agentlas 0.4.0

package/engine/agentlas-cloud-runtime.cjs

@@ -0,0 +1,199 @@
+"use strict";
+
+const fs = require("node:fs");
+const path = require("node:path");
+const os = require("node:os");
+const crypto = require("node:crypto");
+
+const TEXT_EXTS = new Set([".md", ".txt", ".json", ".jsonl", ".yaml", ".yml", ".toml", ".js", ".ts", ".tsx", ".cjs", ".mjs", ".sh"]);
+const SECRET_RE = /(sk-(?:ant-)?[A-Za-z0-9_-]{20,}|gh[opsu]_[A-Za-z0-9_]{20,}|AKIA[0-9A-Z]{16}|AIza[0-9A-Za-z_-]{35}|-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----)/;
+const SECRET_ASSIGN_RE = /\b(?:api[_-]?key|secret|password|token)\s*[:=]\s*["']?([A-Za-z0-9+/=_-]{20,})["']?/i;
+const PROMPT_INJECTION_RE = /\b(ignore (?:all |previous |prior )?instructions|reveal (?:your )?system prompt|print hidden instructions)\b/i;
+const DESTRUCTIVE_RE = /\b(rm\s+-rf\s+(?:\/|~)|curl\b[^\n]{0,240}\|\s*(?:sudo\s+)?(?:sh|bash|zsh)|mkfs\.|dd\s+if=\/dev\/)\b/i;
+
+function collectFiles(root) {
+  const base = path.resolve(root);
+  const files = [];
+  function walk(dir) {
+    for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+      if (entry.name.startsWith("._")) continue;
+      const abs = path.join(dir, entry.name);
+      const rel = path.relative(base, abs).split(path.sep).join("/");
+      if (entry.isDirectory()) {
+        if ([".git", ".next", "node_modules", "dist", "out", "release"].includes(entry.name)) continue;
+        walk(abs);
+        continue;
+      }
+      if (!entry.isFile()) continue;
+      const ext = path.extname(entry.name).toLowerCase();
+      if (ext && !TEXT_EXTS.has(ext) && !["AGENTS.md", "CLAUDE.md", "GEMINI.md", "agent.md", "README.md"].includes(entry.name)) continue;
+      try {
+        files.push({ path: rel, content: fs.readFileSync(abs, "utf8") });
+      } catch {
+        // Skip non-text files.
+      }
+    }
+  }
+  walk(base);
+  return files.sort((a, b) => a.path.localeCompare(b.path));
+}
+
+function hashPackage(files) {
+  const h = crypto.createHash("sha256");
+  for (const file of files) {
+    if (file.path === "agentlas.json") continue;
+    h.update(file.path);
+    h.update("\0");
+    h.update(file.content);
+    h.update("\0");
+  }
+  return `sha256:${h.digest("hex")}`;
+}
+
+function inferEntry(files) {
+  const paths = new Set(files.map((file) => file.path));
+  return ["AGENTS.md", "agent.md", "CLAUDE.md", "README.md"].find((candidate) => paths.has(candidate)) || files[0]?.path || "AGENTS.md";
+}
+
+function inferSkills(files) {
+  const skills = files.map((file) => file.path.match(/(?:^|\/)skills\/([^/]+)\/SKILL\.md$/)?.[1]).filter(Boolean);
+  return [...new Set(skills)].sort().length ? [...new Set(skills)].sort() : ["agentlas-package"];
+}
+
+function buildManifest(root, options = {}) {
+  const files = collectFiles(root);
+  const name = options.name || path.basename(path.resolve(root));
+  return {
+    schemaVersion: "1.0",
+    name,
+    packageHash: hashPackage(files),
+    runtimeBundleVersion: "1.0",
+    entry: inferEntry(files),
+    skills: inferSkills(files),
+    toolPermissions: { network: "ask", shell: "deny", fileRead: "manifest-allowlist" },
+    memoryPolicy: { writeBack: "ask", publicCopy: "reset" },
+    memory: files.filter((file) => [".agentlas/memory-map.json", ".agentlas/agent-card.json"].includes(file.path)).map((file) => file.path),
+    allowRead: ["README.md", "AGENTS.md", "agent.md", "skills/**", ".agentlas/*.json"],
+    denyRead: [".env", ".env.*", "**/secrets/**", "**/credentials/**", "**/cookies/**", "**/*token*", "**/*secret*"],
