elanous 0.2.13 → 0.2.15

package/src/agent-env/profile.ts

@@ -0,0 +1,161 @@
+import { existsSync, readFileSync, readdirSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+
+type Agent = 'claude' | 'codex' | 'grok';
+type Presence = 'present' | '«없음»';
+
+function present(path: string): Presence {
+  return existsSync(path) ? 'present' : '«없음»';
+}
+
+function record(value: unknown): Record<string, unknown> {
+  return value !== null && typeof value === 'object' && !Array.isArray(value)
+    ? value as Record<string, unknown> : {};
+}
+
+function json(path: string): Record<string, unknown> | null {
+  if (!existsSync(path)) return null;
+  return record(JSON.parse(readFileSync(path, 'utf8')));
+}
+
+// Command strings can contain tokens even without a shell; export only known executable names.
+function safeCommand(value: unknown): string | undefined {
+  if (typeof value !== 'string') return undefined;
+  return /^(?:npx|npm|node|bun|uv|uvx|python|python3|docker|deno|pnpm|yarn|bash|sh|claude|codex|grok|cct)$/.test(value)
+    ? value : '<redacted>';
+}
+
+// Key-shaped values (sk-…, ghp_…, AKIA…) pass the character check, so shape alone cannot prove a value is not a secret (10-05 post-review).
+const SECRET_PREFIX = /^(?:sk-|sk_|pk_|rk_|xai-|ghp_|gho_|ghu_|ghs_|ghr_|github_pat_|glpat-|AKIA|ASIA|AIza|ya29\.|xox[abprs]-|eyJ)/;
+
+export function safeIdentifier(value: unknown): string | null {
+  if (typeof value !== 'string') return null;
+  const digits = (value.match(/[0-9]/g) ?? []).length;
+  const keyShaped = SECRET_PREFIX.test(value) || value.length > 40 || (value.length >= 20 && digits >= 8);
+  return /^[a-zA-Z0-9_.:-]{1,90}$/.test(value) && !keyShaped && !/(?:token|secret|password|api.?key|credential)/i.test(value)
+    ? value : '<redacted>';
+}
+
+type McpSource = 'settings' | 'user' | 'project';
+
+function mcpEntry(server: unknown, source: McpSource): Record<string, unknown> {
+  const body = record(server);
+  return {
+    source,
+    command: safeCommand(body.command) ?? null,
+    env: Object.fromEntries(Object.keys(record(body.env)).map(key => [key, '<redacted>'])),
+    headers: Object.fromEntries(Object.keys(record(body.headers)).map(key => [key, '<redacted>'])),
+  };
+}
+
+function collectMcp(
+  into: Record<string, unknown>,
+  servers: unknown,
+  source: McpSource,
+): void {
+  for (const [name, server] of Object.entries(record(servers))) into[name] = mcpEntry(server, source);
+}
+
+function hookGroups(hooks: Record<string, unknown>): Record<string, unknown[]> {
+  return Object.fromEntries(Object.entries(hooks).map(([event, groups]) => [event,
+    Array.isArray(groups) ? groups.map(group => {
+      const body = record(group);
+      const entries = body.hooks;
+      return {
+        matcher: safeIdentifier(body.matcher),
+        hooks: Array.isArray(entries)
+          ? entries.map(entry => ({ command: safeCommand(record(entry).command) ?? null }))
+          : [],
+      };
+    }) : [],
+  ]));
+}
+
+function claude(home: string): Record<string, unknown> {
+  const dir = join(home, '.claude');
+  const settingsPath = join(dir, 'settings.json');
+  const userPath = join(home, '.claude.json');
+  const settings = json(settingsPath);
+  const user = json(userPath);
+  const data = record(settings);
+  const userData = record(user);
+  const plugins = record(data.enabledPlugins);
+  const hooks = record(data.hooks);
+  const statusLine = record(data.statusLine);
+  const skillsDir = join(dir, 'skills');
+  const team = join(home, '.teamclaude');
