elanous 0.2.0 → 0.2.4

package/src/harness/harness-stop.ts

@@ -0,0 +1,131 @@
+// `elanous harness stop <runId>` — 런 하나를 한 줄로 멈춘다: 오케스트레이터 프로세스 ⊕ 그 런의 Pod Job.
+//
+// 🩸 2026-09-27: 멈추려면 사람이 PID 둘(harness ask 부모 · self orchestrate 자식)과 Job 이름을 손으로 찾아야 했고,
+//   그 사이 떠 있던 조각이 main 에 병합됐다(#21048). 부모를 죽이면 자식이 PPID 1 고아로 2h36m 더 돌았다(🅞 보고).
+// B 조각(#21171)이 오케스트레이터에 `self-dev-runs/<runId>/pid.json` ⊕ SIGTERM 정리(새 잡 멈춤 · 자기 Job 삭제 · cancelled)를 넣었다.
+// 이 파일(A 조각)은 그 기록을 «읽고», 소유가 확인될 때만 신호를 보내고, `elanous.run=<runId>` 라벨 Job 을 지운다.
+//
+// ⛔ 불변식: 기록된 시작 시각과 실제 프로세스 시작 시각이 다르면 신호를 보내지 않는다(PID 재사용 방지).
+// ⛔ 불변식: `elanous.run=<runId>` 라벨이 붙은 Job 만 지운다.
+
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { debug } from '../debug/log.js';
+import { selfDevRunsDir } from '../self-dev/run-store.js';
+
+const RUN_ID = /^[A-Za-z0-9][A-Za-z0-9_-]*$/;
+/** `pid.json` 의 `startedAt` 은 `Date.now() − uptime` 근삿값이다 — 이만큼의 차이는 같은 프로세스로 본다. */
+export const START_TOLERANCE_MS = 5_000;
+
+export interface PidRecord { pid: number; startedAt: number; argv0?: string }
+
+export interface HarnessStopDeps {
+  readPidRecord: (runId: string) => PidRecord | null;
+  /** 살아 있는 프로세스의 시작 시각(ms) · 없으면 null. */
+  processStartMs: (pid: number) => number | null;
+  kill: (pid: number, signal: NodeJS.Signals) => void;
+  sleep: (ms: number) => Promise<void>;
+  kubeContexts: () => string[];
+  kubectl: (args: readonly string[]) => { status: number | null; stdout: string; stderr: string };
+  namespace: string;
+  graceMs: number;
+}
+
+export interface HarnessStopResult {
+  runId: string;
+  process: 'stopped' | 'killed' | 'absent' | 'owner-mismatch';
+  pid?: number;
+  jobsDeleted: number;
+  contexts: string[];
+}
+
+export function readPidRecordFrom(runsDir: string, runId: string): PidRecord | null {
+  try {
+    const value = JSON.parse(readFileSync(join(runsDir, runId, 'pid.json'), 'utf8')) as Partial<PidRecord>;
+    if (!Number.isSafeInteger(value.pid) || (value.pid as number) <= 1 || !Number.isFinite(value.startedAt)) return null;
+    return { pid: value.pid as number, startedAt: value.startedAt as number, ...(typeof value.argv0 === 'string' ? { argv0: value.argv0 } : {}) };
+  } catch {
+    return null;
+  }
+}
+
+/** macOS·Linux 공통 — `ps -o lstart=` 는 로컬 시각 문자열(초 단위)이다. */
+export function psProcessStartMs(pid: number): number | null {
+  const r = spawnSync('ps', ['-o', 'lstart=', '-p', String(pid)], { encoding: 'utf8', timeout: 5_000 });
+  if (r.status !== 0) return null;
+  const text = r.stdout.trim();
+  if (!text) return null;
+  const ms = Date.parse(text);
+  return Number.isFinite(ms) ? ms : null;
+}
+
+export function defaultHarnessStopDeps(overrides: Partial<HarnessStopDeps> = {}): HarnessStopDeps {
+  const env = { ...process.env };
+  for (const key of ['HTTPS_PROXY', 'https_proxy', 'HTTP_PROXY', 'http_proxy', 'ALL_PROXY', 'all_proxy']) delete env[key];
+  const kubectl = (args: readonly string[]) => {
+    const r = spawnSync('kubectl', [...args], { encoding: 'utf8', timeout: 15_000, env });
+    return { status: r.status, stdout: r.stdout ?? '', stderr: r.stderr ?? String(r.error ?? '') };
+  };
+  return {
+    readPidRecord: (runId) => readPidRecordFrom(selfDevRunsDir(), runId),
+    processStartMs: psProcessStartMs,
+    kill: (pid, signal) => { process.kill(pid, signal); },
+    sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+    kubeContexts: () => {
+      const r = kubectl(['config', 'get-contexts', '-o', 'name']);
+      return r.status === 0 ? r.stdout.split('\n').map((l) => l.trim()).filter(Boolean) : [];
+    },
+    kubectl,
+    namespace: 'elanous-test',
+    graceMs: 10_000,
+    ...overrides,
+  };
+}
+
+export async function stopHarnessRun(runId: string, deps: HarnessStopDeps, contexts?: readonly string[]): Promise<HarnessStopResult> {
+  if (!RUN_ID.test(runId)) throw new Error(`invalid run id: ${runId}`);
+  // ── ⓐ 프로세스 ────────────────────────────────────────────
+  let processState: HarnessStopResult['process'] = 'absent';
+  const record = deps.readPidRecord(runId);
+  if (record) {
+    const actual = deps.processStartMs(record.pid);
+    if (actual === null) processState = 'absent';
+    else if (Math.abs(actual - record.startedAt) > START_TOLERANCE_MS) processState = 'owner-mismatch';
+    else {
+      try { deps.kill(record.pid, 'SIGTERM'); } catch { /* 방금 끝났다 */ }
+      processState = 'stopped';
+      const step = 250;
+      for (let waited = 0; waited < deps.graceMs; waited += step) {
+        await deps.sleep(step);
+        if (deps.processStartMs(record.pid) === null) break;
+      }
+      const still = deps.processStartMs(record.pid);
+      if (still !== null && Math.abs(still - record.startedAt) <= START_TOLERANCE_MS) {
+        try { deps.kill(record.pid, 'SIGKILL'); processState = 'killed'; } catch { /* 끝났다 */ }
+      }
+    }
+  }
+  // ── ⓑ Pod Job (라벨로만) ───────────────────────────────────
+  const targets = contexts && contexts.length > 0 ? [...contexts] : deps.kubeContexts();
+  let jobsDeleted = 0;
+  for (const context of targets) {
+    const r = deps.kubectl(['--context', context, '-n', deps.namespace, 'delete', 'job', '-l', `elanous.run=${runId}`, '--wait=false']);
+    if (r.status === 0) jobsDeleted += r.stdout.split('\n').filter((line) => line.startsWith('job.batch/')).length;
+    else debug.log('harness.stop', 'job-delete-failed', { runId, context, error: r.stderr.slice(0, 200) }, { level: 'warn' });
+  }
+  const result: HarnessStopResult = { runId, process: processState, ...(record ? { pid: record.pid } : {}), jobsDeleted, contexts: targets };
+  debug.log('harness.stop', 'stopped', { runId, process: processState, jobsDeleted, contexts: targets.length });
+  return result;
+}
+
+export function formatHarnessStop(r: HarnessStopResult): string {
+  const label: Record<HarnessStopResult['process'], string> = {
+    stopped: '멈춤(SIGTERM)', killed: '멈춤(SIGKILL — 제한 시간 안에 안 끝났다)', absent: '없음', 'owner-mismatch': '소유 불일치(건드리지 않음 — PID 가 다른 프로세스로 재사용됐다)',
+  };
+  return [
+    `harness stop ${r.runId}`,
+    `  프로세스: ${label[r.process]}${r.pid ? ` · pid ${r.pid}` : ''}`,
+    `  Pod Job: ${r.jobsDeleted}개 지움 (문맥 ${r.contexts.length}개 · 라벨 elanous.run=${r.runId})`,
+  ].join('\n');
+}

