cli-jaw 1.7.10 → 1.7.11

package/dist/src/routes/orchestrate.js

@@ -4,10 +4,12 @@ import { getLiveRun } from '../agent/live-run-state.js';
 import { orchestrateContinue, orchestrateReset } from '../orchestrator/pipeline.js';
 import { getState, getCtx, setState, resetState, canTransition } from '../orchestrator/state-machine.js';
 import { resolveOrcScope } from '../orchestrator/scope.js';
-import { getActiveWorkers, claimWorker, finishWorker, failWorker, markWorkerReplayed } from '../orchestrator/worker-registry.js';
+import { getActiveWorkers, claimWorker, finishWorker, failWorker, markWorkerReplayed, getWorkerSlot, WorkerBusyError } from '../orchestrator/worker-registry.js';
 import { findEmployee, runSingleAgent } from '../orchestrator/distribute.js';
 import { getEmployees } from '../core/db.js';
 import { settings } from '../core/config.js';
+import { verifyBossToken } from '../core/boss-auth.js';
+import { resolveDispatchableEmployee, checkRuntimeHints } from '../core/employees.js';
 function getRuntimeSnapshot() {
     return {
         uptimeSec: Math.floor(process.uptime()),
@@ -56,8 +58,12 @@ export function registerOrchestrateRoutes(app, requireAuth) {
     });
     // Pipe-mode employee dispatch
     app.post('/api/orchestrate/dispatch', requireAuth, async (req, res) => {
-        if (String(req.headers['x-jaw-dispatch-source'] || '').toLowerCase() === 'employee') {
-            return fail(res, 409, 'Employee self-dispatch is blocked in employee sessions');
+        // Phase 8: server-authoritative dispatch guard. Boss-only token required.
+        // Employees do not have this token (stripped in spawn.ts makeCleanEnv).
+        const bossToken = String(req.headers['x-jaw-boss-token'] || '');
+        if (!verifyBossToken(bossToken)) {
+            console.warn(`[dispatch:deny] ip=${req.ip} ua=${String(req.headers['user-agent'] || '').slice(0, 80)}`);
+            return fail(res, 403, 'Dispatch requires boss-scoped token. Employees cannot dispatch.');
         }
         const { agent: agentName, task, phase } = req.body || {};
         if (!agentName || !task)
@@ -67,10 +73,59 @@ export function registerOrchestrateRoutes(app, requireAuth) {
         const currentOrcState = getState(dispatchScope);
         const resolvedPhase = phase ?? PABCD_PHASE_MAP[currentOrcState] ?? 3;
         const emps = getEmployees.all();
-        const emp = findEmployee(emps, { agent: agentName });
+        // Try DB first (preserves existing id-based matching), then fall
+        // through to static employees for entries like Control.
+        let emp = findEmployee(emps, { agent: agentName });
+        let staticSpec = null;
+        if (!emp) {
+            staticSpec = resolveDispatchableEmployee(agentName, emps);
+            if (staticSpec)
+                emp = staticSpec.row;
+        }
+        else {
+            staticSpec = resolveDispatchableEmployee(emp.name, emps);
+        }
         if (!emp)
             return fail(res, 404, `Employee not found: ${agentName}`);
-        const slot = claimWorker(emp, task);
+        // Runtime preflight for static employees (darwin/CUA/Jaw.app).
+        // Hard-fail on missing prerequisites; warn-only on optional ones.
+        if (staticSpec?.spec) {
+            const checks = checkRuntimeHints(staticSpec.spec);
+            if (checks.fail.length > 0) {
+                return fail(res, 412, `Preconditions not met: ${checks.fail.join('; ')}`);
+            }
+            for (const w of checks.warn)
+                console.warn(`[dispatch] ⚠️  ${w}`);
+        }
+        // Phase 7-2: reject concurrent dispatch of the same employee.
+        // Caller should poll GET /api/orchestrate/worker/:agentId/result.
+        let slot;
+        try {
+            slot = claimWorker(emp, task);
+        }
+        catch (err) {
+            if (err instanceof WorkerBusyError) {
+                return res.status(409).json({
+                    ok: false,
+                    error: 'worker_busy',
+                    existing: {
+                        agentId: err.existing.agentId,
+                        employeeName: err.existing.employeeName,
+                        task: err.existing.task.slice(0, 200),
+                        startedAt: err.existing.startedAt,
+                    },
+                    hint: 'Poll GET /api/orchestrate/worker/:agentId/result for the in-flight run.',
+                });
+            }
+            throw err;
+        }
+        // Phase 7-1: detect client disconnect so we keep pendingReplay=true
+        // (so the next boss turn can drain the result) instead of discarding.