+    publicExportPolicy: "clean-copy",
+    requiredRuntime: ["mcp-client"],
+    license: "call-only-default",
+    createdBy: "agentlas-desktop-setup-wizard",
+  };
+}
+
+function redact(text) {
+  return text.replace(SECRET_RE, "[REDACTED_SECRET]").replace(SECRET_ASSIGN_RE, (match, secret) => match.replace(secret, "[REDACTED_SECRET]"));
+}
+
+function scanFiles(files) {
+  const findings = [];
+  function add(verdict, type, file, line, message) {
+    findings.push({ verdict, type, path: file.path, ...(line ? { line } : {}), message, redacted: true });
+  }
+  for (const file of files) {
+    if ([".env", ".env.local"].includes(file.path) || /(?:^|\/)(secrets|credentials|cookies)\//i.test(file.path) || /token|secret/i.test(file.path)) {
+      add("BLOCK", "credential-path", file, null, "Credential-like file path is excluded from Cloud package and public publish.");
+    }
+    file.content.split(/\r?\n/).forEach((line, index) => {
+      if (SECRET_RE.test(line) || SECRET_ASSIGN_RE.test(line)) add("BLOCK", "secret-like-value", file, index + 1, "Secret-like value detected and redacted.");
+      if (PROMPT_INJECTION_RE.test(line)) add("WARN", "prompt-injection", file, index + 1, "Prompt-injection style instruction needs review.");
+      if (DESTRUCTIVE_RE.test(line)) add("WARN", "destructive-command", file, index + 1, "Destructive or remote shell command needs review before execution.");
+    });
+  }
+  const verdict = findings.some((finding) => finding.verdict === "BLOCK") ? "BLOCK" : findings.some((finding) => finding.verdict === "WARN") ? "WARN" : "PASS";
+  return { verdict, scannedAt: new Date().toISOString(), findings };
+}
+
+function scanFolder(root) {
+  return scanFiles(collectFiles(root));
+}
+
+function runWizard(root, options = {}) {
+  const base = path.resolve(root);
+  const files = collectFiles(base);
+  const manifest = buildManifest(base, options);
+  const scanReport = scanFiles(files);
+  fs.writeFileSync(path.join(base, "agentlas.json"), JSON.stringify(manifest, null, 2) + "\n", "utf8");
+  const agentlasDir = path.join(base, ".agentlas");
+  fs.mkdirSync(agentlasDir, { recursive: true });
+  fs.writeFileSync(path.join(agentlasDir, "security-scan.json"), JSON.stringify(scanReport, null, 2) + "\n", "utf8");
+  const status = scanReport.verdict === "BLOCK" ? "Blocked" : "Ready for MCP call";
+  return {
+    status,
+    manifest,
+    scanReport,
+    stateTransitionLog: ["Started setup wizard", "Generated agentlas.json", `Security scan: ${scanReport.verdict}`, status],
+    blockers: status === "Blocked" ? ["Security scan blocked package upload."] : [],
+  };
+}
+
+function loadManifest(root) {
+  return JSON.parse(fs.readFileSync(path.join(path.resolve(root), "agentlas.json"), "utf8"));
+}
+
+function matches(filePath, pattern) {
+  const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*\*/g, ".*").replace(/\*/g, "[^/]*");
+  return new RegExp(`^${escaped}$`, "i").test(filePath);
+}
+
+function compileBundle(root) {
+  const manifest = loadManifest(root);
+  const files = collectFiles(root);
+  const byPath = new Map(files.map((file) => [file.path, file]));
+  const entry = byPath.get(manifest.entry) || byPath.get("AGENTS.md");
+  if (!entry) throw new Error(`Entry file not found: ${manifest.entry}`);
+  const scanReport = scanFiles(files);
+  return {
+    schemaVersion: "1.0",
+    agent: manifest.name,
+    packageHash: manifest.packageHash,
+    entry: { path: entry.path, content: redact(entry.content).slice(0, 8000) },
+    skills: manifest.skills,
