elanous 0.2.10 → 0.2.12

package/scripts/ci-public-leak-gate.ts

@@ -10,8 +10,8 @@
  *   bun scripts/ci-public-leak-gate.ts --changed-files a b …    # 그 파일들만 검사
  *   bun scripts/ci-public-leak-gate.ts --update                 # 기준선 재스냅샷(치운 뒤)
  *
- * ⛔ 이 게이트는 아직 `pr land` 에 «배선하지 않았다» — 다른 트랙의 주석 관례(대표 표기 기호 등)가 매일 늘어 배선 즉시 착지가 막힌다.
- *    배선은 조율 채널 합의 뒤(2026-09-24 🅢).
+ * `pr land` 는 변경 파일을 PR 트리에서 스캔하고 기준선은 base ref 에서 읽어 방향을 경고 전용으로 표시한다.
+ * 단독 CLI 의 기본 기준선은 현재 트리의 파일이며, 증가는 exit 1 이다.
  */
 import { existsSync, readFileSync, writeFileSync } from 'node:fs';
 import { join, resolve } from 'node:path';
@@ -57,6 +57,19 @@ export function renderBaseline(counts: ReadonlyMap<string, number>): string {
 
 export interface LeakGrowth { readonly marker: string; readonly file: string; readonly allowed: number; readonly now: number }
 
+/** 기준선과 현재 트리의 모든 차이(사라진 표지 포함). */
+export function findLeakChanges(current: ReadonlyMap<string, number>, baseline: ReadonlyMap<string, number>, only?: ReadonlySet<string>): LeakGrowth[] {
+  const out: LeakGrowth[] = [];
+  for (const key of new Set([...baseline.keys(), ...current.keys()])) {
+    const [marker, file] = key.split('\t') as [string, string];
+    if (only && !only.has(file)) continue;
+    const allowed = baseline.get(key) ?? 0;
+    const now = current.get(key) ?? 0;
+    if (now !== allowed) out.push({ marker, file, allowed, now });
+  }
+  return out.sort((a, b) => a.file.localeCompare(b.file) || a.marker.localeCompare(b.marker));
+}
+
 /** 기준선보다 «늘어난» (표지, 파일). `only` 가 있으면 그 파일만 본다. */
 export function findGrowth(current: ReadonlyMap<string, number>, baseline: ReadonlyMap<string, number>, only?: ReadonlySet<string>): LeakGrowth[] {
   const out: LeakGrowth[] = [];
@@ -81,6 +94,8 @@ export interface PublicLeakGateIo {
   readonly args?: readonly string[];
   readonly root?: string;
   readonly scan?: () => LeakHit[];
+  /** Read the baseline from the landing base commit, not the PR's working tree. */
+  readonly baselineRef?: string;
   readonly log?: (s: string) => void;
   readonly error?: (s: string) => void;
 }
@@ -100,14 +115,34 @@ export function runPublicLeakGate(io: PublicLeakGateIo = {}): number {
     log(`[public-leak-gate] baseline updated — ${[...current.values()].reduce((a, n) => a + n, 0)} hits · ${current.size} entries`);
     return 0;
   }
-  if (!existsSync(baselinePath)) { error(`[public-leak-gate] FAIL — 기준선이 없다: ${BASELINE_REL} (--update 로 만든다)`); return 2; }
-  const growth = findGrowth(current, parseBaseline(readFileSync(baselinePath, 'utf8')), only);
+  let baselineText: string;
+  if (io.baselineRef) {
+    const shown = spawnSync('git', ['-C', root, 'show', `${io.baselineRef}:${BASELINE_REL}`], { encoding: 'utf8', maxBuffer: 1 << 28 });
+    if (shown.status !== 0) { error(`[public-leak-gate] FAIL — ${io.baselineRef} 기준선을 못 읽었다: ${BASELINE_REL}`); return 2; }
+    baselineText = shown.stdout;
+  } else {
+    if (!existsSync(baselinePath)) { error(`[public-leak-gate] FAIL — 기준선이 없다: ${BASELINE_REL} (--update 로 만든다)`); return 2; }
+    baselineText = readFileSync(baselinePath, 'utf8');
+  }
+  const baseline = parseBaseline(baselineText);
+  const growth = findGrowth(current, baseline, only);
   const scope = only ? `변경 파일 ${only.size}개` : '전체';
-  if (growth.length === 0) { log(`[public-leak-gate] PASS — 유출이 늘지 않았다 (${scope})`); return 0; }
-  error(`[public-leak-gate] FAIL — 유출이 늘었다 (${scope} · ${growth.length}곳):`);
-  for (const g of growth) error(`  ${g.file}  ${g.marker}  ${g.allowed} → ${g.now}`);
-  error('  확인: bun scripts/public-export.ts --leak-check --path <파일> --all');
-  return 1;
+  if (growth.length > 0) {
+    error(`[public-leak-gate] FAIL — 유출이 늘었다 (${scope} · ${growth.length}곳):`);
+    for (const g of growth) error(`  ${g.file}  ${g.marker}  ${g.allowed} → ${g.now}`);
+    error('  확인: bun scripts/public-export.ts --leak-check --path <파일> --all');
+    return 1;
+  }
+  if (io.baselineRef) {
+    const shrunk = findLeakChanges(current, baseline, only).filter((change) => change.now < change.allowed);
+    if (shrunk.length > 0) {
+      log(`[public-leak-gate] SHRANK — 유출이 줄었다 · 기준선 --update 권장 (${scope} · ${shrunk.length}곳):`);
+      for (const g of shrunk) log(`  ${g.file}  ${g.marker}  ${g.allowed} → ${g.now}`);
+      return 3;
+    }
+  }
+  log(`[public-leak-gate] PASS — 유출이 늘지 않았다 (${scope})`);
+  return 0;
 }
 