+        let clientDisconnected = false;
+        req.on('close', () => {
+            if (!res.writableEnded)
+                clientDisconnected = true;
+        });
         try {
             const ap = {
                 agent: emp.name, role: emp.role || 'general developer',
@@ -80,13 +135,37 @@ export function registerOrchestrateRoutes(app, requireAuth) {
             };
             const result = await runSingleAgent(ap, emp, {}, 1, { origin: 'api' }, []);
             finishWorker(slot.agentId, result.text || '');
-            markWorkerReplayed(slot.agentId);
+            if (clientDisconnected) {
+                console.warn(`[dispatch] client disconnected — keeping pendingReplay for ${slot.agentId}`);
+                // pendingReplay stays true; next boss orchestrate() call drains it.
+                return;
+            }
+            // Only clear replay flag after response is actually flushed to client.
+            res.on('finish', () => markWorkerReplayed(slot.agentId));
             res.json({ ok: true, result });
         }
         catch (err) {
             failWorker(slot.agentId, err.message);
-            res.status(500).json({ ok: false, error: err.message });
+            if (!res.writableEnded)
+                res.status(500).json({ ok: false, error: err.message });
+        }
+    });
+    // Phase 7-4: explicit result polling for 409 retries and reconnects.
+    app.get('/api/orchestrate/worker/:agentId/result', requireAuth, (req, res) => {
+        const agentId = String(req.params.agentId || '');
+        if (!agentId)
+            return fail(res, 400, 'missing agentId');
+        const slot = getWorkerSlot(agentId);
+        if (!slot)
+            return fail(res, 404, 'worker not found');
+        if (slot.state === 'running') {
+            return res.json({ ok: true, state: 'running', startedAt: slot.startedAt, task: slot.task });
+        }
+        // Consume pending replay — subsequent polls will return 404.
+        if (slot.state === 'done' && slot.pendingReplay) {
+            markWorkerReplayed(slot.agentId);
         }
+        return res.json({ ok: true, state: slot.state, result: slot.result });
     });
     app.put('/api/orchestrate/state', requireAuth, (req, res) => {
         const target = String(req.body?.state || '').toUpperCase();

package/dist/src/routes/orchestrate.js.map

@@ -1 +1 @@
-{"version":3,"file":"orchestrate.js","sourceRoot":"","sources":["../../../src/routes/orchestrate.ts"],"names":[],"mappings":"AAEA,OAAO,EAAM,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,gCAAgC,EAAE,MAAM,mBAAmB,CAAC;AAChG,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AACpF,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AAEzG,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACjI,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE7C,SAAS,kBAAkB;IACvB,OAAO;QACH,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACvC,WAAW,EAAE,WAAW,EAAE;QAC1B,YAAY,EAAE,YAAY,CAAC,MAAM;KACpC,CAAC;AACN,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,GAAY,EAAE,WAA2B;IAC/E,GAAG,CAAC,IAAI,CAAC,2BAA2B,EAAE,WAAW,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC5D,IAAI,WAAW,EAAE,EAAE,CAAC;YAChB,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,mBAAmB,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACvC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,wBAAwB,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC/D,IAAI,CAAC;YACD,MAAM,gBAAgB,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1C,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAC;YAChD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5D,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC5C,MAAM,KAAK,GAAG,eAAe,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC,CAAC;QAC1F,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,0BAA0B,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC9C,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,2BAA2B,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC/C,MAAM,OAAO,GAAG,kBAAkB,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,eAAe,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC,CAAC;QAC1F,GAAG,CAAC,IAAI,CAAC;YACL,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE;YAC1D,OAAO,EAAE;gBACL,GAAG,OAAO;gBACV,IAAI,EAAE,OAAO,CAAC,WAAW,IAAI,gBAAgB,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC;aACnF;YACD,OAAO,EAAE,gBAAgB,EAAE;YAC3B,MAAM,EAAE,gCAAgC,CAAC,KAAK,CAAC;YAC/C,SAAS,EAAE,UAAU,CAAC,KAAK,CAAC;SAC/B,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,8BAA8B;IAC9B,GAAG,CAAC,IAAI,CAAC,2BAA2B,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAClE,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,uBAAuB,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,UAAU,EAAE,CAAC;YAClF,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,wDAAwD,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QACzD,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,uBAAuB,CAAC,CAAC;QAExE,MAAM,eAAe,GAA2B,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;QACrE,MAAM,aAAa,GAAG,eAAe,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC,CAAC;QAClG,MAAM,eAAe,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC;QAChD,MAAM,aAAa,GAAG,KAAK,IAAI,eAAe,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAErE,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,EAA2B,CAAC;QACzD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,uBAAuB,SAAS,EAAE,CAAC,CAAC;QAEpE,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC;YACD,MAAM,EAAE,GAAG;gBACP,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,mBAAmB;gBACtD,IAAI,EAAE,QAAQ,EAAE,KAAK;gBACrB,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC;gBAC/C,YAAY,EAAE,CAAC,aAAa,CAAC;aAChC,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;YAC3E,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;YAC9C,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACjC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAChB,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YACtC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5D,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,WAAW,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACxD,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAC3D,MAAM,KAAK,GAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACxD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAsB,CAAC,EAAE,CAAC;YAC1C,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,kBAAkB,MAAM,qBAAqB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,KAAK,GAAG,eAAe,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC,CAAC;QAC1F,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,CAAC,GAAG,MAAsB,CAAC;QACjC,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,sBAAsB,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACZ,QAAQ,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YACtC,UAAU,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;aAAM,CAAC;YACJ,QAAQ,CACJ,CAAC,EACD,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,IAAI,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,EACrI,KAAK,EACL,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CACtB,CAAC;QACN,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"orchestrate.js","sourceRoot":"","sources":["../../../src/routes/orchestrate.ts"],"names":[],"mappings":"AAEA,OAAO,EAAM,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,gCAAgC,EAAE,MAAM,mBAAmB,CAAC;AAChG,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AACpF,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AAEzG,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,kBAAkB,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AACjK,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,2BAA2B,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAEtF,SAAS,kBAAkB;IACvB,OAAO;QACH,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACvC,WAAW,EAAE,WAAW,EAAE;QAC1B,YAAY,EAAE,YAAY,CAAC,MAAM;KACpC,CAAC;AACN,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,GAAY,EAAE,WAA2B;IAC/E,GAAG,CAAC,IAAI,CAAC,2BAA2B,EAAE,WAAW,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC5D,IAAI,WAAW,EAAE,EAAE,CAAC;YAChB,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,mBAAmB,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACvC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,wBAAwB,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC/D,IAAI,CAAC;YACD,MAAM,gBAAgB,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1C,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAC;YAChD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5D,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC5C,MAAM,KAAK,GAAG,eAAe,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC,CAAC;QAC1F,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,0BAA0B,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC9C,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,2BAA2B,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC/C,MAAM,OAAO,GAAG,kBAAkB,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,eAAe,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC,CAAC;QAC1F,GAAG,CAAC,IAAI,CAAC;YACL,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE;YAC1D,OAAO,EAAE;gBACL,GAAG,OAAO;gBACV,IAAI,EAAE,OAAO,CAAC,WAAW,IAAI,gBAAgB,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC;aACnF;YACD,OAAO,EAAE,gBAAgB,EAAE;YAC3B,MAAM,EAAE,gCAAgC,CAAC,KAAK,CAAC;YAC/C,SAAS,EAAE,UAAU,CAAC,KAAK,CAAC;SAC/B,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,8BAA8B;IAC9B,GAAG,CAAC,IAAI,CAAC,2BAA2B,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAClE,0EAA0E;QAC1E,wEAAwE;QACxE,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,IAAI,CAAC,sBAAsB,GAAG,CAAC,EAAE,OAAO,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;YACxG,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,iEAAiE,CAAC,CAAC;QAC7F,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QACzD,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,uBAAuB,CAAC,CAAC;QAExE,MAAM,eAAe,GAA2B,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;QACrE,MAAM,aAAa,GAAG,eAAe,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC,CAAC;QAClG,MAAM,eAAe,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC;QAChD,MAAM,aAAa,GAAG,KAAK,IAAI,eAAe,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAErE,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,EAA2B,CAAC;QACzD,iEAAiE;QACjE,wDAAwD;QACxD,IAAI,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACnD,IAAI,UAAU,GAAmD,IAAI,CAAC;QACtE,IAAI,CAAC,GAAG,EAAE,CAAC;YACP,UAAU,GAAG,2BAA2B,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YAC1D,IAAI,UAAU;gBAAE,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;QACzC,CAAC;aAAM,CAAC;YACJ,UAAU,GAAG,2BAA2B,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,uBAAuB,SAAS,EAAE,CAAC,CAAC;QAEpE,+DAA+D;QAC/D,kEAAkE;QAClE,IAAI,UAAU,EAAE,IAAI,EAAE,CAAC;YACnB,MAAM,MAAM,GAAG,iBAAiB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAClD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzB,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,0BAA0B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC9E,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI;gBAAE,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;QACrE,CAAC;QAED,8DAA8D;QAC9D,kEAAkE;QAClE,IAAI,IAAI,CAAC;QACT,IAAI,CAAC;YACD,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,IAAI,GAAG,YAAY,eAAe,EAAE,CAAC;gBACjC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACxB,EAAE,EAAE,KAAK;oBACT,KAAK,EAAE,aAAa;oBACpB,QAAQ,EAAE;wBACN,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO;wBAC7B,YAAY,EAAE,GAAG,CAAC,QAAQ,CAAC,YAAY;wBACvC,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;wBACrC,SAAS,EAAE,GAAG,CAAC,QAAQ,CAAC,SAAS;qBACpC;oBACD,IAAI,EAAE,yEAAyE;iBAClF,CAAC,CAAC;YACP,CAAC;YACD,MAAM,GAAG,CAAC;QACd,CAAC;QAED,oEAAoE;QACpE,sEAAsE;QACtE,IAAI,kBAAkB,GAAG,KAAK,CAAC;QAC/B,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACjB,IAAI,CAAC,GAAG,CAAC,aAAa;gBAAE,kBAAkB,GAAG,IAAI,CAAC;QACtD,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC;YACD,MAAM,EAAE,GAAG;gBACP,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,mBAAmB;gBACtD,IAAI,EAAE,QAAQ,EAAE,KAAK;gBACrB,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC;gBAC/C,YAAY,EAAE,CAAC,aAAa,CAAC;aAChC,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;YAC3E,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;YAC9C,IAAI,kBAAkB,EAAE,CAAC;gBACrB,OAAO,CAAC,IAAI,CAAC,8DAA8D,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC3F,oEAAoE;gBACpE,OAAO;YACX,CAAC;YACD,uEAAuE;YACvE,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YACzD,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAChB,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YACtC,IAAI,CAAC,GAAG,CAAC,aAAa;gBAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACpF,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,qEAAqE;IACrE,GAAG,CAAC,GAAG,CAAC,yCAAyC,EAAE,WAAW,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACzE,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACrD,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAChG,CAAC;QACD,6DAA6D;QAC7D,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YAC9C,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACrC,CAAC;QACD,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,WAAW,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACxD,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAC3D,MAAM,KAAK,GAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACxD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAsB,CAAC,EAAE,CAAC;YAC1C,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,kBAAkB,MAAM,qBAAqB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,KAAK,GAAG,eAAe,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC,CAAC;QAC1F,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,CAAC,GAAG,MAAsB,CAAC;QACjC,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,sBAAsB,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACZ,QAAQ,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YACtC,UAAU,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;aAAM,CAAC;YACJ,QAAQ,CACJ,CAAC,EACD,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,IAAI,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,EACrI,KAAK,EACL,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CACtB,CAAC;QACN,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;AACP,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cli-jaw",
-  "version": "1.7.10",
+  "version": "1.7.11",
   "description": "Personal AI assistant powered by 5 engines (Claude, Codex, Gemini, OpenCode, Copilot) — Web, Terminal, Telegram, and Discord interfaces with 107 built-in skills",
   "type": "module",
   "keywords": [

package/scripts/darwin/spike-tcc-attribution.sh

@@ -0,0 +1,333 @@
+#!/bin/bash
+# spike-tcc-attribution.sh
+# 목적: macOS TCC가 `Jaw.app` bundle identity로 Automation 권한을 귀속시키는지 실측 검증.
+# 이 스크립트는 31/32 계획의 핵심 가정(shell-shim launcher → com.cli-jaw.agent 책임)을
+# 실제 하드웨어에서 확인한다. 계획을 B로 진입시키기 전 반드시 1회 이상 PASS해야 한다.
+#
+# 사용:
+#   bash scripts/darwin/spike-tcc-attribution.sh                # dry-run check
+#   bash scripts/darwin/spike-tcc-attribution.sh --build        # 임시 Jaw.app 번들 생성 후 검증
+#   bash scripts/darwin/spike-tcc-attribution.sh --cleanup      # 생성된 임시 번들 제거
+#
+# 출력 원칙:
+#   - 각 단계마다 PASS/FAIL을 찍고 실패 시 즉시 exit (fail-fast 규칙)
+#   - 마지막에 `RESULT=...` 한 줄을 찍어 호출자가 grep하기 쉽게 한다
+
+set -euo pipefail
+
+# ── Colors ──
+CYAN='\033[0;36m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; RED='\033[0;31m'
+DIM='\033[2m'; BOLD='\033[1m'; NC='\033[0m'
+info()  { echo -e "${CYAN}▸${NC} $*"; }
+ok()    { echo -e "${GREEN}✔${NC} $*"; }
+warn()  { echo -e "${YELLOW}⚠${NC} $*"; }
+fail()  { echo -e "${RED}✖${NC} $*"; echo "RESULT=FAIL"; exit 1; }
+
+if [[ "$(uname -s)" != "Darwin" ]]; then fail "macOS 전용"; fi
+
+MODE="${1:-check}"
+SPIKE_APP_DIR="/Applications/JawSpike.app"
+SPIKE_BUNDLE_ID="com.cli-jaw.spike"
+
+print_header() {
+  echo ""
+  echo -e "${CYAN}${BOLD}🔬 TCC Attribution Spike${NC}"
+  echo -e "${DIM}   검증: shell-shim launcher가 $SPIKE_BUNDLE_ID 로 귀속되는가${NC}"
+  echo ""
+}
+
+step_check_prereqs() {
+  info "1/6 전제 조건 점검"
+  command -v osascript >/dev/null || fail "osascript 없음"
+  [[ -d "/Applications/Google Chrome.app" ]] || fail "Google Chrome 미설치 — 설치 후 재시도"
+  command -v /usr/libexec/PlistBuddy >/dev/null || fail "PlistBuddy 없음"
+  ok "prereq OK"
+}
+
+step_probe_path_sources() {
+  info "2/6 CLI binary PATH 감지 (bun / npm-global / nvm)"
+  BUN_BIN_DIR=""
+  NPM_BIN_DIR=""
+  NVM_BIN_DIR=""
+  if command -v bun >/dev/null; then BUN_BIN_DIR="$(dirname "$(command -v bun)")"; fi
+  if command -v npm >/dev/null; then NPM_BIN_DIR="$(npm config get prefix 2>/dev/null)/bin"; fi
+  if [[ -n "${NVM_DIR:-}" && -d "$NVM_DIR" ]]; then
+    NVM_BIN_DIR="$(ls -dt "$NVM_DIR"/versions/node/*/bin 2>/dev/null | head -1 || true)"
+  fi
+
+  echo "   BUN:  ${BUN_BIN_DIR:-∅}"
+  echo "   NPM:  ${NPM_BIN_DIR:-∅}"
+  echo "   NVM:  ${NVM_BIN_DIR:-∅}"
+
+  # cli-jaw가 실제로 어디서 발견되는지
+  JAW_BIN="$(command -v cli-jaw || true)"
+  [[ -n "$JAW_BIN" ]] || fail "cli-jaw가 현재 PATH에 없음 — npm i -g cli-jaw 먼저"
+  JAW_BIN_DIR="$(dirname "$JAW_BIN")"
+  echo "   cli-jaw: $JAW_BIN"
+
+  # PATH 머지 (중복 제거, 존재하는 것만)
+  MERGED_PATH=""
+  for d in "$JAW_BIN_DIR" "$BUN_BIN_DIR" "$NPM_BIN_DIR" "$NVM_BIN_DIR" \
+           "/opt/homebrew/bin" "/usr/local/bin" "/usr/bin" "/bin"; do
+    [[ -z "$d" || ! -d "$d" ]] && continue
+    case ":$MERGED_PATH:" in *":$d:"*) ;; *) MERGED_PATH="${MERGED_PATH:+$MERGED_PATH:}$d";; esac
+  done
+  echo "   MERGED_PATH=$MERGED_PATH"
+  ok "PATH sources detected"
+}
+
+build_spike_app() {
+  info "3/6 임시 Jaw.app (JawSpike.app) 생성"
+  if [[ -d "$SPIKE_APP_DIR" ]]; then
+    warn "기존 $SPIKE_APP_DIR 감지 — 삭제 후 재생성"
+    rm -rf "$SPIKE_APP_DIR"
+  fi
+
+  mkdir -p "$SPIKE_APP_DIR/Contents/MacOS"
+  mkdir -p "$SPIKE_APP_DIR/Contents/Resources"
+
+  cat > "$SPIKE_APP_DIR/Contents/Info.plist" <<PLIST
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>CFBundleIdentifier</key><string>$SPIKE_BUNDLE_ID</string>
+  <key>CFBundleName</key><string>JawSpike</string>
+  <key>CFBundleDisplayName</key><string>Jaw Spike</string>
+  <key>CFBundleExecutable</key><string>jaw-spike-launcher</string>
+  <key>CFBundlePackageType</key><string>APPL</string>
+  <key>CFBundleShortVersionString</key><string>0.0.1</string>
+  <key>CFBundleVersion</key><string>0.0.1</string>
+  <key>LSBackgroundOnly</key><true/>
+  <key>LSUIElement</key><true/>
+  <key>NSAppleEventsUsageDescription</key><string>Jaw Spike — TCC attribution test</string>
+</dict>
+</plist>
+PLIST
+
+  cat > "$SPIKE_APP_DIR/Contents/MacOS/jaw-spike-launcher" <<LAUNCHER
+#!/bin/bash
+# PATH pin: CLI discovery from bun / npm / nvm
+export PATH="$MERGED_PATH"
+# 실제 책임 주체가 누구인지 보기 위해 osascript를 직접 실행
+exec /usr/bin/osascript -e 'tell application "Google Chrome" to get URL of active tab of front window'
+LAUNCHER
+  chmod +x "$SPIKE_APP_DIR/Contents/MacOS/jaw-spike-launcher"
+
+  # Launch Services 등록
+  /System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister \
+    -f -R "$SPIKE_APP_DIR" 2>/dev/null || warn "lsregister 실패 (무시 가능)"
+  xattr -dr com.apple.quarantine "$SPIKE_APP_DIR" 2>/dev/null || true
+
+  ok "JawSpike.app 생성됨: $SPIKE_APP_DIR"
+}
+
+probe_attribution() {
+  info "4/6 첫 실행 (TCC 프롬프트 예상)"
+  echo ""
+  echo -e "${YELLOW}   프롬프트가 뜨면 '허용'을 누르세요. 이름은 '${BOLD}Jaw Spike${NC}${YELLOW}'로 보여야 합니다.${NC}"
+  echo -e "${YELLOW}   만약 'Terminal' 또는 'osascript'로 뜨면 귀속 실패입니다.${NC}"
+  echo ""
+  read -r -p "   계속하려면 Enter..." _
+
+  # open -a는 LaunchServices를 통해 번들을 실행 → responsibility가 번들로 귀속됨
+  if ! open -W -a "$SPIKE_APP_DIR" 2>&1; then
+    warn "open -W가 non-zero — 권한 거부 또는 Chrome 비실행 상태일 수 있음"
+  fi
+
+  info "5/6 권한 DB에서 귀속 주체 조회"
+  DB="$HOME/Library/Application Support/com.apple.TCC/TCC.db"
+  if [[ ! -f "$DB" ]]; then warn "유저 TCC.db 없음 (조회 스킵)"; return; fi
+
+  # kTCCServiceAppleEvents 레코드에서 client 필드 확인 (read-only)
+  ATTR=$(sqlite3 "$DB" \
+    "SELECT client FROM access WHERE service='kTCCServiceAppleEvents' AND client LIKE '%cli-jaw%' OR client LIKE '%jaw-spike%';" \
+    2>/dev/null || true)
+
+  if [[ -z "$ATTR" ]]; then
+    warn "TCC.db에 $SPIKE_BUNDLE_ID 관련 레코드 없음 — 아직 허용이 기록되지 않았거나 귀속 실패"
+  else
+    echo "   TCC client 엔트리:"
+    echo "$ATTR" | sed 's/^/     /'
+  fi
+}
+
+verdict() {
+  info "6/6 결론 출력"
+  DB="$HOME/Library/Application Support/com.apple.TCC/TCC.db"
+  PASS=false
+  if [[ -f "$DB" ]]; then
+    if sqlite3 "$DB" "SELECT client FROM access WHERE service='kTCCServiceAppleEvents' AND client='$SPIKE_BUNDLE_ID';" 2>/dev/null | grep -q "$SPIKE_BUNDLE_ID"; then