package/src/harness/harness-substrate-default.ts

@@ -0,0 +1,40 @@
+import { spawnSync } from 'node:child_process';
+import type { UserConfig } from '../user-config.js';
+
+export type HarnessSubstrate = 'local' | 'pod';
+export interface ResolvedHarnessSubstrate {
+  substrate: HarnessSubstrate;
+  pool: string | null;
+  source: 'flag' | 'config' | 'default';
+}
+
+/** Only inspect the current context when no explicit pool is available. Never turn a failed Pod selection into local. */
+export function resolveHarnessSubstrate({ flag, config, env, currentContext = () => {
+  const result = spawnSync('kubectl', ['config', 'current-context'], { encoding: 'utf8', timeout: 5000 });
+  return result.status === 0 ? result.stdout?.trim() : undefined;
+} }: {
+  flag?: { substrate?: HarnessSubstrate; podPool?: string };
+  config?: Pick<UserConfig, 'harness' | 'pod'>;
+  env?: NodeJS.ProcessEnv;
+  currentContext?: () => string | undefined;
+}): ResolvedHarnessSubstrate {
+  const substrate = flag?.substrate ?? config?.harness?.substrate ?? 'local';
+  if (substrate !== 'local' && substrate !== 'pod') throw new Error('harness.substrate: local 또는 pod 만 허용한다');
+  const source = flag?.substrate ? 'flag' : config?.harness?.substrate ? 'config' : 'default';
+  if (substrate === 'local') return { substrate, pool: null, source };
+  const pool = flag?.podPool?.trim() || env?.ELANOUS_POD_POOL?.trim() || config?.harness?.podPool?.trim() || config?.pod?.pool?.trim() || currentContext()?.trim();
+  if (!pool) throw new Error('harness.substrate=pod: Pod 풀 또는 현재 컨텍스트에 닿지 못했다 — 풀을 설정하거나 `--substrate local` 로 명시하라');
+  return { substrate, pool, source };
+}
+
+/** `dev --ask` → Pod dispatch input. Carries `--no-auto-merge` (commander: autoMerge === false) like the
+ *  other Pod entrance, so a remote run never merges when the caller asked it not to. */
+export function devAskPodDispatchInput(opts: { base?: string; autoMerge?: boolean }, goalFile: string, podPool: string): {
+  entrance: 'cli-harness-ask'; input: string; podPool: string; base?: string; autoMerge?: false;
+} {
+  return {
+    entrance: 'cli-harness-ask', input: goalFile, podPool,
+    ...(opts.base !== undefined ? { base: opts.base } : {}),
+    ...(opts.autoMerge === false ? { autoMerge: false as const } : {}),
+  };
+}

