elanous 0.2.18 → 0.2.19

package/src/esc-abort-gate.ts

@@ -34,6 +34,9 @@ import type { KeyEvent } from './display/types.js';
 import type { ThemeTokens } from './theme/tokens.js';
 import { debug } from './debug/log.js';
 import { abortTurnOnly } from './turn-abort-scope.js';
+import { SELF_IMPLEMENT_TOOL_NAMES } from './boot/daemon-tools/self-implement-names.js';
+
+export const DASHBOARD_CLARIFICATION_REQUEST = Symbol.for('elanous.dashboard.clarification-request');
 
 export interface EscAbortGateDeps {
   abortCtrl: AbortController;
@@ -87,8 +90,14 @@ export async function routeStreamingEscapeKey(
   gate: Pick<EscAbortGate, 'handleEscape' | 'handleKey' | 'isGateOpen'>,
   gateEvent: KeyEvent,
   consumeDragEscape: () => Promise<boolean>,
+  consumeTopModalEscape: () => boolean | 'passthrough' = () => false,
 ): Promise<boolean> {
   if (key.kind && key.kind !== 'press') return false;
+  if (key.name === 'escape') {
+    const modalResult = consumeTopModalEscape();
+    if (modalResult === true) return true;
+    if (modalResult === 'passthrough') return false;
+  }
   if (gate.isGateOpen()) {
     gate.handleKey(gateEvent);
     return true;
@@ -99,6 +108,41 @@ export async function routeStreamingEscapeKey(
   return true;
 }
 
+export function consumeStreamingTopModalEscape(input: {
+  modal: Pick<ModalSurface, 'id' | 'onKey'> | null;
+  abortGateModalId: string | null;
+  event: KeyEvent;
+  question?: { id: string; dispose(cancelled: boolean): void; isClarification: boolean };
+  onClarificationClosed(): void;
+  topModalId(): string | null;
+  redraw(): void;
+}): boolean | 'passthrough' {
+  const { modal, question } = input;
+  if (!modal || modal.id === input.abortGateModalId) return false;
+  if (modal.id === question?.id) {
+    question.dispose(true);
+    if (question.isClarification) input.onClarificationClosed();
+    input.redraw();
+    return true;
+  }
+  if (!modal.onKey) return 'passthrough';
+  modal.onKey(input.event);
+  input.redraw();
+  return input.topModalId() === modal.id ? 'passthrough' : true;
+}
+
+export function createHarnessEscHint(pushLine: (line: string) => void): (targets: readonly string[]) => boolean {
+  let shown = false;
+  return (targets) => {
+    if (!targets.some(name => (SELF_IMPLEMENT_TOOL_NAMES as readonly string[]).includes(name))) return false;
+    if (!shown) {
+      pushLine('하니스 런은 따로 계속 돈다 — 멈추려면 /harness stop <space-id> · 목록은 /harness runs');
+      shown = true;
+    }
+    return true;
+  };
+}
+
 export function createEscAbortGate(deps: EscAbortGateDeps): EscAbortGate {
   let current: ApprovalModalHandle | null = null;
   let currentDispose: (() => void) | null = null;

