elanous 0.2.10 → 0.2.12

package/src/agent-mission/review-loop.ts

@@ -11,6 +11,7 @@ import { runGitCommand } from '../git-fs/runner.js';
 import * as llm from '../llm.js';
 import type { LLMMessage } from '../llm.js';
 import { debug } from '../debug/log.js';
+import { releasePathHold, releasePathHoldShouldPost, releasePathHoldComment, releasePathHoldCommentsArgs, releasePrFilePaths, RELEASE_PATH_LABEL } from '../self-dev/release-path-guard.js';
 import { runAgentMission, resolveBackend, type AgentMissionResult, type EvidenceMode } from './driver.js';
 import { judgeWithAcp, prepareJudgeDiff } from './acp-judge.js';
 import { verifyMergeAndMaybeRevert } from './merge-safety.js';
@@ -114,6 +115,31 @@ function gh(args: string[]): string {
   return execFileSync('gh', args, { encoding: 'utf8', timeout: 60000, maxBuffer: 20 * 1024 * 1024, env: process.env });
 }
 
+/** Check every page of the PR file list immediately before an unattended review-loop merge. */
+function holdReleasePathBeforeReviewMerge(pr: string, runGh: (args: string[]) => string): boolean {
+  let paths: string[];
+  try {
+    paths = releasePrFilePaths(JSON.parse(runGh(['api', '--paginate', '--slurp', '--method', 'GET', '-f', 'per_page=100', `repos/{owner}/{repo}/pulls/${pr}/files`])));
+  } catch (error) {
+    debug.log('self-dev.merge', 'release-path-inspection-failed', { pr, error: String(error) });
+    return true;
+  }
+  const path = releasePathHold(paths);
+  if (!path) return false;
+  debug.log('self-dev.merge', 'release-path-hold', { pr, path, label: RELEASE_PATH_LABEL, surface: 'review-loop' });
+  try {
+    const names: unknown = JSON.parse(runGh(['label', 'list', '--search', RELEASE_PATH_LABEL, '--json', 'name']));
+    if (!Array.isArray(names)) throw new Error('invalid label list');
+    if (!names.some((item: unknown) => !!item && typeof item === 'object' && 'name' in item && item.name === RELEASE_PATH_LABEL)) {
+      runGh(['label', 'create', RELEASE_PATH_LABEL, '--color', 'D93F0B', '--description', 'Release path requires OP approval']);
+    }
+    runGh(['pr', 'edit', pr, '--add-label', RELEASE_PATH_LABEL]);
+  } catch (error) { debug.log('self-dev.merge', 'release-path-annotation-failed', { pr, action: 'label', error: String(error) }); }
+  try { if (releasePathHoldShouldPost(() => JSON.parse(runGh(releasePathHoldCommentsArgs(pr))))) runGh(['pr', 'comment', pr, '--body', releasePathHoldComment(path)]); }
+  catch (error) { debug.log('self-dev.merge', 'release-path-annotation-failed', { pr, action: 'comment', error: String(error) }); }
+  return true;
+}
+
 /** ★ G10 안전봉투 — 자율머지 직후 회귀검증(verifyMerge 시). 회귀면 revert PR 이 이미 생성됨(알림 포함) →
  *  원 PR 에 링크 코멘트만. fail-open(검증 오류는 머지를 막지 않음). */
 async function runMergeSafety(pr: string, opts: ReviewLoopOpts, depth: ReviewDepth): Promise<void> {
@@ -233,6 +259,7 @@ export async function judgeAndFinalize(
 
