elanous 0.2.16 → 0.2.18

package/scripts/rhythm/daily.ts

@@ -301,8 +301,9 @@ function recipient(deps: DailyDeps): { chatId: number; botToken: string } | null
 function sendReview(file: string, text: string, target: { chatId: number; botToken: string },
   send: (request: DailySendRequest) => DailySendConfirmation | null,
   receipt: (key: string) => DeliveryReceipt,
-  recordDelivery?: (text: string, kind: 'ops-report') => void): DeliveryResult {
-  const key = file.slice(file.lastIndexOf('/') + 1).replace(/\.md$/, '');
+  recordDelivery?: (text: string, kind: 'ops-report') => void,
+  keySuffix = ''): DeliveryResult {
+  const key = file.slice(file.lastIndexOf('/') + 1).replace(/\.md$/, '') + keySuffix;
   const label = `telegram:${target.chatId}`;
   const db = new Database(join(dirname(file), 'delivery.sqlite'));
   try {
@@ -346,6 +347,21 @@ function sendReview(file: string, text: string, target: { chatId: number; botTok
   finally { db.close(); }
 }
 
+function newsMessage(markdown: string): string | null {
+  const section = markdown.split('## ⑦ 외부 동향\n')[1]?.split('\n\n## ')[0];
+  if (!section || section.startsWith('못 읽음 ·')) return null;
+  const articles = [...section.matchAll(/^- (.+) — (https?:\/\/\S+)\n  시사점: (.*)$/gm)].slice(0, 3);
+  return articles.length ? `## 외부 동향\n${articles.map(article => article[0]).join('\n')}` : null;
+}
+
+function sendNewsAfterReview(delivery: DeliveryResult, file: string, markdown: string,
+  target: { chatId: number; botToken: string }, deps: DailyDeps): string | null {
+  if (!['sent', 'already-sent', 'receipt-sent'].includes(delivery.deliveryState)) return null;
+  const text = newsMessage(markdown);
+  if (!text) return null;
+  return sendReview(file, text, target, deps.send ?? sendTelegram, deps.receipt ?? (() => 'unknown'), deps.recordDelivery, '-news').deliveryState;
+}
+
 export type DailyDeps = { now?: () => Date; root?: string; vaultRoot?: string | null; sendEnabled?: boolean; repoRoot?: string; repoName?: string;
   landings?: (now: Date) => Promise<Landing[]>; release?: () => Promise<Release>; loops?: () => Promise<Loop[]>;
   grid?: () => Promise<Seat[]>; decisions?: () => Promise<Pending[]>; news?: () => Promise<News[]>;
@@ -402,6 +418,7 @@ export async function runDaily(options: { dryRun?: boolean; noNews?: boolean; st
     let target = 'unknown';
     let sendError: string | null = null;
     let recordError: string | null = null;
+    let newsState: string | null = null;
     let enabled = deps.sendEnabled === true;
     if (deps.sendEnabled === undefined && options.stage === 'deliver' && !options.dryRun) {
       try { enabled = record(record(record(getUserConfig().raw.loops).rhythm).daily).send === true; }
@@ -420,12 +437,13 @@ export async function runDaily(options: { dryRun?: boolean; noNews?: boolean; st
       sendError = sendError ?? delivery.sendError;
       recordError = delivery.recordError ?? null;
       deliveryState = delivery.deliveryState;
+      if (resolved) newsState = sendNewsAfterReview(delivery, file, markdown, resolved, deps);
     }
     tick.sent = sent;
     const status = vault.vaultFatal || Object.values(sections).includes('unreadable') ? 'degraded'
       : deliveryState === 'pending' ? 'pending'
       : ['sent', 'already-sent', 'receipt-sent'].includes(deliveryState) ? 'ok' : 'degraded';
-    const deliveryLine = `${options.stage} ${status} · target=${target} · ${deliveryState} · sent=${sent} · chars=${chars} · receipt=${receiptKey}${recordError ? ` · ${recordError}` : ''}`;
+    const deliveryLine = `${options.stage} ${status} · target=${target} · ${deliveryState} · sent=${sent} · chars=${chars} · receipt=${receiptKey}${recordError ? ` · ${recordError}` : ''}${newsState ? ` · news=${newsState}` : ''}`;
     if (options.stage === 'deliver') {
       Object.assign(tick, { status, deliveryState, target, chars, receiptKey, deliveryLine, recordError });
       if (!options.dryRun) {
@@ -526,6 +544,7 @@ export async function runDaily(options: { dryRun?: boolean; noNews?: boolean; st
   }
   let sent = false;
   let recordError: string | null = null;
+  let newsState: string | null = null;
   let chars = 0;
   let target = 'unknown';
   if (!options.dryRun && options.stage !== 'collect' && enabled) {
@@ -541,11 +560,13 @@ export async function runDaily(options: { dryRun?: boolean; noNews?: boolean; st
     sendError = sendError ?? delivery.sendError;
     recordError = delivery.recordError ?? null;
     deliveryState = delivery.deliveryState;
+    if (resolved && parts.news.status === 'ok' && parts.news.value.length > 0)
+      newsState = sendNewsAfterReview(delivery, file, review.markdown, resolved, deps);
   }
   const status = vaultFatal || Object.values(review.sections).includes('unreadable') ? 'degraded'
     : deliveryState === 'pending' ? 'pending'
     : ['sent', 'already-sent', 'receipt-sent'].includes(deliveryState) ? 'ok' : 'degraded';
-  const deliveryLine = `${options.stage === 'collect' ? 'collect' : 'deliver'} ${status} · target=${target} · ${deliveryState} · sent=${sent} · chars=${chars} · receipt=${receiptKey}${recordError ? ` · ${recordError}` : ''}`;
+  const deliveryLine = `${options.stage === 'collect' ? 'collect' : 'deliver'} ${status} · target=${target} · ${deliveryState} · sent=${sent} · chars=${chars} · receipt=${receiptKey}${recordError ? ` · ${recordError}` : ''}${newsState ? ` · news=${newsState}` : ''}`;
   if (options.stage !== 'collect') {
     const tick = { sections: review.sections, risks: review.risks.length, sent, status, deliveryState, target, chars, receiptKey, deliveryLine, recordError };
     if (!options.dryRun) {