 if (import.meta.main) process.exit(runPublicLeakGate());

package/scripts/context-hooks/claude-stop.sh

@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+# Claude Code Stop hook; hook data travels only through stdin to the bounded extractor.
+SCRIPT_DIR="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)" || exit 0
+bun "$SCRIPT_DIR/emit.ts" stop </dev/stdin >/dev/null 2>&1 || true

package/scripts/context-hooks/emit.ts

@@ -0,0 +1,24 @@
+import { spawnSync } from 'node:child_process';
+
+const event = process.argv[2];
+if (event !== 'stop' && event !== 'post-tool-use') process.exit(0);
+
+try {
+  const payload = JSON.parse(await Bun.stdin.text()) as Record<string, unknown>;
+  // A locator is useful only when it is a session ID, not arbitrary hook input.
+  const session = payload.session_id;
+  if (typeof session !== 'string' || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(session)) process.exit(0);
+  const tool = payload.tool_name;
+  if (event === 'post-tool-use' && (typeof tool !== 'string' || !/^[a-z][a-z0-9_.:-]{0,63}$/i.test(tool))) process.exit(0);
+  // Only known tool identifiers can appear in the generated summary. Never copy hook free text.
+  const knownTools = new Set(['Read', 'Write', 'Edit', 'MultiEdit', 'Bash', 'Glob', 'Grep', 'LS',
+    'Task', 'WebFetch', 'WebSearch', 'NotebookEdit', 'TodoWrite', 'AskUserQuestion']);
+  const summary = event === 'stop' ? 'Claude Code session stopped'
+    : `Claude Code tool ${knownTools.has(tool as string) ? tool : 'other'} completed`;
+  const source = `elanous://context/claude-code/${session}`;
+  spawnSync('elanous', ['context', 'emit', '--kind', 'done', '--summary', summary, '--source', source], {
+    stdio: 'ignore', timeout: 3000,
+  });
+} catch {
+  // Hooks must not interrupt the seat session on malformed input or unavailable CLI.
+}

package/scripts/context-hooks/post-tool-use.sh

@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+# Claude Code PostToolUse hook; hook data travels only through stdin to the bounded extractor.
+SCRIPT_DIR="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)" || exit 0
+bun "$SCRIPT_DIR/emit.ts" post-tool-use </dev/stdin >/dev/null 2>&1 || true

package/scripts/coord-channel-watch.sh

@@ -79,6 +79,18 @@ WATCH_EXIT_ANNOUNCED=0    # 종료 줄 중복 방지(INT→EXIT 로 trap 이 두
 # 「거의 비었다」로 «의심»할 자수 — 이 아래로 떨어지면 «변경»이 아니라 «의심»으로 말한다.
 BODY_MIN="${CH_BODY_MIN:-100}"
 
+# ⛔⭐ WATCH1(10-03 MK 6시간 실명): 감시자에 고정 토큰(GH_TOKEN·GITHUB_TOKEN — App 토큰은 1시간)을 넣어 띄우면
+#   만료 뒤 조회가 조용히 계속 실패한다. 읽기는 신원이 필요 없다 ⇒ 고정 토큰을 «비우고» keyring gh 인증으로 읽는다.
+#   그 토큰을 꼭 써야 하면 WATCH_KEEP_TOKEN=1 (그때도 경고 줄은 낸다).
+if [ -n "${GH_TOKEN:-}${GITHUB_TOKEN:-}" ]; then
+  if [ "${WATCH_KEEP_TOKEN:-}" = "1" ]; then
+    echo "⚠️ [watch] GH_TOKEN/GITHUB_TOKEN 고정 토큰으로 읽는다(WATCH_KEEP_TOKEN=1) — 만료되면 «⛔ 조회 실패» 줄이 뜬다"
+  else
+    echo "⚠️ [watch] GH_TOKEN/GITHUB_TOKEN 이 들어 있어 비웠다 — 읽기는 keyring gh 인증으로(고정 토큰은 만료돼 감시가 눈이 먼다 · WATCH1)"
+    unset GH_TOKEN GITHUB_TOKEN
+  fi
+fi
+
 CMD="ensure"
 TRACK=""
 ADOPT_PID=""

