@triflux/remote 10.1.0 → 10.25.1

package/hub/team/mcp-selector.mjs

@@ -0,0 +1,145 @@
+const TASK_TYPES = Object.freeze([
+  "implement",
+  "review",
+  "research",
+  "qa",
+  "ship",
+  "multi",
+  "swarm",
+]);
+
+const CLI_TYPES = Object.freeze(["codex", "gemini"]);
+
+export const MCP_CATALOG = Object.freeze([
+  Object.freeze({
+    name: "filesystem",
+    purpose: "Read and write workspace files",
+    taskTypes: Object.freeze(["implement", "review", "qa", "ship"]),
+    cli: Object.freeze(["codex", "gemini"]),
+  }),
+  Object.freeze({
+    name: "github",
+    purpose: "Inspect PRs, issues, and release state",
+    taskTypes: Object.freeze(["review", "ship"]),
+    cli: Object.freeze(["codex"]),
+  }),
+  Object.freeze({
+    name: "browser",
+    purpose: "Research web pages and verify browser flows",
+    taskTypes: Object.freeze(["research", "qa"]),
+    cli: Object.freeze(["codex", "gemini"]),
+  }),
+  Object.freeze({
+    name: "context7",
+    purpose: "Fetch current SDK and API documentation",
+    taskTypes: Object.freeze(["implement", "review", "research"]),
+    cli: Object.freeze(["codex", "gemini"]),
+  }),
+  Object.freeze({
+    name: "exa",
+    purpose: "Search code examples and repositories",
+    taskTypes: Object.freeze(["research", "review"]),
+    cli: Object.freeze(["codex", "gemini"]),
+  }),
+  Object.freeze({
+    name: "tavily",
+    purpose: "Verify current external facts and search results",
+    taskTypes: Object.freeze(["research", "qa"]),
+    cli: Object.freeze(["gemini"]),
+  }),
+  Object.freeze({
+    name: "sequential-thinking",
+    purpose: "Structured reasoning for audits and review",
+    taskTypes: Object.freeze(["review"]),
+    cli: Object.freeze(["codex"]),
+  }),
+  Object.freeze({
+    name: "tfx-hub",
+    purpose: "Coordinate triflux hub, multi-agent, and swarm work",
+    taskTypes: Object.freeze(["ship", "multi", "swarm"]),
+    cli: Object.freeze(["codex", "gemini"]),
+  }),
+]);
+
+function uniqueStrings(values = []) {
+  return [
+    ...new Set(
+      (Array.isArray(values) ? values : [])
+        .map((value) => String(value ?? "").trim())
+        .filter(Boolean),
+    ),
+  ];
+}
+
+function assertOneOf(label, value, allowed) {
+  if (!allowed.includes(value)) {
+    throw new TypeError(`${label} must be one of: ${allowed.join(", ")}`);
+  }
+}
+
+export function selectMcpServers(opts = {}) {
+  const taskType = String(opts.taskType ?? "").trim();
+  const cli = String(opts.cli ?? "").trim();
+  assertOneOf("taskType", taskType, TASK_TYPES);
+  assertOneOf("cli", cli, CLI_TYPES);
+
+  const allCatalogNames = MCP_CATALOG.map((server) => server.name);
+  const available = new Set(
+    uniqueStrings(opts.available?.length ? opts.available : allCatalogNames),
+  );
+  const exclude = new Set(uniqueStrings(opts.exclude));
+  const force = uniqueStrings(opts.force);
+
+  const taskMatched = MCP_CATALOG.filter((server) =>
+    server.taskTypes.includes(taskType),
+  );
+  const compatible = taskMatched.filter((server) => server.cli.includes(cli));
+  const incompatible = taskMatched.filter(
+    (server) => !server.cli.includes(cli),
+  );
+
+  const selected = uniqueStrings([
+    ...compatible
+      .map((server) => server.name)
+      .filter((name) => available.has(name) && !exclude.has(name)),
+    ...force.filter((name) => available.has(name) && !exclude.has(name)),
+  ]);
+
+  const reasonParts = [
+    `task=${taskType}`,
+    `cli=${cli}`,
+    `selected=${selected.length ? selected.join(", ") : "none"}`,
+  ];
+  if (incompatible.length) {
+    reasonParts.push(
+      `cli-filtered=${incompatible.map((server) => server.name).join(", ")}`,
+    );
+  }
+  if (force.length) reasonParts.push(`forced=${force.join(", ")}`);
+  if (exclude.size) reasonParts.push(`excluded=${[...exclude].join(", ")}`);
+  if (opts.available?.length) {
+    reasonParts.push(`available=${[...available].join(", ")}`);
+  }
+
+  return {
+    selected,
+    reason: reasonParts.join(" | "),
+  };
+}
+
+export function buildMcpArgs(servers = [], cli) {
+  const resolvedCli = String(cli ?? "").trim();
+  assertOneOf("cli", resolvedCli, CLI_TYPES);
+
+  const selected = uniqueStrings(servers);
+  if (!selected.length) return [];
+
+  if (resolvedCli === "codex") {
+    return selected.flatMap((server) => [
+      "-c",
+      `mcp_servers.${server}.enabled=true`,
+    ]);
+  }
+
+  return ["--allowed-mcp-server-names", ...selected];
+}

