agentlas 0.9.9 → 1.0.1

package/engine/commands/update.cjs

@@ -0,0 +1,54 @@
+"use strict";
+/*
+ * update — npm 레지스트리에서 새 agentlas 확인.
+ *
+ * v2 경계: 이 CLI는 자기 자신(npm 패키지)만 업데이트 안내한다. v1이 여기 섞어놓았던
+ * 데스크탑 .app 다운로드/서명검증/교체기는 데스크탑 제품 소관으로 반환했다
+ * (터미널에서 hdiutil로 앱을 갈아끼우는 코드는 관심사 혼합의 대표 사례였다).
+ * 버전 비교는 반드시 compareSemVer — 문자열 비교는 0.9.10 < 0.9.9 오판을 낳는다.
+ */
+const { compareSemVer } = require("../semver.cjs");
+const { readVersion } = require("../agentlas-banner.cjs");
+
+async function checkNpmLatest({ fetch: fetchImpl } = {}) {
+  const f = fetchImpl || globalThis.fetch;
+  const currentVersion = readVersion();
+  let latestVersion = null;
+  try {
+    const resp = await f("https://registry.npmjs.org/agentlas/latest", { headers: { accept: "application/json" } });
+    if (resp.ok) latestVersion = String((await resp.json()).version || "");
+  } catch { /* offline 등 — 호출부에서 안내 */ }
+  const comparison = latestVersion ? compareSemVer(currentVersion, latestVersion) : null;
+  return {
+    currentVersion,
+    latestVersion,
+    updateAvailable: comparison == null ? null : comparison < 0,
+    channel: "npm",
+  };
+}
+
+async function run(ctx, args) {
+  const json = args.includes("--json");
+  const status = await checkNpmLatest();
+  if (json) {
+    ctx.out(JSON.stringify(status, null, 2));
+    return 0;
+  }
+  ctx.out(`Current version: ${status.currentVersion}`);
+  if (!status.latestVersion) {
+    ctx.out("Could not check the latest version on the npm registry (offline or not published yet).");
+    ctx.out("Manual update: npm i -g agentlas@latest");
+    return 0;
+  }
+  ctx.out(`Latest version: ${status.latestVersion}`);
+  if (status.updateAvailable == null) {
+    ctx.out("Could not compare version formats. Manual update: npm i -g agentlas@latest");
+  } else if (status.updateAvailable) {
+    ctx.out("Update: npm i -g agentlas@latest");
+  } else {
+    ctx.out("Already on the latest version.");
+  }
+  return 0;
+}
+
+module.exports = { run, checkNpmLatest };

package/engine/commands/upload.cjs

@@ -0,0 +1,18 @@
+"use strict";
+/*
+ * upload — `agentlas upload <path> [--visibility marketplace]`.
+ * 기본은 owner-private `cloud save`다. 공개 Hub 발행은 오직 명시적
+ * `--visibility marketplace` 로만 일어난다 (조용한 공개 승격 금지).
+ */
+const { runUpload } = require("../cloud-assets/commands.cjs");
+
+async function run(ctx, args) {
+  try {
+    return await runUpload(ctx, args);
+  } catch (e) {
+    ctx.err(String((e && e.message) || e));
+    return 1;
+  }
+}
+
+module.exports = { run };