package/scripts/coord-requests-bridge.ts

@@ -0,0 +1,143 @@
+#!/usr/bin/env bun
+import { execFileSync } from 'node:child_process';
+import { appendFileSync, mkdirSync, readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { debug } from '../src/debug/log.js';
+import { registerStandaloneLogSink } from '../src/domains/standalone-log-sink.js';
+import { effectiveInstanceRoot } from '../src/instance/resolve.js';
+import trackData from './coord-tracks.json';
+
+type Comment = { id: number; body: string; created_at: string; html_url: string };
+type Options = { seat: string; channel: string; since?: string; dryRun: boolean; json: boolean };
+const seatIds = new Set(trackData.tracks.map((track) => track.id));
+
+function options(args: string[]): Options {
+  let seat = '';
+  let channel = '23032';
+  let since: string | undefined;
+  let dryRun = false;
+  let json = false;
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (arg === '--seat' && args[i + 1]) seat = args[++i]!;
+    else if (arg === '--channel' && args[i + 1]) channel = args[++i]!;
+    else if (arg === '--since' && args[i + 1]) since = args[++i]!;
+    else if (arg === '--dry-run') dryRun = true;
+    else if (arg === '--json') json = true;
+    else throw new Error(`모르는 인자 또는 값 없음: ${arg}`);
+  }
+  if (!seatIds.has(seat)) throw new Error('--seat <ID> 는 자리 정본의 ID 여야 한다');
+  if (!/^[1-9]\d*$/.test(channel)) throw new Error('--channel 은 양의 정수여야 한다');
+  if (since && (!/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/.test(since) || !Number.isFinite(Date.parse(since)))) {
+    throw new Error('--since 는 ISO 시각이어야 한다');
+  }
+  return { seat, channel, ...(since ? { since } : {}), dryRun, json };
+}
+
+function envelope(body: string, seat: string): { cell?: string; dueAt?: string; text: string } | null {
+  const [header = '', ...lines] = body.split(/\r?\n/);
+  const match = /^\s*(?:#+\s*)?\*\*\[([^\]]+)\]\*\*[^\n]*?→\s*(.+)$/.exec(header);
+  if (!match || match[1] === seat) return null;
+  const fields = match[2]!.split('·').map((part) => part.trim());
+  const recipients: string[] = [];
+  let i = 0;
+  while (i < fields.length) {
+    const names = fields[i]!.split(/[\s,]+/).filter(Boolean);
+    if (!names.length || names.some((name) => !seatIds.has(name) && name !== '전원')) break;
+    recipients.push(...names);
+    i++;
+  }
+  if (!recipients.includes(seat) || recipients.includes('전원') || (fields[i] !== '요청' && fields[i] !== '결정')) return null;
+  const tail = fields.slice(i + 1);
+  const inline: string[] = [];
+  let cell: string | undefined;
+  let dueAt: string | undefined;
+  for (let j = 0; j < tail.length; j++) {
+    const field = tail[j]!;
+    const suffix = /(?:\s+—\s*|\s+-\s+|:\s+)(\S.*)$/.exec(field);
+    const bare = /^(?:—|-|:)\s*(\S.*)$/.exec(field);
+    const value = suffix ? field.slice(0, suffix.index).trim() : bare ? '' : field;
+    if (/^기한\s+\S/.test(value)) dueAt = value.replace(/^기한\s+/, '');
+    else if (j === 0) cell = value;
+    else if (value && value !== '-') inline.push(value);
+    if (suffix || bare) inline.push((suffix ?? bare)![1]!);
+  }
+  const text = [...inline, lines.join('\n').trim()].filter(Boolean).join('\n') || '(본문 없음 — 채널 글 링크 참조)';
+  return { text: Array.from(text).slice(0, 200).join(''),
+    ...(cell && cell !== '-' && !cell.startsWith('기한 ') ? { cell } : {}), ...(dueAt ? { dueAt } : {}) };
+}
+
+/** 이미 넣은 요청 — `<seat>|<commentId>` 로 센다. 새 꼴 키 `coord:<id>:<SEAT>` 와 옛 꼴 키 `coord:<id>`(그 줄의 `seat` 로 자리를 판별)를 둘 다 읽어,
+ *  한 글이 여러 자리에게 왔을 때 한 자리의 줄이 다른 자리의 요청을 막지 않게 한다. */
+function existingSeatComments(path: string): Set<string> {
+  let contents: string;
+  try { contents = readFileSync(path, 'utf8'); }
+  catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return new Set();
+    throw error;
+  }
+  const seen = new Set<string>();
+  for (const line of contents.split('\n')) {
+    if (!line) continue;
+    const row = JSON.parse(line) as { key?: unknown; seat?: unknown };
+    if (typeof row.key !== 'string') continue;
+    const current = /^coord:(\d+):([^:]+)$/.exec(row.key);
+    if (current) { seen.add(`${current[2]}|${current[1]}`); continue; }
+    const legacy = /^coord:(\d+)$/.exec(row.key);
+    if (legacy && typeof row.seat === 'string') seen.add(`${row.seat}|${legacy[1]}`);
+  }
+  return seen;
+}
+
+async function run(args: string[]): Promise<void> {
+  await registerStandaloneLogSink('coord-requests-bridge');
+  let seat = '';
+  let reason = 'input';
+  try {
+    const selected = options(args);
+    seat = selected.seat;
+    const { channel, since, dryRun, json } = selected;
+    reason = 'gh';
+    const endpoint = `repos/{owner}/{repo}/issues/${channel}/comments${since ? `?since=${encodeURIComponent(since)}` : ''}`;
+    const output = execFileSync('gh', ['api', endpoint, '--paginate', '--jq', '.[]'], { encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 });
+    const comments = output.split('\n').filter(Boolean).map((line) => JSON.parse(line) as unknown);
+    reason = 'ledger';
+    const path = join(effectiveInstanceRoot(), 'seat-requests', 'requests.jsonl');
+    const seen = existingSeatComments(path);
+    let picked = 0, added = 0, existing = 0;
+    for (const item of comments) {
+      const comment = item as Partial<Comment>;
+      if (typeof comment.id !== 'number' || !Number.isSafeInteger(comment.id) || typeof comment.body !== 'string'
+        || typeof comment.created_at !== 'string' || typeof comment.html_url !== 'string') throw new Error('gh api 댓글 필드가 잘못됐다');
+      if (since && Date.parse(comment.created_at) < Date.parse(since)) continue;
+      const request = envelope(comment.body, seat);
+      if (!request) continue;
+      picked++;
+      const key = `coord:${comment.id}:${seat}`;
+      const marker = `${seat}|${comment.id}`;
+      if (seen.has(marker)) { existing++; continue; }
+      if (!dryRun) {
+        mkdirSync(dirname(path), { recursive: true });
+        appendFileSync(path, `${JSON.stringify({ key, seat, text: request.text, status: 'queued', queuedAt: comment.created_at,
+          source: 'coord', ...('cell' in request ? { cell: request.cell } : {}),
+          ...('dueAt' in request ? { dueAt: request.dueAt } : {}), url: comment.html_url })}\n`, { mode: 0o600 });
+      }
+      seen.add(marker);
+      added++;
+    }
+    const counts = { seat, read: comments.length, picked, added, existing };
+    debug.log('coord.requests-bridge', 'run', counts);
+    console.log(json ? JSON.stringify(counts) : `읽은 글 ${counts.read} · 고른 수 ${picked} · 새로 넣은 수 ${added} · 이미 있던 수 ${existing}`);
+  } catch (error) {
+    debug.log('coord.requests-bridge', 'failed', { seat, reason });
+    throw error;
+  }
+}
+
+if (import.meta.main) {
+  try { await run(process.argv.slice(2)); }
+  catch (error) {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exitCode = 1;
+  }
+}

