elanous 0.2.29 → 0.2.31

package/scripts/detect-test-interference.ts

@@ -1,4 +1,9 @@
 #!/usr/bin/env bun
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { prepareIsolatedTestEnv } from './lib/deterministic-env.js';
+
 export const EXIT_NO_INTERFERENCE = 0;
 export const EXIT_INTERFERENCE = 1;
 export const EXIT_INVALID_INPUT = 2;
@@ -19,7 +24,7 @@ export type BunTestChild = {
   exited: Promise<number>;
   signalCode: string | null;
 };
-export type BunSpawn = (options: { cmd: string[]; cwd: string; stdout: 'pipe'; stderr: 'pipe' }) => BunTestChild;
+export type BunSpawn = (options: { cmd: string[]; cwd: string; env: NodeJS.ProcessEnv; stdout: 'pipe'; stderr: 'pipe' }) => BunTestChild;
 
 export type MeasuredRun = {
   files: string[];
@@ -45,10 +50,38 @@ export const MAX_ISOLATED_FAILURE_FILES = 8;
 
 const defaultBunSpawn: BunSpawn = (options) => Bun.spawn(options) as unknown as BunTestChild;
 
-export async function runBunTest(files: readonly string[], spawn: BunSpawn = defaultBunSpawn, cwd: string = process.cwd()): Promise<RunnerResult> {
-  const child = spawn({ cmd: [process.execPath, 'test', ...files], cwd, stdout: 'pipe', stderr: 'pipe' });
-  const [stdout, stderr, exitCode] = await Promise.all([new Response(child.stdout).text(), new Response(child.stderr).text(), child.exited]);
-  return { stdout, stderr, exitCode, signal: child.signalCode };
+/**
+ * ⛔ 2026-10-16 사고(R7 · OP #8751) — 이 러너가 `bun test` 를 env 지정 없이 띄워 호스트 재게이트가 mbp 의 실 HOME·운영
+ * config 를 시험에 물려줬다. seam 이 빠진 시험 둘(tasks-cli · COORD-ONE)이 운영 `taskAgent.parentHost` 목록으로 진짜 ssh
+ * 발사를 해 원격 prod 런 25 · draft PR 11 이 생겼다.
+ * ⇒ 시험은 «게이트와 같은» 격리 env 로 띄운다(`prepareIsolatedTestEnv` — 임시 HOME ⊕ 임시 ELANOUS_STATE_DIR ⊕ 자격·실행
+ *   정체성·`ELANOUS_STATE_DIR_SOURCE` 제거 · PATH 보존) ⊕ 원격 부모 끔(`ELANOUS_TA_PARENT_HOST=off`).
+ */
+export async function isolatedBunTestEnv(sourceEnv: NodeJS.ProcessEnv = process.env): Promise<{ env: NodeJS.ProcessEnv; cleanup: () => void }> {
+  // ⛔ Import the side-effect-free lib, never `test-deterministic.ts`: that file pulls `typescript` and Bun stream
+  //    types into every graph that reaches this runner — the PWA tsc program failed on it (#28474 train · 10-16).
+  const root = mkdtempSync(join(tmpdir(), 'elanous-interference-test-'));
+  const cleanup = (): void => {
+    try { rmSync(root, { recursive: true, force: true }); }
+    catch (error) {
+      // 판정은 막지 않되 숨기지 않는다 — 남은 임시 뿌리는 경로로 찾을 수 있게 한 줄 남긴다(리뷰 should-fix).
+      try { process.stderr.write(`[detect-test-interference] temp env root cleanup failed: ${root}: ${error instanceof Error ? error.message : String(error)}\n`); } catch { /* ignore */ }
+    }
+  };
+  try {
+    return { env: { ...prepareIsolatedTestEnv(sourceEnv, root), ELANOUS_TA_PARENT_HOST: 'off' }, cleanup };
+  } catch (error) { cleanup(); throw error; }
+}
+
+export async function runBunTest(files: readonly string[], spawn: BunSpawn = defaultBunSpawn, cwd: string = process.cwd(), sourceEnv: NodeJS.ProcessEnv = process.env): Promise<RunnerResult> {
+  const isolated = await isolatedBunTestEnv(sourceEnv);
+  try {
+    const child = spawn({ cmd: [process.execPath, 'test', ...files], cwd, env: isolated.env, stdout: 'pipe', stderr: 'pipe' });
+    const [stdout, stderr, exitCode] = await Promise.all([new Response(child.stdout).text(), new Response(child.stderr).text(), child.exited]);
+    return { stdout, stderr, exitCode, signal: child.signalCode };
+  } finally {
+    isolated.cleanup();
+  }
 }
 