package/engine/commands/usage.cjs

@@ -0,0 +1,35 @@
+"use strict";
+/* usage — 로컬 사용 현황 요약 (공유 DB 읽기 전용). 공급자 쿼터 대시보드는 데스크탑 소관. */
+const { listAgents } = require("../agents/registry.cjs");
+
+function run(ctx) {
+  const ko = ctx.lang === "ko";
+  const db = ctx.db();
+  const day = new Date(Date.now() - 86400000).toISOString();
+  const week = new Date(Date.now() - 7 * 86400000).toISOString();
+  const q = (sql, ...p) => {
+    try { return db.prepare(sql).get(...p) || {}; } catch { return {}; }
+  };
+  const ar = q("SELECT kind FROM active_runtime WHERE id=1");
+  const agents = { n: listAgents(db).length };
+  const chats = q("SELECT COUNT(*) AS n FROM chats WHERE archived_at IS NULL");
+  const msg24 = q("SELECT COUNT(*) AS n FROM chat_messages WHERE created_at > ?", day);
+  const msg7 = q("SELECT COUNT(*) AS n FROM chat_messages WHERE created_at > ?", week);
+  const auto = q("SELECT COUNT(*) AS n FROM automations WHERE enabled=1");
+  const runs7 = q("SELECT COUNT(*) AS n, SUM(CASE WHEN status='error' OR error IS NOT NULL THEN 1 ELSE 0 END) AS err FROM run_history WHERE ran_at > ?", week);
+  ctx.out(ko ? `활성 런타임      ${ar.kind || "(없음)"}` : `Active runtime    ${ar.kind || "(none)"}`);
+  ctx.out(ko ? `설치 에이전트    ${agents.n ?? "?"}` : `Installed agents  ${agents.n ?? "?"}`);
+  ctx.out(ko ? `활성 대화        ${chats.n ?? "?"}` : `Active chats      ${chats.n ?? "?"}`);
+  ctx.out(ko ? `메시지           24시간 ${msg24.n ?? 0}  ·  7일 ${msg7.n ?? 0}` : `Messages          24h ${msg24.n ?? 0}  ·  7d ${msg7.n ?? 0}`);
+  ctx.out(ko ? `자동화           ${auto.n ?? 0}` : `Automations       ${auto.n ?? 0}`);
+  ctx.out(ko
+    ? `실행(7일)        ${runs7.n ?? 0}${runs7.err ? `  (실패 ${runs7.err})` : ""}`
+    : `Runs (7d)         ${runs7.n ?? 0}${runs7.err ? `  (${runs7.err} failed)` : ""}`);
+  ctx.out("");
+  ctx.out(ctx.ui.dim(ko
+    ? "세션 토큰·비용은 대화에서 /cost로 확인합니다. 공급자 할당량 대시보드는 Desktop에 있습니다."
+    : "Session tokens/cost: /cost in chat. Provider quota dashboards are in Desktop."));
+  return 0;
+}
+
+module.exports = { run };

package/engine/commands/variant.cjs

@@ -0,0 +1,25 @@
+"use strict";
+/*
+ * variant — 로컬 자문 variant 해소 프리뷰.
+ *   agentlas variant resolve [candidates.json] [--base-release <id>] [--prefer <id>] [--json]
+ * 로직은 engine/experience/variant.cjs (v1 cmdVariant 이식) 가 소유한다.
+ * 결정 어휘 selected|fallback|base-only|error 는 계약 — 변경 금지.
+ * decision=error 는 v1과 동일하게 exit 2 로 끝난다(0/1과 구분되는 자문 오류).
+ */
+const { userDataDir } = require("../core/paths.cjs");
+const { cmdVariant } = require("../experience/variant.cjs");
+
+function run(ctx, args) {
+  let code = 0;
+  cmdVariant({
+    db: ctx.db(),
+    args,
+    userDataDir: userDataDir(),
+    cwd: process.cwd(),
+    out: ctx.out,
+    setExitCode: (value) => { code = value; },
+  });
+  return code;
+}
+
+module.exports = { run };

package/engine/commands/version.cjs

@@ -0,0 +1,9 @@
+"use strict";
+const { readVersion } = require("../agentlas-banner.cjs");
+
+function run(ctx) {
+  ctx.out(`agentlas ${readVersion()}`);
+  return 0;
+}
+
+module.exports = { run };

package/engine/commands/whoami.cjs

@@ -0,0 +1,38 @@
+"use strict";
+/*
+ * whoami — Agentlas Cloud 세션 상태 확인.
+ * 네트워크 계약: GET <web>/api/auth/session (cookie 헤더). 서명 아웃/만료는 exit 1.
+ */
+const auth = require("../cloud/auth.cjs");
+
+async function run(ctx) {
+  const ko = ctx.lang === "ko";
+  const cookie = auth.cloudSessionCookie();
+  if (!cookie) {
+    ctx.out(ko
+      ? "로그아웃 상태입니다. `agentlas login`으로 로그인하세요."
+      : "You are signed out. Sign in with agentlas login.");
+    return 1;
+  }
+  let j;
+  try {
+    j = await auth.fetchSessionMeta(cookie);
+  } catch (e) {
+    ctx.err((ko ? "세션 확인 실패: " : "Session check failed: ") + String((e && e.message) || e));
+    return 1;
+  }
+  if (j && j.authenticated) {
+    const email = (j.user && j.user.email) || "?";
+    const ws = j.workspace || {};
+    ctx.out(ko
+      ? `로그인됨: ${ctx.ui.bold(email)}  ·  작업 공간: ${ws.name || "?"} (${ws.plan || "free"})`
+      : `Signed in: ${ctx.ui.bold(email)}  ·  workspace: ${ws.name || "?"} (${ws.plan || "free"})`);
+    return 0;
+  }
+  ctx.out(ko
+    ? "세션이 만료되었거나 유효하지 않습니다. `agentlas login`으로 다시 로그인하세요."
+    : "The session is expired or invalid. Sign in again with agentlas login.");
+  return 1;
+}
+
+module.exports = { run };

package/engine/commands/workforce.cjs

@@ -0,0 +1,103 @@
+"use strict";
+/*
+ * commands/workforce — `agentlas workforce|network|taskforce <request>`.
+ *
+ * v1 모놀리스 디스패치(legacy-v1-engine-snapshot, engine/agentlas.cjs 13149행)의 포팅:
+ *   case workforce/network/taskforce → workforce().cmdWorkforce(db, rest,
+ *     runtimeOverride, { cwd, projectPath, permission })
+ *
+ * 라우팅 불변식: 이 표면은 Agent Workforce Ontology 전용 fail-closed 경로다.
+ * 어휘 라우터/hep-network 로 조용히 폴백하지 않는다. legacy-network 는 v1에서
+ * parity().cmdHep(["hep-network", ...]) 호환 탈출구였는데, 그 parity 모듈이 아직
+ * v2에 없으므로 정직 정지로 안내만 한다(가짜 성공 금지).
+ *
+ * projectPath 에 대한 정직한 메모: v1은 ensureTerminalProjectForExecutionCli(db,
+ * cwd, permission, "terminal-workforce")로 프로젝트 상태 머신을 돌려 활성 프로젝트
+ * 경로를 만들었다. 그 프로젝트-상태 기계(폴더 방문 기록/활성화 판정)는 아직 v2로
+ * 포팅되지 않았다. cmdWorkforce 가 projectPath 를 쓰는 곳은 buildChildEnv 의
+ * 프로젝트 dotenv 스코핑뿐이고(agentlas-workforce.cjs 1926행) 부재 시 fail-closed
+ * 의존이 없음을 확인했다 — 그래서 여기서는 cwd 를 projectPath 로 넘긴다(같은 폴더
+ * 의 .env/.env.local 이 비신뢰 소스로 한 번 더 스캔될 뿐, 권한이 넓어지지 않는다).
+ * 프로젝트-상태 모듈이 v2에 착륙하면 이 자리를 그 결과로 교체한다.
+ */
+const { workforceRuntime } = require("../workforce/deps.cjs");
+const { projectCwd } = require("../workforce/capture.cjs");
+
+function resolvePermission(ctx) {
+  // v1 resolveTerminalPermission 포팅: 저장된 `full` 은 세션 한정 계약이라
+  // persistent()가 fail-closed 로 강등한다.
+  try {
+    const policy = require("../agentlas-permissions.cjs");
+    return policy.persistent(ctx && ctx.prefs && ctx.prefs.permission, "write");
+  } catch {
+    return "write";
+  }
+}
+
+/** `--runtime <kind>` 만 명령 자체 플래그로 벗겨낸다. 나머지는 cmdWorkforce 가 파싱. */
+function splitRuntimeOverride(args) {
+  const rest = [];
+  let runtimeOverride = null;
+  for (let i = 0; i < args.length; i += 1) {
+    if (args[i] === "--runtime" && args[i + 1]) {
+      runtimeOverride = String(args[++i]);
+      continue;
+    }
+    rest.push(args[i]);
+  }
+  return { rest, runtimeOverride };
+}
+
+/**
+ * command 별 디스패치. commands/index.cjs 는 명령 이름을 별도 인자로 넘기지 않으므로
+ * run()이 기본 "workforce" 로 진입하고, 별칭 배선 시 이 dispatch 를 직접 쓴다.
+ */
+async function dispatch(ctx, command, args) {
+  switch (command) {
+    case "workforce":
+    case "network":
+    case "taskforce": {
+      const { rest, runtimeOverride } = splitRuntimeOverride(args);
+      // usage 경로(작업 텍스트 없음)는 SQLite를 열 이유가 없다 — cmdWorkforce 의
+      // parseArgs 와 동일한 판정: 플래그가 아닌 토큰이 하나도 없으면 빈 작업이다.
+      const hasTask = rest.some((token, i) =>
+        !["--benchmark", "--json", "--parallel", "-n"].includes(String(token))
+        && !(i > 0 && ["--parallel", "-n"].includes(String(rest[i - 1]))));
+      if (!hasTask) {
+        ctx.err("usage: agentlas workforce <task> [--parallel N] [--benchmark] [--json] [--runtime <kind>]");
+        return 1;
+      }
+      const db = ctx.db();
+      const cwd = projectCwd();
+      const permission = resolvePermission(ctx);
+      const runtime = workforceRuntime({ lang: ctx.lang, out: ctx.out });
+      const result = await runtime.cmdWorkforce(db, rest, runtimeOverride, {
+        cwd,
+        // v1 ensureTerminalProjectForExecutionCli 미포팅 — 위 파일 머리 주석 참조.
+        projectPath: cwd,
+        permission,
+      });
+      return result && result.ok ? 0 : 1;
+    }
+    case "legacy-network": {
+      // v1의 명시적 호환 탈출구(parity cmdHep → hep-network)는 아직 v2에 없다.
+      // 조용히 workforce 로 대체 실행하지 않는다 — 두 경로는 라우팅 권한 모델이 다르다.
+      ctx.err(
+        "'legacy-network' (hep-network compatibility) is not wired into the v2 engine yet.\n" +
+        "Use `agentlas workforce <request>` for the fail-closed Agent Workforce Ontology route,\n" +
+        "or the v1 build: git tag legacy-v1-engine-snapshot.",
+      );
+      return 1;
+    }
+    default: {
+      ctx.err(`unknown workforce command: ${command}`);
+      return 1;
+    }
+  }
+}
+
+function run(ctx, args) {
+  return dispatch(ctx, "workforce", args);
+}
+
+module.exports = { run, dispatch };

package/engine/core/db.cjs

@@ -0,0 +1,160 @@
+"use strict";
+/*
+ * core/db — 공유 SQLite(데스크탑과 동일 DB) 열기 + 드라이버 사다리 + 빌트인 시드.
+ *
+ * 드라이버: better-sqlite3(네이티브, optionalDependency) → node:sqlite(Node 22.5+).
+ * 두 드라이버 모두 prepare().get/all/run 표면이 같으므로 얇은 어댑터만 둔다.
+ * 스키마 소유권: 정본 스키마는 데스크탑 앱. 터미널은 bootstrap-schema.sql로
+ * 첫 부트스트랩만 하고(런처가 수행), 이후 마이그레이션은 앱이 한다.
+ * 터미널은 "있으면 쓰는" 방어적 열 확인(columnExists)으로만 전진 호환한다.
+ */
+const fs = require("node:fs");
+const { configureSqliteConnection } = require("../agentlas-sqlite-policy.cjs");
+const { parseSemVer, compareSemVer } = require("../semver.cjs");
+const { dbPath } = require("./paths.cjs");
+
+function loadNodeSqliteQuietly() {
+  const originalEmitWarning = process.emitWarning;
+  process.emitWarning = function agentlasSqliteWarningFilter(warning, ...args) {
+    const message = typeof warning === "string" ? warning : String((warning && warning.message) || warning || "");
+    const type = typeof args[0] === "string" ? args[0] : "";
+    if (type === "ExperimentalWarning" && /SQLite/i.test(message)) return;
+    if (/SQLite is an experimental feature/i.test(message)) return;
+    return originalEmitWarning.call(process, warning, ...args);
+  };
+  try {
+    return require("node:sqlite");
+  } finally {
+    process.emitWarning = originalEmitWarning;
+  }
+}
+
+function openRaw(file) {
+  try {
+    const Database = require("better-sqlite3");
+    const db = new Database(file);
+    configureSqliteConnection(db);
+    db.__driver = "better-sqlite3";
+    return db;
+  } catch { /* optional dep 미설치/ABI 불일치 → node:sqlite */ }
+  const { DatabaseSync } = loadNodeSqliteQuietly();
+  const db = new DatabaseSync(file);
+  configureSqliteConnection(db);
+  db.__driver = "node:sqlite";
+  return db;
+}
+
+/**
+ * DB 파일이 없으면 하드 실패한다. 부트스트랩은 런처(bin/agentlas.cjs)의 책임 —
+ * 엔진이 임의 경로에 빈 DB를 만들면 데스크탑과의 공유 계약이 조용히 깨진다.
+ */
+function openDb() {
+  const file = dbPath();
+  if (!fs.existsSync(file)) {
+    throw new Error(`Agentlas database not found: ${file} (run via bin/agentlas.cjs)`);
+  }
+  return openRaw(file);
+}
+
+function tableExists(db, name) {
+  try { return !!db.prepare("SELECT 1 FROM sqlite_master WHERE type='table' AND name=?").get(name); } catch { return false; }
+}
+
+function columnExists(db, table, col) {
+  try { return db.prepare(`PRAGMA table_info(${table})`).all().some((c) => c.name === col); } catch { return false; }
+}
+
+function runWriteTransaction(db, fn) {
+  db.exec("BEGIN IMMEDIATE");
+  try {
+    const result = fn();
+    db.exec("COMMIT");
+    return result;
+  } catch (e) {
+    try { db.exec("ROLLBACK"); } catch { /* already rolled back */ }
+    throw e;
+  }
+}
+
+// ── 빌트인 아키텍처 시드 (데스크탑 seedBuiltinAgents와 동일 멱등·버전 게이팅) ──
+let _arch = null;
+function loadArch() {
+  if (_arch) return _arch;
+  try {
+    _arch = require("../architecture.data.json");
+  } catch {
+    _arch = { version: "0", agents: [] };
+  }
+  return _arch;
+}
+
+/**
+ * 설치본 시드 버전이 번들보다 최신이거나 파싱 불가면 fail-closed(덮어쓰기 금지):
+ * 더 새로운 데스크탑이 심은 공유 데이터를 옛 터미널이 되감으면 안 된다.
+ */
+function shouldApplyBuiltinArchitectureSeed(installedVersion, bundleVersion, installedCount, bundleCount) {
+  if (!parseSemVer(bundleVersion)) return false;
+  if (installedVersion == null || installedVersion === "") return true;
+  const precedence = compareSemVer(installedVersion, bundleVersion);