package/scripts/skills/public-check.ts

@@ -1,13 +1,14 @@
 #!/usr/bin/env bun
-/** Static readiness inventory for the public (core) skills; never executes a skill. */
-import { existsSync, lstatSync, readdirSync, readFileSync } from 'node:fs';
-import { join, relative } from 'node:path';
+/** Public (core) skill readiness inventory; optional builds never execute a skill. */
+import { cpSync, existsSync, lstatSync, mkdtempSync, readdirSync, readFileSync, realpathSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { basename, isAbsolute, join, relative, sep, win32 } from 'node:path';
 import { computeSkillBoundaries, type SkillBoundaryReport } from '../skill-boundary.js';
 
 export type PublicCheckKey = 'header' | 'entry' | 'free' | 'portable' | 'install';
 export interface PublicSkillRow {
   readonly skill: string;
-  readonly checks: Readonly<Record<PublicCheckKey, boolean | 'N/A'>>;
+  readonly checks: Readonly<Record<PublicCheckKey, boolean | 'N/A'> & { build?: SkillBuildResult }>;
   readonly violations: readonly string[];
 }
 export interface PublicCheckReport {
@@ -68,6 +69,44 @@ function executableEntries(files: readonly string[], dir: string, docs: string):
     && (commanded.has(file) || file.startsWith('bin/') || ENTRY_NAME.test(file)));
 }
 
+export type SkillBuildResult = 'OK' | 'FAIL' | 'N/A';
+
+/** Build only selected TS/JS entries from an isolated skill copy, never from the repository. */
+export function buildSkillEntries(
+  dir: string,
+  entries: readonly string[],
+  run: (args: string[], cwd: string) => boolean = (args, cwd) => Bun.spawnSync(args, {
+    cwd, stdout: 'ignore', stderr: 'ignore',
+  }).exitCode === 0,
+): SkillBuildResult {
+  const buildable = entries.filter((entry) => /\.(?:ts|tsx|js|mjs|cjs)$/iu.test(entry));
+  if (buildable.length === 0) return 'N/A';
+  if (buildable.some((entry) => isAbsolute(entry) || win32.isAbsolute(entry) || entry.split(/[\\/]/u).includes('..'))) return 'FAIL';
+  const temp = mkdtempSync(join(tmpdir(), 'skill-public-build-'));
+  try {
+    const skill = join(temp, 'skill');
+    cpSync(dir, skill, {
+      recursive: true,
+      filter: (source) => source === dir || !['.git', 'node_modules', '__pycache__'].includes(basename(source)) && !lstatSync(source).isSymbolicLink(),
+    });
+    const copiedRoot = realpathSync(skill);
+    for (const entry of buildable) {
+      const target = realpathSync(join(skill, entry));
+      const inside = relative(copiedRoot, target);
+      if (inside === '..' || inside.startsWith(`..${sep}`) || isAbsolute(inside) || !lstatSync(target).isFile()) return 'FAIL';
+    }
+    if (existsSync(join(skill, 'package.json')) && !run(['bun', 'install', '--ignore-scripts'], skill)) return 'FAIL';
+    for (const [index, entry] of buildable.entries()) {
+      if (!run(['bun', 'build', entry, '--target=bun', '--outfile', join(temp, `entry-${index}.js`)], skill)) return 'FAIL';
+    }
+    return 'OK';
+  } catch {
+    return 'FAIL';
+  } finally {
+    rmSync(temp, { recursive: true, force: true });
+  }
+}
+
 function freeValid(doc: string, entries: ReadonlySet<string>): boolean {
   const section = /(?:^|\n)#{1,4}\s*[^\n]*(?:무료|free)[^\n]*\n([\s\S]*?)(?=\n#{1,4}\s|$)/giu;
   for (const match of doc.matchAll(section)) {
@@ -97,7 +136,7 @@ function installValid(doc: string, dir: string): boolean {
 }
 