 export function parseFailureCount(output: string): number | null {

package/scripts/gate-pr-cache.ts

@@ -0,0 +1,65 @@
+#!/usr/bin/env bun
+/** Read-only OP train adapter: one JSON decision, never launches a gate or edits a queue. */
+import { readFileSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
+import { resolve } from 'node:path';
+import { decidePrGateCache } from './release-loop/gate-pr-cache.js';
+import { buildClosureGraph, gitClosureTree, testsReachingChanged } from './release-loop/gate-closure.js';
+
+const SHA = /^[0-9a-f]{40}$/i;
+const argv = process.argv.slice(2);
+const option = (name: string): string | undefined => {
+  const index = argv.indexOf(name);
+  return index >= 0 ? argv[index + 1] : undefined;
+};
+const summaryPath = option('--summary');
+const repo = option('--repo');
+const head = option('--head')?.toLowerCase();
+const main = option('--main')?.toLowerCase();
+const singlePr = argv.includes('--single-pr');
+if (!summaryPath || !repo || !head || !main || !SHA.test(head) || !SHA.test(main) || !singlePr) {
+  console.error('usage: bun scripts/gate-pr-cache.ts --summary <author-summary.json> --repo <git-repo> --head <PR-head40> --main <main40> --single-pr');
+  process.exit(2);
+}
+const git = (args: string[]): { status: number | null; stdout: string } => {
+  // git-spawn-allow: read-only object ancestry and path diff; this adapter never checks out or mutates.
+  const result = spawnSync('git', args, { cwd: resolve(repo), encoding: 'utf8', maxBuffer: 16 * 1024 * 1024 });
+  return { status: result.status, stdout: result.stdout ?? '' };
+};
+let summary: unknown;
+try { summary = JSON.parse(readFileSync(summaryPath, 'utf8')); } catch { summary = null; }
+const base = summary && typeof summary === 'object' && 'base40' in summary && typeof summary.base40 === 'string'
+  ? summary.base40.toLowerCase() : '';
+const baseAncestorOfHead = SHA.test(base) && git(['merge-base', '--is-ancestor', base, head]).status === 0;
+const baseAncestorOfMain = SHA.test(base) && git(['merge-base', '--is-ancestor', base, main]).status === 0;
+const diff = baseAncestorOfMain ? git(['-c', 'core.quotepath=off', 'diff', '--name-only', '--no-renames', `${base}..${main}`]) : null;
+const mainChangedFiles = diff?.status === 0 ? diff.stdout.split(/\r?\n/).filter(Boolean) : null;
+const docs = mainChangedFiles?.filter((file) => /\.md$/.test(file));
+const added = docs?.length ? git(['-c', 'core.quotepath=off', 'diff', '--name-only', '--no-renames', '--diff-filter=A', `${base}..${main}`]) : null;
+const inertDocsAddedOnly = docs ? (!docs.length || (added?.status === 0 && docs.every((file) => added.stdout.split(/\r?\n/).includes(file)))) : null;
+let affectedTests: string[] | null = null;
+let sourceDependencyOverlap: boolean | null = null;
+if (mainChangedFiles && summary && typeof summary === 'object' && 'cohort' in summary && Array.isArray(summary.cohort)) {
+  const code = mainChangedFiles.filter((file) => /\.[cm]?[jt]sx?$/.test(file));
+  if (!code.length) { affectedTests = []; sourceDependencyOverlap = false; }
+  else try {
+    const tree = gitClosureTree(resolve(repo), head);
+    const prDiff = SHA.test(base) ? git(['-c', 'core.quotepath=off', 'diff', '--name-only', '--no-renames', `${base}..${head}`]) : null;
+    const prChanged = prDiff?.status === 0 ? prDiff.stdout.split(/\r?\n/).filter(Boolean) : null;
+    if (prChanged && code.every((file) => tree.files.includes(file))
+      && prChanged.every((file) => /\.[cm]?[jt]sx?$/.test(file) || (/\.md$/.test(file) && !/(?:^|\/)(?:test|tests|__tests__|fixtures|__fixtures__|__snapshots__|__mocks__)\//.test(file)))) {
+      const graph = buildClosureGraph(tree);
+      const seen = new Set(prChanged.filter((file) => /\.[cm]?[jt]sx?$/.test(file)));
+      const pending = [...seen];
+      while (pending.length) for (const dependency of graph.forward.get(pending.pop()!) ?? []) {
+        if (!seen.has(dependency)) { seen.add(dependency); pending.push(dependency); }
+      }
+      if ([...seen].some((file) => graph.opaque.has(file) || !graph.tracked.has(file))) throw new Error('PR source closure opaque');
+      sourceDependencyOverlap = code.some((file) => seen.has(file));
+      const closure = testsReachingChanged(tree, code, summary.cohort);
+      if (closure.ok) affectedTests = closure.tests;
+    }
+  } catch { /* unknown radius means full gate */ }
+}
+console.log(JSON.stringify(decidePrGateCache({ summary, head, main, singlePr,
+  baseAncestorOfHead, baseAncestorOfMain, mainChangedFiles, inertDocsAddedOnly, affectedTests, sourceDependencyOverlap }), null, 2));

