elanous 0.2.0 → 0.2.5

package/src/cli/bg-launch.ts

@@ -5,9 +5,11 @@ import { join as joinPath } from 'node:path';
 import { nexusLogsDir, getTestStateRoot } from '../nexus/paths.js';
 import { getElanousConfigDir } from '../elanous-config-dir.js';
 import { isPidAlive } from '../process/pid-liveness.js';
+import { DEFAULT_NEXUS_HTTP_PORT } from '../nexus/default-port.js';
 import {
   checkSetupStatus,
   renderSetupStatus,
+  setupBootMode,
   type SetupCheckResult,
 } from '../nexus/setup-status.js';
 import {
@@ -33,7 +35,7 @@ function defaultProbeChild(child: BgChildHandle): BgChildProbeResult {
   return isPidAlive(child.pid) ? 'alive' : 'exited';
 }
 
-function lastMeaningfulLogLine(logPath: string): string | undefined {
+export function lastMeaningfulLogLine(logPath: string): string | undefined {
   let text = '';
   try {
     text = readFileSync(logPath, 'utf-8');
@@ -60,6 +62,7 @@ function lastMeaningfulLogLine(logPath: string): string | undefined {
 
 export interface BgLaunchOpts {
   forwardArgs?: string[];
+  childEnv?: Record<string, string>;
   force?: boolean;
   spawnFn?: (cmd: string, args: string[], opts: SpawnOptions) => BgChildHandle;
   logPathFn?: (stamp: string) => string;
@@ -87,7 +90,7 @@ function defaultLogPath(stamp: string): string {
 function httpSummary(opts: BgLaunchOpts): string {
   const args = opts.forwardArgs ?? [];
   let host = '127.0.0.1';
-  let port = '31415';
+  let port = String(DEFAULT_NEXUS_HTTP_PORT);
   for (let i = 0; i < args.length; i += 1) {
     if (args[i] === '--http-host' && typeof args[i + 1] === 'string') host = args[i + 1]!;
     if (args[i] === '--http-port' && typeof args[i + 1] === 'string') port = args[i + 1]!;
@@ -117,13 +120,15 @@ export async function runBgLaunch(opts: BgLaunchOpts = {}): Promise<BgLaunchResu
   }
 
   const setup = opts.setupStatus ?? checkSetupStatus({ argvBin: process.argv[1] ?? '' });
-  if (!setup.ok) {
+  const boot = setupBootMode(setup);
+  if (boot.mode === 'refuse') {
     out.error('✗ elanous nexus --bg: setup incomplete');
     renderSetupStatus(setup, out);
     out.log('');
     out.log('  Run `elanous nexus` (interactive) once to walk through the wizard.');
     return { exitCode: 1 };
   }
+  const setupMode = boot.mode === 'setup';
 
   const argvBin = process.argv[1] ?? '';
   if (!argvBin) {
@@ -166,7 +171,15 @@ export async function runBgLaunch(opts: BgLaunchOpts = {}): Promise<BgLaunchResu
     const child = spawnFn(process.execPath, args, {
       detached: true,
       stdio: ['ignore', logFd, logFd],
-      env: { ...process.env, ELANOUS_NEXUS_BG_PARENT: '1' },
+      env: {
+        ...process.env,
+        ELANOUS_TEST_COORDINATOR_LEASE_PORT: undefined,
+        ELANOUS_TEST_COORDINATOR_LEASE_TOKEN: undefined,
+        ELANOUS_TEST_COORDINATOR_LEASE_ID: undefined,
+        ...opts.childEnv,
+        ELANOUS_NEXUS_BG_PARENT: '1',
+        ...(setupMode ? { ELANOUS_NEXUS_SETUP_MODE: '1' } : {}),
+      },
     });
     child.unref();
     await (opts.sleepFn ?? sleep)(opts.childProbeDelayMs ?? DEFAULT_CHILD_PROBE_DELAY_MS);
@@ -178,6 +191,9 @@ export async function runBgLaunch(opts: BgLaunchOpts = {}): Promise<BgLaunchResu
       out.error(`  log       ${logPath}`);
       return { exitCode: 1, pid: child.pid, logPath };
     }
+    if (setupMode) {
+      out.log(`셋업 모드로 떴습니다 — 브라우저로 셋업: ${httpSummary(opts)}/app/setup/ (빠진 것: ${boot.missing.join(', ')})`);
+    }
     out.log('elanous nexus: started in background');
     out.log(`  pid       ${child.pid ?? '(unknown)'}`);
     out.log(`  log       ${logPath}`);