   if (j.verdict === 'merge') {
     if (opts.autoMerge) {
+      if (holdReleasePathBeforeReviewMerge(pr, runGh)) return { pr, branch, verdict: 'reinforce', asks, action: 'parked', reworkOk: true, pushed: lastPushed, rounds: round, detail: 'OP approval required: release-path hold or PR file inspection unavailable' };
       const approve = opts.approve ?? approvePr;
       const recordReviewOutcome = opts.recordReviewOutcome ?? recordOutcome;
       approve(pr, `2차 ACP 최종심판 MERGE (round ${round})`);
@@ -480,6 +507,9 @@ export async function runReviewLoop(pr: string, opts: ReviewLoopOpts = {}): Prom
   if (cls.verdict === 'ok') {
     // light: 1차 clean 으로 충분 → approve + 머지. heavy: 1차 ok 여도 2차 심판 머스트.
     if (!effectiveFinalJudge) {
+      if ((opts.autoMergeOnOk || opts.autoMerge) && holdReleasePathBeforeReviewMerge(pr, runGh)) {
+        return { pr, branch, verdict: 'ok', asks: [], action: 'parked', detail: 'OP approval required: release-path hold or PR file inspection unavailable' };
+      }
       approve(pr, `소작업(light)·1차 리뷰 clean`);
       let merged = false;
       if (opts.autoMergeOnOk || opts.autoMerge) {

package/src/autopilot/build/llm-conflict-merge.ts

@@ -9,6 +9,17 @@ import { join } from 'node:path';
 import { readFileSync, writeFileSync } from 'node:fs';
 import { runGitCommand } from '../../git-fs/runner.js';
 import { countTestDeclarations } from '../../self-implement/test-declarations.js';
+import { NEXT_MD_PATH, resolveNextMdConflict } from '../../release-loop/next-md-merge.js';
+
+function deterministicNextMd(git: MergeGitSeam, worktreePath: string, file: string): string | null {
+  try {
+    const resolved = resolveNextMdConflict(git.readIndexStage(worktreePath, 1, file), git.readIndexStage(worktreePath, 2, file), git.readIndexStage(worktreePath, 3, file));
+    void import('../../debug/log.js').then(({ debug }) => debug.log('self-dev.merge', 'next-md-deterministic', { resolved: resolved !== null })).catch(() => {});
+    return resolved;
+  } catch {
+    return null; // a stage is missing (added/deleted on one side) — the usual resolver decides
+  }
+}
 
 /** 충돌 마커가 남아있나(LLM 이 해결 못 함 판별). ours/base/theirs 3-way 마커 모두. 순수. */
 export function hasConflictMarkers(s: string): boolean {
@@ -130,8 +141,8 @@ export interface MergeGitSeam {
   merge: (wt: string, mergeTarget: string) => { ok: boolean; conflict: boolean; stdout: string; errorDetail?: string };
   /** 충돌(unmerged) 파일 목록(worktree 상대 경로). */
   conflictedFiles: (wt: string) => string[];
-  /** Reads an unmerged index stage (2=ours, 3=theirs) for a conflicted file. */
-  readIndexStage: (wt: string, stage: 2 | 3, file: string) => string;
+  /** Reads an unmerged index stage (1=base, 2=ours, 3=theirs) for a conflicted file. */
+  readIndexStage: (wt: string, stage: 1 | 2 | 3, file: string) => string;
   readFile: (absPath: string) => string;
   writeFile: (absPath: string, content: string) => void;
   /** 해결된 파일 스테이징. */
@@ -193,7 +204,9 @@ export async function mergeMainWithLlmResolve(
     let merged: string;
     try {
       conflicted = git.readFile(abs);
-      merged = await resolve(f, conflicted);
+      // release/next.md: concurrent landings each append a line — keep both without asking the LLM (REL7c).
+      const deterministic = f === NEXT_MD_PATH ? deterministicNextMd(git, worktreePath, f) : null;
+      merged = deterministic ?? await resolve(f, conflicted);
     } catch {
       git.abort(worktreePath); // LLM 예외 → base 유지
       return measuredOutcome({ status: 'conflict-unresolved', resolvedFiles });

package/src/autopilot/pty-control-loop.ts

@@ -88,7 +88,7 @@ export type ControlDecision =
   | { readonly action: 'handoff'; readonly to: 'codex' | 'claude' | 'elanous'; readonly mission: string; readonly carry?: 'diff' | 'summary' }
   | { readonly action: 'ask-human'; readonly reason: string; readonly url?: string; readonly code?: string }
   /** `no-progress` reports observed lack of progress without claiming completion. */
-  | { readonly action: 'no-progress'; readonly reason: string };
+  | { readonly action: 'no-progress'; readonly reason: string; readonly terminal?: boolean };
 