package/src/harness/harness-worktrees.ts

@@ -389,7 +389,7 @@ export function execHarnessWorktrees(deps: {
   const queryOwnerRuns = deps.queryRunningRuns ?? queryRunningRuns;
   let ownerRunStatuses: Map<string, RunningRunStatus> | undefined;
   try {
-    ownerRunStatuses = ownerRunStatusesFromQuery(queryOwnerRuns());
+    ownerRunStatuses = ownerRunStatusesFromQuery(queryOwnerRuns({ caller: 'harness-worktrees' }));
   } catch {
     ownerRunStatuses = undefined;
   }

package/src/harness/harness-write-boundary.ts

@@ -40,6 +40,7 @@ import { getHarnessSpace, getHarnessBoundaryPath, HARNESS_BOUNDARY_REQUESTS_ENV,
 import { getSessionCwd, getSessionWorkingDir, setSessionCwd } from '../session/working-dir.js';
 import { findGitDir } from '../git-fs/locate.js';
 import { debug } from '../debug/log.js';
+import { emitDecision } from '../live/detail-switch.js';
 import { observeRawShellMetacharacters } from '../self-implement/auto-intervene.js';
 
 export { HARNESS_BOUNDARY_REQUESTS_ENV } from './harness-space.js';
@@ -319,6 +320,7 @@ export function harnessMainTreeReject(
   try {
     // ⭐ 이쪽은 `target` 이 «실제» 쓰기 대상이다 — 위 미지-셸 분기와 «다른 사실»이므로 값으로 가른다.
     debug.log('harness.boundary', 'main-tree-reject', request);
+    emitDecision({ kind: 'VERIFY', what: `격리 경계 밖 쓰기 거절 · ${basename(absPath)}`, reason: `정본 트리(${space.kind}) 보호 — 격리 worktree 밖`, purpose: '사람 트리를 자식이 오염하지 않게', target: '자식에게 되돌림(격리 안 경로로)', phase: 'implement' });
   } catch { /* fail-soft */ }
   const requestRecorded = appendHarnessBoundaryRequest(env, request);
   observeHarnessBoundaryResponseMailbox(env);

package/src/harness/llm-decompose.ts

@@ -37,7 +37,7 @@ const observationErrorReason = (error: unknown): string => {
 export async function llmDecomposeSteps(
   objective: string,
   callable: DecomposeCallable,
-  opts?: { context?: string; maxTasks?: number; promptProfile?: DecomposePromptProfile; signal?: AbortSignal },
+  opts?: { context?: string; maxTasks?: number; promptProfile?: DecomposePromptProfile; signal?: AbortSignal; onRationale?: (rationale: string) => void },
 ): Promise<string[]> {
   const startedAt = Date.now();
   const promptProfileObservation = opts?.promptProfile ? { promptProfile: opts.promptProfile } : {};
@@ -59,6 +59,7 @@ export async function llmDecomposeSteps(
     );
     const steps = result.proposal.tasks.map((t) => t.title).filter((t) => !!t && t.trim().length > 0);
     observe({ inputLength: objective.length, taskCount: result.proposal.tasks.length, durationMs: Date.now() - startedAt, failed: false, ...promptProfileObservation });
+    try { opts?.onRationale?.(result.proposal.rationale); } catch { /* Observation cannot change the proposed steps. */ }
     return steps;
   } catch (error) {
     observe({ inputLength: objective.length, taskCount: 0, durationMs: Date.now() - startedAt, failed: true, error: observationErrorReason(error), ...promptProfileObservation });

