elanous 0.2.27 → 0.2.28

package/src/cli/plugin-cli.ts

@@ -6,7 +6,8 @@ import { existsSync, readFileSync } from 'node:fs';
 import { elanousStateRoot } from '../autopilot/state-paths.js';
 import { userConfigPath } from '../user-config.js';
 import { debug, redactSecretText } from '../debug/log.js';
-import { addMarket, ensureInternalMarketIndex, listMarkets, MarketFetchError, updateMarket } from '../plugins/install/market-fetch.js';
+import { addMarket, codexPluginPackagePath, ensureInternalMarketIndex, listMarkets, MarketFetchError, updateMarket } from '../plugins/install/market-fetch.js';
+import { readCodexPluginList } from '../acp/codex-plugins.js';
 import { emitDecision } from '../live/detail-switch.js';
 import { OFFICIAL_INDEX_KEYS } from '../market/official-keys.js';
 import { installPlugin, listInstalledPlugins, PluginInstallError, removePlugin, type InstallEvent } from '../plugins/install/plugin-install.js';
@@ -118,15 +119,22 @@ export function registerPluginCommands(program: Command): void {
       }
     });
   plugin.command('add <spec>').description('Install a local path, pinned git plugin or signed market plugin')
+    .option('--from-codex', 'Import an installed Codex plugin by name@marketplace')
     .option('--yes', 'Accept requested capabilities')
     .option('--json', 'NDJSON progress events')
     .option('--allow-unsigned', 'Allow unsigned marketplace indices')
     .option('--refresh', 'Refresh the signed marketplace index before installing')
-    .action(async (spec: string, opts: { yes?: boolean; json?: boolean; allowUnsigned?: boolean; refresh?: boolean }) => {
+    .action(async (spec: string, opts: { yes?: boolean; json?: boolean; allowUnsigned?: boolean; refresh?: boolean; fromCodex?: boolean }) => {
       try {
         const root = elanousStateRoot();
         const nodeCount = { value: 0 };
-        await installPlugin(spec, {
+        let source = spec;
+        if (opts.fromCodex) {
+          const match = /^([a-z0-9][a-z0-9-]{1,39})@([a-z0-9][a-z0-9-]{1,39})$/.exec(spec);
+          if (!match) throw new PluginInstallError('io', 'Codex import requires name@marketplace');
+          source = codexPluginPackagePath(await readCodexPluginList(), match[1]!, match[2]!);
+        }
+        await installPlugin(source, {
           root, marketDir: join(root, 'plugins', 'markets'), trustedKeys: keys(),
           yes: opts.yes, allowUnsigned: opts.allowUnsigned, refresh: opts.refresh,
           onEvent: event => outputEvent(event, !!opts.json, nodeCount),

package/src/cli/pr-cli.ts

@@ -58,7 +58,9 @@ import { parseReleaseNoteSection } from '../release-loop/release-note.js';
 import { landingFreezeMessage } from '../release-loop/landing-freeze.js';
 import { admitLandingMerge } from '../self-implement/frozen-merges.js';
 import { verifyAncestorAutoPass, verifyOverlapEvidence } from './pr-land-overlap-evidence.js';
+import { observePrLandRefusal } from './pr-land-refusal.js';
 import { taskAgentStatePath } from '../task-agent/task-hand.js';
+import { PR_LABEL_NAMES } from '../github/pr-labels.js';
 import { enqueueL8ShadowQueue, runL8ShadowQueue, shadowPrNumber, statusL8ShadowQueue, type L8ShadowQueueDeps } from '../self-implement/l8-merge-queue.js';
 
 export { branchLineageSlug, findSiblingPrs };
@@ -1143,8 +1145,36 @@ export function runPrGranularity(opts: PrGranularityOpts = {}, deps: PrLandDeps
 const GITHUB_MERGEABLE = new Set(['MERGEABLE', 'CONFLICTING', 'UNKNOWN']);
 const GITHUB_MERGE_STATE = new Set(['BEHIND', 'BLOCKED', 'CLEAN', 'DIRTY', 'DRAFT', 'HAS_HOOKS', 'UNKNOWN', 'UNSTABLE']);
 
