elanous 0.2.10 → 0.2.11

package/src/card-followup/core.ts

@@ -0,0 +1,109 @@
+import { chmodSync, mkdirSync, readFileSync, readdirSync } from 'node:fs';
+import { randomUUID } from 'node:crypto';
+import { join, resolve } from 'node:path';
+import { effectiveInstanceRoot } from '../instance/resolve.js';
+import { lastJsonObject, runGraph as defaultRunGraph, type GraphRunState } from '../graph-runner/runner.js';
+
+const GRAPH = resolve(import.meta.dir, '../../plugins/card-followup/graphs/card-followup.yaml');
+export type CardDetectDecision = 'card' | 'skip' | 'ambiguous';
+
+export function cardShape(width?: number, height?: number): { decision: 'skip' | 'pass'; signal: string } {
+  if (!width || !height) return { decision: 'pass', signal: 'ratio:unknown' };
+  const ratio = Math.max(width, height) / Math.min(width, height);
+  if (ratio < 1.15) return { decision: 'skip', signal: 'ratio:square' };
+  if (ratio > 2.0) return { decision: 'skip', signal: 'ratio:screenshot' };
+  return { decision: 'pass', signal: `ratio:${ratio.toFixed(2)}` };
+}
+const EMAIL = /[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}/i;
+const PHONE = /(?:\+?\d{1,3}[\s.-]?)?\(?\d{2,4}\)?[\s.-]?\d{3,4}[\s.-]?\d{4}/;
+const WEB = /\b(?:https?:\/\/|www\.)\S+|\b[a-z0-9-]+\.(?:com|co\.kr|kr|io|ai|net|org)\b/i;
+const TITLE = /대표|이사|팀장|부장|과장|실장|매니저|주식회사|\(주\)|\b(?:CEO|CTO|COO|CFO|Director|Manager|Founder|Inc|Ltd|Corp)\b/i;
+export function cardText(ocr: string | null): { decision: CardDetectDecision; signal: string } {
+  if (ocr === null) return { decision: 'ambiguous', signal: 'ocr:unavailable' };
+  const chars = ocr.replace(/\s+/g, '').length;
+  if (chars < 15) return { decision: 'ambiguous', signal: 'ocr:chars<15' };
+  if (chars > 700) return { decision: 'skip', signal: 'ocr:document' };
+  const hits = ([['email', EMAIL], ['phone', PHONE], ['web', WEB], ['title', TITLE]] as const).filter(([, re]) => re.test(ocr)).map(([name]) => name);
+  const signal = `ocr:${hits.join(',') || 'none'}`;
+  if (hits.length >= 2) return { decision: 'card', signal };
+  return { decision: hits.length === 0 ? 'skip' : 'ambiguous', signal };
+}
+export function detectCard({ width, height, ocrText }: { width?: number; height?: number; ocrText: string | null }): { decision: CardDetectDecision; signal: string } {
+  const shape = cardShape(width, height);
+  return shape.decision === 'skip' ? { decision: 'skip', signal: shape.signal } : cardText(ocrText);
+}
+
+const obj = (value: unknown): Record<string, unknown> => value !== null && typeof value === 'object' && !Array.isArray(value) ? value as Record<string, unknown> : {};
+const text = (value: unknown): string => typeof value === 'string' ? value.trim() : '';
+const line = (value: unknown): string => (typeof value === 'number' && Number.isFinite(value) ? String(value) : text(value)).replace(/[\r\n]+/g, ' ') || '—';
+
+export class NotACardError extends Error {}
+function isNotACard(state: GraphRunState): boolean {
+  if (state.status !== 'failed') return false;
+  const read = state.nodes.find((node) => node.nodeId === 'read-card');
+  if (!read || !read.ok) return false;
+  const output = lastJsonObject(read.output);
+  if (output?.outcome === 'ok' && output.card && typeof output.card === 'object') {
+    const card = obj(output.card);
+    return !['name', 'company', 'title', 'email', 'phone', 'url', 'linkedin'].some((field) => text(card[field]));
+  }
+  return output?.outcome === 'fail' && typeof output.reason === 'string'
+    && /\bnot a (?:business )?card\b|명함이?\s*아님|명함이?\s*아닙니다/i.test(output.reason);
+}
+function validateReport(report: Record<string, unknown>): void {
+  const card = obj(report.card), fit = obj(report.fit), approach = obj(report.approach);
+  const next = obj(report.nextAction), draft = obj(report.draft);
+  const score = fit.score;
+  if (report.sent !== false || !text(card.name) || !text(card.company)
+    || !(score === null || (typeof score === 'number' && Number.isFinite(score)))
+    || !text(fit.label) || !text(approach.problem) || !text(approach.proposal)
+    || !text(approach.channel) || !text(next.what) || !text(next.due)
+    || !text(draft.subject) || !text(draft.body)) {
+    throw new Error('incomplete or sent card report');
+  }
+}
+
+export async function runCardFollowup({ imagePath, ocrText, runGraph = defaultRunGraph, rootDir = effectiveInstanceRoot(), outDir, runId = randomUUID(), context }: {
+  imagePath: string;
+  ocrText: string | null;
+  runGraph?: typeof defaultRunGraph;
+  rootDir?: string;
+  outDir?: string;
+  runId?: string;
+  context?: string;
+}): Promise<{ replies: [string, string, string]; followupPath?: string }> {
+  if (ocrText !== null && cardText(ocrText).decision !== 'card') throw new NotACardError('not a card');
+  const base = join(rootDir, 'graph-runs', 'card-followup');
+  const dir = outDir ?? join(base, runId);
+  mkdirSync(dir, { recursive: true, mode: 0o700 });
+  chmodSync(base, 0o700);
+  chmodSync(dir, 0o700);
+  const statePath = join(base, `${runId}.json`);
+  const sealState = () => {
+    try { chmodSync(statePath, 0o600); } catch { /* runner may not have written state */ }
+    const contexts = `${statePath}.contexts`;
+    try {
+      chmodSync(contexts, 0o700);
+      for (const file of readdirSync(contexts)) chmodSync(join(contexts, file), 0o600);
+    } catch { /* no contexts yet */ }
+  };
+  try {
+    const state = await runGraph(GRAPH, { runId, deps: { root: rootDir }, input: {
+      image: imagePath, outDir: dir, ...(context ? { context } : {}),
+    } });
+    if (isNotACard(state)) throw new NotACardError('not a card');
+    if (state.status !== 'done') throw new Error('graph did not finish');
+    const report = obj(JSON.parse(readFileSync(join(dir, 'followup.json'), 'utf8')));
+    validateReport(report);
+    const card = obj(report.card), fit = obj(report.fit), approach = obj(report.approach);
+    const next = obj(report.nextAction), draft = obj(report.draft);
+    const summary = `① 요약\n${line(card.name)} · ${line(card.company)} · ${line(card.title)}\n타겟 판정: ${line(fit.score)} · ${line(fit.label)}`;
+    const strategy = `② 전략\n${[approach.problem, approach.proposal, approach.channel].map(line).join('\n')}\n다음 행동: ${line(next.what)} · ${line(next.due)}`;
+    const mail = `③ 팔로업 초안 (보내지 않았습니다)\n제목: ${line(draft.subject)}\n${text(draft.body)}`;
+    const followupPath = join(dir, 'followup.md');
+    readFileSync(followupPath);
+    return { replies: [summary, strategy, mail], followupPath };
+  } finally {
+    if (runGraph === defaultRunGraph) sealState();
+  }
+}

