@triflux/core 10.0.0-alpha.1 → 10.0.0

package/hub/adaptive.mjs

@@ -0,0 +1,143 @@
+import { randomUUID } from 'node:crypto';
+import { join } from 'node:path';
+
+import { createAdaptiveMemory } from './adaptive-memory.mjs';
+import { createDiagnosticPipeline } from './adaptive-diagnostic.mjs';
+import { createAdaptiveInjector } from './adaptive-inject.mjs';
+import { createAdaptiveFingerprintService } from './session-fingerprint.mjs';
+
+let singletonEngine = null;
+
+function clone(value) {
+  return value == null ? value : JSON.parse(JSON.stringify(value));
+}
+
+function toRuleList(value) {
+  return Array.isArray(value) ? value : [];
+}
+
+function resolveTierCount(memory, tier) {
+  if (typeof memory.getTier === 'function') {
+    const rules = memory.getTier(tier);
+    return Array.isArray(rules) ? rules.length : 0;
+  }
+  return toRuleList(memory.getAllRules?.()).filter((rule) => Number(rule?.tier) === tier).length;
+}
+
+function resolveActiveRuleIds(memory, decayResult) {
+  if (Array.isArray(decayResult?.activeRuleIds)) return [...decayResult.activeRuleIds];
+  return toRuleList(memory.getAllRules?.()).map((rule) => rule.id).filter(Boolean);
+}
+
+function resolveRecordedRule(recordResult) {
+  if (recordResult?.rule) return { rule: recordResult.rule, promoted: Boolean(recordResult.promoted) };
+  return { rule: recordResult || null, promoted: false };
+}
+
+function createEngineInstance(opts = {}) {
+  const repoRoot = opts.repoRoot || process.cwd();
+  const claudeMdPath = opts.claudeMdPath || join(repoRoot, 'CLAUDE.md');
+  const projectSlug = String(opts.projectSlug || 'default').trim() || 'default';
+  const now = opts.now || (() => Date.now());
+  const sessionIdFactory = opts.sessionIdFactory || (() => randomUUID());
+
+  const memory = opts.memory || opts.memoryFactory?.(opts) || createAdaptiveMemory({ projectSlug, ...opts.memoryOptions });
+  const diagnostic = opts.diagnostic || opts.diagnosticFactory?.(opts) || createDiagnosticPipeline(opts.diagnosticOptions);
+  const injector = opts.injector || opts.injectorFactory?.(opts) || createAdaptiveInjector({ claudeMdPath, ...opts.injectorOptions });
+  const fingerprintService = opts.fingerprintService
+    || opts.fingerprintFactory?.(opts)
+    || createAdaptiveFingerprintService(opts.fingerprintOptions);
+
+  let started = false;
+  let currentSessionId = null;
+  let lastFingerprintId = null;
+  const counters = {
+    totalErrors: 0,
+    diagnosedErrors: 0,
+  };
+
+  function refreshFingerprint() {
+    if (typeof fingerprintService.computeFingerprint !== 'function') return;
+    const fingerprint = fingerprintService.computeFingerprint({
+      scope: projectSlug,
+      cwd: repoRoot,
+      filePath: claudeMdPath,
+      workType: 'adaptive',
+      timestamp: now(),
+    });
+    lastFingerprintId = fingerprint?.fingerprint_id || lastFingerprintId;
+  }
+
+  function startSession() {
+    if (started) return;
+    currentSessionId = sessionIdFactory();
+    const decayResult = typeof memory.decay === 'function' ? memory.decay(currentSessionId) : null;
+    injector.cleanup?.(resolveActiveRuleIds(memory, decayResult));
+    refreshFingerprint();
+    started = true;
+  }
+
+  function handleError(errorContext = {}) {
+    if (!started) startSession();
+    counters.totalErrors += 1;
+
+    const diagnosis = diagnostic.diagnose({
+      ...errorContext,
+      projectSlug,
+      sessionId: currentSessionId,
+    });
+    if (!diagnosis?.matched || !diagnosis.rule) {
+      return Object.freeze({ diagnosed: false, rule: null, promoted: false });
+    }
+
+    counters.diagnosedErrors += 1;
+    const { rule: recordedRule, promoted } = resolveRecordedRule(memory.record({
+      ...diagnosis.rule,
+      confidence: diagnosis.confidence,
+      dnaFactor: diagnosis.dnaFactor,
+      sessionId: currentSessionId,
+      lastSeen: new Date(now()).toISOString().slice(0, 10),
+    }));
+
+    const nextRule = clone(recordedRule || diagnosis.rule);
+    if (nextRule?.tier >= 3 && promoted) {
+      injector.inject?.(nextRule);
+    }
+
+    return Object.freeze({
+      diagnosed: true,
+      rule: nextRule,
+      promoted: Boolean(promoted),
+    });
+  }
+
+  function endSession() {
+    if (!started) return;
+    memory.reset?.({ tier: 1, sessionId: currentSessionId });
+    started = false;
+    currentSessionId = null;
+  }
+
+  function getStats() {
+    return Object.freeze({
+      tier1Count: resolveTierCount(memory, 1),
+      tier2Count: resolveTierCount(memory, 2),
+      tier3Count: resolveTierCount(memory, 3),
+      totalErrors: counters.totalErrors,
+    });
+  }
+
+  return Object.freeze({ handleError, startSession, endSession, getStats, __lastFingerprintId: () => lastFingerprintId });
+}
+
+export function createAdaptiveEngine(opts = {}) {
+  if (singletonEngine) return singletonEngine;
+  singletonEngine = createEngineInstance(opts);
+  return singletonEngine;
+}
+
+export function __resetAdaptiveEngineForTests() {
+  singletonEngine = null;
+}
+
+export default createAdaptiveEngine;

