elanous 0.2.0 → 0.2.4

package/scripts/heal/run-role.ts

@@ -0,0 +1,328 @@
+#!/usr/bin/env bun
+/** 힐 판 역할 하나 — ELANOUS_GRAPH_CONTEXT 를 읽고 마지막 줄에 {outcome, …} JSON 을 낸다. */
+import { spawnSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { debug } from '../../src/debug/log.js';
+import {
+  fillMissingGateFacts,
+  markDeletedUnverified,
+  mergeHealSignatures,
+  triageFailure,
+  type HealCitation,
+  type HealFailureSignature,
+  type HealTriageHistory,
+  type PathExists,
+} from '../../src/self-implement/heal-triage.js';
+import { loadRunLedger, runLedgerDir, type RunLedgerEntry } from '../../src/self-implement/run-ledger.js';
+
+interface GraphContext {
+  graphId?: string;
+  runId?: string;
+  nodeId?: string;
+  input?: unknown;
+  outputs?: Record<string, unknown>;
+}
+
+function readContext(): GraphContext {
+  const path = process.env.ELANOUS_GRAPH_CONTEXT;
+  if (!path) return {};
+  try {
+    return JSON.parse(readFileSync(path, 'utf8')) as GraphContext;
+  } catch {
+    return {};
+  }
+}
+
+function asRecord(value: unknown): Record<string, unknown> | undefined {
+  return value && typeof value === 'object' && !Array.isArray(value) ? value as Record<string, unknown> : undefined;
+}
+
+function citationsOf(value: unknown): HealCitation[] {
+  if (!Array.isArray(value)) return [];
+  return value.flatMap((item) => {
+    const record = asRecord(item);
+    return typeof record?.title === 'string' && typeof record.url === 'string' && record.url.trim()
+      && typeof record.snippet === 'string'
+      ? [{ title: record.title, url: record.url, snippet: record.snippet }]
+      : [];
+  });
+}
+
+function failureOf(ctx: GraphContext): HealFailureSignature {
+  const input = asRecord(ctx.input);
+  const raw = asRecord(input?.failure) ?? input ?? {};
+  const unverified = Array.isArray(raw.unverified) ? raw.unverified.filter((item): item is string => typeof item === 'string') : [];
+  const citations = citationsOf(raw.citations);
+  return {
+    ...(typeof raw.failedTests === 'number' ? { failedTests: raw.failedTests } : {}),
+    ...(typeof raw.introduced === 'number' ? { introduced: raw.introduced } : {}),
+    ...(typeof raw.unknown === 'number' ? { unknown: raw.unknown } : {}),
+    ...(typeof raw.timedOut === 'number' ? { timedOut: raw.timedOut } : {}),
+    ...(unverified.length ? { unverified } : {}),
+    ...(typeof raw.importerUnrunTests === 'number' ? { importerUnrunTests: raw.importerUnrunTests } : {}),
+    ...(typeof raw.environmentClaim === 'string' ? { environmentClaim: raw.environmentClaim } : {}),
+    ...(typeof raw.namedSource === 'string' ? { namedSource: raw.namedSource } : {}),
+    ...(typeof raw.errorText === 'string' ? { errorText: raw.errorText } : {}),
+    ...(citations.length ? { citations } : {}),
+  };
+}
+
+function historyOf(ctx: GraphContext): HealTriageHistory {
+  return { visited: Object.keys(ctx.outputs ?? {}) };
+}
+
+function accountCount(failure: Record<string, unknown>): number | undefined {
+  const evidence = asRecord(failure.environmentEvidence);
+  const count = evidence?.accountCount ?? failure.accountCount;
+  return typeof count === 'number' ? count : undefined;
+}
+
+function exitCode(failure: Record<string, unknown>): number | undefined {
+  const evidence = asRecord(failure.environmentEvidence);
+  const code = evidence?.exitCode ?? failure.exitCode;
+  return typeof code === 'number' ? code : undefined;
+}
+
+function credentialMissing(failure: Record<string, unknown>): boolean {
+  const evidence = asRecord(failure.environmentEvidence);
+  return evidence?.credentialFile === 'missing' || failure.credentialFile === 'missing';
+}
+
+function accountsFullOrExpired(failure: Record<string, unknown>): boolean {
+  const evidence = asRecord(failure.environmentEvidence);
+  return evidence?.accounts === 'full' || evidence?.accounts === 'expired'
+    || failure.accounts === 'full' || failure.accounts === 'expired';
+}
+
+export interface HealRoleDeps {
+  exists?: (path: string) => PathExists;
+  loadLedger?: (runId: string) => RunLedgerEntry[] | null;
+  ledgerDir?: string;
+  search?: (query: string) => unknown;
+}
+
+function gitHeadExists(worktree: string, path: string): PathExists {
+  const repo = spawnSync('git', ['-C', worktree, 'rev-parse', '--is-inside-work-tree'], { encoding: 'utf8' });