 /** `boundary` is injectable for pure fixture tests; production always derives it from the repository. */
-export function checkPublicSkills(root: string, boundary: SkillBoundaryReport = computeSkillBoundaries(root)): PublicCheckReport {
+export function checkPublicSkills(root: string, boundary: SkillBoundaryReport = computeSkillBoundaries(root), build = false): PublicCheckReport {
   const errors = [...boundary.errors];
   const skills: PublicSkillRow[] = [];
   const skillsDir = join(root, 'skills');
@@ -133,6 +172,7 @@ export function checkPublicSkills(root: string, boundary: SkillBoundaryReport =
       free: freeValid(docs, entries),
       portable: matches.length === 0,
       install: installValid(docs, dir),
+      ...(build ? { build: buildSkillEntries(dir, [...entries]) } : {}),
     };
     const violations = [
       ...(!checks.header ? ['SKILL.md 머리(name·description) 없음/불일치'] : []),
@@ -140,6 +180,7 @@ export function checkPublicSkills(root: string, boundary: SkillBoundaryReport =
       ...(!checks.free ? ['키/.env 없이 쓰는 무료 경로가 문서에 없음'] : []),
       ...matches.map((file) => `${file}: 개인 경로/내부 표지 문자열`),
       ...(!checks.install ? ['의존 manifest와 문서의 한 줄 설치 명령이 없음'] : []),
+      ...(checks.build === 'FAIL' ? ['스킬 실행 파일 빌드 실패'] : []),
     ];
     skills.push({ skill, checks, violations });
   }
@@ -147,23 +188,32 @@ export function checkPublicSkills(root: string, boundary: SkillBoundaryReport =
 }
 
 export function formatPublicCheck(report: PublicCheckReport): string {
-  const columns: PublicCheckKey[] = ['header', 'entry', 'free', 'portable', 'install'];
+  const columns: (PublicCheckKey | 'build')[] = ['header', 'entry', 'free', 'portable', 'install'];
+  if (report.skills.some((row) => row.checks.build !== undefined)) columns.push('build');
   return [
     `skill                              ${columns.map((key) => key.padEnd(9)).join(' ')} result`,
-    ...report.skills.map((row) => `${row.skill.padEnd(34)} ${columns.map((key) => (row.checks[key] === 'N/A' ? 'N/A' : row.checks[key] ? 'OK' : 'FAIL').padEnd(9)).join(' ')} ${row.violations.length ? row.violations.join('; ') : 'OK'}`),
+    ...report.skills.map((row) => `${row.skill.padEnd(34)} ${columns.map((key) => { const value = row.checks[key]; return (typeof value === 'string' ? value : value ? 'OK' : 'FAIL').padEnd(9); }).join(' ')} ${row.violations.length ? row.violations.join('; ') : 'OK'}`),
     ...report.errors.map((error) => `ERROR ${error}`),
     `PUBLIC-CHECK ${report.ok ? 'PASS' : 'FAIL'} (${report.skills.length} public skills)`,
   ].join('\n');
 }
 
+export function runPublicCheck(root: string, args: readonly string[], boundary?: SkillBoundaryReport): { output: string; exitCode: number } {
+  const report = checkPublicSkills(root, boundary, args.includes('--build'));
+  return {
+    output: args.includes('--json') ? JSON.stringify(report, null, 2) : formatPublicCheck(report),
+    exitCode: report.ok ? 0 : 1,
+  };
+}
+
 if (import.meta.main) {
   const args = process.argv.slice(2);
-  if (args.some((arg) => arg !== '--json')) {
-    console.error('Usage: bun scripts/skills/public-check.ts [--json]');
+  if (args.some((arg) => arg !== '--json' && arg !== '--build')) {
+    console.error('Usage: bun scripts/skills/public-check.ts [--json] [--build]');
     process.exitCode = 2;
   } else {
-    const report = checkPublicSkills(join(import.meta.dir, '..', '..'));
-    console.log(args.includes('--json') ? JSON.stringify(report, null, 2) : formatPublicCheck(report));
-    if (!report.ok) process.exitCode = 1;
+    const result = runPublicCheck(join(import.meta.dir, '..', '..'), args);
+    console.log(result.output);
+    process.exitCode = result.exitCode;
   }
 }

package/scripts/test-deterministic.ts

@@ -57,7 +57,10 @@ const HARNESS_TEST_ENV_KEYS = [
 // Discovery: rg -n "process\.env\.ELANOUS_(HOST|RUN|ORIGIN|SUPERVISOR|PARENT)" src
 // These are ambient execution identities, not inputs to a deterministic test.
 // debug.log also attributes SUBSTRATE and ARM_ID to every plain-object record.
-const GIT_LOCATION_ENV_KEYS = ['GIT_DIR', 'GIT_WORK_TREE', 'GIT_COMMON_DIR'] as const;
+export const GIT_LOCATION_ENV_KEYS = [
+  'GIT_DIR', 'GIT_WORK_TREE', 'GIT_COMMON_DIR', 'GIT_INDEX_FILE',
+  'GIT_OBJECT_DIRECTORY', 'GIT_ALTERNATE_OBJECT_DIRECTORIES',
+] as const;
 
 const EXECUTION_ORIGIN_ENV_KEYS = [
   'ELANOUS_HOST_ID',
@@ -123,7 +126,7 @@ export type DeterministicRunnerDeps = {
   childGraceMs?: number;
   killProcessGroup?: KillProcessGroup;
   getProcessGroupId?: GetProcessGroupId;
-  gitConfig?: (cwd: string, args: string[]) => string;
+  gitConfig?: (cwd: string, args: string[]) => string | undefined;
 };
 
 export function isLivePid(pid: number): boolean {
@@ -273,14 +276,17 @@ export async function terminateDirectChild(
   reportVisible(`failed to terminate child pid=${pid}`, report);
 }
 