package/scripts/gh-surface/capture.ts

@@ -0,0 +1,126 @@
+import { closeSync, constants, openSync, writeSync } from 'node:fs';
+
+// Only fixed gh vocabulary and validated field identifiers may cross this boundary.
+// Do not add positional arguments or error messages to the persisted record.
+const SUBCOMMANDS: Record<string, ReadonlySet<string>> = {
+  auth: new Set(['status', 'login', 'logout', 'token', 'refresh', 'setup-git']),
+  project: new Set(['list', 'view', 'create', 'edit', 'delete', 'close', 'field-list', 'item-list']),
+  cache: new Set(['list', 'delete']),
+  codespace: new Set(['list', 'view', 'create', 'delete', 'ssh']),
+  'ssh-key': new Set(['list', 'add', 'delete']),
+  api: new Set(['graphql']),
+  issue: new Set(['list', 'view', 'create', 'edit', 'close', 'reopen', 'comment', 'status']),
+  pr: new Set(['list', 'view', 'create', 'edit', 'checkout', 'merge', 'close', 'reopen', 'comment', 'checks', 'diff', 'status', 'ready', 'review']),
+  repo: new Set(['view', 'list', 'clone', 'create', 'edit', 'fork', 'sync']),
+  run: new Set(['list', 'view', 'watch', 'rerun', 'cancel', 'download']),
+  workflow: new Set(['list', 'view', 'run', 'enable', 'disable']),
+  release: new Set(['list', 'view', 'create', 'edit', 'delete', 'download', 'upload']),
+  label: new Set(['list', 'create', 'edit', 'delete', 'clone']),
+  search: new Set(['code', 'commits', 'issues', 'prs', 'repos']),
+  gist: new Set(['list', 'view', 'create', 'edit', 'delete', 'clone']),
+  secret: new Set(['list', 'set', 'delete']),
+  variable: new Set(['list', 'set', 'delete']),
+};
+// A syntactically valid identifier can still be a token passed as a --json value.
+// Unknown names are counted, never copied into the log. Extend only from gh's documented fields.
+const FIELDS = new Set([
+  'additions', 'assignees', 'author', 'baseRefName', 'body', 'changedFiles', 'closed',
+  'closedAt', 'comments', 'commits', 'createdAt', 'databaseId', 'deletions', 'files',
+  'headRefName', 'headRepository', 'id', 'isDraft', 'isPrivate', 'labels', 'latestReviews',
+  'maintainerCanModify', 'mergeCommit', 'mergeStateStatus', 'mergeable', 'mergedAt',
+  'mergedBy', 'milestone', 'name', 'number', 'owner', 'projectCards', 'projectItems',
+  'reactionGroups', 'reviewDecision', 'reviewRequests', 'reviews', 'state', 'status',
+  'title', 'updatedAt', 'url', 'viewerCanUpdate', 'viewerDidAuthor', 'workflowName',
+]);
+const MAX_FIELDS = 100;
+// Option arity is command-specific. Unsupported forms must not silently hide --json.
+// This is deliberately a narrow allowlist, not a global inventory of gh flags.
+const VALUE_OPTIONS_BY_COMMAND: Record<string, ReadonlySet<string>> = {
+  'api graphql': new Set(['--field', '--raw-field', '-H', '--header', '--method', '-X', '--input']),
+  'pr list': new Set(['-R', '--repo', '--limit', '-L', '--state', '-s', '--author', '--base', '--head', '--search', '-S', '--label', '-l', '--assignee', '-a', '--jq', '-q', '--template', '-t']),
+  'pr view': new Set(['-R', '--repo', '--jq', '-q', '--template', '-t']),
+  'issue list': new Set(['-R', '--repo', '--limit', '-L', '--state', '-s', '--author', '--assignee', '-a', '--label', '-l', '--search', '-S', '--jq', '-q', '--template', '-t']),
+  'run list': new Set(['-R', '--repo', '--limit', '-L', '-w', '--workflow', '--branch', '--jq', '-q', '--template', '-t']),
+};
+const SWITCH_OPTIONS_BY_COMMAND: Record<string, ReadonlySet<string>> = {
+  'repo list': new Set(['-s', '--source']),
+  'pr create': new Set(['-w', '--web']),
+};
+const UNIVERSAL_SWITCH_OPTIONS = new Set(['--help', '-h']);
+
+type CaptureRow = { command: string; fields: string[] | 'unknown'; unknown: boolean };
+
+export function classifyGhCall(args: readonly string[]): CaptureRow {
+  const root = args[0];
+  const sub = args[1];
+  const command = root && Object.hasOwn(SUBCOMMANDS, root)
+    ? root === 'api' ? (sub === 'graphql' ? 'api graphql' : 'api')
+      : sub && SUBCOMMANDS[root]!.has(sub) ? `${root} ${sub}` : 'unknown'
+    : 'unknown';
+  let unknown = command === 'unknown';
+  let fields: string[] = [];
+  let seen = false;
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i]!;
+    if (arg === '--') break;
+    if (VALUE_OPTIONS_BY_COMMAND[command]?.has(arg)) {
+      const value = args[++i];
+      if (!value || value.startsWith('-')) unknown = true;
+      continue;
+    }
+    if (SWITCH_OPTIONS_BY_COMMAND[command]?.has(arg) || UNIVERSAL_SWITCH_OPTIONS.has(arg)) continue;
+    // Sensitive payload options consume one argument without inspecting or retaining its contents.
+    if (arg === '--body' || arg === '-f' || arg === '-F') {
+      const value = args[++i];
+      if (value === undefined || value.startsWith('-')) {
+        unknown = true;
+        i--; // Parse the next option too; a missing payload must never hide --json.
+      }
+      continue;
+    }
+    if (arg === '--json' || arg.startsWith('--json=')) {
+      if (seen || root === 'api') unknown = true;
+      seen = true;
+      const value = arg === '--json' ? args[++i] : arg.slice('--json='.length);
+      const parts = value?.split(',');
+      if (!parts?.length || parts.length > MAX_FIELDS || parts.some((part) => !FIELDS.has(part))) {
+        unknown = true;
+      } else {
+        fields = parts;
+      }
+    } else if (arg.startsWith('--json')) {
+      unknown = true;
+    } else if (arg.startsWith('-') && arg !== '-') {
+      // Unknown options can consume arguments; fail closed rather than infer fields.
+      unknown = true;
+    }
+  }
+  return { command, fields: unknown ? 'unknown' : fields, unknown };
+}
+
+export function captureGhCall(args: readonly string[], file: string): void {
+  const row = JSON.stringify(classifyGhCall(args)) + '\n';
+  const fd = openSync(file, constants.O_WRONLY | constants.O_APPEND | constants.O_CREAT, 0o600);
+  try {
+    // One bounded append per invocation: concurrent children cannot interleave JSONL fragments.
+    if (writeSync(fd, row) !== Buffer.byteLength(row)) throw new Error('short JSONL write');
+  } finally {
+    closeSync(fd);
+  }
+}
+
+if (import.meta.main) {
+  const file = process.env.ELANOUS_GH_SURFACE_JSONL;
+  if (!file) {
+    console.error('gh-surface: JSONL destination not configured');
+    process.exitCode = 70;
+  } else {
+    try {
+      captureGhCall(process.argv.slice(2), file);
+    } catch {
+      // Filesystem exception text can contain a path or user input.
+      console.error('gh-surface: capture failed');
+      process.exitCode = 70;
+    }
+  }
+}

