elanous 0.2.0 → 0.2.4

package/src/task-orchestrator/surfaces/pod-pool.ts

@@ -15,6 +15,7 @@
 import { spawn, spawnSync } from 'node:child_process';
 import { existsSync } from 'node:fs';
 import { join, resolve } from 'node:path';
+import { debug } from '../../debug/log.js';
 
 export interface PodPoolMember {
   readonly context: string;
@@ -23,6 +24,70 @@ export interface PodPoolMember {
   readonly capacity: number;
   /** k3d 클러스터 이름(이미지 반입용). 기본: 컨텍스트가 `k3d-<이름>` 이면 그 이름, 원격이면 `elanous-pool`. */
   readonly k3dCluster: string;
+  /** 노드 로컬 레지스트리의 이미지(커밋 태그) — 있으면 Pod 가 이것을 pull 한다(델타 · 대표 2026-09-26). 없으면 반입된 로컬 이미지. */
+  readonly imageRef?: string;
+}
+
+/** 노드 로컬 레지스트리(`scripts/fleet/node-setup.sh` 5b) — 클러스터 안에서 부르는 이름. */
+export const NODE_REGISTRY = `k3d-elanous-registry:${process.env.ELANOUS_FLEET_REGISTRY_PORT ?? '5050'}`;
+
+/** 노드 쪽 빌드가 실패했을 때, 같은 판을 굽는 다른 발사의 레지스트리 태그를 기다리는 한도. */
+const CONCURRENT_BUILD_WAIT_MS = 5 * 60_000;
+const CONCURRENT_BUILD_POLL_MS = 15_000;
+
+const sleep = (ms: number): Promise<void> => new Promise((done) => setTimeout(done, ms));
+
+/**
+ * 노드 쪽 빌드가 부딪혀 실패한 뒤, 같은 판을 굽는 다른 발사가 레지스트리에 이 커밋 태그를 올리는지 본다.
+ * 생기면 그 imageRef. 한도까지 없으면 null. 간격은 시험이 짧게 주입한다.
+ */
+async function waitForConcurrentBuild(member: PodPoolMember, commit: string | null, opts: { intervalMs?: number; maxMs?: number; now?: () => number; sleep?: (ms: number) => Promise<void>; run?: RemoteRun } = {}): Promise<{ imageRef: string | null; waitedMs: number }> {
+  const intervalMs = opts.intervalMs ?? CONCURRENT_BUILD_POLL_MS;
+  const maxMs = opts.maxMs ?? CONCURRENT_BUILD_WAIT_MS;
+  if (maxMs <= 0) return { imageRef: registryImageRef(member, commit, opts.run), waitedMs: 0 };
+  const now = opts.now ?? Date.now;
+  const pause = opts.sleep ?? sleep;
+  const started = now();
+  for (;;) {
+    const imageRef = registryImageRef(member, commit, opts.run);
+    const waitedMs = now() - started;
+    if (imageRef || waitedMs >= maxMs) return { imageRef, waitedMs };
+    const remaining = maxMs - waitedMs;
+    await pause(Math.min(intervalMs, remaining));
+  }
+}
+
+/** 이 기계 이미지의 커밋 라벨(`elanous.commit`). 못 읽으면 null — 목표와 같다고 여기지 않는다. */
+function localImageCommit(image: string, inspect: LocalImageInspect = defaultLocalImageInspect): string | null {
+  const r = inspect(image);
+  const v = r.status === 0 ? r.stdout.trim() : '';
+  return v && v !== '<no value>' ? v : null;
+}
+
+function defaultLocalImageInspect(image: string): { status: number | null; stdout: string } {
+  const r = spawnSync('docker', ['image', 'inspect', image, '--format', '{{index .Config.Labels "elanous.commit"}}'], { encoding: 'utf8', timeout: 30_000 });
+  return { status: r.status, stdout: r.stdout ?? '' };
+}
+
+/** 이 커밋의 이미지가 노드 레지스트리에 있나 — 있으면 클러스터 안 이미지 주소. */
+export function registryImageRef(member: PodPoolMember, commit: string | null, run: RemoteRun = defaultRemoteRun): string | null {
+  if (!member.sshHost || !commit) return null;
+  const tag = commit.slice(0, 12);
+  const port = process.env.ELANOUS_FLEET_REGISTRY_PORT ?? '5050';
+  const r = run(member.sshHost, `curl -fsS http://localhost:${port}/v2/elanous-harness/tags/list 2>/dev/null`);
+  if (r.status !== 0) return null;
+  try {
+    const tags = (JSON.parse(r.stdout) as { tags?: string[] }).tags ?? [];
+    return tags.includes(tag) ? `${NODE_REGISTRY}/elanous-harness:${tag}` : null;
+  } catch { return null; }
+}
+
+/** 노드 이미지의 스킬 해시 라벨(`elanous.pod-skills`). */
+export function remoteImageSkillsDigest(member: PodPoolMember, image: string, run: RemoteRun = defaultRemoteRun): string | null {
+  if (!member.sshHost) return null;
+  const r = run(member.sshHost, `docker image inspect ${image} --format '{{index .Config.Labels "elanous.pod-skills"}}'`);
+  const v = r.status === 0 ? r.stdout.trim() : '';
+  return v && v !== '<no value>' ? v : null;
 }
 