package/src/graph-runner/runner.ts

@@ -35,7 +35,11 @@ export interface GraphRunState {
   stoppedAt?: string;
   status: 'running' | 'done' | 'failed' | 'budget-exceeded' | 'awaiting-approval';
   path: string[];
-  nodes: Array<{ nodeId: string; ok: boolean; exit: number | null; executed: boolean; output?: unknown; error?: string; decidedBy?: string; decidedAt?: string }>;
+  /** startedAt/endedAt (ISO) and seconds are written when the node runs; ledgers before GRAPH-NODE-TIMES (0.2.19) have none. */
+  nodes: Array<{ nodeId: string; ok: boolean; exit: number | null; executed: boolean; output?: unknown; error?: string; decidedBy?: string; decidedAt?: string;
+    startedAt?: string; endedAt?: string; seconds?: number }>;
+  /** The node now running and when it started; cleared when its record is written. */
+  currentNode?: { nodeId: string; startedAt: string };
   input?: unknown;
   pending?: { nodeId: string; message: string; since: string; notifiedAt?: string; decision?: 'approved' | 'rejected'; decidedBy?: string; decidedAt?: string };
   approvalSourceHash?: string;
@@ -658,6 +662,8 @@ export async function runGraph(path: string, options: GraphRunOptions = {}): Pro
     }
     state.status = 'running';
     const startedAt = performance.now();
+    const nodeStartedAt = new Date().toISOString();
+    if (!resumingCompleted) state.currentNode = { nodeId: current, startedAt: nodeStartedAt };
     console.error(`[graph] ${current} start (0.00s)`);
     debug.log('graph.run', 'node', { graphId, runId, nodeId: current, phase: 'start', dryRun: state.dryRun });
     publishInsideEvent({ kind: 'node', graphId, runId, nodeId: current, phase: 'start' });
@@ -723,6 +729,10 @@ export async function runGraph(path: string, options: GraphRunOptions = {}): Pro
       error = result.error ? redactCredentials(result.error) : undefined;
       state.executed++;
     }
+    const seconds = Number(((performance.now() - startedAt) / 1000).toFixed(2));
+    // A wall clock stepped back mid-node must not record an end before the start.
+    const nodeEndedAt = new Date(Math.max(Date.now(), Date.parse(nodeStartedAt))).toISOString();
+    delete state.currentNode;
     if (resumingCompleted && completed) {
       ok = completed.ok;
       exit = completed.exit;
@@ -734,7 +744,8 @@ export async function runGraph(path: string, options: GraphRunOptions = {}): Pro
         output = JSON.stringify({ outcome: ok ? 'approved' : 'rejected', ...(state.pending?.decidedBy === undefined ? {} : { decidedBy: state.pending.decidedBy }), decidedAt: state.pending?.decidedAt ?? null });
       }
       state.nodes.push({ nodeId: current, ok, exit, executed: !!command && (!state.dryRun || !!command.dry_run_command), ...((command || approval) && (!state.dryRun || !!command?.dry_run_command) && output !== undefined ? { output } : {}), ...(error ? { error } : {}),
-        ...(approval && state.pending ? { ...(state.pending.decidedBy === undefined ? {} : { decidedBy: state.pending.decidedBy }), decidedAt: state.pending.decidedAt } : {}) });
+        ...(approval && state.pending ? { ...(state.pending.decidedBy === undefined ? {} : { decidedBy: state.pending.decidedBy }), decidedAt: state.pending.decidedAt } : {}),
+        startedAt: nodeStartedAt, endedAt: nodeEndedAt, seconds });
     }
     if (approval) {
       delete state.pending;
@@ -742,7 +753,6 @@ export async function runGraph(path: string, options: GraphRunOptions = {}): Pro
     }
     const reported = command && (!state.dryRun || command.dry_run_command) ? lastJsonObject(resumingCompleted ? completed?.output : output)?.outcome : undefined;
     const namedOutcome = typeof reported === 'string' ? reported : undefined;
-    const seconds = Number(((performance.now() - startedAt) / 1000).toFixed(2));
     console.error(`[graph] ${current} ${ok ? 'ok' : 'fail'} (${seconds.toFixed(2)}s)`);
     debug.log('graph.run', 'node', { graphId, runId, nodeId: current, phase: ok ? 'ok' : 'fail', seconds, exit });
     publishInsideEvent({ kind: 'node', graphId, runId, nodeId: current, phase: ok ? 'ok' : 'fail', seconds });
@@ -892,11 +902,21 @@ export function manageGraphRun(graphId: string, runId: string, action: 'stop' |
         catch (error) { if ((error as NodeJS.ErrnoException).code !== 'ESRCH') throw error; }
       }
     }
+    const current = state.currentNode;
+    const running = current && state.path.length === state.nodes.length + 1 && current.nodeId === state.path.at(-1) &&
+      Number.isFinite(Date.parse(current.startedAt)) ? current.startedAt : undefined;
+    // One stop instant for the node end, finishedAt and stoppedAt — never before the running node's start.
+    const stopMs = running === undefined ? Date.now() : Math.max(Date.now(), Date.parse(running));
     if (state.path.length === state.nodes.length + 1) {
-      state.nodes.push({ nodeId: state.path.at(-1)!, ok: false, exit: null, executed: false, error: 'stopped before node completed' });
+      state.nodes.push({ nodeId: state.path.at(-1)!, ok: false, exit: null, executed: false, error: 'stopped before node completed',
+        // The stop instant is always the node end; a start (and so seconds) exists only when the ledger named the running
+        // node — a run begun by a runner before GRAPH-NODE-TIMES did not, and a guessed start would be a false time.
+        endedAt: new Date(stopMs).toISOString(),
+        ...(running === undefined ? {} : { startedAt: running, seconds: Number(((stopMs - Date.parse(running)) / 1000).toFixed(2)) }) });
     }
+    delete state.currentNode;
     state.status = 'failed';
-    state.finishedAt = new Date().toISOString();
+    state.finishedAt = new Date(stopMs).toISOString();
     state.stoppedAt = state.finishedAt;
     delete state.activeNode;
     persistGraphRun(state);