package/src/harness/self-send-decide.ts

@@ -0,0 +1,224 @@
+import { normalizeSpaceId } from './harness-space.js';
+import type { SelfSendTargetResolution } from './self-send-target.js';
+
+export const SELF_SEND_RECENT_FRAME_WINDOW_MS = 24 * 60 * 60 * 1000;
+export const SELF_SEND_STALE_HEARTBEAT_MS = 5 * 60 * 1000;
+
+export interface SelfSendCandidate {
+  readonly spaceId: string;
+  readonly mtimeMs?: number;
+  readonly liveness?: 'alive' | 'dead' | 'unknown';
+  readonly heartbeatAtMs?: number;
+}
+
+export interface SelfSendCandidateDisplay {
+  readonly lines: readonly string[];
+  readonly hiddenStaleCount: number;
+}
+
+const SELF_SEND_GOAL_ATTEMPT_SUFFIX = /^(.*)-[0-9a-f]{8}$/;
+
+function selfSendGoalPrefix(spaceId: string): string | undefined {
+  return SELF_SEND_GOAL_ATTEMPT_SUFFIX.exec(spaceId)?.[1];
+}
+
+function newestSelfSendAttempt(members: readonly SelfSendCandidate[]): SelfSendCandidate | undefined {
+  if (members.length === 0 || members.some((member) => !Number.isFinite(member.mtimeMs))) return undefined;
+  let newest = members[0]!;
+  for (const member of members) if (member.mtimeMs! > newest.mtimeMs!) newest = member;
+  return newest;
+}
+
+function formatSelfSendHeartbeatAge(heartbeatAtMs: number, now: number): string | undefined {
+  if (!Number.isFinite(heartbeatAtMs)) return undefined;
+  const seconds = Math.floor(Math.max(0, now - heartbeatAtMs) / 1_000);
+  if (seconds < 60) return `${seconds}초 전`;
+  const minutes = Math.floor(seconds / 60);
+  if (minutes < 60) return `${minutes}분 전`;
+  const hours = Math.floor(minutes / 60);
+  if (hours < 24) return `${hours}시간 전`;
+  return `${Math.floor(hours / 24)}일 전`;
+}
+
+export function formatSelfSendCandidateDisplay(
+  candidates: readonly SelfSendCandidate[],
+  { includeStale = false, now }: { includeStale?: boolean; now: number },
+): SelfSendCandidateDisplay {
+  const recent: SelfSendCandidate[] = [];
+  const stale: SelfSendCandidate[] = [];
+  for (const candidate of candidates) {
+    const mtimeMs = candidate.mtimeMs;
+    if (Number.isFinite(mtimeMs) && mtimeMs! >= now - SELF_SEND_RECENT_FRAME_WINDOW_MS && mtimeMs! <= now) recent.push(candidate);
+    else stale.push(candidate);
+  }
+  const displayed = includeStale ? [...recent, ...stale] : recent;
+  const groups = new Map<string, SelfSendCandidate[]>();
+  for (const candidate of candidates) {
+    const prefix = selfSendGoalPrefix(candidate.spaceId);
+    if (prefix === undefined) continue;
+    const members = groups.get(prefix);
+    if (members) members.push(candidate);
+    else groups.set(prefix, [candidate]);
+  }
+  return {
+    lines: displayed.map((candidate) => {
+      const timestamp = Number.isFinite(candidate.mtimeMs) ? new Date(candidate.mtimeMs!).toISOString() : '알 수 없음';
+      const prefix = selfSendGoalPrefix(candidate.spaceId);
+      const members = prefix === undefined ? undefined : groups.get(prefix);
+      let annotation = '';
+      if (members && new Set(members.map((member) => member.spaceId)).size >= 2) {
+        annotation = '  · 같은 골의 다른 시도';
+        const newest = newestSelfSendAttempt(members);
+        if (newest !== undefined && candidate.mtimeMs === newest.mtimeMs) annotation += ' · 가장 최근';
+      }
+      const liveness = candidate.liveness ?? 'unknown';
+      const heartbeatAge = liveness === 'alive' && candidate.heartbeatAtMs !== undefined
+        ? formatSelfSendHeartbeatAge(candidate.heartbeatAtMs, now) : undefined;
+      const livenessAnnotation = liveness === 'alive'
+        ? `  · 자식 생존${heartbeatAge === undefined ? '' : ` (heartbeat ${heartbeatAge})`}`
+        : liveness === 'dead' ? '  · 자식 사망 (heartbeat alive=false)' : '';
+      return `  ${candidate.spaceId}  마지막 프레임: ${timestamp}${annotation}${livenessAnnotation}`;
+    }),
+    hiddenStaleCount: includeStale ? 0 : stale.length,
