elanous 0.2.35 → 0.2.37

package/src/cli/make-cli.ts

@@ -4,40 +4,276 @@ import { judge } from '../llm/judge-layer.js';
 import { runPluginMake } from './plugin-cli.js';
 import { workflowRun } from './workflow.js';
 
-type MakeKind = 'plugin' | 'workflow';
+export type MakeKind = 'plugin' | 'workflow';
+
+/** A cell the route ruled out, together with the evidence that ruled it out. */
+export type MakeExclusion = { kind: MakeKind; reason: string };
+
+/** A classify-judge answer. It only counts when the judge supplied BOTH
+ *  rationales: a bare `{"kind":"workflow"}` carries no reason and no exclusion
+ *  ground, so the route treats it as an unanswered (unmeasured) request. */
+export type MakeJudgeVerdict = { kind: MakeKind; reason: string; excluded: string };
+
+/** What the production `cli.make/route` path judged for one natural-language request. */
+export type MakeRouteEvidence = {
+  request: string;
+  /** Selected cell, or null when the request carries no usable evidence. */
+  kind: MakeKind | null;
+  /** Which arm produced `kind`. */
+  decidedBy: 'request-evidence' | 'classify-judge' | 'none';
+  /** false means "unmeasured": no rationale existed for any cell. */
+  measured: boolean;
+  /** Why the selected cell won. Never empty; a judge row quotes the judge's own reason verbatim. */
+  reason: string;
+  /** Phrases from the request that support the selected cell. A judge-decided row
+   *  carries a `judge:<kind>` marker instead: the request had no phrases to cite. */
+  signals: string[];
+  /** Every cell that was not selected, with the reason it was excluded. */
+  excluded: MakeExclusion[];
+};
+
+type JudgeCall = (args: { prompt: string; provider: string; model: string }) => Promise<{ text: string }>;
+
 type MakeDeps = {
-  decide?: (request: string) => Promise<MakeKind | null>;
+  /** Test-only classify transport: only ever throws, so it can never deliver an answer. */
+  judgeCall?: JudgeCall;
   pluginMake?: (request: string) => Promise<void>;
   workflowMake?: (request: string) => Promise<number>;
 };
 