package/src/chat/index.ts

@@ -437,6 +437,7 @@ export const SLASH_COMMANDS: SlashCommand[] = [
   { name: 'model',     aliases: ['m'],           description: '모델 바꾸기 — /model <codex|terra|sol|luna|opus|sonnet|grok> (list + current when no arg). OpenAI 는 Codex(Responses API)만. effort 는 /reasoning.', subcommands: ['codex', 'terra', 'sol', 'luna', 'opus', 'sonnet', 'grok'] },
   { name: 'clear', aliases: ['cls'],       description: '대화 기록 지우기' },
   { name: 'status', aliases: ['st'], description: '지금 상태 — 모델 · 연결 · 계정' },
+  { name: 'now', aliases: [], description: '현재 맥락과 출처 표 — /now [주제]' },
   { name: 'remaining', aliases: [], description: '계정별 남은 사용량' },
   { name: 'setup', aliases: [], description: '상세 설정 — /setup · /setup reset(다음 실행 때 마법사 다시)', subcommands: ['help', 'reset'] },
   { name: 'quit',  aliases: ['q', 'exit'], description: '나가기' },

package/src/cli/drive-input-jail.ts

@@ -0,0 +1,101 @@
+import { realpathSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, isAbsolute, relative, sep } from 'node:path';
+
+export type DriveInputJailVerdict =
+  | { readonly allowed: true }
+  | { readonly allowed: false; readonly reason: 'outside-jail'; readonly path: string };
+
+/** Resolve each existing component before applying the next '..', including write targets. */
+function canonicalPath(path: string): string {
+  let current = isAbsolute(path) ? sep : realpathSync(process.cwd());
+  for (const part of path.split(sep)) {
+    if (!part || part === '.') continue;
+    if (part === '..') {
+      current = dirname(current);
+      continue;
+    }
+    const next = `${current === sep ? '' : current}${sep}${part}`;
+    try {
+      current = realpathSync(next);
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error;
+      current = next;
+    }
+  }
+  return current;
+}
+
+function insideJail(boundary: string, candidate: string): boolean {
+  const rel = relative(boundary, candidate);
+  return rel !== '..' && !rel.startsWith(`..${sep}`) && !isAbsolute(rel);
+}
+
+/**
+ * Check path literals in brain-generated PTY text without executing or rewriting the text.
+ * Absolute paths and home paths (~ and ~/) are checked against the canonical jail, including symlink
+ * ancestors. This is a path-literal guard, not a shell interpreter or a sandbox for the child.
+ */
+export function checkDriveInputJail(input: string, boundary: string, home: string = homedir()): DriveInputJailVerdict {
+  const jail = canonicalPath(boundary);
+  // Quoted path arguments can contain spaces. Inspect those as one literal before scanning
+  // unquoted tokens (which also covers option assignments such as --prefix=/opt/homebrew).
+  const quotedRanges: Array<[number, number]> = [];
+  const literals: string[] = [];
+  for (const match of input.matchAll(/(["'])(.*?)\1/gs)) {
+    const start = match.index ?? 0;
+    if (match[2]?.startsWith('/') || match[2] === '~' || match[2]?.startsWith('~/')) {
+      // A double-quoted string still runs $(…) and `…` — keep scanning inside it so a substituted
+      // command's own paths (e.g. "/jail/$(cat /etc/passwd)") are checked too.
+      const expands = match[1] === '"' && /\$\(|`/.test(match[2]);
+      if (!expands) quotedRanges.push([start, start + match[0].length]);
+      if (/\bPATH=$/.test(input.slice(0, start))) literals.push(...match[2].split(':').filter(Boolean));
+      else literals.push(match[2]);
+    }
+  }
+  const candidates = /(^|[\s"'`|&=:<>(\[,;])((?:~\/|\/)[^\s"'`|:;&<>()[\]{}]*|~(?=$|[\s"'`|:;&<>()[\]{},]))/gm;
+  for (const match of input.matchAll(candidates)) {
+    const literal = match[2]!;
+    const start = (match.index ?? 0) + match[1]!.length;
+    if (quotedRanges.some(([from, to]) => from < start && start < to)) continue;
+    if (literal.startsWith('//') && /\w+:$/.test(input.slice(Math.max(0, start - 12), start))) continue;
+    literals.push(literal);
+  }
+  for (const literal of literals) {
+    const expanded = literal === '~' ? home : literal.startsWith('~/') ? `${home.replace(/\/$/, '')}/${literal.slice(2)}` : literal;
+    if (!insideJail(jail, canonicalPath(expanded))) return { allowed: false, reason: 'outside-jail', path: literal };
+  }
+  return { allowed: true };
+}
+
+export interface DriveJailDeps {
+  inject(text: string): boolean;
+  observe(): string | Promise<string>;
+}
+
+/**
+ * Put a drive's PTY input behind the jail. A blocked input is never sent to the PTY; the next screen the brain
+ * reads carries one line saying why, so it can try another way inside the jail (returning false from inject
