elanous 0.2.14 → 0.2.16

package/scripts/rhythm/weekly.ts

@@ -7,13 +7,15 @@ import { effectiveInstanceRoot, prodInstanceRoot } from '../../src/instance/reso
 import { getUserConfig } from '../../src/user-config.js';
 import { loopEvent } from '../../src/loops/observe.js';
 import { sendOutbound } from '../../src/domains/outbound-alert.js';
-import { collectLandings, collectRelease, collectDecisions, type Landing, type Release, type Pending, type Section } from './daily.js';
+import { listSchedules } from '../../src/release-loop/release-schedule.js';
+import { listChecklist } from '../../src/release-loop/checklist.js';
+import { collectLandings, collectDecisions, type Landing, type Release, type Pending, type Section } from './daily.js';
 
 type Issue = { id: string; title: string; owner: string; due: string; status: 'open' | 'done'; at: string; by: string };
 type WeeklyParts = { landings: Section<Landing[]>; release: Section<Release>; issues: Section<Issue[]>;
   followThrough: Section<{ issue: Issue; outcome: 'done' | '기한 뒤 완료' | '기한 넘김' | '진행'; doneAt?: string }[]>;
   decisions: Section<Pending[]>; news: Section<{ title: string; url: string }[]> };
-export type WeeklyDeps = { now?: () => Date; root?: string; vaultRoot?: string | null; sendEnabled?: boolean;
+export type WeeklyDeps = { now?: () => Date; root?: string; vaultRoot?: string | null; sendEnabled?: boolean; repoRoot?: string; repoName?: string;
   landings?: (now: Date, window: { from: Date; to: Date }) => Promise<Landing[]>; release?: () => Promise<Release>;
   decisions?: () => Promise<Pending[]>; send?: (text: string, kind: string) => boolean;
   receipt?: (key: string) => 'sent' | 'not-sent' | 'unknown';
@@ -60,6 +62,20 @@ function appendIssue(root: string, row: Issue) {
   mkdirSync(dirname(file), { recursive: true });
   appendFileSync(file, `${JSON.stringify(row)}\n`);
 }
+async function collectWeeklyRelease(now: Date, root: string): Promise<Release> {
+  if (!existsSync(join(root, 'release', 'features.sqlite'))) throw new Error('판 원장 없음');
+  const schedules = listSchedules(root).sort((a, b) => a.cutAt.localeCompare(b.cutAt));
+  const index = schedules.findIndex(schedule => Date.parse(schedule.cutAt) >= now.getTime());
+  if (index < 0) throw new Error('남은 판 일정 없음');
+  const current = schedules[index]!;
+  const items = listChecklist(current.version, root).items;
+  const next = schedules[index + 1];
+  const nextItems = next ? listChecklist(next.version, root).items : null;
+  return { version: current.version, green: items.filter(i => i.status === 'green').length, total: items.length,
+    nextVersion: next?.version ?? null, nextGreen: nextItems ? nextItems.filter(i => i.status === 'green').length : null,
+    nextTotal: nextItems?.length ?? null, cutAt: current.cutAt,
+    red: items.filter(i => i.status === 'red').map(i => ({ name: `${i.id} ${i.title}` })) };
+}
 function readDailyNews(root: string, from: Date, to: Date): Section<{ title: string; url: string }[]> {
   const found = new Map<string, { title: string; url: string }>();
   const failures: string[] = [];
@@ -67,7 +83,7 @@ function readDailyNews(root: string, from: Date, to: Date): Section<{ title: str
   for (let at = from.getTime(); at < to.getTime(); at += DAY) {
     const day = kstDate(new Date(at));
     const file = join(root, 'rhythm', 'daily', `${day}.md`);
-    if (!existsSync(file)) { failures.push(`${day} 데일리 없음`); continue; }
+    if (!existsSync(file)) continue;
     files++;
     try {
       const text = readFileSync(file, 'utf8');
@@ -83,7 +99,8 @@ function readDailyNews(root: string, from: Date, to: Date): Section<{ title: str