package/hub/team/native-supervisor.mjs

@@ -1,10 +1,21 @@
 // hub/team/native-supervisor.mjs — tmux 없이 멀티 CLI를 직접 띄우는 네이티브 팀 런타임
+
+import { execSync as execSyncSupervisor, spawn } from "node:child_process";
+import {
+  createWriteStream,
+  mkdirSync,
+  readFileSync,
+  writeFileSync,
+} from "node:fs";
 import { createServer } from "node:http";
-import { spawn, execSync as execSyncSupervisor } from "node:child_process";
-import { mkdirSync, readFileSync, writeFileSync, createWriteStream } from "node:fs";
 import { dirname, join } from "node:path";
+import {
+  ensureBashScriptExecution,
+  resolveBashExecutable,
+} from "@triflux/core/hub/lib/bash-path.mjs";
 import { verifySlimWrapperRouteExecution } from "./native.mjs";
 import { forceCleanupTeam } from "./nativeProxy.mjs";
+import { buildWorkerSandboxEnv } from "./worker-sandbox.mjs";
 
 const ROUTE_LOG_TAIL_BYTES = 65536;
 
@@ -106,6 +117,7 @@ function memberStateSnapshot() {
       routeVerification: state?.routeVerification || null,
       logFile: state?.logFile || null,
       errFile: state?.errFile || null,
+      workerSandboxRoot: state?.workerSandboxRoot || null,
     });
   }
   return states;
@@ -130,18 +142,23 @@ const SAFE_COMMAND_RE = /^[a-zA-Z0-9 _./:@"'=\-\\]+$/;
 
 function validateMemberCommand(command, memberName) {
   if (typeof command !== "string" || command.trim().length === 0) {
-    throw new Error(`member "${memberName}": command must be a non-empty string`);
+    throw new Error(
+      `member "${memberName}": command must be a non-empty string`,
+    );
   }
   if (!SAFE_COMMAND_RE.test(command)) {
     throw new Error(
       `member "${memberName}": command contains disallowed characters — ` +
-      `shell metacharacters (;&|$\`()<>{}\\n\\r) are not permitted`
+        `shell metacharacters (;&|$\`()<>{}\\n\\r) are not permitted`,
     );
   }
 }
 
 function spawnMember(member) {
-  validateMemberCommand(member.command, member.name);
+  const command = ensureBashScriptExecution(member.command, {
+    bashCommand: resolveBashExecutable(),
+  });
+  validateMemberCommand(command, member.name);
 
   const outPath = join(logsDir, `${member.name}.out.log`);
   const errPath = join(logsDir, `${member.name}.err.log`);
@@ -149,12 +166,25 @@ function spawnMember(member) {
   const outWs = createWriteStream(outPath, { flags: "a" });
   const errWs = createWriteStream(errPath, { flags: "a" });
 