+ * would end the loop as a human takeover). No jail → the deps come back unchanged.
+ */
+export function withDriveJail<T extends DriveJailDeps>(deps: T, jail: string | undefined, log?: (event: string, data: Record<string, unknown>) => void): T {
+  if (!jail) return deps;
+  let notice: string | null = null;
+  return {
+    ...deps,
+    inject: (text: string) => {
+      const verdict = checkDriveInputJail(text, jail);
+      if (verdict.allowed) return deps.inject(text);
+      notice = `⚠ elanous: input blocked — ${verdict.path} is outside the boundary ${jail} · try another way inside it`;
+      log?.('jail-block', { path: verdict.path, input: text.slice(0, 80) });
+      return true;
+    },
+    observe: async (): Promise<string> => {
+      const frame = await deps.observe();
+      if (notice === null) return frame;
+      const line = notice;
+      notice = null;
+      return `${frame}\n${line}`;
+    },
+  };
+}

package/src/cli/hooks-cli.ts

@@ -1,6 +1,7 @@
 import type { Command } from 'commander';
 import { startHookReceiver } from '../hooks/receiver.js';
 import { HookQueue } from '../hooks/queue.js';
+import { closeIngressAndExposure, hookExposurePlan, hookExposureStatus, startPublicHookIngress, turnHookExposureOff, turnHookExposureOn, type HookExposureDeps } from '../hooks/expose.js';
 import { getSecretAsync, setSecretAsync } from '../nexus/config/secrets/index.js';
 import { getUserConfig } from '../user-config.js';
 
@@ -9,7 +10,7 @@ export function asanaEnabled(raw: unknown = getUserConfig().raw): boolean {
   return tox?.external?.asana?.enabled === true;
 }
 
-export function registerHooksCommands(program: Command): void {
+export function registerHooksCommands(program: Command, exposureDeps: HookExposureDeps = {}): void {
   const hooks = program.command('hooks').description('외부 웹훅 수신·재전송');
   hooks.command('serve').description('웹훅 수신기를 포그라운드에서 실행')
     .option('--host <host>', '리스닝 주소', '127.0.0.1')
@@ -20,22 +21,35 @@ export function registerHooksCommands(program: Command): void {
         throw new Error('invalid hooks port');
       const secrets = {
         linear: await getSecretAsync('hooks.linear'), asana: await getSecretAsync('hooks.asana'),
+        github: await getSecretAsync('hooks.github'),
         // 첫 핸드셰이크의 비밀을 저장하는 것은 «먼저 온 사람이 이긴다» — Asana 를 켠 설치에서만 연다.
         ...(asanaEnabled() ? { saveAsana: (value: string) => setSecretAsync('hooks.asana', value) } : {}),
       };
       const server = startHookReceiver({ host: opts.host, port, secrets });
+      let ingress: ReturnType<typeof startPublicHookIngress> | undefined;
+      try { if (opts.host === '127.0.0.1' && port === 31480) ingress = startPublicHookIngress(server.url); }
+      catch (error) { server.stop(); throw error; }
       console.log(`hooks listening ${new URL(server.url).host}`);
       await new Promise<void>(resolve => {
         const stop = () => {
           process.removeListener('SIGINT', stop);
           process.removeListener('SIGTERM', stop);
-          server.stop();
-          resolve();
+          void closeIngressAndExposure(ingress, exposureDeps).finally(() => { server.stop(); resolve(); });
         };
         process.once('SIGINT', stop);
         process.once('SIGTERM', stop);
       });
     });
+  const expose = hooks.command('expose').description('결정 원장에 묶인 웹훅 공개 진입');
+  expose.command('plan').description('공개 경로와 tailscale 명령만 표시').action(() => console.log(JSON.stringify(hookExposurePlan())));
+  expose.command('on').description('결정 뒤 공개 진입 켜기').option('--decision <D-id>')
+    .action(async (opts: { decision?: string }) => console.log(JSON.stringify(await turnHookExposureOn(opts.decision, exposureDeps))));
+  expose.command('off').description('이 도구가 켠 공개 진입 끄기(결정 불필요)').option('--force', '기록·대상 확인 없이 8443 Funnel 을 끈다')
+    .action(async (opts: { force?: boolean }) => {
+      const result = await turnHookExposureOff(exposureDeps, { force: opts.force });
+      console.log(result.changed ? `hooks exposure off (${result.reason})` : 'hooks exposure: nothing of ours to turn off (8443 Funnel is not recorded and does not target the hook ingress; --force to turn it off anyway)');
+    });
+  expose.command('status').description('기록된 공개 경로·결정·시각').action(() => console.log(JSON.stringify(hookExposureStatus(exposureDeps))));
   hooks.command('status').description('대기 중인 웹훅 수와 마지막 전달 시각')
     .action(() => {
       const queue = new HookQueue();