     } catch (e) { failures.push(`${day} ${reasonOf(e)}`); }
   }
   const news = [...found.values()].slice(0, 10);
-  if (failures.length) return { status: 'unreadable', reason: `${files ? failures.join('; ') : '데일리 없음'}${news.length ? `\n부분 수집 (완전한 주간 집계 아님):\n${news.map(n => `- ${n.title} — ${n.url}`).join('\n')}` : ''}` };
+  if (!files) return { status: 'unreadable', reason: '데일리 없음' };
+  if (failures.length) return { status: 'unreadable', reason: `${failures.join('; ')}${news.length ? `\n부분 수집 (완전한 주간 집계 아님):\n${news.map(n => `- ${n.title} — ${n.url}`).join('\n')}` : ''}` };
   return { status: 'ok', value: news };
 }
 const labels: Record<keyof WeeklyParts, string> = {
@@ -133,8 +150,10 @@ function vaultCopy(markdown: string, key: string, deps: WeeklyDeps) {
   let root = deps.vaultRoot;
   if (root === undefined) {
     try {
-      root = String(object(getUserConfig().raw.obsidian).vaultRoot || '') || null;
-      if (root && effectiveInstanceRoot() !== prodInstanceRoot()) return { vaultError: '격리 인스턴스 — 운영 볼트 사본 건너뜀', vaultFatal: false };
+      const config = getUserConfig();
+      const obsidian = object(config.raw.obsidian);
+      root = (typeof obsidian.vault === 'string' && obsidian.vault) || (typeof obsidian.vaultRoot === 'string' && obsidian.vaultRoot) || config.obsidian.vault || null;
+      if (root && effectiveInstanceRoot() !== prodInstanceRoot() && !root.startsWith(`${effectiveInstanceRoot()}/`)) return { vaultError: '격리 인스턴스 — 운영 볼트 사본 건너뜀', vaultFatal: false };
     } catch (e) { return { vaultError: reasonOf(e), vaultFatal: true }; }
   }
   if (!root) return { vaultError: null, vaultFatal: false };
@@ -181,6 +200,8 @@ export async function runWeekly(options: { dryRun?: boolean; stage?: 'collect' |
   const now = (deps.now ?? (() => new Date()))();
   const root = deps.root ?? effectiveInstanceRoot();
   const { from, to, key } = weekOf(now);
+  const newsTo = new Date(`${kstDate(now)}T00:00:00+09:00`);
+  const newsFrom = new Date(newsTo.getTime() - 7 * DAY);
   const file = join(root, 'rhythm', 'weekly', `${key}.md`);
   let markdown: string;
   let header: string;
@@ -205,8 +226,8 @@ export async function runWeekly(options: { dryRun?: boolean; stage?: 'collect' |
     };
     const issues = await safe(async () => issueHistory(root));
     const parts: WeeklyParts = {
-      landings: await safe(() => (deps.landings ?? collectLandings)(now, { from, to })),
-      release: await safe(deps.release ?? collectRelease),
+      landings: await safe(() => deps.landings ? deps.landings(now, { from, to }) : collectLandings(now, { from, to }, { repoRoot: deps.repoRoot, repoName: deps.repoName })),
+      release: await safe(deps.release ?? (() => collectWeeklyRelease(now, root))),
       issues: issues.status === 'ok' ? { status: 'ok', value: [...latest(issues.value).values()].filter(i => i.status === 'open') } : issues,
       followThrough: issues.status === 'ok' ? { status: 'ok', value: [...new Set([
         ...[...latest(issues.value, from.getTime()).values()].filter(i => i.status === 'open').map(i => i.id),
@@ -219,7 +240,7 @@ export async function runWeekly(options: { dryRun?: boolean; stage?: 'collect' |
         return { issue, outcome: Date.parse(issue.due) < now.getTime() ? '기한 넘김' as const : '진행' as const };
       }) } : issues,
       decisions: await safe(deps.decisions ?? collectDecisions),
-      news: readDailyNews(root, from, to),
+      news: readDailyNews(root, newsFrom, newsTo),
     };
     const versions = await safe(async () => publishedVersions(root, from, to));
     if (versions.status === 'unreadable') {