package/scripts/gh-surface/gh

@@ -0,0 +1,40 @@
+#!/bin/sh
+# Opt-in only: the launcher must prepend this directory to its isolated child's PATH.
+case ${ELANOUS_GH_REAL_BIN-} in
+  /*) ;;
+  *) printf '%s\n' 'gh-surface: real gh absolute path required' >&2; exit 70 ;;
+esac
+if [ ! -f "$ELANOUS_GH_REAL_BIN" ] || [ ! -x "$ELANOUS_GH_REAL_BIN" ] || [ "$ELANOUS_GH_REAL_BIN" -ef "$0" ]; then
+  printf '%s\n' 'gh-surface: real gh unavailable' >&2
+  exit 70
+fi
+case $0 in
+  */*) capture=${0%/*}/capture.ts ;;
+  *) printf '%s\n' 'gh-surface: wrapper path unavailable' >&2; exit 70 ;;
+esac
+capture_pid=
+forward_signal() {
+  signal=$1
+  trap - INT TERM
+  if [ -n "$capture_pid" ]; then
+    # Noninteractive shells may start an async child with SIGINT ignored.
+    # TERM reliably stops capture; the wrapper still exits with the original signal.
+    child_signal=$signal
+    if [ "$signal" = INT ]; then child_signal=TERM; fi
+    kill -s "$child_signal" "$capture_pid" 2>/dev/null || :
+    wait "$capture_pid" 2>/dev/null || :
+  fi
+  kill -s "$signal" "$$"
+}
+trap 'forward_signal INT' INT
+trap 'forward_signal TERM' TERM
+bun "$capture" "$@" &
+capture_pid=$!
+wait "$capture_pid"
+capture_status=$?
+trap - INT TERM
+if [ "$capture_status" -ne 0 ]; then
+  printf '%s\n' 'gh-surface: capture failed' >&2
+  exit 70
+fi
+exec "$ELANOUS_GH_REAL_BIN" "$@"