+    toolPermissions: manifest.toolPermissions,
+    memoryPolicy: manifest.memoryPolicy,
+    memorySummary: (manifest.memory || []).map((memoryPath) => byPath.get(memoryPath)).filter(Boolean).map((file) => `${file.path}: ${redact(file.content).replace(/\s+/g, " ").slice(0, 480)}`),
+    securityWarnings: scanReport.findings.map((finding) => `${finding.verdict}:${finding.type}:${finding.path}`),
+    lazyRead: { tool: "agentlas.read_agent_file", allowedPatterns: manifest.allowRead, deniedPatterns: manifest.denyRead },
+  };
+}
+
+function readAgentFile(root, requestedPath) {
+  const manifest = loadManifest(root);
+  if ((manifest.denyRead || []).some((pattern) => matches(requestedPath, pattern))) {
+    return { status: "denied", path: requestedPath, reason: "Denied by agentlas.json denyRead.", redacted: true };
+  }
+  if (!(manifest.allowRead || []).some((pattern) => matches(requestedPath, pattern))) {
+    return { status: "denied", path: requestedPath, reason: "Path is not in agentlas.json allowRead.", redacted: false };
+  }
+  const abs = path.join(path.resolve(root), requestedPath);
+  if (!fs.existsSync(abs)) return { status: "missing", path: requestedPath, reason: "File not found." };
+  const raw = fs.readFileSync(abs, "utf8");
+  const content = redact(raw);
+  return { status: "allowed", path: requestedPath, content, redacted: content !== raw };
+}
+
+function runFieldTest() {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), "agentlas-desktop-cloud-field-"));
+  const agent = path.join(root, "mac_a", "instagram-operator");
+  fs.mkdirSync(path.join(agent, "skills", "social-media-strategist"), { recursive: true });
+  fs.mkdirSync(path.join(agent, ".agentlas"), { recursive: true });
+  fs.writeFileSync(path.join(agent, "AGENTS.md"), "# Instagram Operator\n\nBuild weekly Instagram posts.\n", "utf8");
+  fs.writeFileSync(path.join(agent, "skills", "social-media-strategist", "SKILL.md"), "---\nname: social-media-strategist\ndescription: Use for social content.\n---\n\nCreate social plans.\n", "utf8");
+  fs.writeFileSync(path.join(agent, ".agentlas", "memory-map.json"), "{\"project\":\"instagram-operator\"}\n", "utf8");
+  const wizard = runWizard(agent, { name: "instagram-operator" });
+  const bundle = compileBundle(agent);
+  const allowed = readAgentFile(agent, "AGENTS.md");
+  const denied = readAgentFile(agent, ".env");
+  const ledger = [{ agentId: "agent_public_instagram", callerId: "other_user", creatorId: "creator", version: "1.0.0", status: "PASS", mode: "public-call-only" }];
+  const scenarios = [
+    { id: "E1", status: wizard.status === "Ready for MCP call" ? "PASS" : "FAIL", evidence: ["agentlas.json", ".agentlas/security-scan.json"], blockers: wizard.blockers },
+    { id: "E2", status: bundle.entry.path === "AGENTS.md" && allowed.status === "allowed" && denied.status === "denied" ? "PASS" : "FAIL", evidence: ["runtime-bundle", "lazy-read"], blockers: [] },
+    { id: "E3", status: ledger[0].status === "PASS" ? "PASS" : "FAIL", evidence: ["mock-call-only-ledger"], blockers: [] },
+  ];
+  const report = { suite: "agentlas-desktop-cloud-field-test", status: scenarios.every((item) => item.status === "PASS") ? "PASS" : "FAIL", scenarios, ledger };
+  fs.rmSync(root, { recursive: true, force: true });
+  return report;
+}
+
+module.exports = { buildManifest, scanFolder, runWizard, compileBundle, readAgentFile, runFieldTest };

package/engine/agentlas-composer.cjs

@@ -0,0 +1,256 @@
+"use strict";
+/*
+ * agentlas-composer: a raw-mode bottom input box (Claude Code / Hermes style).