 export interface RunSupervisor {
   /** run supervisor의 관측 → 다음 행동. 동기/비동기 모두 허용(LLM 은 async). `signal` 이 abort 되면(사람 takeover
@@ -664,6 +664,9 @@ export async function runPtyControlLoop(
           previousIntervention = { ...intervention, sameScreenCount: 1 };
         }
       } else if (decision.action === 'wait' || decision.action === 'no-progress') {
+        if (decision.action === 'no-progress' && decision.terminal) {
+          return finish({ kind: 'stuck', iteration: step, reason: decision.reason }, step, intervention, true);
+        }
         // wait/no-progress — 종료된 자식은 새 출력을 낼 수 없으므로 대기 없이 즉시 수렴한다.
         if (deps.isAlive?.() === false) {
           debug.log('autopilot.control', 'child-exited', { step });

package/src/autopilot/tool-registry.ts

@@ -266,4 +266,6 @@ export const AUTOPILOT_TOOL_IDS = [
   'memory_recall',
   'ops_status',
   'self_recall',
+  // CTX2 #23185 — 맥락 한 문(READ-ONLY 자기관측 원장에 더해졌다).
+  'context_now',
 ] as const;

package/src/boot/daemon-prompt-turn.ts

@@ -116,6 +116,8 @@ export async function runDaemonPromptTurn(opts: {
    *  `--tool-cwd` / `ELANOUS_TOOL_CWD` to keep `/v1/prompt` and ACP WS
    *  on the same path-guard boundary. */
   toolCwd?: string;
+  /** Per-turn project instructions; unlike the base system preamble these must survive subsequent turns. */
+  projectInstructions?: string;
   /** Phase 4 (WT-A-3b) — external abort signal. When provided and
    *  fired, the internal AbortController fans the abort through to
    *  `runCoreTurn` (LLM stream + tool dispatch). Callers without an
@@ -286,6 +288,9 @@ export async function runDaemonPromptTurn(opts: {
   if (fast && !isFirstTurn) {
     messages.unshift({ role: 'system', content: fastPathGuidance });
   }
+  if (!isFirstTurn && opts.projectInstructions) {
+    messages.unshift({ role: 'system', content: opts.projectInstructions });
+  }
   const result = await runCoreTurn({
     sessionId: request.sessionId,
     userText: request.userText,

package/src/boot/daemon-runtime.ts

@@ -53,6 +53,7 @@ import {
 import type { CoreTurnDispatchTool } from '../core-turn/index.js';
 import { elanousSelfAccessPrompt } from '../agent/self-ambient.js';
 import { createToolCwdResolver, type ToolCwdResolver } from './tool-cwd.js';
+import { resolveSessionProjectContext } from '../project/session-context.js';
 import { debug } from '../debug/log.js';
 
 /** C4 (2026-07-12) — arm the non-detached-PTY kill ONCE per turn signal.
@@ -579,7 +580,9 @@ export function createDaemonRunTurn(
     // moved this out of an inline closure to fix the user-message
     // persistence bug uniformly across all daemon paths.
     getMessages: ({ sessionId, userText, promptBlocks, promptMeta }) => {
-      const baseSystemPrompt = composeDaemonSystemPrompt(opts.systemPrompt, promptMeta, sessionId);
+      const projectInstructions = resolveSessionProjectContext(sessionId)?.instructions;
+      const baseSystemPrompt = [composeDaemonSystemPrompt(opts.systemPrompt, promptMeta, sessionId), projectInstructions]
+        .filter(Boolean).join('\n\n');
       // Image-pipeline followup #4 (2026-05-05) — append daemon webterm
       // context (current ACP sessionId + active terminal summary) to
       // the system prompt when the webterm surface is active. Helper
@@ -720,8 +723,11 @@ export function createDaemonRunTurn(
         });
         debugBridge.activate();
       }
-      if (opts.acpSessionCwd) {
-        const resolver = createToolCwdResolver({ tools: opts.tools ?? 'none', toolCwd: turnCtx.cwd });
+      const projectCwd = resolveSessionProjectContext(turnCtx.sessionId)?.cwd;
+      if (projectCwd || opts.acpSessionCwd) {
+        // An ACP session's explicit cwd wins; the project folder is only the default when none was given (IA3 review).
+        const explicitCwd = opts.acpSessionCwd && turnCtx.cwd ? turnCtx.cwd : undefined;
+        const resolver = createToolCwdResolver({ tools: opts.tools ?? 'none', toolCwd: explicitCwd ?? projectCwd ?? turnCtx.cwd });
         await turnToolCwd.run(resolver, () => inner(turnCtx));
       } else {
         await inner(turnCtx);