package/scripts/field-feed/lib.ts

@@ -5,6 +5,7 @@ import { existsSync, readFileSync, readdirSync, writeFileSync, renameSync, mkdir
 import { basename, dirname, extname, join, resolve } from 'node:path';
 import { homedir } from 'node:os';
 import { spawn, spawnSync } from 'node:child_process';
+import { recordOutput } from '../../src/outputs/ledger.js';
 
 export type FeedSlide = { image: string; source: string; caption: string; include: boolean; renderedCaption?: string /* `N/M:caption` as last drawn */ };
 export type FeedDraft = {
@@ -55,6 +56,9 @@ export function writeDraft(folder: string, draft: FeedDraft): void {
   const tmp = `${path}.${process.pid}.tmp`;
   writeFileSync(tmp, JSON.stringify(draft, null, 2) + '\n');
   renameSync(tmp, path);
+  if (draft.updatedBy === 'graph' && draft.revision === 1) {
+    recordOutput({ source: 'field-feed', sourceId: basename(folder), kind: 'post', title: draft.event.title, path });
+  }
 }
 
 /** Field uploads are named `20261002T193012Z-<device>-<name>` (capture time, UTC) — same order as the reel. */

package/scripts/fleet/node-setup.sh

@@ -2,7 +2,7 @@
 # 로컬 플릿 노드 셋업 — 원격 맥 한 대를 «Pod 풀 ⊕ 시험 샤딩» 노드로 (MANUAL-local-fleet-node-setup).
 #   bash scripts/fleet/node-setup.sh <호스트> [--check]
 #   <호스트>  ssh 로 닿는 이름(예: node-b · node-c) — 이 맥에서 `ssh -o BatchMode=yes <호스트> true` 가 돼야 한다.
-#   --check  아무것도 바꾸지 않고 상태만 본다(단계마다 ✓ · ✗ · → 할 일).
+#   --check  영구 설정을 바꾸지 않고 상태만 본다(단계마다 ✓ · ✗ · → 할 일). DNS 점검용 Pod 는 잠깐 만들었다 지운다.
 # ⭐ 단계마다 «이미 돼 있으면 건너뛴다» — 몇 번 돌려도 같은 결과(재현 가능한 셋업).
 # ⛔ 원격의 다른 컨테이너·앱은 건드리지 않는다. 이 맥의 ~/.kube/config 는 바꾸기 전에 백업한다.
 set -u
@@ -62,7 +62,7 @@ REGISTRY="${ELANOUS_FLEET_REGISTRY:-elanous-registry}"; REG_PORT="${ELANOUS_FLEE
 # ⛔ 레지스트리는 노드의 «루프백»에만 연다 — 🩸 2026-09-26: `0.0.0.0:5050` 이라 tailnet 의 누구든 인증 없이 목록·푸시가 됐다
 #   (Pod 는 커밋 태그로 pull 하므로 그 태그를 덮으면 곧 공급망 위험). 노드 안 빌드는 localhost 로 푸시하고, 클러스터는 docker 내부 이름으로 받는다.
 REG_BIND="$(R "docker port k3d-$REGISTRY 5000/tcp" 2>/dev/null | head -1)"
-if [ -n "$REG_BIND" ] && [ "${REG_BIND#127.0.0.1:}" != "$REG_BIND" ]; then ok "레지스트리 k3d-$REGISTRY :$REG_PORT (루프백)"
+if [ -n "$REG_BIND" ] && [ "${REG_BIND#127.0.0.1:}" != "$REG_BIND" ]; then REG_PORT="${REG_BIND##*:}"; ok "레지스트리 k3d-$REGISTRY :$REG_PORT (루프백)"
 elif [ -n "$REG_BIND" ] && [ $CHECK = 1 ]; then bad "레지스트리 k3d-$REGISTRY 가 $REG_BIND 에 열려 있다 — 루프백으로 다시 만들어야 한다"
 elif [ -n "$REG_BIND" ]; then R "k3d registry delete $REGISTRY >/dev/null 2>&1; k3d registry create $REGISTRY --port 127.0.0.1:$REG_PORT >/tmp/fleet-registry.log 2>&1 && (docker network connect k3d-$CLUSTER k3d-$REGISTRY 2>/dev/null || true)" && ok "레지스트리 k3d-$REGISTRY 를 루프백으로 다시 만들었다(이미지는 다음 동기화에서 다시 푸시)" || { bad "레지스트리 재생성 실패 — 원격 /tmp/fleet-registry.log"; exit 1; }
 elif [ $CHECK = 1 ]; then todo "레지스트리 k3d-$REGISTRY :$REG_PORT 생성(루프백)"
@@ -157,10 +157,27 @@ apply_base() {
 }
 apply_base
 # 9. 판 대조 — k3s · 노드 준비
+# DNS: coredns Ready 와 격리 네임스페이스 Pod 안에서 서비스 이름 풀이를 각각 확인한다.