package/src/harness/harness-cli-command.ts

@@ -23,6 +23,7 @@ import { queryRunningRuns } from '../self-implement/running-runs.js';
 import { DevPipelineError } from '../self-dev/dev-pipeline.js';
 import { runDraftSweep, sweepFailureReason, type DraftSweepAdapters, type DraftSweepResult, type SweepDraft, type SweepMergedPr, type SweepReviewGate } from '../self-dev/draft-sweep.js';
 import { debug } from '../debug/log.js';
+import { installHarnessSalvageCommand } from './harness-salvage-cli.js';
 import { decideNestedElanousLaunch, readNestedElanousDepth } from './nested-elanous-policy.js';
 import { dispatchTask, type DispatchTaskInput, type DispatchTaskDeps } from '../execution-loop/dispatch-task.js';
 import { launchRequestId, preLaunchGate, type PreLaunchGateDeps } from '../execution-loop/launch-gate.js';
@@ -2511,6 +2512,7 @@ export function installHarnessCliCommand(program: Command, deps: HarnessCliComma
   installDeliverableVerifyCliCommand(harnessCmd, deps.deliverableVerify);
   installHarnessProcessObservationCommand(harnessCmd, deps.processObservation);
   installHarnessBudgetCommand(harnessCmd);
+  installHarnessSalvageCommand(harnessCmd);
   installHarnessGoalCommand(harnessCmd, deps.goalLookup, deps.goalArchive);
   installHarnessDraftSweepCommand(harnessCmd, deps.draftSweep);
   const queue = harnessCmd.command('queue').description('자리별 영속 발사 대기열');