+  if (repo.error || repo.status !== 0) return 'unknown';
+  const child = spawnSync('git', ['-C', worktree, 'cat-file', '-e', `HEAD:${path}`], { encoding: 'utf8' });
+  if (child.error || child.status === null) return 'unknown';
+  return child.status === 0;
+}
+
+function defaultExists(worktree: string): (path: string) => PathExists {
+  return (path) => gitHeadExists(worktree, path);
+}
+
+function signatureFromUnknown(value: unknown): HealFailureSignature | undefined {
+  const raw = asRecord(value);
+  if (!raw) return undefined;
+  const unverified = Array.isArray(raw.unverified) ? raw.unverified.filter((item): item is string => typeof item === 'string') : undefined;
+  const citations = citationsOf(raw.citations);
+  const signature: HealFailureSignature = {
+    ...(typeof raw.failedTests === 'number' ? { failedTests: raw.failedTests } : {}),
+    ...(typeof raw.introduced === 'number' ? { introduced: raw.introduced } : {}),
+    ...(typeof raw.unknown === 'number' ? { unknown: raw.unknown } : {}),
+    ...(typeof raw.timedOut === 'number' ? { timedOut: raw.timedOut } : {}),
+    ...(unverified ? { unverified } : {}),
+    ...(typeof raw.importerUnrunTests === 'number' ? { importerUnrunTests: raw.importerUnrunTests } : {}),
+    ...(typeof raw.environmentClaim === 'string' ? { environmentClaim: raw.environmentClaim } : {}),
+    ...(typeof raw.namedSource === 'string' ? { namedSource: raw.namedSource } : {}),
+    ...(typeof raw.errorText === 'string' ? { errorText: raw.errorText } : {}),
+    ...(citations.length ? { citations } : {}),
+  };
+  return Object.keys(signature).length ? signature : undefined;
+}
+
+function outputRecord(outputs: Record<string, unknown> | undefined, nodeId: string): Record<string, unknown> | undefined {
+  const raw = outputs?.[nodeId];
+  if (typeof raw === 'string') {
+    const line = raw.split('\n').map((row) => row.trim()).filter(Boolean).at(-1);
+    return line?.startsWith('{') ? asRecord(JSON.parse(line) as unknown) : undefined;
+  }
+  return asRecord(raw);
+}
+
+function collectSignature(outputs: Record<string, unknown> | undefined): HealFailureSignature | undefined {
+  const record = outputRecord(outputs, 'collect');
+  const entries = Array.isArray(record?.entries) ? record.entries : [];
+  return signatureFromUnknown(entries[0]);
+}
+
+function deeperSignature(outputs: Record<string, unknown> | undefined): HealFailureSignature | undefined {
+  const record = outputRecord(outputs, 'observe-deeper');
+  return signatureFromUnknown(record?.signature);
+}
+
+function externalSignature(outputs: Record<string, unknown> | undefined): HealFailureSignature | undefined {
+  const record = outputRecord(outputs, 'ground-external');
+  return record?.outcome === 'ok' ? signatureFromUnknown(record) : undefined;
+}
+
+function withAddedFacts(result: Record<string, unknown>, addedFacts: readonly string[]): Record<string, unknown> {
+  return { ...result, addedFacts: [...addedFacts] };
+}
+
+function mergedContextSignature(signature: HealFailureSignature, outputs: GraphContext['outputs']) {
+  const collect = collectSignature(outputs);
+  const deeper = deeperSignature(outputs);
+  const external = externalSignature(outputs);
+  return mergeHealSignatures(signature, [
+    ...(collect ? [{ source: 'collect', signature: collect }] : []),
+    ...(deeper ? [{ source: 'observe-deeper', signature: deeper }] : []),
+    ...(external ? [{ source: 'ground-external', signature: external }] : []),
+  ]);
+}
+
+function firstJsonObject(text: string): string | undefined {
+  const start = text.search(/\S/);
+  if (start < 0 || text[start] !== '{') return undefined;
+  let depth = 0;
+  let quoted = false;
+  let escaped = false;
+  for (let i = start; i < text.length; i++) {
+    const char = text[i];
+    if (quoted) {
+      if (escaped) escaped = false;
+      else if (char === '\\') escaped = true;
+      else if (char === '"') quoted = false;
+    } else if (char === '"') quoted = true;
+    else if (char === '{') depth++;
+    else if (char === '}' && --depth === 0) return text.slice(start, i + 1);
+  }
+  return undefined;
+}
+
+function defaultSearch(query: string): unknown {
+  const script = join(homedir(), '.claude/skills/omni-crawl/scripts/main.ts');
+  const child = spawnSync('npx', ['tsx', script, query, '--engine', 'fc-dev', '--json'], {