 const MEMBER = /^([A-Za-z0-9][A-Za-z0-9._-]*)(?:@([A-Za-z0-9][A-Za-z0-9._-]*))?(?::(\d+))?$/u;
@@ -43,11 +108,20 @@ export function parsePodPool(spec: string): PodPoolMember[] {
 }
 
 /** 스펙 해석 순서: 명시 인자 → `ELANOUS_POD_POOL` → 없음(null = 현재 컨텍스트 하나). */
-export function resolvePodPoolSpec(explicit: string | undefined, env: NodeJS.ProcessEnv = process.env): string | null {
-  const v = explicit?.trim() || env.ELANOUS_POD_POOL?.trim();
+export function resolvePodPoolSpec(explicit: string | undefined, env: NodeJS.ProcessEnv = process.env, configPool: () => string | undefined = defaultConfigPool): string | null {
+  // ⭐ «--substrate pod 만 써도 분배»(대표 2026-09-26) — 인자 → 환경 → 설정 `pod.pool` 순. 셋 다 없으면 현재 컨텍스트 하나.
+  const v = explicit?.trim() || env.ELANOUS_POD_POOL?.trim() || configPool()?.trim();
   return v ? v : null;
 }
 
+function defaultConfigPool(): string | undefined {
+  try {
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const { getUserConfig } = require('../../user-config.js') as typeof import('../../user-config.js');
+    return getUserConfig().pod?.pool;
+  } catch { return undefined; }
+}
+
 /** 노드 자리 배분 — 우선순위 순서로 첫 빈 자리. 순수(시각·대기는 호출자가). */
 export class PodPoolScheduler {
   private readonly inflight = new Map<string, number>();
@@ -70,6 +144,16 @@ export class PodPoolScheduler {
 
 export type RemoteRun = (host: string, script: string, input?: Buffer) => { status: number | null; stdout: string; stderr: string };
 