-export async function classifyMakeRequest(request: string, call?: (args: { prompt: string; provider: string; model: string }) => Promise<{ text: string }>): Promise<MakeKind | null> {
+const CELL_LABEL: Record<MakeKind, string> = { plugin: '플러그인', workflow: '워크플로' };
+
+const OTHER_CELL: Record<MakeKind, MakeKind> = { plugin: 'workflow', workflow: 'plugin' };
+
+/** A request that names a cell explicitly outranks every softer signal. */
+const NAMED_CELL_WORDS: Record<MakeKind, readonly string[]> = {
+  plugin: ['플러그인', 'plugin'],
+  workflow: ['워크플로', 'workflow'],
+};
+
+/** Signal words that must not fire when every occurrence lives inside a longer
+ *  compound: `메일` inside `이메일` is an email-domain word, not a mailing task,
+ *  so '이메일 파싱 API' must not reach the workflow cell through it. */
+const COMPOUND_GUARDS: ReadonlyArray<{ word: string; inside: string }> = [
+  { word: '메일', inside: '이메일' },
+  { word: '로드', inside: '업로드' },
+];
+
+/** Request phrases that point at each cell. Workflow is the upper cell: a workflow
+ *  may use a connector, so its signals win over connector signals.
+ *
+ *  판정 기준(위에서 아래로):
+ *  1. 이름 지목 — '플러그인/plugin', '워크플로/workflow' 가 직접 나오면 그 칸.
+ *  2. 합성어 가드 — 신호 단어가 더 긴 합성어 안에만 있으면(예: '메일' ⊂ '이메일')
+ *     그 단어는 신호로 치지 않는다. '이메일 파싱 API' 는 이메일 도메인 처리
+ *     요청이지 메일 발송 워크플로가 아니다.
+ *  3. 가드를 통과한 신호가 한쪽에만 있으면 그 칸을 채택한다.
+ *  4. 양쪽에 신호가 남아 있으면(충돌) 상위 칸 워크플로가 하위 칸 플러그인을
+ *     흡수한다 — 워크플로는 커넥터를 부품으로 쓸 수 있지만 그 반대는 안 된다. */
+const CELL_WORDS: Record<MakeKind, readonly string[]> = {
+  plugin: [
+    '읽', '파싱', 'parse', '불러', 'load', '로드', '열어', '변환', 'convert', '추출', 'extract',
+    '연동', '연결', '커넥터', 'connector', '스킬', 'skill', '도구', 'tool', 'api', '조회',
+    'ocr', 'hwp', 'pdf', 'xlsx', 'docx', 'csv', 'json', '이미지', '사진', '엑셀', '워드',
+    '번역', 'translate', '검색', 'search',
+  ],
+  workflow: [
+    '매일', '매주', '매월', '매년', '매시간', '매번', '정기', '주기적', '스케줄', 'schedule',
+    'cron', '크론', '반복', 'daily', 'weekly', 'hourly', 'every ',
+    '올려', '올리', '게시', '발행', '포스팅', '업로드', 'upload', '배포', 'deploy', 'publish',
+    '보내', '전송', 'send', '알림', 'notify', '메일',
+    '하고 나서', '그다음', '순서대로', '단계별', '파이프라인', 'pipeline', '자동화', 'automation',
+    '자동으로', '일괄', 'batch', '모아', '수집해서', '시리즈',
+  ],
+};
+
+function countOccurrences(text: string, needle: string): number {
+  let count = 0;
+  let at = text.indexOf(needle);
+  while (at >= 0) {
+    count += 1;
+    at = text.indexOf(needle, at + needle.length);
+  }
+  return count;
+}
+
+function matchWords(text: string, words: readonly string[]): string[] {
+  const hits: string[] = [];
+  for (const word of words) {
+    if (!text.includes(word)) continue;
+    const guarded = COMPOUND_GUARDS.some(
+      g => g.word === word && countOccurrences(text, g.inside) >= countOccurrences(text, word),
+    );
+    if (!guarded) hits.push(word);
+  }
+  return hits;
+}
+
+/** Deterministic judgement over the request text: picks a cell and says why it won
+ *  and why the sibling cell lost. Runs before any model call, so the route always
+ *  has a rationale to report. */
+function evidenceFromRequest(request: string): MakeRouteEvidence {
+  const text = request.toLowerCase();
+  const pluginWords = matchWords(text, CELL_WORDS.plugin);
+  const workflowWords = matchWords(text, CELL_WORDS.workflow);
+  const namedPlugin = matchWords(text, NAMED_CELL_WORDS.plugin);
+  const namedWorkflow = matchWords(text, NAMED_CELL_WORDS.workflow);
+  const named: MakeKind | null = namedPlugin.length && !namedWorkflow.length
+    ? 'plugin'
+    : namedWorkflow.length && !namedPlugin.length ? 'workflow' : null;
+
+  let kind: MakeKind | null = null;
+  let reason: string;
+  let signals: string[] = [];
+
+  if (named) {
+    kind = named;
+    signals = named === 'plugin' ? namedPlugin : namedWorkflow;
+    reason = `요청이 ${CELL_LABEL[named]} 칸을 이름으로 지목(${signals.join(', ')}) — 명시 지목이 최상위 근거`;
+  } else if (workflowWords.length) {
+    kind = 'workflow';
+    signals = workflowWords;
+    reason = `반복·게시·시퀀스 신호(${workflowWords.join(', ')}) — 상위 칸 워크플로 채택`;
+  } else if (pluginWords.length) {
+    kind = 'plugin';
+    signals = pluginWords;
+    reason = `커넥터·역량·형식 신호(${pluginWords.join(', ')}) — 하위 칸 플러그인 채택`;
+  } else {
+    reason = '필수 근거 없음 — 요청에서 플러그인·워크플로 신호를 찾지 못했다';
+  }
+
+  const excluded: MakeExclusion[] = [];
+  if (kind === 'workflow') {
+    excluded.push({
+      kind: 'plugin',
+      reason: [
+        named === 'workflow'
+          ? `요청이 워크플로를 이름으로 지목(${namedWorkflow.join(', ')})`
+          : `반복·게시·시퀀스 신호(${workflowWords.join(', ')})`,
+        pluginWords.length
+          ? `플러그인 신호(${pluginWords.join(', ')})는 커넥터 단품이라 상위 칸에 흡수`
+          : '플러그인 신호 0건',
+      ].join(' · '),
+    });
+  } else if (kind === 'plugin') {
+    excluded.push({
+      kind: 'workflow',
+      reason: [
+        named === 'plugin'
+          ? `요청이 플러그인을 이름으로 지목(${namedPlugin.join(', ')})`
+          : `커넥터·역량 신호(${pluginWords.join(', ')})`,
+        workflowWords.length
+          ? `워크플로 신호(${workflowWords.join(', ')})가 있으나 단품 칸이 채택`
+          : '워크플로 신호 0건',
+      ].join(' · '),
+    });
+  } else {
+    excluded.push(
+      { kind: 'plugin', reason: '플러그인 신호 0건 — 필수 근거 없음' },
+      { kind: 'workflow', reason: '워크플로 신호 0건 — 필수 근거 없음' },
+    );
+  }
+
+  return {
+    request,
+    kind,
+    decidedBy: kind ? 'request-evidence' : 'none',
+    measured: kind !== null,
+    reason,
+    signals,
+    excluded,
+  };
+}
+
+export async function classifyMakeRequest(request: string, call?: JudgeCall): Promise<MakeJudgeVerdict | null> {
   if (!request.trim()) return null;
-  const result = await judge<MakeKind>({
+  const result = await judge<MakeJudgeVerdict>({
     site: 'cli.make',
     ...(call ? { call } : {}),
-    prompt: `Classify this request for an Elanous creator. Choose "plugin" for a reusable connector, integration, skill, or capability (including reading a file format). Choose "workflow" for a sequence of jobs, recurring schedule, automation, or publishing task, even when it uses a connector. If you cannot decide, return {"kind":"unclear"}. Respond with JSON only, exactly {"kind":"plugin"} or {"kind":"workflow"} or {"kind":"unclear"}. Do not execute the request.\nRequest: ${JSON.stringify(request)}`,
+    prompt: `Classify this request for an Elanous creator. Choose "plugin" for a reusable connector, integration, skill, or capability (including reading a file format). Choose "workflow" for a sequence of jobs, recurring schedule, automation, or publishing task, even when it uses a connector. Respond with JSON only, exactly {"kind":"plugin"|"workflow","reason":"<한 문장: 이 칸을 고른 근거>","excluded":"<한 문장: 다른 칸을 뺀 근거>"}. Return {"kind":"unclear"} when you cannot decide. An answer missing either rationale field is rejected as unmeasured. Do not execute the request.\nRequest: ${JSON.stringify(request)}`,
     schema: value => {
       if (!value || typeof value !== 'object' || Array.isArray(value)) return null;
       const kind = (value as { kind?: unknown }).kind;
-      return kind === 'plugin' || kind === 'workflow' ? kind : null;
+      if (kind !== 'plugin' && kind !== 'workflow') return null;
+      const reason = (value as { reason?: unknown }).reason;
+      const excluded = (value as { excluded?: unknown }).excluded;
+      if (typeof reason !== 'string' || !reason.trim()) return null;
+      if (typeof excluded !== 'string' || !excluded.trim()) return null;
+      return { kind, reason: reason.trim(), excluded: excluded.trim() };
     },
   });
   return result.ok ? result.value : null;
 }
 