package/src/boot/daemon-tools/web-search.ts

@@ -23,6 +23,8 @@ export interface DaemonWebSearchArgs {
 export interface DaemonWebSearchResult {
   query: string;
   providerName: string;
+  /** Absent for ordinary searches; signals whether X sources were actually cited. */
+  xSearch?: 'grok' | 'unavailable';
   hits: Array<{
     url: string;
     title: string;
@@ -90,6 +92,7 @@ export async function dispatchWebSearch(
     return {
       query,
       providerName: result.providerName,
+      ...(result.xSearch ? { xSearch: result.xSearch } : {}),
       hits: result.hits.map((h) => ({
         url: h.url,
         title: h.title,

package/src/card-followup/core.ts

@@ -0,0 +1,109 @@
+import { chmodSync, mkdirSync, readFileSync, readdirSync } from 'node:fs';
+import { randomUUID } from 'node:crypto';
+import { join, resolve } from 'node:path';
+import { effectiveInstanceRoot } from '../instance/resolve.js';
+import { lastJsonObject, runGraph as defaultRunGraph, type GraphRunState } from '../graph-runner/runner.js';
+
+const GRAPH = resolve(import.meta.dir, '../../plugins/card-followup/graphs/card-followup.yaml');
+export type CardDetectDecision = 'card' | 'skip' | 'ambiguous';
+
+export function cardShape(width?: number, height?: number): { decision: 'skip' | 'pass'; signal: string } {
+  if (!width || !height) return { decision: 'pass', signal: 'ratio:unknown' };
+  const ratio = Math.max(width, height) / Math.min(width, height);
+  if (ratio < 1.15) return { decision: 'skip', signal: 'ratio:square' };
+  if (ratio > 2.0) return { decision: 'skip', signal: 'ratio:screenshot' };
+  return { decision: 'pass', signal: `ratio:${ratio.toFixed(2)}` };
+}
+const EMAIL = /[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}/i;
+const PHONE = /(?:\+?\d{1,3}[\s.-]?)?\(?\d{2,4}\)?[\s.-]?\d{3,4}[\s.-]?\d{4}/;
+const WEB = /\b(?:https?:\/\/|www\.)\S+|\b[a-z0-9-]+\.(?:com|co\.kr|kr|io|ai|net|org)\b/i;
+const TITLE = /대표|이사|팀장|부장|과장|실장|매니저|주식회사|\(주\)|\b(?:CEO|CTO|COO|CFO|Director|Manager|Founder|Inc|Ltd|Corp)\b/i;
+export function cardText(ocr: string | null): { decision: CardDetectDecision; signal: string } {
+  if (ocr === null) return { decision: 'ambiguous', signal: 'ocr:unavailable' };
+  const chars = ocr.replace(/\s+/g, '').length;
+  if (chars < 15) return { decision: 'ambiguous', signal: 'ocr:chars<15' };
+  if (chars > 700) return { decision: 'skip', signal: 'ocr:document' };
+  const hits = ([['email', EMAIL], ['phone', PHONE], ['web', WEB], ['title', TITLE]] as const).filter(([, re]) => re.test(ocr)).map(([name]) => name);
+  const signal = `ocr:${hits.join(',') || 'none'}`;
+  if (hits.length >= 2) return { decision: 'card', signal };
+  return { decision: hits.length === 0 ? 'skip' : 'ambiguous', signal };
+}
+export function detectCard({ width, height, ocrText }: { width?: number; height?: number; ocrText: string | null }): { decision: CardDetectDecision; signal: string } {
+  const shape = cardShape(width, height);
+  return shape.decision === 'skip' ? { decision: 'skip', signal: shape.signal } : cardText(ocrText);
+}
+
+const obj = (value: unknown): Record<string, unknown> => value !== null && typeof value === 'object' && !Array.isArray(value) ? value as Record<string, unknown> : {};
+const text = (value: unknown): string => typeof value === 'string' ? value.trim() : '';
+const line = (value: unknown): string => (typeof value === 'number' && Number.isFinite(value) ? String(value) : text(value)).replace(/[\r\n]+/g, ' ') || '—';
+
+export class NotACardError extends Error {}
+function isNotACard(state: GraphRunState): boolean {