-function gitConfig(cwd: string, args: string[]): string {
+function gitConfig(cwd: string, args: string[]): string | undefined {
   const env = { ...process.env };
   for (const key of GIT_LOCATION_ENV_KEYS) delete env[key];
   const result = spawnSync('git', args, { cwd, env, encoding: 'utf8' });
   if (result.error || (result.status !== 0 && !(result.status === 1 && args.includes('--get-all') && !result.stderr))) {
     throw new Error(`git ${args.join(' ')} failed: ${result.error?.message ?? result.stderr}`);
   }
-  return result.stdout.trim();
+  if (result.status === 1) return undefined;
+  // --null --get-all terminates each complete value with NUL, even when
+  // a value itself contains newlines or is empty.
+  return args.includes('--get-all') ? result.stdout : result.stdout.trim();
 }
 
 export function prepareIsolatedTestEnv(sourceEnv: NodeJS.ProcessEnv, testRoot: string): NodeJS.ProcessEnv {
@@ -406,33 +412,45 @@ export async function runDeterministicTests(deps: DeterministicRunnerDeps = {}):
   const cwd = deps.cwd ?? process.cwd();
   const config = deps.gitConfig ?? gitConfig;
   const commonDir = config(cwd, ['rev-parse', '--path-format=absolute', '--git-common-dir']);
+  if (commonDir === undefined) throw new Error('git common directory is unset');
   const configFile = join(resolve(cwd, commonDir), 'config');
-  const bareArgs = ['config', '--file', configFile];
-  const readBare = () => config(cwd, [...bareArgs, '--get-all', 'core.bare']);
-  const bareBefore = readBare();
-  let bareChanged = false;
-  let bareChecked = false;
-  const checkBare = (): void => {
-    bareChecked = true;
-    let bareAfter = '<unreadable>';
-    const visible = (values: string) => values ? values.replaceAll('\n', ',') : '<unset>';
-    try {
-      bareAfter = readBare();
-      if (bareAfter === bareBefore) return;
-      bareChanged = true;
-      const originalValues = bareBefore ? bareBefore.split('\n') : [];
-      if (originalValues.length > 0) {
-        config(cwd, [...bareArgs, '--replace-all', 'core.bare', originalValues[0]!]);
-        for (const value of originalValues.slice(1)) config(cwd, [...bareArgs, '--add', 'core.bare', value]);
-      } else if (bareAfter) {
-        config(cwd, [...bareArgs, '--unset-all', 'core.bare']);
+  const configArgs = ['config', '--file', configFile];
+  const watchedKeys = ['core.bare', 'user.name', 'user.email'] as const;
+  // Legacy injected gitConfig fixtures supply newline-delimited results and
+  // return '' for an absent key. Real Git uses NUL-delimited complete values.
+  const readConfig = (key: string): string[] => {
+    const value = config(cwd, [...configArgs, '--null', '--get-all', key]);
+    if (value === undefined || (deps.gitConfig && value === '')) return [];
+    if (deps.gitConfig && !value.includes('\0')) return value.split('\n');
+    if (!value.endsWith('\0')) throw new Error(`unterminated git config value for ${key}`);
+    return value.slice(0, -1).split('\0');
+  };
+  const before = new Map(watchedKeys.map((key) => [key, readConfig(key)]));
+  let configChanged = false;
+  let configChecked = false;
+  const checkConfig = (): void => {
+    configChecked = true;
+    const visible = (values: string[]) => values.length === 0 ? '<unset>' : values.map((value) => value === '' ? '<empty>' : value.replaceAll('\n', ',')).join(',');
+    for (const key of watchedKeys) {
+      const original = before.get(key)!;
+      let after: string[] = ['<unreadable>'];
+      try {
+        after = readConfig(key);
+        if (JSON.stringify(after) === JSON.stringify(original)) continue;
+        configChanged = true;
+        if (original.length > 0) {
+          config(cwd, [...configArgs, '--replace-all', key, original[0]!]);
+          for (const value of original.slice(1)) config(cwd, [...configArgs, '--add', key, value]);
+        } else {
+          config(cwd, [...configArgs, '--unset-all', key]);
+        }
+        const restored = readConfig(key);
+        if (JSON.stringify(restored) !== JSON.stringify(original)) throw new Error(`expected ${visible(original)}, got ${visible(restored)}`);
+        report(`[test-deterministic] ${key} changed ${visible(original)} -> ${visible(after)}; restored ${visible(original)}; failing run`);
+      } catch (error) {
+        configChanged = true;
+        report(`[test-deterministic] ${key} changed ${visible(original)} -> ${visible(after)}; restore failed: ${formatError(error)}`);
       }
-      const restored = readBare();
-      if (restored !== bareBefore) throw new Error(`expected ${visible(bareBefore)}, got ${visible(restored)}`);
-      report(`[test-deterministic] core.bare changed ${visible(bareBefore)} -> ${visible(bareAfter)}; restored ${visible(bareBefore)}; failing run`);
-    } catch (error) {
-      bareChanged = true;
-      report(`[test-deterministic] core.bare changed ${visible(bareBefore)} -> ${visible(bareAfter)}; restore failed: ${formatError(error)}`);
     }
   };
   // ⛔ 사람이 «경로»를 직접 준 창에서는 아무것도 빼지 않는다 — 그 창은 「이것만 돌려라」다.
@@ -494,7 +512,7 @@ export async function runDeterministicTests(deps: DeterministicRunnerDeps = {}):
       });
       cleanupTemporaryRoot(testRoot, { rmSync: deps.rmSync, report });
       rootCleanupAttempted = true;
-      checkBare();
+      checkConfig();
       gate?.dispose();
       gate = undefined;
       if (deps.killSelf) {
@@ -509,8 +527,8 @@ export async function runDeterministicTests(deps: DeterministicRunnerDeps = {}):
     }
 