+/** Production judgement path for `elanous make`: request evidence first, the
+ *  classify judge only when the request carries no evidence at all. A judge
+ *  answer without both rationales is reported as unmeasured, never as success;
+ *  `skipJudge` leaves the judge uncalled so --route-only dumps stay
+ *  deterministic (no model call, no dispatch). */
+export async function routeMakeRequest(
+  request: string,
+  opts: { call?: JudgeCall; skipJudge?: boolean } = {},
+): Promise<MakeRouteEvidence> {
+  const evidence = evidenceFromRequest(request);
+  if (evidence.measured) return evidence;
+
+  let verdict: MakeJudgeVerdict | null = null;
+  let note: string;
+  if (opts.skipJudge) {
+    note = '판정기 호출 생략(증거 전용 경로)';
+  } else {
+    try {
+      verdict = await classifyMakeRequest(request, opts.call);
+      note = verdict
+        ? `classify judge 가 ${CELL_LABEL[verdict.kind]} 를 근거와 함께 반환`
+        : 'classify judge 가 근거 있는 판정을 반환하지 않음';
+    } catch (err) {
+      note = `classify judge 호출 실패(${err instanceof Error ? err.message : String(err)})`;
+    }
+  }
+
+  if (!verdict) {
+    return { ...evidence, decidedBy: 'none', measured: false, reason: `${evidence.reason} · ${note}` };
+  }
+  const other = OTHER_CELL[verdict.kind];
+  return {
+    request,
+    kind: verdict.kind,
+    decidedBy: 'classify-judge',
+    measured: true,
+    reason: `요청 근거 없음(플러그인·워크플로 신호 0건) → ${note} — ${CELL_LABEL[verdict.kind]} 칸 채택 · 판정기 근거: ${verdict.reason}`,
+    signals: [`judge:${verdict.kind}`],
+    excluded: [{ kind: other, reason: `요청 근거 없음 · 판정기 배제 근거: ${verdict.excluded}` }],
+  };
+}
+
 export function registerMakeCommand(program: Command, deps: MakeDeps = {}): void {
   program.command('make <request>')
     .description('Classify a one-line request and make a plugin or build a workflow')
-    .action(async (request: string) => {
-      const kind = await (deps.decide ?? classifyMakeRequest)(request).catch(() => null);
-      debug.log('cli.make', 'route', { kind: kind ?? 'undecided' });
-      if (!kind) {
+    .option('--route-only', 'print the cli.make/route evidence JSON and exit — no judge call, no plugin or workflow dispatch')
+    .action(async (request: string, opts: { routeOnly?: boolean }) => {
+      const evidence = await routeMakeRequest(request, {
+        ...(deps.judgeCall ? { call: deps.judgeCall } : {}),
+        ...(opts.routeOnly ? { skipJudge: true } : {}),
+      });
+      debug.log('cli.make', 'route', evidence);
+      if (!evidence.measured) {
+        debug.log('cli.make', 'route-unmeasured', {
+          request: evidence.request,
+          reason: evidence.reason,
+          excluded: evidence.excluded,
+        });
+      }
+      if (opts.routeOnly) {
+        console.log(JSON.stringify(evidence));
+        return;
+      }
+      if (!evidence.kind) {
         console.log('플러그인(커넥터·스킬)을 만들까요, 워크플로(잡)를 만들까요?');
         process.exitCode = 1;
         return;
       }
-      if (kind === 'plugin') await (deps.pluginMake ?? runPluginMake)(request);
+      if (evidence.kind === 'plugin') await (deps.pluginMake ?? runPluginMake)(request);
       else process.exitCode = await (deps.workflowMake ?? ((text: string) => workflowRun('build-workflow', text)))(request);
     });
 }