package/src/cli/claude-plugin-setup.ts

@@ -0,0 +1,199 @@
+import { spawnSync } from 'node:child_process';
+
+const MARKETPLACE = 'elanous';
+const PLUGIN = 'elanous@elanous';
+const DEFAULT_SOURCE = 'ElanvitalAI/elanous';
+
+export interface ClaudePluginCommandResult {
+  exitCode: number;
+  stdout: string;
+  stderr?: string;
+}
+
+export interface ClaudePluginSetupDeps {
+  /** Executes an argv vector directly, without a shell. */
+  run?: (binary: string, args: string[]) => ClaudePluginCommandResult | Promise<ClaudePluginCommandResult>;
+  /** Tests whether a binary is on PATH. */
+  has?: (binary: string) => boolean | Promise<boolean>;
+}
+
+export interface ClaudePluginSetupStep {
+  command: string[];
+  needed: boolean;
+}
+
+export interface ClaudePluginSetupPlan {
+  source: string;
+  claudeCode: boolean;
+  node: boolean;
+  elanous: boolean;
+  marketplaceInstalled: boolean;
+  pluginInstalled: boolean;
+  steps: ClaudePluginSetupStep[];
+  ready: boolean;
+}
+
+export interface ClaudePluginSetupResult {
+  verification: ClaudePluginSetupPlan;
+  mcpVerified: boolean;
+  executed: string[][];
+  ok: boolean;
+}
+
+function runBinary(binary: string, args: string[]): ClaudePluginCommandResult {
+  const result = spawnSync(binary, args, { encoding: 'utf8', timeout: 30_000 });
+  return { exitCode: result.status ?? 1, stdout: result.stdout ?? '', stderr: result.stderr ?? '' };
+}
+
+function hasBinary(binary: string): boolean {
+  const result = spawnSync(binary, ['--version'], { encoding: 'utf8', timeout: 10_000 });
+  return result.error === undefined && result.status === 0;
+}
+
+function entries(text: string): unknown[] | null {
+  try {
+    const parsed: unknown = JSON.parse(text);
+    if (Array.isArray(parsed)) return parsed;
+    if (parsed && typeof parsed === 'object') {
+      const obj = parsed as Record<string, unknown>;
+      for (const key of ['marketplaces', 'plugins', 'installed']) {
+        if (Array.isArray(obj[key])) return obj[key];
+      }
+    }
+  } catch { /* Older Claude versions print a human-readable list. */ }
+  return null;
+}
+
+function marketplaceSource(entry: Record<string, unknown>): string | undefined {
+  for (const key of ['source', 'url', 'repository']) {
+    const value = entry[key];
+    if (typeof value === 'string') return value;
+    if (value !== null && typeof value === 'object') {
+      for (const nested of ['repo', 'url', 'path']) {
+        const source = (value as Record<string, unknown>)[nested];
+        if (typeof source === 'string') return source;
+      }
+    }
+  }
+  return undefined;
+}
+
+function normalizeSource(source: string): string {
+  const trimmed = source.trim();
+  const displayed = trimmed.match(/^(GitHub|Directory)\s*\((.*)\)$/i);
+  const value = displayed ? displayed[2]!.trim() : trimmed;
+  const github = value.replace(/^https?:\/\/github\.com\//i, '').replace(/^github:/i, '')
+    .replace(/\.git$/i, '').replace(/\/$/, '');
+  return /^[^/\s]+\/[^/\s]+$/.test(github) ? github.toLowerCase() : value;
+}
+
+/** A named marketplace with an unknown source is not safe to reuse for --source. */
+function marketplacePresent(text: string, source: string): boolean {
+  const list = entries(text);
+  if (list !== null) {
+    for (const entry of list) {
+      const item = typeof entry === 'string' ? { name: entry } : entry;
+      if (!item || typeof item !== 'object') continue;
+      const record = item as Record<string, unknown>;
+      if (record.name !== MARKETPLACE && record.id !== MARKETPLACE) continue;
+      const existing = marketplaceSource(record);
+      if (!existing || normalizeSource(existing) !== normalizeSource(source)) {
+        throw new Error(`Claude marketplace ${MARKETPLACE} source is unknown or differs from requested source: ${source}`);
+      }
+      return true;
+    }
+    return false;
+  }
+  // The human-readable CLI prints the source under the marketplace heading.
+  const lines = text.split(/\r?\n/);
+  for (let i = 0; i < lines.length; i++) {
+    if (!/^\s*(?:[❯*]\s*)?elanous(?:\s*[:(].*)?\s*$/.test(lines[i]!)) continue;
+    const inline = lines[i]!.match(/^\s*(?:[❯*]\s*)?elanous\s*:\s*(.+)$/)?.[1];
+    const next = lines[i + 1]?.match(/^\s+Source:\s*(.+)$/i)?.[1];
+    const existing = next ?? inline;
+    if (!existing || normalizeSource(existing) !== normalizeSource(source)) {