     cleanupRoot();
-    checkBare();
-    return bareChanged ? 1 : (outcome.code ?? 1);
+    checkConfig();
+    return configChanged ? 1 : (outcome.code ?? 1);
   } catch (error) {
     if (child) {
       try {
@@ -529,7 +547,7 @@ export async function runDeterministicTests(deps: DeterministicRunnerDeps = {}):
   } finally {
     gate?.dispose();
     cleanupRoot();
-    if (!bareChecked) checkBare();
+    if (!configChecked) checkConfig();
   }
 }
 

package/scripts/test-diet/effectiveness.ts

@@ -1,7 +1,7 @@
 import { spawnSync } from 'node:child_process';
 import { cpSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, existsSync, statSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
-import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
 import ts from 'typescript';
 import { pickRange } from './lib.js';
 
@@ -119,6 +119,67 @@ export function fixedCountAssertions(testPath: string, root: string): Array<{ li
   return assertions.sort((a, b) => a.line - b.line);
 }
 
+// Read module specifiers from syntax, not from comments or strings; re-exports count for non-test importers.
+function directImports(file: string, includeReexports = false): string[] {
+  const source = ts.createSourceFile(file, readFileSync(file, 'utf8'), ts.ScriptTarget.Latest, true);
+  const imports: string[] = [];
+  const visit = (node: ts.Node): void => {
+    if (ts.isImportDeclaration(node) && ts.isStringLiteral(node.moduleSpecifier)) imports.push(node.moduleSpecifier.text);
+    if (includeReexports && ts.isExportDeclaration(node) && node.moduleSpecifier && ts.isStringLiteral(node.moduleSpecifier))
+      imports.push(node.moduleSpecifier.text);
+    if (ts.isCallExpression(node) && node.expression.kind === ts.SyntaxKind.ImportKeyword
+      && node.arguments.length === 1 && ts.isStringLiteral(node.arguments[0]!)) imports.push(node.arguments[0]!.text);
+    ts.forEachChild(node, visit);
+  };
+  visit(source);
+  return imports;
+}
+
+/** Directly imported repository modules with no direct, tracked, non-test importer. */
+export function unreachableImports(testPath: string, root: string, deps: {
+  importers?: (modulePath: string, root: string) => string[];
+} = {}): string[] {
+  const repo = realpathSync(resolve(root));
+  const inside = (path: string) => path !== repo && !relative(repo, path).startsWith(`..${sep}`)
+    && relative(repo, path) !== '..' && !isAbsolute(relative(repo, path));
+  const validFile = (path: string) => inside(path) && existsSync(path) && realpathSync(path) === path && statSync(path).isFile();
+  const isTest = (path: string) => path.endsWith('.test.ts') || path === 'test' || path.startsWith(`test${sep}`);
+  const testFile = resolve(repo, testPath);
+  if (!validFile(testFile)) throw new Error('test path outside repository or symlinked');
+  const resolveImport = (from: string, specifier: string): string | undefined => {
+    if (!/^\.{1,2}\//.test(specifier)) return undefined;
+    const base = resolve(dirname(from), specifier);
+    const candidates = base.endsWith('.js')
+      ? [base.replace(/\.js$/, '.ts'), base, `${base}.ts`, join(base, 'index.ts')]
+      : [base, `${base}.ts`, join(base, 'index.ts')];
+    return candidates.find(validFile);
+  };
+  const importers = deps.importers ?? ((modulePath: string, rootPath: string): string[] => {
+    const stem = basename(modulePath).replace(/\.[^.]+$/, '');
+    const needles = stem === 'index' ? [stem, basename(dirname(modulePath))] : [stem];
+    const matches = new Set<string>();
+    for (const needle of needles) {
+      const found = spawnSync('git', ['-C', rootPath, 'grep', '-l', '-F', '--', needle], { encoding: 'utf8', maxBuffer: 16 * 1024 * 1024 });
+      if (found.error || (found.status !== 0 && found.status !== 1)) throw new Error(`importer lookup failed: ${found.error?.message ?? found.stderr}`);
+      for (const file of found.stdout.split('\n').filter(Boolean)) matches.add(file);
+    }
+    return [...matches];
+  });
+  const sources = new Set(directImports(testFile).map((specifier) => resolveImport(testFile, specifier))
+    .filter((path): path is string => path !== undefined && !isTest(relative(repo, path))));
+  const unreachable: string[] = [];
+  for (const source of sources) {
+    const modulePath = relative(repo, source);
+    const used = importers(modulePath, repo).some((candidate) => {
+      const path = resolve(repo, candidate);
+      if (!validFile(path) || isTest(relative(repo, path)) || path === source) return false;
+      return directImports(path, true).some((specifier) => resolveImport(path, specifier) === source);
+    });
+    if (!used) unreachable.push(modulePath.split(sep).join('/'));
+  }
+  return unreachable.sort();
+}
+
 export function mutationProbe(file: string, deps: { root: string; run?: (root: string, file: string) => number | null; baselineStable?: boolean }): Mutation {
   if (deps.baselineStable === false) return 'n/a';
   const root = realpathSync(resolve(deps.root));

package/scripts/test-diet/lib.ts

@@ -7,7 +7,7 @@ export const DEFAULT_COST_SECS = 10;
 export const SLOW_SECS = 60;
 export const HEAVY_MB = 2048;
 
-export interface Effectiveness { flake: 'stable' | 'flaky' | 'failing'; mutation: 'caught' | 'survived' | 'n/a'; fixedCounts?: number }
+export interface Effectiveness { flake: 'stable' | 'flaky' | 'failing'; mutation: 'caught' | 'survived' | 'n/a'; fixedCounts?: number; unreachable?: number }
 export interface Measurement { file: string; secs: number; rssMb: number | null; rc: number | null; pass: number | null; fail: number | null; reason?: string; effectiveness?: Effectiveness }
 export type Verdict = 'keep' | 'failing' | 'review';
 export type Proposal = 'delete' | 'shrink' | 'rewrite-cheap' | 'move-out-of-gate' | 'investigate';

package/scripts/test-diet/node.ts

@@ -10,7 +10,7 @@ import { effectiveInstanceRoot } from '../../src/instance/resolve.js';
 import { CardStore } from '../../src/task-cards/card-store.js';
 import { GATE_NIGHTLY_AUDITS } from '../release-loop/gate-node.js';
 import { appendLedger, costTable, judge, lastLedgerLine, ledgerPath, nightlyAuditLedgerPath, pickRange, propose, td1Dispositions, writeCardDraft, type LedgerLine, type Measurement, type Td1Disposition } from './lib.js';
-import { fixedCountAssertions, flakeVerdict, sweepSlice, type Mutation, type TestRun } from './effectiveness.js';
+import { fixedCountAssertions, flakeVerdict, sweepSlice, unreachableImports, type Mutation, type TestRun } from './effectiveness.js';
 
 type Context = { graphId?: string; input: Record<string, unknown>; outputs: Record<string, Record<string, unknown> | null> };
 function context(): Context {
@@ -123,6 +123,13 @@ function measure(ctx: Context, audit = false, effectiveness = false): number {
           file: measurement.file, reason: error instanceof Error ? error.message : String(error),
         });
       }
+      try {
+        measurement.effectiveness.unreachable = unreachableImports(measurement.file, process.cwd()).length;
+      } catch (error) {
+        debug.log('test-diet.effectiveness', 'unreachable-unreadable', {
+          file: measurement.file, reason: error instanceof Error ? error.message : String(error),
+        });
+      }
       debug.log('test-diet.effectiveness', 'judged', { file: measurement.file, ...measurement.effectiveness, secs: effect.secs });
     }
   }

package/src/agent-mission/driver.ts

@@ -8,8 +8,8 @@
 //   - 증거 게이트(doc 존재 / tsc 0 / test pass)로 완료 판정 후 commit
 // 재사용: startPty(Bun 네이티브 PTY)·createWorktree·streamLLM·worktreeHasChanges·commitWorktree.
 import { execFileSync, spawnSync, spawn as spawnChild } from 'node:child_process';
-import { homedir } from 'node:os';
-import { existsSync, writeFileSync, mkdirSync, readdirSync, readFileSync, statSync, readlinkSync, realpathSync, lstatSync, unlinkSync } from 'node:fs';
+import { homedir, tmpdir } from 'node:os';
+import { existsSync, writeFileSync, mkdirSync, mkdtempSync, rmSync, readdirSync, readFileSync, statSync, readlinkSync, realpathSync, lstatSync, unlinkSync } from 'node:fs';
 import { createHash } from 'node:crypto';
 import { join, relative, resolve, isAbsolute, sep } from 'node:path';
 import { startPty, mintPtyId, onPtyEvent, type PtyHandle, type StartOpts } from '../pty-shell/registry.js';
@@ -18,7 +18,7 @@ import { NESTED_AGENT_ENV_BLOCKLIST } from '../agent/nested-agent-env.js';
 import { getNestDepth } from '../agent/nest-depth.js';
 import { gateNestedElanousLaunch, nestedDepthCodexArgs, readNestedElanousDepth } from '../harness/nested-elanous-policy.js';
 import { createWorktree, resolveMainRepoRoot, type CreateWorktreeOpts } from '../git-fs/worktree.js';
-import { configuredWorktreeRoot } from '../user-config.js';
+import { configuredWorktreeRoot, getUserConfig } from '../user-config.js';
 import { worktreeHasChanges, commitWorktree, changedFiles } from '../self-implement/seams.js';
 import { streamLLM, type LLMMessage } from '../llm.js';
 import { debug } from '../debug/log.js';
@@ -330,6 +330,27 @@ export function resolveBackendSpawn(
   return { cmd: backend.cmd, args, env, unsetEnv, nestedEnvRemovedCount, forcedEnv };
 }
 
+/** Claude's strict MCP override is per-child; never edit the user's Claude settings. */
+export function prepareClaudeChildSpawn(
+  spawn: ReturnType<typeof resolveBackendSpawn>,
+  options: { readonly backendName: string; readonly depth: number; readonly allowNestedElanous: boolean; readonly tempRoot?: string },
+): { readonly args: string[]; readonly cleanup: () => void; readonly configPath?: string } {
+  // Backend identity, not the command string — an absolute-path claude binary is still the Claude backend.
+  if (options.backendName !== 'claude' || (options.depth === 0 && options.allowNestedElanous)) {
+    return { args: [...spawn.args], cleanup: () => {} };
+  }
+  const dir = mkdtempSync(join(options.tempRoot ?? tmpdir(), 'elanous-claude-mcp-'));
+  try {
+    const configPath = join(dir, 'mcp.json');
+    writeFileSync(configPath, JSON.stringify({ mcpServers: {} }), { mode: 0o600 });
+    return { args: [...spawn.args, '--strict-mcp-config', '--mcp-config', configPath], configPath,
+      cleanup: () => rmSync(dir, { recursive: true, force: true }) };
+  } catch (error) {
+    rmSync(dir, { recursive: true, force: true });
+    throw error;
+  }
+}
+
 /**
  * Refuse a requested nested elanous launch when this backend cannot carry the depth marker.
  * Unset depth is 0. A normal mission spawn (`nestedLaunchRequested: false`) is never refused here.
@@ -528,6 +549,8 @@ export interface AgentMissionSpec {
    * Absent means an ordinary mission spawn — never refused for a missing marker.
    */
   nestedElanousLaunch?: boolean;
+  /** Explicit depth-0 allow from the caller (e.g. `--nested-elanous allow`). Ignored at depth >= 1. Config `harness.nestedElanous` also counts at depth 0. */
+  nestedElanousAllow?: boolean;
   /** Concurrent missions may share one decision stream alias without sharing a PTY or worktree. */
   decisionMissionId?: string;
   /** ⭐⭐ 그 브랜치를 이미 쥔 «소유» 워크트리가 있으면 지우지 말고 그대로 재사용하라고 요청한다
@@ -1574,6 +1597,8 @@ async function runAgentMissionBody(spec: AgentMissionSpec, deps: AgentMissionDep
   const nestedRefusal = refuseNestedElanousOnBackend({
     backendName: backend.name,
     nestedLaunchRequested: spec.nestedElanousLaunch === true,
+    ...(spec.nestedElanousAllow === true ? { allow: true } : {}),
+    ...(getUserConfig().harness?.nestedElanous === 'allow' ? { configAllow: true } : {}),
     env: process.env,
   });
   if (nestedRefusal.refused) {
@@ -1691,12 +1716,16 @@ async function runAgentMissionBody(spec: AgentMissionSpec, deps: AgentMissionDep
       evidencePath: finalEv.path, evidenceSatisfied: true, committed, usedOmniCrawl: false, detail: '완료(증거 충족)' };
   }
   env.TERM = 'xterm-256color';
+  // Claude's per-child MCP override is held until the PTY exits, not until the control loop returns.
+  const claudeChild = backend.name === 'claude'
+    ? prepareClaudeChildSpawn(spawnParams, { backendName: backend.name, depth: readNestedElanousDepth(process.env), allowNestedElanous: spec.nestedElanousAllow === true || getUserConfig().harness?.nestedElanous === 'allow' })
+    : undefined;
   // ⭐run-identity — runId was resolved before either headless or PTY spawn.
-  debug.log('agent-mission', 'spawn', { agent: backend.name, cmd: `${spawnParams.cmd} ${spawnParams.args.join(' ')}`, scrubbed: backend.scrubEnv ?? [], nestedEnvRemovedCount: spawnParams.nestedEnvRemovedCount, runId });
+  debug.log('agent-mission', 'spawn', { agent: backend.name, cmd: `${spawnParams.cmd} ${(claudeChild?.args ?? spawnParams.args).join(' ')}`, scrubbed: backend.scrubEnv ?? [], nestedEnvRemovedCount: spawnParams.nestedEnvRemovedCount, runId });
   // PTY 정체성 — kind(=backend)·nickname(goto 로 나중 접근)·accessMode='auto'(헤드리스 자율·brain 이 write 소유).
   const ptyOpts = buildAgentMissionPtySpawnOptions({
     backend,
-    spawn: { cmd: spawnParams.cmd, args: spawnParams.args, env, unsetEnv: spawnParams.unsetEnv },
+    spawn: { cmd: spawnParams.cmd, args: claudeChild?.args ?? spawnParams.args, env, unsetEnv: spawnParams.unsetEnv },
     workdir: wt.path,
     nickname: spec.nickname ?? spec.branch ?? backend.name,
   });
@@ -1706,6 +1735,11 @@ async function runAgentMissionBody(spec: AgentMissionSpec, deps: AgentMissionDep
   let usageReemitted = false;
   let childSessionId: string | undefined;
   let sessionOutput = '';
+  let claudeCleanupTimer: ReturnType<typeof setInterval> | undefined;
+  const cleanupClaude = (): void => {
+    if (claudeCleanupTimer) clearInterval(claudeCleanupTimer);
+    claudeChild?.cleanup();
+  };
   const offLive = onPtyEvent((ev) => {
     if (ev.id !== ptyOpts.id) return;
     if (ev.type === 'output') {
@@ -1718,6 +1752,7 @@ async function runAgentMissionBody(spec: AgentMissionSpec, deps: AgentMissionDep
     if (ev.type === 'exit') {
       offLive();
       if (liveTimer) clearInterval(liveTimer);
+      cleanupClaude();
     }
     if (ev.type === 'exit' && backend.name === 'codex' && !usageReemitted) {
       usageReemitted = true;
@@ -1740,9 +1775,17 @@ async function runAgentMissionBody(spec: AgentMissionSpec, deps: AgentMissionDep
     }
   });
   let h: PtyHandle;
-  if (deps.isMissionAborted?.()) { offLive(); throw new Error('MISSION_ABORTED'); }
+  if (deps.isMissionAborted?.()) { offLive(); cleanupClaude(); throw new Error('MISSION_ABORTED'); }
   try { h = spawnPty(ptyOpts); }
-  catch (error) { offLive(); throw error; }
+  catch (error) { offLive(); cleanupClaude(); throw error; }
+  if (!h.isAlive()) cleanupClaude();
+  else if (claudeChild) {
+    // A test-injected PTY may not emit registry events; keep the config until its handle exits.
+    claudeCleanupTimer = setInterval(() => {
+      if (!h.isAlive()) cleanupClaude();
+    }, 1000);
+    claudeCleanupTimer.unref();
+  }
   if (backend.name === 'codex') observeExternalEvent({ origin: 'codex-agent-mission', kind: 'started',
     summary: 'Codex agent mission started', source: `elanous://agent-mission/${encodeURIComponent(runId)}/${encodeURIComponent(h.id)}` });
   let contextFinished = false;
@@ -1753,8 +1796,8 @@ async function runAgentMissionBody(spec: AgentMissionSpec, deps: AgentMissionDep
       summary: `Codex agent mission ${ok ? 'completed' : 'failed'}`,
       source: `elanous://agent-mission/${encodeURIComponent(runId)}/${encodeURIComponent(h.id)}` });
   };
-  deps.onPtyStarted?.(h, () => { if (liveTimer) clearInterval(liveTimer); offLive(); finishContext(false); });
-  if (deps.isMissionAborted?.()) { finishContext(false); return { ok: false, reason: 'aborted', worktree: wt.path, branch: wt.branch,
+  deps.onPtyStarted?.(h, () => { if (liveTimer) clearInterval(liveTimer); offLive(); finishContext(false); cleanupClaude(); });
+  if (deps.isMissionAborted?.()) { finishContext(false); cleanupClaude(); return { ok: false, reason: 'aborted', worktree: wt.path, branch: wt.branch,
     rounds: 0, evidencePath: null, committed: false, usedOmniCrawl: false, detail: 'aborted' }; }
   const executorRef = buildExecutorPtyRef({
     ptyId: h.id,
@@ -2275,7 +2318,7 @@ async function runAgentMissionBody(spec: AgentMissionSpec, deps: AgentMissionDep
     ptyId: h.id, webUrl: webAddress.webUrl, driveVerdict: driveVerdict.kind,
     detail: recoverExhausted ? control.termination.reason : driveVerdict.kind === 'done-but-failed' ? `미완(DRIVE-OK: ${driveVerdict.reason})` : driveVerdict.kind === 'success-unverified' && finalEv.ok ? '완료(증거)' : done ? '완료(증거 충족)' : (finalEv.ok ? '증거 충족(루프 종료)' : '미완(증거 부족)'),
   };
-  } finally { stopLive(); finishContext(false); }
+  } finally { stopLive(); finishContext(false); if (!h.isAlive() || deps.isMissionAborted?.()) cleanupClaude(); }
 }
 