package/scripts/import-graph-scc.ts

@@ -0,0 +1,38 @@
+#!/usr/bin/env bun
+// Read-only operator/train entry: bun scripts/import-graph-scc.ts --base <full SHA> [--repo <clean checkout>]
+import { reportImportGraphSccForGate } from './release-loop/import-graph-scc-run.js';
+
+function parse(args: readonly string[]): { base40: string; repo: string; format: 'json' | 'table' } | null {
+  if (args.length % 2 !== 0) return null;
+  const values = new Map<string, string>();
+  for (let at = 0; at < args.length; at += 2) {
+    const name = args[at]!;
+    const value = args[at + 1]!;
+    if ((name !== '--base' && name !== '--repo' && name !== '--format') || !value || value.startsWith('-') || values.has(name)) return null;
+    values.set(name, value);
+  }
+  const base40 = values.get('--base');
+  const format = values.get('--format') ?? 'json';
+  return base40 && (format === 'json' || format === 'table')
+    ? { base40, repo: values.get('--repo') ?? process.cwd(), format } : null;
+}
+
+const input = parse(process.argv.slice(2));
+if (!input) {
+  process.stderr.write('usage: bun scripts/import-graph-scc.ts --base <full SHA> [--repo <clean checkout>] [--format json|table]\n');
+  process.exitCode = 2;
+} else {
+  const result = reportImportGraphSccForGate(input.repo, input.base40);
+  if (input.format === 'table' && result.ok) {
+    const { report } = result;
+    const rows = [
+      `HEAD ${result.head40}  BASE ${result.base40}`,
+      `SCC ${report.cycleCount}  largest ${report.largestScc}  cut candidates ${report.cutCandidateTotal}  ${report.measured ? 'measured' : 'unmeasured'}`,
+      'Changed file | Definite tests | Possible tests | Impact',
+      '--- | ---: | ---: | ---',
+      ...report.changedFileImpacts.map((impact) => `${impact.file} | ${impact.affectedTestCount} | ${impact.possibleTestCount} | ${impact.measured ? 'measured' : impact.issues.join('; ')}`),
+    ];
+    process.stdout.write(`${rows.join('\n')}\n`);
+  } else process.stdout.write(`${JSON.stringify(result)}\n`);
+  process.exitCode = !result.ok ? 2 : result.report.measured ? 0 : 1;
+}