package/scripts/smart-merge/resync-shadow.ts

@@ -0,0 +1,147 @@
+#!/usr/bin/env bun
+import { spawnSync } from 'node:child_process';
+import { appendFileSync, mkdirSync, mkdtempSync, rmSync } from 'node:fs';
+import { homedir, tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { debug } from '../../src/debug/log.js';
+import {
+  defaultGitMergeSeam, defaultLlmResolve, mergeMainWithLlmResolve,
+  type MergeGitSeam,
+} from '../../src/autopilot/build/llm-conflict-merge.js';
+import { NEXT_MD_PATH } from '../../src/release-loop/next-md-merge.js';
+
+type Command = (cwd: string, program: 'git' | 'gh', args: readonly string[]) => { status: number; stdout: string; stderr: string };
+export type ShadowOutcome = 'clean' | 'resolved-deterministic' | 'resolved-llm' | 'unresolved' | 'unmeasured';
+export interface ShadowRow { pr: number; outcome: ShadowOutcome; files: string[]; durationMs: number }
+interface Draft { number: number; headRefName: string; isDraft: boolean; mergeable: string | boolean | null }
+
+export interface ShadowOptions {
+  repo: string;
+  stateRoot: string;
+  limit?: number;
+  run?: Command;
+  git?: MergeGitSeam;
+  resolve?: (file: string, conflicted: string) => Promise<string>;
+  log?: (line: string) => void;
+  now?: () => number;
+}
+
+export const runCommand: Command = (cwd, program, args) => {
+  const result = spawnSync(program, [...args], { cwd, encoding: 'utf8' });
+  return { status: result.status ?? 1, stdout: result.stdout ?? '', stderr: result.stderr ?? String(result.error ?? '') };
+};
+
+function mustRun(run: Command, cwd: string, program: 'git' | 'gh', args: readonly string[]): string {
+  const result = run(cwd, program, args);
+  if (result.status !== 0) throw new Error(`${program} ${args.slice(0, 3).join(' ')}: ${result.stderr || 'failed'}`);
+  return result.stdout;
+}
+
+/** Use the same harness ownership boundary as the draft sweep; never touch a non-harness PR. */
+export function conflictingHarnessDrafts(json: string): Draft[] {
+  const rows: unknown = JSON.parse(json);
+  if (!Array.isArray(rows)) throw new Error('gh PR inventory is not an array');
+  if (rows.some((row) => !row || typeof row !== 'object' || !Number.isSafeInteger(row.number)
+    || row.number <= 0 || typeof row.headRefName !== 'string' || typeof row.isDraft !== 'boolean'
+    || !('mergeable' in row) || !['string', 'boolean'].includes(typeof row.mergeable) && row.mergeable !== null)) {
+    throw new Error('gh PR inventory is incomplete');
+  }
+  return (rows as Draft[]).filter((row) => row.isDraft && row.headRefName.startsWith('self-impl/')
+    && (row.mergeable === 'CONFLICTING' || row.mergeable === false));
+}
+
+/** GitHub 는 병합 가능 여부를 늦게 계산한다 — 첫 조회에 UNKNOWN 이면 «충돌 0»이 아니라 «아직 못 잼»이다(10-05 첫 운영 실행이 조용히 0). */
+export function unknownMergeableDrafts(json: string): number {
+  const rows = JSON.parse(json) as Draft[];
+  return rows.filter((row) => row.isDraft && row.headRefName.startsWith('self-impl/') && (row.mergeable === 'UNKNOWN' || row.mergeable === null)).length;
+}
+
+export function shadowSummary(rows: readonly ShadowRow[]): string {
+  const measured = rows.filter((row) => row.outcome !== 'unmeasured');
+  const recoverable = measured.filter((row) => row.outcome !== 'unresolved').length;
+  return `충돌 draft ${measured.length} 중 살릴 수 있음 ${recoverable} = ${measured.length ? Math.round(recoverable / measured.length * 100) : 0}%`;
+}
+
+/** Shadow only: fetch a PR snapshot, detach it outside the repo, simulate merging fresh origin/main, then discard it. */
+export async function runResyncShadow(options: ShadowOptions): Promise<ShadowRow[]> {
+  const { repo, stateRoot, limit = 10, run = runCommand, log = console.log, now = Date.now } = options;