+/** Read-only identity check shared by pinned landing and its dry-run. Later landing gates still run only on a real landing. */
+function inspectPinnedPr(run: CmdRunner, cwd: string, pr: number, expectedHead: string) {
+  const viewed = run('gh', ['pr', 'view', String(pr), '--json', 'headRefOid,headRefName,state,isDraft,url'], { cwd });
+  let value: { headRefOid?: string; headRefName?: string; state?: string; isDraft?: boolean; url?: string } = {};
+  try {
+    if (viewed.ok) {
+      const parsed: unknown = JSON.parse(viewed.out);
+      if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) value = parsed as typeof value;
+    }
+  } catch { /* unreadable is not approval */ }
+  const local = run('git', ['rev-parse', 'HEAD'], { cwd });
+  const dirty = run('git', ['status', '--porcelain'], { cwd });
+  const reasons: string[] = [];
+  if (value.state !== 'OPEN') reasons.push('PR is not OPEN or its state is unavailable');
+  if (value.isDraft !== false) reasons.push(value.isDraft === true ? 'PR is draft' : 'PR ready status is unavailable');
+  if (value.headRefOid?.toLowerCase() !== expectedHead.toLowerCase()) reasons.push('PR head differs from --expected-head or is unavailable');
+  if (!value.url?.endsWith(`/pull/${pr}`) || !value.headRefName) reasons.push('PR identity or head branch is unavailable');
+  if (!local.ok || local.out.trim().toLowerCase() !== expectedHead.toLowerCase()) reasons.push('local HEAD differs from --expected-head or is unavailable');
+  if (!dirty.ok || dirty.out.trim()) reasons.push(dirty.ok ? 'local worktree is dirty' : 'local worktree status is unavailable');
+  return { ok: reasons.length === 0, reasons, branch: value.headRefName, url: value.url };
+}
+
 export async function runPrLand(opts: PrLandOpts = {}, deps: PrLandDeps = {}): Promise<number> {
   const out = deps.out ?? liveOut;
+  // First slice: observe pinned identity/branch, overlap decision, and GitHub merge refusals.
+  // Option syntax and prerequisite gate errors do not describe a merge recovery edge.
+  const refuse = (message: string, context: { isDraft?: boolean } = {}): void => {
+    out.error(message);
+    observePrLandRefusal(message, context);
+  };
   if (opts.title !== undefined && opts.titleFile !== undefined) {
     out.error('✗ title: --title과 --title-file은 함께 사용할 수 없습니다.');
     return 1;
@@ -1248,6 +1278,31 @@ export async function runPrLand(opts: PrLandOpts = {}, deps: PrLandDeps = {}): P
     out.log('- Mutations (ready/edit/create/merge, git commit/push, worktree): NOT RUN');
     return 0;
   }
+  if (opts.dryRun && pinned) {
+    const pr = Number(opts.pr);
+    if (!/^[1-9]\d*$/.test(opts.pr ?? '') || !Number.isSafeInteger(pr) || !/^[a-f0-9]{40}$/i.test(opts.expectedHead ?? '')) {
+      out.error('✗ expected-head: --pr and --expected-head (full SHA) are required together without --hold');
+      return 1;
+    }
+    if (opts.hold) {
+      out.error('✗ dry-run: --hold 는 머리 고정 읽기 전용 예행과 함께 사용할 수 없습니다.');
+      return 1;
+    }
+    if (opts.overlapEvidence !== undefined) {
+      out.error('✗ dry-run: --overlap-evidence 는 머리 고정 읽기 전용 예행에서 사용할 수 없습니다.');
+      return 1;
+    }
+    const inspected = inspectPinnedPr(run, cwd, pr, opts.expectedHead!);
+    const branch = (deps.currentBranch ?? liveCurrentBranch)(cwd);
+    const reasons = [...inspected.reasons];
+    if (!branch || branch !== inspected.branch) reasons.push('current branch differs from the PR head branch or is unavailable');
+    out.log(`[dry-run] pinned PR #${pr} · expected head ${opts.expectedHead}`);