+      PASS=true
+    fi
+  fi
+
+  if $PASS; then
+    ok "RESULT=PASS — shell-shim launcher가 $SPIKE_BUNDLE_ID 로 귀속됨"
+    echo "RESULT=PASS"
+    echo "   → 31/32 계획의 shell-shim 전략 진행 가능"
+  else
+    warn "RESULT=INCONCLUSIVE_OR_FAIL"
+    echo "RESULT=INCONCLUSIVE"
+    echo ""
+    echo "   가능한 원인과 대처:"
+    echo "   1) 프롬프트에서 거부/무시함 → 재실행"
+    echo "   2) Terminal/osascript로 귀속됨 → shell-shim 전략 불가. 대안:"
+    echo "      a. Swift/C 네이티브 mini-launcher (앱 번들 executable이 실제 네이티브 바이너리)"
+    echo "      b. launchd ProgramArguments에 Jaw.app 자체를 지정하는 대신"
+    echo "         /Applications/Jaw.app/Contents/MacOS/jaw-launcher 를 pid 1 자식으로 두기"
+    echo "   3) TCC.db 권한 없음 → Full Disk Access가 필요할 수 있음"
+  fi
+}
+
+build_native_spike() {
+  info "3/6 [V2 native] clang 확인 + Obj-C launcher 컴파일"
+  if ! command -v /usr/bin/clang >/dev/null; then
+    fail "clang 없음 — Xcode Command Line Tools 설치: xcode-select --install"
+  fi
+  ok "clang: $(/usr/bin/clang --version | head -1)"
+
+  if [[ -d "$SPIKE_APP_DIR" ]]; then
+    warn "기존 $SPIKE_APP_DIR 제거"
+    rm -rf "$SPIKE_APP_DIR"
+  fi
+  mkdir -p "$SPIKE_APP_DIR/Contents/MacOS"
+  mkdir -p "$SPIKE_APP_DIR/Contents/Resources"
+
+  cat > "$SPIKE_APP_DIR/Contents/Info.plist" <<PLIST
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>CFBundleIdentifier</key><string>$SPIKE_BUNDLE_ID</string>
+  <key>CFBundleName</key><string>JawSpike</string>
+  <key>CFBundleDisplayName</key><string>Jaw Spike Native</string>
+  <key>CFBundleExecutable</key><string>jaw-spike-launcher</string>
+  <key>CFBundlePackageType</key><string>APPL</string>
+  <key>CFBundleShortVersionString</key><string>0.0.2</string>
+  <key>CFBundleVersion</key><string>0.0.2</string>
+  <key>LSBackgroundOnly</key><true/>
+  <key>LSUIElement</key><true/>
+  <key>NSAppleEventsUsageDescription</key><string>Jaw Spike — native launcher TCC test</string>
+</dict>
+</plist>
+PLIST
+
+  # Objective-C source: Mach-O that fires an AppleEvent (TCC 진짜 트리거)
+  local SRC="$(mktemp -t jaw-spike-XXXXXX).m"
+  cat > "$SRC" <<'OBJC'
+#import <Foundation/Foundation.h>
+int main(void) {
+    @autoreleasepool {
+        NSAppleScript *s = [[NSAppleScript alloc] initWithSource:
+            @"tell application \"Google Chrome\" to get URL of active tab of front window"];
+        NSDictionary *err = nil;
+        NSAppleEventDescriptor *r = [s executeAndReturnError:&err];
+        if (err) {
+            fprintf(stderr, "ERR: %s\n", [[err description] UTF8String]);
+            return 1;
+        }
+        NSString *v = [r stringValue];
+        printf("URL=%s\n", v ? [v UTF8String] : "(null)");
+        return 0;
+    }
+}
+OBJC
+
+  local OUT="$SPIKE_APP_DIR/Contents/MacOS/jaw-spike-launcher"
+  if ! /usr/bin/clang -framework Foundation -O2 -o "$OUT" "$SRC"; then
+    rm -f "$SRC"
+    fail "clang compile 실패"