+ *
+ *   ╭────────────────────────────────────────────╮
+ *   │ › your message                              │
+ *   ╰────────────────────────────────────────────╯
+ *     claude-code · full · 12.3k tok · / for commands
+ *     (slash suggestions render here while typing /…)
+ *
+ * Single-line field with horizontal scroll (fixed 3-line box → flicker-free clear/redraw).
+ * Full line editing, persisted history, Tab/path/slash completion, slash palette.
+ * Zero external deps. Caller falls back to readline when stdin/stdout is not a TTY.
+ */
+const readline = require("node:readline");
+
+// East-Asian width: CJK / Hangul / Kana / fullwidth glyphs occupy 2 terminal cells.
+function isWide(cp) {
+  return (
+    (cp >= 0x1100 && cp <= 0x115f) || // Hangul Jamo
+    (cp >= 0x2e80 && cp <= 0x303e) || // CJK radicals … symbols
+    (cp >= 0x3041 && cp <= 0x33ff) || // Hiragana … CJK compat
+    (cp >= 0x3400 && cp <= 0x4dbf) || // CJK ext A
+    (cp >= 0x4e00 && cp <= 0x9fff) || // CJK unified
+    (cp >= 0xa000 && cp <= 0xa4cf) || // Yi
+    (cp >= 0xac00 && cp <= 0xd7a3) || // Hangul syllables
+    (cp >= 0xf900 && cp <= 0xfaff) || // CJK compat ideographs
+    (cp >= 0xfe30 && cp <= 0xfe4f) || // CJK compat forms
+    (cp >= 0xff00 && cp <= 0xff60) || // Fullwidth forms
+    (cp >= 0xffe0 && cp <= 0xffe6) ||
+    (cp >= 0x1f300 && cp <= 0x1faff) // emoji / pictographs
+  );
+}
+function charWidth(ch) {
+  const cp = ch.codePointAt(0);
+  if (cp < 0x20) return 0;
+  return isWide(cp) ? 2 : 1;
+}
+function visWidth(s) {
+  const clean = String(s).replace(/\x1b\[[0-9;]*m/g, "");
+  let n = 0;
+  for (const ch of clean) n += charWidth(ch);
+  return n;
+}
+
+function createComposer(opts) {
+  const out = opts.stream || process.stdout;
+  const inp = opts.input || process.stdin;
+  const ui = opts.ui;
+  const c = ui.c;
+  const loadHistory = opts.loadHistory || (() => []);
+  const saveHistory = opts.saveHistory || (() => {});
+  let history = (loadHistory() || []).filter((x) => typeof x === "string"); // index 0 = most recent
+
+  function cols() {
+    return Math.max(30, out.columns || process.stdout.columns || 80);
+  }
+  function boxWidth() {
+    return Math.min(cols() - 1, 120);
+  }
+
+  // Build the rendered block (array of lines) + the cursor target column on the input line.
+  function frame(state, ctx) {
+    const w = boxWidth();
+    const inner = w - 2; // chars between │ … │
+    const glyph = " " + (ctx.glyph || "›") + " "; // " › "
+    const glyphW = visWidth(glyph);
+    const fieldW = Math.max(8, inner - glyphW);
+
+    // horizontal scroll by visual width — keep the cursor visible (CJK-safe)
+    let start = Math.min(state.scroll, state.cur);
+    while (start < state.cur && visWidth(state.buf.slice(start, state.cur)) > fieldW - 1) start++;
+    state.scroll = start;
+
+    let shown = "";
+    let ww = 0;
+    for (let i = start; i < state.buf.length; ) {
+      const ch = state.buf.codePointAt(i) > 0xffff ? state.buf.slice(i, i + 2) : state.buf[i];
+      const cw = charWidth(ch);
+      if (ww + cw > fieldW) break;
+      shown += ch;
+      ww += cw;
+      i += ch.length;
+    }
+    const pad = " ".repeat(Math.max(0, fieldW - ww));
+    const top = c.faint("╭" + "─".repeat(inner) + "╮");
+    const mid = c.faint("│") + c.emerald(glyph) + c.text(shown) + pad + c.faint("│");
+    const bot = c.faint("╰" + "─".repeat(inner) + "╯");
+    const lines = [top, mid, bot];
+    if (ctx.status) lines.push("  " + c.faint(ctx.status));
+
+    const rows = state.suggest || [];
+    rows.slice(0, 8).forEach((r, i) => {
+      const cmd = String(r.command || "").padEnd(16);
+      const desc = String(r.description || "");
+      const label = (" " + cmd + " " + desc).slice(0, w);
+      lines.push(i === state.suggestSel ? c.inverse(label) : " " + c.blue(cmd) + c.dim(desc.slice(0, w - 20)));