+DNS_READY="$(kubectl --context "$CTX" --request-timeout=10s -n kube-system get deployment coredns -o jsonpath='{.status.readyReplicas}/{.spec.replicas}' 2>/dev/null)"
+DNS_NAME="elanous-dns-check-$$"
+if [[ "$DNS_READY" =~ ^[1-9][0-9]*/[1-9][0-9]*$ ]] && [ "${DNS_READY%/*}" = "${DNS_READY#*/}" ]; then
+  DNS_MANIFEST="$(printf '{"apiVersion":"v1","kind":"Pod","metadata":{"name":"%s","namespace":"elanous-test"},"spec":{"restartPolicy":"Never","activeDeadlineSeconds":40,"automountServiceAccountToken":false,"containers":[{"name":"dns","image":"busybox:1.36","command":["nslookup","kubernetes.default.svc.cluster.local"],"resources":{"requests":{"cpu":"10m","memory":"16Mi"},"limits":{"cpu":"100m","memory":"64Mi"}}}]}}' "$DNS_NAME")"
+  if ! printf '%s' "$DNS_MANIFEST" | kubectl --context "$CTX" --request-timeout=10s create -f - >/dev/null 2>&1; then bad "dns 점검 Pod 생성 실패 (DNS 미측정)"
+  else
+    kubectl --context "$CTX" --request-timeout=10s -n elanous-test wait --for=jsonpath='{.status.phase}=Succeeded' "pod/$DNS_NAME" --timeout=30s >/dev/null 2>&1
+    DNS_STATE="$(kubectl --context "$CTX" --request-timeout=10s -n elanous-test get "pod/$DNS_NAME" -o jsonpath='{.status.phase}:{.status.containerStatuses[0].state.waiting.reason}' 2>/dev/null)"
+    DNS_LOG="$(kubectl --context "$CTX" --request-timeout=10s -n elanous-test logs "pod/$DNS_NAME" 2>/dev/null)"
+    if [[ "$DNS_STATE" = Succeeded:* ]] && [[ "$DNS_LOG" =~ Name:[[:space:]]*kubernetes\.default\.svc\.cluster\.local ]] && [[ "$DNS_LOG" =~ Address(es)?':'[[:space:]]*[^[:space:]]+ ]]; then ok "dns (coredns Ready ⊕ Pod 이름 풀이)"
+    elif [[ "$DNS_STATE" = *:ImagePullBackOff || "$DNS_STATE" = *:ErrImagePull || "$DNS_STATE" = *:InvalidImageName ]]; then bad "dns 점검 이미지 확보 실패 (DNS 미측정)"
+    elif [[ "$DNS_STATE" = Failed:* ]] && [[ "$DNS_LOG" =~ (can.t.resolve|server.can.t.find|connection.timed.out|no.servers.could.be.reached|NXDOMAIN|SERVFAIL) ]] || [[ "$DNS_STATE" = Succeeded:* ]]; then bad "dns (Pod 이름 풀이 실패)"
+    else bad "dns 점검 Pod 실행 실패 (DNS 미측정: ${DNS_STATE:-응답 없음})"; fi
+  fi
+else bad "dns (coredns Ready 아님: ${DNS_READY:-응답 없음})"; fi
+kubectl --context "$CTX" --request-timeout=10s -n elanous-test delete "pod/$DNS_NAME" --ignore-not-found=true --wait=false >/dev/null 2>&1
 v="$(kubectl --context "$CTX" --request-timeout=10s get nodes -o jsonpath='{.items[0].status.nodeInfo.kubeletVersion}' 2>/dev/null)"
 want="${K3S_IMAGE##*:}"; want="${want/-k3s/+k3s}"
 [ "$v" = "$want" ] && ok "k3s $v" || bad "k3s ${v:-응답 없음} ≠ 기대 $want"
 echo
 if [ $FAIL = 0 ] && [ $TODO -gt 0 ]; then echo "→ $HOST 할 일 $TODO — --check 없이 다시 돌리면 채운다"; exit 2
-elif [ $FAIL = 0 ]; then echo "✓ $HOST 준비됨 — 풀에 넣기: ELANOUS_POD_POOL='…,$CTX@$HOST:<상한>'"; else echo "✗ $HOST 미완 — 위 ✗ 를 먼저"; fi
+elif [ $FAIL = 0 ]; then echo "✓ $HOST 준비됨 — 풀에 넣기: ELANOUS_POD_POOL='…,$CTX@$HOST:<상한>#k3d-$REGISTRY:$REG_PORT'"; else echo "✗ $HOST 미완 — 위 ✗ 를 먼저"; fi
 exit $FAIL

