return;
     }
   }
@@ -4837,26 +4465,79 @@ async function runNaturalLanguageRoute(input) {
   await dispatchNlpRoute(route, input);
 }
 
-// src/lib/version.ts
-import { existsSync as existsSync14 } from "fs";
-import { dirname as dirname3, join as join4 } from "path";
-import { fileURLToPath as fileURLToPath4 } from "url";
-function getVhkVersion2() {
-  const dir = dirname3(fileURLToPath4(import.meta.url));
-  for (const pkgPath of [
-    join4(dir, "../../package.json"),
-    join4(dir, "../package.json")
-  ]) {
-    try {
-      if (existsSync14(pkgPath)) {
-        const pkg = readJsonFile(pkgPath);
-        if (pkg.version) return pkg.version;
-      }
-    } catch {
-      continue;
-    }
+// src/commands/agent.ts
+import chalk27 from "chalk";
+function activeGoalId() {
+  const goals = listGoals("goals");
+  const id = selectActiveId(goals);
+  return id ?? void 0;
+}
+async function blocker(description) {
+  console.log(chalk27.bold(`
+${ko.agent.blockerTitle}
+`));
+  if (!description || !description.trim()) {
+    console.log(chalk27.red("  \u274C \uBE14\uB85C\uCEE4 \uC124\uBA85\uC744 \uC785\uB825\uD574 \uC8FC\uC138\uC694."));
+    console.log(chalk27.dim('  \uC608: vhk blocker "tsc \uC5D0\uB7EC \u2014 simple-git \uD0C0\uC785 \uD638\uD658"'));
+    process.exitCode = 1;
+    return;
+  }
+  const goalId = activeGoalId();
+  const r = appendBlocker(description, goalId);
+  console.log(chalk27.green(`  \u2705 blocker \uAE30\uB85D (\uD604\uC7AC \uD65C\uC131 ${r.count}\uAC74)`));
+  if (r.hardStopTripped) {
+    console.log(chalk27.red.bold("  \u{1F6D1} HARD_STOP \uC790\uB3D9 \uC0DD\uC131 \u2014 \uBAA8\uB4E0 \uC790\uB3D9\uD654 \uC911\uB2E8."));
+    console.log(chalk27.yellow("     \uC0AC\uB78C \uAC80\uD1A0 \uD6C4 `vhk resume --confirm` \uC73C\uB85C\uB9CC \uD574\uC81C."));
+    process.exitCode = 2;
+  }
+}
+async function learn(lesson) {
+  console.log(chalk27.bold(`
+${ko.agent.learnTitle}
+`));
+  if (!lesson || !lesson.trim()) {
+    console.log(chalk27.red("  \u274C \uAD50\uD6C8 \uB0B4\uC6A9\uC744 \uC785\uB825\uD574 \uC8FC\uC138\uC694."));
+    console.log(chalk27.dim('  \uC608: vhk learn "PowerShell \uC5D0\uC11C\uB294 ; \uC0AC\uC6A9 (&& \uBBF8\uC9C0\uC6D0)"'));
+    process.exitCode = 1;
+    return;
+  }
+  const goalId = activeGoalId();
+  appendLearning(lesson, goalId);
+  console.log(chalk27.green("  \u2705 learnings.md append."));
+  console.log(
+    chalk27.dim("  \uACB0\uC815\uC0AC\uD56D(decision)\uC740 `vhk memory add` \uB85C \uBCC4\uB3C4 \uAE30\uB85D \u2014 SoT \uBD84\uB9AC.")
+  );
+}
+async function resume(opts = {}) {
+  console.log(chalk27.bold(`
+${ko.agent.resumeTitle}
+`));
+  if (!isHardStopActive()) {
+    console.log(chalk27.dim("  HARD_STOP \uD65C\uC131 \uC544\uB2D8 \u2014 \uD560 \uC77C \uC5C6\uC74C."));
+    return;
+  }
+  const reason = readHardStopReason();
+  if (reason) {
+    console.log(chalk27.yellow("  \u{1F4CB} HARD_STOP \uC0AC\uC720:"));
+    console.log(chalk27.dim(`     ${reason.split("\n").join("\n     ")}`));
+    console.log("");
+  }
+  if (!opts.confirm) {
+    console.log(
+      chalk27.red(
+        "  \u274C --confirm \uD50C\uB798\uADF8 \uC5C6\uC774\uB294 \uD574\uC81C\uD560 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4 (\uC790\uB3D9 \uD638\uCD9C \uAE08\uC9C0)."