+    encoding: 'utf8', timeout: 60_000, maxBuffer: 8 * 1024 * 1024,
+  });
+  if (child.error || child.status !== 0) return [];
+  const begin = '---BEGIN_OMNI_CRAWL_JSON---';
+  const end = '---END_OMNI_CRAWL_JSON---';
+  const start = child.stdout.indexOf(begin);
+  if (start < 0) return [];
+  const finish = child.stdout.indexOf(end, start + begin.length);
+  try {
+    const payload = child.stdout.slice(start + begin.length, finish < 0 ? undefined : finish);
+    return JSON.parse(finish < 0 ? firstJsonObject(payload) ?? '' : payload.trim()) as unknown;
+  } catch {
+    return [];
+  }
+}
+
+function searchCitations(value: unknown): HealCitation[] {
+  if (Array.isArray(value)) {
+    return value.flatMap((item) => {
+      const raw = asRecord(item);
+      const snippet = raw?.snippet ?? raw?.text;
+      return typeof raw?.url === 'string' && raw.url.trim() && typeof raw.title === 'string' && typeof snippet === 'string'
+        ? [{ title: raw.title, url: raw.url, snippet: snippet.slice(0, 200) }]
+        : [];
+    }).slice(0, 5);
+  }
+  const payload = asRecord(value);
+  if (!Array.isArray(payload?.results)) return [];
+  return searchCitations(payload.results.flatMap((result) => {
+    const record = asRecord(result);
+    return Array.isArray(record?.items) ? record.items : [result];
+  }));
+}
+
+function groundQuery(signature: HealFailureSignature, failure: Record<string, unknown>): string {
+  if (signature.errorText?.trim()) return signature.errorText;
+  const names = failure.failedTestNames ?? failure.failingTests ?? failure.testNames;
+  return Array.isArray(names) ? names.filter((name): name is string => typeof name === 'string').slice(0, 3).join(' ') : '';
+}
+
+export function roleResult(role: string, ctx: GraphContext, deps: HealRoleDeps = {}): Record<string, unknown> {
+  const input = asRecord(ctx.input) ?? {};
+  const failure = asRecord(input.failure) ?? input;
+  const signature = failureOf(ctx);
+  switch (role) {
+    case 'observe-ledger': {
+      if (!asRecord(input.failure) && Object.keys(failure).length === 0) return withAddedFacts({ outcome: 'empty' }, []);
+      const worktree = typeof input.worktree === 'string' ? input.worktree : '';
+      const paths = signature.unverified ?? [];
+      if (!worktree || paths.length === 0) return withAddedFacts({ outcome: 'ok', entries: [signature] }, []);
+      const exists = deps.exists ?? defaultExists(worktree);
+      const marked = markDeletedUnverified(paths, exists);
+      const changed = marked.some((path, index) => path !== paths[index]);
+      const entry: HealFailureSignature = { ...signature, unverified: marked };
+      return withAddedFacts({ outcome: 'ok', entries: [entry] }, changed ? ['unverified'] : []);
+    }
+    case 'triage': {
+      const merged = mergedContextSignature(signature, ctx.outputs);
+      const judged = triageFailure(merged.signature, historyOf(ctx));
+      return withAddedFacts(
+        { outcome: judged.outcome === 'rework-with-citations' ? 'child-fixable' : judged.outcome, evidence: [...merged.evidence, ...judged.evidence] },
+        merged.evidence.map((line) => line.split(' ← ')[0]!).filter((field, index, all) => all.indexOf(field) === index),
+      );
+    }
+    case 'verify-classification-evidence': {
+      const count = accountCount(failure);
+      const code = exitCode(failure);
+      if (count === 0) return { outcome: 'corrected', 'corrected-kind': 'no-account' };
+      if (code === 127) return { outcome: 'corrected', 'corrected-kind': 'binary-missing' };
+      if (credentialMissing(failure)) return { outcome: 'corrected', 'corrected-kind': 'credential-file-missing' };
+      if ((count ?? 0) > 0 && accountsFullOrExpired(failure)) return { outcome: 'confirmed', next: 'defer' };
+      return { outcome: 'corrected', 'corrected-kind': 'unexplained' };
+    }
+    case 'acknowledge-untestable':
+      return withAddedFacts({ outcome: 'ok', next: 'review', acknowledged: [...(signature.unverified ?? [])] }, []);
+    case 'rework-note': {
+      const grounded = mergedContextSignature(signature, ctx.outputs).signature;
+      const file = grounded.namedSource?.trim() || (grounded.unverified ?? []).find((path) => !path.endsWith('.md')) || 'unknown';
+      const symbol = typeof failure.symbol === 'string' ? failure.symbol : file.split('/').pop();