+  };
+}
+
+export interface SelfSendRunScreen {
+  logStoreStatus: string;
+  logStorePath: string;
+  screenKey?: string | null;
+  lastEvent?: { category: string; event: string; timestamp: string } | null;
+  missingStatus?: 'awaiting-start' | 'pipeline-failed' | 'cleaned' | 'not-found' | string;
+}
+
+export interface SelfSendLedger {
+  runId: string;
+  entries: readonly { event: string; data: Record<string, unknown> }[];
+}
+
+export interface SelfSendDecisionInput {
+  space?: string;
+  opts: { stop?: boolean; memo?: string; run?: string; includeStale?: boolean; readWait?: string };
+  now: number;
+}
+
+export interface SelfSendDecisionDeps {
+  resolveRunScreen(runId: string): SelfSendRunScreen;
+  resolveTarget(space: string): SelfSendTargetResolution;
+  isPodFragment(spaceId: string): boolean;
+  screens(): readonly SelfSendCandidate[];
+  ledgers(): readonly SelfSendLedger[];
+  runScreenKey(runId: string): string | null | undefined;
+}
+
+export type SelfSendDecision =
+  | { kind: 'refuse'; message: string; exitCode: 1 | 2 }
+  | { kind: 'send'; spaceId: string; channel: 'inbox' | 'pod'; warnings: readonly string[] };
+
+const refuse = (message: string, exitCode: 1 | 2): SelfSendDecision => ({ kind: 'refuse', message, exitCode });
+
+export function decideSelfSend(input: SelfSendDecisionInput, deps: SelfSendDecisionDeps): SelfSendDecision {
+  const { space, opts, now } = input;
+  if (space !== undefined && opts.run !== undefined) return refuse('--run 과 space 는 함께 사용할 수 없습니다.\n', 2);
+  if (opts.run !== undefined && opts.run.trim() === '') return refuse('--run 에 빈 runId 를 줄 수 없습니다.\n', 2);
+  let requestedSpace = space;
+  if (opts.run !== undefined) {
+    const resolved = deps.resolveRunScreen(opts.run);
+    if (resolved.logStoreStatus !== 'read') {
+      return refuse(`run 화면 해석 불가: 로그 스토어 ${resolved.logStoreStatus} (${resolved.logStorePath})\n`, 1);
+    }
+    if (!resolved.screenKey) {
+      const last = resolved.lastEvent;
+      const lastDetail = last
+        ? ` 마지막 이벤트: ${last.category}/${last.event} (${Number.isFinite(Date.parse(last.timestamp)) ? `${Math.max(0, Math.floor((now - Date.parse(last.timestamp)) / 60_000))}분 전` : '시각 알 수 없음'})`
+        : ' 마지막 이벤트: 없음';
+      const status = resolved.missingStatus;
+      const guidance = status === 'awaiting-start'
+        ? '아직 화면을 띄우기 전입니다. 되묻기에 답하거나 저작이 끝날 때까지 기다리세요.'
+        : status === 'pipeline-failed' ? '파이프라인이 오류로 멈췄습니다. 해당 error를 읽어 원인을 수리하세요.'
+          : status === 'cleaned' ? '하니스가 정리되어 화면이 없습니다. 필요하면 새 런을 시작하세요.'
+            : status === 'not-found' ? '이 runId의 이벤트가 없습니다. runId와 인스턴스 우주를 확인하세요.'
+              : '화면을 아직 분류할 수 없습니다. 마지막 이벤트를 조사하세요.';
+      return refuse(`run 화면 해석 불가: ${guidance}${lastDetail} (${opts.run})\n`, 1);
+    }
+    requestedSpace = normalizeSpaceId(resolved.screenKey);
+  }
+  const hasMemo = opts.memo !== undefined;
+  if (opts.stop && hasMemo) return refuse('self send에서는 --stop 과 --memo를 함께 사용할 수 없습니다.\n', 2);
+  if (!opts.stop && !hasMemo) return refuse('self send에는 --stop 또는 --memo <sentence>가 필요합니다.\n', 2);
+  if (space !== undefined) {
+    const resolution = deps.resolveTarget(space);
+    if (resolution.kind === 'refuse') {
+      const hint = resolution.hint === undefined ? '' : ` 대신 space ${resolution.hint}를 지정하세요.`;
+      const reason = resolution.reason === 'tui-self-report-has-no-inbox-reader'
+        ? 'tui 자기 보고 대상에는 control inbox를 읽는 쪽이 없습니다.'
+        : resolution.reason === 'pty-not-found' ? '지정한 PTY를 찾을 수 없습니다.'
+          : '지정한 PTY에 연결된 harness space가 없습니다.';
+      return refuse(`self send 대상 거절: ${reason}${hint}\n`, 2);
+    }
+    requestedSpace = resolution.spaceId;
+  }
+  if (requestedSpace !== undefined && deps.isPodFragment(requestedSpace)) {
+    return { kind: 'send', spaceId: requestedSpace, channel: 'pod', warnings: [] };
+  }