+      )
+    );
+    console.log(chalk27.yellow("     \uC0AC\uC720\uB97C \uD655\uC778\uD55C \uD6C4 \uB2E4\uC2DC: vhk resume --confirm"));
+    process.exitCode = 1;
+    return;
+  }
+  const removed = clearHardStop();
+  if (removed) {
+    console.log(chalk27.green("  \u2705 HARD_STOP \uD574\uC81C. \uC790\uB3D9\uD654 \uC7AC\uAC1C \uAC00\uB2A5."));
+  } else {
+    console.log(chalk27.dim("  \uD30C\uC77C\uC774 \uC774\uBBF8 \uC5C6\uC74C \u2014 no-op."));
   }
-  return "0.0.0";
 }
 
 // src/index.ts
@@ -4864,7 +4545,8 @@ var program = new Command();
 var defaultHelp = new Help();
 var KO_ALIASES = {
   gate: "\uAC80\uC99D",
-  init: "\uC2DC\uC791",
+  start: "\uC2DC\uC791",
+  init: "\uCD08\uAE30\uD654",
   recap: "\uC815\uB9AC",
   sync: "\uADDC\uCE59",
   check: "\uC810\uAC80",
@@ -4890,9 +4572,13 @@ var KO_ALIASES = {
   context: "\uB9E5\uB77D",
   "context-show": "\uB9E5\uB77D\uBCF4\uAE30",
   memory: "\uAE30\uC5B5",
-  brief: "\uBE0C\uB9AC\uD551"
+  brief: "\uBE0C\uB9AC\uD551",
+  goal: "\uBAA9\uD45C",
+  blocker: "\uBE14\uB85C\uCEE4",
+  learn: "\uAD50\uD6C8",
+  resume: "\uC7AC\uAC1C"
 };
-program.name("vhk").description("VHK \u2014 \uBC14\uC774\uBE0C\uCF54\uB529 \uD504\uB85C\uC81D\uD2B8 \uCF54\uCE58 (\uD55C\uAD6D\uC5B4\uB85C \uC548\uB0B4\uD569\uB2C8\uB2E4)").version(getVhkVersion2());
+program.name("vhk").description("VHK \u2014 \uBC14\uC774\uBE0C\uCF54\uB529 \uD504\uB85C\uC81D\uD2B8 \uCF54\uCE58 (\uD55C\uAD6D\uC5B4\uB85C \uC548\uB0B4\uD569\uB2C8\uB2E4)").version(getVhkVersion());
 program.configureHelp({
   formatHelp(cmd, helper) {
     if (cmd.parent) {
@@ -4917,10 +4603,13 @@ program.configureHelp({
   }
 });
 program.command("gate").alias("\uAC80\uC99D").alias("\uC544\uC774\uB514\uC5B4").description("\uC544\uC774\uB514\uC5B4 \uAC80\uC99D \u2192 \uC2DC\uC791\uD574\uB3C4 \uB3FC\uC694 / \uB2E4\uB4EC\uAE30 / \uB2E4\uB978 \uC544\uC774\uB514\uC5B4").action(gate);
-program.command("init").alias("\uC2DC\uC791").alias("\uB9CC\uB4E4\uAE30").description("\uD504\uB85C\uC81D\uD2B8 \uC2DC\uC791\uD558\uAE30 \u2014 \uD3F4\uB354 + \uD558\uB124\uC2A4 \uD30C\uC77C \uC790\uB3D9 \uC0DD\uC131").option("--skip-gate", "gate \uAC80\uC99D \uC2A4\uD0B5").option("--from-notion <url>", "Notion PRD \uD398\uC774\uC9C0\uC5D0\uC11C import").option("--name <name>", "\uD504\uB85C\uC81D\uD2B8 \uC774\uB984").option("--description <desc>", "\uD55C \uC904 \uC124\uBA85").option("--type <type>", "\uD504\uB85C\uC81D\uD2B8 \uC720\uD615 (webapp|extension|cli|notion|mobile)").option("-y, --yes", "\uC2A4\uD0DD \uD655\uC778 \uC2A4\uD0B5").action(init);