package/scripts/homebrew-formula-bump.ts

@@ -0,0 +1,69 @@
+#!/usr/bin/env bun
+import { createHash, randomUUID } from 'node:crypto';
+import { readFile, stat, writeFile, chmod, rename, unlink } from 'node:fs/promises';
+import { dirname, join, resolve } from 'node:path';
+import { debug } from '../src/debug/log.js';
+
+const usage = 'usage: bun scripts/homebrew-formula-bump.ts --version <v> [--tarball <local tgz>] [--formula <path>] [--dry-run]';
+const urlLine = /^([ \t]*url "https:\/\/registry\.npmjs\.org\/elanous\/-\/elanous-)(\d+\.\d+\.\d+)(\.tgz"[ \t]*)(?=\r?$)/gm;
+const shaLine = /^([ \t]*sha256 ")[0-9a-f]{64}("[ \t]*)(?=\r?$)/gm;
+let from: string | undefined;
+
+async function main(): Promise<void> {
+  const args = process.argv.slice(2);
+  const options: Record<string, string> = {};
+  for (let i = 0; i < args.length; i++) {
+    const flag = args[i]!;
+    if (flag === '--dry-run' && !Object.hasOwn(options, flag)) { options[flag] = 'true'; continue; }
+    if (!['--version', '--tarball', '--formula'].includes(flag) || Object.hasOwn(options, flag) || !args[i + 1] || args[i + 1]!.startsWith('--')) throw new Error(usage);
+    options[flag] = args[++i]!;
+  }
+  const version = options['--version'];
+  if (!version || !/^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/.test(version)) throw new Error(usage);
+  const formulaPath = resolve(options['--formula'] ?? join(import.meta.dir, '..', 'integrations', 'homebrew', 'elanous.rb'));
+  const original = await readFile(formulaPath, 'utf8');
+  const urls = [...original.matchAll(urlLine)];
+  const hashes = [...original.matchAll(shaLine)];
+  from = urls.length === 1 ? urls[0]![2] : undefined;
+  if (urls.length !== 1 || hashes.length !== 1) throw new Error('formula must contain exactly one npm url and one sha256 line');
+  const source = options['--tarball'] ? 'tarball' : 'npm';
+  const bytes = options['--tarball']
+    ? await readFile(options['--tarball'])
+    : await (async () => {
+        const response = await fetch(`https://registry.npmjs.org/elanous/-/elanous-${version}.tgz`);
+        if (!response.ok) throw new Error(`npm tarball download failed: HTTP ${response.status}`);
+        return Buffer.from(await response.arrayBuffer());
+      })();
+  const sha = createHash('sha256').update(bytes).digest('hex');
+  const nextUrl = `${urls[0]![1]}${version}${urls[0]![3]}`;
+  const nextSha = `${hashes[0]![1]}${sha}${hashes[0]![2]}`;
+  const updated = original.replace(urlLine, () => nextUrl).replace(shaLine, () => nextSha);
+  if (options['--dry-run']) {
+    console.log(nextUrl);
+    console.log(nextSha);
+  } else {
+    const temporary = join(dirname(formulaPath), `.elanous.rb.${randomUUID()}.tmp`);
+    try {
+      await writeFile(temporary, updated);
+      await chmod(temporary, (await stat(formulaPath)).mode);
+      await rename(temporary, formulaPath);
+    } finally {
+      await unlink(temporary).catch((error: NodeJS.ErrnoException) => { if (error.code !== 'ENOENT') throw error; });
+    }
+  }
+  debug.log('release.homebrew', 'bumped', { from, to: version, source, reason: options['--dry-run'] ? 'dry-run' : 'updated' });
+  console.log(`formula: ${from} → ${version} · sha256 ${sha.slice(0, 12)}`);
+}
+
+main().catch((error: unknown) => {
+  const reason = (error instanceof Error ? error.message : String(error)).replace(/\s+/g, ' ');
+  const args = process.argv.slice(2);
+  debug.log('release.homebrew', 'failed', {
+    from,
+    to: args.includes('--version') ? args[args.indexOf('--version') + 1] : undefined,
+    source: args.includes('--tarball') ? 'tarball' : 'npm',
+    reason,
+  });
+  console.error(reason);
+  process.exitCode = 1;
+});