+type LocalImageInspect = (image: string) => { status: number | null; stdout: string };
+
+/** `docker save | ssh docker load` 한 번. 시험이 실제 전송 대신 호출 횟수만 센다. */
+type ImageShip = (member: PodPoolMember, image: string) => { status: number | null; stderr: string };
+
+function defaultImageShip(member: PodPoolMember, image: string): { status: number | null; stderr: string } {
+  const ship = spawnSync('bash', ['-c', `set -o pipefail; docker save ${image} | gzip -1 | ssh -o BatchMode=yes -o ConnectTimeout=10 ${member.sshHost} 'export PATH=/opt/homebrew/bin:/usr/local/bin:$HOME/.orbstack/bin:$PATH; gunzip | docker load'`], { encoding: 'utf8', timeout: 1_800_000 });
+  return { status: ship.status, stderr: ship.stderr ?? '' };
+}
+
 export function defaultRemoteRun(host: string, script: string): { status: number | null; stdout: string; stderr: string } {
   const r = spawnSync('ssh', ['-o', 'BatchMode=yes', '-o', 'ConnectTimeout=10', host, `export PATH=/opt/homebrew/bin:/usr/local/bin:$HOME/.orbstack/bin:$PATH; unset HTTPS_PROXY https_proxy HTTP_PROXY http_proxy ALL_PROXY all_proxy; ${script}`], { encoding: 'utf8', timeout: 900_000 });
   return { status: r.status, stdout: r.stdout ?? '', stderr: (r.stderr ?? '') + (r.error ? String(r.error) : '') };
@@ -87,15 +171,22 @@ export function remoteImageCommit(member: PodPoolMember, image: string, run: Rem
  * 원격 노드에 이 기계의 이미지를 보낸다(판이 다를 때만) — `docker save | ssh docker load` ⊕ `k3d image import`.
  * ⛔ Pod 의 elanous 는 이미지 판이다(피드백: Pod 는 main 이 아니라 이미지를 돈다) — 노드마다 판이 다르면 같은 골이 노드마다 다른 코드로 돈다.
  */
-export function syncPoolImage(member: PodPoolMember, image: string, localCommit: string | null, run: RemoteRun = defaultRemoteRun): { ok: boolean; action: 'local' | 'fresh' | 'built' | 'shipped' | 'failed'; detail: string } {
+export function syncPoolImage(member: PodPoolMember, image: string, localCommit: string | null, run: RemoteRun | { run?: RemoteRun; inspect?: LocalImageInspect; transfer?: ImageShip } = defaultRemoteRun): { ok: boolean; action: 'local' | 'fresh' | 'built' | 'shipped' | 'failed'; detail: string } {
+  const opts = typeof run === 'function' ? { run } : { run: run.run ?? defaultRemoteRun, inspect: run.inspect, transfer: run.transfer };
+  const remote = opts.run ?? defaultRemoteRun;
+  const inspect = opts.inspect ?? defaultLocalImageInspect;
+  const transfer = opts.transfer ?? defaultImageShip;
   if (!member.sshHost) return { ok: true, action: 'local', detail: 'this machine' };
-  const before = remoteImageCommit(member, image, run);
+  const before = remoteImageCommit(member, image, remote);
   if (localCommit && before === localCommit) return { ok: true, action: 'fresh', detail: before.slice(0, 12) };
-  const ship = spawnSync('bash', ['-c', `set -o pipefail; docker save ${image} | gzip -1 | ssh -o BatchMode=yes -o ConnectTimeout=10 ${member.sshHost} 'export PATH=/opt/homebrew/bin:/usr/local/bin:$HOME/.orbstack/bin:$PATH; gunzip | docker load'`], { encoding: 'utf8', timeout: 1_800_000 });
+  // 통째 전송은 이 기계 이미지의 커밋 라벨이 목표와 같을 때만. 다르면 낡은 판을 보내지 않는다.
+  const here = localImageCommit(image, inspect);
+  if (localCommit && here !== localCommit) return { ok: false, action: 'failed', detail: '로컬 이미지 판이 다르다 · 보내지 않음' };
+  const ship = transfer(member, image);
   if (ship.status !== 0) return { ok: false, action: 'failed', detail: `docker load rc=${ship.status}: ${(ship.stderr ?? '').slice(-300)}` };
-  const imp = run(member.sshHost, `k3d image import ${image} -c ${member.k3dCluster}`);
+  const imp = remote(member.sshHost, `k3d image import ${image} -c ${member.k3dCluster}`);
   if (imp.status !== 0) return { ok: false, action: 'failed', detail: `k3d import rc=${imp.status}: ${imp.stderr.slice(-300)}` };
-  const after = remoteImageCommit(member, image, run);
+  const after = remoteImageCommit(member, image, remote);
   return after && (!localCommit || after === localCommit)
     ? { ok: true, action: 'shipped', detail: `${before?.slice(0, 12) ?? '없음'} → ${after.slice(0, 12)}` }
     : { ok: false, action: 'failed', detail: `보낸 뒤 판이 ${after ?? '없음'} — 기대 ${localCommit ?? '?'}` };
@@ -118,7 +209,7 @@ export function checkPodPool(members: readonly PodPoolMember[], kubectl: PoolKub
   return { ok: ready.length > 0, ready, dropped };
 }
 
-export type PoolImageSync = { ok: boolean; action: 'local' | 'fresh' | 'built' | 'shipped' | 'failed'; detail: string; ms: number };
+export type PoolImageSync = { ok: boolean; action: 'local' | 'fresh' | 'built' | 'shipped' | 'failed'; detail: string; ms: number; /** 노드 레지스트리의 이 판 이미지(있으면 Pod 가 pull). */ imageRef?: string };
 
 /** 이미지 빌드 스크립트 — 발사한 트리의 것(판이 HEAD 와 같다). 없으면 null(통째 전송으로 떨어진다). */
 export function podImageBuildScript(cwd: string = process.cwd()): string | null {
@@ -147,21 +238,46 @@ function defaultRemoteBuild(script: string): RemoteBuild {
  *           📏 커밋이 바뀐 뒤 두 노드를 올리는 데 벽시계 55초(종전: 다시 굽기 1분 40초 ⊕ 4GB 차례 전송 5분 48초).
  *   실패하면 = 종전의 통째 전송(syncPoolImage)으로 떨어진다.
  */
-export async function syncPoolImages(members: readonly PodPoolMember[], image: string, localCommit: string | null, deps: { run?: RemoteRun; remoteBuild?: RemoteBuild; buildScript?: string | null; ship?: typeof syncPoolImage } = {}): Promise<Map<string, PoolImageSync>> {
+export async function syncPoolImages(members: readonly PodPoolMember[], image: string, localCommit: string | null, deps: { run?: RemoteRun; remoteBuild?: RemoteBuild; buildScript?: string | null; ship?: typeof syncPoolImage; localSkillsDigest?: string | null; waitIntervalMs?: number; waitMaxMs?: number; now?: () => number; sleep?: (ms: number) => Promise<void>; inspect?: LocalImageInspect; transfer?: ImageShip } = {}): Promise<Map<string, PoolImageSync>> {
   const run = deps.run ?? defaultRemoteRun;
   const script = deps.buildScript === undefined ? podImageBuildScript() : deps.buildScript;
   const remoteBuild = deps.remoteBuild ?? (script ? defaultRemoteBuild(script) : null);
-  const ship = deps.ship ?? syncPoolImage;
+  const ship = deps.ship ?? ((m: PodPoolMember, img: string, commit: string | null, remote: RemoteRun) => syncPoolImage(m, img, commit, { run: remote, inspect: deps.inspect, transfer: deps.transfer }));
   const results = new Map<string, PoolImageSync>();
   await Promise.all(members.map(async (m) => {
     const t0 = Date.now();
     if (!m.sshHost) { results.set(m.context, { ok: true, action: 'local', detail: 'this machine', ms: 0 }); return; }
     const before = remoteImageCommit(m, image, run);
-    if (localCommit && before === localCommit) { results.set(m.context, { ok: true, action: 'fresh', detail: before.slice(0, 12), ms: Date.now() - t0 }); return; }
+    // ⭐ «같은 판» = 커밋 ⊕ 스킬 해시 ⊕ (레지스트리 노드면) 레지스트리에 그 커밋 태그가 있다 — 스킬만 바뀌어도 다시 굽는다(대표 2026-09-26 «스킬 셋트 싱크»).
+    const skillsNow = deps.localSkillsDigest;
+    const skillsSame = skillsNow == null || remoteImageSkillsDigest(m, image, run) === skillsNow;
+    const refBefore = registryImageRef(m, localCommit, run);
+    const hasRegistry = run(m.sshHost, 'docker inspect k3d-elanous-registry >/dev/null 2>&1').status === 0;
+    if (localCommit && before === localCommit && skillsSame && (!hasRegistry || refBefore)) {
+      results.set(m.context, { ok: true, action: 'fresh', detail: before.slice(0, 12), ms: Date.now() - t0, ...(refBefore ? { imageRef: refBefore } : {}) });
+      return;
+    }
     if (remoteBuild) {
       const b = await remoteBuild(m.sshHost, m.k3dCluster);
       const after = remoteImageCommit(m, image, run);
-      if (b.ok && after && (!localCommit || after === localCommit)) { results.set(m.context, { ok: true, action: 'built', detail: `${before?.slice(0, 12) ?? '없음'} → ${after.slice(0, 12)} (노드 쪽 빌드)`, ms: Date.now() - t0 }); return; }
+      const refAfter = registryImageRef(m, localCommit ?? after, run);
+      // ⭐ 레지스트리 노드면 «이 판 커밋 태그가 레지스트리에 있나»로 판정한다 — Pod 는 그 커밋 태그를 pull 한다.
+      //   🩸 2026-09-26(🅣 실측): 두 발사가 같은 노드를 동시에 구우면 가변 태그 `:local` 을 서로 덮어, 빌드는 성공했는데
+      //   `:local` 의 판이 남의 커밋이라 «못 맞췄다»로 노드를 뺐다(런이 시작도 못 함). 커밋 태그는 덮이지 않는다.
+      if (b.ok && localCommit && refAfter) {
+        results.set(m.context, { ok: true, action: 'built', imageRef: refAfter, detail: `${before?.slice(0, 12) ?? '없음'} → ${localCommit.slice(0, 12)} (노드 쪽 빌드 · 레지스트리 판 태그)`, ms: Date.now() - t0 });
+        return;
+      }
+      if (b.ok && after && (!localCommit || after === localCommit)) { results.set(m.context, { ok: true, action: 'built', ...(refAfter ? { imageRef: refAfter } : {}), detail: `${before?.slice(0, 12) ?? '없음'} → ${after.slice(0, 12)} (노드 쪽 빌드)`, ms: Date.now() - t0 }); return; }
+      // 빌드가 성공하면 위에서 즉시 끝난다. 실패했을 때만, 통째 전송 전에 같은 판을 굽는 다른 발사의 태그를 기다린다.
+      if (!b.ok) {
+        const waited = await waitForConcurrentBuild(m, localCommit, { intervalMs: deps.waitIntervalMs, maxMs: deps.waitMaxMs, now: deps.now, sleep: deps.sleep, run });
+        debug.log('self-implement.pod', 'pool-image-wait-concurrent', { context: m.context, commit: localCommit, waitedMs: waited.waitedMs, outcome: waited.imageRef ? 'built' : 'timeout' });
+        if (waited.imageRef) {
+          results.set(m.context, { ok: true, action: 'built', imageRef: waited.imageRef, detail: '동시 빌드 결과 사용', ms: Date.now() - t0 });
+          return;
+        }
+      }
       const fallback = ship(m, image, localCommit, run);
       results.set(m.context, { ...fallback, detail: `노드 쪽 빌드 실패(${b.detail}) → ${fallback.detail}`, ms: Date.now() - t0 });
       return;

package/src/task-orchestrator/surfaces/pod-skills.ts

@@ -19,14 +19,22 @@ import { homedir } from 'node:os';
 import { join, relative } from 'node:path';
 import { LOCAL_SKILLS_DIR } from '../../config.js';
 import { getElanousConfigDir } from '../../elanous-config-dir.js';
+import { prodInstanceRoot } from '../../instance/resolve.js';
 
 const SKILL_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]*$/u;
 
-/** 이미지로 가면 안 되는 것 — 비밀 ⊕ 재생성물. 이름(경로 조각) 기준. */
-const EXCLUDED_NAME = /^(\.env(\..*)?|.*\.(pem|key|p12|pfx)|auth[^/]*\.json|credentials[^/]*\.json|token[^/]*\.json|node_modules|\.venv|venv|__pycache__|\.cache|\.git|\.DS_Store|.*\.log)$/iu;
+/** 이미지로 가면 안 되는 것 — 비밀 ⊕ 재생성물 ⊕ «개인 데이터·상태». 이름(경로 조각) 기준.
+ *  🔐 2026-09-27(🅞 짚음): 스킬 폴더의 `data/`(yt-vault 413MB · 구독·흡수 이력 DB) · `.elanous/`(스킬이 쓴 관측·상태) · DB 파일이
+ *  이미지(→ node-b 레지스트리)에 구워질 뻔했다 — 코드만 이미지로, 데이터는 런이 산출 폴더로 받는다. */
+const EXCLUDED_NAME = /^(\.env(\..*)?|.*\.(pem|key|p12|pfx)|auth[^/]*\.json|credentials[^/]*\.json|token[^/]*\.json|node_modules|\.venv|venv|__pycache__|\.cache|\.git|\.DS_Store|.*\.log|data|\.elanous|\.monad|.*\.(db|sqlite|sqlite3|db-wal|db-shm|sqlite-wal|sqlite-shm))$/iu;
 
 export function podSkillsListPath(configDir: string = getElanousConfigDir()): string {
-  return join(configDir, 'pod-skills.txt');
+  const here = join(configDir, 'pod-skills.txt');
+  if (configDir !== getElanousConfigDir() || existsSync(here)) return here;
+  // 스킬 목록은 «이 기계 사용자»의 설정이다(스킬도 ~/.claude/skills 에 있다) — 워크트리의 시험 우주에서 빌드해도
+  //   운영 목록을 읽는다(2026-09-26 실측: 워크트리 빌드가 목록을 못 찾아 스킬 0개로 이미지를 구웠다).
+  const prod = join(prodInstanceRoot(), 'pod-skills.txt');
+  return existsSync(prod) ? prod : here;
 }
 
 /** 목록 해석: `ELANOUS_POD_SKILLS` → 설정 파일 → 빈 목록. 이름 규칙 밖은 버리지 않고 오류로 낸다. */

package/src/task-orchestrator/surfaces/pod-source-bundle.ts

@@ -0,0 +1,132 @@
+import { execFileSync } from 'node:child_process';
+import { createHash, randomUUID } from 'node:crypto';
+import { existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, rmSync, statSync } from 'node:fs';
+import { dirname, isAbsolute, relative, resolve } from 'node:path';
+import { debug } from '../../debug/log.js';
+
+const DEFAULT_MAX_SIZE_BYTES = 200 * 1024 * 1024;
+
+type PackOptions = {
+  repoDir: string;
+  kind: 'worktree' | 'files';
+  base: string;
+  paths?: string[];
+  outDir: string;
+  maxSizeBytes?: number;
+  log?: (category: string, event: string, data: Record<string, unknown>) => void;
+};
+
+type PackedBundle = {
+  bundlePath: string;
+  sha256: string;
+  sizeBytes: number;
+  baseCommit: string;
+  headCommit: string;
+  fileCount: number;
+};
+
+function git(repoDir: string, env: NodeJS.ProcessEnv, ...args: string[]): string {
+  try {
+    return execFileSync('git', args, { cwd: repoDir, env, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] }).trim();
+  } catch (error) {
+    const e = error as Error & { stderr?: Buffer | string };
+    throw new Error(`git ${args[0]} failed: ${String(e.stderr ?? e.message).trim()}`);
+  }
+}
+
+/** Package the host's on-disk files above a fetchable remote base without touching the user's index. */
+export function packSourceBundle(options: PackOptions): PackedBundle {
+  const { repoDir, kind, base, paths, outDir } = options;
+  const log = options.log ?? ((category: string, event: string, data: Record<string, unknown>) => debug.log(category, event, data));
+  const started = Date.now();
+  let root = resolve(repoDir);
+  const output = resolve(outDir);
+  const env = { ...process.env, GIT_INDEX_FILE: `${output}/index.tmp`, GIT_OPTIONAL_LOCKS: '0',
+    GIT_AUTHOR_NAME: 'elanous pod source', GIT_AUTHOR_EMAIL: 'pod-source@elanous.local',
+    GIT_COMMITTER_NAME: 'elanous pod source', GIT_COMMITTER_EMAIL: 'pod-source@elanous.local' };
+  const bundlePath = `${output}/pod-source-${randomUUID()}.bundle`;
+  let ref: string | undefined;
+  let headCommit: string | undefined;
+  let ownsIndex = false;
+  let createdBundle = false;
+  try {
+    root = git(root, env, 'rev-parse', '--show-toplevel');
+    const outputRelative = relative(root, output);
+    if (!outputRelative || (!outputRelative.startsWith('..') && !isAbsolute(outputRelative))) {
+      throw new Error('outDir must be outside the source worktree');
+    }
+    if (kind !== 'worktree' && kind !== 'files') throw new Error('unknown source kind');
+    if (kind === 'files' && (!paths?.length || paths.some((path) => !path || path.startsWith('-') || isAbsolute(path) || path.includes('\\') || path.split('/').some((part) => part === '..' || part === '.')))) {
+      throw new Error('files requires nonempty relative paths inside the worktree');
+    }
+    const limit = options.maxSizeBytes ?? DEFAULT_MAX_SIZE_BYTES;
+    if (!Number.isSafeInteger(limit) || limit < 0) throw new Error('invalid bundle size limit');
+    const baseCommit = git(root, env, 'rev-parse', '--verify', `${base}^{commit}`);
+    // Ask origin, not its potentially absent or stale local tracking refs. Fetch objects only.
+    const { GIT_INDEX_FILE: _temporaryIndex, ...remoteEnv } = env;
+    const remoteHead = git(root, remoteEnv, 'ls-remote', '--symref', 'origin', 'HEAD');
+    const defaultBranch = /^ref: (refs\/heads\/[^\t\n]+)\tHEAD$/m.exec(remoteHead)?.[1];
+    const remoteDefault = /^([0-9a-f]{40,64})\tHEAD$/m.exec(remoteHead)?.[1];
+    if (!defaultBranch || !remoteDefault) throw new Error('origin does not advertise a default branch commit');
+    git(root, remoteEnv, 'fetch', '--no-write-fetch-head', '--no-tags', '--refmap=', 'origin', defaultBranch);
+    if (git(root, remoteEnv, 'ls-remote', 'origin', defaultBranch).split('\t')[0] !== remoteDefault) {
+      throw new Error(`origin default branch (${defaultBranch}) changed during packing`);
+    }
+    try {
+      git(root, env, 'merge-base', '--is-ancestor', baseCommit, remoteDefault);
+    } catch {
+      throw new Error(`base ${baseCommit} is not on origin default branch (${defaultBranch}); origin cannot supply this base`);
+    }
+    let existingParent = output;
+    while (!existsSync(existingParent)) existingParent = dirname(existingParent);
+    const realParentRelative = relative(realpathSync(root), realpathSync(existingParent));
+    if (!realParentRelative || (!realParentRelative.startsWith('..') && !isAbsolute(realParentRelative))) {
+      throw new Error('outDir must be outside the source worktree');
+    }
+    mkdirSync(output, { recursive: true });
+    const realOutputRelative = relative(realpathSync(root), realpathSync(output));
+    if (!realOutputRelative || (!realOutputRelative.startsWith('..') && !isAbsolute(realOutputRelative))) {
+      throw new Error('outDir must be outside the source worktree');
+    }
+    const indexExists = (path: string): boolean => {
+      try { lstatSync(path); return true; }
+      catch (error) {
+        if ((error as NodeJS.ErrnoException).code === 'ENOENT') return false;
+        throw error;
+      }
+    };
+    if (indexExists(env.GIT_INDEX_FILE) || indexExists(`${env.GIT_INDEX_FILE}.lock`)) {
+      throw new Error('temporary index already exists in outDir');
+    }
+    ownsIndex = true;
+    git(root, env, 'read-tree', baseCommit);
+    if (kind === 'worktree') git(root, env, 'add', '-A');
+    else git(root, env, 'add', '--', ...paths!);
+    const tree = git(root, env, 'write-tree');
+    headCommit = git(root, env, 'commit-tree', tree, '-p', baseCommit, '-m', `elanous pod source (${kind})`);
+    const fileCount = git(root, env, 'diff-tree', '--no-commit-id', '--name-only', '-r', '-z', baseCommit, headCommit).split('\0').filter(Boolean).length;
+    ref = `refs/elanous/pod-source/${randomUUID()}`;
+    git(root, env, 'update-ref', ref, headCommit);
+    createdBundle = true;
+    git(root, env, 'bundle', 'create', bundlePath, `${baseCommit}..${ref}`);
+    git(root, env, 'update-ref', '-d', ref, headCommit);
+    ref = undefined;
+    const sizeBytes = statSync(bundlePath).size;
+    if (sizeBytes > limit) throw new Error(`bundle size ${sizeBytes} exceeds limit ${limit} bytes`);
+    const sha256 = createHash('sha256').update(readFileSync(bundlePath)).digest('hex');
+    const result = { bundlePath, sha256, sizeBytes, baseCommit, headCommit, fileCount };
+    log('pod.source', 'bundle-packed', { kind, baseCommit, headCommit, fileCount, sizeBytes, ms: Date.now() - started });
+    return result;
+  } catch (error) {
+    if (createdBundle) rmSync(bundlePath, { force: true });
+    const reason = error instanceof Error ? error.message : String(error);
+    log('pod.source', 'bundle-refused', { kind, reason });
+    throw error;
+  } finally {
+    if (ref && headCommit) git(root, env, 'update-ref', '-d', ref, headCommit);
+    if (ownsIndex) {
+      rmSync(env.GIT_INDEX_FILE, { force: true });
+      rmSync(`${env.GIT_INDEX_FILE}.lock`, { force: true });
+    }
+  }
+}

package/src/task-orchestrator/surfaces/pod-source-receive.ts

@@ -0,0 +1,91 @@
+/** Pod Job 원천 단계 — default clone · 커밋 · PR · 호스트 번들.
+ *  sha·PR·커밋은 형식 검사 전에 스크립트에 넣지 않는다(셸 주입 차단). */
+
+export type PodSource =
+  | { kind: 'default' }
+  | { kind: 'commit'; sha: string }
+  | { kind: 'pr'; number: number }
+  | { kind: 'bundle'; bundlePath: string; sha256: string; sizeBytes: number; headCommit: string };
+
+const SHA40 = /^[0-9a-f]{40}$/;
+
+function assertSha(value: string, label: string): string {
+  if (!SHA40.test(value)) throw new Error(`${label} must be 40 hex characters`);
+  return value;
+}
+
+function assertPositiveInt(value: number): number {
+  if (!Number.isSafeInteger(value) || value < 1) throw new Error('pr number must be a positive integer');
+  return value;
+}
+
+function assertSha256(value: string): string {
+  if (!/^[0-9a-f]{64}$/.test(value)) throw new Error('sha256 must be 64 hex characters');
+  return value;
+}
+
+function assertSize(value: number): number {
+  if (!Number.isSafeInteger(value) || value < 0) throw new Error('sizeBytes must be a non-negative integer');
+  return value;
+}
+
+/** Job 스크립트의 원천 단계. 성공 갈래는 `ELANOUS_POD_SOURCE <kind> <HEAD>` 로 끝난다. */
+export function podSourceScript(source: PodSource, repoUrl: string): string {
+  const clone = `git clone -q --depth 50 '${repoUrl}' repo`;
+  if (source.kind === 'default') {
+    return [
+      `${clone} && cd repo || exit 5`,
+      'head=$(git rev-parse HEAD)',
+      "printf 'ELANOUS_POD_SOURCE default %s\\n' \"$head\"",
+    ].join('\n');
+  }
+  if (source.kind === 'commit') {
+    const sha = assertSha(source.sha, 'sha');
+    return [
+      `${clone} && cd repo || exit 5`,
+      `git fetch --depth 1 origin ${sha}`,
+      `git checkout --detach ${sha}`,
+      'head=$(git rev-parse HEAD)',
+      "printf 'ELANOUS_POD_SOURCE commit %s\\n' \"$head\"",
+    ].join('\n');
+  }
+  if (source.kind === 'pr') {
+    const n = assertPositiveInt(source.number);
+    return [
+      `${clone} && cd repo || exit 5`,
+      `git fetch --depth 50 origin pull/${n}/head:pr-${n}`,
+      `git checkout pr-${n}`,
+      'head=$(git rev-parse HEAD)',
+      "printf 'ELANOUS_POD_SOURCE pr %s\\n' \"$head\"",
+    ].join('\n');
+  }
+  const sha256 = assertSha256(source.sha256);
+  const sizeBytes = assertSize(source.sizeBytes);
+  const headCommit = assertSha(source.headCommit, 'headCommit');
+  return [
+    'ready=0',
+    'for i in $(seq 1 300); do',
+    '  if [ -f /tmp/source.ready ]; then ready=1; break; fi',
+    '  sleep 1',
+    'done',
+    'if [ "$ready" -ne 1 ]; then',
+    "  printf 'ELANOUS_POD_SOURCE_MISMATCH ready-timeout\\n'",
+    '  exit 3',
+    'fi',
+    'size=$(wc -c < /tmp/source.bundle | tr -d " ")',
+    `if [ "$size" != "${sizeBytes}" ]; then`,
+    "  printf 'ELANOUS_POD_SOURCE_MISMATCH size\\n'",
+    '  exit 3',
+    'fi',
+    'got=$(sha256sum /tmp/source.bundle | awk \'{print $1}\')',
+    `if [ "$got" != "${sha256}" ]; then`,
+    "  printf 'ELANOUS_POD_SOURCE_MISMATCH sha256\\n'",
+    '  exit 3',
+    'fi',
+    'git clone /tmp/source.bundle repo',
+    `git -C repo checkout --detach ${headCommit}`,
+    'head=$(git -C repo rev-parse HEAD)',
+    "printf 'ELANOUS_POD_SOURCE bundle %s\\n' \"$head\"",
+    'cd repo',
+  ].join('\n');
+}

package/src/task-orchestrator/surfaces/pod-source-spec.ts

@@ -0,0 +1,77 @@
+/** 사람이 고른 Pod 원천 spec — `commit:` · `pr:` · `worktree:` · `files:`.
+ *  commit·pr 은 그대로 넘기고, worktree·files 는 호스트에서 포장해 bundle 로 만든다. */
+
+import { execFileSync } from 'node:child_process';
+import { isAbsolute, relative, resolve } from 'node:path';
+import { packSourceBundle } from './pod-source-bundle.js';
+import type { PodSource } from './pod-source-receive.js';
+
+export type ParsedPodSource =
+  | { kind: 'commit'; sha: string }
+  | { kind: 'pr'; number: number }
+  | { kind: 'worktree'; path: string }
+  | { kind: 'files'; paths: string[] };
+
+const SHA40 = /^[0-9a-f]{40}$/;
+
+export function parsePodSourceSpec(spec: string): ParsedPodSource {
+  const text = spec.trim();
+  const colon = text.indexOf(':');
+  if (colon < 1) throw new Error(`unknown source spec '${spec}' — expected commit:<40-hex> | pr:<integer> | worktree:<path> | files:<path>[,<path>…]`);
+  const kind = text.slice(0, colon);
+  const rest = text.slice(colon + 1);
+  if (kind === 'commit') {
+    if (!SHA40.test(rest)) throw new Error(`commit sha must be 40 hex characters (got '${rest}')`);
+    return { kind: 'commit', sha: rest };
+  }
+  if (kind === 'pr') {
+    if (!/^[1-9][0-9]*$/.test(rest)) throw new Error(`pr number must be a positive integer (got '${rest}')`);
+    const number = Number(rest);
+    if (!Number.isSafeInteger(number)) throw new Error(`pr number must be a positive integer (got '${rest}')`);
+    return { kind: 'pr', number };
+  }
+  if (kind === 'worktree') {
+    if (!rest || rest.startsWith('-')) throw new Error(`worktree path is empty or unsafe (got '${rest}')`);
+    return { kind: 'worktree', path: rest };
+  }
+  if (kind === 'files') {
+    const paths = rest.split(',').map((path) => path.trim()).filter((path) => path.length > 0);
+    if (paths.length === 0) throw new Error('files requires at least one path');
+    if (paths.some((path) => path.startsWith('-') || isAbsolute(path) || path.includes('\\') || path.split('/').some((part) => part === '..' || part === '.'))) {
+      throw new Error('files requires nonempty relative paths inside the worktree');
+    }
+    return { kind: 'files', paths };
+  }
+  throw new Error(`unknown source kind '${kind}' — expected commit | pr | worktree | files`);
+}
+
+function gitRoot(start: string): string {
+  try {
+    return execFileSync('git', ['rev-parse', '--show-toplevel'], {
+      cwd: start, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'],
+    }).trim();
+  } catch (error) {
+    const e = error as Error & { stderr?: Buffer | string };
+    throw new Error(`git rev-parse failed: ${String(e.stderr ?? e.message).trim()}`);
+  }
+}
+
+/** commit·pr 는 그대로. worktree·files 는 `packSourceBundle` 로 `{ kind: 'bundle' }`. */
+export function resolvePodSource(parsed: ParsedPodSource, opts: { base: string; outDir: string }): PodSource {
+  if (parsed.kind === 'commit') return { kind: 'commit', sha: parsed.sha };
+  if (parsed.kind === 'pr') return { kind: 'pr', number: parsed.number };
+  if (parsed.kind === 'worktree') {
+    const packed = packSourceBundle({ repoDir: resolve(parsed.path), kind: 'worktree', base: opts.base, outDir: opts.outDir });
+    return { kind: 'bundle', bundlePath: packed.bundlePath, sha256: packed.sha256, sizeBytes: packed.sizeBytes, headCommit: packed.headCommit };
+  }
+  const first = resolve(parsed.paths[0]!);
+  const root = gitRoot(first);
+  const paths = parsed.paths.map((path) => {
+    const abs = resolve(path);
+    const rel = relative(root, abs);
+    if (!rel || rel.startsWith('..') || isAbsolute(rel)) throw new Error(`files path '${path}' is outside git root ${root}`);
+    return rel.split('\\').join('/');
+  });
+  const packed = packSourceBundle({ repoDir: root, kind: 'files', base: opts.base, paths, outDir: opts.outDir });
+  return { kind: 'bundle', bundlePath: packed.bundlePath, sha256: packed.sha256, sizeBytes: packed.sizeBytes, headCommit: packed.headCommit };
+}