+    for (const reason of reasons) out.log(`[dry-run] ✗ preflight: ${reason}`);
+    if (reasons.includes('PR is draft')) out.log(`[dry-run] 선행: eln gh pr ready ${pr}`);
+    if (reasons.length === 0) out.log('[dry-run] ✓ preflight: PR OPEN non-draft, matching PR/local HEAD and branch, clean worktree');
+    out.log('[dry-run] Remaining landing gates, freeze, overlap and merge: UNMEASURED; no PR or git state changed.');
+    return reasons.length === 0 ? 0 : 1;
+  }
   if (opts.overlapEvidence !== undefined && (!pinned || !opts.overlapEvidence.trim())) {
     out.error('✗ overlap-evidence: --overlap-evidence <file> 는 --pr ⊕ --expected-head 머리 고정 착지에서만 쓴다.');
     return 1;
@@ -1256,30 +1311,26 @@ export async function runPrLand(opts: PrLandOpts = {}, deps: PrLandDeps = {}): P
   let pinnedUrl: string | undefined;
   if (pinned) {
     const pr = Number(opts.pr);
-    if (!/^[1-9]\d*$/.test(opts.pr ?? '') || !Number.isSafeInteger(pr) || !/^[a-f0-9]{40}$/i.test(opts.expectedHead ?? '') || opts.hold || opts.dryRun) {
-      out.error('✗ expected-head: --pr and --expected-head (full SHA) are required together without --hold/--dry-run');
+    if (!/^[1-9]\d*$/.test(opts.pr ?? '') || !Number.isSafeInteger(pr) || !/^[a-f0-9]{40}$/i.test(opts.expectedHead ?? '') || opts.hold) {
+      out.error('✗ expected-head: --pr and --expected-head (full SHA) are required together without --hold');
       return 1;
     }
-    const viewed = run('gh', ['pr', 'view', String(pr), '--json', 'headRefOid,headRefName,state,isDraft,url'], { cwd });
-    let value: { headRefOid?: string; headRefName?: string; state?: string; isDraft?: boolean; url?: string } = {};
-    try { if (viewed.ok) value = JSON.parse(viewed.out) as typeof value; } catch { /* unreadable is not approval */ }
-    const local = run('git', ['rev-parse', 'HEAD'], { cwd });
-    const dirty = run('git', ['status', '--porcelain'], { cwd });
-    if (value.state !== 'OPEN' || value.isDraft !== false || value.headRefOid?.toLowerCase() !== opts.expectedHead!.toLowerCase()
-      || !value.url?.endsWith(`/pull/${pr}`) || !value.headRefName || !local.ok || local.out.trim().toLowerCase() !== opts.expectedHead!.toLowerCase()
-      || !dirty.ok || dirty.out.trim()) {
-      out.error('✗ expected-head: PR OPEN non-draft, matching local HEAD and clean worktree required');
+    const inspected = inspectPinnedPr(run, cwd, pr, opts.expectedHead!);
+    if (!inspected.ok) {
+      refuse('✗ expected-head: PR OPEN non-draft, matching local HEAD and clean worktree required', {
+        isDraft: inspected.reasons.includes('PR is draft'),
+      });
       return 1;
     }
-    pinnedBranch = value.headRefName;
-    pinnedUrl = value.url;
+    pinnedBranch = inspected.branch;
+    pinnedUrl = inspected.url;
   }
   const resolveBase = deps.resolveBase ?? resolveDeliverableBase;
   const branch = (deps.currentBranch ?? liveCurrentBranch)(cwd);
   if (!branch || (pinned && branch !== pinnedBranch)) {
     const detail = pinned ? 'PR head branch와 현재 브랜치가 다릅니다.' : '현재 브랜치를 해석하지 못했습니다.';
     record('branch', false);
-    out.error(`✗ branch: ${detail}`);
+    refuse(`✗ branch: ${detail}`);
     return 1;
   }
   record('branch', true);
@@ -1664,6 +1715,7 @@ export async function runPrLand(opts: PrLandOpts = {}, deps: PrLandDeps = {}): P
   const hold = !!opts.hold || overlapDecision?.outcome === 'user-hold';
   // TA-LAND-OVERLAP — 비대화형 «승인 불가»만 증거로 대신한다(사람의 hold 는 증거로 뒤집지 않는다) · 증거가 없거나 어긋나면 종전 거부 그대로.
   let overlapEvidenceAccepted = false;
+  let ancestorResyncNeeded = false;