+  const teamManifest = json(join(team, 'package.json'));
+  const teamVersion = typeof teamManifest?.version === 'string' && /^\d+\.\d+\.\d+(?:[-+.][a-zA-Z0-9.-]+)?$/.test(teamManifest.version)
+    ? teamManifest.version : undefined;
+  const mcp: Record<string, unknown> = {};
+  if (settings !== null) collectMcp(mcp, data.mcpServers, 'settings');
+  if (user !== null) {
+    collectMcp(mcp, userData.mcpServers, 'user');
+    for (const project of Object.values(record(userData.projects))) {
+      collectMcp(mcp, record(project).mcpServers, 'project');
+    }
+  }
+  const mcpFilesMissing = settings === null && user === null;
+  return {
+    settings: settings === null ? '«없음»' : 'present',
+    userConfig: user === null ? '«없음»' : 'present',
+    permissionMode: safeIdentifier(record(data.permissions).defaultMode),
+    statusLine: settings === null ? '«없음»' : data.statusLine === undefined ? '«없음»' : {
+      type: safeIdentifier(statusLine.type),
+      command: safeCommand(statusLine.command) ?? null,
+    },
+    hooks: settings === null ? '«없음»' : hookGroups(hooks),
+    enabledPlugins: settings === null ? '«없음»' : Object.fromEntries(Object.entries(plugins).map(([name, enabled]) => [name, enabled === true])),
+    mcpServers: mcpFilesMissing ? '«없음»' : mcp,
+    skills: !existsSync(skillsDir) ? '«없음»' : readdirSync(skillsDir, { withFileTypes: true })
+      .filter(entry => entry.isDirectory()).map(entry => entry.name).sort(),
+    teamclaude: { installed: present(team), version: teamVersion ?? null },
+    auth: present(join(dir, 'auth.json')),
+    credentials: present(join(dir, '.credentials.json')),
+  };
+}
+
+function codex(home: string): Record<string, unknown> {
+  const dir = join(home, '.codex');
+  const file = join(dir, 'config.toml');
+  if (!existsSync(file)) return { config: '«없음»', model: null, profile: null, mcpServers: '«없음»', auth: present(join(dir, 'auth.json')) };
+  const data = record(Bun.TOML.parse(readFileSync(file, 'utf8')));
+  const mcp = record(data.mcp_servers);
+  return {
+    config: 'present',
+    model: safeIdentifier(data.model),
+    profile: safeIdentifier(data.profile),
+    mcpServers: Object.keys(mcp).sort(),
+    auth: present(join(dir, 'auth.json')),
+  };
+}
+
+function grok(home: string): Record<string, unknown> {
+  const dir = join(home, '.grok');
+  const jsonPath = join(dir, 'config.json');
+  const tomlPath = join(dir, 'config.toml');
+  const file = existsSync(jsonPath) ? jsonPath : tomlPath;
+  const data = !existsSync(file) ? null : file === jsonPath ? json(file) : record(Bun.TOML.parse(readFileSync(file, 'utf8')));
+  return {
+    config: data === null ? '«없음»' : 'present',
+    keys: data === null ? '«없음»' : Object.keys(data).sort(),
+    auth: present(join(dir, 'auth.json')),
+    credentials: present(join(dir, 'credentials.json')),
+  };
+}
+
+export function captureAgentEnv(options: { agent?: Agent; home?: string; now?: Date } = {}): {
+  version: number; capturedAt: string; agents: Record<string, Record<string, unknown>>;
+} {
+  const home = options.home ?? homedir();
+  const selected = options.agent ? [options.agent] : ['claude', 'codex', 'grok'] as const;
+  const agents: Record<string, Record<string, unknown>> = {};
+  for (const agent of selected) {
+    if (agent === 'claude') agents.claude = claude(home);
+    else if (agent === 'codex') agents.codex = codex(home);
+    else if (agent === 'grok') agents.grok = grok(home);
+    else throw new Error('Unknown agent');
+  }
+  return { version: 1, capturedAt: (options.now ?? new Date()).toISOString(), agents };
+}