package/src/harness/harness-salvage-cli.ts

@@ -0,0 +1,78 @@
+/**
+ * `elanous harness salvage <runId...> [--json]` — 런마다 «PR #n | 수확 가지 <branch> (+a/-b · N files) | 없음 | 모름(<이유>)».
+ * SALVAGE-VISIBLE(0.2.19) — 판정은 `src/self-implement/salvage-branches.ts`, 여기는 배선·출력·관측만.
+ */
+import type { Command } from 'commander';
+import { debug } from '../debug/log.js';
+import { normalizeRunId } from './harness-space.js';
+import { loadFederatedRunLedger } from '../self-implement/run-ledger.js';
+import {
+  decideRunSalvage,
+  findRunSalvageBranches,
+  gitSalvageRunner,
+  listRemoteSalvageRefs,
+  prStateFromLedger,
+  type RunPrState,
+  type RunSalvageVerdict,
+  type SalvageGitRunner,
+} from '../self-implement/salvage-branches.js';
+
+export interface HarnessSalvageDeps {
+  git?: SalvageGitRunner;
+  readPr?: (runId: string) => RunPrState;
+  print?: (line: string) => void;
+}
+
+function defaultReadPr(runId: string): RunPrState {
+  try {
+    return prStateFromLedger(loadFederatedRunLedger(runId, { includeTest: true }));
+  } catch (error) {
+    return { status: 'unknown', reason: `원장 읽기 실패 · ${error instanceof Error ? error.message : String(error)}` };
+  }
+}
+
+/** 여러 런을 ls-remote «한 번»으로 판정한다. PR 이 있는 런은 git 을 더 부르지 않는다. */
+export function runHarnessSalvage(runIds: readonly string[], deps: HarnessSalvageDeps = {}): RunSalvageVerdict[] {
+  const git = deps.git ?? gitSalvageRunner(process.cwd());
+  const readPr = deps.readPr ?? defaultReadPr;
+  let listing: ReturnType<typeof listRemoteSalvageRefs> | undefined;
+  const verdicts: RunSalvageVerdict[] = [];
+  for (const raw of runIds) {
+    const runId = normalizeRunId(raw);
+    const pr = readPr(runId);
+    let verdict: RunSalvageVerdict;
+    if (pr.status === 'pr') {
+      verdict = decideRunSalvage(runId, pr, { status: 'not-checked' });
+    } else {
+      listing ??= listRemoteSalvageRefs(git);
+      verdict = decideRunSalvage(runId, pr, findRunSalvageBranches(runId, git, { listing }));
+    }
+    const top = verdict.salvage.status === 'found' ? verdict.salvage.branches[0] : undefined;
+    debug.log('harness.salvage', 'visible', {
+      runId,
+      outcome: verdict.outcome,
+      branch: top?.branch ?? null,
+      files: top?.diffstat.files ?? null,
+      ...(verdict.pr.status === 'pr' ? { prNumber: verdict.pr.number } : {}),
+      ...(verdict.salvage.status === 'unknown' ? { reason: verdict.salvage.reason } : {}),
+      ...(verdict.pr.status === 'unknown' ? { prReason: verdict.pr.reason } : {}),
+    });
+    verdicts.push(verdict);
+  }
+  return verdicts;
+}
+
+export function installHarnessSalvageCommand(harnessCmd: Command, deps: HarnessSalvageDeps = {}): Command {
+  return harnessCmd
+    .command('salvage')
+    .description('런 → PR | 수확 가지(salvage/*) | 없음 | 모름 — Pod 런이 멈추며 남긴 가지를 보인다')
+    .argument('<runIds...>', '런 id (run-xxxxxxxx-…)')
+    .option('--json', '런마다 { runId, outcome, pr, salvage } 를 JSON 배열로')
+    .action((runIds: string[], opts: { json?: boolean }) => {
+      const print = deps.print ?? ((line: string) => console.log(line));
+      const verdicts = runHarnessSalvage(runIds, deps);
+      if (opts.json) print(JSON.stringify(verdicts.map(({ line: _line, ...rest }) => rest)));
+      else for (const verdict of verdicts) print(verdict.line);
+      if (verdicts.some((verdict) => verdict.outcome === 'unknown')) process.exitCode = 1;
+    });
+}

package/src/harness/harness-worktree-add.ts

@@ -2,6 +2,7 @@ import { createWorktree, type CreateWorktreeResult } from '../git-fs/worktree.js
 import { runGitCommand } from '../git-fs/runner.js';
 import { configuredWorktreeRoot } from '../user-config.js';
 import { debug } from '../debug/log.js';
+import { join, resolve } from 'node:path';
 
 const OWNER_CONFIG_KEY = 'elanous.harness.owner';
 const COMMAND_CONFIG_KEY = 'elanous.harness.command';
@@ -87,8 +88,75 @@ function restoreWorktreeProvenance(worktreePath: string, snapshot: WorktreeConfi
   }
 }
 