+  if (precedence == null || precedence > 0) return false;
+  if (precedence < 0) return true;
+  const have = Number.isSafeInteger(Number(installedCount)) ? Number(installedCount) : 0;
+  const expected = Number.isSafeInteger(Number(bundleCount)) ? Number(bundleCount) : 0;
+  return have < expected;
+}
+
+function seedBuiltins(db) {
+  const arch = loadArch();
+  if (!arch.agents || !arch.agents.length) return;
+  if (!tableExists(db, "meta") || !columnExists(db, "installed_agents", "builtin")) return;
+  const now = new Date().toISOString();
+  try {
+    runWriteTransaction(db, () => {
+      const installed = db.prepare("SELECT value FROM meta WHERE key='architecture_version'").get();
+      const have = db.prepare("SELECT COUNT(*) AS n FROM installed_agents WHERE builtin=1").get();
+      if (!shouldApplyBuiltinArchitectureSeed(
+        installed ? installed.value : null,
+        arch.version,
+        have ? have.n : 0,
+        arch.agents.length,
+      )) return false;
+      const hasVisibility = columnExists(db, "installed_agents", "visibility");
+      for (const def of arch.agents) {
+        const visibility = def.visibility || "background";
+        const existing = db.prepare("SELECT id FROM installed_agents WHERE id=? OR slug=?").get(def.id, def.slug);
+        if (existing) {
+          if (hasVisibility) {
+            db.prepare(
+              "UPDATE installed_agents SET name=?, name_en=?, tagline=?, tagline_en=?, system_prompt=?, tone=?, role=?, builtin=1, trust_grade='A', visibility=? WHERE id=?",
+            ).run(def.name, def.nameEn, def.tagline, def.taglineEn, def.systemPrompt, def.tone, def.role, visibility, existing.id);
+          } else {
+            db.prepare(
+              "UPDATE installed_agents SET name=?, name_en=?, tagline=?, tagline_en=?, system_prompt=?, tone=?, role=?, builtin=1, trust_grade='A' WHERE id=?",
+            ).run(def.name, def.nameEn, def.tagline, def.taglineEn, def.systemPrompt, def.tone, def.role, existing.id);
+          }
+        } else if (hasVisibility) {
+          db.prepare(
+            "INSERT INTO installed_agents (id, slug, name, name_en, tagline, tagline_en, system_prompt, mcp_servers_json, env_requirements_json, preferred_backend, trust_grade, installed_at, tone, builtin, role, visibility) VALUES (?,?,?,?,?,?,?,'[]','[]',NULL,'A',?,?,1,?,?)",
+          ).run(def.id, def.slug, def.name, def.nameEn, def.tagline, def.taglineEn, def.systemPrompt, now, def.tone, def.role, visibility);
+        } else {
+          db.prepare(
+            "INSERT INTO installed_agents (id, slug, name, name_en, tagline, tagline_en, system_prompt, mcp_servers_json, env_requirements_json, preferred_backend, trust_grade, installed_at, tone, builtin, role) VALUES (?,?,?,?,?,?,?,'[]','[]',NULL,'A',?,?,1,?)",
+          ).run(def.id, def.slug, def.name, def.nameEn, def.tagline, def.taglineEn, def.systemPrompt, now, def.tone, def.role);
+        }
+      }
+      db.prepare("INSERT INTO meta(key,value) VALUES('architecture_version',?) ON CONFLICT(key) DO UPDATE SET value=excluded.value").run(arch.version);
+      return true;
+    });
+  } catch { /* best-effort: 앱이 마이그레이션 중이면 다음 실행에서 재시도 */ }
+}
+
+module.exports = {
+  openDb,
+  openRaw,
+  tableExists,
+  columnExists,
+  runWriteTransaction,
+  seedBuiltins,
+  shouldApplyBuiltinArchitectureSeed,
+  loadArch,
+};

