cuelo 0.9.5 → 0.9.7

package/Tools/OMP_Global_Config/agent/sop/_writer.md

@@ -104,10 +104,12 @@
   an injected message; you have no `wait`, so the checkpoint never blocks the session. Never send a
   diff body, raw output, file contents, or a second message per edit step. Only trigger code is held
   for that reply: keep doing read-only investigation and the non-trigger work in the same slice.
-  When independent work runs out before the reply arrives, say in prose that you are holding for the
-  checkpoint reply and end the turn; Main's message wakes you in a new turn. No reply is never
-  approval - there is no implicit or time-based approval, and trigger edits proceed only on Main's
-  explicit reply. Main retains the
+  When independent work runs out before the reply arrives, use `yield` to report the pending
+  checkpoint, completed evidence, and unstarted work as blocked/partial, never as accepted or done.
+  Prose alone ends a model turn but leaves the task executor asking for `yield`. A shared-workspace
+  Maker resumes on Main's first reply; an isolated worktree is not resumable after terminal yield,
+  so preserve the handoff for Main instead of promising a wake. No reply is never approval: trigger
+  edits require Main's explicit reply. Main retains the
   approved location and invariants for the final drift check, so a revision that edited trigger
   code without an approved checkpoint cannot be closed. This checkpoint is the first contact point
   of review, not a separate gate: the final judgement covers only deltas not yet reviewed and the
@@ -146,6 +148,10 @@
   build error. Never put a broken intermediate state on the user's screen. Use the user's browser
   only when their live session is genuinely required, or when Main tells you to hand a FINISHED
   surface over for judgement — do not open it on your own initiative.
+  Do not launch Chrome/Edge executables directly from bash or eval (including `Bun.spawn`) for
+  verification. Use the managed browser helpers or the project's supported verification commands.
+  Such commands must use an absolute, isolated profile path: even headless startup can show a
+  native desktop error dialog when its profile path is invalid.
 - Run surface checks in the environment Main provides; create a common isolation environment or
   run a full build yourself only when the brief explicitly delegates that run. When you do launch a
   server (delegated, or no environment exists

package/Tools/OMP_Global_Config/agent/tools/git-finalizer/finalizer.ps1

@@ -10,6 +10,10 @@ try {
     $OutputEncoding = [Console]::OutputEncoding
 } catch {}
 $env:GIT_TERMINAL_PROMPT = '0'
+# PowerShell 5.1 on Windows and PowerShell 7 on Linux share this transaction.
+$isWindowsPlatform = [IO.Path]::DirectorySeparatorChar -eq '\'
+$pathComparison = if ($isWindowsPlatform) { [StringComparison]::OrdinalIgnoreCase } else { [StringComparison]::Ordinal }
+$pathComparer = if ($isWindowsPlatform) { [StringComparer]::OrdinalIgnoreCase } else { [StringComparer]::Ordinal }
 
 $stage = 'request'
 $createdCommit = $null
@@ -58,12 +62,12 @@ function Get-Sha256Hex([string]$Text) {
 function Normalize-FullPath([string]$Path) {
     $fullPath = [IO.Path]::GetFullPath($Path)
     $pathRoot = [IO.Path]::GetPathRoot($fullPath)
-    if ($fullPath.Equals($pathRoot, [StringComparison]::OrdinalIgnoreCase)) { return $pathRoot }
+    if ($fullPath.Equals($pathRoot, $pathComparison)) { return $pathRoot }
     return $fullPath.TrimEnd([IO.Path]::DirectorySeparatorChar, [IO.Path]::AltDirectorySeparatorChar)
 }
 
 function Test-PathWithin([string]$Path, [string]$Root) {
-    if ($Path.Equals($Root, [StringComparison]::OrdinalIgnoreCase)) { return $true }
+    if ($Path.Equals($Root, $pathComparison)) { return $true }
     $prefix = $Root
     if (
         -not $prefix.EndsWith([IO.Path]::DirectorySeparatorChar) -and
@@ -71,7 +75,7 @@ function Test-PathWithin([string]$Path, [string]$Root) {
     ) {
         $prefix += [IO.Path]::DirectorySeparatorChar
     }
-    return $Path.StartsWith($prefix, [StringComparison]::OrdinalIgnoreCase)
+    return $Path.StartsWith($prefix, $pathComparison)
 }
 
 function Get-NearestExistingDirectory([string]$Path) {
@@ -97,7 +101,7 @@ function Get-RepositoryRootInPathNamespace([string]$WorkingDirectory) {
 }
 
 function Convert-ToRepoPath([string]$FullPath, [string]$Root) {
-    if ($FullPath.Equals($Root, [StringComparison]::OrdinalIgnoreCase)) { return '' }
+    if ($FullPath.Equals($Root, $pathComparison)) { return '' }
     return $FullPath.Substring($Root.Length).TrimStart('\', '/').Replace('\', '/')
 }
 