+/** Keys that must leave the shared config once `extensions.worktreeConfig` is on (`git help worktree` §CONFIGURATION FILE).
+ *  `core.bare=false` is harmless when shared (linked trees default to non-bare), so only a true value moves. */
+const MAIN_TREE_ONLY_CONFIG_KEYS = ['core.bare', 'core.worktree'] as const;
+
+/** Moves `core.bare=true` / `core.worktree` from `$GIT_COMMON_DIR/config` to `$GIT_COMMON_DIR/config.worktree`.
+ *  Runs every time (also when the extension is already on) and throws before the caller enables the extension.
+ *  Incident 10-07 (HQ-WORKTREE-CONFIG): a shared `core.bare=true` made every linked worktree of a bare repo unusable. */
+/** Values are moved byte-for-byte (a `core.worktree` path may carry edge whitespace), so read them NUL-terminated. */
+function nulTerminatedValue(stdout: unknown, key: string): string {
+  const text = String(stdout ?? '');
+  if (!text.endsWith('\0')) throw new Error(`harness worktree ${key} read failed — git config emitted an unterminated value`);
+  return text.slice(0, -1);
+}
+
+function moveMainTreeOnlyConfig(worktreePath: string): void {
+  const common = gitAt(worktreePath, ['rev-parse', '--git-common-dir']);
+  const commonOut = String(common.stdout ?? '').trim();
+  if (common.status !== 0 || !commonOut) {
+    throw new Error(`harness worktree common git dir lookup failed — ${gitConfigFailure(common)}`);
+  }
+  const commonDir = resolve(worktreePath, commonOut);
+  const shared = join(commonDir, 'config');
+  const perTree = join(commonDir, 'config.worktree');
+  // `null` = absent. Typed reads judge meaning (`yes`/`TRUE` are true); raw reads carry the bytes that move.
+  const readValue = (file: string, key: string, typed: boolean): string | null => {
+    const read = gitAt(worktreePath, ['config', '--file', file, ...(typed ? ['--type=bool'] : []), '--null', '--get', key]);
+    if (read.status === 1) return null;
+    if (read.status !== 0) throw new Error(`harness worktree ${key} read failed (${file}) — ${gitConfigFailure(read)}`);
+    return nulTerminatedValue(read.stdout, key);
+  };
+  for (const key of MAIN_TREE_ONLY_CONFIG_KEYS) {
+    const typed = key === 'core.bare';
+    const meaning = readValue(shared, key, typed);
+    if (meaning === null) continue;
+    if (typed && meaning !== 'true') continue;
+    const raw = typed ? readValue(shared, key, false) : meaning;
+    if (raw === null) throw new Error(`harness worktree shared ${key} vanished during the move`);
+    // A valueless `bare` means true; writing its empty raw form would mean false.
+    const value = typed && raw === '' ? 'true' : raw;
+    // A conflicting per-tree value would flip the main tree once the extension is on — refuse instead of guessing.
+    // Every per-tree value must agree (not just the last one), so a mixed list also fails closed.
+    const existingRead = gitAt(worktreePath, ['config', '--file', perTree, ...(typed ? ['--type=bool'] : []), '--null', '--get-all', key]);
+    if (existingRead.status !== 0 && existingRead.status !== 1) {
+      throw new Error(`harness worktree ${key} read failed (${perTree}) — ${gitConfigFailure(existingRead)}`);
+    }
+    const existingValues = existingRead.status === 0 ? nulTerminatedValue(existingRead.stdout, key).split('\0') : [];
+    if (existingValues.some((existing) => existing !== meaning)) {
+      throw new Error(`harness worktree ${key} conflict — ${shared} has ${JSON.stringify(meaning)} but ${perTree} has ${JSON.stringify(existingValues)}; resolve by hand before enabling extensions.worktreeConfig`);
+    }
+    const existingMeaning = existingValues.length > 0 ? meaning : null;
+    if (existingMeaning === null) {
+      const write = gitAt(worktreePath, ['config', '--file', perTree, key, value]);
+      if (write.status !== 0) throw new Error(`harness worktree ${key} move failed — ${gitConfigFailure(write)}`);
+    }
+    const unset = gitAt(worktreePath, ['config', '--file', shared, '--unset-all', key]);
+    if (unset.status !== 0) throw new Error(`harness worktree shared ${key} unset failed — ${gitConfigFailure(unset)}`);
+    debug.log('harness.worktree', 'core-bare-moved', {
+      key,
+      value,
+      commonDir,
+      perTreeHadValue: existingMeaning !== null,
+      worktreePath,
+    }, { level: 'warn' });
+  }
+}
+
 /** Records the shared worktree-scoped provenance used by both manual and self-implement creation paths. */
 export function recordHarnessWorktreeProvenance(worktreePath: string, provenance: HarnessWorktreeProvenance): void {
+  moveMainTreeOnlyConfig(worktreePath);
   const enable = gitAt(worktreePath, ['config', 'extensions.worktreeConfig', 'true']);
   if (enable.status !== 0) {
     throw new Error(`harness worktree owner declaration failed — ${gitConfigFailure(enable)}`);

package/src/harness/ledger-write-guard.ts

@@ -1,19 +1,7 @@
-import { realpathSync } from 'node:fs';
-import { dirname, isAbsolute, relative, resolve, sep } from 'node:path';
+import { isAbsolute, relative, sep } from 'node:path';
 import { debug } from '../debug/log.js';
 import { effectiveInstanceRoot, prodInstanceRoot } from '../instance/resolve.js';
-
-function physicalPath(path: string): string {
-  const absolute = resolve(path);
-  try {
-    return realpathSync(absolute);
-  } catch (error) {
-    if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error;
-    const parent = dirname(absolute);
-    if (parent === absolute) throw error;
-    return resolve(physicalPath(parent), relative(parent, absolute));
-  }
-}
+import { isInsideOpsRoot, physicalPath, testProcessSignal } from '../instance/test-write-guard.js';
 
 /** Refuse a test's write to the production instance, including an explicitly supplied ledger directory. */
 export function refuseProductionLedgerWriteInTest(
@@ -23,11 +11,13 @@ export function refuseProductionLedgerWriteInTest(
   productionRoot = prodInstanceRoot(),
   instanceRoot = effectiveInstanceRoot(),
 ): boolean {
-  if (env.NODE_ENV !== 'test' && !env.ELANOUS_TEST_HOME) return false;
+  if (!testProcessSignal(env, env === process.env ? undefined : '')) return false;
   const target = physicalPath(root);
   const production = physicalPath(productionRoot);
   const withinProduction = relative(production, target);
-  if (withinProduction === '..' || withinProduction.startsWith(`..${sep}`) || isAbsolute(withinProduction)) return false;
+  const outsideHomeRoot = withinProduction === '..' || withinProduction.startsWith(`..${sep}`) || isAbsolute(withinProduction);
+  // The account's real ~/.elanous is production too when a runner redirected HOME (TEST-PROD-LEAK).
+  if (outsideHomeRoot && !isInsideOpsRoot(root)) return false;
   try {
     debug.log('harness.incidents', 'write-refused', { store, root: target, effectiveInstanceRoot: instanceRoot });
   } catch { /* Observation cannot reopen a closed write boundary. */ }

package/src/hq/hq.ts

@@ -108,7 +108,7 @@ function resolve(deps: HqDeps = {}): Resolved {
     ssh,
     probe: deps.probe ?? tailnetProbe(config),
     localPath: deps.localPath ?? join(getElanousConfigDir(), 'hq', 'local.json'),
-    seenPath: deps.seenPath ?? config.seenGenerationFile ?? (deps.localPath ? `${deps.localPath}.seen-generation` : join(homedir(), '.elanous-hq', 'seen-generation')),
+    seenPath: deps.seenPath ?? (deps.localPath && !config.seenGenerationFile ? `${deps.localPath}.seen-generation` : hqSeenGenerationPath(config)),
     now: deps.now ?? (() => Math.floor(Date.now() / 1000)),
     log,
   };
@@ -161,6 +161,11 @@ function writeLocal(path: string, state: LocalHqState): void {
 }
 
 /** Highest lease generation this host ever observed (null = never). */
+/** The seen-generation marker this host keeps (hq.seenGenerationFile · default ~/.elanous-hq/seen-generation). */
+export function hqSeenGenerationPath(config: Pick<HqConfig, 'seenGenerationFile'>): string {
+  return config.seenGenerationFile ?? join(homedir(), '.elanous-hq', 'seen-generation');
+}
+
 export function readSeenGeneration(path: string): number | null {
   try {
     if (!existsSync(path)) return null;

package/src/index.ts

@@ -51,6 +51,7 @@ import { registerRoleCommands } from './cli/role-cli.js';
 import { registerMachineCommands } from './cli/machine-cli.js';
 import { registerAgentEnvCommands } from './cli/agent-env-cli.js';
 import { registerScheduleCommands } from './cli/schedule-cli.js';
+import { registerGuardianCommands } from './cli/guardian-cli.js';
 export { runSchedule, scheduleCreatePlan } from './cli/schedule-cli.js';
 export type { ScheduleDispatch } from './cli/schedule-cli.js';
 import { registerReviewLoopOptions, buildReviewLoopOpts } from './agent-mission/review-loop-cli.js';
@@ -75,6 +76,7 @@ import { registerIntakeCommands } from './cli/intake-cli.js';
 import { registerTasksCommands } from './cli/tasks-cli.js';
 import { registerBriefCommands } from './cli/brief-cli.js';
 import { registerNotifyCommand } from './cli/notify-cli.js';
+import { registerAwayCommand } from './cli/away-cli.js';
 import { registerLabelsCommands } from './cli/labels-cli.js';
 import { registerMsgCommands } from './cli/msg-cli.js';
 import { registerDoctorCommand } from './cli/doctor-cli.js';
@@ -215,6 +217,23 @@ export { cliVersion, setInstallMetadataRootForTesting };
 export const program = new Command();
 program.enablePositionalOptions();
 
+program.command('preview <target>')
+  .description('Isolated PR/branch-head TUI + PWA preview; publish the TUI-COMFORT friction table to a PR')
+  .option('--scenario <id>', 'TUI-COMFORT scenario (default S2)', 'S2')
+  .option('--flag <path>', 'Enable an existing config feature flag in main-based preview (repeatable)', (value: string, all: string[]) => [...all, value], [] as string[])
+  .option('--comment-pr <number>', 'PR to receive a branch/main preview report', (value: string) => Number(value))
+  .action(async (target: string, opts: { scenario: string; flag: string[]; commentPr?: number }) => {
+    try {
+      const { runPrPreview } = await import('./self-dev/pr-preview.js');
+      const result = await runPrPreview({ target, repoRoot: process.cwd(), scenario: opts.scenario, flags: opts.flag, ...(opts.commentPr === undefined ? {} : { commentPr: opts.commentPr }) });
+      console.log(`preview ${result.status} · ${result.head} · PR #${result.prNumber} · comment posted`);
+      if (result.status !== 'passed') process.exitCode = 1;
+    } catch (error) {
+      console.error(error instanceof Error ? error.message : String(error));
+      process.exitCode = 1;
+    }
+  });
+
 export { SELF_SEND_RECENT_FRAME_WINDOW_MS, SELF_SEND_STALE_HEARTBEAT_MS, formatSelfSendCandidateDisplay } from './harness/self-send-decide.js';
 export type { SelfSendCandidate, SelfSendCandidateDisplay } from './harness/self-send-decide.js';
 import { decideSelfSend, type SelfSendCandidate } from './harness/self-send-decide.js';
@@ -891,6 +910,7 @@ registerResearchCommand(program);
 registerReleaseCommands(program);
 registerKnowCommand(program);
 registerNotifyCommand(program);
+registerAwayCommand(program);
 registerFreezeCommands(program);
 registerFlowCommands(program);
 // HQ-HB · HQ-FENCE (10-04): one writer across mbp · node-b · cloud-vm — lease on the arbiter, 2-of-3 quorum, generation fencing.
@@ -5979,6 +5999,7 @@ program
   });
 
 registerScheduleCommands(program);
+registerGuardianCommands(program);
 