package/hub/cli-adapter-base.mjs

@@ -1,11 +1,56 @@
 // hub/cli-adapter-base.mjs — codex/gemini 공통 CLI adapter 인터페이스
 // Phase 2: codex-adapter.mjs에서 추출한 재사용 가능 유틸리티
 
-import { spawn } from 'node:child_process';
+import { execSync, spawn } from 'node:child_process';
 import { existsSync, readFileSync } from 'node:fs';
 
 import { killProcess, IS_WINDOWS } from './platform.mjs';
 
+// ── Codex CLI compatibility ─────────────────────────────────────
+
+let _cachedVersion = null;
+
+/**
+ * `codex --version` 실행 결과를 파싱하여 마이너 버전 숫자 반환.
+ * 파싱 실패 시 0 반환 (구버전으로 간주).
+ * @returns {number} 마이너 버전 (예: 0.117.0 → 117)
+ */
+export function getCodexVersion() {
+  if (_cachedVersion !== null) return _cachedVersion;
+  try {
+    const out = execSync('codex --version', { encoding: 'utf8', timeout: 5000 }).trim();
+    const match = out.match(/(\d+)\.(\d+)\.(\d+)/);
+    _cachedVersion = match ? Number.parseInt(match[2], 10) : 0;
+  } catch {
+    _cachedVersion = 0;
+  }
+  return _cachedVersion;
+}
+
+/**
+ * 최소 마이너 버전 이상인지 확인.
+ * @param {number} minMinor
+ * @returns {boolean}
+ */
+export function gte(minMinor) {
+  return getCodexVersion() >= minMinor;
+}
+
+/**
+ * Codex CLI 기능별 분기 객체.
+ * 117 = 0.117.0 (Rust 리라이트, exec 서브커맨드 도입)
+ */
+export const FEATURES = {
+  /** exec 서브커맨드 사용 가능 여부 */
+  get execSubcommand() { return gte(117); },
+  /** --output-last-message 플래그 지원 여부 */
+  get outputLastMessage() { return gte(117); },
+  /** --color never 플래그 지원 여부 */
+  get colorNever() { return gte(117); },
+  /** 플러그인 시스템 지원 여부 (향후 확장용) */
+  get pluginSystem() { return gte(120); },
+};
+
 // ── Shell utilities ─────────────────────────────────────────────
 
 export function normalizePathForShell(value) {
@@ -16,6 +61,49 @@ export function shellQuote(value) {
   return JSON.stringify(String(value));
 }
 