@@ -108,8 +112,8 @@ function Get-GitPaths([string]$WorkingDirectory, [string[]]$GitArgs) {
 }
 
 function Assert-ExactPathSet([string[]]$Actual, [string[]]$Expected, [string]$Label) {
-    $actualSet = [Collections.Generic.HashSet[string]]::new([StringComparer]::OrdinalIgnoreCase)
-    $expectedSet = [Collections.Generic.HashSet[string]]::new([StringComparer]::OrdinalIgnoreCase)
+    $actualSet = [Collections.Generic.HashSet[string]]::new($pathComparer)
+    $expectedSet = [Collections.Generic.HashSet[string]]::new($pathComparer)
     foreach ($path in $Actual) { [void]$actualSet.Add($path) }
     foreach ($path in $Expected) { [void]$expectedSet.Add($path) }
     if (-not $actualSet.SetEquals($expectedSet)) {
@@ -129,7 +133,7 @@ try {
 
     $stage = 'repository'
     $resolvedFiles = @()
-    $seenFullPaths = [Collections.Generic.HashSet[string]]::new([StringComparer]::OrdinalIgnoreCase)
+    $seenFullPaths = [Collections.Generic.HashSet[string]]::new($pathComparer)
     foreach ($inputFile in $inputFiles) {
         if ($inputFile.IndexOfAny(@([char]0, [char]10, [char]13)) -ge 0) { throw 'File paths cannot contain NUL or newlines.' }
         if ([IO.Path]::IsPathRooted($inputFile)) { throw "Absolute file path is not allowed: $inputFile" }
@@ -164,8 +168,8 @@ try {
             $selectedRepoRoot = $targetRepoRoot
             $selectedCommonDir = $targetCommonDir
         } elseif (
-            -not $selectedRepoRoot.Equals($targetRepoRoot, [StringComparison]::OrdinalIgnoreCase) -or
-            -not $selectedCommonDir.Equals($targetCommonDir, [StringComparison]::OrdinalIgnoreCase)
+            -not $selectedRepoRoot.Equals($targetRepoRoot, $pathComparison) -or
+            -not $selectedCommonDir.Equals($targetCommonDir, $pathComparison)
         ) {
             throw "Files belong to different repositories: $($file.Input)"
         }
@@ -174,11 +178,11 @@ try {
     $repoRoot = $selectedRepoRoot
     $commonDir = $selectedCommonDir
     if ($cwdRepoRoot) {
-        $targetsBelongToCwdRepository = $commonDir.Equals($cwdCommonDir, [StringComparison]::OrdinalIgnoreCase)
+        $targetsBelongToCwdRepository = $commonDir.Equals($cwdCommonDir, $pathComparison)
         if ($targetsBelongToCwdRepository) {
             foreach ($file in $resolvedFiles) {
                 $parentPath = [IO.Path]::GetDirectoryName($file.FullPath)
-                $isDirectRepoRootChild = $parentPath -and $parentPath.Equals($cwdRepoRoot, [StringComparison]::OrdinalIgnoreCase)
+                $isDirectRepoRootChild = $parentPath -and $parentPath.Equals($cwdRepoRoot, $pathComparison)
                 if (-not (Test-PathWithin -Path $file.FullPath -Root $cwd) -and -not $isDirectRepoRootChild) {
                     throw "File path escapes the session cwd: $($file.Input)"
                 }
@@ -195,10 +199,10 @@ try {
         }
     }
 
-    $seen = [Collections.Generic.HashSet[string]]::new([StringComparer]::OrdinalIgnoreCase)
+    $seen = [Collections.Generic.HashSet[string]]::new($pathComparer)
     foreach ($file in $resolvedFiles) {
         $repoPath = Convert-ToRepoPath -FullPath $file.FullPath -Root $repoRoot
-        if (-not $repoPath -or $repoPath -eq '.git' -or $repoPath.StartsWith('.git/', [StringComparison]::OrdinalIgnoreCase)) {
+        if (-not $repoPath -or $repoPath -eq '.git' -or $repoPath.StartsWith('.git/', $pathComparison)) {
             throw "Repository metadata or broad paths are not allowed: $($file.Input)"
         }
         if (-not $seen.Add($repoPath)) { throw "Duplicate file path: $($file.Input)" }
@@ -235,8 +239,9 @@ try {
     $trackingConfigured = [bool]$configuredRemote -and [bool]$configuredUpstreamRef
 