package/src/cli/make-cli.ts

@@ -0,0 +1,43 @@
+import type { Command } from 'commander';
+import { debug } from '../debug/log.js';
+import { judge } from '../llm/judge-layer.js';
+import { runPluginMake } from './plugin-cli.js';
+import { workflowRun } from './workflow.js';
+
+type MakeKind = 'plugin' | 'workflow';
+type MakeDeps = {
+  decide?: (request: string) => Promise<MakeKind | null>;
+  pluginMake?: (request: string) => Promise<void>;
+  workflowMake?: (request: string) => Promise<number>;
+};
+
+export async function classifyMakeRequest(request: string, call?: (args: { prompt: string; provider: string; model: string }) => Promise<{ text: string }>): Promise<MakeKind | null> {
+  if (!request.trim()) return null;
+  const result = await judge<MakeKind>({
+    site: 'cli.make',
+    ...(call ? { call } : {}),
+    prompt: `Classify this request for an Elanous creator. Choose "plugin" for a reusable connector, integration, skill, or capability (including reading a file format). Choose "workflow" for a sequence of jobs, recurring schedule, automation, or publishing task, even when it uses a connector. If you cannot decide, return {"kind":"unclear"}. Respond with JSON only, exactly {"kind":"plugin"} or {"kind":"workflow"} or {"kind":"unclear"}. Do not execute the request.\nRequest: ${JSON.stringify(request)}`,
+    schema: value => {
+      if (!value || typeof value !== 'object' || Array.isArray(value)) return null;
+      const kind = (value as { kind?: unknown }).kind;
+      return kind === 'plugin' || kind === 'workflow' ? kind : null;
+    },
+  });
+  return result.ok ? result.value : null;
+}
+
+export function registerMakeCommand(program: Command, deps: MakeDeps = {}): void {
+  program.command('make <request>')
+    .description('Classify a one-line request and make a plugin or build a workflow')
+    .action(async (request: string) => {
+      const kind = await (deps.decide ?? classifyMakeRequest)(request).catch(() => null);
+      debug.log('cli.make', 'route', { kind: kind ?? 'undecided' });
+      if (!kind) {
+        console.log('플러그인(커넥터·스킬)을 만들까요, 워크플로(잡)를 만들까요?');
+        process.exitCode = 1;
+        return;
+      }
+      if (kind === 'plugin') await (deps.pluginMake ?? runPluginMake)(request);
+      else process.exitCode = await (deps.workflowMake ?? ((text: string) => workflowRun('build-workflow', text)))(request);
+    });
+}

package/src/cli/persona-cli.ts

@@ -1,4 +1,4 @@
-// PS1 — `elanous persona list|add|show`: 프리셋(persona-presets/)을 보고, 골라서 «내 페르소나»를 만들고, 만든 것을 본다.
+// `elanous persona list|add|edit|show`: 프리셋을 보고, 내 페르소나를 만들고 꾸민다.
 // 만든 페르소나는 기존 페르소나 저장소(resolveStatePersonaDir · Discord·PWA 가 읽는 곳)의 `<id>.yaml` 한 파일이다.
 import type { Command } from 'commander';
 import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
@@ -7,7 +7,8 @@ import { parse as parseYaml } from 'yaml';
 import { debug } from '../debug/log.js';
 import { parsePersonaYaml } from '../persona/loader.js';
 import { resolveRepositoryPersonaDir, resolveStatePersonaDir } from '../persona/global-registry.js';
-import { choosePersonaId, describePreset, findPreset, loadPresetIndex, loadPresets, presetToProfileYaml } from '../persona/presets.js';
+import { choosePersonaId, clonePreset, describePreset, editPersona, findPreset, loadPresetIndex, loadPresets, presetToProfileYaml } from '../persona/presets.js';
+import { addTeamSet, listTeamSets, removeTeamSet } from '../persona/team-set.js';
 
 interface StoredPersona { personaId: string; displayName: string; description?: string; preset?: string; title?: string; path: string }
 
@@ -36,8 +37,52 @@ function takenIds(stateDir: string): Set<string> {
   return ids;
 }
 