-  const child = spawn(member.command, {
+  const baseEnv = {
+    ...process.env,
+    TERM:
+      process.env.TERM && process.env.TERM !== "dumb"
+        ? process.env.TERM
+        : "xterm-256color",
+  };
+  const sandbox =
+    member.role === "worker"
+      ? buildWorkerSandboxEnv({
+          cwd: config.workdir || process.cwd(),
+          sessionId: `${sessionName}-${member.name}`,
+          env: baseEnv,
+        })
+      : { env: {}, root: null };
+
+  const child = spawn(command, {
     shell: true,
-    env: {
-      ...process.env,
-      TERM: process.env.TERM && process.env.TERM !== "dumb" ? process.env.TERM : "xterm-256color",
-    },
+    env: { ...baseEnv, ...sandbox.env },
     stdio: ["pipe", "pipe", "pipe"],
     windowsHide: true,
   });
@@ -169,6 +199,7 @@ function spawnMember(member) {
     status: "running",
     exitCode: null,
     lastPreview: "",
+    workerSandboxRoot: sandbox.root || null,
   };
 
   child.stdout.on("data", (buf) => {
@@ -176,7 +207,8 @@ function spawnMember(member) {
     const txt = safeText(buf).trim();
     if (txt) {
       const lines = txt.split(/\r?\n/).filter(Boolean);
-      if (lines.length) state.lastPreview = lines[lines.length - 1].slice(0, 280);
+      if (lines.length)
+        state.lastPreview = lines[lines.length - 1].slice(0, 280);
     }
   });
 
@@ -185,7 +217,8 @@ function spawnMember(member) {
     const txt = safeText(buf).trim();
     if (txt) {
       const lines = txt.split(/\r?\n/).filter(Boolean);
-      if (lines.length) state.lastPreview = `[err] ${lines[lines.length - 1].slice(0, 260)}`;
+      if (lines.length)
+        state.lastPreview = `[err] ${lines[lines.length - 1].slice(0, 260)}`;
     }
   });
 
@@ -193,8 +226,12 @@ function spawnMember(member) {
     state.status = "exited";
     state.exitCode = code;
     finalizeRouteVerification(state);
-    try { outWs.end(); } catch {}
-    try { errWs.end(); } catch {}
+    try {
+      outWs.end();
+    } catch {}
+    try {
+      errWs.end();
+    } catch {}
     maybeAutoShutdown();
   });
 
@@ -202,8 +239,12 @@ function spawnMember(member) {
     state.status = "exited";
     state.exitCode = -1;
     state.lastPreview = `[spawn error] ${err.message}`;
-    try { outWs.end(); } catch {}
-    try { errWs.end(); } catch {}
+    try {
+      outWs.end();
+    } catch {}
+    try {
+      errWs.end();
+    } catch {}
     maybeAutoShutdown();
   });
 
@@ -213,7 +254,8 @@ function spawnMember(member) {
 function sendInput(memberName, text) {
   const state = processMap.get(memberName);
   if (!state) return { ok: false, error: "member_not_found" };
-  if (state.status !== "running") return { ok: false, error: "member_not_running" };
+  if (state.status !== "running")
+    return { ok: false, error: "member_not_running" };
   try {
     state.child.stdin.write(`${safeText(text)}\n`);
     return { ok: true };
@@ -225,7 +267,8 @@ function sendInput(memberName, text) {
 function interruptMember(memberName) {
   const state = processMap.get(memberName);
   if (!state) return { ok: false, error: "member_not_found" };
-  if (state.status !== "running") return { ok: false, error: "member_not_running" };
+  if (state.status !== "running")
+    return { ok: false, error: "member_not_running" };
 
   let signaled = false;
   try {
@@ -250,7 +293,9 @@ let isShuttingDown = false;
 
 function maybeAutoShutdown() {
   if (isShuttingDown) return;
-  const allExited = [...processMap.values()].every((s) => s.status === "exited");
+  const allExited = [...processMap.values()].every(
+    (s) => s.status === "exited",
+  );
   if (!allExited) return;
   shutdown();
 }
@@ -261,11 +306,19 @@ async function shutdown() {
 
   for (const state of processMap.values()) {
     if (state.status === "running") {
-      try { state.child.stdin.write("exit\n"); } catch {}
-      try { state.child.kill("SIGTERM"); } catch {}
+      try {
+        state.child.stdin.write("exit\n");
+      } catch {}
+      try {
+        state.child.kill("SIGTERM");
+      } catch {}
     }
-    try { state.outWs.end(); } catch {}
-    try { state.errWs.end(); } catch {}
+    try {
+      state.outWs.end();
+    } catch {}
+    try {
+      state.errWs.end();
+    } catch {}
   }
 
   try {
@@ -278,9 +331,17 @@ async function shutdown() {
         const pid = state.child?.pid;
         if (process.platform === "win32" && Number.isInteger(pid) && pid > 0) {
           // Windows: 프로세스 트리 전체 강제 종료 (손자 MCP 서버 포함)
-          try { execSyncSupervisor(`taskkill /T /F /PID ${pid}`, { stdio: "pipe", windowsHide: true, timeout: 5000 }); } catch {}
+          try {
+            execSyncSupervisor(`taskkill /T /F /PID ${pid}`, {
+              stdio: "pipe",
+              windowsHide: true,
+              timeout: 5000,
+            });
+          } catch {}
         } else {
-          try { state.child.kill("SIGKILL"); } catch {}
+          try {
+            state.child.kill("SIGKILL");
+          } catch {}
         }
       }
     }
@@ -321,7 +382,10 @@ const server = createServer(async (req, res) => {
     let totalLen = 0;
     for await (const c of req) {
       totalLen += c.length;
-      if (totalLen > MAX_BODY) { send(413, { ok: false, error: "payload_too_large" }); return; }
+      if (totalLen > MAX_BODY) {
+        send(413, { ok: false, error: "payload_too_large" });
+        return;
+      }
       chunks.push(c);
     }
     const raw = Buffer.concat(chunks).toString("utf8") || "{}";

package/hub/team/native.mjs

@@ -21,7 +21,8 @@ export const SCOUT_ROLE_CONFIG = {
   readOnly: true,
 };
 const ROUTE_LOG_RE = /\[tfx-route\]/i;
-const ROUTE_COMMAND_RE = /(?:^|[\s"'`])(?:bash\s+)?(?:[^"'`\s]*\/)?tfx-route\.sh\b/i;
+const ROUTE_COMMAND_RE =
+  /(?:^|[\s"'`])(?:bash\s+)?(?:[^"'`\s]*\/)?tfx-route\.sh\b/i;
 const ROUTE_PROMPT_RE = /tfx-route\.sh/i;
 const DIRECT_TOOL_BYPASS_RE = /\b(?:Read|Edit|Write)\s*\(/;
 
@@ -33,12 +34,14 @@ function inferWorkerIndex(agentName = "") {
 }
 
 function buildRouteEnvPrefix(agentName, workerIndex, searchTool) {
-  const effectiveWorkerIndex = Number.isInteger(workerIndex) && workerIndex > 0
-    ? workerIndex
-    : inferWorkerIndex(agentName);
+  const effectiveWorkerIndex =
+    Number.isInteger(workerIndex) && workerIndex > 0
+      ? workerIndex
+      : inferWorkerIndex(agentName);
 