     $stage = 'lock'
-    $lockKey = Get-Sha256Hex ($commonDir.ToLowerInvariant() + [char]0 + $remote + [char]0 + $upstreamRef)
-    $mutexName = "Global\OMP-GitFinalize-$lockKey"
+    $lockDirectory = if ($isWindowsPlatform) { $commonDir.ToLowerInvariant() } else { $commonDir }
+    $lockKey = Get-Sha256Hex ($lockDirectory + [char]0 + $remote + [char]0 + $upstreamRef)
+    $mutexName = if ($isWindowsPlatform) { "Global\OMP-GitFinalize-$lockKey" } else { "OMP-GitFinalize-$lockKey" }
     $mutex = [Threading.Mutex]::new($false, $mutexName)
     try {
         $ownsMutex = $mutex.WaitOne([TimeSpan]::FromSeconds(120))
@@ -248,7 +253,7 @@ try {
     $stage = 'locked-preflight'
     $lockedCommonDir = Normalize-FullPath (Invoke-Git -WorkingDirectory $repoRoot -GitArgs @('rev-parse', '--path-format=absolute', '--git-common-dir')).Output
     $lockedBranch = (Invoke-Git -WorkingDirectory $repoRoot -GitArgs @('rev-parse', '--abbrev-ref', 'HEAD')).Output
-    if (-not $lockedCommonDir.Equals($commonDir, [StringComparison]::OrdinalIgnoreCase) -or $lockedBranch -ne $branch) {
+    if (-not $lockedCommonDir.Equals($commonDir, $pathComparison) -or $lockedBranch -cne $branch) {
         throw 'Repository or branch changed while acquiring the finalizer lock.'
     }
 