+export function escapePwshSingleQuoted(value) {
+  return String(value).replace(/'/g, "''");
+}
+
+export const CODEX_MCP_TRANSPORT_EXIT_CODE = 70;
+export const CODEX_MCP_EXECUTION_EXIT_CODE = 1;
+
+/**
+ * long-form 플래그 기반 명령 빌더.
+ * @param {string} prompt
+ * @param {string|null} resultFile — null이면 --output-last-message 생략
+ * @param {{ profile?: string, skipGitRepoCheck?: boolean, sandboxBypass?: boolean, cwd?: string, mcpServers?: string[] }} [opts]
+ * @returns {string} 실행할 셸 커맨드
+ */
+export function buildExecCommand(prompt, resultFile = null, opts = {}) {
+  const { profile, skipGitRepoCheck = true, sandboxBypass = true, cwd, mcpServers } = opts;
+
+  const parts = ['codex'];
+  if (profile) parts.push('--profile', profile);
+
+  if (FEATURES.execSubcommand) {
+    parts.push('exec');
+    if (sandboxBypass) parts.push('--dangerously-bypass-approvals-and-sandbox');
+    if (skipGitRepoCheck) parts.push('--skip-git-repo-check');
+    if (resultFile && FEATURES.outputLastMessage) {
+      parts.push('--output-last-message', resultFile);
+    }
+    if (FEATURES.colorNever) parts.push('--color', 'never');
+    if (cwd) parts.push('--cwd', `'${escapePwshSingleQuoted(cwd)}'`);
+    if (Array.isArray(mcpServers)) {
+      for (const server of mcpServers) {
+        parts.push('-c', `mcp_servers.${server}.enabled=true`);
+      }
+    }
+  } else {
+    parts.push('--dangerously-bypass-approvals-and-sandbox');
+    if (skipGitRepoCheck) parts.push('--skip-git-repo-check');
+  }
+
+  parts.push(JSON.stringify(prompt));
+  return parts.join(' ');
+}
+
 // ── Sleep ───────────────────────────────────────────────────────
 
 export function sleep(ms) {

package/hub/codex-adapter.mjs

@@ -4,11 +4,11 @@ import { tmpdir } from 'node:os';
 
 import { runPreflight } from './codex-preflight.mjs';
 import { withRetry } from './workers/worker-utils.mjs';
-import { buildExecCommand } from './codex-compat.mjs';
 import {
   createCircuitBreaker,
   createResult,
   appendWarnings,
+  buildExecCommand,
   normalizePathForShell,
   shellQuote,
   runProcess,
@@ -20,6 +20,7 @@ const breaker = createCircuitBreaker();
 
 function inferStallMode(stdout, stderr) {
   const text = `${stdout}\n${stderr}`.toLowerCase();
+  if (/(rate.?limit|quota|throttl|too.many.requests|429|usage.limit)/u.test(text)) return 'rate_limited';
   if (/(approval|approve|permission|sandbox|bypass)/u.test(text)) return 'approval_stall';
   if (/\bmcp\b|context7|playwright|tavily|exa|brave|sequential|server/u.test(text)) return 'mcp_stall';
   return 'timeout';
@@ -97,16 +98,24 @@ export function buildExecArgs(opts = {}) {
     profile: opts.profile,
     skipGitRepoCheck: true,
     sandboxBypass: true,
+    cwd: opts.cwd,
   });
 
   if (!prompt) return command.replace(/\s+""$/u, '');
 
+  let result;
   const quotedPrompt = JSON.stringify(prompt);
   if (/^\(Get-Content\b[\s\S]*\)$/u.test(prompt) && command.endsWith(quotedPrompt)) {
-    return `${command.slice(0, -quotedPrompt.length)}${prompt}`;
+    result = `${command.slice(0, -quotedPrompt.length)}${prompt}`;
+  } else {
+    result = command;
   }
 
-  return command;
+  // stderr 캡처: codex 실패 시에도 원인 추적 가능 (resultFile.err)
+  if (opts.resultFile) {
+    result += ` 2>'${opts.resultFile}.err'`;
+  }
+  return result;
 }
 
 // ── Codex execution ─────────────────────────────────────────────

package/hub/codex-compat.mjs

@@ -1,78 +1,11 @@
-// hub/team/codex-compat.mjs — Codex CLI 버전 어댑터
-// Codex 0.117.0+ (Rust 리라이트): exec 서브커맨드 기반
-import { execSync } from "node:child_process";
-
-let _cachedVersion = null;
-
-/**
- * `codex --version` 실행 결과를 파싱하여 마이너 버전 숫자 반환.
- * 파싱 실패 시 0 반환 (구버전으로 간주).
- * @returns {number} 마이너 버전 (예: 0.117.0 → 117)
- */
-export function getCodexVersion() {
-  if (_cachedVersion !== null) return _cachedVersion;
-  try {
-    const out = execSync("codex --version", { encoding: "utf8", timeout: 5000 }).trim();
-    // "codex 0.117.0" 또는 "0.117.0" 형식 대응
-    const m = out.match(/(\d+)\.(\d+)\.(\d+)/);
-    _cachedVersion = m ? parseInt(m[2], 10) : 0;
-  } catch {
-    _cachedVersion = 0;
-  }
-  return _cachedVersion;
-}
-
-/**
- * 최소 마이너 버전 이상인지 확인.
- * @param {number} minMinor
- * @returns {boolean}
- */
-export function gte(minMinor) {
-  return getCodexVersion() >= minMinor;
-}
-
-/**
- * Codex CLI 기능별 분기 객체.
- * 117 = 0.117.0 (Rust 리라이트, exec 서브커맨드 도입)
- */
-export const FEATURES = {
-  /** exec 서브커맨드 사용 가능 여부 */
-  get execSubcommand() { return gte(117); },
-  /** --output-last-message 플래그 지원 여부 */
-  get outputLastMessage() { return gte(117); },
-  /** --color never 플래그 지원 여부 */
-  get colorNever() { return gte(117); },
-  /** 플러그인 시스템 지원 여부 (향후 확장용) */
-  get pluginSystem() { return gte(120); },
-};
-
-/**
- * long-form 플래그 기반 명령 빌더.
- * @param {string} prompt
- * @param {string|null} resultFile — null이면 --output-last-message 생략
- * @param {{ profile?: string, skipGitRepoCheck?: boolean, sandboxBypass?: boolean }} [opts]
- * @returns {string} 실행할 셸 커맨드
- */
-export function buildExecCommand(prompt, resultFile = null, opts = {}) {
-  const { profile, skipGitRepoCheck = true, sandboxBypass = true } = opts;
-
-  const parts = ["codex"];
-  if (profile) parts.push("--profile", profile);
-
-  if (FEATURES.execSubcommand) {
-    parts.push("exec");
-    if (sandboxBypass) parts.push("--dangerously-bypass-approvals-and-sandbox");
-    if (skipGitRepoCheck) parts.push("--skip-git-repo-check");
-    if (resultFile && FEATURES.outputLastMessage) {
-      parts.push("--output-last-message", resultFile);
-    }
-    if (FEATURES.colorNever) parts.push("--color", "never");
-  } else {
-    // 구버전 fallback
-    parts.push("--dangerously-bypass-approvals-and-sandbox");
-    if (skipGitRepoCheck) parts.push("--skip-git-repo-check");
-  }
-
-  parts.push(JSON.stringify(prompt));
-  return parts.join(" ");
-}
+// hub/codex-compat.mjs — backward-compatible facade for legacy imports
+
+export {
+  CODEX_MCP_EXECUTION_EXIT_CODE,
+  CODEX_MCP_TRANSPORT_EXIT_CODE,
+  FEATURES,
+  buildExecCommand,
+  escapePwshSingleQuoted,
+  getCodexVersion,
+  gte,
+} from './cli-adapter-base.mjs';

package/hub/codex-preflight.mjs

@@ -1,11 +1,12 @@
 import { readFileSync, existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { homedir } from 'node:os';
+import { execSync } from 'node:child_process';
 
 import { whichCommandAsync } from './platform.mjs';
-import { getCodexVersion } from './codex-compat.mjs';
 
 const MIN_RECOMMENDED_MINOR = 118;
+let _cachedVersion = null;
 
 function escapeRegExp(value) {
   return String(value).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
@@ -38,6 +39,24 @@ function readSection(text, name) {
   return body.join('\n');
 }
 
+/**
+ * `codex --version` 실행 결과를 파싱하여 마이너 버전 숫자 반환.
+ * 파싱 실패 시 0 반환 (구버전으로 간주).
+ * @returns {number} 마이너 버전 (예: 0.117.0 → 117)
+ */
+export function getCodexVersion() {
+  if (_cachedVersion !== null) return _cachedVersion;
+  try {
+    const out = execSync('codex --version', { encoding: 'utf8', timeout: 5000 }).trim();
+    // "codex 0.117.0" 또는 "0.117.0" 형식 대응
+    const match = out.match(/(\d+)\.(\d+)\.(\d+)/);
+    _cachedVersion = match ? parseInt(match[2], 10) : 0;
+  } catch {
+    _cachedVersion = 0;
+  }
+  return _cachedVersion;
+}
+
 async function checkCodexInstalled() {
   const codexPath = await whichCommandAsync('codex');
   if (codexPath) return { codexPath, ok: true, warnings: [] };

package/hub/gemini-adapter.mjs

@@ -22,6 +22,7 @@ const breaker = createCircuitBreaker();
 
 function inferStallMode(stdout, stderr) {
   const text = `${stdout}\n${stderr}`.toLowerCase();
+  if (/(rate.?limit|quota|resource.?exhaust|429)/u.test(text)) return 'rate_limited';
   if (/(unauthorized|forbidden|auth|login|token|credential|api.?key)/u.test(text)) return 'auth_stall';
   if (/\bmcp\b|playwright|tavily|brave|sequential|server/u.test(text)) return 'mcp_stall';
   return 'timeout';

package/hub/index.mjs

@@ -0,0 +1,34 @@
+// @triflux/core — barrel export (auto-generated by pack.mjs)
+// Adapters
+export { buildExecCommand, sleep, gte, FEATURES, CODEX_MCP_TRANSPORT_EXIT_CODE, normalizePathForShell, shellQuote } from './cli-adapter-base.mjs';
+export { execute as executeCodex, buildExecArgs as buildCodexArgs, buildLaunchScript, getCircuitState as getCodexCircuit } from './codex-adapter.mjs';
+export { execute as executeGemini, buildExecArgs as buildGeminiArgs, getCircuitState as getGeminiCircuit } from './gemini-adapter.mjs';
+export { getCodexVersion, runPreflight } from './codex-preflight.mjs';
+
+// Routing & Intent
+export { createRouter } from './router.mjs';
+export { classifyIntent, quickClassify, INTENT_CATEGORIES, refineClassification } from './intent.mjs';
+
+// State & Paths & Platform
+export * from './paths.mjs';
+export { IS_WINDOWS, IS_MAC, IS_LINUX, TEMP_DIR, normalizePath, whichCommand, killProcess, pipePath } from './platform.mjs';
+
+// Core services
+export { createHitlManager } from './hitl.mjs';
+export { createAssignCallbackServer } from './assign-callbacks.mjs';
+export { getHubUrl, getHubPipePath, requestJson, post, connectPipe, parseArgs, parseJsonSafe } from './bridge.mjs';
+
+// Fullcycle & Research
+export { createFullcycleRunId, getFullcycleRunDir, ensureFullcycleRunDir, saveFullcycleArtifact, readFullcycleArtifact, writeFullcycleState, readFullcycleState, shouldStopQaLoop } from './fullcycle.mjs';
+export { generateQueries, normalizeResults, buildReport, saveReport } from './research.mjs';
+
+// Reflexion (adaptive error learning)
+export { normalizeError, lookupSolution, learnFromError, reportOutcome, adaptiveRuleFromError, getActiveAdaptiveRules } from './reflexion.mjs';
+
+// Neural Memory (Lake 1.5)
+export { createAdaptiveEngine } from './adaptive.mjs';
+export { createAdaptiveMemory } from './adaptive-memory.mjs';
+export { createDiagnosticPipeline } from './adaptive-diagnostic.mjs';
+export { createAdaptiveInjector } from './adaptive-inject.mjs';
+export { buildAdaptiveFingerprint, createAdaptiveFingerprintService } from './session-fingerprint.mjs';
+export { broker as accountBroker } from './account-broker.mjs';

package/hub/lib/cache-guard.mjs

@@ -0,0 +1,114 @@
+import { accessSync, constants, existsSync, readFileSync, readdirSync } from "node:fs";
+import http from "node:http";
+import https from "node:https";
+import { basename, join, relative } from "node:path";
+
+const NETWORK_TIMEOUT_MS = 3_000;
+
+function toIssuePath(cacheDir, filePath) {
+  const relPath = relative(cacheDir, filePath);
+  return (relPath && relPath.length > 0 ? relPath : basename(filePath)).replace(/\\/g, "/");
+}
+
+function collectCacheFiles(cacheDir) {
+  return readdirSync(cacheDir, { withFileTypes: true }).flatMap((entry) => {
+    const filePath = join(cacheDir, entry.name);
+    if (entry.isDirectory()) return collectCacheFiles(filePath);
+    return entry.isFile() ? [filePath] : [];
+  });
+}
+
+function validateCacheFile(cacheDir, filePath) {
+  try {
+    accessSync(filePath, constants.R_OK);
+    if (filePath.endsWith(".json")) {
+      JSON.parse(readFileSync(filePath, "utf8"));
+    }
+    return null;
+  } catch (error) {
+    return {
+      file: toIssuePath(cacheDir, filePath),
+      error: error instanceof Error ? error.message : String(error),
+    };
+  }
+}
+
+function probeUrl(url) {
+  return new Promise((resolve) => {
+    let settled = false;
+
+    const finish = (ok) => {
+      if (settled) return;
+      settled = true;
+      resolve({ url, ok });
+    };
+
+    try {
+      const parsed = new URL(url);
+      const transport = parsed.protocol === "https:" ? https : parsed.protocol === "http:" ? http : null;
+      if (!transport) {
+        finish(false);
+        return;
+      }
+
+      const request = transport.request(parsed, {
+        method: "HEAD",
+        headers: { "user-agent": "triflux-cache-guard" },
+      }, (response) => {
+        response.resume();
+        finish(true);
+      });
+
+      request.setTimeout(NETWORK_TIMEOUT_MS, () => {
+        request.destroy(new Error("timeout"));
+      });
+      request.on("error", () => finish(false));
+      request.end();
+    } catch {
+      finish(false);
+    }
+  });
+}
+
+export function validateRuntimeCachePaths(cacheDir) {
+  if (!cacheDir || !existsSync(cacheDir)) {
+    return { ok: true, issues: [] };
+  }
+
+  try {
+    const files = collectCacheFiles(cacheDir);
+    const issues = files
+      .map((filePath) => validateCacheFile(cacheDir, filePath))
+      .filter((issue) => issue !== null);
+
+    return {
+      ok: issues.length === 0,
+      issues,
+    };
+  } catch (error) {
+    return {
+      ok: false,
+      issues: [{
+        file: ".",
+        error: error instanceof Error ? error.message : String(error),
+      }],
+    };
+  }
+}
+
+export async function checkNetworkAvailability(urls) {
+  const targets = [...new Set((Array.isArray(urls) ? urls : []).filter(Boolean))];
+  if (targets.length === 0) {
+    return { online: true, reachable: [], unreachable: [] };
+  }
+
+  const results = await Promise.all(targets.map((url) => probeUrl(url)));
+  const reachable = results.filter((result) => result.ok).map((result) => result.url);
+  const unreachable = results.filter((result) => !result.ok).map((result) => result.url);
+
+  return {
+    online: unreachable.length === 0,
+    reachable,
+    unreachable,
+  };
+}

package/hub/lib/known-errors.json

@@ -0,0 +1,72 @@
+{
+  "$schema": "Neural Memory 에러 시그니처 시드 — 자동 학습 전 수동 등록 패턴",
+  "version": 1,
+  "signatures": {
+    "ssh-powershell-devnull": {
+      "pattern": "Could not find a part of the path.*dev.null",
+      "tool": "Bash",
+      "context": "SSH 명령 실행",
+      "root_cause": "원격 호스트가 PowerShell인데 bash 문법(2>/dev/null)을 사용",
+      "dna_factor": "remote.os",
+      "rule_template": "원격 호스트 {host}는 PowerShell 기본 셸. 2>/dev/null 대신 2>$null, && 대신 ;, $(cmd) 대신 $(cmd) PowerShell 구문 사용.",
+      "fix": "hub/lib/ssh-command.mjs의 suppressStderr(os) 사용",
+      "confidence_base": 0.95,
+      "severity": "high"
+    },
+    "ssh-powershell-ampamp": {
+      "pattern": "The token '&&' is not a valid statement separator",
+      "tool": "Bash",
+      "context": "SSH 명령 실행",
+      "root_cause": "원격 호스트가 PowerShell인데 bash의 && 연결자를 사용",
+      "dna_factor": "remote.os",
+      "rule_template": "원격 호스트 {host}는 PowerShell 기본 셸. && 대신 ; 사용.",
+      "fix": "hub/lib/ssh-command.mjs의 commandJoin(os) 사용",
+      "confidence_base": 0.95,
+      "severity": "high"
+    },
+    "codex-sandbox-duplicate": {
+      "pattern": "cannot be used multiple times",
+      "tool": "Bash",
+      "context": "codex exec 실행",
+      "root_cause": "config.toml sandbox 설정과 CLI 플래그(--full-auto) 중복",
+      "dna_factor": "cli.codex.config.sandbox",
+      "rule_template": "Codex config.toml에 sandbox=\"{value}\" 설정이 있으므로 CLI에서 --full-auto 플래그 사용 금지",
+      "fix": "config.toml에 기본값을 두고, CLI에서는 --profile만 선택",
+      "confidence_base": 0.95,
+      "severity": "critical"
+    },
+    "codex-exec-approval-stall": {
+      "pattern": "Reading additional input from stdin",
+      "tool": "Bash",
+      "context": "codex exec 비대화형 실행",
+      "root_cause": "codex exec이 config.toml approval_mode를 무시하여 무한 대기",
+      "dna_factor": null,
+      "rule_template": "codex exec은 config.toml approval_mode를 무시함. 반드시 --dangerously-bypass-approvals-and-sandbox 명시적 추가 필수",
+      "fix": "codex exec 호출 시 항상 --dangerously-bypass-approvals-and-sandbox 플래그 포함",
+      "confidence_base": 1.0,
+      "severity": "critical"
+    },
+    "ssh-stdin-hang": {
+      "pattern": "Reading additional input from stdin|Pseudo-terminal will not be allocated",
+      "tool": "Bash",
+      "context": "SSH 원격 CLI 실행",
+      "root_cause": "SSH 세션에서 stdin이 리다이렉트되지 않음",
+      "dna_factor": null,
+      "rule_template": "SSH 원격 실행 시 ssh -n 또는 stdin: 'ignore' 옵션으로 stdin 리다이렉트 필수",
+      "fix": "execFileSync('ssh', [...], { stdio: ['ignore', 'pipe', 'pipe'] })",
+      "confidence_base": 0.9,
+      "severity": "high"
+    },
+    "psmux-node-not-found": {
+      "pattern": "node: not found|node: command not found",
+      "tool": "Bash",
+      "context": "psmux 세션에서 node 실행",
+      "root_cause": "psmux 세션이 PowerShell 7인데 bash 경로의 node를 참조",
+      "dna_factor": "multiplexer.name",
+      "rule_template": "psmux pane은 PowerShell 7 환경. bash PATH의 node 경로가 아닌 PowerShell PATH를 사용해야 함. wrapCliForBash 래핑 금지.",
+      "fix": "PowerShell 네이티브 명령 사용, bash 래핑 금지",
+      "confidence_base": 0.9,
+      "severity": "high"
+    }
+  }
+}