+  if (!Number.isSafeInteger(limit) || limit < 1) throw new Error('--limit must be a positive integer');
+  const rows: ShadowRow[] = [];
+  const output = join(stateRoot, 'smart-merge', 'resync-shadow.jsonl');
+  const record = (row: ShadowRow): void => {
+    mkdirSync(dirname(output), { recursive: true });
+    appendFileSync(output, `${JSON.stringify(row)}\n`);
+    rows.push(row);
+    debug.log('smart-merge.resync', 'shadow-result', { pr: row.pr, outcome: row.outcome, files: row.files });
+  };
+  let drafts: Draft[];
+  try {
+    // gh's mergeable GraphQL field is CONFLICTING/MERGEABLE/UNKNOWN (some adapters return false/true).
+    const inventory = mustRun(run, repo, 'gh', [
+      'pr', 'list', '--state', 'open', '--limit', '1000', '--json', 'number,isDraft,headRefName,mergeable',
+    ]);
+    drafts = conflictingHarnessDrafts(inventory).slice(0, limit);
+    const unknown = unknownMergeableDrafts(inventory);
+    if (unknown) log(`병합 가능 여부 미계산 draft ${unknown} — GitHub 계산 뒤 다시 돌려라(이번 수에 안 들어감)`);
+  } catch (error) {
+    log(`못 잼: GitHub draft 조회 실패 (${String(error)})`);
+    log(shadowSummary(rows));
+    return rows;
+  }
+  for (const draft of drafts) {
+    const start = now();
+    let temp: string | undefined;
+    let attached = false;
+    let outcome: ShadowOutcome = 'unmeasured';
+    let files: string[] = [];
+    try {
+      // refs/pull/N/head supports fork heads too; FETCH_HEAD is consumed before the next fetch.
+      mustRun(run, repo, 'git', ['fetch', 'origin', `refs/pull/${draft.number}/head`]);
+      temp = mkdtempSync(join(tmpdir(), 'elanous-resync-shadow-'));
+      mustRun(run, repo, 'git', ['worktree', 'add', '--detach', temp, 'FETCH_HEAD']);
+      attached = true;
+      const seam = options.git ?? defaultGitMergeSeam();
+      const observedGit: MergeGitSeam = {
+        ...seam,
+        conflictedFiles: (wt) => { files = seam.conflictedFiles(wt); return files; },
+      };
+      const result = await mergeMainWithLlmResolve(temp, 'origin/main',
+        options.resolve ?? ((file, conflicted) => defaultLlmResolve(file, conflicted, 'origin/main', { worktreePath: temp })), observedGit);
+      if (result.status === 'merged' || result.status === 'up-to-date') outcome = 'clean';
+      else if (result.status === 'llm-resolved') {
+        files = result.resolvedFiles ?? files;
+        outcome = files.length > 0 && files.every((file) => file === NEXT_MD_PATH) ? 'resolved-deterministic' : 'resolved-llm';
+      } else if (result.status === 'conflict-unresolved') outcome = 'unresolved';
+      // A git error is a measurement failure, not evidence of an unresolvable conflict.
+    } catch {
+      outcome = 'unmeasured';
+    } finally {
+      if (attached && temp) {
+        try { mustRun(run, repo, 'git', ['worktree', 'remove', '--force', temp]); }
+        catch { outcome = 'unmeasured'; }
+      }
+      if (temp) {
+        try { rmSync(temp, { recursive: true, force: true }); }
+        catch { outcome = 'unmeasured'; }
+      }
+      record({ pr: draft.number, outcome, files, durationMs: Math.max(0, now() - start) });
+    }
+  }
+  log(shadowSummary(rows));
+  return rows;
+}
+
+if (import.meta.main) {
+  const args = process.argv.slice(2);
+  const valid = args.length === 0 || args.length === 2 && args[0] === '--limit' && /^[1-9]\d*$/.test(args[1]!);
+  if (!valid) {
+    console.error('usage: bun scripts/smart-merge/resync-shadow.ts [--limit N]');
+    process.exitCode = 2;
+  } else {
+    await runResyncShadow({
+      repo: mustRun(runCommand, process.cwd(), 'git', ['rev-parse', '--show-toplevel']).trim(),
+      stateRoot: process.env.ELANOUS_STATE_DIR || join(homedir(), '.elanous'),
+      ...(args.length ? { limit: Number(args[1]) } : {}),
+    });
+  }
+}