   let envPrefix = "";
-  if (effectiveWorkerIndex) envPrefix += ` TFX_WORKER_INDEX="${effectiveWorkerIndex}"`;
+  if (effectiveWorkerIndex)
+    envPrefix += ` TFX_WORKER_INDEX="${effectiveWorkerIndex}"`;
   if (searchTool) envPrefix += ` TFX_SEARCH_TOOL="${searchTool}"`;
   return envPrefix;
 }
@@ -91,7 +94,8 @@ export function verifySlimWrapperRouteExecution(input = {}) {
   const sawDirectToolBypass = DIRECT_TOOL_BYPASS_RE.test(stdoutText);
   const usedRoute = sawRouteCommand || sawRouteLog;
   const expectedRouteInvocation = promptMentionsRoute;
-  const abnormal = expectedRouteInvocation && (sawDirectToolBypass || !usedRoute);
+  const abnormal =
+    expectedRouteInvocation && (sawDirectToolBypass || !usedRoute);
   const reason = !abnormal
     ? null
     : sawDirectToolBypass
@@ -123,14 +127,26 @@ function getRouteTimeout(role, _mcpProfile) {
   // tfx-route.sh route_agent()의 DEFAULT_TIMEOUT 기반, 최소 1080초(18분) 보장.
   // Bash timeout = 이 값 + 60초 여유. 짧은 역할도 네트워크/스케줄 지연 대비.
   const TIMEOUTS = {
-    'build-fixer': 1080, debugger: 1080, executor: 1080,
-    'deep-executor': 3600, architect: 3600, planner: 3600,
-    critic: 3600, analyst: 3600, scientist: 1800,
-    'scientist-deep': 3600, 'document-specialist': 1800,
-    'code-reviewer': 1800, 'security-reviewer': 1800,
-    'quality-reviewer': 1800, verifier: 1800,
-    designer: 1080, writer: 1080,
-    explore: 1080, 'test-engineer': 1080, 'qa-tester': 1080,
+    "build-fixer": 1080,
+    debugger: 1080,
+    executor: 1080,
+    "deep-executor": 3600,
+    architect: 3600,
+    planner: 3600,
+    critic: 3600,
+    analyst: 3600,
+    scientist: 1800,
+    "scientist-deep": 3600,
+    "document-specialist": 1800,
+    "code-reviewer": 1800,
+    "security-reviewer": 1800,
+    "quality-reviewer": 1800,
+    verifier: 1800,
+    designer: 1080,
+    writer: 1080,
+    explore: 1080,
+    "test-engineer": 1080,
+    "qa-tester": 1080,
     spark: 600,
   };
   return TIMEOUTS[role] || 1080;
@@ -176,16 +192,21 @@ export function buildSlimWrapperPrompt(cli, opts = {}) {
   const escaped = subtask.replace(/'/g, "'\\''");
   const pipelineHint = pipelinePhase
     ? `\n파이프라인 단계: ${pipelinePhase}`
-    : '';
-  const routeEnvPrefix = buildRouteEnvPrefix(agentName, workerIndex, searchTool);
-  const scoutConstraint = (role === "scout" || role === "scientist")
-    ? "\n이 워커는 scout(탐색 전용)이다. 코드를 수정하거나 파일을 생성하지 마라. 기존 코드를 읽고 분석하여 보고만 하라."
     : "";
+  const routeEnvPrefix = buildRouteEnvPrefix(
+    agentName,
+    workerIndex,
+    searchTool,
+  );
+  const scoutConstraint =
+    role === "scout" || role === "scientist"
+      ? "\n이 워커는 scout(탐색 전용)이다. 코드를 수정하거나 파일을 생성하지 마라. 기존 코드를 읽고 분석하여 보고만 하라."
+      : "";
 
   // Bash 도구 timeout (모두 600초 이내)
-  const launchTimeoutMs = 15000;   // Step 1: fork + job_id 반환
-  const waitTimeoutMs = 570000;    // Step 2: 내부 폴링 (540초 대기 + 여유)
-  const resultTimeoutMs = 30000;   // Step 3: 결과 읽기
+  const launchTimeoutMs = 15000; // Step 1: fork + job_id 반환
+  const waitTimeoutMs = 570000; // Step 2: 내부 폴링 (540초 대기 + 여유)
+  const resultTimeoutMs = 30000; // Step 3: 결과 읽기
 
   return `실행 프로토콜 (subagent_type="${SLIM_WRAPPER_SUBAGENT_TYPE}", async + feedback):
 MAX_ITERATIONS = ${maxIterations}
@@ -252,9 +273,7 @@ SendMessage(type: "message", recipient: "${leadName}", content: "최종 완료:
  */
 export function buildScoutDispatchPrompt(opts = {}) {
   const { question, scope = "", teamName, taskId, agentName, leadName } = opts;
-  const subtask = scope
-    ? `${question} 탐색 범위: ${scope}`
-    : question;
+  const subtask = scope ? `${question} 탐색 범위: ${scope}` : question;
   return buildSlimWrapperPrompt("codex", {
     subtask,
     role: "scientist",
@@ -305,10 +324,16 @@ export function buildHybridWrapperPrompt(cli, opts = {}) {
   } = opts;
 
   const escaped = subtask.replace(/'/g, "'\\''");
-  const pipelineHint = pipelinePhase ? `\n파이프라인 단계: ${pipelinePhase}` : "";
+  const pipelineHint = pipelinePhase
+    ? `\n파이프라인 단계: ${pipelinePhase}`
+    : "";
   const taskIdRef = taskId ? `taskId: "${taskId}"` : "";
   const taskIdArg = taskIdRef ? `${taskIdRef}, ` : "";
-  const routeEnvPrefix = buildRouteEnvPrefix(agentName, workerIndex, searchTool);
+  const routeEnvPrefix = buildRouteEnvPrefix(
+    agentName,
+    workerIndex,
+    searchTool,
+  );
 