package/scripts/install.ps1

@@ -101,6 +101,25 @@ for ($index = 0; $index -lt $RemainingArgs.Count; $index++) {
 if ($Help) { Show-Usage; exit 0 }
 $installLang = if ($env:ELANOUS_INSTALL_LANG) { $env:ELANOUS_INSTALL_LANG } else { [Globalization.CultureInfo]::CurrentUICulture.Name }
 $installLang = if ($installLang -match '^ko(?:-|$)') { 'ko' } else { 'en' }
+
+# WIN-ARM64-VM-TRIAL (0.2.40): Windows on ARM reports ARM64 via PROCESSOR_ARCHITECTURE (ARM64-native
+# host) or PROCESSOR_ARCHITEW6432 (32-bit host on 64-bit Windows). bun, the required runtime, publishes
+# no Windows ARM64 build (its installer fetches bun-windows-x64), so refuse before touching the prefix
+# or the profile. Exit 78 (EX_CONFIG) keeps this distinct from 127 (required command missing) and 1.
+# Third tier (re-issued fragment): a host that spawns PowerShell with a scrubbed environment block still
+# reports its architecture through the .NET runtime (RuntimeInformation, in .NET since 4.7.1, the floor
+# under PowerShell 5.1), so fall back to it only when both environment variables are absent. Guarded to
+# Windows_NT: elsewhere the host architecture says nothing about Windows installability and the gate must
+# keep its pre-fallback behavior. Uppercased: the enum prints Arm64, the check below reads ARM64.
+$osArchitecture = $env:PROCESSOR_ARCHITEW6432
+if (-not $osArchitecture) { $osArchitecture = $env:PROCESSOR_ARCHITECTURE }
+if (-not $osArchitecture -and $env:OS -eq 'Windows_NT') {
+  try { $osArchitecture = ([string][System.Runtime.InteropServices.RuntimeInformation]::ProcessArchitecture).ToUpperInvariant() } catch { $osArchitecture = $null }
+}
+if ($osArchitecture -eq 'ARM64') {
+  Fail (Say 'Windows on ARM (ARM64) is not supported yet: bun, the required runtime, has no Windows ARM64 build, so nothing was installed. Use x64 Windows for now (WIN-ARM64-VM-TRIAL tracks the first live measurement).' '\uc708\ub3c4\uc6b0 ARM(ARM64)\uc740 \uc544\uc9c1 \uc9c0\uc6d0\ud558\uc9c0 \uc54a\uc2b5\ub2c8\ub2e4: \ud544\uc218 \ub7f0\ud0c0\uc784 bun \uc5d0 \uc708\ub3c4\uc6b0 ARM64 \ube4c\ub4dc\uac00 \uc5c6\uc5b4 \uc544\ubb34\uac83\ub3c4 \uc124\uce58\ud558\uc9c0 \uc54a\uc558\uc2b5\ub2c8\ub2e4. \ub2f9\ubd84\uac04 x64 \uc708\ub3c4\uc6b0\ub97c \uc0ac\uc6a9\ud558\uc138\uc694(WIN-ARM64-VM-TRIAL \uce78\uc774 \uccab \uc2e4\uce21\uc744 \ucd94\uc801\ud569\ub2c8\ub2e4).') 78
+}
+
 if (-not $Prefix) {
   $dataHome = if ($env:LOCALAPPDATA) { $env:LOCALAPPDATA } else { Join-Path $HOME 'AppData\Local' }
   $Prefix = if ($env:ELANOUS_INSTALL_PREFIX) { $env:ELANOUS_INSTALL_PREFIX } else { Join-Path $dataHome 'elanous' }