package/engine/core/paths.cjs

@@ -0,0 +1,35 @@
+"use strict";
+/*
+ * core/paths — 모든 경로 규칙의 단일 정본.
+ * bin/agentlas.cjs(런처)의 userDataDir 규칙과 반드시 동일해야 한다:
+ * 데스크탑 앱과 같은 userData를 공유하는 것이 제품 계약이다.
+ */
+const os = require("node:os");
+const path = require("node:path");
+
+function userDataDir() {
+  const override = process.env.AGENTLAS_USER_DATA_DIR;
+  if (override) return override;
+  const home = os.homedir();
+  if (process.platform === "darwin") return path.join(home, "Library", "Application Support", "Agentlas");
+  if (process.platform === "win32") return path.join(process.env.APPDATA || path.join(home, "AppData", "Roaming"), "Agentlas");
+  return path.join(process.env.XDG_CONFIG_HOME || path.join(home, ".config"), "Agentlas");
+}
+
+function dbPath() {
+  return path.join(userDataDir(), "agentlas.sqlite");
+}
+
+function terminalConfigPath() {
+  return path.join(userDataDir(), "terminal-config.json");
+}
+
+function engineRoot() {
+  return path.dirname(__dirname);
+}
+
+function packageRoot() {
+  return path.dirname(engineRoot());
+}
+
+module.exports = { userDataDir, dbPath, terminalConfigPath, engineRoot, packageRoot };