package/src/agent-mission/driver.ts

@@ -2202,8 +2202,8 @@ async function runAgentMissionBody(spec: AgentMissionSpec, deps: AgentMissionDep
     rounds: round, evidencePath: null, committed: false, usedOmniCrawl: usedOmni, detail: 'aborted' };
   const finalEv = verifyEvidence(wt.path, spec.evidence);
   const finalScreen = await h.renderScreen();
-  const driveVerdict = verdictForFinalPtyScreen({ screen: finalScreen, inputHistory: submittedInputs, exitCode: h.exitCode ?? null });
-  debug.log('agent-mission', 'drive-verdict', { kind: driveVerdict.kind, reason: driveVerdict.reason.slice(0, 200) });
+  const driveVerdict = verdictForFinalPtyScreen({ screen: finalScreen, inputHistory: submittedInputs, exitCode: h.exitCode ?? null, artifactEvidence: finalEv.ok });
+  debug.log('agent-mission', 'drive-ok', { verdict: driveVerdict.kind, reason: driveVerdict.reason.slice(0, 200), evidence: finalEv.ok });
   const recoverExhausted = control.termination.kind === 'stuck' && control.termination.reason.startsWith('사람 필요');
   const accepted = finalEv.ok && !recoverExhausted && driveVerdict.kind !== 'done-but-failed';
   const evidencePath = accepted ? finalEv.path : null;
@@ -2223,7 +2223,7 @@ async function runAgentMissionBody(spec: AgentMissionSpec, deps: AgentMissionDep
     ok: accepted, worktree: wt.path, branch: wt.branch, rounds: round,
     evidencePath, evidenceSatisfied: finalEv.ok, committed, usedOmniCrawl: usedOmni,
     ptyId: h.id, webUrl: webAddress.webUrl, driveVerdict: driveVerdict.kind,
-    detail: recoverExhausted ? control.termination.reason : driveVerdict.kind === 'done-but-failed' ? `미완(DRIVE-OK: ${driveVerdict.reason})` : done ? '완료(증거 충족)' : (finalEv.ok ? '증거 충족(루프 종료)' : '미완(증거 부족)'),
+    detail: recoverExhausted ? control.termination.reason : driveVerdict.kind === 'done-but-failed' ? `미완(DRIVE-OK: ${driveVerdict.reason})` : driveVerdict.kind === 'success-unverified' && finalEv.ok ? '완료(증거)' : done ? '완료(증거 충족)' : (finalEv.ok ? '증거 충족(루프 종료)' : '미완(증거 부족)'),
   };
   } finally { stopLive(); finishContext(false); }
 }

package/src/agent-substrate/pr-reviewer.ts

@@ -825,6 +825,8 @@ export async function reviewPullRequest(
 
 /** 리뷰 결과를 PR 코멘트/알림/CLI 용 markdown 으로 렌더. */
 export function renderReview(r: ReviewResult): string {
+  // A review that never ran must not read as PASS anywhere it is rendered (PR body, comments, CLI) — 10-05 #23942·#24151.
+  if (r.reviewed === false) return `⚠️ 자율 PR 리뷰: 리뷰 안 돎 — 사유 ${r.failureReason?.trim() || '미상'} (통과 판정 아님)`;
   const icon = r.verdict === 'pass' ? '✅' : r.verdict === 'warn' ? '⚠️' : '⛔';
   const head = `${icon} 자율 PR 리뷰: ${r.verdict.toUpperCase()}`;
   const parts = [head];

package/src/ask-user-question/pending-questions.ts

@@ -9,6 +9,8 @@ export interface PendingQuestion {
   id: string;
   sessionId?: string;
   runId?: string;
+  /** Explicit provenance for isolated test questions; a temporary goal path alone is not proof. */
+  testOrigin?: true;
   questions: Array<Pick<Question, 'id' | 'question' | 'options' | 'impact' | 'recommendedIndex'>>;
   startedAt: string;
   expiresAt?: string;
@@ -84,6 +86,7 @@ function isPendingQuestion(value: unknown): value is PendingQuestion {
   return typeof pending.id === 'string'
     && (pending.sessionId === undefined || typeof pending.sessionId === 'string')
     && (pending.runId === undefined || typeof pending.runId === 'string')
+    && (pending.testOrigin === undefined || pending.testOrigin === true)
     && Array.isArray(pending.questions)
     && pending.questions.every((question) => {
       if (question === null || typeof question !== 'object' || Array.isArray(question)) return false;
@@ -175,6 +178,7 @@ export function createPendingQuestion(
   sessionId?: string,
   deps: Pick<PendingQuestionStoreDeps, 'now'> = {},
   presentation: PendingQuestionPresentation = { surface: 'tui', delivery: request.delivery ?? 'modal' },
+  provenance: { testOrigin?: true } = {},
 ): PendingQuestion {
   // File-surface waits must carry a concrete deadline so the CLI answer path can
   // reject an expired record (see isPendingQuestion). Fail loudly at creation
@@ -186,6 +190,7 @@ export function createPendingQuestion(
     id,
     ...(sessionId === undefined ? {} : { sessionId }),
     ...(request.runId === undefined ? {} : { runId: request.runId }),
+    ...(provenance.testOrigin ? { testOrigin: true as const } : {}),
     questions: request.questions.map(({ id, question, options, impact, recommendedIndex }) => ({
       id, question, options,
       ...(impact === undefined ? {} : { impact }),