 /** `elanous decide*` 공통 — 보낼 곳과 자격을 정한다(설정 decide.endpoint > ELANOUS_JEV_ENDPOINT > Typesafe). 없으면 안내하고 rc 2. */
 async function loadJevAccessOrExit(): Promise<import('./decide/jev.js').JevAccess> {
@@ -7173,7 +7194,7 @@ const selfDevCmd = program
             const members = parsePodPool(devAskSubstrate.pool!);
             const host = podPoolHostLease(members);
             while (!authoringLease) {
-              const status = recommendConcurrency(measurePoolLease(members), { capacity: members.reduce((n, m) => n + m.capacity, 0), accounts: 0, perAccount: 0 });
+              const status = recommendConcurrency(measurePoolLease(members, { measureUsage: true }), { capacity: members.reduce((n, m) => n + m.capacity, 0), accounts: 0, perAccount: 0 });
               if (status.recommended !== null && status.recommended > 0) {
                 const { leaseHasPendingPod } = await import('./pod-lease/host-lease.js');
                 const pendingJobs = status.pendingJobs ?? [];
@@ -7328,7 +7349,23 @@ const selfDevCmd = program
         if (hasExplicitReviewerContext && loaded.failed.length > 0) throw new DevPipelineError(contextStatus);
         if (loaded.items.length > 0) spec = { ...spec, reviewerContext: loaded.items };
       }
-      if (devOpts.worktree === true) {
+      // ⭐ TUI-ONE-WORD-LAUNCH — 명시 격리 우주에서 `--cwd`·`--worktree` 둘 다 없으면 «자동» 갈래로
+      //    같은 `prepareDevWorktree` 를 탄다(새 생성 경로 없음). 명시 `--cwd` 는 그대로 이긴다.
+      const autoWorktreeDecision = await (async () => {
+        if (!devOpts.elanous || devOpts.worktree === true || devOpts.cwd !== undefined) {
+          return devCli.decideAutoWorktree({ explicitlyIsolated: false, ...devOpts });
+        }
+        const [{ resolveCurrentInstance }, { isExplicitlyIsolated }] = await Promise.all([
+          import('./instance/current.js'),
+          import('./cli/pty-drive-cli.js'),
+        ]);
+        return devCli.decideAutoWorktree({
+          explicitlyIsolated: isExplicitlyIsolated(resolveCurrentInstance(), devOpts.isolatedRoot),
+          ...devOpts,
+        });
+      })();
+      debug.log('dev-pipeline', 'auto-worktree-decision', { runId: devRunId, decision: autoWorktreeDecision });
+      if (autoWorktreeDecision === 'requested' || autoWorktreeDecision === 'auto') {
         const { prepareDevWorktree, renderPreparedDevWorktree } = await import('./harness/harness-worktree-auto.js');
         const goal = 'file' in input
           ? await (async () => {
@@ -7338,13 +7375,25 @@ const selfDevCmd = program
               return { id: goalId, file: input.file };
             })()
           : undefined;
-        const prepared = prepareDevWorktree(process.cwd(), devRunId, invokedAsDrive ? 'drive' : 'dev', goal);
+        const prepared = (() => {
+          try {
+            return prepareDevWorktree(process.cwd(), devRunId, invokedAsDrive ? 'drive' : 'dev', goal);
+          } catch (error) {
+            if (autoWorktreeDecision !== 'auto') throw error;
+            debug.log('dev-pipeline', 'auto-worktree-failed', { runId: devRunId, cwd: process.cwd(), msg: error instanceof Error ? error.message : String(error) }, { level: 'warn' });
+            throw new DevPipelineError(devCli.formatAutoWorktreeFailure(error));
+          }
+        })();
         preparedWorktree = prepared;
         if (spec.elanous) spec = { ...spec, elanous: { ...spec.elanous, cwd: prepared.worktree.path } };
         else if (spec.drive) spec = { ...spec, drive: { ...spec.drive, cwd: prepared.worktree.path } };
         else throw new DevPipelineError('--worktree 는 elanous 또는 셸 drive child에만 유효');
         if (!opts.json) console.log(renderPreparedDevWorktree(prepared).join('\n'));
         debug.log('dev-pipeline', 'auto-worktree-prepared', { runId: devRunId, ...prepared.environment, worktree: prepared.worktree });
+        if (autoWorktreeDecision === 'auto') {
+          if (!opts.json) console.log(devCli.formatAutoWorktreeNotice(prepared.worktree.path));
+          debug.log('dev-pipeline', 'auto-worktree-implied', { runId: devRunId, worktree: prepared.worktree.path });
+        }
       }
       // ⛔ 종전의 `const plan = planDevPipeline(spec)` 를 지운다(무인 리뷰 must-fix) — 쓰이지 않는
       //    데다 **잔여 조회보다 먼저 던질 수 있어** 관측 자체를 건너뛰게 만든다. 계획은 어차피

package/src/instance/test-write-guard-spy-first.fixture.ts

@@ -0,0 +1,13 @@
+// Child fixture for test-write-guard.test.ts: a bare spy installed BEFORE outbound-alert is imported must not
+// make the captured «real» curl look like a fake. Prints {refused, curlCalls}.
+import { spyOn } from 'bun:test';
+import * as childProcess from 'node:child_process';
+
+const bare = spyOn(childProcess, 'execFileSync');
+const { sendTelegramDirect } = await import('../domains/outbound-alert.js');
+const { getUserConfig } = await import('../user-config.js');
+const base = getUserConfig();
+const config = { ...base, telegram: { ...base.telegram, channels: undefined, botToken: '2:fake', homeChannel: 2 } } as typeof base;
+let refused = '';
+try { sendTelegramDirect('private-alert-body', 'ops-alert', { config }); } catch (e) { refused = e instanceof Error ? e.name : String(e); }
+console.log(JSON.stringify({ refused, curlCalls: bare.mock.calls.length }));