+      const citations = grounded.citations ?? [];
+      const urls = citations.length ? `\n근거: ${citations.map((citation) => citation.url).join(' · ')}` : '';
+      return withAddedFacts({ outcome: 'ok', next: 'implement', 'rework-note': `${file} 의 ${symbol} 을 고친다${urls}` }, []);
+    }
+    case 'verify':
+    case 'revise-goal':
+      return withAddedFacts({ outcome: 'fail', reason: 'not-wired' }, []);
+    case 'observe-deeper': {
+      const runId = typeof input.runId === 'string' ? input.runId : '';
+      if (!runId) return withAddedFacts({ outcome: 'empty', reason: 'not-wired' }, []);
+      const entries = deps.loadLedger
+        ? deps.loadLedger(runId)
+        : loadRunLedger(runId, deps.ledgerDir ?? (process.env.ELANOUS_STATE_DIR ? runLedgerDir(process.env.ELANOUS_STATE_DIR) : undefined));
+      const filled = fillMissingGateFacts(signature, entries ?? []);
+      if (filled.added.length === 0) return withAddedFacts({ outcome: 'empty', reason: 'no-new-facts' }, []);
+      return withAddedFacts({ outcome: 'ok', signature: filled.signature }, filled.added);
+    }
+    case 'ground-external': {
+      const collect = collectSignature(ctx.outputs);
+      const deeper = deeperSignature(ctx.outputs);
+      const grounded = mergeHealSignatures(signature, [
+        ...(collect ? [{ source: 'collect', signature: collect }] : []),
+        ...(deeper ? [{ source: 'observe-deeper', signature: deeper }] : []),
+      ]).signature;
+      const query = groundQuery(grounded, failure);
+      const started = Date.now();
+      let citations: HealCitation[] = [];
+      if (query) {
+        try { citations = searchCitations((deps.search ?? defaultSearch)(query)); }
+        catch { /* A failed external search is an empty observation, not a failed heal role. */ }
+      }
+      const search = { query, count: citations.length, ms: Date.now() - started };
+      debug.log('graph.heal', 'ground-external-search', search);
+      return citations.length
+        ? withAddedFacts({ outcome: 'ok', citations, ...search }, ['citations'])
+        : withAddedFacts({ outcome: 'empty', reason: 'no-results', ...search }, []);
+    }
+    default:
+      return withAddedFacts({ outcome: 'fail', reason: `unknown-role:${role}` }, []);
+  }
+}
+
+if (import.meta.main) {
+  const role = process.argv[2] ?? '';
+  const ctx = readContext();
+  const result = roleResult(role, ctx);
+  debug.log('graph.heal', role || 'missing-role', { outcome: result.outcome, nodeId: ctx.nodeId, runId: ctx.runId });
+  process.stdout.write(`${JSON.stringify(result)}\n`);
+  if (result.outcome === 'fail' && result.reason !== 'not-wired') process.exitCode = 1;
+}

package/scripts/install-role-watch.sh

@@ -0,0 +1,95 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+mode=dry-run
+for arg in "$@"; do
+  case "$arg" in
+    --dry-run) mode=dry-run ;;
+    --apply) mode=apply ;;
+    *) echo "unknown option: $arg" >&2; exit 2 ;;
+  esac
+done
+
+os="${ROLE_WATCH_OS:-$(uname -s)}"
+case "$os" in
+  Darwin|macOS) os=Darwin; target="$HOME/Library/LaunchAgents/com.elanous.role-watch.plist" ;;
+  Linux) target="${XDG_CONFIG_HOME:-$HOME/.config}/systemd/user/elanous-role-watch.service" ;;
+  *) echo "unsupported OS: $os" >&2; exit 2 ;;
+esac
+
+# Pin the installed CLI path, not the caller's checkout. PATH is unreliable in launchd/systemd.
+cli="${ROLE_WATCH_CLI:-${ELANOUS_INSTALL_PREFIX:-${XDG_DATA_HOME:-$HOME/.local/share}/elanous}/bin/elanous}"
+case "$cli" in /*) ;; *) echo "role watch CLI must be an absolute path" >&2; exit 2 ;; esac
+case "$cli$target" in *$'\n'*|*$'\r'*) echo "newline in service path" >&2; exit 2 ;; esac
+xml_escape() {
+  local s="$1"
+  s="${s//&/\&amp;}"; s="${s//</\&lt;}"; s="${s//>/\&gt;}"; s="${s//\"/\&quot;}"
+  printf '%s' "$s"
+}
+render() {
+  if [ "$os" = Darwin ]; then
+    cat <<EOF
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0"><dict>
+  <key>Label</key><string>com.elanous.role-watch</string>
+  <key>ProgramArguments</key><array><string>$(xml_escape "$cli")</string><string>role</string><string>watch</string></array>
+  <key>RunAtLoad</key><true/>
+  <key>KeepAlive</key><true/>
+  <key>ThrottleInterval</key><integer>10</integer>
+</dict></plist>
+EOF
+  else
+    # systemd ExecStart accepts a quoted absolute executable path.