+    });
+    if (rows.length) lines.push(c.faint("  ↑↓ move · Tab complete · Enter run · Esc close"));
+
+    const curCol = 1 + glyphW + visWidth(state.buf.slice(start, state.cur)); // 0-based visual column
+    return { lines, curCol };
+  }
+
+  function render(state, ctx) {
+    const f = frame(state, ctx);
+    let seq = "";
+    if (state.drawn > 0) seq += "\r\x1b[1A\x1b[0J"; // from input line: col0, up to top border, clear down
+    seq += f.lines.join("\r\n");
+    const up = f.lines.length - 1 - 1; // from last line up to the input line (index 1)
+    if (up > 0) seq += "\x1b[" + up + "A";
+    seq += "\r";
+    if (f.curCol > 0) seq += "\x1b[" + f.curCol + "C";
+    out.write(seq);
+    state.drawn = f.lines.length;
+  }
+
+  function clearBox(state) {
+    if (state.drawn > 0) {
+      out.write("\r\x1b[1A\x1b[0J");
+      state.drawn = 0;
+    }
+  }
+
+  function read(ctx) {
+    ctx = ctx || {};
+    return new Promise((resolve) => {
+      const state = { buf: "", cur: 0, scroll: 0, drawn: 0, suggest: [], suggestSel: 0, hist: -1, stash: "", dismissed: null };
+
+      function refreshSuggest() {
+        if (ctx.suggest && state.buf !== state.dismissed) {
+          state.suggest = ctx.suggest(state.buf) || [];
+        } else {
+          state.suggest = [];
+        }
+        if (state.suggestSel >= state.suggest.length) state.suggestSel = 0;
+      }
+      function draw() {
+        refreshSuggest();
+        render(state, ctx);
+      }
+
+      const wasRaw = !!inp.isRaw;
+      try { if (inp.setRawMode) inp.setRawMode(true); } catch { /* ignore */ }
+      readline.emitKeypressEvents(inp);
+      inp.resume();
+
+      let ctrlc = 0;
+      function done(result) {
+        inp.removeListener("keypress", onKey);
+        try { if (inp.setRawMode) inp.setRawMode(wasRaw); } catch { /* ignore */ }
+        resolve(result);
+      }
+      function setBuf(s, cur) {
+        state.buf = s;
+        state.cur = cur == null ? s.length : Math.max(0, Math.min(cur, s.length));
+        state.dismissed = null;
+        draw();
+      }
+      function submit() {
+        const value = state.buf;
+        clearBox(state);
+        out.write(c.paw("▌") + c.emerald(" › ") + c.text(value) + "\r\n");
+        if (value.trim()) {
+          history = history.filter((h) => h !== value);
+          history.unshift(value);
+          saveHistory(history);
+        }
+        done({ value });
+      }
+
+      function onKey(str, key) {
+        key = key || {};
+        const name = key.name;
+
+        if (key.ctrl && name === "c") {
+          if (state.buf.length) { ctrlc = 0; return setBuf("", 0); }
+          const now = Date.now();
+          if (now < ctrlc) { clearBox(state); return done({ exit: true }); }
+          ctrlc = now + 1500;
+          return;
+        }
+        if (key.ctrl && name === "d") {
+          if (!state.buf.length) { clearBox(state); return done({ eof: true }); }
+          return;
+        }
+        if (name === "return" || name === "enter") return submit();
+        if (name === "escape") {
+          if (state.suggest.length) { state.dismissed = state.buf; state.suggest = []; return render(state, ctx); }
+          return setBuf("", 0);
+        }
+        if (name === "backspace" || (key.ctrl && name === "h")) {
+          if (state.cur > 0) setBuf(state.buf.slice(0, state.cur - 1) + state.buf.slice(state.cur), state.cur - 1);
+          return;
+        }
+        if (name === "delete") return setBuf(state.buf.slice(0, state.cur) + state.buf.slice(state.cur + 1), state.cur);
+        if (name === "left") { if (state.cur > 0) { state.cur--; draw(); } return; }
+        if (name === "right") { if (state.cur < state.buf.length) { state.cur++; draw(); } return; }