+      throw new Error(`Claude marketplace ${MARKETPLACE} source is unknown or differs from requested source: ${source}`);
+    }
+    return true;
+  }
+  // Unparsed output that still names the marketplace may be an installed entry in a format we do not know:
+  // «unreadable» is not «absent», so stop before `marketplace add` writes a duplicate.
+  if (new RegExp(`(^|[^\\w@-])${MARKETPLACE}(?=$|[^\\w@-])`, 'm').test(text)) {
+    throw new Error(`Claude marketplace list mentions ${MARKETPLACE} in an unrecognized format — refusing to add it again`);
+  }
+  return false;
+}
+
+function mcpConnected(text: string): boolean {
+  // Claude prints one server per line; a listed but disconnected server is not verified.
+  return text.split(/\r?\n/).some((line) =>
+    /^\s*elanous:\s*(?:.*?\s[-–]\s)?(?:[✓✔]\s*)?connected\s*$/i.test(line));
+}
+
+function containsEntry(text: string, name: string, keys: string[]): boolean {
+  const list = entries(text);
+  if (list !== null) {
+    return list.some((entry) => typeof entry === 'string' ? entry === name
+      : entry !== null && typeof entry === 'object'
+        && keys.some((key) => (entry as Record<string, unknown>)[key] === name));
+  }
+  // Match a whole identifier rather than accepting substrings like elanous-staging.
+  const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  return new RegExp(`(^|[^\\w@-])${escaped}(?=$|[^\\w@-])`, 'm').test(text);
+}
+
+/** Read-only discovery: only checks PATH and invokes Claude's list subcommands. */
+export async function planClaudePluginSetup(
+  options: { source?: string } = {},
+  deps: ClaudePluginSetupDeps = {},
+): Promise<ClaudePluginSetupPlan> {
+  const source = options.source ?? DEFAULT_SOURCE;
+  if (!source.trim()) throw new Error('Claude plugin marketplace source cannot be empty');
+  const has = deps.has ?? hasBinary;
+  const run = deps.run ?? runBinary;
+  const [claudeCode, node, elanous] = await Promise.all([
+    has('claude'), has('node'), has('elanous'),
+  ]);
+  let marketplaceInstalled = false;
+  let pluginInstalled = false;
+  if (claudeCode) {
+    const marketplaces = await run('claude', ['plugin', 'marketplace', 'list']);
+    if (marketplaces.exitCode !== 0) throw new Error('Could not list Claude Code plugin marketplaces');
+    marketplaceInstalled = marketplacePresent(marketplaces.stdout, source);
+    const plugins = await run('claude', ['plugin', 'list']);
+    if (plugins.exitCode !== 0) throw new Error('Could not list Claude Code plugins');
+    pluginInstalled = containsEntry(plugins.stdout, PLUGIN, ['id', 'name']);
+  }
+  return {
+    source, claudeCode, node, elanous, marketplaceInstalled, pluginInstalled,
+    steps: [
+      { command: ['claude', 'plugin', 'marketplace', 'add', source], needed: !marketplaceInstalled },
+      { command: ['claude', 'plugin', 'install', PLUGIN], needed: !pluginInstalled },
+    ],
+    ready: claudeCode && node && elanous && marketplaceInstalled && pluginInstalled,
+  };
+}
+
+/** Apply only the missing steps, in dependency order, then independently verify current state. */
+export async function applyClaudePluginSetup(
+  plan: ClaudePluginSetupPlan,
+  deps: ClaudePluginSetupDeps = {},
+): Promise<ClaudePluginSetupResult> {
+  const run = deps.run ?? runBinary;
+  const executed: string[][] = [];
+  // Refresh the plan: an earlier dry-run may have become stale.
+  const current = await planClaudePluginSetup({ source: plan.source }, deps);
+  if (!current.claudeCode) throw new Error('Claude Code is not installed; install `claude` first');
+  if (!current.node || !current.elanous) throw new Error('Both `node` and `elanous` must be on PATH before installing the plugin');
+  for (const step of current.steps) {
+    if (!step.needed) continue;
+    const [binary, ...args] = step.command;
+    const result = await run(binary!, args);
+    if (result.exitCode !== 0) throw new Error(`Claude plugin setup failed: ${step.command.join(' ')}`);
+    executed.push(step.command);
+  }
+  const verification = await planClaudePluginSetup({ source: plan.source }, deps);
+  const mcp = await run('claude', ['mcp', 'list']);
+  const mcpVerified = mcp.exitCode === 0 && mcpConnected(mcp.stdout);
+  return { verification, mcpVerified, executed, ok: verification.ready && mcpVerified };
+}