+  if (state.status !== 'failed') return false;
+  const read = state.nodes.find((node) => node.nodeId === 'read-card');
+  if (!read || !read.ok) return false;
+  const output = lastJsonObject(read.output);
+  if (output?.outcome === 'ok' && output.card && typeof output.card === 'object') {
+    const card = obj(output.card);
+    return !['name', 'company', 'title', 'email', 'phone', 'url', 'linkedin'].some((field) => text(card[field]));
+  }
+  return output?.outcome === 'fail' && typeof output.reason === 'string'
+    && /\bnot a (?:business )?card\b|명함이?\s*아님|명함이?\s*아닙니다/i.test(output.reason);
+}
+function validateReport(report: Record<string, unknown>): void {
+  const card = obj(report.card), fit = obj(report.fit), approach = obj(report.approach);
+  const next = obj(report.nextAction), draft = obj(report.draft);
+  const score = fit.score;
+  if (report.sent !== false || !text(card.name) || !text(card.company)
+    || !(score === null || (typeof score === 'number' && Number.isFinite(score)))
+    || !text(fit.label) || !text(approach.problem) || !text(approach.proposal)
+    || !text(approach.channel) || !text(next.what) || !text(next.due)
+    || !text(draft.subject) || !text(draft.body)) {
+    throw new Error('incomplete or sent card report');
+  }
+}
+
+export async function runCardFollowup({ imagePath, ocrText, runGraph = defaultRunGraph, rootDir = effectiveInstanceRoot(), outDir, runId = randomUUID(), context }: {
+  imagePath: string;
+  ocrText: string | null;
+  runGraph?: typeof defaultRunGraph;
+  rootDir?: string;
+  outDir?: string;
+  runId?: string;
+  context?: string;
+}): Promise<{ replies: [string, string, string]; followupPath?: string }> {
+  if (ocrText !== null && cardText(ocrText).decision !== 'card') throw new NotACardError('not a card');
+  const base = join(rootDir, 'graph-runs', 'card-followup');
+  const dir = outDir ?? join(base, runId);
+  mkdirSync(dir, { recursive: true, mode: 0o700 });
+  chmodSync(base, 0o700);
+  chmodSync(dir, 0o700);
+  const statePath = join(base, `${runId}.json`);
+  const sealState = () => {
+    try { chmodSync(statePath, 0o600); } catch { /* runner may not have written state */ }
+    const contexts = `${statePath}.contexts`;
+    try {
+      chmodSync(contexts, 0o700);
+      for (const file of readdirSync(contexts)) chmodSync(join(contexts, file), 0o600);
+    } catch { /* no contexts yet */ }
+  };
+  try {
+    const state = await runGraph(GRAPH, { runId, deps: { root: rootDir }, input: {
+      image: imagePath, outDir: dir, ...(context ? { context } : {}),
+    } });
+    if (isNotACard(state)) throw new NotACardError('not a card');
+    if (state.status !== 'done') throw new Error('graph did not finish');
+    const report = obj(JSON.parse(readFileSync(join(dir, 'followup.json'), 'utf8')));
+    validateReport(report);
+    const card = obj(report.card), fit = obj(report.fit), approach = obj(report.approach);
+    const next = obj(report.nextAction), draft = obj(report.draft);
+    const summary = `① 요약\n${line(card.name)} · ${line(card.company)} · ${line(card.title)}\n타겟 판정: ${line(fit.score)} · ${line(fit.label)}`;
+    const strategy = `② 전략\n${[approach.problem, approach.proposal, approach.channel].map(line).join('\n')}\n다음 행동: ${line(next.what)} · ${line(next.due)}`;
+    const mail = `③ 팔로업 초안 (보내지 않았습니다)\n제목: ${line(draft.subject)}\n${text(draft.body)}`;
+    const followupPath = join(dir, 'followup.md');
+    readFileSync(followupPath);
+    return { replies: [summary, strategy, mail], followupPath };
+  } finally {
+    if (runGraph === defaultRunGraph) sealState();
+  }
+}