   if (pinned && overlapDecision?.outcome === 'unavailable' && opts.overlapEvidence !== undefined) {
     const ref = resolveRemoteBranchRef(run, cwd, base);
     const verdict = verifyOverlapEvidence({
@@ -1678,7 +1730,7 @@ export async function runPrLand(opts: PrLandOpts = {}, deps: PrLandDeps = {}): P
           ? `✓ overlap-evidence: base-advanced-disjoint — gate base ${verdict.gateBase.slice(0, 12)} ⊂ head ${opts.expectedHead!.slice(0, 12)} · ${ref.remote}/${ref.branch} ${verdict.baseTip.slice(0, 12)} 까지 ${verdict.windowCommits}개 커밋이 PR 파일을 안 건드린다 · review pass|warn must-fix 0 (${verdict.reviewResult})`
           : `✓ overlap-evidence: ${ref.remote}/${ref.branch} ${verdict.baseTip.slice(0, 12)} ⊂ head ${opts.expectedHead!.slice(0, 12)} · gate passed on that base · review pass must-fix 0 (${verdict.reviewResult})`);
     }
-    else out.error(`✗ overlap-evidence: ${verdict.reason}`);
+    else refuse(`✗ overlap-evidence: ${verdict.reason}`);
   } else if (pinned && overlapDecision?.outcome === 'unavailable') {
     // 증거 파일이 없을 때 — 겹친 착지가 전부 머리의 조상이고 표준 자리의 리뷰가 pass|warn ⊕ must-fix 0 이면 통과(아니면 종전 거부).
     const verdict = verifyAncestorAutoPass({
@@ -1690,9 +1742,19 @@ export async function runPrLand(opts: PrLandOpts = {}, deps: PrLandDeps = {}): P
     if (verdict.ok) {
       out.log(`✓ overlap-evidence: already-ancestor-auto — 겹친 최근 착지 ${overlappingLandings.length}개가 전부 head ${opts.expectedHead!.slice(0, 12)} 의 조상 · review pass|warn must-fix 0 (${verdict.reviewResult})`);
     }
-    else out.error(`✗ ancestor-auto: ${verdict.reason}`);
+    else {
+      refuse(`✗ ancestor-auto: ${verdict.reason}`);
+      ancestorResyncNeeded = verdict.reason.startsWith('ancestor-auto-not-ancestor:');
+    }
   }
   if (pinned && overlapDecision && overlapDecision.outcome !== 'user-merge' && !overlapEvidenceAccepted) {
+    // A clean GitHub PR can still be behind a recently landed overlapping head. Preserve the cue
+    // across hosts; the current steward tick acts only if it can also prove local run ownership.
+    if (ancestorResyncNeeded && !opts.dryRun) {
+      const marked = run('gh', ['pr', 'edit', String(opts.pr), '--add-label', PR_LABEL_NAMES.needsRebase], { cwd });
+      record('resync-marker', marked.ok, { pr: Number(opts.pr), reason: 'ancestor-auto-not-ancestor' });
+      if (!marked.ok) out.error('⚠ resync-marker: needs-rebase 라벨을 남기지 못했습니다');
+    }
     out.error('✗ expected-head: overlap merge approval unavailable for the reviewed head');
     return 1;
   }
@@ -1753,7 +1815,7 @@ export async function runPrLand(opts: PrLandOpts = {}, deps: PrLandDeps = {}): P
     if (opts.hold) {
       out.log(`[dry-run] ${existing.url ? '기존 PR을 갱신' : 'PR을 생성'}하고 --hold 로 병합하지 않고 멈춥니다.`);
     } else {
-      out.log(`[dry-run] ${existing.url ? '기존 PR을 갱신하고 ready 상태를 보장' : 'PR을 생성하고 ready 상태를 보장'}한 뒤 squash merge 합니다.`);
+      out.log(`[dry-run] 머리 고정 없는 일반 착지: ${existing.url ? '기존 PR을 갱신하고 ready 상태를 보장' : 'PR을 생성하고 ready 상태를 보장'}한 뒤 squash merge 합니다.`);
     }
     return 0;
   }
@@ -1927,7 +1989,7 @@ export async function runPrLand(opts: PrLandOpts = {}, deps: PrLandDeps = {}): P
       ...(mergeable ? { mergeable } : {}),
       ...(mergeStateStatus ? { mergeStateStatus } : {}),
     });
-    out.error(`✗ merge: ${detail}`);
+    refuse(`✗ merge: ${detail}`);
     if (mergeable === 'CONFLICTING') {
       out.error('  ↳ 충돌 — 이 브랜치가 기준 브랜치의 최근 착지와 같은 줄을 고쳤다. `bun bin/elanous.mjs git fetch origin` → `bun bin/elanous.mjs git rebase origin/<기준>` 로 풀고 다시 pr land.');
     }