+    local escaped="$cli"
+    escaped="${escaped//\\/\\\\}"; escaped="${escaped//\"/\\\"}"; escaped="${escaped//%/%%}"
+    cat <<EOF
+[Unit]
+Description=elanous role watch
+[Service]
+Type=simple
+ExecStart="$escaped" role watch
+Restart=always
+RestartSec=10
+[Install]
+WantedBy=default.target
+EOF
+  fi
+}
+
+echo "role watch unit: $target"
+echo "command: $cli role watch"
+if [ "$mode" = dry-run ]; then
+  render
+  if [ "$os" = Linux ]; then echo 'apply: verify or enable systemd user lingering (loginctl enable-linger) for boot-before-login'; fi
+  echo 'dry-run: no files written'
+  exit 0
+fi
+if [ ! -x "$cli" ]; then echo "installed elanous CLI not executable: $cli" >&2; exit 1; fi
+if [ "$os" = Linux ]; then
+  user="$(id -un)"
+  linger="$(loginctl show-user "$user" --property=Linger --value)" || {
+    echo "cannot verify systemd user lingering; boot watch not configured" >&2; exit 1;
+  }
+  if [ "$linger" != yes ]; then
+    if ! loginctl enable-linger "$user"; then
+      echo "cannot enable systemd user lingering; boot watch not configured" >&2; exit 1
+    fi
+    linger="$(loginctl show-user "$user" --property=Linger --value)" || {
+      echo "cannot verify systemd user lingering; boot watch not configured" >&2; exit 1;
+    }
+  fi
+  if [ "$linger" != yes ]; then
+    echo "systemd user lingering is not enabled; boot watch not configured" >&2; exit 1
+  fi
+fi
+mkdir -p "$(dirname "$target")"
+render > "$target"
+if [ "$os" = Darwin ]; then
+  launchctl bootout "gui/$(id -u)/com.elanous.role-watch" 2>/dev/null || true
+  launchctl bootstrap "gui/$(id -u)" "$target"
+else
+  systemctl --user daemon-reload
+  systemctl --user enable --now elanous-role-watch.service
+fi
+"$cli" role watch --once

package/scripts/install.ps1

@@ -221,7 +221,17 @@ try {
   New-Item -ItemType Directory -Force -Path $binDirectory | Out-Null
   $shimPath = Join-Path $binDirectory 'elanous.cmd'
   # The shim names bun by its absolute path so `elanous` works in a shell whose PATH lacks ~\.bun\bin.
-  Set-Content -LiteralPath $shimPath -Value "@echo off`r`n`"$bunPath`" `"%~dp0..\current\node_modules\elanous\bin\elanous.mjs`" %*`r`n" -NoNewline -Encoding ascii
+  $shimContent = "@echo off`r`nrem elanous-wrapper`r`n`"$bunPath`" `"%~dp0..\current\node_modules\elanous\bin\elanous.mjs`" %*`r`n"
+  Set-Content -LiteralPath $shimPath -Value $shimContent -NoNewline -Encoding ascii
+  $elnShim = Join-Path $binDirectory 'eln.cmd'
+  $pathEln = Get-Command eln -ErrorAction SilentlyContinue
+  if (($pathEln -and $pathEln.Source -ne $elnShim) -or
+      ((Test-Path -LiteralPath $elnShim) -and ((Get-Item -LiteralPath $elnShim -Force).Attributes -band [IO.FileAttributes]::ReparsePoint -or
+        (Read-Text $elnShim) -notmatch '(?m)^rem elanous-wrapper\r?$'))) {
+    Write-Output 'WARNING eln: another command already exists; use elanous instead'
+  } else {
+    Set-Content -LiteralPath $elnShim -Value $shimContent -NoNewline -Encoding ascii
+  }
 
   $installedPackage = Join-Path $Prefix 'current\node_modules\elanous\package.json'
   if (-not (Test-Path -LiteralPath $installedPackage)) { Fail "package version missing: $installedPackage" 1 }

package/scripts/install.sh

@@ -4,7 +4,7 @@
 # 🆕 2026-09-24 (결정 「sh 를 실행하면 알아서 설치되는 구조」) — claude·grok 의 네이티브 설치기와 같은 모양:
 #   $PREFIX/versions/<version>[-<커밋12>]/ 판별 본체(각자 node_modules) ← 옛 판은 남는다(롤백 · 체크아웃 설치는 커밋이 이름)
 #   $PREFIX/current  → versions/<version>                                ← 전환은 심링크 하나
-#   $PREFIX/bin/elanous → ../current/node_modules/.bin/elanous               ← PATH 에 넣는 «고정» 경로
+#   $PREFIX/bin/elanous → current 판을 절대 경로 bun 으로 실행하는 sh 래퍼     ← PATH 에 넣는 «고정» 경로