package/engine/experience/build.cjs

@@ -0,0 +1,181 @@
+"use strict";
+
+/*
+ * experience/build — /build 공용 핸들러 (REPL·상위 build 명령이 같은 코드를 호출).
+ *
+ * v1 engine/agentlas-experience-mcp.cjs의 cmdBuild/parseBuildArgs/
+ * tokenizeBuildCommandLine 슬라이스를 이식했다. MCP 계획·동의·런타임
+ * allowlist는 v2 engine/mcp/* 서브시스템을 "소비만" 한다(재구현 금지).
+ *
+ * 계약(v1 그대로):
+ *  - MCP는 시스템 전역 레지스트리 메타데이터에서만 해소한다. 네트워크 발견/설치
+ *    폴백 없음. 부족(shortage)은 빌드를 중단시키지 않고 능력별로 degrade한다.
+ *  - 로컬 Experience 자문은 exact base release + 정확히 1개 pack release +
+ *    task signature가 모두 명시된 때에만 붙는다. 서버 rental-resolution
+ *    영수증을 로컬에서 주장하지 않는다.
+ */
+
+const mcp = require("../mcp/index.cjs");
+const { assertId } = require("./intents.cjs");
+
+function parseIdList(value) {
+  if (!value || value === true) return [];
+  return [...new Set(String(value).split(",").map((item) => item.trim()).filter(Boolean))];
+}
+
+function tokenizeBuildCommandLine(value) {
+  const tokens = [];
+  let current = "";
+  let quote = null;
+  const source = String(value || "");
+  for (let index = 0; index < source.length; index += 1) {
+    const char = source[index];
+    if (char === "\\" && quote !== "'") {
+      const next = source[index + 1];
+      if (next && (/\s/.test(next) || next === "\\" || next === '"' || next === "'")) {
+        current += next;
+        index += 1;
+      } else {
+        // Windows 경로/일반 백슬래시 보존. 이 파서는 토큰 묶기에 필요한
+        // 이스케이프만 소비하며 셸 확장/명령 치환은 절대 적용하지 않는다.
+        current += "\\";
+      }
+      continue;
+    }
+    if (quote) {
+      if (char === quote) quote = null;
+      else current += char;
+      continue;
+    }
+    if (char === '"' || char === "'") {
+      quote = char;
+      continue;
+    }
+    if (/\s/.test(char)) {
+      if (current) tokens.push(current), (current = "");
+      continue;
+    }
+    current += char;
+  }
+  if (quote) throw new Error("unterminated quote in /build command");
+  if (current) tokens.push(current);
+  return tokens;
+}
+
+function parseBuildArgs(args) {
+  const buildArgs = args;
+  const options = {
+    task: [], requiredIds: [], recommendedIds: [], approvedIds: [],
+    experienceTaskSignatures: [], experienceEnvironmentTags: [],
+    experiencePackReleaseIds: [], experienceBaseReleaseId: null, experienceAgentDefinitionId: null,
+    approveAll: false, noMcp: false, noExperience: false, planOnly: false, json: false,
+  };
+  for (let index = 0; index < buildArgs.length; index += 1) {
+    const token = String(buildArgs[index]);
+    const take = () => (index + 1 < buildArgs.length ? String(buildArgs[++index]) : "");
+    if (token === "--mcp-plan-only") options.planOnly = true;
+    else if (token === "--mcp-json") options.json = true;
+    else if (token === "--approve-all-mcp") options.approveAll = true;
+    else if (token === "--no-mcp") options.noMcp = true;
+    else if (token === "--no-experience") options.noExperience = true;
+    else if (token === "--experience-base-release") options.experienceBaseReleaseId = take();
+    else if (token.startsWith("--experience-base-release=")) options.experienceBaseReleaseId = token.slice(26);
+    else if (token === "--experience-pack-release") options.experiencePackReleaseIds.push(...parseIdList(take()));
+    else if (token.startsWith("--experience-pack-release=")) options.experiencePackReleaseIds.push(...parseIdList(token.slice(26)));
+    else if (token === "--experience-agent-definition") options.experienceAgentDefinitionId = take();
+    else if (token.startsWith("--experience-agent-definition=")) options.experienceAgentDefinitionId = token.slice(30);
+    else if (token === "--experience-task-signature") options.experienceTaskSignatures.push(...parseIdList(take()));
+    else if (token.startsWith("--experience-task-signature=")) options.experienceTaskSignatures.push(...parseIdList(token.slice(28)));
+    else if (token === "--experience-environment") options.experienceEnvironmentTags.push(...parseIdList(take()));
+    else if (token.startsWith("--experience-environment=")) options.experienceEnvironmentTags.push(...parseIdList(token.slice(25)));
+    else if (token === "--approve-mcp") options.approvedIds.push(...parseIdList(take()));
+    else if (token.startsWith("--approve-mcp=")) options.approvedIds.push(...parseIdList(token.slice(14)));
+    else if (token === "--require-mcp") options.requiredIds.push(...parseIdList(take()));
+    else if (token.startsWith("--require-mcp=")) options.requiredIds.push(...parseIdList(token.slice(14)));