+  const screens = deps.screens();
+  const explicitScreen = requestedSpace === undefined ? undefined : screens.find((screen) => screen.spaceId === requestedSpace);
+  if (requestedSpace !== undefined && !explicitScreen) {
+    const candidates = screens.length === 0 ? '  (후보 없음)' : screens.map((screen) => `  ${screen.spaceId}`).join('\n');
+    if (opts.run !== undefined) return refuse(`run 화면 해석 불가: 해석한 화면이 없습니다: ${requestedSpace} (${opts.run})\n`, 1);
+    return refuse(`알 수 없는 self send 대상 space: ${requestedSpace}. 후보 중 하나를 지정하세요:\n${candidates}\n`, 2);
+  }
+  if (space !== undefined && explicitScreen) {
+    const goalPrefix = selfSendGoalPrefix(explicitScreen.spaceId);
+    const sameGoalAttempts = goalPrefix === undefined ? [] : screens.filter((screen) => selfSendGoalPrefix(screen.spaceId) === goalPrefix);
+    const newest = newestSelfSendAttempt(sameGoalAttempts);
+    if (newest !== undefined && newest.spaceId !== explicitScreen.spaceId && newest.mtimeMs! > explicitScreen.mtimeMs!) {
+      return refuse(`지정한 self send 대상은 같은 골의 더 최근 시도로 교체되었습니다: ${explicitScreen.spaceId} → ${newest.spaceId}. 더 최근 space를 지정해 다시 보내세요.\n`, 2);
+    }
+  }
+  if (requestedSpace === undefined && screens.length !== 1) {
+    const display = formatSelfSendCandidateDisplay(screens, { includeStale: opts.includeStale, now });
+    const candidates = screens.length === 0 ? '  (후보 없음)' : [
+      ...display.lines,
+      ...(display.hiddenStaleCount > 0 ? [`  오래된 후보 ${display.hiddenStaleCount}개 숨김 (--include-stale로 표시)`] : []),
+    ].join('\n');
+    return refuse(`soft stop 대상이 모호합니다. space를 지정하세요. 후보와 마지막 프레임 시각:\n${candidates}\n`, 2);
+  }
+  const selectedScreen = requestedSpace === undefined ? screens[0]! : explicitScreen!;
+  const warnings: string[] = [];
+  if (hasMemo) {
+    let runId = opts.run;
+    let lifecycle: 'continuing' | 'terminal' | 'unknown' = 'unknown';
+    try {
+      const ledgers = deps.ledgers();
+      if (runId === undefined) {
+        for (const candidate of ledgers) {
+          if (normalizeSpaceId(deps.runScreenKey(candidate.runId) ?? '') === selectedScreen.spaceId) {
+            runId = candidate.runId;
+            break;
+          }
+        }
+      }
+      if (runId !== undefined) {
+        const ledger = ledgers.find((candidate) => candidate.runId === runId)?.entries;
+        if (ledger !== undefined) {
+          for (const entry of ledger) {
+            if (entry.event === 'start' || entry.event === 'run-start' || (entry.event === 'run-status' && entry.data.runStatus === 'running')) lifecycle = 'continuing';
+            else if (entry.event === 'terminal' || entry.event === 'run-status') lifecycle = 'terminal';
+          }
+        }
+      }
+    } catch { /* unreadable lifecycle evidence remains unknown */ }
+    if (lifecycle === 'terminal') {
+      return refuse(`self send 대상 런이 이미 종료되었습니다: ${runId ?? selectedScreen.spaceId}. 메모를 기록하지 않았습니다. 새 런을 시작해 다시 보내세요.\n`, 2);
+    }
+    if (lifecycle === 'unknown') warnings.push(`경고: self send 대상 런의 lifecycle 상태를 알 수 없습니다: ${runId ?? selectedScreen.spaceId}. 기록은 계속합니다.\n`);
+  } else if (selectedScreen.liveness === 'dead') {
+    return refuse(`self send 대상 자식이 heartbeat alive=false로 사망한 상태입니다: ${selectedScreen.spaceId}. 메모를 기록하지 않았습니다. 새 런을 시작하거나 살아 있는 space를 지정해 다시 보내세요.\n`, 2);
+  }
+  if (selectedScreen.liveness === 'unknown') warnings.push(`경고: self send 대상의 heartbeat 상태를 알 수 없습니다: ${selectedScreen.spaceId}. 기록은 계속합니다.\n`);
+  if (selectedScreen.liveness === 'alive' && selectedScreen.heartbeatAtMs !== undefined && now - selectedScreen.heartbeatAtMs > SELF_SEND_STALE_HEARTBEAT_MS) {
+    warnings.push(`경고: self send 대상 space가 죽어 보입니다: ${selectedScreen.spaceId}. heartbeat가 5분보다 오래되어 메모가 전달되지 않을 수 있습니다.\n`);
+  }
+  return { kind: 'send', spaceId: selectedScreen.spaceId, channel: 'inbox', warnings };
+}