package/src/acp/client.ts

@@ -302,7 +302,7 @@ const ACP_FORCED_BILLING_ENV_BY_BACKEND: Readonly<Record<string, Readonly<Record
 };
 
 function scrubAcpBillingEnv(spec: AcpBackendSpec, env: NodeJS.ProcessEnv): AcpBillingEnvScrubObservation {
-  const billingEnvScrubEnabled = getUserConfig().acp.scrubBillingEnv !== false;
+  const billingEnvScrubEnabled = spec.id === 'claude' || getUserConfig().acp.scrubBillingEnv !== false;
   const scrubbedBillingEnv: string[] = [];
   const forcedBillingEnv: string[] = [];
   if (billingEnvScrubEnabled) {
@@ -378,6 +378,8 @@ export interface AcpAgentOpts {
   /** Extra env vars to pass to the subprocess. Inherits from
    *  process.env unless overridden. */
   env?: Record<string, string>;
+  /** Test seam: replace the child process without launching Claude. */
+  spawnChild?: typeof spawn;
   /** Session-scoped Codex app-server configuration arguments. Ignored by
    *  non-Codex ACP backends. */
   codexArgs?: readonly string[];
@@ -419,6 +421,7 @@ export class AcpAgent {
   private readonly spec: AcpBackendSpec;
   private readonly cwd: string;
   private readonly env: NodeJS.ProcessEnv;
+  private readonly spawnChild: typeof spawn;
   private readonly billingEnvScrub: AcpBillingEnvScrubObservation;
   private readonly log: (msg: string) => void;
   private readonly onCapabilities: ((capabilities: ElanousCapabilities) => void) | undefined;
@@ -461,6 +464,7 @@ export class AcpAgent {
     }
     this.billingEnvScrub = scrubAcpBillingEnv(this.spec, cleanEnv);
     this.env = cleanEnv;
+    this.spawnChild = opts.spawnChild ?? spawn;
     this.log = opts.log ?? ((m) => console.error(`[acp:${this.spec.id}] ${m}`));
     this.onCapabilities = opts.onCapabilities;
     this.permissionApprover = opts.permissionApprover ?? null;
@@ -501,7 +505,18 @@ export class AcpAgent {
       throw new Error(`acp spawn: cwd does not exist: ${this.cwd}`);
     }
 
-    const child = spawn(resolvedBin.path, this.spec.args, {
+    if (this.spec.id === 'claude') {
+      const remaining = (claudeBackend.scrubEnv ?? []).filter(key => key in this.env);
+      debug.log('acp.claude', 'auth-source', {
+        apiKeyPresent: remaining.length > 0,
+        source: remaining.length > 0 ? 'billing-env' : 'subscription',
+      });
+      if (remaining.length > 0 && process.env.NODE_ENV !== 'test' && !process.env.ELANOUS_TEST_HOME) {
+        throw new Error('ACP Claude refused: billing authentication environment remains after scrub');
+      }
+    }
+
+    const child = this.spawnChild(resolvedBin.path, this.spec.args, {
       cwd: this.cwd,
       env: this.env,
       stdio: ['pipe', 'pipe', 'pipe'],