package/src/auth/github-app-token.ts

@@ -1,6 +1,6 @@
 import { createHash, createSign } from 'node:crypto';
 import { spawnSync } from 'node:child_process';
-import { existsSync, readFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs';
 import { dirname, isAbsolute, join } from 'node:path';
 import { getElanousConfigDir, getElanousConfigDirOverride } from '../elanous-config-dir.js';
 import { prodInstanceRoot } from '../instance/resolve.js';
@@ -45,21 +45,23 @@ export function githubAutomationToken(deps: GithubAutomationTokenDeps = {}): str
   return githubInstallationCredential(deps)?.token ?? null;
 }
 
+/** The App credential is machine-level (like `gh auth` in ~/.config/gh), not per universe: a tree-derived test
+ *  universe resolves its config dir to `<tree>/.elanous-test`, where the file never is — 09-29 #21879 was inert there.
+ *  Order: explicit path → this universe's config dir → the prod root `~/.elanous`.
+ *  An explicit config-dir override (tests · `--config-dir`) is a deliberate boundary — never reach past it.
+ *  ELANOUS_GITHUB_APP_CONFIG_PATH pins the machine-level fallback (the bun test preload points it at nothing,
+ *  so tests never mint); an explicit config-dir override still wins. */
+function appConfigPath(explicit?: string): string {
+  const rel = join('secrets', 'github-app', 'app.json');
+  const own = join(getElanousConfigDir(), rel);
+  const pinned = process.env.ELANOUS_GITHUB_APP_CONFIG_PATH?.trim();
+  return explicit ?? (getElanousConfigDirOverride() ? own : pinned || (existsSync(own) ? own : join(prodInstanceRoot(), rel)));
+}
+
 /** Scoped requests always mint anew; the returned expiry comes from GitHub's response. */
 export function githubInstallationCredential(deps: GithubAutomationTokenDeps = {}): { token: string; expires_at: string } | null {
   let path: string;
-  // The App credential is machine-level (like `gh auth` in ~/.config/gh), not per universe: a tree-derived test
-  // universe resolves its config dir to `<tree>/.elanous-test`, where the file never is — 09-29 #21879 was inert there.
-  // Order: explicit path → this universe's config dir → the prod root `~/.elanous`.
-  try {
-    const rel = join('secrets', 'github-app', 'app.json');
-    const own = join(getElanousConfigDir(), rel);
-    // An explicit config-dir override (tests · `--config-dir`) is a deliberate boundary — never reach past it.
-    // ELANOUS_GITHUB_APP_CONFIG_PATH pins the machine-level fallback (the bun test preload points it at nothing,
-    // so tests never mint); an explicit config-dir override still wins.
-    const pinned = process.env.ELANOUS_GITHUB_APP_CONFIG_PATH?.trim();
-    path = deps.configPath ?? (getElanousConfigDirOverride() ? own : pinned || (existsSync(own) ? own : join(prodInstanceRoot(), rel)));
-  }
+  try { path = appConfigPath(deps.configPath); }
   catch {
     try { debug.log('auth.github-app', 'token-failed', { reason: 'config-path-failed' }); } catch { /* fail open */ }
     return null;
@@ -113,3 +115,100 @@ export function githubInstallationCredential(deps: GithubAutomationTokenDeps = {
     return null;
   }
 }
+
+/** PODCRED1 (10-05): simultaneous launches each minted a scoped token in the same second and the Pods' logins died
+ *  together (12:49Z · 5 in 2 s). Concurrent issuers for one repository — across processes — share one mint: the first
+ *  takes a lock and mints, the others wait and reuse that result while it is recent and long-lived. */
+export interface CoalescedInstallationOptions {
+  cacheDir?: string;
+  /** Reuse a token minted at most this long ago. */
+  windowMs?: number;
+  /** …and only while it still has this much life left. */
+  minRemainingMs?: number;
+  /** Skip reuse (still mint under the lock and publish the result) — for a retry after the shared token failed. */
+  fresh?: boolean;
+  lockWaitMs?: number;
+  staleLockMs?: number;
+  now?: () => number;
+  sleepSync?: (ms: number) => void;
+  mint?: (scope: GithubInstallationTokenScope) => { token: string; expires_at: string } | null;
+}
+
+const COALESCE_WINDOW_MS = 120_000;
+const COALESCE_MIN_REMAINING_MS = 50 * 60_000;
+
+function blockingSleep(ms: number): void {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+
+export function coalescedInstallationCredential(scope: GithubInstallationTokenScope, opts: CoalescedInstallationOptions = {}): { token: string; expires_at: string } | null {
+  const now = opts.now ?? Date.now;
+  const mint = opts.mint ?? ((s: GithubInstallationTokenScope) => githubInstallationCredential({ scope: s }));
+  const windowMs = opts.windowMs ?? COALESCE_WINDOW_MS;
+  const minRemainingMs = opts.minRemainingMs ?? COALESCE_MIN_REMAINING_MS;
+  const sleepSync = opts.sleepSync ?? blockingSleep;
+  // Same boundary as the App config: a test process (or config-dir override) never writes the operational root.
+  if (!opts.cacheDir && (process.env.NODE_ENV === 'test' || process.env.ELANOUS_TEST_HOME)) return mint(scope);
+  let dir: string;
+  let identity: string;
+  try {
+    const configPath = appConfigPath();
+    const config = JSON.parse(readFileSync(configPath, 'utf8')) as Partial<AppConfig>;
+    identity = JSON.stringify([configPath, config.id, config.installation_id]);
+    dir = opts.cacheDir ?? join(getElanousConfigDirOverride() ? getElanousConfigDir() : prodInstanceRoot(), 'cache', 'github-app-scoped');
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+  } catch {
+    if (!opts.cacheDir) return mint(scope);
+    dir = opts.cacheDir;
+    identity = 'injected';
+  }
+  // Keyed by App installation and repository, so another App (another universe or owner) never reuses this token.
+  const key = createHash('sha256').update(`${identity}\0${scope.repository}`).digest('hex').slice(0, 32);
+  const file = join(dir, `${key}.json`);
+  const lock = join(dir, `${key}.lock`);
+  let waitStart: number | undefined;
+  const reuse = (): { token: string; expires_at: string } | null => {
+    try {
+      const entry = JSON.parse(readFileSync(file, 'utf8')) as { token?: unknown; expiresAt?: unknown; mintedAt?: unknown };
+      const t = now();
+      if (typeof entry.token === 'string' && entry.token && typeof entry.expiresAt === 'number' && typeof entry.mintedAt === 'number'
+        && t - entry.mintedAt <= windowMs && entry.expiresAt - t >= minRemainingMs) {
+        try { debug.log('auth.github-app', 'token-coalesced', { ageMs: t - entry.mintedAt, expiresAt: new Date(entry.expiresAt).toISOString(), ...(waitStart === undefined ? {} : { waitedMs: t - waitStart }) }); } catch { /* fail open */ }
+        return { token: entry.token, expires_at: new Date(entry.expiresAt).toISOString() };
+      }
+    } catch { /* no usable entry */ }
+    return null;
+  };
+  const hit = opts.fresh ? null : reuse();
+  if (hit) return hit;
+  waitStart = now();
+  const deadline = waitStart + (opts.lockWaitMs ?? 15_000);
+  let locked = false;
+  for (;;) {
+    try { mkdirSync(lock); locked = true; break; }
+    catch {
+      try { if (now() - statSync(lock).mtimeMs > (opts.staleLockMs ?? 30_000)) { rmSync(lock, { recursive: true, force: true }); continue; } } catch { continue; }
+      if (now() >= deadline) break;
+      sleepSync(200);
+      const waited = opts.fresh ? null : reuse();
+      if (waited) return waited;
+    }
+  }
+  if (!locked) { try { debug.log('auth.github-app', 'token-coalesce-lock-timeout', { waitedMs: now() - (waitStart ?? now()) }); } catch { /* fail open */ } }
+  try {
+    const again = opts.fresh ? null : reuse();
+    if (again) return again;
+    const minted = mint(scope);
+    const expiresAt = minted ? Date.parse(minted.expires_at) : NaN;
+    if (minted && Number.isFinite(expiresAt)) {
+      const temp = `${file}.${process.pid}.tmp`;
+      try {
+        writeFileSync(temp, JSON.stringify({ token: minted.token, expiresAt, mintedAt: now() }), { mode: 0o600 });
+        renameSync(temp, file);
+      } catch { try { rmSync(temp, { force: true }); } catch { /* best effort */ } }
+    }
+    return minted;
+  } finally {
+    if (locked) { try { rmSync(lock, { recursive: true, force: true }); } catch { /* stale-lock rule recovers */ } }
+  }
+}

package/src/autopilot/build/llm-conflict-merge.ts

@@ -10,6 +10,9 @@ import { readFileSync, writeFileSync } from 'node:fs';
 import { runGitCommand } from '../../git-fs/runner.js';
 import { countTestDeclarations } from '../../self-implement/test-declarations.js';
 import { NEXT_MD_PATH, resolveNextMdConflict } from '../../release-loop/next-md-merge.js';
+import { getUserConfig } from '../../user-config.js';
+import { debug } from '../../debug/log.js';
+import { collectMergeIntent, defaultIntentGit, type IntentGit } from './merge-intent.js';
 
 function deterministicNextMd(git: MergeGitSeam, worktreePath: string, file: string): string | null {
   try {
@@ -64,6 +67,9 @@ export interface LlmMergeOutcome {
   testDeclarationUnmeasured?: string[];
   /** 해결기 응답이 LLM 공급자 오류 문구였다 — 파일 내용이 아니다(🅢 2026-09-27 #21086: 세 파일이 통째로 그 문구가 됐다). */
   providerFailure?: string[];
+  /** LLM 입력 상한 초과: 사람 수확으로 넘긴다. 원래 브랜치는 abort 후 보존된다. */
+  reason?: 'conflict-input-too-large' | 'conflict-resolver-interrupted';
+  inputChars?: number;
   /** 병합 결과가 양쪽 판 중 작은 쪽의 절반 아래로 줄었다 — 통째로 날린 것으로 보고 해결 실패로 친다. */
   sizeCollapse?: Array<{ file: string; ours: number; theirs: number; merged: number }>;
   /** `status: 'error'` 일 때 어느 단계인지. 선택 — 옛 호출자는 이 칸 없이 돌아도 된다. */
@@ -76,6 +82,13 @@ export interface LlmMergeOutcome {
 export const PROVIDER_FAILURE_TEXT = /^\s*\[LLM PROVIDER (?:BLOCKED|STOPPED)\]/;
 /** 이 줄 수 미만 파일은 크기 붕괴 판정에서 뺀다(작은 파일은 정당하게 크게 줄 수 있다). */
 export const SIZE_COLLAPSE_MIN_LINES = 50;
+export const DEFAULT_MERGE_CONFLICT_INPUT_MAX_CHARS = 60_000;
+
+export class MergeConflictInputTooLarge extends Error {
+  constructor(readonly inputChars: number) {
+    super(`충돌 큼 — 사람 수확 (LLM 입력 ${inputChars}자)`);
+  }
+}
 
 function lineCount(s: string): number {
   if (s.length === 0) return 0;
@@ -204,12 +217,21 @@ export async function mergeMainWithLlmResolve(
     let merged: string;
     try {
       conflicted = git.readFile(abs);
+    } catch {
+      git.abort(worktreePath);
+      return measuredOutcome({ status: 'conflict-unresolved', resolvedFiles });
+    }
+    try {
       // release/next.md: concurrent landings each append a line — keep both without asking the LLM (REL7c).
       const deterministic = f === NEXT_MD_PATH ? deterministicNextMd(git, worktreePath, f) : null;
       merged = deterministic ?? await resolve(f, conflicted);
-    } catch {
+    } catch (error) {
       git.abort(worktreePath); // LLM 예외 → base 유지
-      return measuredOutcome({ status: 'conflict-unresolved', resolvedFiles });
+      return measuredOutcome({ status: 'conflict-unresolved', resolvedFiles,
+        ...(error instanceof MergeConflictInputTooLarge
+          ? { reason: 'conflict-input-too-large' as const, inputChars: error.inputChars }
+          : { reason: 'conflict-resolver-interrupted' as const }),
+      });
     }
     if (PROVIDER_FAILURE_TEXT.test(merged)) {
       git.abort(worktreePath); // 해결기가 공급자 오류 문구를 «내용»으로 돌려줬다 → base 유지
@@ -328,27 +350,68 @@ export function defaultGitMergeSeam(): MergeGitSeam {
 }
 
 /** 실 LLM 충돌 해결 어댑터(streamLLM·sol). 코드펜스/설명 제거해 완결 파일만. */
-export async function defaultLlmResolve(filePath: string, conflicted: string, mergeTarget: string): Promise<string> {
-  const { streamLLM } = await import('../../llm.js');
-  const out = await streamLLM([{ role: 'user', content: conflictResolvePrompt(filePath, conflicted, mergeTarget) }], () => {}, { model: process.env.ELANOUS_CONFLICT_MODEL || tierModel('better'), reasoningEffort: 'medium' });
-  // ⛔ 라우터는 공급자가 전부 막히면 던지지 않고 오류 문구를 돌려준다 — 그것은 파일 내용이 아니다. 던져서 «LLM 예외 → base 유지» 로 보낸다.
-  if (PROVIDER_FAILURE_TEXT.test(out)) throw new Error(`conflict resolve: LLM provider failure for ${filePath}`);
-  return `${out.replace(/^```[\w.-]*\n?/, '').replace(/\n?```\s*$/, '').trimEnd()}\n`;
+export async function defaultLlmResolve(
+  filePath: string, conflicted: string, mergeTarget: string,
+  options: { worktreePath?: string; mode?: 'off' | 'shadow' | 'on'; git?: IntentGit; stream?: typeof import('../../llm.js')['streamLLM'] } = {},
+): Promise<string> {
+  let rawConfig: { mergeConflictInputMaxChars?: unknown; mergeIntent?: unknown } | undefined;
+  try { rawConfig = getUserConfig().raw.selfImplement as typeof rawConfig; }
+  catch { /* unreadable config keeps the old resolver and default input limit */ }
+  const configuredMax = rawConfig?.mergeConflictInputMaxChars;
+  const maxChars = typeof configuredMax === 'number' && Number.isSafeInteger(configuredMax) && configuredMax > 0
+    ? configuredMax : DEFAULT_MERGE_CONFLICT_INPUT_MAX_CHARS;
+  let rawMode: unknown = options.mode;
+  if (rawMode === undefined) {
+    rawMode = rawConfig?.mergeIntent;
+  }
+  const mode = rawMode === 'shadow' || rawMode === 'on' ? rawMode : 'off';
+  const resolve = async (intent?: { ours: string | null; theirs: string[] }): Promise<string> => {
+    const prompt = conflictResolvePrompt(filePath, conflicted, mergeTarget, intent);
+    if (prompt.length > maxChars) throw new MergeConflictInputTooLarge(prompt.length);
+    const streamLLM = options.stream ?? (await import('../../llm.js')).streamLLM;
+    const out = await streamLLM([{ role: 'user', content: prompt }], () => {}, { model: process.env.ELANOUS_CONFLICT_MODEL || tierModel('better'), reasoningEffort: 'medium' });
+    // ⛔ 라우터는 공급자가 전부 막히면 던지지 않고 오류 문구를 돌려준다 — 그것은 파일 내용이 아니다.
+    if (PROVIDER_FAILURE_TEXT.test(out)) throw new Error(`conflict resolve: LLM provider failure for ${filePath}`);
+    return `${out.replace(/^```[\w.-]*\n?/, '').replace(/\n?```\s*$/, '').trimEnd()}\n`;
+  };
+  if (mode === 'off') return resolve();
+  const collect = () => collectMergeIntent({ worktreePath: options.worktreePath ?? process.cwd(), filePath, mergeTarget, git: options.git ?? defaultIntentGit });
+  if (mode === 'on') return resolve(collect());
+  const plain = await resolve();
+  try {
+    const intent = collect();
+    const withIntent = await resolve(intent);
+    debug.log('self-dev.merge', 'intent-shadow', {
+      file: filePath, same: plain === withIntent,
+      plainMarkers: hasConflictMarkers(plain), intentMarkers: hasConflictMarkers(withIntent),
+      plainLines: lineCount(plain), intentLines: lineCount(withIntent),
+      oursIntent: intent.ours !== null, theirsCount: intent.theirs.length,
+    });
+  } catch (error) {
+    try { debug.log('self-dev.merge', 'intent-shadow-failed', { file: filePath, error: String(error) }); }
+    catch { /* shadow observation must not affect the adopted result */ }
+  }
+  return plain;
 }
 
 /** 편의 — 실 git+LLM 으로 호출부가 해석한 ref를 worktree 에 지능 정합한다. */
 export async function mergeMainIntoWorktreeWithLlm(worktreePath: string, mergeTarget: string): Promise<LlmMergeOutcome> {
-  return mergeMainWithLlmResolve(worktreePath, mergeTarget, (filePath, conflicted) => defaultLlmResolve(filePath, conflicted, mergeTarget), defaultGitMergeSeam());
+  return mergeMainWithLlmResolve(worktreePath, mergeTarget, (filePath, conflicted) => defaultLlmResolve(filePath, conflicted, mergeTarget, { worktreePath }), defaultGitMergeSeam());
 }
 
 /** LLM 충돌 해결 프롬프트(순수·테스트) — ours(walker)·theirs(호출자가 전달한 정합 대상) 종합 지시. */
-export function conflictResolvePrompt(filePath: string, conflictedContent: string, mergeTarget: string): string {
+export function conflictResolvePrompt(filePath: string, conflictedContent: string, mergeTarget: string, intent?: { ours: string | null; theirs: string[] }): string {
   return [
     '너는 git merge 충돌을 지능적으로 해결하는 엔지니어다. 아래 파일은 3-way merge 충돌 마커를 포함한다:',
     '  <<<<<<< ours   = 현재 브랜치(walker 가 이 미션에서 만든 산출물)',
     '  ======= 사이   = 양쪽 버전',
     `  >>>>>>> theirs = ${mergeTarget}(호출자가 해석해 전달한 정합 대상)`,
     '',
+    ...(intent ? [
+      `ours 의 의도: ${intent.ours ?? '(확인 불가)'}`,
+      `theirs 에 먼저 착지한 변경: ${intent.theirs.length ? intent.theirs.join(' · ') : '(확인 불가)'}`,
+      '',
+    ] : []),
     '해결 원칙:',
     '- 양쪽의 의도를 **모두 보존**하며 종합한다(한쪽을 통째로 버리지 않는다).',
     `- 같은 목적의 중복(예: 같은 테스트·같은 함수)은 **theirs(${mergeTarget}) 버전을 채택**하고 ours 의 중복은 제거.`,

package/src/autopilot/build/merge-intent.ts

@@ -0,0 +1,53 @@
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { runGitCommand } from '../../git-fs/runner.js';
+
+export interface MergeIntent {
+  ours: string | null;
+  theirs: string[];
+}
+
+export type IntentGit = (worktreePath: string, args: string[]) => { status: number | null; stdout: string };
+
+export const defaultIntentGit: IntentGit = (worktreePath, args) => {
+  const result = runGitCommand(worktreePath, args, { encoding: 'utf8' });
+  return { status: result.status, stdout: result.stdout ?? '' };
+};
+
+/** Read only commits introduced on each side of the merge base; a missing ref/document never blocks resolution. */
+export function collectMergeIntent({ worktreePath, filePath, mergeTarget, git }: {
+  worktreePath: string;
+  filePath: string;
+  mergeTarget: string;
+  git: IntentGit;
+}): MergeIntent {
+  const read = (...args: string[]): string | null => {
+    try {
+      const result = git(worktreePath, args);
+      return result.status === 0 ? result.stdout.trim() : null;
+    } catch { return null; }
+  };
+  const base = read('merge-base', 'HEAD', mergeTarget);
+  if (!base) return { ours: null, theirs: [] };
+
+  let ours: string | null = null;
+  const added = read('log', '--reverse', '--diff-filter=A', '--format=', '--name-only', '-z', `${base}..HEAD`, '--', 'docs/goals/');
+  for (const goal of added?.split('\0').map((file) => file.trim()).filter((file) => /^docs\/goals\/[^/]+$/.test(file)) ?? []) {
+    try {
+      const content = readFileSync(join(worktreePath, goal), 'utf8');
+      const lines = content.split(/\r?\n/);
+      const title = lines.find((line) => /^#\s+\S/.test(line))?.replace(/^#\s+/, '').trim()
+        ?? lines.find((line) => line.trim().length > 0)?.trim();
+      const situation = lines.find((line) => /^Situation:/.test(line))?.trim();
+      const complication = lines.find((line) => /^Complication:/.test(line))?.trim();
+      ours = [title, situation, complication].filter(Boolean).join('\n') || null;
+      if (ours) break;
+    } catch { /* missing goal: try the next added document */ }
+  }
+  if (!ours) {
+    const subjects = read('log', '-3', '--format=%s', `${base}..HEAD`);
+    ours = subjects || null;
+  }
+  const subjects = read('log', '-5', '--format=%s', `${base}..${mergeTarget}`, '--', filePath);
+  return { ours, theirs: subjects ? subjects.split('\n') : [] };
+}