package/src/harness/shell-relay.ts

@@ -21,6 +21,9 @@ import type { SurfaceUx } from '../agent/surface-ux/types.js';
 import type { AutoDrive } from './staged-harness.js';
 import { dispatchPtyShellSend } from '../skills/tools/pty.js';
 import { debug } from '../debug/log.js';
+import { getHarnessRunId } from './harness-space.js';
+import { emitDecision } from '../live/detail-switch.js';
+import { escalateDecision } from '../self-implement/decision-events.js';
 
 /** relay 게이트 결정 — auto(자율 답·operator 안 부름) vs escalate(막으로 외부 전파). */
 export type RelayMode = 'auto' | 'escalate';
@@ -176,12 +179,14 @@ export async function relayShellPrompt(input: RelayShellPromptInput): Promise<Re
       answer = typeof picked === 'string' ? picked : Array.isArray(picked) ? (picked[0] ?? null) : null;
       if (answer === null) reason = res == null ? 'non-interactive-menu-fail-closed' : 'cancelled';
       debug.log('harness.relay', 'escalate-question', { shellId, answer: answer ? digest(answer) : null, interactive: ux.interactive });
+      try { emitDecision(escalateDecision({ runId: getHarnessRunId() || undefined, shellId, answer, interactive: ux.interactive, mode: 'question' })); } catch { /* observation must not change the relay outcome */ }
     } else {
       // y/N → ux.confirm. 채널 없으면 fail-closed false → 안전측 decline(noBytes) 주입.
       const ok = await ux.confirm({ prompt, detail: `셸 ${shellId}`, yesLabel: '예', noLabel: '아니오' });
       answer = ok ? yesBytes : noBytes;
       if (!ok && !ux.interactive) reason = 'non-interactive-fail-closed-decline';
       debug.log('harness.relay', 'escalate-confirm', { shellId, ok, answer: digest(answer), interactive: ux.interactive });
+      try { emitDecision(escalateDecision({ runId: getHarnessRunId() || undefined, shellId, answer: reason === 'non-interactive-fail-closed-decline' ? null : answer, interactive: ux.interactive, mode: 'confirm', safeDecline: reason === 'non-interactive-fail-closed-decline' })); } catch { /* observation must not change the relay outcome */ }
     }
   }
 

package/src/hooks/providers.ts

@@ -0,0 +1,77 @@
+import { createHmac, timingSafeEqual } from 'node:crypto';
+
+export type HookProvider = 'linear' | 'asana';
+export interface ExternalTask {
+  eventId: string;
+  title: string;
+  description?: string;
+  external: { provider: HookProvider; ref: string; url?: string };
+}
+export type Verification = { ok: true; body: unknown; eventIds: string[]; ignored?: string } | { ok: false; reason: 'bad-signature' | 'stale' | 'invalid-body' };
+
+function object(value: unknown): Record<string, unknown> | undefined {
+  return value && typeof value === 'object' && !Array.isArray(value) ? value as Record<string, unknown> : undefined;
+}
+function text(value: unknown): string | undefined {
+  return typeof value === 'string' && value.length > 0 ? value : undefined;
+}
+function equalSignature(raw: Buffer, secret: string, signature: string | null): boolean {
+  if (!signature || !/^[a-f0-9]{64}$/i.test(signature)) return false;
+  const expected = createHmac('sha256', secret).update(raw).digest();
+  return timingSafeEqual(expected, Buffer.from(signature, 'hex'));
+}
+export function asanaEventId(event: unknown): string | undefined {
+  const row = object(event);
+  const gid = text(object(row?.resource)?.gid);
+  const action = text(row?.action);
+  const created = text(row?.created_at);
+  return gid && action && created ? `${gid}:${action}:${created}` : undefined;
+}
+
+export function verifyWebhook(provider: HookProvider, raw: Buffer, headers: Headers, secret: string, now = Date.now()): Verification {
+  if (!equalSignature(raw, secret, headers.get(provider === 'linear' ? 'linear-signature' : 'x-hook-signature')))
+    return { ok: false, reason: 'bad-signature' };
+  let parsed: unknown;
+  try { parsed = JSON.parse(raw.toString('utf8')); } catch { return { ok: false, reason: 'invalid-body' }; }
+  const body = object(parsed);
+  if (!body) return { ok: false, reason: 'invalid-body' };
+  if (provider === 'linear') {
+    const timestamp = body.webhookTimestamp;
+    if (typeof timestamp !== 'number' || !Number.isFinite(timestamp) || Math.abs(now - timestamp) > 60_000)
+      return { ok: false, reason: 'stale' };
+    // Linear 은 실패 응답이 쌓이면 웹훅을 꺼 버린다 — 서명이 맞는 «대상 아닌» 이벤트(댓글·수정 등)는
+    // 거절하지 않고 받아서 버린다. 지금 태스크로 만드는 것은 이슈 생성뿐이다.
+    if (body.type !== 'Issue' || body.action !== 'create')
+      return { ok: true, body, eventIds: [], ignored: `${String(body.type)}:${String(body.action)}` };
+    const eventId = text(headers.get('linear-delivery')) ?? (text(body.webhookId) && text(body.createdAt) ? `${body.webhookId}:${body.createdAt}` : undefined);
+    if (!eventId || !object(body.data) || !text(object(body.data)?.id) || !text(object(body.data)?.title))
+      return { ok: false, reason: 'invalid-body' };
+    return { ok: true, body, eventIds: [eventId] };
+  }
+  if (!Array.isArray(body.events)) return { ok: false, reason: 'invalid-body' };
+  const ids = body.events.map(asanaEventId);
+  if (ids.some(id => !id)) return { ok: false, reason: 'invalid-body' };
+  return { ok: true, body, eventIds: ids as string[] };
+}
+
+export function toExternalTask(provider: HookProvider, body: unknown): ExternalTask {
+  const row = object(body);
+  if (!row) throw new Error('invalid hook body');
+  if (provider === 'linear') {
+    const issue = object(row.data);
+    const ref = text(issue?.id);
+    const title = text(issue?.title);
+    const eventId = text(row.eventId) ?? (text(row.webhookId) && text(row.createdAt) ? `${row.webhookId}:${row.createdAt}` : undefined);
+    if (!ref || !title || !eventId) throw new Error('invalid linear issue');
+    return { eventId, title, ...(text(issue?.description) ? { description: text(issue?.description) } : {}),
+      external: { provider, ref, ...(text(issue?.url) ? { url: text(issue?.url) } : {}) } };
+  }
+  const event = object(row.event);
+  const task = object(row.task);
+  const ref = text(object(event?.resource)?.gid);
+  const eventId = asanaEventId(event);
+  if (!ref || !eventId) throw new Error('invalid asana event');
+  return { eventId, title: text(task?.name) ?? `Asana task ${ref}`,
+    ...(text(task?.notes) ? { description: text(task?.notes) } : {}),
+    external: { provider, ref, ...(text(task?.permalink_url) ? { url: text(task?.permalink_url) } : {}) } };
+}