+function mapping(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+
+function setEdit(edits: Record<string, unknown>, assignment: string): void {
+  const equals = assignment.indexOf('=');
+  if (equals < 1) throw new Error(`--set requires key=value: ${assignment}`);
+  const key = assignment.slice(0, equals);
+  const parts = key.split('.');
+  if (parts.some((part) => !part || ['__proto__', 'prototype', 'constructor'].includes(part))) {
+    throw new Error(`invalid --set key: ${key}`);
+  }
+  const value: unknown = parseYaml(assignment.slice(equals + 1));
+  let target = edits;
+  for (const part of parts.slice(0, -1)) {
+    if (!Object.hasOwn(target, part)) target[part] = {};
+    if (!mapping(target[part])) throw new Error(`--set key conflicts with a scalar: ${key}`);
+    target = target[part];
+  }
+  target[parts.at(-1)!] = value;
+}
+
+function editOptions(fromFile: string | undefined, assignments: readonly string[]): Record<string, unknown> {
+  const parsed: unknown = fromFile ? parseYaml(readFileSync(fromFile, 'utf8')) : {};
+  if (!mapping(parsed)) throw new Error('--from-file must contain a YAML mapping');
+  const edits = { ...parsed };
+  for (const assignment of assignments) setEdit(edits, assignment);
+  return edits;
+}
+
 export function registerPersonaCommands(program: Command): void {
-  const persona = program.command('persona').description('Persona presets — AI coworkers you pick and customise (list · add · show)');
+  const team = program.command('team-set').description('Install, remove and list persona team sets');
+  team.command('add <file>').description('Install a YAML team set').action((file: string) => {
+    try { const result = addTeamSet(file); console.log(`Installed team-set ${result['team-set']}`); }
+    catch (error) { console.error(error instanceof Error ? error.message : String(error)); process.exitCode = 1; }
+  });
+  team.command('remove <name>').description('Remove an installed team set').action((name: string) => {
+    try { removeTeamSet(name); console.log(`Removed team-set ${name}`); }
+    catch (error) { console.error(error instanceof Error ? error.message : String(error)); process.exitCode = 1; }
+  });
+  team.command('list').description('List installed team sets').action(() => {
+    try { for (const item of listTeamSets()) console.log(`${item['team-set']}  ${item.members.map((member) => `${member.persona} (${member.title})`).join(', ')}`); }
+    catch (error) { console.error(error instanceof Error ? error.message : String(error)); process.exitCode = 1; }
+  });
+
+  const persona = program.command('persona').description('Persona presets — AI coworkers you pick and customise (list · add · edit · show)');
 
   persona.command('list')
     .description('List the persona presets, then the personas you have made')
@@ -63,9 +108,10 @@ export function registerPersonaCommands(program: Command): void {
   persona.command('add <preset>')
     .description('Make your own persona from a preset (id, name or role) — the preset file is not changed')
     .option('--name <name>', 'What to call it (default: the preset’s first name)')
+    .option('--as <name>', 'Clone this preset under a new, unique name')
     .option('--title <title>', 'Optional title, e.g. CMO')
     .option('--json', 'JSON output')
-    .action((query: string, opts: { name?: string; title?: string; json?: boolean }) => {
+    .action((query: string, opts: { name?: string; as?: string; title?: string; json?: boolean }) => {
       const presets = loadPresets();
       const preset = findPreset(presets, query);
       if (!preset) {
@@ -73,6 +119,23 @@ export function registerPersonaCommands(program: Command): void {
         process.exitCode = 1;
         return;
       }
+      if (opts.as !== undefined) {
+        try {
+          if (opts.name !== undefined || opts.title !== undefined) throw new Error('--as cannot be combined with --name or --title');
+          const result = clonePreset(preset, opts.as);
+          debug.log('persona.cli', 'cloned', { preset: preset.personaId, personaId: result.personaId });
+          if (opts.json) console.log(JSON.stringify({ personaId: result.personaId, displayName: result.displayName, preset: preset.personaId, path: result.path }, null, 2));
+          else {
+            console.log(`만들었습니다 — ${result.displayName} (id ${result.personaId} · 프리셋 ${preset.personaId})`);
+            console.log(`  처음 묻는 것: ${preset.firstQuestions.join(' / ')}`);
+            console.log(`  보기: elanous persona show ${result.personaId}`);
+          }
+        } catch (err) {
+          console.error(err instanceof Error ? err.message : String(err));
+          process.exitCode = 1;
+        }
+        return;
+      }
       const dir = resolveStatePersonaDir();
       const personaId = choosePersonaId(preset, opts.name, takenIds(dir));
       const yaml = presetToProfileYaml(preset, loadPresetIndex().common, { personaId, ...(opts.name ? { name: opts.name } : {}), ...(opts.title ? { title: opts.title } : {}) });
@@ -89,6 +152,29 @@ export function registerPersonaCommands(program: Command): void {
       console.log(`  보기: elanous persona show ${personaId}`);
     });
 