@@ -276,22 +281,53 @@ try {
     $stagedByFinalizer = $true
     [void](Invoke-Git -WorkingDirectory $repoRoot -GitArgs (@('--literal-pathspecs', 'add', '-A', '--') + $repoPaths))
     $cachedPaths = Get-GitPaths -WorkingDirectory $repoRoot -GitArgs @('-c', 'core.quotepath=false', 'diff', '--cached', '--no-renames', '--name-only')
-    Assert-ExactPathSet -Actual $cachedPaths -Expected $repoPaths -Label 'Staged path set'
-
-    $stage = 'commit'
-    $messageFile = [IO.Path]::GetTempFileName()
-    [IO.File]::WriteAllText($messageFile, $message + [Environment]::NewLine, [Text.UTF8Encoding]::new($false))
-    [void](Invoke-Git -WorkingDirectory $repoRoot -GitArgs @('commit', '--file', $messageFile))
-    $createdCommit = (Invoke-Git -WorkingDirectory $repoRoot -GitArgs @('rev-parse', 'HEAD')).Output
-    $stagedByFinalizer = $false
-
-    $stage = 'commit-verify'
-    $parentSha = (Invoke-Git -WorkingDirectory $repoRoot -GitArgs @('rev-parse', "$createdCommit^" )).Output
-    if ($parentSha -ne $headSha) {
-        throw "Created commit parent does not match the captured HEAD. parent=$parentSha head=$headSha"
+    # 이전 실행이 커밋은 만들고 push에서 실패했으면 요청 파일이 이미 깨끗하다. 그 파일이 아직 원격에 없는
+    # 커밋(upstream..HEAD, 원격 브랜치가 없으면 원격 추적 ref 어디에도 없는 HEAD 커밋)에 들어 있을 때만
+    # 그 커밋을 인정하고 새 커밋 없이 다시 보낸다.
+    $cachedPaths = @($cachedPaths)
+    $cachedSet = [Collections.Generic.HashSet[string]]::new($pathComparer)
+    foreach ($path in $cachedPaths) { [void]$cachedSet.Add($path) }
+    $alreadyCommitted = @($repoPaths | Where-Object { -not $cachedSet.Contains($_) })
+    $resumedPush = $false
+    if ($alreadyCommitted.Count -gt 0) {
+        if ($upstreamSha -eq $headSha) {
+            Assert-ExactPathSet -Actual $cachedPaths -Expected $repoPaths -Label 'Staged path set'
+        }
+        $pendingRange = if ($upstreamSha) { "${upstreamSha}..${headSha}" } else { "${headSha} not in refs/remotes/$remote" }
+        $pendingPaths = if ($upstreamSha) {
+            Get-GitPaths -WorkingDirectory $repoRoot -GitArgs @('-c', 'core.quotepath=false', 'diff', '--no-renames', '--name-only', $upstreamSha, $headSha)
+        } else {
+            Get-GitPaths -WorkingDirectory $repoRoot -GitArgs @('-c', 'core.quotepath=false', 'log', '--no-renames', '--format=', '--name-only', $headSha, '--not', "--remotes=$remote")
+        }
+        $pendingSet = [Collections.Generic.HashSet[string]]::new($pathComparer)
+        foreach ($path in $pendingPaths) { [void]$pendingSet.Add($path) }
+        $unpending = @($alreadyCommitted | Where-Object { -not $pendingSet.Contains($_) })
+        if ($unpending.Count -gt 0) {
+            throw "Staged path set mismatch. Unchanged paths are not in unpushed commits ${pendingRange}: $($unpending -join ', ')"
+        }
+        $resumedPush = $true
+    }
+
+    if ($cachedPaths.Count -gt 0) {
+        Assert-ExactPathSet -Actual $cachedPaths -Expected @($repoPaths | Where-Object { $cachedSet.Contains($_) }) -Label 'Staged path set'
+        $stage = 'commit'
+        $messageFile = [IO.Path]::GetTempFileName()
+        [IO.File]::WriteAllText($messageFile, $message + [Environment]::NewLine, [Text.UTF8Encoding]::new($false))
+        [void](Invoke-Git -WorkingDirectory $repoRoot -GitArgs @('commit', '--file', $messageFile))
+        $createdCommit = (Invoke-Git -WorkingDirectory $repoRoot -GitArgs @('rev-parse', 'HEAD')).Output
+        $stagedByFinalizer = $false
+
+        $stage = 'commit-verify'
+        $parentSha = (Invoke-Git -WorkingDirectory $repoRoot -GitArgs @('rev-parse', "$createdCommit^" )).Output
+        if ($parentSha -ne $headSha) {
+            throw "Created commit parent does not match the captured HEAD. parent=$parentSha head=$headSha"
+        }
+        $committedPaths = Get-GitPaths -WorkingDirectory $repoRoot -GitArgs @('-c', 'core.quotepath=false', 'diff-tree', '--no-commit-id', '--no-renames', '--name-only', '-r', $createdCommit)
+        Assert-ExactPathSet -Actual $committedPaths -Expected $cachedPaths -Label 'Committed path set'
+    } else {
+        $stagedByFinalizer = $false
+        $createdCommit = $headSha
     }
-    $committedPaths = Get-GitPaths -WorkingDirectory $repoRoot -GitArgs @('-c', 'core.quotepath=false', 'diff-tree', '--no-commit-id', '--no-renames', '--name-only', '-r', $createdCommit)
-    Assert-ExactPathSet -Actual $committedPaths -Expected $repoPaths -Label 'Committed path set'
 
     $stage = 'push'
     [void](Invoke-Git -WorkingDirectory $repoRoot -GitArgs @('push', $remote, "${createdCommit}:${upstreamRef}"))
@@ -316,6 +352,7 @@ try {
         commitSha = $createdCommit
         remote = $remote
         upstreamRef = $upstreamRef
+        resumedPush = $resumedPush
     }
 } catch {
     $exitCode = 1

package/Tools/OMP_Global_Config/agent/tools/git-finalizer/index.ts

@@ -12,6 +12,7 @@ interface FinalizerResult {
   commitSha?: string;
   remote?: string;
   upstreamRef?: string;
+  resumedPush?: boolean;
 }
 
 const scriptPath = fileURLToPath(new URL("./finalizer.ps1", import.meta.url));
@@ -30,6 +31,7 @@ node files/source-build-helper.js verify-source ../.. files/source-integrity.jso
 Then include Tools/CUELO_Setup/files/source-integrity.json in the same commit.`;
 const memorySyncScript = "Tools/OMP_Global_Config/memory-sync/sync.ts";
 const memoryTransport = "Tools/OMP_Global_Config/memory-sync/memories.jsonl";
+const pathKey = (value: string) => process.platform === "win32" ? value.toLowerCase() : value;
 
 type Exec = (command: string, args: string[], options: { cwd: string }) => Promise<{ code: number; stdout: string; stderr?: string }>;
 