 /** @deprecated codex 특정 이름 — runAgentMission 을 쓰라(codex 는 기본 backend). */

package/src/agent-mission/review-loop.ts

@@ -22,7 +22,7 @@ import { budgetReviewerContext } from '../agent-substrate/pr-reviewer.js';
 import { DEFAULT_REVIEW_BACKEND } from '../agent-substrate/acp-reviewer.js';
 import { loadReviewerContext } from '../agent-substrate/self-review-cli.js';
 import { createRepositoryReferencedFileReader, type ReferencedFileReader } from '../self-implement/goal-file-reader.js';
-import { parse as parsePrCommentMeta } from '../agent-substrate/pr-comment-meta.js';
+import { expandRecords, parse as parsePrCommentMeta } from '../agent-substrate/pr-comment-meta.js';
 
 export type ReviewVerdict = 'ok' | 'reinforce' | 'reject' | 'ambiguous';
 export type ReviewClassificationSource = 'llm' | 'llm-call-failure' | 'empty-review' | 'injected';
@@ -310,9 +310,10 @@ function analyzeAppliedReviewItems(comments: readonly NonNullable<LatestReviewSo
   const items: string[] = [];
   const seen = new Set<string>();
   let headlineComments = 0;
-  const newestFirst = [...comments].sort((a, b) => (b.createdAt ?? '').localeCompare(a.createdAt ?? ''));
+  const newestFirst = comments.flatMap((comment) => expandRecords(comment.body ?? '').map((body) => ({ ...comment, body })))
+    .sort((a, b) => (b.createdAt ?? '').localeCompare(a.createdAt ?? ''));
   for (const comment of newestFirst) {
-    const lines = (comment.body ?? '').split('\n');
+    const lines = comment.body.split('\n');
     const headlineIndex = parsePrCommentMeta(lines[0] ?? '') ? 1 : 0;
     const headline = lines[headlineIndex]?.trim() ?? '';
     if (!headline.startsWith(REVIEW_REINFORCEMENT_HEADLINE) && !headline.startsWith(ACP_REWORK_HEADLINE)) continue;