package/scripts/lib/telegram-inject-args.ts

@@ -0,0 +1,31 @@
+import { existsSync } from 'node:fs';
+
+export function parseInjectArgs(
+  argv: string[],
+  env: { TELEGRAM_TEST_BOT?: string | undefined },
+): { to: string; text?: string; photos: string[]; caption?: string } {
+  const value = (flag: string): string | undefined => {
+    const index = argv.indexOf(flag);
+    if (index < 0) return undefined;
+    const next = argv[index + 1];
+    if (!next || next.startsWith('--')) throw new Error(`옵션 값 없음: ${flag}`);
+    return next;
+  };
+  const to = value('--to') ?? env.TELEGRAM_TEST_BOT;
+  const text = value('--text');
+  const photos: string[] = [];
+  for (let i = 0; i < argv.length; i++) {
+    if (argv[i] !== '--photo') continue;
+    const photo = argv[++i];
+    if (!photo || photo.startsWith('--') || !existsSync(photo)) {
+      throw new Error(`사진 파일 경로 없음: ${photo ?? '(미지정)'}`);
+    }
+    photos.push(photo);
+  }
+  if (!to || (!text && photos.length === 0)) {
+    throw new Error('사용: telegram-inject.ts --to @monad_test_bot --text "<objective>"');
+  }
+  return photos.length > 0
+    ? { to, photos, ...(text !== undefined ? { caption: text } : {}) }
+    : { to, text, photos };
+}