+        if (name === "home" || (key.ctrl && name === "a")) { state.cur = 0; draw(); return; }
+        if (name === "end" || (key.ctrl && name === "e")) { state.cur = state.buf.length; draw(); return; }
+        if (key.ctrl && name === "u") return setBuf(state.buf.slice(state.cur), 0);
+        if (key.ctrl && name === "k") return setBuf(state.buf.slice(0, state.cur), state.cur);
+        if (key.ctrl && name === "w") {
+          const left = state.buf.slice(0, state.cur).replace(/\s*\S+\s*$/, "");
+          return setBuf(left + state.buf.slice(state.cur), left.length);
+        }
+        if (name === "up") {
+          if (state.suggest.length) { state.suggestSel = (state.suggestSel - 1 + state.suggest.length) % state.suggest.length; state.buf = state.suggest[state.suggestSel].command; state.cur = state.buf.length; return render(state, ctx); }
+          return histNav(1);
+        }
+        if (name === "down") {
+          if (state.suggest.length) { state.suggestSel = (state.suggestSel + 1) % state.suggest.length; state.buf = state.suggest[state.suggestSel].command; state.cur = state.buf.length; return render(state, ctx); }
+          return histNav(-1);
+        }
+        if (name === "tab") {
+          if (state.suggest.length) { const cmd = state.suggest[state.suggestSel].command; state.dismissed = cmd; return setBuf(cmd, cmd.length); }
+          if (ctx.complete) {
+            const res = ctx.complete(state.buf) || [];
+            const hits = res[0] || [];
+            const token = res[1] || "";
+            if (hits.length === 1) {
+              const head = token ? state.buf.slice(0, state.buf.length - token.length) : state.buf;
+              return setBuf(head + hits[0]);
+            }
+          }
+          return;
+        }
+        // printable insert (single char or paste). Strip control/newlines → single-line field.
+        if (str && !key.ctrl && !key.meta) {
+          const text = String(str).replace(/[\r\n\t]+/g, " ").replace(/[\x00-\x1f]/g, "");
+          if (text) return setBuf(state.buf.slice(0, state.cur) + text + state.buf.slice(state.cur), state.cur + text.length);
+        }
+      }
+
+      function histNav(dir) {
+        if (!history.length) return;
+        if (state.hist === -1 && dir === 1) state.stash = state.buf;
+        let i = state.hist + dir;
+        if (i < -1) i = -1;
+        if (i >= history.length) i = history.length - 1;
+        state.hist = i;
+        const v = i === -1 ? state.stash : history[i];
+        state.buf = v;
+        state.cur = v.length;
+        draw();
+      }
+
+      inp.on("keypress", onKey);
+      draw();
+    });
+  }
+
+  return { read, setHistory: (h) => { history = (h || []).filter((x) => typeof x === "string"); } };
+}
+
+module.exports = { createComposer, visWidth };

package/engine/agentlas-config.cjs

@@ -0,0 +1,29 @@
+"use strict";
+/*
+ * CLI preferences (separate from the app's SQLite/keychain) — first-run onboarding result.
+ * Stored at <userData>/cli-prefs.json: { onboarded, lang, runtime, permission }.
+ */
+const fs = require("node:fs");
+const path = require("node:path");
+
+function prefsPath(userDataDir) {
+  return path.join(userDataDir, "cli-prefs.json");
+}
+function loadPrefs(userDataDir) {
+  try {
+    return JSON.parse(fs.readFileSync(prefsPath(userDataDir), "utf8")) || {};
+  } catch {
+    return {};
+  }
+}
+function savePrefs(userDataDir, prefs) {
+  try {
+    fs.mkdirSync(userDataDir, { recursive: true });
+    fs.writeFileSync(prefsPath(userDataDir), JSON.stringify(prefs, null, 2), "utf8");
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+module.exports = { prefsPath, loadPrefs, savePrefs };

package/engine/agentlas-doctor.cjs

@@ -0,0 +1,173 @@
+"use strict";
+/*
+ * agentlas-doctor: 런타임 CLI 실패의 "시스템 원인"을 결정론적으로 진단·수리한다.