+    else if (token === "--recommend-mcp") options.recommendedIds.push(...parseIdList(take()));
+    else if (token.startsWith("--recommend-mcp=")) options.recommendedIds.push(...parseIdList(token.slice(16)));
+    else options.task.push(token);
+  }
+  options.request = options.task.join(" ").trim();
+  options.requiredIds = [...new Set(options.requiredIds)];
+  options.recommendedIds = [...new Set(options.recommendedIds)];
+  options.approvedIds = [...new Set(options.approvedIds)];
+  options.experienceTaskSignatures = [...new Set(options.experienceTaskSignatures)];
+  options.experienceEnvironmentTags = [...new Set(options.experienceEnvironmentTags)];
+  options.experiencePackReleaseIds = [...new Set(options.experiencePackReleaseIds)];
+  if (options.experienceBaseReleaseId) assertId(options.experienceBaseReleaseId, "--experience-base-release");
+  if (options.experienceAgentDefinitionId) assertId(options.experienceAgentDefinitionId, "--experience-agent-definition");
+  options.experiencePackReleaseIds.forEach((id) => assertId(id, "--experience-pack-release"));
+  return options;
+}
+
+async function cmdBuild(options) {
+  const parsed = parseBuildArgs(options.args || []);
+  const emit = options.out || console.log;
+  const inventory = mcp.collectSystemMcpInventory(options.db, { userDataDir: options.userDataDir, env: options.env || process.env });
+  const policy = mcp.loadProjectMcpPolicy(options.cwd || process.cwd());
+  const plan = mcp.buildMcpPlan({
+    inventory, policy, request: parsed.request,
+    requiredIds: parsed.requiredIds, recommendedIds: parsed.recommendedIds,
+  });
+  emit(parsed.json ? JSON.stringify(plan, null, 2) : mcp.renderMcpPlan(plan));
+  if (parsed.planOnly) return { plan, approvedIds: [], invoked: false };
+
+  let approvedIds = [];
+  if (!parsed.noMcp) {
+    if (parsed.approveAll) approvedIds = [...plan.availableCatalogIds];
+    else if (parsed.approvedIds.length) approvedIds = mcp.normalizeConsentAnswer(parsed.approvedIds.join(","), plan.availableCatalogIds);
+    else approvedIds = await mcp.askMcpConsentOnce(plan, { input: options.input, output: options.promptOutput });
+  }
+  approvedIds = mcp.fitApprovedMcpIds(plan, approvedIds);
+  const runtimeAllowlist = await mcp.resolveApprovedMcpRuntimeAllowlist({
+    db: options.db,
+    plan,
+    approvedIds,
+    cwd: options.cwd || process.cwd(),
+    userDataDir: options.userDataDir,
+    env: options.runtimeEnv || options.env || process.env,
+    probeServer: options.probeMcpServer,
+  });
+  const attachedIds = runtimeAllowlist.attached.map((item) => item.catalogId);
+  const directive = mcp.buildMcpDirective(plan, attachedIds);
+  let experienceContext = { text: "", itemIds: [], estimatedTokens: 0, authority: "local-advisory", serverRentalResolutionReceiptPresent: false };
+  if (
+    !parsed.noExperience &&
+    parsed.experienceBaseReleaseId &&
+    parsed.experienceTaskSignatures.length &&
+    parsed.experiencePackReleaseIds.length === 1
+  ) {
+    const exchange = require("../agentlas-experience-exchange.cjs");
+    experienceContext = exchange.buildLocalExperienceAdvisory({
+      userDataDir: options.userDataDir,
+      cwd: options.cwd || process.cwd(),
+      baseAgentReleaseId: parsed.experienceBaseReleaseId,
+      agentDefinitionId: parsed.experienceAgentDefinitionId,
+      experiencePackReleaseIds: parsed.experiencePackReleaseIds,
+      taskSignatures: parsed.experienceTaskSignatures,
+      environmentTags: parsed.experienceEnvironmentTags.length
+        ? parsed.experienceEnvironmentTags
+        : exchange.defaultEnvironmentTags(),
+    });
+  }
+  const builderRequest = [parsed.request, directive, experienceContext.text].filter(Boolean).join("\n\n");
+  if (typeof options.invokeBuild === "function") {
+    await options.invokeBuild(builderRequest, {
+      plan,
+      approvedIds,
+      experienceContext,
+      mcpRuntimeAllowlist: runtimeAllowlist,
+      mcpServers: runtimeAllowlist.servers,
+    });
+  }
+  emit(mcp.renderBuildMcpResult(plan, approvedIds, runtimeAllowlist));
+  if (experienceContext.itemIds.length) emit(`Local Experience advisory attached: ${experienceContext.itemIds.length} item(s), ~${experienceContext.estimatedTokens} tokens · no server rental-resolution receipt.`);
+  return { plan, approvedIds, mcpRuntimeAllowlist: runtimeAllowlist, experienceContext, invoked: typeof options.invokeBuild === "function" };
+}
+
+module.exports = {
+  tokenizeBuildCommandLine,
+  parseBuildArgs,
+  cmdBuild,
+};