package/src/cli/config-test-sync.ts

@@ -10,10 +10,13 @@
 //
 // 변환은 **raw JSON 레벨** — 정규화(getUserConfig)를 거치지 않아 미지 필드가
 // 보존된다(정규화 저장이 필드를 조용히 떨어뜨리는 사고 클래스 회피). 정책은
-// buildTestSafeDaemonConfig 와 동일 의미론(파리티 테스트로 고정):
+// buildTestSafeDaemonConfig 와 아웃바운드 정책 파리티(시험으로 고정), 추가로 평문 비밀 제거:
 //   • telegram.botToken → testChannel.botToken (없으면 telegram off)
 //   • 운영 아웃바운드 경로 제거 (reportChannel · homeChannel · channels)
-//   • discord off
+//   • discord off · 평문 비밀 필드 재귀 제거
+//   • 채널 탭(telegram:* · discord:*)의 tokenRef 제거 — 🩸 2026-09-27: 봇 토큰이 탭 tokenRef 로 옮겨간 뒤(#20732)
+//     `resolveChannelBotToken` 이 tokenRef 를 먼저 풀어 «시험 봇 스왑»을 무시하고 운영 봇을 격리 우주에 줬다.
+//   • secrets.json 은 «그대로»가 아니라 아웃바운드 자격(채널 탭 봇 토큰 · 웹 푸시 VAPID)을 뺀 사본으로.
 //
 // 부속 파일 복사 정책(대표 지시 "현재 그대로 복사"):
 //   • 복사 = 연산/인바운드에 필요한 것 (LLM 키·oauth·identity)
@@ -21,9 +24,11 @@
 //     무장류(autopilot/finance mandate — 부재 시 fail-closed=DISARMED 가 테스트의
 //     안전 기본값) · 상태 DB(테스트는 빈 우주에서 시작)
 
-import { copyFileSync, existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from 'node:fs';
+import { chmodSync, copyFileSync, existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { basename, dirname, join } from 'node:path';
+import { debug } from '../debug/log.js';
+import { isSecretRef, secretIdFromRef } from '../nexus/config/types.js';
 
 /** 운영 config 루트(항상 실 운영 — --config-dir 오버라이드와 무관하게 원본을 읽는다). */
 export function prodConfigDir(): string {
@@ -32,7 +37,7 @@ export function prodConfigDir(): string {
 
 /** 그대로 복사할 부속 파일 (운영 config dir 상대). 없는 파일은 조용히 스킵. */
 export const TEST_SYNC_AUX_FILES: readonly string[] = [
-  'secrets.json',      // LLM/서비스 키 — 에이전트 턴에 필요
+  'secrets.json',      // LLM/서비스 키 — 에이전트 턴에 필요 (아웃바운드 자격은 빼고 쓴다 — testSyncExcludedSecretIds)
   'llm-fallback.json', // 모델 폴백 체인
   'auth.json',         // oauth 자격 (LLM provider)
   'identity.json',     // self identity — 무해·자기인식 일관
@@ -47,8 +52,27 @@ export const TEST_SYNC_EXCLUDED: ReadonlyArray<{ file: string; reason: string }>
   { file: 'finance-trade-mandate.json', reason: '매매 무장 — 동상' },
 ];
 