+ *
+ * 데스크탑 앱 electron/system-agents/runtime-doctor.ts 와 로직 패리티를 유지해야 한다
+ * (3제품 싱크: 데스크탑 TS ↔ 터미널 CJS ↔ system-optimizer 패키지 플레이북).
+ * 패리티는 Agentlas_F/scripts/sync-runtime-doctor.sh 가 공유 픽스처로 검증한다 —
+ * 이 파일의 분류/수리 규칙을 바꾸면 반드시 그 스크립트를 PASS 시켜라.
+ *
+ * 사례(2026-07-08): codex CLI 업데이트가 openai-curated 플러그인(notion/figma)을 자동
+ * 활성화 → 미인증 OAuth 원격 MCP가 매 실행 AuthRequired fatal → codex exit 1.
+ * 수리: 에러 stderr의 호스트와 플러그인 캐시 .mcp.json url 호스트를 대조해 "정확히 그
+ * 플러그인만" config.toml에서 enabled=false (백업 필수, 인증돼 잘 도는 플러그인 오폭 금지).
+ */
+const fs = require("node:fs");
+const os = require("node:os");
+const path = require("node:path");
+
+function codexHome() {
+  return process.env.CODEX_HOME || path.join(os.homedir(), ".codex");
+}
+
+/** 에러 텍스트에서 실패 원인으로 지목된 원격 호스트들을 추출한다. */
+function extractHosts(error) {
+  const hosts = new Set();
+  const re = /https?:\/\/([a-z0-9][a-z0-9.-]*[a-z0-9])/gi;
+  let m;
+  while ((m = re.exec(error)) !== null) hosts.add(m[1].toLowerCase());
+  return [...hosts];
+}
+
+/** kind: mcp-oauth-unauthenticated | timeout | cli-exit | unknown (데스크탑 TS와 동일 규칙) */
+function classifyFailure(error) {
+  const text = error || "";
+  if (/authrequired|invalid_token|oauth-protected-resource|www_authenticate/i.test(text)) {
+    return { kind: "mcp-oauth-unauthenticated", hosts: extractHosts(text) };
+  }
+  if (/no response for \d+s|auto-aborted/i.test(text)) return { kind: "timeout", hosts: [] };
+  if (/CLI exit \d+|exited with code [1-9]/i.test(text)) return { kind: "cli-exit", hosts: extractHosts(text) };
+  return { kind: "unknown", hosts: [] };
+}
+
+/** 실패 호스트와 일치하는 OAuth MCP를 실은 플러그인 찾기(호스트가 에러에 등장한 것만). */
+function findOauthPluginsByHost(hosts) {
+  if (!hosts.length) return [];
+  const cacheRoot = path.join(codexHome(), "plugins", "cache");
+  const hits = [];
+  let marketplaces = [];
+  try {
+    marketplaces = fs.readdirSync(cacheRoot, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
+  } catch {
+    return [];
+  }
+  for (const marketplace of marketplaces) {
+    let plugins = [];
+    try {
+      plugins = fs.readdirSync(path.join(cacheRoot, marketplace), { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
+    } catch {
+      continue;
+    }
+    for (const plugin of plugins) {
+      let versions = [];
+      try {
+        versions = fs.readdirSync(path.join(cacheRoot, marketplace, plugin), { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
+      } catch {
+        continue;
+      }
+      for (const ver of versions) {
+        const mcpJson = path.join(cacheRoot, marketplace, plugin, ver, ".mcp.json");
+        if (!fs.existsSync(mcpJson)) continue;
+        try {
+          const parsed = JSON.parse(fs.readFileSync(mcpJson, "utf8"));
+          for (const server of Object.values(parsed.mcpServers || {})) {
+            if (!server || !server.url) continue;
+            let host = "";
+            try {
+              host = new URL(server.url).hostname.toLowerCase();
+            } catch {
+              continue;
+            }
+            if (hosts.some((h) => h === host || h.endsWith("." + host) || host.endsWith("." + h))) {
+              // cache 디렉토리 "openai-curated-remote"는 config 키에선 "openai-curated".