 #   ⛔ 기본 PREFIX 는 상태 폴더(~/.elanous)가 «아니다» — 설치물과 상태(auth·logs·worktrees)를 가른다.
 #   bun 이 없으면 공식 설치기로 먼저 깐다(--no-bootstrap-bun 으로 끈다).
 set -euo pipefail
@@ -159,8 +159,13 @@ done
 #    $PREFIX/bin/bun 링크 «자신»을 가리켰고, `ln -sfn` 이 그것을 자기 자신으로 덮어 고리를 만들었다
 #    (`bun: Too many levels of symbolic links` · 설치 rc 127 · 이후 `elanous` 가 전부 죽음). 업데이트·재설치 경로 전부가 여기를 지난다.
 BUN_EXEC="$(bun -e 'process.stdout.write(process.execPath)' 2>/dev/null || true)"
-# bun 이 경로를 못 대면(비정상 bun) 예전처럼 PATH 의 이름으로 물러선다 — 그 이름이 우리 링크 자신이면 아래에서 다시 잇지 않는다.
-{ [ -n "$BUN_EXEC" ] && [ -x "$BUN_EXEC" ]; } || BUN_EXEC="$(command -v bun)"
+# 래퍼에는 PATH 에 의존하지 않는 절대 실행 경로만 박는다. bun 이 경로를 못 대면(비정상 bun) PATH 에서 찾은 절대 경로로 물러서고,
+# 그래도 절대 경로가 없으면 설치를 중단한다.
+{ [ -n "$BUN_EXEC" ] && [ -x "$BUN_EXEC" ]; } || BUN_EXEC="$(command -v bun 2>/dev/null || true)"
+case "$BUN_EXEC" in
+  /*) [ -x "$BUN_EXEC" ] || { echo "⛔ bun executable is not available: $BUN_EXEC" >&2; exit 127; } ;;
+  *) echo '⛔ bun executable absolute path is unavailable' >&2; exit 127 ;;
+esac
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" && pwd -P)"
 REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
@@ -189,9 +194,16 @@ if [ "$MODIFY_PATH" -eq 1 ]; then
   fi
   # bash 는 로그인 셸이 ~/.profile 을 읽고, ~/.bashrc 는 «비대화형이면 맨 앞에서 return» 한다(Debian 기본).
   # 🩸 2026-09-25 빈 debian:12 컨테이너: `bash -lc elanous`(= ssh 원격 명령·스크립트) → command not found. 그래서 ~/.profile 에도 쓴다.
+  # zsh 도 같다: ~/.zshrc 는 «대화형» 만 읽고 `ssh host cmd`(비대화형)는 ~/.zshenv 만 읽는다.
+  # 🩸 2026-09-28 node-b: ssh 원격 명령이 설치본을 못 찾아 🅣 의 원격 실행 태스크가 not-done 이 됐다. 그래서 ~/.zshenv 에도 쓴다.
   LOGIN_STARTUP=""
+  if [ -z "${ELANOUS_SHELL_STARTUP:-}" ] && [ "$STARTUP" = "$HOME/.zshrc" ]; then
+    LOGIN_STARTUP="$HOME/.zshenv"
+  fi
   if [ -z "${ELANOUS_SHELL_STARTUP:-}" ] && [ "$STARTUP" = "$HOME/.bashrc" ]; then
     LOGIN_STARTUP="$HOME/.profile"
+  fi
+  if [ -n "$LOGIN_STARTUP" ]; then
     touch "$LOGIN_STARTUP"
     if grep -Fqx "$MARKER_START" "$LOGIN_STARTUP" && ! grep -Fqx "$PATH_LINE" "$LOGIN_STARTUP"; then
       echo "⛔ PATH block in $LOGIN_STARTUP already points to a different installation prefix" >&2
@@ -305,11 +317,25 @@ fi
 rm -rf "$NATIVE_SHIM"
 ln -sfn "versions/$VERSION_NAME" "$PREFIX/current"
 mkdir -p "$PREFIX/bin"
-ln -sfn ../current/node_modules/.bin/elanous "$PREFIX/bin/elanous"
-chmod +x "$PREFIX/bin/elanous"
-# elanous 엔트리는 `#!/usr/bin/env bun` 이다 — bun 도 같은 bin 에 둬서 PATH 한 줄로 둘 다 잡히게 한다.
-# 🩸 2026-09-25 빈 debian:12 컨테이너: bun 설치기는 ~/.bun/bin 을 ~/.bashrc 에만 써서(비대화형이면 안 읽힌다)
-#    로그인 셸에서 elanous 는 찾았는데 `/usr/bin/env: 'bun': No such file or directory` 로 죽었다.
+# 절대 bun 경로를 설치 때 박고 엔트리는 current 를 거친다 — cron/systemd 의 짧은 PATH 와 판 전환 모두 지원.