package/src/hooks/queue.ts

@@ -0,0 +1,73 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, readdirSync, renameSync, rmSync, writeSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { effectiveInstanceRoot } from '../instance/resolve.js';
+import type { ExternalTask } from './providers.js';
+
+export interface QueuedHook { provider: ExternalTask['external']['provider']; eventId: string; task: ExternalTask }
+
+export class HookQueue {
+  readonly directory: string;
+  readonly seenPath: string;
+  readonly deliveredPath: string;
+  private readonly seen = new Set<string>();
+
+  constructor(root: string = effectiveInstanceRoot()) {
+    const hooks = join(root, 'hooks');
+    this.directory = join(hooks, 'queue');
+    this.seenPath = join(hooks, 'seen.jsonl');
+    this.deliveredPath = join(hooks, 'last-delivered');
+    mkdirSync(this.directory, { recursive: true, mode: 0o700 });
+    if (existsSync(this.seenPath)) {
+      for (const line of readFileSync(this.seenPath, 'utf8').split('\n')) {
+        if (!line) continue;
+        const key: unknown = JSON.parse(line);
+        if (typeof key !== 'string') throw new Error('invalid hooks seen entry');
+        this.seen.add(key);
+      }
+    }
+    // A crash between publishing the queue file and appending seen must not create
+    // a second copy on replay (or allow a corrupt ledger to discard queued work).
+    for (const event of this.entries()) this.seen.add(`${event.provider}:${event.eventId}`);
+  }
+
+  private filename(provider: string, eventId: string): string {
+    return join(this.directory, `${createHash('sha256').update(`${provider}:${eventId}`).digest('hex')}.json`);
+  }
+
+  enqueue(event: QueuedHook): boolean {
+    const key = `${event.provider}:${event.eventId}`;
+    const path = this.filename(event.provider, event.eventId);
+    if (this.seen.has(key)) return false;
+    if (!existsSync(path)) this.atomicWrite(path, JSON.stringify(event));
+    const fd = openSync(this.seenPath, 'a', 0o600);
+    try { writeSync(fd, `${JSON.stringify(key)}\n`); fsyncSync(fd); }
+    finally { closeSync(fd); }
+    this.seen.add(key);
+    return true;
+  }
+
+  private atomicWrite(path: string, content: string): void {
+    const temp = `${path}.${randomBytes(8).toString('hex')}.tmp`;
+    try {
+      const fd = openSync(temp, 'wx', 0o600);
+      try { writeSync(fd, content); fsyncSync(fd); } finally { closeSync(fd); }
+      renameSync(temp, path);
+      const dir = openSync(dirname(path), 'r');
+      try { fsyncSync(dir); } finally { closeSync(dir); }
+    } finally { rmSync(temp, { force: true }); }
+  }
+
+  entries(): QueuedHook[] {
+    return readdirSync(this.directory).filter(name => /^[a-f0-9]{64}\.json$/.test(name))
+      .map(name => JSON.parse(readFileSync(join(this.directory, name), 'utf8')) as QueuedHook);
+  }
+  count(): number { return readdirSync(this.directory).filter(name => /^[a-f0-9]{64}\.json$/.test(name)).length; }
+  delivered(event: QueuedHook, now: number = Date.now()): void {
+    this.atomicWrite(this.deliveredPath, new Date(now).toISOString());
+    rmSync(this.filename(event.provider, event.eventId));
+  }
+  lastDelivered(): string | null {
+    return existsSync(this.deliveredPath) ? readFileSync(this.deliveredPath, 'utf8') : null;
+  }
+}