package/src/chat/index.ts

@@ -437,6 +437,8 @@ export const SLASH_COMMANDS: SlashCommand[] = [
   { name: 'model',     aliases: ['m'],           description: '모델 바꾸기 — /model <codex|terra|sol|luna|opus|sonnet|grok> (list + current when no arg). OpenAI 는 Codex(Responses API)만. effort 는 /reasoning.', subcommands: ['codex', 'terra', 'sol', 'luna', 'opus', 'sonnet', 'grok'] },
   { name: 'clear', aliases: ['cls'],       description: '대화 기록 지우기' },
   { name: 'status', aliases: ['st'], description: '지금 상태 — 모델 · 연결 · 계정' },
+  { name: 'now', aliases: [], description: '현재 맥락과 출처 표 — /now [주제]' },
+  { name: 'wish', aliases: [], description: '소원을 카드로 남기기 — /wish <소원 한 줄>' },
   { name: 'remaining', aliases: [], description: '계정별 남은 사용량' },
   { name: 'setup', aliases: [], description: '상세 설정 — /setup · /setup reset(다음 실행 때 마법사 다시)', subcommands: ['help', 'reset'] },
   { name: 'quit',  aliases: ['q', 'exit'], description: '나가기' },

package/src/cli/drive-input-jail.ts

@@ -0,0 +1,101 @@
+import { realpathSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, isAbsolute, relative, sep } from 'node:path';
+
+export type DriveInputJailVerdict =
+  | { readonly allowed: true }
+  | { readonly allowed: false; readonly reason: 'outside-jail'; readonly path: string };
+
+/** Resolve each existing component before applying the next '..', including write targets. */
+function canonicalPath(path: string): string {
+  let current = isAbsolute(path) ? sep : realpathSync(process.cwd());
+  for (const part of path.split(sep)) {
+    if (!part || part === '.') continue;
+    if (part === '..') {
+      current = dirname(current);
+      continue;
+    }
+    const next = `${current === sep ? '' : current}${sep}${part}`;
+    try {
+      current = realpathSync(next);
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error;
+      current = next;
+    }
+  }
+  return current;
+}
+
+function insideJail(boundary: string, candidate: string): boolean {
+  const rel = relative(boundary, candidate);
+  return rel !== '..' && !rel.startsWith(`..${sep}`) && !isAbsolute(rel);
+}
+
+/**
+ * Check path literals in brain-generated PTY text without executing or rewriting the text.
+ * Absolute paths and home paths (~ and ~/) are checked against the canonical jail, including symlink
+ * ancestors. This is a path-literal guard, not a shell interpreter or a sandbox for the child.
+ */
+export function checkDriveInputJail(input: string, boundary: string, home: string = homedir()): DriveInputJailVerdict {
+  const jail = canonicalPath(boundary);
+  // Quoted path arguments can contain spaces. Inspect those as one literal before scanning
+  // unquoted tokens (which also covers option assignments such as --prefix=/opt/homebrew).
+  const quotedRanges: Array<[number, number]> = [];
+  const literals: string[] = [];
+  for (const match of input.matchAll(/(["'])(.*?)\1/gs)) {
+    const start = match.index ?? 0;
+    if (match[2]?.startsWith('/') || match[2] === '~' || match[2]?.startsWith('~/')) {
+      // A double-quoted string still runs $(…) and `…` — keep scanning inside it so a substituted
+      // command's own paths (e.g. "/jail/$(cat /etc/passwd)") are checked too.
+      const expands = match[1] === '"' && /\$\(|`/.test(match[2]);
+      if (!expands) quotedRanges.push([start, start + match[0].length]);
+      if (/\bPATH=$/.test(input.slice(0, start))) literals.push(...match[2].split(':').filter(Boolean));
+      else literals.push(match[2]);
+    }
+  }
+  const candidates = /(^|[\s"'`|&=:<>(\[,;])((?:~\/|\/)[^\s"'`|:;&<>()[\]{}]*|~(?=$|[\s"'`|:;&<>()[\]{},]))/gm;
+  for (const match of input.matchAll(candidates)) {
+    const literal = match[2]!;
+    const start = (match.index ?? 0) + match[1]!.length;
+    if (quotedRanges.some(([from, to]) => from < start && start < to)) continue;
+    if (literal.startsWith('//') && /\w+:$/.test(input.slice(Math.max(0, start - 12), start))) continue;
+    literals.push(literal);
+  }
+  for (const literal of literals) {
+    const expanded = literal === '~' ? home : literal.startsWith('~/') ? `${home.replace(/\/$/, '')}/${literal.slice(2)}` : literal;
+    if (!insideJail(jail, canonicalPath(expanded))) return { allowed: false, reason: 'outside-jail', path: literal };
+  }
+  return { allowed: true };
+}
+
+export interface DriveJailDeps {
+  inject(text: string): boolean;
+  observe(): string | Promise<string>;
+}
+
+/**
+ * Put a drive's PTY input behind the jail. A blocked input is never sent to the PTY; the next screen the brain
+ * reads carries one line saying why, so it can try another way inside the jail (returning false from inject
+ * would end the loop as a human takeover). No jail → the deps come back unchanged.
+ */
+export function withDriveJail<T extends DriveJailDeps>(deps: T, jail: string | undefined, log?: (event: string, data: Record<string, unknown>) => void): T {
+  if (!jail) return deps;
+  let notice: string | null = null;
+  return {
+    ...deps,
+    inject: (text: string) => {
+      const verdict = checkDriveInputJail(text, jail);
+      if (verdict.allowed) return deps.inject(text);
+      notice = `⚠ elanous: input blocked — ${verdict.path} is outside the boundary ${jail} · try another way inside it`;
+      log?.('jail-block', { path: verdict.path, input: text.slice(0, 80) });
+      return true;
+    },
+    observe: async (): Promise<string> => {
+      const frame = await deps.observe();
+      if (notice === null) return frame;
+      const line = notice;
+      notice = null;
+      return `${frame}\n${line}`;
+    },
+  };
+}