   const routeCmd = `TFX_TEAM_NAME="${teamName}" TFX_TEAM_TASK_ID="${taskId}" TFX_TEAM_AGENT_NAME="${agentName}" TFX_TEAM_LEAD_NAME="${leadName}"${routeEnvPrefix} bash ${ROUTE_SCRIPT} "${role}" '${escaped}' ${mcp_profile}`;
 
@@ -374,7 +399,12 @@ export async function pollTeamResults(teamName, expectedTaskIds = []) {
     return { completed: [], pending: normalizedTaskIds };
   }
 
-  const resultDir = path.join(os.homedir(), ".claude", "tfx-results", normalizedTeamName);
+  const resultDir = path.join(
+    os.homedir(),
+    ".claude",
+    "tfx-results",
+    normalizedTeamName,
+  );
 
   let entries;
   try {
@@ -387,9 +417,7 @@ export async function pollTeamResults(teamName, expectedTaskIds = []) {
   }
 
   const availableFiles = new Set(
-    entries
-      .filter((entry) => entry.isFile())
-      .map((entry) => entry.name),
+    entries.filter((entry) => entry.isFile()).map((entry) => entry.name),
   );
 
   const completedCandidates = await Promise.all(
@@ -418,7 +446,9 @@ export async function pollTeamResults(teamName, expectedTaskIds = []) {
 
   const completed = completedCandidates.filter(Boolean);
   const completedTaskIds = new Set(completed.map((item) => item.taskId));
-  const pending = normalizedTaskIds.filter((taskId) => !completedTaskIds.has(taskId));
+  const pending = normalizedTaskIds.filter(
+    (taskId) => !completedTaskIds.has(taskId),
+  );
 
   return { completed, pending };
 }
@@ -430,7 +460,9 @@ export async function pollTeamResults(teamName, expectedTaskIds = []) {
  * @returns {string}
  */
 export function formatPollReport(pollResult = {}) {
-  const completed = Array.isArray(pollResult.completed) ? pollResult.completed : [];
+  const completed = Array.isArray(pollResult.completed)
+    ? pollResult.completed
+    : [];
   const pending = Array.isArray(pollResult.pending) ? pollResult.pending : [];
   const total = completed.length + pending.length;
 
@@ -453,7 +485,10 @@ export function formatPollReport(pollResult = {}) {
  * @returns {string}
  */
 function normalizeText(s) {
-  return String(s || "").toLowerCase().replace(/\s+/g, " ").trim();
+  return String(s || "")
+    .toLowerCase()
+    .replace(/\s+/g, " ")
+    .trim();
 }
 
 /**
@@ -523,7 +558,8 @@ export function compressScoutReport(rawReport) {
   const text = String(rawReport || "");
 
   // 파일:라인 패턴 추출 (path/to/file.ext:123 형태 + 뒤따르는 설명)
-  const fileLineRe = /([a-zA-Z0-9_./-]+\.[a-zA-Z]{1,10}):(\d+)\s*[:\-–—]?\s*(.+)/g;
+  const fileLineRe =
+    /([a-zA-Z0-9_./-]+\.[a-zA-Z]{1,10}):(\d+)\s*[:\-–—]?\s*(.+)/g;
   const findings = [];
   let match;
   while ((match = fileLineRe.exec(text)) !== null) {
@@ -546,7 +582,10 @@ export function compressScoutReport(rawReport) {
 
   // findings를 먼저 계산하고, 남은 공간에 맞춰 summary를 자른다
   const findingsJson = JSON.stringify(findings);
-  const findingsBudget = Math.min(findingsJson.length, Math.floor(MAX_CHARS * 0.3));
+  const findingsBudget = Math.min(
+    findingsJson.length,
+    Math.floor(MAX_CHARS * 0.3),
+  );
 
   let trimmedFindings = findings;
   if (findingsJson.length > findingsBudget && findings.length > 0) {