+  persona.command('edit <name>')
+    .description('Edit a saved persona (schema fields only; the preset source is not changed)')
+    .option('--set <key=value>', 'Set a field (repeatable; YAML values)', (value: string, values: string[]) => [...values, value], [] as string[])
+    .option('--from-file <path>', 'Load edits from a YAML mapping')
+    .option('--dry-run', 'Validate and preview without writing')
+    .option('--json', 'JSON output')
+    .action((name: string, opts: { set: string[]; fromFile?: string; dryRun?: boolean; json?: boolean }) => {
+      try {
+        if (!opts.fromFile && !opts.set.length) throw new Error('persona edit requires --set or --from-file');
+        const result = editPersona(name, editOptions(opts.fromFile, opts.set), { dryRun: opts.dryRun });
+        debug.log('persona.cli', opts.dryRun ? 'edit-dry-run' : 'edited', { personaId: result.personaId });
+        if (opts.json) console.log(JSON.stringify(result, null, 2));
+        else {
+          console.log(`${opts.dryRun ? '미리 보기' : '수정했습니다'} — ${result.displayName} (id ${result.personaId})`);
+          console.log(result.yaml);
+          console.log(`  파일: ${result.path}`);
+        }
+      } catch (err) {
+        console.error(err instanceof Error ? err.message : String(err));
+        process.exitCode = 1;
+      }
+    });
+
   persona.command('show <name>')
     .description('Show one of your personas (id or name), or a preset')
     .option('--json', 'JSON output')

package/src/cli/plugin-cli.ts

@@ -12,6 +12,7 @@ import { OFFICIAL_INDEX_KEYS } from '../market/official-keys.js';
 import { installPlugin, listInstalledPlugins, PluginInstallError, removePlugin, type InstallEvent } from '../plugins/install/plugin-install.js';
 import { credentialStatus, setPluginCredentials } from '../plugins/install/plugin-credentials.js';
 import { makePlugin } from '../plugins/maker/plugin-maker.js';
+import { registerStandaloneLogSink } from '../domains/standalone-log-sink.js';
 import { addAndInstallNode } from '../plugins/maker/node-install.js';
 
 function keys(): ReadonlyArray<{ keyId: string; publicKey: string }> {
@@ -56,34 +57,42 @@ function safeCause(error: unknown): string {
   return redactSecretText(error.message.replace(/https?:\/\/[^\s"'<>]+/gi, '[redacted URL]'));
 }
 
+export async function runPluginMake(request: string, opts: { name?: string; dir?: string; draftFile?: string; run?: boolean; marketBundleDir?: string; input?: string; json?: boolean } = {}): Promise<void> {
+  try {
+    await registerStandaloneLogSink('cli');
+    const result = await makePlugin({ request, name: opts.name, parentDir: opts.dir, draftFile: opts.draftFile, run: opts.run, marketBundleDir: opts.marketBundleDir,
+      ...(opts.input === undefined ? {} : { input: JSON.parse(opts.input) as unknown }) });
+    debug.flush();
+    if (opts.json) stdout.write(JSON.stringify(result) + '\n');
+    else {
+      console.log(`뼈대 ${result.timings.scaffold}ms · 작성 ${result.timings.write}ms`);
+      console.log(`검증 오류 ${result.errors.length} · ${result.timings.validate}ms${result.timings.repair === undefined ? '' : ` · 수리 ${result.timings.repair}ms`}`);
+      console.log(`설치 ${result.status === 'draft' || result.timings.install === 0 ? '미실행' : result.status === 'failed' && result.timings.run === undefined ? '실패' : '완료'} · ${result.timings.install}ms (${result.dir})`);
+      if (result.status === 'draft') console.log('연구 초안만 생성됨 — 요청 처리 단계 구현 후 별도로 검증·설치 필요');
+      if (result.marketBundle) console.log(`마켓 꾸러미 ${result.marketBundle.path} · ${result.marketBundle.signature} · 게시 안 함`);
+      if (opts.run) console.log(`실행 ${result.runStatus ?? '미실행'} · ${result.timings.run ?? 0}ms`);
+      for (const error of result.errors) console.error(error);
+    }
+    if (result.status === 'failed') process.exitCode = 1;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (opts.json) stdout.write(JSON.stringify({ status: 'failed', errors: [message] }) + '\n');
+    else console.error(`plugin make failed: ${message}`);
+    process.exitCode = 1;
+  }
+}
+
 export function registerPluginCommands(program: Command): void {
   const plugin = program.command('plugin').description('Install and manage Elanous plugins');
-  plugin.command('make <request>').description('Write, validate and install a local graph plugin from one request')
+  plugin.command('make <request>').description('Write, validate and install a local graph plugin, or generate an uninstalled research draft')
     .option('--name <slug>', 'Local plugin name')
     .option('--dir <parent>', 'Parent directory (default: instance plugins-local)')
-    .option('--run', 'Run the installed graph')
+    .option('--draft-file <path>', 'Generate an uninstalled research draft with connector and skill definitions')
+    .option('--run', 'Run the installed graph (not available for research drafts)')
+    .option('--market-bundle-dir <path>', 'Bundle installed plugin for human review; never publish')
     .option('--input <json>', 'JSON input for --run')
     .option('--json', 'Print the result as JSON')
-    .action(async (request: string, opts: { name?: string; dir?: string; run?: boolean; input?: string; json?: boolean }) => {
-      try {
-        const result = await makePlugin({ request, name: opts.name, parentDir: opts.dir, run: opts.run,
-          ...(opts.input === undefined ? {} : { input: JSON.parse(opts.input) as unknown }) });
-        if (opts.json) stdout.write(JSON.stringify(result) + '\n');
-        else {
-          console.log(`뼈대 ${result.timings.scaffold}ms · 작성 ${result.timings.write}ms`);
-          console.log(`검증 오류 ${result.errors.length} · ${result.timings.validate}ms${result.timings.repair === undefined ? '' : ` · 수리 ${result.timings.repair}ms`}`);
-          console.log(`설치 ${result.timings.install === 0 && result.status === 'failed' ? '미실행' : result.status === 'failed' && result.timings.run === undefined ? '실패' : '완료'} · ${result.timings.install}ms (${result.dir})`);
-          if (opts.run) console.log(`실행 ${result.runStatus ?? '미실행'} · ${result.timings.run ?? 0}ms`);
-          for (const error of result.errors) console.error(error);
-        }
-        if (result.status === 'failed') process.exitCode = 1;
-      } catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        if (opts.json) stdout.write(JSON.stringify({ status: 'failed', errors: [message] }) + '\n');
-        else console.error(`plugin make failed: ${message}`);
-        process.exitCode = 1;
-      }
-    });
+    .action(runPluginMake);
   plugin.command('node').description('Manage plugin workflow nodes')
     .command('add <dir> <request>').description('Write, validate and install a workflow node in a plugin')
     .option('--kind <slug>', 'Workflow node kind')

package/src/cli/pod-cli.ts

@@ -6,7 +6,7 @@ import { debug } from '../debug/log.js';
 import { getUserConfig } from '../user-config.js';
 import { listCodexAccountsInStore } from '../oauth/codex-account-store.js';
 import { parsePodPool, resolvePodPoolSpec, type PoolKubectl } from '../task-orchestrator/surfaces/pod-pool.js';
-import { leaseKubectl, measurePoolLease, recommendConcurrency, type PoolLeaseMeasure } from '../task-orchestrator/surfaces/pod-lease.js';
+import { leaseKubectl, measurePoolLease, probePoolDns, recommendConcurrency, type PoolLeaseMeasure, type PoolDnsProbe } from '../task-orchestrator/surfaces/pod-lease.js';
 import { POD_COMMAND_DEADLINE_SECONDS, runPodCommand, type PodCommandResult, type RunPodCommandOptions } from '../task-orchestrator/surfaces/pod-command-job.js';
 
 export interface PodCliIo {
@@ -19,9 +19,11 @@ export interface PodCliDeps {
   io?: PodCliIo;
   run?: (options: RunPodCommandOptions) => Promise<PodCommandResult>;
   kubectl?: PoolKubectl;
+  dns?: (context: string, kubectl: PoolKubectl) => PoolDnsProbe;
   accounts?: () => number;
   perAccount?: () => number;
   poolSpec?: (explicit?: string) => string | null;
+  harnessPool?: () => string | undefined;
 }
 