-/** raw JSON dict 레벨 test-safe 변환 — buildTestSafeDaemonConfig 와 의미론 동일
- *  (파리티 테스트로 고정), 단 미지 필드 보존. 순수. */
+const SECRET_KEY_PATTERN = /^(apiKey|botToken|token|secret|password|clientSecret|webhookSecret|accessToken|refreshToken)$/i;
+
+/** 봇 토큰을 tokenRef 로 드는 채널 탭 id(`telegram:1` · `discord:1` …). */
+const CHANNEL_TAB_ID = /^(telegram|discord):/;
+/** 웹 푸시 VAPID 쌍 — 격리 우주는 부재 시 자기 쌍을 새로 만든다(`src/web-push/vapid-keys.ts`). */
+const VAPID_SECRET_PREFIX = 'pwa-push-vapid-';
+
+/** 운영 secrets.json 에서 격리 사본에 넣지 않을 비밀 id — 채널 탭이 참조하는 봇 토큰 ⊕ VAPID. */
+export function testSyncExcludedSecretIds(raw: Record<string, unknown>, secretIds: readonly string[]): string[] {
+  const refd = new Set<string>();
+  const tabs = raw.tabs && typeof raw.tabs === 'object' && !Array.isArray(raw.tabs) ? raw.tabs as Record<string, unknown> : {};
+  for (const [id, tab] of Object.entries(tabs)) {
+    if (!CHANNEL_TAB_ID.test(id) || !tab || typeof tab !== 'object') continue;
+    const ref = (tab as Record<string, unknown>).tokenRef;
+    const sid = isSecretRef(ref) ? secretIdFromRef(ref as string) : null;
+    if (sid) refd.add(sid);
+  }
+  return secretIds.filter((sid) => refd.has(sid) || /^(telegram|discord)_\d+__tokenRef$/.test(sid) || sid.startsWith(VAPID_SECRET_PREFIX));
+}
+
+/** raw JSON dict 레벨 test-safe 변환 — 미지 필드는 보존하고 평문 비밀만 제거한다. */
 export function buildTestSafeRawConfig(raw: Record<string, unknown>): Record<string, unknown> {
   const out: Record<string, unknown> = { ...raw };
   const tg = { ...((raw.telegram ?? {}) as Record<string, unknown>) };
@@ -61,12 +85,51 @@ export function buildTestSafeRawConfig(raw: Record<string, unknown>): Record<str
   } else {
     tg.enabled = false;
   }
+  if (tg.testChannel && typeof tg.testChannel === 'object' && !Array.isArray(tg.testChannel)) {
+    const safeTestChannel = { ...testChannel };
+    if (testToken.length > 0 && !testToken.startsWith('secret://')) delete safeTestChannel.botToken;
+    tg.testChannel = safeTestChannel;
+  }
   delete tg.reportChannel;
   delete tg.homeChannel;
   delete tg.channels;
   out.telegram = tg;
   out.discord = { ...((raw.discord ?? {}) as Record<string, unknown>), enabled: false };
-  return out;
+
+  const paths: string[] = [];
+  if (raw.tabs && typeof raw.tabs === 'object' && !Array.isArray(raw.tabs)) {
+    const tabs: Record<string, unknown> = {};
+    for (const [id, tab] of Object.entries(raw.tabs as Record<string, unknown>)) {
+      if (CHANNEL_TAB_ID.test(id) && tab && typeof tab === 'object' && !Array.isArray(tab) && 'tokenRef' in tab) {
+        const { tokenRef: _dropped, ...rest } = tab as Record<string, unknown>;
+        paths.push(`tabs.${id}.tokenRef`);
+        Object.defineProperty(tabs, id, { value: rest, enumerable: true, writable: true, configurable: true });
+      } else {
+        Object.defineProperty(tabs, id, { value: tab, enumerable: true, writable: true, configurable: true });
+      }
+    }
+    out.tabs = tabs;
+  }
+  const strip = (value: unknown, path: string): unknown => {
+    if (Array.isArray(value)) return value.map((item, i) => strip(item, `${path}[${i}]`));
+    if (value === null || typeof value !== 'object') return value;
+    const result: Record<string, unknown> = {};
+    for (const [key, child] of Object.entries(value)) {
+      const childPath = path ? `${path}.${key}` : key;
+      if (SECRET_KEY_PATTERN.test(key) && typeof child === 'string' && !child.startsWith('secret://')
+        && !(path === 'telegram' && key === 'botToken' && testToken.length > 0)) {
+        paths.push(childPath);
+        continue;
+      }
+      // `__proto__` 등 특수 키도 «자기 필드»로 보존한다(대입은 프로토타입을 바꾸고 필드를 잃는다).
+      Object.defineProperty(result, key, { value: strip(child, childPath), enumerable: true, writable: true, configurable: true });
+    }
+    return result;
+  };
+  const safe = strip(out, '') as Record<string, unknown>;
+  safe._testSecretsStripped = paths.length;
+  debug.log('config.test-sync', 'secrets-stripped', { count: paths.length, paths });
+  return safe;
 }
 
 export interface TestSyncResult {
@@ -76,6 +139,8 @@ export interface TestSyncResult {
   /** 대상이 이미 바이트 동일해 복사하지 않은 파일(읽기 전용 대상도 여기로 — EACCES 로 뒤 파일이 끊기지 않게). */
   skippedIdentical: string[];
   telegramMode: 'test-token' | 'disabled';
+  /** 사본의 _testSecretsStripped (syncTestConfig 가 채운다). */
+  testSecretsStripped?: number;
 }
 
 /** cwd 에서 위로 걸어 올라가 레포 루트(.git 보유 dir)를 찾는다. 못 찾으면 null. */
@@ -102,7 +167,7 @@ function atomicWriteJson(path: string, value: unknown): void {
 export function syncTestConfig(testDir: string, srcDir: string = prodConfigDir()): TestSyncResult {
   const srcPath = join(srcDir, 'config.json');
   const raw = JSON.parse(readFileSync(srcPath, 'utf-8')) as Record<string, unknown>;
-  const transformed = buildTestSafeRawConfig(raw);
+  const transformed = buildTestSafeRawConfig(raw); // 운영 비밀을 제거한 뒤에만 사본을 저장한다.
   transformed._testSyncedFrom = srcPath;
   transformed._testSyncedAt = new Date().toISOString();
   const testConfigPath = join(testDir, 'config.json');
@@ -115,11 +180,29 @@ export function syncTestConfig(testDir: string, srcDir: string = prodConfigDir()
     const from = join(srcDir, f);
     if (!existsSync(from)) { skippedMissing.push(f); continue; }
     const to = join(testDir, f);
+    if (f === 'secrets.json') {
+      const store = JSON.parse(readFileSync(from, 'utf-8')) as { secrets?: Record<string, unknown> } & Record<string, unknown>;
+      const all = store.secrets && typeof store.secrets === 'object' ? store.secrets : {};
+      const excluded = new Set(testSyncExcludedSecretIds(raw, Object.keys(all)));
+      const kept: Record<string, unknown> = {};
+      for (const [sid, v] of Object.entries(all)) if (!excluded.has(sid)) kept[sid] = v;
+      const body = JSON.stringify(store.secrets && typeof store.secrets === 'object' ? { ...store, secrets: kept } : store, null, 2);
+      debug.log('config.test-sync', 'secrets-file-filtered', { kept: Object.keys(kept).length, excluded: [...excluded] });
+      if (existsSync(to) && readFileSync(to, 'utf-8') === body) { chmodSync(to, 0o600); skippedIdentical.push(f); continue; }
+      mkdirSync(dirname(to), { recursive: true });
+      const tmp = `${to}.tmp-${process.pid}`;
+      writeFileSync(tmp, body, { mode: 0o600 });
+      renameSync(tmp, to);
+      chmodSync(to, 0o600);
+      copied.push(excluded.size ? `${f}(아웃바운드 자격 ${excluded.size}개 뺌)` : f);
+      continue;
+    }
     // 🩸 2026-09-24: 대상 `llm-fallback.json` 이 읽기 전용(0444)이라 copyFileSync 가 EACCES 로 던졌고,
     //   목록 뒤의 `auth.json`(codex 로그인)이 복사되지 않아 격리 우주의 자식이 codex 를 못 썼다.
     //   ⇒ 이미 같은 바이트면 건너뛴다(멱등) — 다르면 종전처럼 복사한다(실패는 그대로 드러난다).
-    if (existsSync(to) && readFileSync(from).equals(readFileSync(to))) { skippedIdentical.push(f); continue; }
+    if (existsSync(to) && readFileSync(from).equals(readFileSync(to))) { chmodSync(to, 0o600); skippedIdentical.push(f); continue; }
     copyFileSync(from, to);
+    chmodSync(to, 0o600);
     copied.push(f);
   }
   const tg = transformed.telegram as Record<string, unknown>;
@@ -129,6 +212,7 @@ export function syncTestConfig(testDir: string, srcDir: string = prodConfigDir()
     skippedMissing,
     skippedIdentical,
     telegramMode: tg.enabled === false ? 'disabled' : 'test-token',
+    testSecretsStripped: transformed._testSecretsStripped as number,
   };
 }
 
@@ -268,7 +352,7 @@ export function runConfigSyncTest(opts: { repo?: string; stateDir?: string; json
     }
     console.log(`운영 config → ${r.testConfigPath}`);
     console.log(`  telegram: ${r.telegramMode === 'test-token' ? '테스트 봇 토큰으로 스왑 · report/home/channels 제거' : 'testChannel 없음 → off'}`);
-    console.log(`  discord: off`);
+    console.log(`  discord: off · 비밀 칸 ${r.testSecretsStripped}개 뺌`);
     console.log(`  부속 복사: ${r.copied.join(', ') || '없음'}${r.skippedMissing.length ? ` (부재 스킵: ${r.skippedMissing.join(', ')})` : ''}${r.skippedIdentical.length ? ` (동일 스킵: ${r.skippedIdentical.join(', ')})` : ''}`);
     console.log(`  제외(정책): ${TEST_SYNC_EXCLUDED.map((e) => e.file).join(', ')}`);
     console.log(`격리 루트: ${basename(testDir) === '.elanous-test' ? basename(dirname(testDir)) : testDir} — 테스트 인스턴스 재기동 시 반영`);