package/scripts/marketing/measure-site-numbers.ts

@@ -0,0 +1,169 @@
+import { execFileSync } from 'node:child_process';
+import { closeSync, lstatSync, openSync, readSync } from 'node:fs';
+import { basename, sep } from 'node:path';
+
+const COMMANDS = {
+  lines: 'git ls-files -z',
+  prs: 'gh pr list --state merged --limit 100000 --json number',
+  months: 'git log --reverse --format=%cs | head -1',
+} as const;
+
+const UNMEASURED = '못 잼' as const;
+type Metric = number | typeof UNMEASURED;
+
+interface SiteNumberRow {
+  value: Metric;
+  command: string;
+  denominator: string;
+  candidate: string;
+  error?: string;
+}
+
+interface SiteNumbers {
+  measuredAtKst: string;
+  lines: SiteNumberRow;
+  prs: SiteNumberRow;
+  months: SiteNumberRow;
+}
+
+function command(binary: string, args: string[], cwd: string): Buffer {
+  return execFileSync(binary, args, { cwd, maxBuffer: 64 * 1024 * 1024, stdio: ['ignore', 'pipe', 'pipe'] });
+}
+
+export function siteNumberCandidate(value: number, kind: 'lines' | 'prs' | 'months'): string {
+  if (!Number.isSafeInteger(value) || value < 0) throw new Error('invalid measurement');
+  if (kind === 'months') return value >= 1 ? `${value}개월+` : '큰 수 후보 없음';
+  if (kind === 'lines' && value >= 1_000_000) return `${Math.floor(value / 100_000) * 10}만+`;
+  return value >= 10_000 ? `${Math.floor(value / 10_000)}만+` : '큰 수 후보 없음';
+}
+
+export function completedMonths(firstDay: string, todayKst: string): number {
+  if (!/^\d{4}-\d{2}-\d{2}$/.test(firstDay) || !/^\d{4}-\d{2}-\d{2}$/.test(todayKst)
+    || !Number.isFinite(Date.parse(`${firstDay}T00:00:00Z`)) || !Number.isFinite(Date.parse(`${todayKst}T00:00:00Z`))) {
+    throw new Error('invalid commit or measurement date');
+  }
+  const [year, month, day] = firstDay.split('-').map(Number);
+  const [nowYear, nowMonth, nowDay] = todayKst.split('-').map(Number);
+  const months = (nowYear - year) * 12 + nowMonth - month - Number(nowDay < day);
+  if (months < 0) throw new Error('first commit is after measurement day');
+  return months;
+}
+
+function trackedTextLines(cwd: string): { lines: number; included: number; excluded: number } {
+  const paths = command('git', ['ls-files', '-z'], cwd).toString('utf8').split('\0').filter(Boolean);
+  let lines = 0;
+  let included = 0;
+  let excluded = 0;
+  const chunk = Buffer.allocUnsafe(64 * 1024);
+  for (const path of paths) {
+    const name = basename(path);
+    if (path.split(/[\\/]/).includes('node_modules') || name.endsWith('.lock')
+      || ['package-lock.json', 'npm-shrinkwrap.json', 'pnpm-lock.yaml', 'yarn.lock', 'Pipfile.lock'].includes(name)) {
+      excluded++;
+      continue;
+    }
+    const fullPath = `${cwd}${sep}${path}`;
+    try {
+      if (!lstatSync(fullPath).isFile()) { excluded++; continue; }
+      const fd = openSync(fullPath, 'r');
+      let fileLines = 0;
+      let lastByte: number | undefined;
+      let binary = false;
+      const decoder = new TextDecoder('utf-8', { fatal: true });
+      try {
+        let n: number;
+        while ((n = readSync(fd, chunk, 0, chunk.length, null)) > 0) {
+          for (let i = 0; i < n; i++) {
+            const byte = chunk[i];
+            if (byte === 0 || (byte < 32 && byte !== 9 && byte !== 10 && byte !== 13 && byte !== 12 && byte !== 27)) {
+              binary = true;
+              break;
+            }
+            if (byte === 10) fileLines++;
+          }
+          if (binary) break;
+          lastByte = chunk[n - 1];
+          try { decoder.decode(chunk.subarray(0, n), { stream: true }); }
+          catch { binary = true; break; }
+        }
+        if (!binary) {
+          try { decoder.decode(); } catch { binary = true; }
+        }
+      } finally { closeSync(fd); }
+      if (binary) excluded++;
+      else { lines += fileLines + Number(lastByte !== undefined && lastByte !== 10); included++; }
+    } catch (error) {
+      throw new Error(`tracked file cannot be read: ${path}`, { cause: error });
+    }
+  }
+  return { lines, included, excluded };
+}
+
+function measured(value: number, commandText: string, denominator: string, kind: 'lines' | 'prs' | 'months'): SiteNumberRow {
+  const candidate = siteNumberCandidate(value, kind);
+  const unit = kind === 'lines' ? '줄' : 'PR';
+  return { value, command: commandText, denominator,
+    candidate: candidate === '큰 수 후보 없음' || kind === 'months' ? candidate : `${candidate} ${unit}` };
+}
+
+function unavailable(commandText: string, denominator: string, error: unknown): SiteNumberRow {
+  return { value: UNMEASURED, command: commandText, denominator, candidate: UNMEASURED,
+    error: error instanceof Error ? error.message : String(error) };
+}
+
+export function measureSiteNumbers(options: { cwd: string; now?: Date; ghCommand?: string }): SiteNumbers {
+  const { cwd, now = new Date(), ghCommand = 'gh' } = options;
+  const measuredAtKst = new Intl.DateTimeFormat('sv-SE', {
+    timeZone: 'Asia/Seoul', year: 'numeric', month: '2-digit', day: '2-digit',
+    hour: '2-digit', minute: '2-digit', second: '2-digit', hourCycle: 'h23',
+  }).format(now).replace(' ', 'T') + '+09:00';
+  const todayKst = measuredAtKst.slice(0, 10);
+  let lines: SiteNumberRow;
+  try {
+    const result = trackedTextLines(cwd);
+    lines = measured(result.lines, COMMANDS.lines,
+      `git ls-files 추적 파일 ${result.included + result.excluded}개 중 UTF-8 일반 텍스트 ${result.included}개; 제외 ${result.excluded}개 (바이너리/제어 바이트·node_modules·잠금 파일·심볼릭 링크); 각 파일의 LF 개수 + 마지막 개행 없는 비어 있지 않은 파일의 마지막 줄`, 'lines');
+  } catch (error) {
+    lines = unavailable(COMMANDS.lines, 'git ls-files 추적 UTF-8 일반 텍스트 파일; 바이너리·node_modules·잠금 파일·심볼릭 링크 제외; LF 개수 + 마지막 개행 없는 비어 있지 않은 파일의 마지막 줄', error);
+  }
+  let prs: SiteNumberRow;
+  const prDenominator = '현재 저장소에서 gh가 반환한 병합 PR 목록 (상한 100000개; 제작 주체 미분류)';
+  try {
+    const list: unknown = JSON.parse(command(ghCommand, ['pr', 'list', '--state', 'merged', '--limit', '100000', '--json', 'number'], cwd).toString('utf8'));
+    if (!Array.isArray(list) || !list.every(item => item !== null && typeof item === 'object' && Number.isSafeInteger(item.number))) {
+      throw new Error('invalid gh PR response');
+    }
+    prs = measured(list.length, COMMANDS.prs, prDenominator, 'prs');
+  } catch (error) {
+    prs = unavailable(COMMANDS.prs, prDenominator, error);
+  }
+  let months: SiteNumberRow;
+  try {
+    const firstDay = command('git', ['log', '--reverse', '--format=%cs'], cwd).toString('utf8').split('\n')[0];
+    if (!firstDay) throw new Error('no commits');
+    months = measured(completedMonths(firstDay, todayKst), COMMANDS.months,
+      `첫 커밋 날짜 ${firstDay}부터 KST 오늘 ${todayKst}까지 완료된 달력 개월 (일 미도달이면 1개월 차감)`, 'months');
+  } catch (error) {
+    months = unavailable(COMMANDS.months, `첫 커밋 날짜부터 KST 오늘 ${todayKst}까지 완료된 달력 개월`, error);
+  }
+  return { measuredAtKst, lines, prs, months };
+}
+
+if (import.meta.main) {
+  const args = process.argv.slice(2);
+  if (args.some(arg => arg !== '--json') || args.length > 1) {
+    console.error('Usage: bun scripts/marketing/measure-site-numbers.ts [--json]');
+    process.exitCode = 2;
+  } else {
+    const result = measureSiteNumbers({ cwd: process.cwd() });
+    if (args.includes('--json')) console.log(JSON.stringify(result, null, 2));
+    else {
+      console.log(`잰 시각: ${result.measuredAtKst} (KST)`);
+      for (const [label, row] of [['줄 수', result.lines], ['병합 PR', result.prs], ['기간', result.months]] as const) {
+        console.log(`${label}: ${row.value} · 후보 ${row.candidate}`);
+        console.log(`  명령: ${row.command}\n  분모: ${row.denominator}`);
+        if (row.error) console.log(`  못 잰 이유: ${row.error}`);
+      }
+    }
+  }
+}