package/scripts/intake-social.ts

@@ -0,0 +1,181 @@
+import { createHash } from 'node:crypto';
+import { spawnSync } from 'node:child_process';
+import { appendFileSync, existsSync, mkdirSync, readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
+import { effectiveInstanceRoot } from '../src/instance/resolve.js';
+import { canonicalUrl } from '../src/intake-plane/items.js';
+
+export interface CommunityPoint { title: string; url: string; text: string }
+export interface SocialCheck { items: { fact: string; line: string; verdict: string; current: string }[] }
+export interface SocialDeps {
+  now?: () => Date;
+  crawl?: () => Promise<CommunityPoint[]>;
+  check?: (facts: readonly string[]) => Promise<SocialCheck>;
+  log?: (message: string) => void;
+}
+
+const QUERY = '최근 24시간 AI 코딩 에이전트·하니스·로컬 LLM 커뮤니티(X·Reddit) 화제와 반응';
+const MAX_POINTS = 8;
+// URL 을 뺀 뒤 남는 서술의 최소 길이 — «링크만 있는 줄» 같은 레이블은 내용 없는 동향이라 흡수하지 않는다.
+const MIN_TREND_TEXT_LENGTH = 12;
+const OMNI_JSON_BEGIN = '---BEGIN_OMNI_CRAWL_JSON---';
+const OMNI_JSON_END = '---END_OMNI_CRAWL_JSON---';
+
+/** grok-community rawText(마크다운 보고서)에서 불릿/번호 줄만 뽑아 링크 있는 동향 점으로 만든다. */
+export function parseCommunityReport(rawText: string): CommunityPoint[] {
+  const points: CommunityPoint[] = [];
+  for (const rawLine of rawText.split('\n')) {
+    const line = rawLine.trim();
+    if (!/^(?:[-*•·]|\d{1,2}[.)])\s+/.test(line)) continue;
+    const url = line.match(/https?:\/\/[^\s)\]]+/)?.[0];
+    if (!url) continue;
+    const text = line
+      .replace(/^(?:[-*•·]|\d{1,2}[.)])\s+/, '')
+      .replace(/\[([^\]]*)\]\(https?:\/\/[^)]*\)/g, '$1')
+      .replace(/\*\*([^*]+)\*\*/g, '$1')
+      .replace(/\*([^*]+)\*/g, '$1')
+      .replace(/https?:\/\/\S+/g, '')
+      .replace(/\s+/g, ' ')
+      .trim();
+    if (text.length < MIN_TREND_TEXT_LENGTH) continue;
+    points.push({ title: text.slice(0, 120), url, text });
+  }
+  return points;
+}
+
+/** omni-crawl `--json` 페이로드(results[].items ⊕ results[].summary)에서 커뮤니티 동향 점을 합친다. URL 로 중복을 뺀다. */
+export function parseOmniCrawlPayload(payload: { results?: { items?: { url?: unknown; title?: unknown; text?: unknown }[]; summary?: unknown }[] }): CommunityPoint[] {
+  const points: CommunityPoint[] = [];
+  const urls = new Set<string>();
+  for (const result of payload.results ?? []) {
+    const fromItems = (result.items ?? []).flatMap((item) => {
+      const url = typeof item.url === 'string' && /^https?:\/\//.test(item.url) ? item.url : '';
+      const title = typeof item.title === 'string' ? item.title.trim() : '';
+      const text = typeof item.text === 'string' ? item.text.trim() : '';
+      return url && (title || text) ? [{ title: (title || text).slice(0, 120), url, text: text || title }] : [];
+    });
+    const fromSummary = parseCommunityReport(typeof result.summary === 'string' ? result.summary : '');
+    for (const point of [...fromItems, ...fromSummary]) {
+      const key = canonicalUrl(point.url) ?? point.url;
+      if (urls.has(key)) continue;
+      urls.add(key);
+      points.push(point);
+    }
+  }
+  return points;
+}
+
+/** omni-crawl 스킬의 grok-community 엔진을 실제로 돌린다(스킬 .env 를 엔진이 알아서 적재한다). */
+async function crawlWithOmniCrawl(): Promise<CommunityPoint[]> {
+  const dir = process.env.OMNI_CRAWL_DIR || join(homedir(), '.claude', 'skills', 'omni-crawl');
+  if (!existsSync(dir)) throw new Error(`omni-crawl 스킬 디렉터리 없음: ${dir}`);
+  const result = spawnSync('bun', ['scripts/main.ts', QUERY, '--engine', 'grok-community', '--json', '--no-save'], {
+    cwd: dir, encoding: 'utf8', timeout: 600_000, maxBuffer: 32 * 1024 * 1024,
+  });
+  if (result.error || result.status !== 0) throw new Error(result.error?.message ?? result.stderr?.trim() ?? `omni-crawl exited ${result.status}`);
+  const begin = result.stdout.indexOf(OMNI_JSON_BEGIN);
+  const end = result.stdout.lastIndexOf(OMNI_JSON_END);
+  if (begin < 0 || end <= begin) throw new Error('omni-crawl JSON 마커 없음');
+  return parseOmniCrawlPayload(JSON.parse(result.stdout.slice(begin + OMNI_JSON_BEGIN.length, end)) as Parameters<typeof parseOmniCrawlPayload>[0]);
+}
+
+/** 함의 판정은 로컬 흉내가 아니라 CLI(intake check) 가 정본이다. 칸이나 판을 바꾸지 않는다. */
+async function checkWithCli(facts: readonly string[]): Promise<SocialCheck> {
+  const result = spawnSync('bun', ['bin/elanous.mjs', '--test', 'intake', 'check', ...facts.flatMap((fact) => ['--fact', fact]), '--json'], {
+    cwd: resolve(import.meta.dir, '..'), encoding: 'utf8', timeout: 120_000, maxBuffer: 4 * 1024 * 1024,
+  });
+  if (result.error || result.status !== 0) throw new Error(result.error?.message ?? result.stderr?.trim() ?? `intake check exited ${result.status}`);