package/src/cli/pr-land-refusal.ts

@@ -0,0 +1,20 @@
+import { readJourneyEdge, recordJourneyEdge } from '../self-dev/graph-journey-route.js';
+import { debug } from '../debug/log.js';
+
+/** The five outcomes of an observed `pr land` refusal. This function never retries a landing. */
+export type PrLandRefusal = 'draft' | 'head-branch' | 'not-ancestor' | 'review-missing' | 'other';
+
+export function classifyPrLandRefusal(message: string, context: { isDraft?: boolean } = {}): PrLandRefusal {
+  if (context.isDraft === true && message.startsWith('✗ expected-head: PR OPEN non-draft')) return 'draft';
+  if (message.startsWith('✗ branch: PR head branch와 현재 브랜치가 다릅니다.')) return 'head-branch';
+  if (message.startsWith('✗ ancestor-auto: ancestor-auto-not-ancestor:')) return 'not-ancestor';
+  if (/^✗ (?:ancestor-auto|overlap-evidence): (?:review-missing|review-not-reviewed|review-error|review-no-result|review-unreadable|review-pr-mismatch|review-head-mismatch|review-path-not-for-this-pr-head|review-verdict-null|review-must-fix-unknown)(?:\b|$)/.test(message)) return 'review-missing';
+  return 'other';
+}
+
+/** Read the declared recovery edge and observe the refusal. No recovery command runs here. */
+export function observePrLandRefusal(message: string, context: { isDraft?: boolean } = {}): void {
+  const route = readJourneyEdge('merge', classifyPrLandRefusal(message, context));
+  if (route.to !== null) recordJourneyEdge(route, route.to, 'pr-land-refused; recovery-execution=none');
+  else debug.log('self-implement', 'graph-edge-unresolved', { from: 'merge', label: route.label, reason: 'pr-land-refused; recovery-execution=none' });
+}

package/src/cli/release-cli.ts

@@ -53,6 +53,7 @@ import { autoStartScheduledRelease, type AutoStartDeferral } from '../release-lo
 import { runRehearsalTick, type RehearsalDeps } from '../release-loop/rehearsal.js';
 import { landingFreezeMessage, LandingFrozenError, readLandingFreeze } from '../release-loop/landing-freeze.js';
 import { formatLightRc, runLightRc, type LightRcDeps } from '../release-loop/light-rc.js';
+import { registerRfcCommands } from './rfc-cli.js';
 