package/src/cli/connector-cli.ts

@@ -0,0 +1,204 @@
+import { randomUUID } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { getElanousConfigDir } from '../elanous-config-dir.js';
+import { readNexusRuntime } from '../nexus/runtime.js';
+import { getSecretAsync, setSecretAsync } from '../nexus/config/secrets/index.js';
+import { debug } from '../debug/log.js';
+import { EventLedger } from '../connectors/event-ledger.js';
+import { fetchLinearIssues, isLinearProjectionEcho, linearConnector, parseLinearWebhook, toTaskRequest } from '../connectors/linear.js';
+import type { ExternalTaskEvent } from '../connectors/types.js';
+
+const SECRET_ID = 'connector.linear.apiKey';
+
+export interface ConnectorSyncOptions {
+  team: string;
+  prefix?: string;
+  dryRun?: boolean;
+  json?: boolean;
+}
+
+export interface ConnectorCliDeps {
+  getSecret?: (id: string) => Promise<string | undefined>;
+  setSecret?: (id: string, value: string) => Promise<void>;
+  fetch?: typeof fetch;
+  ledger?: EventLedger;
+  baseUrl?: string;
+  output?: (line: string) => void;
+  log?: typeof debug.log;
+  bearerToken?: string;
+  readKey?: () => Promise<string>;
+}
+
+async function setLinearSecret(id: string, deps: ConnectorCliDeps): Promise<number> {
+  const readKey = deps.readKey ?? (async () => {
+    // `set-key < file` gives Bun a file descriptor that the async iterator reads as empty;
+    // a synchronous read of fd 0 works for files and pipes alike.
+    try { return readFileSync(0, 'utf8'); } catch { /* fall back to the stream */ }
+    let input = '';
+    for await (const chunk of process.stdin) input += chunk.toString();
+    return input;
+  });
+  const key = (await readKey()).trim();
+  if (!key) {
+    (deps.output ?? console.error)(`${id}: stdin is empty`);
+    return 2;
+  }
+  await (deps.setSecret ?? setSecretAsync)(id, key);
+  (deps.output ?? console.log)(`${id} saved`);
+  return 0;
+}
+
+export async function runLinearSetKey(deps: ConnectorCliDeps = {}): Promise<number> {
+  return setLinearSecret(SECRET_ID, deps);
+}
+
+export async function runLinearSetWebhookSecret(deps: ConnectorCliDeps = {}): Promise<number> {
+  return setLinearSecret('connector.linear.webhookSecret', deps);
+}
+
+async function existingExternalTasks(url: string, fetchFn: typeof fetch, bearerToken?: string): Promise<Set<string> | null> {
+  const headers: Record<string, string> = bearerToken ? { Authorization: `Bearer ${bearerToken}` } : {};
+  try {
+    const response = await fetchFn(`${url}/v1/tasks`, { method: 'GET', headers });
+    if (!response.ok) return null;
+    const body: unknown = await response.json();
+    if (!body || typeof body !== 'object' || !Array.isArray((body as { tasks?: unknown }).tasks)) return null;
+    const keys = new Set<string>();
+    for (const card of (body as { tasks: unknown[] }).tasks) {
+      if (!card || typeof card !== 'object') return null;
+      const item = card as { id?: unknown; generatedBy?: { provider?: unknown; ref?: unknown } };
+      if (typeof item.id !== 'string') return null;
+      // Task-board cards omit generatedBy; details carry the persisted origin.
+      let origin = item.generatedBy;
+      if (origin === undefined) {
+        const detail = await fetchFn(`${url}/v1/tasks/${encodeURIComponent(item.id)}`, { method: 'GET', headers });
+        if (!detail.ok) return null;
+        const payload: unknown = await detail.json();
+        const task = payload && typeof payload === 'object' ? (payload as { task?: unknown }).task : undefined;
+        if (!task || typeof task !== 'object' || (task as { id?: unknown }).id !== item.id) return null;
+        origin = (task as { generatedBy?: typeof origin }).generatedBy;
+      }
+      if (typeof origin?.provider === 'string' && typeof origin.ref === 'string') keys.add(JSON.stringify([origin.provider, origin.ref]));
+    }
+    return keys;
+  } catch {
+    return null;
+  }
+}
+
+export async function applyLinearEvents(events: ExternalTaskEvent[], opts: Pick<ConnectorSyncOptions, 'dryRun' | 'json'> & { team?: string }, deps: ConnectorCliDeps = {}): Promise<number> {
+  const out = deps.output ?? console.log;
+  const fetchFn = deps.fetch ?? fetch;
+  const ledger = deps.ledger ?? new EventLedger();
+  const log = deps.log ?? debug.log.bind(debug);
+  let bearerToken = deps.bearerToken;
+  if (!bearerToken && !opts.dryRun) {
+    try { bearerToken = readFileSync(join(getElanousConfigDir(), 'acp-token'), 'utf8').trim() || undefined; }
+    catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error;
+    }
+  }
+  const results: Array<{ issue: string; taskId: string | null; status: 'created' | 'recreated' | 'deduplicated' | 'skipped-seen' | 'dry-run' | 'failed'; reason?: string }> = [];
+  let existing: Set<string> | null | undefined;
+  for (const event of events) {
+    const fields = { traceId: randomUUID(), ref: event.ref, identifier: event.identifier, eventId: event.eventId };
+    log('connector.linear', 'fetched', fields);
+    if (isLinearProjectionEcho(event, ledger)) {
+      results.push({ issue: event.identifier ?? event.ref, taskId: null, status: 'skipped-seen' });