package/src/agent-env/profile.ts

@@ -0,0 +1,161 @@
+import { existsSync, readFileSync, readdirSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+
+type Agent = 'claude' | 'codex' | 'grok';
+type Presence = 'present' | '«없음»';
+
+function present(path: string): Presence {
+  return existsSync(path) ? 'present' : '«없음»';
+}
+
+function record(value: unknown): Record<string, unknown> {
+  return value !== null && typeof value === 'object' && !Array.isArray(value)
+    ? value as Record<string, unknown> : {};
+}
+
+function json(path: string): Record<string, unknown> | null {
+  if (!existsSync(path)) return null;
+  return record(JSON.parse(readFileSync(path, 'utf8')));
+}
+
+// Command strings can contain tokens even without a shell; export only known executable names.
+function safeCommand(value: unknown): string | undefined {
+  if (typeof value !== 'string') return undefined;
+  return /^(?:npx|npm|node|bun|uv|uvx|python|python3|docker|deno|pnpm|yarn|bash|sh|claude|codex|grok|cct)$/.test(value)
+    ? value : '<redacted>';
+}
+
+// Key-shaped values (sk-…, ghp_…, AKIA…) pass the character check, so shape alone cannot prove a value is not a secret (10-05 post-review).
+const SECRET_PREFIX = /^(?:sk-|sk_|pk_|rk_|xai-|ghp_|gho_|ghu_|ghs_|ghr_|github_pat_|glpat-|AKIA|ASIA|AIza|ya29\.|xox[abprs]-|eyJ)/;
+
+export function safeIdentifier(value: unknown): string | null {
+  if (typeof value !== 'string') return null;
+  const digits = (value.match(/[0-9]/g) ?? []).length;
+  const keyShaped = SECRET_PREFIX.test(value) || value.length > 40 || (value.length >= 20 && digits >= 8);
+  return /^[a-zA-Z0-9_.:-]{1,90}$/.test(value) && !keyShaped && !/(?:token|secret|password|api.?key|credential)/i.test(value)
+    ? value : '<redacted>';
+}
+
+type McpSource = 'settings' | 'user' | 'project';
+
+function mcpEntry(server: unknown, source: McpSource): Record<string, unknown> {
+  const body = record(server);
+  return {
+    source,
+    command: safeCommand(body.command) ?? null,
+    env: Object.fromEntries(Object.keys(record(body.env)).map(key => [key, '<redacted>'])),
+    headers: Object.fromEntries(Object.keys(record(body.headers)).map(key => [key, '<redacted>'])),
+  };
+}
+
+function collectMcp(
+  into: Record<string, unknown>,
+  servers: unknown,
+  source: McpSource,
+): void {
+  for (const [name, server] of Object.entries(record(servers))) into[name] = mcpEntry(server, source);
+}
+
+function hookGroups(hooks: Record<string, unknown>): Record<string, unknown[]> {
+  return Object.fromEntries(Object.entries(hooks).map(([event, groups]) => [event,
+    Array.isArray(groups) ? groups.map(group => {
+      const body = record(group);
+      const entries = body.hooks;
+      return {
+        matcher: safeIdentifier(body.matcher),
+        hooks: Array.isArray(entries)
+          ? entries.map(entry => ({ command: safeCommand(record(entry).command) ?? null }))
+          : [],
+      };
+    }) : [],
+  ]));
+}
+
+function claude(home: string): Record<string, unknown> {
+  const dir = join(home, '.claude');
+  const settingsPath = join(dir, 'settings.json');
+  const userPath = join(home, '.claude.json');
+  const settings = json(settingsPath);
+  const user = json(userPath);
+  const data = record(settings);
+  const userData = record(user);
+  const plugins = record(data.enabledPlugins);
+  const hooks = record(data.hooks);
+  const statusLine = record(data.statusLine);
+  const skillsDir = join(dir, 'skills');
+  const team = join(home, '.teamclaude');
+  const teamManifest = json(join(team, 'package.json'));
+  const teamVersion = typeof teamManifest?.version === 'string' && /^\d+\.\d+\.\d+(?:[-+.][a-zA-Z0-9.-]+)?$/.test(teamManifest.version)
+    ? teamManifest.version : undefined;
+  const mcp: Record<string, unknown> = {};
+  if (settings !== null) collectMcp(mcp, data.mcpServers, 'settings');
+  if (user !== null) {
+    collectMcp(mcp, userData.mcpServers, 'user');
+    for (const project of Object.values(record(userData.projects))) {
+      collectMcp(mcp, record(project).mcpServers, 'project');
+    }
+  }
+  const mcpFilesMissing = settings === null && user === null;
+  return {
+    settings: settings === null ? '«없음»' : 'present',
+    userConfig: user === null ? '«없음»' : 'present',
+    permissionMode: safeIdentifier(record(data.permissions).defaultMode),
+    statusLine: settings === null ? '«없음»' : data.statusLine === undefined ? '«없음»' : {
+      type: safeIdentifier(statusLine.type),
+      command: safeCommand(statusLine.command) ?? null,
+    },
+    hooks: settings === null ? '«없음»' : hookGroups(hooks),
+    enabledPlugins: settings === null ? '«없음»' : Object.fromEntries(Object.entries(plugins).map(([name, enabled]) => [name, enabled === true])),
+    mcpServers: mcpFilesMissing ? '«없음»' : mcp,
+    skills: !existsSync(skillsDir) ? '«없음»' : readdirSync(skillsDir, { withFileTypes: true })
+      .filter(entry => entry.isDirectory()).map(entry => entry.name).sort(),
+    teamclaude: { installed: present(team), version: teamVersion ?? null },
+    auth: present(join(dir, 'auth.json')),
+    credentials: present(join(dir, '.credentials.json')),
+  };
+}
+
+function codex(home: string): Record<string, unknown> {
+  const dir = join(home, '.codex');
+  const file = join(dir, 'config.toml');
+  if (!existsSync(file)) return { config: '«없음»', model: null, profile: null, mcpServers: '«없음»', auth: present(join(dir, 'auth.json')) };
+  const data = record(Bun.TOML.parse(readFileSync(file, 'utf8')));
+  const mcp = record(data.mcp_servers);
+  return {
+    config: 'present',
+    model: safeIdentifier(data.model),
+    profile: safeIdentifier(data.profile),
+    mcpServers: Object.keys(mcp).sort(),
+    auth: present(join(dir, 'auth.json')),
+  };
+}
+
+function grok(home: string): Record<string, unknown> {
+  const dir = join(home, '.grok');
+  const jsonPath = join(dir, 'config.json');
+  const tomlPath = join(dir, 'config.toml');
+  const file = existsSync(jsonPath) ? jsonPath : tomlPath;
+  const data = !existsSync(file) ? null : file === jsonPath ? json(file) : record(Bun.TOML.parse(readFileSync(file, 'utf8')));
+  return {
+    config: data === null ? '«없음»' : 'present',
+    keys: data === null ? '«없음»' : Object.keys(data).sort(),
+    auth: present(join(dir, 'auth.json')),
+    credentials: present(join(dir, 'credentials.json')),
+  };
+}
+
+export function captureAgentEnv(options: { agent?: Agent; home?: string; now?: Date } = {}): {
+  version: number; capturedAt: string; agents: Record<string, Record<string, unknown>>;
+} {
+  const home = options.home ?? homedir();
+  const selected = options.agent ? [options.agent] : ['claude', 'codex', 'grok'] as const;
+  const agents: Record<string, Record<string, unknown>> = {};
+  for (const agent of selected) {
+    if (agent === 'claude') agents.claude = claude(home);
+    else if (agent === 'codex') agents.codex = codex(home);
+    else if (agent === 'grok') agents.grok = grok(home);
+    else throw new Error('Unknown agent');
+  }
+  return { version: 1, capturedAt: (options.now ?? new Date()).toISOString(), agents };
+}

package/src/agent-mission/driver.ts

@@ -15,6 +15,8 @@ import { join, relative, resolve, isAbsolute, sep } from 'node:path';
 import { startPty, mintPtyId, onPtyEvent, type PtyHandle, type StartOpts } from '../pty-shell/registry.js';
 import { withChildPtyIdentity } from '../agent/pty-identity.js';
 import { NESTED_AGENT_ENV_BLOCKLIST } from '../agent/nested-agent-env.js';
+import { getNestDepth } from '../agent/nest-depth.js';
+import { gateNestedElanousLaunch, nestedDepthCodexArgs, readNestedElanousDepth } from '../harness/nested-elanous-policy.js';
 import { createWorktree, resolveMainRepoRoot, type CreateWorktreeOpts } from '../git-fs/worktree.js';
 import { configuredWorktreeRoot } from '../user-config.js';
 import { worktreeHasChanges, commitWorktree, changedFiles } from '../self-implement/seams.js';
@@ -321,7 +323,36 @@ export function resolveBackendSpawn(
   // 지운 키 이름 — PTY 합성이 로그인 셸 캡처본에서 되살리지 않게 그대로 넘긴다(강제 env 로 다시 넣은 키는 뺀다).
   //   ⚠️ 과금 스크럽 키만 — 중첩 표지는 정체성 allowlist 가 다시 싣는 키가 있어 이 PR 의 범위 밖이다.
   const unsetEnv = [...new Set(backend.scrubEnv ?? [])].filter((k) => !(k in env));
-  return { cmd: backend.cmd, args: [...backend.args], env, unsetEnv, nestedEnvRemovedCount, forcedEnv };
+  // Codex drops parent env under shell_environment_policy inherit=core, so the nested-depth
+  // marker rides on argv (`-c shell_environment_policy.set.ELANOUS_NESTED_DEPTH=<child>`).
+  // Backends that cannot carry it are refused only when a nested elanous launch was requested.
+  const args = [...backend.args, ...nestedDepthCodexArgs(backend.name, getNestDepth() + 1)];
+  return { cmd: backend.cmd, args, env, unsetEnv, nestedEnvRemovedCount, forcedEnv };
+}
+
+/**
+ * Refuse a requested nested elanous launch when this backend cannot carry the depth marker.
+ * Unset depth is 0. A normal mission spawn (`nestedLaunchRequested: false`) is never refused here.
+ */
+export function refuseNestedElanousOnBackend(input: {
+  readonly backendName: string;
+  readonly nestedLaunchRequested: boolean;
+  readonly allow?: boolean;
+  readonly configAllow?: boolean;
+  readonly env?: Record<string, string | undefined>;
+}): { readonly refused: boolean; readonly reason?: string; readonly depth: number } {
+  const depth = readNestedElanousDepth(input.env);
+  const decision = gateNestedElanousLaunch({
+    backendName: input.backendName,
+    depth,
+    nestedLaunchRequested: input.nestedLaunchRequested,
+    ...(input.allow === true ? { allow: true } : {}),
+    ...(input.configAllow === true ? { configAllow: true } : {}),
+  });
+  if (input.nestedLaunchRequested && !decision.allowed) {
+    return { refused: true, reason: decision.reason, depth };
+  }
+  return { refused: false, depth };
 }
 
 /** Build the mission PTY options after identity is preallocated for child env propagation. */
@@ -491,6 +522,12 @@ export interface AgentMissionSpec {
   memory?: boolean;
   /** PTY 닉네임(휴먼 리더블·goto 로 나중 접근). 기본 branch. */
   nickname?: string;
+  /**
+   * True only when this mission is itself a nested elanous launch.
+   * A backend that cannot carry the depth marker is then refused.
+   * Absent means an ordinary mission spawn — never refused for a missing marker.
+   */
+  nestedElanousLaunch?: boolean;
   /** Concurrent missions may share one decision stream alias without sharing a PTY or worktree. */
   decisionMissionId?: string;
   /** ⭐⭐ 그 브랜치를 이미 쥔 «소유» 워크트리가 있으면 지우지 말고 그대로 재사용하라고 요청한다
@@ -1534,6 +1571,19 @@ async function runAgentMissionBody(spec: AgentMissionSpec, deps: AgentMissionDep
   // 구독 모드 — backend 지정 env 키 스크럽 후 강제 env까지 적용해 cmd·args·env를 순수 seam으로 구성한다.
   // forcedEnv 이름의 후속 로깅은 이 착지의 의도적 경계이며, spawn에는 같은 seam의 env가 그대로 흐른다.
   const spawnParams = resolveBackendSpawn(backend, process.env);
+  const nestedRefusal = refuseNestedElanousOnBackend({
+    backendName: backend.name,
+    nestedLaunchRequested: spec.nestedElanousLaunch === true,
+    env: process.env,
+  });
+  if (nestedRefusal.refused) {
+    debug.log('agent-mission.nested', 'refused', { agent: backend.name, depth: nestedRefusal.depth, reason: nestedRefusal.reason });
+    return {
+      ok: false, worktree: spec.workdir ?? '', branch: spec.branch ?? null, rounds: 0,
+      evidencePath: null, committed: false, usedOmniCrawl: false,
+      detail: `nested elanous refused (${nestedRefusal.reason})`,
+    };
+  }
   const env = spawnParams.env;
   if (backend.name === 'claude') {
     const status = (deps.checkClaudeSubscription ?? checkClaudeSubscription)({ env });

package/src/agent-mission/supervisor-metrics-cli.ts

@@ -0,0 +1,40 @@
+import type { Command } from 'commander';
+import { parseSince } from '../cli/logs-cli.js';
+import {
+  SUPERVISOR_METRICS_DEFAULT_SINCE,
+  formatSupervisorMetrics,
+  loadSupervisorMetrics,
+  type ReadSupervisorLogs,
+} from './supervisor-metrics.js';
+
+export interface SupervisorMetricsCliDeps {
+  readonly read?: ReadSupervisorLogs;
+  readonly write?: (text: string) => void;
+  readonly nowMs?: number;
+}
+
+export function registerSupervisorMetricsCommand(parent: Command, deps: SupervisorMetricsCliDeps = {}): Command {
+  return parent.command('metrics')
+    .description('외부 에이전트 미션 슈퍼바이저 품질 지표 — 이미 남은 미션 기록만 읽는다')
+    .option('--since <window>', '조회 창 (30s/15m/2h/7d · 기본 7d)', SUPERVISOR_METRICS_DEFAULT_SINCE)
+    .option('--json', 'JSON 출력')
+    .action((opts: { since?: string; json?: boolean }) => {
+      const since = opts.since?.trim() || SUPERVISOR_METRICS_DEFAULT_SINCE;
+      const nowMs = deps.nowMs ?? Date.now();
+      const relative = /^(\d+)(s|m|h|d)$/.exec(since);
+      const unitMs = { s: 1_000, m: 60_000, h: 3_600_000, d: 86_400_000 } as const;
+      // parseSince returns an absolute epoch (including for relative inputs); anchor relative windows to this invocation's clock.
+      const sinceMs = relative
+        ? nowMs - Number(relative[1]) * unitMs[relative[2] as keyof typeof unitMs]
+        : parseSince(since);
+      const write = deps.write ?? ((text: string) => { process.stdout.write(text); });
+      if (sinceMs === null || !Number.isFinite(sinceMs)) {
+        write(`--since 를 읽지 못함: ${since}\n`);
+        process.exitCode = 2;
+        return;
+      }
+      const report = loadSupervisorMetrics(since, sinceMs, nowMs, deps.read);
+      if (opts.json) write(`${JSON.stringify(report)}\n`);
+      else write(`${formatSupervisorMetrics(report)}\n`);
+    });
+}