package/src/cli/hooks-cli.ts

@@ -1,6 +1,7 @@
 import type { Command } from 'commander';
 import { startHookReceiver } from '../hooks/receiver.js';
 import { HookQueue } from '../hooks/queue.js';
+import { closeIngressAndExposure, hookExposurePlan, hookExposureStatus, startPublicHookIngress, turnHookExposureOff, turnHookExposureOn, type HookExposureDeps } from '../hooks/expose.js';
 import { getSecretAsync, setSecretAsync } from '../nexus/config/secrets/index.js';
 import { getUserConfig } from '../user-config.js';
 
@@ -9,7 +10,7 @@ export function asanaEnabled(raw: unknown = getUserConfig().raw): boolean {
   return tox?.external?.asana?.enabled === true;
 }
 
-export function registerHooksCommands(program: Command): void {
+export function registerHooksCommands(program: Command, exposureDeps: HookExposureDeps = {}): void {
   const hooks = program.command('hooks').description('외부 웹훅 수신·재전송');
   hooks.command('serve').description('웹훅 수신기를 포그라운드에서 실행')
     .option('--host <host>', '리스닝 주소', '127.0.0.1')
@@ -20,22 +21,35 @@ export function registerHooksCommands(program: Command): void {
         throw new Error('invalid hooks port');
       const secrets = {
         linear: await getSecretAsync('hooks.linear'), asana: await getSecretAsync('hooks.asana'),
+        github: await getSecretAsync('hooks.github'),
         // 첫 핸드셰이크의 비밀을 저장하는 것은 «먼저 온 사람이 이긴다» — Asana 를 켠 설치에서만 연다.
         ...(asanaEnabled() ? { saveAsana: (value: string) => setSecretAsync('hooks.asana', value) } : {}),
       };
       const server = startHookReceiver({ host: opts.host, port, secrets });
+      let ingress: ReturnType<typeof startPublicHookIngress> | undefined;
+      try { if (opts.host === '127.0.0.1' && port === 31480) ingress = startPublicHookIngress(server.url); }
+      catch (error) { server.stop(); throw error; }
       console.log(`hooks listening ${new URL(server.url).host}`);
       await new Promise<void>(resolve => {
         const stop = () => {
           process.removeListener('SIGINT', stop);
           process.removeListener('SIGTERM', stop);
-          server.stop();
-          resolve();
+          void closeIngressAndExposure(ingress, exposureDeps).finally(() => { server.stop(); resolve(); });
         };
         process.once('SIGINT', stop);
         process.once('SIGTERM', stop);
       });
     });
+  const expose = hooks.command('expose').description('결정 원장에 묶인 웹훅 공개 진입');
+  expose.command('plan').description('공개 경로와 tailscale 명령만 표시').action(() => console.log(JSON.stringify(hookExposurePlan())));
+  expose.command('on').description('결정 뒤 공개 진입 켜기').option('--decision <D-id>')
+    .action(async (opts: { decision?: string }) => console.log(JSON.stringify(await turnHookExposureOn(opts.decision, exposureDeps))));
+  expose.command('off').description('이 도구가 켠 공개 진입 끄기(결정 불필요)').option('--force', '기록·대상 확인 없이 8443 Funnel 을 끈다')
+    .action(async (opts: { force?: boolean }) => {