 export const DEFAULT_PUBLIC_REPO = 'ElanvitalAI/elanous';
 const SEMVER = /^\d+\.\d+\.\d+(?:-(?:rc|alpha|beta)\.\d+)?$/;
@@ -623,6 +624,7 @@ function compareReleaseVersions(a: string, b: string): number {
 }
 
 export function registerReleaseCommands(program: Command, releaseRunDeps: UnattendedReleaseDeps = {}, landedDeps: LandedButYellowDeps = {}, hqDeps: HqDeps = {}, lightRcDeps: LightRcDeps = {}, rehearsalDeps: RehearsalDeps = {}): void {
+  registerRfcCommands(program);
   const release = program.command('release').description('공개 배포 한 판 — prepare(로컬) → publish(--yes) → verify (docs/manual/MANUAL-versioning-and-release-2026-09-25.md)');
   const schedule = release.command('schedule').description('판별 컷·착지 마감 조회·갱신');
   const scheduleLedgerRoot = () => releaseRunDeps.ledgerRoot ?? releaseLedgerRoot();

package/src/cli/rfc-cli.ts

@@ -0,0 +1,24 @@
+import type { Command } from 'commander';
+import { CliUserError } from './cli-user-error.js';
+import { listRfcs, showRfc } from '../rfc-registry/registry.js';
+
+/** RFC-REGISTRY first slice: list/show initialize an empty registry if needed, then only read rows. */
+export function registerRfcCommands(program: Command): void {
+  const rfc = program.command('rfc').description('RFC registry (list/show initialize the database when absent)');
+  rfc.command('list').description('registered RFCs').option('--json', 'JSON rows')
+    .action((opts: { json?: boolean }) => {
+      const rows = listRfcs();
+      if (opts.json) console.log(JSON.stringify(rows));
+      else for (const row of rows) console.log(`${row.id} · ${row.status} · ${row.title}`);
+    });
+  rfc.command('show <id>').description('RFC and its items').option('--json', 'JSON record')
+    .action((id: string, opts: { json?: boolean }) => {
+      const row = showRfc(id);
+      if (!row) throw new CliUserError(`없는 RFC: ${id}`);
+      if (opts.json) console.log(JSON.stringify(row));
+      else {
+        console.log(`${row.id} · ${row.status} · ${row.title}`);
+        for (const item of row.items) console.log(`  ${item.id} · ${item.status} · ${item.title}${item.links.length ? ` → ${item.links.map((link) => link.target_item_id).join(', ')}` : ''}`);
+      }
+    });
+}

package/src/cli/tailscale-serve.ts

@@ -1,17 +1,14 @@
 // Unified Tailscale Serve helper — single source of truth for the
 // two transport modes monad-agent uses on macOS:
 //
-//   - `https-443` — share the daemon on the host's standard HTTPS:443
-//                   (one Serve per host · used by `pwa share enable`
-//                   and the legacy `bringShareUp` auto-share path in
-//                   `pwa-start`). HTTP/2 forwarder · NOT WebSocket-
-//                   friendly (Upgrade returns 502).
+//   - `https-443` — explicit legacy mode on the host's standard HTTPS:443.
+//                   HTTP/2 forwarding does not preserve WebSocket Upgrade
+//                   (the daily PWA sharing path no longer selects it).
 //
 //   - `tls-tcp`   — per-port TLS terminator forwarding plaintext TCP
 //                   (HTTP/1.1) to a backend on `localhost:<port>`.
-//                   Used by `pwa test --https` for project-local
-//                   isolated dogfood. WebSocket Upgrade returns 101
-//                   (the iPad-side multi-LLM dispatch needs this).
+//                   Used by `pwa share enable`, `pwa-start` auto-share and
+//                   `pwa test --https`. WebSocket Upgrade returns 101.
 //
 // Why unify? Before this lift, `defaultServe` (https-443) and
 // `mountTailscaleTestServe` (tls-tcp) duplicated: