@kaydash9999/banker-plugins 0.18.0 → 0.19.1

package/skills/anti-drm/scripts/instruction-toggle.mjs

@@ -33,17 +33,30 @@
  * open and close in turn; a marker quoted inside a sentence, or an end before a
  * start, makes turnOn and turnOff refuse rather than guess where the block ends.
  * So does a file that is not UTF-8 (CP949, UTF-16): written back as text it
- * would lose its bytes.
+ * would lose its bytes. A folder or FIFO at a file's name is never read: a
+ * FIFO would make the read wait forever. Nor is a socket or a link loop; and an
+ * AGENTS.md that is a link to nothing is refused by turnOn, which would
+ * otherwise create the file the link points at.
  *
- * Results are { ok, message }; ok false means refused with nothing changed.
+ * Codex's files are read and written under a lock file (.banker-agents.lock in
+ * the Codex folder), so both skills turned on at once keep both blocks; a lock
+ * older than a minute is taken over.
+ *
+ * Results are { ok, message }; ok false means refused with nothing changed, or,
+ * when a change of two files was refused at the second, with the first changed
+ * and named in the message ("앞서 바꾼 파일").
  * Anything else that goes wrong throws.
  */
 import {
   accessSync,
+  closeSync,
   constants,
+  fstatSync,
   lstatSync,
+  openSync,
   mkdirSync,
   readFileSync,
+  realpathSync,
   renameSync,
   rmSync,
   statSync,
@@ -60,8 +73,12 @@ export const KEEP_CLOSE = "<!-- USER:OMX:POLICY:END -->";
 
 // The byte order mark an editor may put in front of a file.
 const BOM = String.fromCharCode(0xfeff);
-const noBom = (text) => (text.startsWith(BOM) ? text.slice(BOM.length) : text);
-const lf = (text) => text.replace(/\r\n/g, "\n");
+/** The text without the byte order mark an editor may put in front of it. */
+export const noBom = (text) => (text.startsWith(BOM) ? text.slice(BOM.length) : text);
+/** The text with CRLF line ends turned into LF. */
+export const lf = (text) => text.replace(/\r\n/g, "\n");
+/** How many times needle occurs in text. */
+export const count = (text, needle) => text.split(needle).length - 1;
 const eolOf = (text) => (text.includes("\r\n") ? "\r\n" : "\n");
 const isDir = (path) => {
   try {
@@ -80,27 +97,61 @@ const isLink = (path) => {
 
 const UTF8 = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true });
 
+// What sits at a name that is not a regular file: a folder, a FIFO, a socket, a device or a link loop.
+// It is never read; reading a FIFO waits for a writer.
+const SPECIAL = Object.freeze({ bytes: null, text: null, special: true });
+// What sits at a name that is a link to nothing: Codex finds no file there, and writing would follow the link.
+const DANGLING = Object.freeze({ bytes: null, text: null, dangling: true });
+// What opening a name fails with when no regular file can be there: links that loop (ELOOP) or a socket (ENXIO,
+// EOPNOTSUPP). macOS answers a socket with errno 102, which Node 22 does not name ("Unknown system error -102"), so
+// the kind of what is there decides too.
+const NOT_A_FILE = new Set(["ELOOP", "ENXIO", "EOPNOTSUPP"]);
+// Whether path leads to something that is there and is no regular file: a folder, a socket, a FIFO or a device.
+const notAFile = (path) => {
+  try {
+    return !statSync(path).isFile();
+  } catch {
+    return false;
+  }
+};
+
+// What a failed open of path means: null for nothing there, DANGLING for a link to nothing, SPECIAL for a folder,
+// a socket or a link loop. Any other failure (permissions) is not "missing" and propagates.
+function openFailure(path, e) {
+  if (e.code === "ENOENT" || e.code === "ENOTDIR") return isLink(path) ? DANGLING : null;
+  if (e.code === "EISDIR" || NOT_A_FILE.has(e.code) || notAFile(path)) return SPECIAL;
+  throw e;
+}
+
 // A file's bytes and text, null when there is no such file. text is null when
 // the bytes are not UTF-8, which callers refuse: decoding them would replace
-// them with U+FFFD for good. Any other read failure (permissions, a folder at
-// that name) is not "missing" and propagates.
+// them with U+FFFD for good. A folder, a socket, a link loop or anything but a
+// regular file is SPECIAL, and a link to nothing is DANGLING: the name is
+// opened without blocking and not read.
 function readFile(path) {
-  let bytes;
+  let fd;
   try {
-    bytes = readFileSync(path);
+    fd = openSync(path, constants.O_RDONLY | (constants.O_NONBLOCK ?? 0));
   } catch (e) {
-    if (e.code === "ENOENT" || e.code === "ENOTDIR") return null;
-    throw e;
+    return openFailure(path, e);
   }
   try {
-    return { bytes, text: UTF8.decode(bytes) };
-  } catch {
-    return { bytes, text: null };
+    if (!fstatSync(fd).isFile()) return SPECIAL;
+    const bytes = readFileSync(fd);
+    try {
+      return { bytes, text: UTF8.decode(bytes) };
+    } catch {
+      return { bytes, text: null };
+    }
+  } finally {
+    closeSync(fd);
   }
 }
 
-const done = (message) => ({ ok: true, message });
-const refuse = (message) => ({ ok: false, message });
+/** A result that did, or found already done, what was asked. */
+export const done = (message) => ({ ok: true, message });
+/** A result that refused and changed nothing, unless its message names a file changed before (applied). */
+export const refuse = (message) => ({ ok: false, message });
 
 /** A skill's marks: the first line of its rules file, and the lines around its Codex block. */
 export function markersOf(slug) {
@@ -144,9 +195,14 @@ export const denied = (e) => e.code === "EACCES" || e.code === "EPERM" || e.code
  * paragraph separator, private-use, unassigned and variation selector
  * characters become "?": a path from the environment cannot start a line of
  * its own, reorder the text around it, or hide text after a visible letter.
+ * So do letters that print as nothing (default-ignorable ones such as U+3164),
+ * the braille blank and spaces other than the ASCII one, which hide text as blanks.
  */
 export const where = (value) =>
-  String(value).replace(/[\p{Cc}\p{Cf}\p{Zl}\p{Zp}\p{Co}\p{Cn}\p{Variation_Selector}]/gu, "?");
+  String(value).replace(
+    /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}\p{Co}\p{Cn}\p{Variation_Selector}\p{Default_Ignorable_Code_Point}\u{2800}\u{a0}\u{1680}\u{2000}-\u{200a}\u{202f}\u{205f}\u{3000}]/gu,
+    "?",
+  );
 
 // ---- Claude Code: one rules file that is banker's alone ----
 
@@ -156,7 +212,7 @@ const claudeText = (t, rules) => `${t.header}\n${rules}\n`;
 // "off", "foreign" (not banker's file), or, when rules are given, "on" or
 // "stale" (other rules); without rules a banker file is "ours".
 function claudeState(t, file, rules) {
-  if (file === null) return "off";
+  if (file === null || file.dangling) return "off";
   if (file.text === null) return "foreign";
   const body = lf(noBom(file.text));
   if (!body.startsWith(t.ownerMark)) return "foreign";
@@ -172,6 +228,7 @@ function claudeOn(t, o, getRules) {
   const state = claudeState(t, readFile(file), rules);
   if (state === "foreign") return refuse(`같은 이름의 다른 파일이 있어 그대로 두었습니다: ${shown}`);
   if (state === "on") return done(`Claude Code: 이미 켜져 있습니다 (변경 없음). ${shown}`);
+  const wasLink = isLink(file);
   try {
     mkdirSync(dirname(file), { recursive: true, mode: 0o755 });
     writeFresh(file, claudeText(t, rules));
@@ -179,13 +236,13 @@ function claudeOn(t, o, getRules) {
     if (denied(e)) return refuse(`쓸 권한이 없어 켜지 못했습니다 (${e.code}): ${shown}`);
     throw e;
   }
-  return done(
-    state === "stale"
-      ? `Claude Code: ${t.updatedText}. ${shown}`
-      : `Claude Code: 켰습니다. 다음 세션부터 자동 적용됩니다. ${shown}`,
-  );
+  const words = state === "stale" ? `Claude Code: ${t.updatedText}. ${shown}` : `Claude Code: 켰습니다. 다음 세션부터 자동 적용됩니다. ${shown}`;
+  return done(wasLink ? `${words}\n${LINK_REPLACED}` : words);
 }
 