@@ -54,7 +56,7 @@ async function exportMemories(cwd: string, files: string[], exec: Exec): Promise
   if (!files.every(inRoot)) return {};
   const transport = relative(cwd, join(root, ...memoryTransport.split("/"))).split(sep).join("/");
   if (transport.startsWith("../")) return { note: "기억 export 생략: 현재 cwd 밖의 파일이라 이 커밋에 넣을 수 없다." };
-  if (files.some((file) => file.replace(/\\/g, "/").toLowerCase() === transport.toLowerCase())) return {};
+  if (files.some((file) => pathKey(file.replace(/\\/g, "/")) === pathKey(transport))) return {};
   const exported = await exec("bun", [join(root, ...memorySyncScript.split("/")), "export", root], { cwd: root });
   if (exported.code !== 0) {
     const reason = (exported.stderr || exported.stdout).trim().split(/\r?\n/).at(-1) || `exit ${exported.code}`;
@@ -99,7 +101,7 @@ async function checkSourceManifest(
     if (!path || path === ".." || path.startsWith("../")) return;
     targets.push({ root, path });
   }
-  if (!targets.length || targets.some(({ root }) => root.toLowerCase() !== targets[0].root.toLowerCase())) return;
+  if (!targets.length || targets.some(({ root }) => pathKey(root) !== pathKey(targets[0].root))) return;
 
   const root = targets[0].root;
   try {
@@ -108,7 +110,7 @@ async function checkSourceManifest(
     if ((error as NodeJS.ErrnoException).code === "ENOENT") return;
     throw error;
   }
-  if (targets.some(({ path }) => path.toLowerCase() === manifestPath.toLowerCase())) return;
+  if (targets.some(({ path }) => pathKey(path) === pathKey(manifestPath))) return;
 
   let packagedTools: string[] = [];
   try {
@@ -165,7 +167,7 @@ const factory: CustomToolFactory = (pi) => ({
   label: "Git Finalize",
   loadMode: "essential",
   description:
-    "Atomically finalize relative exact files in one repository. Resolve every target from its nearest existing parent. Treat matching git common-dir values as the same repository: restrict those targets to paths inside cwd or an exact direct child file of the cwd repository root, while allowing one distinct repository; reject mixed repositories before staging. Serialize by repository/upstream, verify exact paths and ancestry, commit, then push the created SHA. Main only.",
+    "Atomically finalize relative exact files in one repository. Resolve every target from its nearest existing parent. Treat matching git common-dir values as the same repository: restrict those targets to paths inside cwd or an exact direct child file of the cwd repository root, while allowing one distinct repository; reject mixed repositories before staging. Serialize by repository/upstream, verify exact paths and ancestry, commit, then push the created SHA. If an earlier run committed but its push failed, call again with the same files: unchanged files found in unpushed upstream..HEAD commits are accepted and HEAD is pushed without a new commit. Main only.",
   parameters: pi.zod.object({
     files: pi.zod.array(pi.zod.string()),
     message: pi.zod.string(),
@@ -176,7 +178,6 @@ const factory: CustomToolFactory = (pi) => ({
     const message = params.message.trim();
     if (requested.length === 0) throw new Error("git_finalize requires at least one exact file path.");
     if (!message) throw new Error("git_finalize requires a non-empty commit message.");
-    if (process.platform !== "win32") throw new Error("git_finalize currently requires Windows PowerShell.");
 
     const exec: Exec = (command, args, options) => pi.exec(command, args, { ...options, signal });
     await checkSourceManifest(pi.cwd, requested, exec);
@@ -193,7 +194,7 @@ const factory: CustomToolFactory = (pi) => ({
     try {
       await writeFile(requestPath, JSON.stringify({ cwd: pi.cwd, files, message }), "utf8");
       const result = await pi.exec(
-        "powershell.exe",
+        process.platform === "win32" ? "powershell.exe" : "pwsh",
         ["-NoProfile", "-ExecutionPolicy", "Bypass", "-File", scriptPath, "-Request", requestPath],
         { cwd: pi.cwd, signal, timeout: 180_000 },
       );
@@ -207,6 +208,7 @@ const factory: CustomToolFactory = (pi) => ({
           {
             type: "text",
             text: `Committed and pushed ${parsed.commitSha} to ${parsed.remote} ${parsed.upstreamRef}.`
+              + (parsed.resumedPush ? " 이미 커밋돼 있던 미전송 커밋을 함께 다시 보냈다." : "")
               + (memory.file ? ` 기억 transport(${memory.file})를 함께 커밋했다.` : "")
               + (memory.note ? ` ${memory.note}` : ""),
           },