+program.command("start").alias("\uC2DC\uC791").alias("\uC0C8\uD504\uB85C\uC81D\uD2B8").description("\uC0C8 \uD504\uB85C\uC81D\uD2B8 \uC2DC\uC791 \uB9C8\uBC95\uC0AC \u2014 git init + \uBB38\uC11C + MCP + \uCEE8\uD14D\uC2A4\uD2B8 \uD55C \uBC88\uC5D0").option("--from-notion <url>", "Notion PRD \uD398\uC774\uC9C0\uC5D0\uC11C import").option("--name <name>", "\uD504\uB85C\uC81D\uD2B8 \uC774\uB984").option("--description <desc>", "\uD55C \uC904 \uC124\uBA85").option("--type <type>", "\uD504\uB85C\uC81D\uD2B8 \uC720\uD615 (webapp|extension|cli|notion|mobile)").option("-y, --yes", "\uBAA8\uB4E0 \uD655\uC778 \uC2A4\uD0B5 (\uC790\uB3D9 yes)").action(start);
+program.command("init").alias("\uCD08\uAE30\uD654").alias("\uB9CC\uB4E4\uAE30").description("\uD558\uB124\uC2A4 \uD30C\uC77C\uB9CC \uC0DD\uC131 (git/MCP/context\uB294 \uC81C\uC678) \u2014 \uBCF4\uD1B5 vhk start \uAD8C\uC7A5").option("--skip-gate", "gate \uAC80\uC99D \uC2A4\uD0B5").option("--from-notion <url>", "Notion PRD \uD398\uC774\uC9C0\uC5D0\uC11C import").option("--name <name>", "\uD504\uB85C\uC81D\uD2B8 \uC774\uB984").option("--description <desc>", "\uD55C \uC904 \uC124\uBA85").option("--type <type>", "\uD504\uB85C\uC81D\uD2B8 \uC720\uD615 (webapp|extension|cli|notion|mobile)").option("-y, --yes", "\uC2A4\uD0DD \uD655\uC778 \uC2A4\uD0B5").action(init);
 program.command("recap").alias("\uC815\uB9AC").alias("\uC624\uB298").description("\uC624\uB298 \uD55C \uC77C \uC815\uB9AC + ADR/\uD2B8\uB7EC\uBE14\uC288\uD305 \uC790\uB3D9 \uBD84\uB9AC").option("--since <date>", "\uBD84\uC11D \uC2DC\uC791\uC77C (YYYY-MM-DD)").action(recap);
 program.command("sync").alias("\uB9DE\uCD94\uAE30").alias("\uADDC\uCE59").description("RULES.md \u2192 .cursorrules + CLAUDE.md \uB3D9\uAE30\uD654").action(sync);
-program.command("check").alias("\uC810\uAC80").alias("\uB9B0\uD2B8").description("RULES.md \uADDC\uCE59 \uC810\uAC80 \u2014 \uCF54\uB4DC \uC704\uBC18 \uAC80\uC0AC").action(check);
+program.command("check").alias("\uC810\uAC80").alias("\uB9B0\uD2B8").option("--goal <id>", "goal id \uC9C0\uC815 \uC2DC scripts/check-goal-<id>.sh \uAC8C\uC774\uD2B8 \uC2E4\uD589").description("RULES.md \uADDC\uCE59 \uC810\uAC80 \u2014 \uCF54\uB4DC \uC704\uBC18 \uAC80\uC0AC (\uB610\uB294 --goal <id> \uB85C goal \uAC8C\uC774\uD2B8)").action(async (opts) => {
+  await check(opts);
+});
 var secureCmd = program.command("secure").alias("\uBCF4\uC548").description("\uBCF4\uC548 \uB3C4\uAD6C \uBAA8\uC74C \u2014 scan: \uC2DC\uD06C\uB9BF\xB7\uD0A4 \uC720\uCD9C \uAC80\uC0AC").action(secure);
 secureCmd.command("scan").alias("\uC2A4\uCE94").description("\uC2DC\uD06C\uB9BF/\uD0A4 \uC720\uCD9C \uC2A4\uCE94").action(secure);