+  fi
+  rm -f "$SRC"
+  chmod +x "$OUT"
+
+  # ad-hoc codesign so TCC accepts the bundle identity stably
+  /usr/bin/codesign --force --sign - "$SPIKE_APP_DIR" 2>/dev/null || warn "codesign 실패 (무시 가능)"
+
+  /System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister \
+    -f -R "$SPIKE_APP_DIR" 2>/dev/null || warn "lsregister 실패"
+  xattr -dr com.apple.quarantine "$SPIKE_APP_DIR" 2>/dev/null || true
+
+  ok "Native JawSpike.app 컴파일 완료: $SPIKE_APP_DIR"
+  file "$OUT" | sed 's/^/   /'
+}
+
+verdict_native() {
+  info "6/6 V2 결론"
+  DB="$HOME/Library/Application Support/com.apple.TCC/TCC.db"
+  if [[ ! -f "$DB" ]]; then
+    warn "TCC.db 접근 불가 — Terminal/iTerm에 Full Disk Access 필요"
+    echo "RESULT=INCONCLUSIVE_NO_TCC_ACCESS"
+    return
+  fi
+
+  local SPIKE_ROW
+  SPIKE_ROW=$(sqlite3 "$DB" \
+    "SELECT client FROM access WHERE service='kTCCServiceAppleEvents' AND client='$SPIKE_BUNDLE_ID';" \
+    2>/dev/null || true)
+
+  if [[ -n "$SPIKE_ROW" ]]; then
+    ok "RESULT=PASS — Mach-O launcher가 $SPIKE_BUNDLE_ID 로 귀속됨"
+    echo "RESULT=PASS"
+    echo "   → 31/32의 native launcher 전략 진행 가능"
+    return
+  fi
+
+  # 실패 상세: 실제 누구에게 귀속됐는지 힌트
+  warn "RESULT=FAIL — $SPIKE_BUNDLE_ID TCC 엔트리 없음"
+  echo "RESULT=FAIL"
+  echo ""
+  echo "   TCC.db의 최근 AppleEvents 허용 client 상위 10개:"
+  sqlite3 "$DB" \
+    "SELECT client, datetime(last_modified, 'unixepoch', 'localtime') FROM access WHERE service='kTCCServiceAppleEvents' ORDER BY last_modified DESC LIMIT 10;" \
+    2>/dev/null | sed 's/^/     /'
+  echo ""
+  echo "   프롬프트 제목이 무엇으로 떴는지(예: 'Jaw Spike Native' vs 'osascript' vs 'bash')가 핵심 증거입니다."
+  echo "   'Jaw Spike Native'였다면 유저가 허용만 안 누른 것 — 재실행하세요."
+  echo "   다른 이름이었다면 native launcher도 귀속 실패 → 계획 재협상 필요."
+}
+
+cleanup() {
+  info "cleanup"
+  if [[ -d "$SPIKE_APP_DIR" ]]; then
+    rm -rf "$SPIKE_APP_DIR"
+    ok "$SPIKE_APP_DIR 제거됨"
+  else
+    ok "이미 깨끗함"
+  fi
+}
+
+case "$MODE" in
+  --cleanup|cleanup) cleanup; exit 0 ;;
+  --build|build)
+    print_header
+    warn "V1 (shell-shim) 모드는 이미 FAIL 판정 — 참고용으로만 실행하세요."
+    step_check_prereqs
+    step_probe_path_sources
+    build_spike_app
+    probe_attribution
+    verdict
+    ;;
+  --build-native|build-native|--v2|v2)
+    print_header
+    echo -e "${DIM}   V2: Mach-O Objective-C launcher 기반 재검증${NC}"
+    echo ""
+    step_check_prereqs
+    step_probe_path_sources
+    build_native_spike
+    probe_attribution
+    verdict_native
+    ;;
+  *)
+    print_header
+    step_check_prereqs
+    step_probe_path_sources
+    warn "dry-run 모드 — 번들 생성/권한 요청은 스킵"
+    echo ""
+    echo "다음 단계:"
+    echo "   bash $0 --build-native   # V2: clang Mach-O 기반 (권장)"
+    echo "   bash $0 --build          # V1: shell-shim (이미 FAIL, 참고용)"
+    echo "   bash $0 --cleanup        # spike 번들 제거"
+    ;;
+esac