+              hits.push({ pluginKey: `${plugin}@${marketplace.replace(/-remote$/, "")}`, host });
+            }
+          }
+        } catch {
+          /* 손상된 .mcp.json은 건너뜀 */
+        }
+      }
+    }
+  }
+  const seen = new Set();
+  return hits.filter((h) => (seen.has(h.pluginKey) ? false : (seen.add(h.pluginKey), true)));
+}
+
+/** config.toml에서 해당 플러그인을 enabled=false로 내린다(백업 필수). 반환: 실제 변경 여부. */
+function disableCodexPlugin(pluginKey) {
+  const configPath = path.join(codexHome(), "config.toml");
+  if (!fs.existsSync(configPath)) return false;
+  const original = fs.readFileSync(configPath, "utf8");
+  const header = `[plugins."${pluginKey}"]`;
+  let next;
+  if (original.includes(header)) {
+    const idx = original.indexOf(header);
+    const after = original.slice(idx);
+    const replacedAfter = after.replace(/(\[plugins\."[^"]+"\]\s*\n)enabled\s*=\s*true/, "$1enabled = false");
+    if (replacedAfter === after) return false; // 이미 false거나 형태가 다름
+    next = original.slice(0, idx) + replacedAfter;
+  } else {
+    next = `${original.trimEnd()}\n\n${header}\nenabled = false\n`;
+  }
+  const backup = `${configPath}.bak-doctor-${new Date().toISOString().replace(/[:.]/g, "-")}`;
+  fs.copyFileSync(configPath, backup);
+  fs.writeFileSync(configPath, next);
+  return true;
+}
+
+/**
+ * 진단 + (아는 계열이면) 즉시 수리. 반환: { kind, summary, repaired, actions[] }
+ * 데스크탑 runtime-doctor.ts 의 runRuntimeDoctor 와 동일 계약.
+ */
+function runRuntimeDoctor(errorMessage) {
+  const { kind, hosts } = classifyFailure(errorMessage);
+  const actions = [];
+
+  if (kind === "mcp-oauth-unauthenticated") {
+    const hitList = findOauthPluginsByHost(hosts);
+    let repairedAny = false;
+    for (const hit of hitList) {
+      try {
+        if (disableCodexPlugin(hit.pluginKey)) {
+          repairedAny = true;
+          actions.push({
+            title: `codex plugin disabled: ${hit.pluginKey}`,
+            detail: `미인증 OAuth MCP(${hit.host})가 런타임을 죽여서 ~/.codex/config.toml에서 비활성화했습니다(백업 생성). 이 서비스를 쓰려면 인증 후 다시 켜세요.`,
+          });
+        }
+      } catch (err) {
+        actions.push({ title: `repair failed: ${hit.pluginKey}`, detail: err && err.message ? err.message : String(err) });
+      }
+    }
+    return {
+      kind,
+      summary: hitList.length
+        ? `런타임에 미인증 OAuth MCP 플러그인(${hitList.map((h) => h.pluginKey).join(", ")})이 붙어 있어 CLI가 죽었습니다.`
+        : `미인증 OAuth MCP(${hosts.join(", ") || "unknown host"})가 런타임을 죽였지만 어떤 플러그인인지 특정하지 못했습니다.`,
+      repaired: repairedAny,
+      actions,
+    };
+  }
+
+  if (kind === "timeout") {
+    return {
+      kind,
+      summary: "실행이 장시간 무응답이라 자동 중단됐습니다. 대화형 인증 대기·stdin 블록·원격 MCP 행이 흔한 원인입니다.",
+      repaired: false,
+      actions,
+    };
+  }
+
+  if (kind === "cli-exit") {
+    return {
+      kind,
+      summary: "런타임 CLI가 비정상 종료했지만 아는 수리 계열이 아닙니다.",
+      repaired: false,
+      actions,
+    };
+  }
+
+  return { kind: "unknown", summary: "", repaired: false, actions };
+}
+
+module.exports = { classifyFailure, extractHosts, findOauthPluginsByHost, disableCodexPlugin, runRuntimeDoctor };