+WRAPPER="$PREFIX/bin/.elanous-$$"
+printf '#!/bin/sh\n# elanous-wrapper\nif [ ! -x %s ]; then\n  printf '\''bun 을 찾을 수 없습니다: %%s — 설치기를 다시 실행하세요\\n'\'' %s >&2\n  exit 127\nfi\nexec %s %s "$@"\n' \
+  "$(shell_quote "$BUN_EXEC")" "$(shell_quote "$BUN_EXEC")" "$(shell_quote "$BUN_EXEC")" \
+  "$(shell_quote "$PREFIX/current/node_modules/elanous/bin/elanous.mjs")" > "$WRAPPER"
+chmod +x "$WRAPPER"
+mv -f "$WRAPPER" "$PREFIX/bin/elanous"
+ELN="$PREFIX/bin/eln"
+ELN_ON_PATH="$(command -v eln 2>/dev/null || true)"
+if { [ -n "$ELN_ON_PATH" ] && [ "$ELN_ON_PATH" != "$ELN" ]; } ||
+   { { [ -e "$ELN" ] || [ -L "$ELN" ]; } &&
+     { [ -L "$ELN" ] || [ ! -f "$ELN" ] || [ "$(sed -n '2p' "$ELN")" != '# elanous-wrapper' ]; }; }; then
+  echo '⚠ eln: 이미 다른 명령이 있어 만들지 않았다 — elanous 로 쓰십시오'
+  ELN_AVAILABLE=0
+else
+  cp "$PREFIX/bin/elanous" "$ELN"
+  ELN_AVAILABLE=1
+fi
+# 대화형 셸은 bun 도 같은 bin 에서 찾는다(래퍼 자체는 이 링크나 PATH 에 의존하지 않는다).
 case "$BUN_EXEC" in
   "$PREFIX/bin/bun"|"$PREFIX/bin/bun/") ;;   # 자기 자신에게 잇지 않는다(고리)
   *) ln -sfn "$BUN_EXEC" "$PREFIX/bin/bun" ;;
@@ -360,6 +386,48 @@ if ! grep -q '"openai-codex"' "$HOME/.elanous/auth.json" 2>/dev/null; then
 fi
 # 🆕 2026-09-24 빈 VM 실측: 하니스(codex 백엔드)는 Codex CLI 를 자식으로 띄우는데 빈 기계엔 codex·node 가 «둘 다» 없었다.
 #    ⚠️ 아래 설치 줄은 빈 기계에서 아직 «안 쟀다» — `elanous doctor` 의 codex 줄이 판정한다.
+# C++20 toolchain must precede node-pty's rebuild; only suggest missing prerequisites.
+if ! command -v make >/dev/null 2>&1 || ! command -v c++ >/dev/null 2>&1; then
+  case "$(uname -s)" in
+    Darwin) BUILD_HINT='xcode-select --install' ;;
+    Linux)
+      OS_ID='' OS_LIKE=''
+      if [ -r "${ELANOUS_INSTALL_OS_RELEASE_FILE:-/etc/os-release}" ]; then
+        while IFS='=' read -r key value; do
+          value="${value#\"}"; value="${value%\"}"
+          case "$key" in ID) OS_ID="$value" ;; ID_LIKE) OS_LIKE="$value" ;; esac
+        done < "${ELANOUS_INSTALL_OS_RELEASE_FILE:-/etc/os-release}"
+      fi
+      BUILD_HINT=''
+      case " $OS_ID $OS_LIKE " in
+        *' debian '*|*' ubuntu '*) BUILD_HINT='sudo apt-get install -y build-essential' ;;
+        *' fedora '*) BUILD_HINT='sudo dnf groupinstall -y "Development Tools"' ;;
+      esac ;;
+    *) BUILD_HINT='' ;;
+  esac
+  if [ -n "$BUILD_HINT" ]; then
+    echo "  $STEP) $BUILD_HINT"; STEP=$((STEP + 1))
+  fi
+  echo "  $STEP) elanous doctor --fix --yes       # rebuild node-pty after installing build tools"; STEP=$((STEP + 1))
+fi
+if ! command -v rg >/dev/null 2>&1; then
+  if [ -z "${OS_ID:-}" ] && [ -r "${ELANOUS_INSTALL_OS_RELEASE_FILE:-/etc/os-release}" ]; then
+    while IFS='=' read -r key value; do
+      value="${value#\"}"; value="${value%\"}"
+      case "$key" in ID) OS_ID="$value" ;; ID_LIKE) OS_LIKE="$value" ;; esac
+    done < "${ELANOUS_INSTALL_OS_RELEASE_FILE:-/etc/os-release}"
+  fi
+  case "$(uname -s)" in
+    Darwin) RG_HINT='brew install ripgrep' ;;
+    Linux) case " ${OS_ID:-} ${OS_LIKE:-} " in
+      *' debian '*|*' ubuntu '*) RG_HINT='sudo apt-get install -y ripgrep' ;;
+      *' fedora '*) RG_HINT='sudo dnf install -y ripgrep' ;;
+      *) RG_HINT='install ripgrep (rg) with your package manager' ;;
+    esac ;;
+    *) RG_HINT='install ripgrep (rg) with your package manager' ;;
+  esac
+  echo "  $STEP) $RG_HINT"; STEP=$((STEP + 1))
+fi
 if ! command -v codex >/dev/null 2>&1; then
   if ! command -v node >/dev/null 2>&1; then