 program.command("ship").alias("\uCD9C\uD558").description("\uBC30\uD3EC \uCCB4\uD06C\uB9AC\uC2A4\uD2B8 + \uD68C\uACE0 + \uBE4C\uB4DC \uB85C\uADF8 \uC0DD\uC131").action(ship);
@@ -4935,10 +4624,10 @@ program.command("status").alias("\uC0C1\uD0DC").description("\uD504\uB85C\uC81D\
   await status();
 });
 program.command("diff").alias("\uBCC0\uACBD").alias("\uCC28\uC774").description("Git \uBCC0\uACBD\uC0AC\uD56D \uD55C\uAD6D\uC5B4 \uC694\uC57D (staged / unstaged / \uC0C8 \uD30C\uC77C)").action(diff);
-program.command("mcp").description("MCP \uC11C\uBC84 \uC2DC\uC791 (Cursor \uB4F1 MCP \uD074\uB77C\uC774\uC5B8\uD2B8\uC6A9)").action(async () => {
+program.command("mcp").description("MCP \uC11C\uBC84 \uC2DC\uC791 (24 tool stdio \u2014 Cursor\xB7Claude Desktop \uB4F1)").action(async () => {
   await startMcpServer();
 });
-program.command("mcp-init").alias("mcp\uC124\uC815").description("Cursor MCP \uC5F0\uB3D9 \uC124\uC815 \uC790\uB3D9 \uC0DD\uC131 (.cursor/mcp.json)").action(async () => {
+program.command("mcp-init").alias("mcp\uC124\uC815").description("Cursor\xB7Claude Desktop MCP \uC5F0\uB3D9 \uC124\uC815 \uC790\uB3D9 \uC0DD\uC131 (.cursor/mcp.json)").action(async () => {
   await mcpInit();
 });
 program.command("deploy").alias("\uBC30\uD3EC").description("\uD504\uB85C\uB355\uC158 \uBC30\uD3EC (Vercel/Netlify/Cloudflare \uC790\uB3D9 \uAC10\uC9C0)").action(async () => {
@@ -5008,6 +4697,33 @@ memoryCmd.command("remove <index>").alias("\uC0AD\uC81C").description("\uAE30\uC
 program.command("brief").alias("\uBE0C\uB9AC\uD551").description("\uD504\uB85C\uC81D\uD2B8 \uC0C1\uD0DC \uC694\uC57D \uBCF4\uACE0\uC11C \uC0DD\uC131 (.vhk/brief.md)").action(async () => {
   await brief();
 });
+var goalCmd = program.command("goal").alias("\uBAA9\uD45C").description("Goal \uB2E8\uACC4\uBCC4 \uBBF8\uC158 \uAD00\uB9AC (init / list / next / check / done)").action(async () => {
+  await goalList();
+});
+goalCmd.command("list").alias("\uBAA9\uB85D").description("goals/*.md \uBAA9\uB85D (id, status, priority, title)").action(async () => {
+  await goalList();
+});
+goalCmd.command("next").alias("\uB2E4\uC74C").description("active goal \uC790\uB3D9 \uC120\uD0DD \u2192 docs/state/next-task.md \uAC31\uC2E0").action(async () => {
+  await goalNext();
+});
+goalCmd.command("init").alias("\uCD08\uAE30\uD654").description("\uD604\uC7AC \uD504\uB85C\uC81D\uD2B8\uC5D0 goals/ + docs/state/ \uC2A4\uCE90\uD3F4\uB529 (\uAE30\uC874 \uD30C\uC77C \uBCF4\uC874)").action(async () => {
+  await goalInit();
+});
+goalCmd.command("check").alias("\uAC80\uC99D").option("--id <id>", "goal id \uC9C0\uC815 (\uC0DD\uB7B5 \uC2DC active goal)").description("scripts/check-goal-<id>.sh \uC2E4\uD589 + exit code \uC804\uB2EC").action(async (opts) => {
+  await goalCheck(opts);
+});
+goalCmd.command("done").alias("\uC644\uB8CC").option("--id <id>", "goal id \uC9C0\uC815 (\uC0DD\uB7B5 \uC2DC active goal)").description("\uAC8C\uC774\uD2B8 \uC7AC\uAC80\uC99D \u2192 \uD1B5\uACFC \uC2DC frontmatter status=DONE \uC73C\uB85C \uC804\uC774").action(async (opts) => {
+  await goalDone(opts);
+});
+program.command("blocker <description>").alias("\uBE14\uB85C\uCEE4").description("\uBE14\uB85C\uCEE4 \uAE30\uB85D \u2192 docs/state/blockers.md append (3\uAC74 \uB204\uC801 \uC2DC HARD_STOP \uC790\uB3D9 \uC0DD\uC131)").action(async (description) => {
+  await blocker(description);
+});
+program.command("learn <lesson>").alias("\uAD50\uD6C8").description("\uAD50\uD6C8 \uAE30\uB85D \u2192 docs/state/learnings.md append (memory.json \uACFC \uBCC4\uB3C4 SoT)").action(async (lesson) => {
+  await learn(lesson);
+});
+program.command("resume").alias("\uC7AC\uAC1C").option("--confirm", "\uC0AC\uB78C \uD655\uC778 \u2014 \uC790\uB3D9 \uD638\uCD9C \uAE08\uC9C0 (Forbidden \uC704\uBC18)").description(".vhk/HARD_STOP \uD574\uC81C (\uC0AC\uC6A9\uC790\uAC00 \uC0AC\uC720 \uD655\uC778 \uD6C4 --confirm \uD544\uC694)").action(async (opts) => {
+  await resume(opts);
+});
 program.on("command:*", async (operands) => {
   const unknown = operands[0] ?? "";
   const rest = operands.slice(1);
@@ -5016,13 +4732,13 @@ program.on("command:*", async (operands) => {
 });
 program.action(async () => {
   console.log("\n\u{1F3AF} VHK \u2014 \uBC14\uC774\uBE0C\uCF54\uB529 \uD504\uB85C\uC81D\uD2B8 \uCF54\uCE58\n");
-  const { choice } = await inquirer14.prompt([{
+  const { choice } = await inquirer12.prompt([{
     type: "list",
     name: "choice",
     message: "\uBB58 \uB3C4\uC640\uB4DC\uB9B4\uAE4C\uC694?",
     choices: [
       { name: "\u{1F4A1} \uC0C8 \uC544\uC774\uB514\uC5B4 \uAC80\uC99D\uD558\uAE30", value: "gate" },
-      { name: "\u{1F4E6} \uD504\uB85C\uC81D\uD2B8 \uC2DC\uC791\uD558\uAE30", value: "init" },
+      { name: "\u{1F680} \uC0C8 \uD504\uB85C\uC81D\uD2B8 \uC2DC\uC791 \uB9C8\uBC95\uC0AC (start)", value: "start" },
       { name: "\u{1F4DD} \uC624\uB298 \uD55C \uC77C \uC815\uB9AC\uD558\uAE30", value: "recap" },
       { name: "\u{1F50D} \uADDC\uCE59 \uD30C\uC77C \uC810\uAC80\uD558\uAE30", value: "check" },
       { name: "\u{1F512} \uBCF4\uC548 \uC2A4\uCE94 \uB3CC\uB9AC\uAE30", value: "secure" },
@@ -5038,8 +4754,8 @@ program.action(async () => {
   switch (choice) {
     case "gate":
       return gate();
-    case "init":
-      return init({ skipGate: false });
+    case "start":
+      return start();
     case "recap":
       return recap({});
     case "check":