+      const result = await turnHookExposureOff(exposureDeps, { force: opts.force });
+      console.log(result.changed ? `hooks exposure off (${result.reason})` : 'hooks exposure: nothing of ours to turn off (8443 Funnel is not recorded and does not target the hook ingress; --force to turn it off anyway)');
+    });
+  expose.command('status').description('기록된 공개 경로·결정·시각').action(() => console.log(JSON.stringify(hookExposureStatus(exposureDeps))));
   hooks.command('status').description('대기 중인 웹훅 수와 마지막 전달 시각')
     .action(() => {
       const queue = new HookQueue();

package/src/cli/make-cli.ts

@@ -0,0 +1,43 @@
+import type { Command } from 'commander';
+import { debug } from '../debug/log.js';
+import { judge } from '../llm/judge-layer.js';
+import { runPluginMake } from './plugin-cli.js';
+import { workflowRun } from './workflow.js';
+
+type MakeKind = 'plugin' | 'workflow';
+type MakeDeps = {
+  decide?: (request: string) => Promise<MakeKind | null>;
+  pluginMake?: (request: string) => Promise<void>;
+  workflowMake?: (request: string) => Promise<number>;
+};
+
+export async function classifyMakeRequest(request: string, call?: (args: { prompt: string; provider: string; model: string }) => Promise<{ text: string }>): Promise<MakeKind | null> {
+  if (!request.trim()) return null;
+  const result = await judge<MakeKind>({
+    site: 'cli.make',
+    ...(call ? { call } : {}),
+    prompt: `Classify this request for an Elanous creator. Choose "plugin" for a reusable connector, integration, skill, or capability (including reading a file format). Choose "workflow" for a sequence of jobs, recurring schedule, automation, or publishing task, even when it uses a connector. If you cannot decide, return {"kind":"unclear"}. Respond with JSON only, exactly {"kind":"plugin"} or {"kind":"workflow"} or {"kind":"unclear"}. Do not execute the request.\nRequest: ${JSON.stringify(request)}`,
+    schema: value => {
+      if (!value || typeof value !== 'object' || Array.isArray(value)) return null;
+      const kind = (value as { kind?: unknown }).kind;
+      return kind === 'plugin' || kind === 'workflow' ? kind : null;
+    },
+  });
+  return result.ok ? result.value : null;
+}
+
+export function registerMakeCommand(program: Command, deps: MakeDeps = {}): void {
+  program.command('make <request>')
+    .description('Classify a one-line request and make a plugin or build a workflow')
+    .action(async (request: string) => {
+      const kind = await (deps.decide ?? classifyMakeRequest)(request).catch(() => null);
+      debug.log('cli.make', 'route', { kind: kind ?? 'undecided' });
+      if (!kind) {
+        console.log('플러그인(커넥터·스킬)을 만들까요, 워크플로(잡)를 만들까요?');
+        process.exitCode = 1;
+        return;
+      }
+      if (kind === 'plugin') await (deps.pluginMake ?? runPluginMake)(request);
+      else process.exitCode = await (deps.workflowMake ?? ((text: string) => workflowRun('build-workflow', text)))(request);
+    });
+}