+      log('connector.linear', 'skipped-seen', fields);
+      continue;
+    }
+    const seen = ledger.seen(event.provider, linearConnector.idempotencyKey(event)) || ledger.seenChange(event.provider, event.ref, event.occurredAt);
+    if (seen && !opts.dryRun) {
+      if (existing === undefined) {
+        const runtime = deps.baseUrl ? undefined : readNexusRuntime();
+        const url = deps.baseUrl ?? (runtime?.httpPort ? `http://127.0.0.1:${runtime.httpPort}` : undefined);
+        existing = url ? await existingExternalTasks(url, fetchFn, bearerToken) : null;
+      }
+    }
+    if (seen && (opts.dryRun || !existing || existing.has(JSON.stringify([event.provider, event.ref])))) {
+      results.push({ issue: event.identifier ?? event.ref, taskId: null, status: 'skipped-seen' });
+      log('connector.linear', 'skipped-seen', fields);
+      continue;
+    }
+    if (opts.dryRun) {
+      results.push({ issue: event.identifier ?? event.ref, taskId: null, status: 'dry-run' });
+      continue;
+    }
+    const runtime = deps.baseUrl ? undefined : readNexusRuntime();
+    const url = deps.baseUrl ?? (runtime?.httpPort ? `http://127.0.0.1:${runtime.httpPort}` : undefined);
+    if (!url) throw new Error('Nexus runtime unavailable: start nexus before connector linear sync');
+    const task = toTaskRequest(event);
+    if (opts.team) task.external.team = opts.team;
+    let response: Response;
+    try {
+      response = await fetchFn(`${url}/v1/tasks`, {
+        method: 'POST', headers: { 'Content-Type': 'application/json', 'x-elanous-trace-id': fields.traceId, ...(bearerToken ? { Authorization: `Bearer ${bearerToken}` } : {}) },
+        body: JSON.stringify(task),
+      });
+    } catch {
+      results.push({ issue: event.identifier ?? event.ref, taskId: null, status: 'failed', reason: 'Nexus POST /v1/tasks request failed' });
+      log('connector.linear', 'failed', { ...fields, reason: 'Nexus POST /v1/tasks request failed' });
+      continue;
+    }
+    let reason: string | undefined = !response.ok ? `Nexus POST /v1/tasks HTTP ${response.status}` : undefined;
+    let body: { taskId?: string; task?: { id?: string }; id?: string; created?: boolean; deduplicated?: boolean } | undefined;
+    if (!reason) {
+      try { body = await response.json() as typeof body; }
+      catch { reason = 'Nexus POST /v1/tasks invalid JSON response'; }
+    }
+    const taskId = body?.taskId ?? body?.task?.id ?? body?.id;
+    if (!reason && !taskId) reason = 'Nexus POST /v1/tasks returned no taskId';
+    if (reason) {
+      results.push({ issue: event.identifier ?? event.ref, taskId: null, status: 'failed', reason });
+      log('connector.linear', 'failed', { ...fields, reason });
+      continue;
+    }
+    const status = body?.deduplicated || body?.created === false ? 'deduplicated' : seen ? 'recreated' : 'created';
+    ledger.record(event.provider, linearConnector.idempotencyKey(event), { ref: event.ref, occurredAt: event.occurredAt });
+    existing?.add(JSON.stringify([event.provider, event.ref]));
+    results.push({ issue: event.identifier ?? event.ref, taskId: taskId!, status });
+    log('connector.linear', 'posted', fields);
+  }
+  if (opts.json) out(JSON.stringify(results));
+  else for (const row of results) out(`${row.issue}\t${row.taskId ?? '-'}\t${row.status}${row.reason ? `\t${row.reason}` : ''}`);
+  return results.some(row => row.status === 'failed') ? 1 : 0;
+}
+
+export async function runLinearWebhook(input: { rawBody: string | Uint8Array; signature: string; deliveryId: string; now?: number }, deps: ConnectorCliDeps = {}): Promise<number> {
+  const out = deps.output ?? console.log;
+  const secret = await (deps.getSecret ?? getSecretAsync)('connector.linear.webhookSecret');
+  if (!secret) {
+    out('connector.linear.webhookSecret missing');
+    return 2;
+  }
+  const verified = linearConnector.verify({ rawBody: input.rawBody, signature: input.signature, secret, now: input.now });
+  if (!verified.ok) {
+    out(`connector linear receive: ${verified.reason}`);
+    return 2;
+  }
+  let body: unknown;
+  try { body = JSON.parse(Buffer.from(input.rawBody).toString('utf8')); }
+  catch { out('connector linear receive: invalid-body'); return 2; }
+  const event = parseLinearWebhook(body, input.deliveryId, deps.ledger);
+  if (!event) {
+    out('connector linear receive: ignored');
+    return 0;
+  }
+  return applyLinearEvents([event], {}, deps);
+}
+
+export async function runLinearSync(opts: ConnectorSyncOptions, deps: ConnectorCliDeps = {}): Promise<number> {
+  if (!opts.team?.trim()) {
+    (deps.output ?? console.log)('connector linear sync: --team is required');
+    return 2;
+  }
+  const key = await (deps.getSecret ?? getSecretAsync)(SECRET_ID);
+  if (!key) {
+    (deps.output ?? console.log)('connector.linear.apiKey missing; run elanous connector linear set-key');
+    return 2;
+  }
+  const events = await fetchLinearIssues({ apiKey: key, teamKey: opts.team, labelOrPrefix: opts.prefix, fetch: deps.fetch ?? fetch, ledger: deps.ledger });
+  return applyLinearEvents(events, opts, deps);
+}