     echo "  $STEP) install Node.js 20+ (the Codex CLI runs on node)   # e.g. your package manager or https://nodejs.org"; STEP=$((STEP + 1))
@@ -371,5 +439,9 @@ if ! command -v gh >/dev/null 2>&1; then
 elif ! gh auth status >/dev/null 2>&1; then
   echo "  $STEP) gh auth login                     # the harness opens pull requests with it"; STEP=$((STEP + 1))
 fi
-echo "  $STEP) elanous harness say \"<one line of what you want>\""
+if [ "$ELN_AVAILABLE" -eq 1 ]; then
+  echo "  $STEP) eln harness say \"<one line of what you want>\" (or: elanous harness say)"
+else
+  echo "  $STEP) elanous harness say \"<one line of what you want>\""
+fi
 echo "  check anytime: elanous setup --non-interactive"

package/scripts/isolation-hardcode-baseline.txt

@@ -12,6 +12,7 @@
 1	src/background-reasoning/patcher-config.ts
 1	src/budget/codex-reset-credit-state.ts
 1	src/cli/config-test-sync.ts
+1	src/cli/fleet-cli.ts
 2	src/cli/logs-cli.ts
 1	src/cli/nexus-dist.ts
 1	src/cli/nexus-ios-bind.ts
@@ -31,7 +32,6 @@
 1	src/domains/signal-dedup.ts
 1	src/expression/config/answer-file.ts
 1	src/hitl/audit-log.ts
-1	src/index.ts
 1	src/input-core/user-config-loader.ts
 2	src/instance/leader.ts
 1	src/instance/nexus-run-refusal.ts

package/scripts/landing-heal/must-fix-match.ts

@@ -0,0 +1,37 @@
+export type MustFixVerdict = 'resolved' | 'unresolved' | 'unknown';
+
+/** Match only named evidence in a PR's final patch, never an earlier review round. */
+export function matchMustFix(mustFix: string, finalDiff: string): MustFixVerdict {
+  const names = [...mustFix.matchAll(/`([^`\n]+)`/g)].map((match) => match[1]!.trim()).filter(Boolean);
+  if (!names.length) return 'unknown';
+  const files = [...finalDiff.matchAll(/^diff --git a\/(.+) b\/(.+)$/gm)].map((match) => ({
+    path: match[2]!, start: match.index!,
+  }));
+  if (!files.length) return 'unresolved';
+  const fileNames = names.filter((name) => /\.(?:[a-z][a-z0-9]*)$/i.test(name) && !name.includes('('));
+  const target = names.find((name) => !fileNames.includes(name) && name.endsWith('()'))
+    ?? names.find((name) => !fileNames.includes(name));
+  if (!fileNames.length && !target) return 'unknown';
+  const symbol = target?.replace(/\(\)$/, '');
+  const boundary = symbol ? new RegExp(`(^|[^\\w$])${symbol.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}(?![\\w$])`) : null;
+  // Review transport adds a must-fix label; it does not change the request.
+  const request = mustFix.replace(/^\s*must[-\s]?fix\s*:\s*/i, '').trim();
+  const touchOnly = /^`[^`\n]+`\s*(?:을|를)\s*확인해\s*주세요\.?$/.test(request);
+  for (const [index, file] of files.entries()) {
+    if (fileNames.length && !fileNames.some((name) => file.path === name || file.path.endsWith(`/${name}`))) continue;
+    const patch = finalDiff.slice(file.start, files[index + 1]?.start ?? finalDiff.length);
+    for (const hunk of patch.split(/(?=^@@ )/m).slice(1)) {
+      const changes = hunk.split('\n').filter((line) => /^[+-](?![+-])/.test(line));
+      if (!changes.length) continue;
+      const changedSymbol = !boundary || changes.some((line) => boundary.test(line));
+      if (!changedSymbol && boundary && !boundary.test(hunk.split('\n', 1)[0] ?? '')) continue;
+      if (touchOnly) {
+        if (changedSymbol) return 'resolved';
+        continue;
+      }
+      if (!changedSymbol && !changes.some((line) => /\b(?:markStopped|unlinkSync|rmSync)\b/.test(line))) continue;
+      return 'unknown';
+    }
+  }
+  return 'unresolved';
+}