+  const start = result.stdout.indexOf('{');
+  if (start < 0) throw new Error('intake check JSON 없음');
+  const parsed = JSON.parse(result.stdout.slice(start)) as SocialCheck;
+  if (!Array.isArray(parsed.items)) throw new Error('intake check items 없음');
+  return parsed;
+}
+
+function splitSentences(text: string): string[] {
+  const clean = text.replace(/\s+/g, ' ').trim();
+  if (!clean) return [];
+  return clean.split(/(?<=[.!?。])\s+/).map((sentence) => sentence.trim()).filter(Boolean)
+    .map((sentence) => sentence.slice(0, 240)).slice(0, 5);
+}
+
+export async function runIntakeSocial(options: { root: string; deps?: SocialDeps }): Promise<{ written: number; failed: number }> {
+  const { root, deps = {} } = options;
+  const log = deps.log ?? ((message: string) => console.error(message));
+  const now = (deps.now ?? (() => new Date()))();
+  const day = new Date(now.getTime() + 9 * 3600_000).toISOString().slice(0, 10);
+  const state = join(root, 'intake', 'social-seen.jsonl');
+  const lens = join(root, 'intake', 'outbox', 'lens', `${day}.jsonl`);
+  const seen = new Set(existsSync(state) ? readFileSync(state, 'utf8').split('\n').filter(Boolean) : []);
+  // 렌즈에 이미 쓴 동향도 «본 것» — 상태 기록이 죽어도 재실행이 같은 점을 다시 쓰지 않는다(24h 창이라 어제·오늘 파일).
+  const yesterday = new Date(now.getTime() + 9 * 3600_000 - 86_400_000).toISOString().slice(0, 10);
+  for (const lensDay of [yesterday, day]) {
+    const file = join(root, 'intake', 'outbox', 'lens', `${lensDay}.jsonl`);
+    if (!existsSync(file)) continue;
+    for (const line of readFileSync(file, 'utf8').split('\n')) {
+      try { const id = (JSON.parse(line) as { id?: unknown }).id; if (typeof id === 'string') seen.add(id); } catch { /* 깨진 줄은 건너뛴다 */ }
+    }
+  }
+  let written = 0;
+  let failed = 0;
+  const crawl = deps.crawl ?? crawlWithOmniCrawl;
+  let points: CommunityPoint[] = [];
+  try {
+    points = await crawl();
+  } catch (error) {
+    failed++;
+    log(`못 모음: grok-community — ${error instanceof Error ? error.message : String(error)}`);
+    return { written, failed };
+  }
+  for (const point of points) {
+    if (written >= MAX_POINTS) break;
+    if (!/^https?:\/\//.test(point.url)) continue;
+    const id = createHash('sha256').update(canonicalUrl(point.url) ?? point.url).digest('hex').slice(0, 16);
+    if (seen.has(id)) continue;
+    try {
+      const summary = splitSentences(point.text);
+      if (!summary.length) throw new Error('요약 줄 없음');
+      // 동향 자체는 기능 주장이 아니다. 제목과 본문에 실제로 적힌 제품 주장만 추가로 대조한다.
+      const isProductClaim = (fact: string) => /^(?:elanous|엘라누스)\s*(?:는|은)\s+/i.test(fact);
+      const facts = [...new Set([
+        ...summary.slice(0, 2),
+        ...splitSentences(point.title).filter(isProductClaim),
+        ...summary.filter(isProductClaim),
+      ])];
+      const check = await (deps.check ?? checkWithCli)(facts);
+      if (!check.items.length) throw new Error('intake check 항목 없음');
+      const productClaims = new Set(facts.filter(isProductClaim));
+      const judgedClaims = check.items.filter((item) => productClaims.has(item.fact));
+      const suggestions = judgedClaims.filter((item) => item.verdict === '없음' || item.verdict === '판단 필요')
+        .map((item) => ({ kind: '칸 제안', fact: item.fact, status: '제안', verdict: item.verdict }));
+      const verdict = suggestions.length ? '보강'
+        : judgedClaims.length && !judgedClaims.every((item) => item.verdict === '있음') ? '경쟁 대조' : '참고';
+      const implication = facts.map((fact) => productClaims.has(fact)
+        ? check.items.find((item) => item.fact === fact)?.line ?? `점검 결과 없음: ${fact}`
+        : `커뮤니티 동향 참고: ${fact}`);
+      const record = {
+        id, at: now.toISOString(), source: 'grok-community', url: point.url, title: point.title.slice(0, 120),
+        summary, implication, suggestions,
+        lensVerdict: verdict, why: `${judgedClaims.length ? '엘라누스 대조' : '커뮤니티 동향 참고'}: ${implication.join(' · ')}`.slice(0, 500),
+        target: point.text.match(/\b[A-Z][A-Z0-9]{2,}\b/)?.[0] ?? '커뮤니티',
+      };
+      mkdirSync(dirname(lens), { recursive: true });
+      appendFileSync(lens, `${JSON.stringify(record)}\n`);
+      mkdirSync(dirname(state), { recursive: true });
+      appendFileSync(state, `${id}\n`);
+      seen.add(id);
+      written++;
+    } catch (error) {
+      failed++;
+      log(`못 모음: ${point.url} — ${error instanceof Error ? error.message : String(error)}`);
+    }
+  }
+  return { written, failed };
+}
+
+if (import.meta.main) {
+  const result = await runIntakeSocial({ root: effectiveInstanceRoot() });
+  console.log(`intake-social: ${result.written}건 · 못 모음 ${result.failed}건`);
+  if (result.failed) process.exitCode = 1;
+}