 const HELP = `elanous pod run [--pool <스펙>] [--skill <이름,…>] [--llm grok] [--clone] [--deadline <초>] -- <명령…>
@@ -36,19 +38,22 @@ export function registerPodCommands(program: Command, deps: PodCliDeps = {}): vo
   };
   const run = deps.run ?? ((options: RunPodCommandOptions) => runPodCommand(options));
   const pod = program.command('pod').description('Pod 명령 Job — 하니스 없이 명령 하나를 돌리고 산출을 돌려받는다');
-  pod.command('lease').description('Pod 풀의 읽기 전용 동시 실행 권장')
+  pod.command('lease').description('Pod 풀 동시 실행 권장 (DNS 점검용 Pod 를 잠깐 만들었다 지움)')
     .command('status').description('지금 추가로 쏠 수 있는 Pod 골과 제한 근거')
-    .option('--pool <spec>', '풀 스펙 — 컨텍스트[@ssh호스트][:상한] 쉼표')
+    .option('--pool <spec>', '풀 스펙 — 컨텍스트[@ssh호스트][:상한][#레지스트리:포트] 쉼표')
     .option('--json', '표 대신 동일 측정값을 JSON 으로')
     .action((opts: { pool?: string; json?: boolean }) => {
       try {
         const kubectl = deps.kubectl ?? leaseKubectl;
-        const spec = (deps.poolSpec ?? ((explicit?: string) => resolvePodPoolSpec(explicit)))(opts.pool);
+        const spec = (deps.poolSpec ?? ((explicit?: string) => resolvePodPoolSpec(explicit, process.env, () => {
+          const config = deps.harnessPool ? null : getUserConfig();
+          return (deps.harnessPool?.() ?? config?.harness?.podPool) || config?.pod?.pool;
+        })))(opts.pool);
         // No pool configured: mirror the Pod launch fallback to kubectl's current context.
         const current = spec ? null : kubectl(['config', 'current-context']);
         const context = spec ?? (current?.status === 0 ? current.stdout.trim() : '');
         const members = context ? parsePodPool(context) : [];
-        const measure: PoolLeaseMeasure = members.length ? measurePoolLease(members, { kubectl }) : { members: [] };
+        const measure: PoolLeaseMeasure = members.length ? measurePoolLease(members, { kubectl, dns: (context) => (deps.dns ?? probePoolDns)(context, kubectl) }) : { members: [] };
         let accounts: number | null = null;
         let accountReason: string | null = null;
         try { accounts = (deps.accounts ?? (() => listCodexAccountsInStore().length))(); }
@@ -57,17 +62,20 @@ export function registerPodCommands(program: Command, deps: PodCliDeps = {}): vo
         const decision = recommendConcurrency(measure, { capacity: members.reduce((sum, m) => sum + m.capacity, 0), accounts: accounts ?? -1, perAccount });
         if (!context) { decision.recommended = null; decision.limitedBy = null; decision.reason = '측정 불가: cluster (current context)'; }
         const result = { pool: spec, ...measure, accounts, perAccount, ...decision };
-        debug.log('pod.lease', 'status', { pool: spec ? members.map((m) => ({ capacity: m.capacity })) : null, running: decision.running, pending: decision.pending, recommended: decision.recommended, limitedBy: decision.limitedBy });
+        debug.log('pod.lease', 'status', { pool: spec ? members.map((m) => ({ capacity: m.capacity })) : null, running: decision.running, pending: decision.pending, unleasedRunning: decision.unleasedRunning, recommended: decision.recommended, limitedBy: decision.limitedBy });
         if (opts.json) io.log(JSON.stringify(result));
         else {
+          io.log(`풀: ${(spec ?? context) || '?'}`);
           io.log('컨텍스트 | 상한 | Running | Pending | 메모리(상한 합/할당 가능) | CPU(할당 가능)');
           for (const m of measure.members) {
             const mem = (v: number | null) => v === null ? '?' : `${(v / 1024 ** 3).toFixed(1)}Gi`;
             io.log(`${m.context} | ${m.capacity} | ${m.running ?? '?'} | ${m.pending ?? '?'} | ${mem(m.memoryLimitBytes)}/${mem(m.allocatableMemoryBytes)} | ${m.allocatableCpuMillicores === null ? '?' : m.allocatableCpuMillicores / 1000}${m.reason ? ` (${m.reason})` : ''}`);
           }
           io.log(`권장 지금 ${decision.recommended ?? '?'} 개 더 (limitedBy=${decision.limitedBy ?? 'unknown'})${decision.reason ? ` · ${decision.reason}` : ''}`);
-          io.log(`capacity: ${decision.capacitySlots ?? '?'} 칸 (상한 ${members.reduce((sum, m) => sum + m.capacity, 0)} − Running ${decision.running ?? '?'} − Pending ${decision.pending ?? '?'})`);
+          io.log(`임대 없는 실행 ${decision.unleasedRunning ?? '?'}`);
+          io.log(`capacity: ${decision.capacitySlots ?? '?'} 칸 (상한 ${members.reduce((sum, m) => sum + m.capacity, 0)} − Running ${decision.running ?? '?'} − Pending ${decision.pending ?? '?'}; 권장 수에서 건강한 멤버의 임대 없는 실행 차감)`);
           io.log(`memory: ${decision.memorySlots ?? '?'} 칸 (할당 가능 − Running 하니스 상한 합; 골당 16Gi · 모든 네임스페이스의 노드별 기존 예약을 반영해 배치 가능 ${decision.placeableSlots ?? '?'} 칸)`);
+          io.log(`lite: ${decision.liteMemorySlots ?? '?'} 칸 (같은 여유를 lite 골 2Gi 로 센 값 · 관측만 — 권장 수는 위 standard 기준)`);
           io.log(`accounts (관측만 · 상한 아님): ${decision.accountSlots ?? '?'} 칸 (${accounts ?? '?'} × ${perAccount} − Running ${decision.running ?? '?'})${accountReason ? ` · ${accountReason}` : ''}`);
         }
         io.exit(0);
@@ -78,14 +86,15 @@ export function registerPodCommands(program: Command, deps: PodCliDeps = {}): vo
     });
   pod.command('run')
     .description(HELP)
-    .option('--pool <spec>', '풀 스펙 — 컨텍스트[@ssh호스트][:상한] 쉼표')
+    .option('--pool <spec>', '풀 스펙 — 컨텍스트[@ssh호스트][:상한][#레지스트리:포트] 쉼표')
     .option('--skill <names>', '스킬 이름(쉼표). 그 스킬 .env 만 Secret 으로 싣는다')
     .option('--llm <provider>', 'grok 만 허용 — access 사본(refresh 없음)')
     .option('--clone', '저장소를 clone 한다(비공개 · GitHub 토큰이 런 Secret 으로 간다 · 명시할 때만). 기본은 clone 없이 ~/work 에서 이미지의 elanous 로')
     .option('--deadline <seconds>', `Job 수명 상한(초). 생략 시 ${POD_COMMAND_DEADLINE_SECONDS}`)
     .allowUnknownOption(true)
     .allowExcessArguments(true)
-    .action(async (opts: { pool?: string; skill?: string; llm?: string; clone?: boolean; deadline?: string }, command: Command) => {
+    .option('--lite', '네트워크 스킬(omni-crawl·omni-digest)만 쓰는 명령 — 작은 이미지 ⊕ 2Gi 한도(POD7 · clone 불가)')
+    .action(async (opts: { pool?: string; skill?: string; llm?: string; clone?: boolean; deadline?: string; lite?: boolean }, command: Command) => {
       const argv = process.argv.slice(2);
       const sep = argv.indexOf('--');
       const fromArgv = sep >= 0 ? argv.slice(sep + 1) : [];
@@ -117,6 +126,7 @@ export function registerPodCommands(program: Command, deps: PodCliDeps = {}): vo
           ...(skills.length ? { skills } : {}),
           ...(opts.llm === 'grok' ? { llm: 'grok' as const } : {}),
           ...(opts.clone ? { clone: true } : {}),
+          ...(opts.lite ? { lite: true } : {}),
           ...(deadlineSeconds !== undefined ? { deadlineSeconds } : {}),
         });
         if (result.image) io.error(`[pod] image ${result.image} · job ${result.job}`);