+/** The note for a name that was a link (to nothing, or to an older copy) and is now a regular file. */
+export const LINK_REPLACED = "참고: 링크였던 자리를 일반 파일로 바꿨습니다. 링크가 가리키던 곳은 건드리지 않았습니다.";
+
 function claudeOff(t, o) {
   const file = claudeFile(t, o);
   const state = claudeState(t, readFile(file));
@@ -317,25 +374,48 @@ const otherBlocks = (t, text) =>
     return spans !== null && spans.length > 0;
   });
 
+const special = (f) => f.special === true;
 const binary = (f) => f.bytes !== null && f.text === null;
 const unpaired = (f) => f.spans === null;
 const hasBlock = (f) => f.spans !== null && f.spans.length > 0;
 const stripped = (f) => (f.text === null ? "" : strip(f.text, f.spans));
 
+/** Whether two bigint stats name one file: one device and one inode, where the file system gives inodes at all. */
+export const sameInode = (x, y) => x.ino !== 0n && x.dev === y.dev && x.ino === y.ino;
+
+// Whether two paths name one file: a link (both resolve to one real path) or a hard link (one inode). A file system
+// that gives no inode numbers (0) cannot say so for hard links, so those count as two files.
+function sameFile(a, b) {
+  try {
+    if (realpathSync(a) === realpathSync(b)) return true;
+    return sameInode(statSync(a, { bigint: true }), statSync(b, { bigint: true }));
+  } catch {
+    return false;
+  }
+}
+
 // Both global instruction files with their bytes and text (null when absent;
 // text null when not UTF-8) and blocks (null when the markers do not pair up).
 // The block's place (target) is the override when the override has text of its
 // own, AGENTS.md otherwise. shadowers names the other banker skills whose
 // blocks alone fill the override: Codex then reads the override, not AGENTS.md.
+// An override that is a link or a hard link to AGENTS.md is one file with it.
 function codexFiles(t, o) {
   const read = (name) => {
     const path = join(o.codexDir, name);
     const file = readFile(path);
-    if (file === null) return { path, bytes: null, text: null, spans: [] };
+    if (file === null || file.special || file.dangling) {
+      return { path, bytes: null, text: null, spans: [], special: file?.special === true, dangling: file?.dangling === true };
+    }
     return { path, ...file, spans: file.text === null ? null : blockSpansOf(file.text, t.open, t.close) };
   };
   const override = read("AGENTS.override.md");
   const main = read("AGENTS.md");
+  if (override.bytes !== null && main.bytes !== null && sameFile(override.path, main.path)) {
+    // One file under both names: Codex reads it either way, so it is AGENTS.md alone.
+    const none = { path: override.path, bytes: null, text: null, spans: [] };
+    return { target: main, other: none, all: [none, main], shadowers: [] };
+  }
   const ownContent = binary(override) || (override.text !== null && hasContent(withoutBankerBlocks(override.text)));
   const target = ownContent ? override : main;
   const shadowers = ownContent || override.text === null ? [] : otherBlocks(t, override.text);
@@ -357,18 +437,30 @@ function withBlock(t, text, rules) {
   return text === "" ? blockFor(t, rules, eol) : text + eol + blockFor(t, rules, eol);
 }
 
+// The state when the block is not in its place: "hidden" (only in an override with no text of its own),
+// "hiddenbroken" (the same, with AGENTS.md a link to nothing, so on cannot move it), "misplaced" (only in AGENTS.md
+// while Codex reads the override), "dangling" (nowhere, and AGENTS.md is a link to nothing that on must not write
+// through) or "off".
+function placeState(files) {
+  if (hasBlock(files.other)) {
+    if (files.other !== files.all[0]) return "misplaced";
+    return files.target.dangling ? "hiddenbroken" : "hidden";
+  }
+  return files.target.dangling ? "dangling" : "off";
+}
+
 // "off", "on", "stale", "misplaced" (only in AGENTS.md while Codex reads the
 // override, so not applied), "hidden" (in the override with no text of its own,
-// applied but hiding AGENTS.md), "unpaired" or "notutf8". Without rules any
-// block in its place counts as "on".
+// applied but hiding AGENTS.md), "dangling" (nowhere, and AGENTS.md is a link to
+// nothing), "unpaired", "notutf8" or "notregular" (a folder, FIFO, socket or
+// link loop at a file's name). Without rules any block in its place counts as "on".
 function codexState(t, files, rules) {
+  if (files.all.some(special)) return "notregular";
   if (files.all.some(binary)) return "notutf8";
   if (files.all.some(unpaired)) return "unpaired";
-  const inTarget = hasBlock(files.target);
-  const inOther = hasBlock(files.other);
-  if (!inTarget) return inOther ? (files.other === files.all[0] ? "hidden" : "misplaced") : "off";
+  if (!hasBlock(files.target)) return placeState(files);
   if (rules === undefined) return "on";
-  return blockCurrent(t, files.target, rules) && !inOther ? "on" : "stale";
+  return blockCurrent(t, files.target, rules) && !hasBlock(files.other) ? "on" : "stale";
 }
 
 // Why these files cannot be written, or "" when they can. The folder counts
@@ -390,12 +482,120 @@ function writeBlocked(changes) {
 // target changes, after keeping the old bytes in a .bak only this account can
 // read (the file may be a link into a private folder). A new file gets 0644
 // whatever the umask allows more. A file left empty is removed, unless it is a
-// link: Codex skips an empty file anyway.
+// link or has other names (a hard link), whose other names would keep the old
+// text: it is emptied instead. Codex skips an empty file anyway.
+// A file that was not there when it was read is created only if it still is not ("wx"): a name that appeared in
+// between, a link planted there among them, is not written through.
 function apply(t, changes) {
   for (const { file, after } of changes) {
     if (file.bytes !== null) writeFresh(`${file.path}.${t.slug}.bak`, file.bytes, 0o600);
-    if (after === "" && !isLink(file.path)) rmSync(file.path, { force: true });
-    else writeFileSync(file.path, after, { mode: 0o644 });
+    if (after === "" && !isLink(file.path) && !hasOtherNames(file.path)) rmSync(file.path, { force: true });
+    else writeFileSync(file.path, after, { mode: 0o644, flag: file.bytes === null ? "wx" : "w" });
+  }
+}
+
+// Applies the changes, or the refusal for a write that failed with nothing of the file changed: a name that
+// appeared in between (EEXIST), or a write a sandbox refused after access() allowed it. The refusal names the place
+// the system refused (a rename's target, as the backup, or the file it was about), and a file changed before the
+// failing one. Other errors propagate.
+function applied(t, changes) {
+  let i = 0;
+  try {
+    for (; i < changes.length; i++) apply(t, [changes[i]]);
+  } catch (e) {
+    if (e.code !== "EEXIST" && !denied(e)) throw e;
+    const why = e.code === "EEXIST" ? "쓰는 사이에 같은 이름이 생겨 그대로 두었습니다" : `쓸 권한이 없어 그대로 두었습니다 (${where(e.code)})`;
+    const at = [e.dest, e.path].find((p) => typeof p === "string") ?? changes[i].file.path;
+    const before = i === 0 ? "" : `\n앞서 바꾼 파일: ${changes.slice(0, i).map((c) => where(c.file.path)).join(", ")}`;
+    return refuse(`${why}: ${where(at)}${before}`);
+  }
+  return null;
+}
+
+// Whether the file at path is also reachable under another name: a hard link.
+function hasOtherNames(path) {
+  try {
+    return lstatSync(path).nlink > 1;
+  } catch {
+    return false;
+  }
+}
+
+// The lock both banker skills take while they read and write Codex's instructions files: two on's at once would
+// each write the file back with only their own block. A lock is held for milliseconds; one older than a minute was
+// left by a run that died.
+const LOCK = ".banker-agents.lock";
+const LOCK_STALE_MS = 60_000;
+const LOCK_STEP_MS = 50;
+const SLEEP = new Int32Array(new SharedArrayBuffer(4));
+
+// Makes the lock file; false when one is there already. Anything else (permissions) throws.
+function tryLock(path, token) {
+  try {
+    writeFileSync(path, token, { flag: "wx", mode: 0o600 });
+    return true;
+  } catch (e) {
+    if (e.code === "EEXIST") return false;
+    throw e;
+  }
+}
+
+// Removes a lock a dead run left; true when there is none now, so the next try may take it. The name itself is
+// looked at, not where it leads: a link to nothing or a link loop there is a lock like any other. A lock dated more
+// than a minute away either way (a clock set back) is stale too. A folder there is none of this module's: it stays,
+// and the wait ends in a refusal.
+function dropStale(path) {
+  let st;
+  try {
+    st = lstatSync(path);
+  } catch (e) {
+    if (e.code === "ENOENT" || e.code === "ESTALE") return true; /* gone in between (ESTALE: a network share's word for it) */
+    throw e;
+  }
+  if (st.isDirectory() || Math.abs(Date.now() - st.mtimeMs) <= LOCK_STALE_MS) return false;
+  rmSync(path, { force: true });
+  return true;
+}
+
+// Takes the lock: { path, token }, or null when another run held it for waitMs. The deadline is looked at every
+// round, so no lock spot, whatever is there, keeps the wait going past it.
+function takeLock(dir, waitMs) {
+  const path = join(dir, LOCK);
+  const token = `${process.pid} ${Date.now()} ${Math.random()}`;
+  const until = Date.now() + waitMs;
+  for (;;) {
+    if (tryLock(path, token)) return { path, token };
+    if (Date.now() >= until) return null;
+    if (!dropStale(path)) Atomics.wait(SLEEP, 0, 0, LOCK_STEP_MS);
+  }
+}
+
+// Gives the lock back while it is still this run's. The name is opened without blocking: a pipe put there is not
+// this run's lock and stays.
+function dropLock(lock) {
+  try {
+    if (readFile(lock.path)?.text === lock.token) rmSync(lock.path, { force: true });
+  } catch {
+    /* already gone */
+  }
+}
+
+// Runs fn holding the lock; a lock another run keeps past the wait is a refusal. A folder this account cannot write
+// takes no lock, and nothing in it can be written either: fn then only reads, and writeBlocked refuses any change,
+// so "already on" and "already off" answer as before.
+function locked(o, fn) {
+  let lock;
+  try {
+    lock = takeLock(o.codexDir, o.lockWaitMs ?? 5000);
+  } catch (e) {
+    if (denied(e)) return fn();
+    throw e;
+  }
+  if (!lock) return refuse(`다른 banker 지침 작업이 끝나지 않아 그대로 두었습니다: ${where(join(o.codexDir, LOCK))}`);
+  try {
+    return fn();
+  } finally {
+    dropLock(lock);
   }
 }
 
@@ -408,35 +608,65 @@ const shadowNote = (files) =>
     ? ""
     : `\n주의: AGENTS.override.md 에 다른 banker 블록(${files.shadowers.join(", ")})만 있어 Codex 가 AGENTS.md 를 읽지 않습니다. 그 스킬에서 on 을 실행해 블록을 옮기세요.`;
 
+// The file a refused state is about: the folder or FIFO, the file that is not UTF-8, or the one whose markers do
+// not pair up; null in any other state.
+function problemFile(files, state) {
+  const which = { notregular: special, notutf8: binary, unpaired }[state];
+  return which ? files.all.find(which) : null;
+}
+
 // The refusal for files on and off must not touch, or null.
 function codexRefusal(t, files, state) {
-  if (state === "notutf8") return refuse(`UTF-8 이 아닌 파일이라 그대로 두었습니다: ${where(files.all.find(binary).path)}`);
-  if (state === "unpaired") return refuse(`${t.slug} 표시의 짝이 맞지 않아 그대로 두었습니다: ${where(files.all.find(unpaired).path)}`);
-  return null;
+  const file = problemFile(files, state);
+  if (!file) return null;
+  const why = {
+    notregular: "일반 파일이 아니라 그대로 두었습니다",
+    notutf8: "UTF-8 이 아닌 파일이라 그대로 두었습니다",
+    unpaired: `${t.slug} 표시의 짝이 맞지 않아 그대로 두었습니다`,
+  }[state];
+  return refuse(`${why}: ${where(file.path)}`);
+}
+
+// What codexOn says it did. A block Codex does not read, because other banker
+// blocks alone fill the override, says so in its first words.
+function onWords(t, state, unread) {
+  if (state === "on") return unread ? "이미 AGENTS.md 에 있지만 지금은 적용되지 않습니다 (변경 없음)" : "이미 켜져 있습니다 (변경 없음)";
+  if (unread) return "AGENTS.md 에 넣었지만 지금은 적용되지 않습니다";
+  const moved = "블록을 맞는 파일로 옮겼습니다";
+  return { stale: t.updatedText, misplaced: moved, hidden: moved }[state] ?? "켰습니다. 다음 세션부터 자동 적용됩니다";
 }
 
 function codexOn(t, o, getRules) {
   if (!isDir(o.codexDir)) return refuse(`Codex 설정 폴더가 없습니다: ${where(o.codexDir)}`);
+  return locked(o, () => codexOnHeld(t, o, getRules));
+}
+
+function codexOnHeld(t, o, getRules) {
   const rules = getRules();
   const files = codexFiles(t, o);
   const state = codexState(t, files, rules);
   const refusal = codexRefusal(t, files, state);
   if (refusal) return refusal;
+  if (files.target.dangling) return refuse(`끊어진 링크라 그대로 두었습니다: ${where(files.target.path)}`);
+  const words = onWords(t, state, files.shadowers.length > 0);
   const tail = `${where(files.target.path)}${shadowNote(files)}`;
-  if (state === "on") return done(`Codex: 이미 켜져 있습니다 (변경 없음). ${tail}`);
+  if (state === "on") return done(`Codex: ${words}. ${tail}`);
   const changes = [{ file: files.target, after: withBlock(t, stripped(files.target), rules) }];
   if (hasBlock(files.other)) changes.push({ file: files.other, after: stripped(files.other) });
   const why = writeBlocked(changes);
   if (why) return refuse(why);
-  apply(t, changes);
-  const moved = "블록을 맞는 파일로 옮겼습니다";
-  const what = { stale: t.updatedText, misplaced: moved, hidden: moved }[state];
+  const failed = applied(t, changes);
+  if (failed) return failed;
   const note = files.target === files.all[1] ? `\n${OMX_NOTE}` : "";
-  return done(`Codex: ${what ?? "켰습니다. 다음 세션부터 자동 적용됩니다"}. ${tail}${note}`);
+  return done(`Codex: ${words}. ${tail}${note}`);
 }
 
 function codexOff(t, o) {
   if (!isDir(o.codexDir)) return done(`Codex: 설정 폴더가 없어 끌 것이 없습니다 (변경 없음). ${where(o.codexDir)}`);
+  return locked(o, () => codexOffHeld(t, o));
+}
+
+function codexOffHeld(t, o) {
   const files = codexFiles(t, o);
   const refusal = codexRefusal(t, files, codexState(t, files));
   if (refusal) return refusal;
@@ -444,8 +674,11 @@ function codexOff(t, o) {
   if (changes.length === 0) return done("Codex: 이미 꺼져 있습니다 (변경 없음).");
   const why = writeBlocked(changes);
   if (why) return refuse(why);
-  apply(t, changes);
-  return done(`Codex: 껐습니다. 다음 세션부터 적용되지 않습니다. ${changes.map((c) => where(c.file.path)).join(", ")}`);
+  const failed = applied(t, changes);
+  if (failed) return failed;
+  const paths = changes.map((c) => where(c.file.path)).join(", ");
+  const baks = changes.map((c) => where(`${c.file.path}.${t.slug}.bak`)).join(", ");
+  return done(`Codex: 껐습니다. 다음 세션부터 적용되지 않습니다. ${paths}\n지우기 전 파일: ${baks}`);
 }
 
 // ---- status ----
@@ -457,8 +690,11 @@ const STATE_TEXT = {
   foreign: "꺼짐, 같은 이름의 다른 파일이 있음 (손대지 않음)",
   misplaced: "꺼짐, 단 블록이 Codex 가 읽지 않는 AGENTS.md 에 있음 (on 으로 옮김)",
   hidden: "켜짐, 단 AGENTS.override.md 에 블록만 있어 AGENTS.md 가 가려짐 (on 으로 옮김)",
+  hiddenbroken: "켜짐, 단 AGENTS.override.md 에 블록만 있고 AGENTS.md 가 끊어진 링크라 on 이 블록을 옮기지 못함 (링크 확인 필요)",
   notutf8: "UTF-8 이 아닌 지침 파일이 있어 손대지 않음 (on, off 모두 거부)",
+  notregular: "일반 파일이 아닌 지침 파일이 있어 손대지 않음 (on, off 모두 거부)",
   unpaired: "표시의 짝이 맞지 않음 (on, off 모두 거부. 남은 표시 줄 정리 필요)",
+  dangling: "꺼짐, 단 AGENTS.md 가 끊어진 링크라 on 이 거부함 (링크 확인 필요)",
 };
 
 // A state as the status line says it.
@@ -486,7 +722,7 @@ function codexLook(t, o, rules) {
   const files = codexFiles(t, o);
   const state = codexState(t, files, rules);
   const shadowed = files.shadowers.length > 0 && (state === "on" || state === "stale");
-  return { state: shadowed ? "shadowed" : state, path: files.target.path, who: files.shadowers };
+  return { state: shadowed ? "shadowed" : state, path: (problemFile(files, state) ?? files.target).path, who: files.shadowers };
 }
 
 /** One status line per runtime: "- Claude Code: ..." and "- Codex: ...". rules may be undefined. */
@@ -507,7 +743,7 @@ export function stateLines(t, o, rules) {
  */
 export function present(t, runtime, o) {
   if (runtime === "claude") return isDir(o.claudeDir) && claudeState(t, readFile(claudeFile(t, o))) === "ours";
-  return isDir(o.codexDir) && !["off", "notutf8"].includes(codexState(t, codexFiles(t, o)));
+  return isDir(o.codexDir) && !["off", "notutf8", "notregular", "dangling"].includes(codexState(t, codexFiles(t, o)));
 }
 
 const knownRuntime = (runtime) => {

package/skills/lineage/SKILL.md

@@ -2,7 +2,7 @@
 name: lineage
 description: "현재 세션 대화를 카카오톡 스타일의 단일 HTML 로 내보냄. Claude 답변은 한 줄 요약 아래에 원문을 접어 두고, 펼치면 마크다운으로 렌더해 보여 줌. 기본은 세션 모델이 요약을 쓰고 노이즈 턴을 걸러 내며, `--rulebase` 는 모델 없이 규칙만 씀. 여러 세션을 합칠 수 있음. 'lineage'/'대화 export'/'카톡 스타일 html' 시 사용."
 invocation: /lineage
-version: 3.0.3
+version: 3.0.6
 schema_version: 1
 ---
 
@@ -17,6 +17,8 @@ Claude 본문은 **마크다운으로 렌더**(헤딩·리스트·표·코드·
 노이즈(스킬 본문·compaction 요약·조작 명령·에코 교환)는 **기본으로 걸러진다**.
 Secret 자동 redaction. 규칙 단계는 결정론(turn uuid·요약기버전 캐시)이고, 세션 모델의 검토 결정은 캐시해 다음 실행에 다시 쓴다.
 
+> **3.0.6** — 글자 방향을 바꾸는 제어 문자 9자(U+202A~202E, U+2066~2069)는 `--no-markdown` 이어도 `[U+202E]` 처럼 보이는 표지로 넣는다. 화면의 글자 순서가 실제와 달라 보이는 속임수를 막기 위해서다. 방향 표시(LRM, RLM, ALM)는 그대로 둔다.
+
 > **3.0.0 — 기본 흐름이 세션 모델 검토로 바뀌었습니다.**
 > - 규칙이 1차로 정리한 턴을 세션 모델이 다시 검토한다. 요약 줄을 직접 쓰고, 남길 턴과 뺄 턴을 고른다.
 > - 2.x 의 한 번 실행(규칙만, 모델 호출 없음)은 `--rulebase` 다.
@@ -214,6 +216,7 @@ Schema-tolerant 파서: 미지 record type → stderr WARN + 다음 line. `v1`/`
 
 - 캐시 hit(`~/.cache/lineage/<schema>/<sid>/<uuid>-<digest>.md`, 3.0.2 까지 쓴 `.txt` 도 읽음) → 그대로. digest 는 본문+요약기버전
   해시라 **요약기를 고치면 자동 무효화**된다.
+- 캐시는 64KiB 이하의 일반 파일만 읽고 링크는 따르지 않는다. 그 자리의 FIFO, 링크, 큰 파일, 깊게 중첩된 결정 캐시는 읽지 못한 것으로 보고 다시 요약한다(3.0.6).
 - miss → head+tail 추출(도입이 순수 의도문이면 결론절을 끝에서 읽어 승격) + 0600 캐시 쓰기.
 - 요약 저장은 항상 **redact 적용 후**(평문 secret 이 디스크에 남지 않음).