package/src/cli/memory-cli.ts

@@ -10,6 +10,8 @@ import {
   readIndex, memoryRoot, memoryIndexPath,
   type MemoryType,
 } from '../memory.js';
+import { applyClaudeMemoryImport, claudeMemoryRoot, collectClaudeMemoryFiles } from '../context-bus/claude-memory-import.js';
+import { importClaudeMemories } from '../context-bus/long-term-memory.js';
 
 export function registerMemoryCommands(program: Command): void {
   const memCmd = program.command('memory').description('Persistent memories injected into every chat turn (user / feedback / project / reference)');
@@ -179,4 +181,31 @@ export function registerMemoryCommands(program: Command): void {
     console.log(`memory dir   ${memoryRoot()}`);
     console.log(`index file   ${memoryIndexPath()}`);
   });
-}
+
+  // 대표 10-12 MEMORY-IMPORT-CLAUDE — Claude 자동 기억(~/.claude/projects/*/memory)을 엘라누스
+  // 장기 기억으로 가져온다. 에이전트 무관 — codex·elanous TUI 가 같은 기억을 바로 읽는다.
+  memCmd
+  .command('import-claude')
+  .description('Import Claude auto-memories (~/.claude/projects/*/memory) into elanous memories — same name overwrites')
+  .option('--root <path>', 'projects root or a single memory dir', claudeMemoryRoot())
+  .option('--as-of <date>', 'staleness basis «MM-DD 기준» (default: today)')
+  .option('--dry-run', 'preview without saving')
+  .action((opts: { root: string; asOf?: string; dryRun?: boolean }) => {
+    const asOf = opts.asOf ?? new Date().toISOString().slice(0, 10);
+    const files = collectClaudeMemoryFiles(opts.root);
+    if (opts.dryRun) {
+      const preview = importClaudeMemories(files, { asOf });
+      ui.header(`claude-memory (dry-run) ${files.length} files`);
+      for (const item of preview.items) console.log(`  [${item.type.padEnd(9)}]  ${item.name}  ${item.summary}`);
+      if (preview.overwritten) console.log(`  overwritten ${preview.overwritten}`);
+      for (const [reason, count] of Object.entries(preview.skipped)) console.log(`  skipped ${reason}:${count}`);
+      return;
+    }
+    const result = applyClaudeMemoryImport(files, { asOf }, {
+      list: () => listMemories().map(entry => ({ id: entry.id, name: entry.name })),
+      save: record => { saveMemory(record); },
+    });
+    ui.info(`claude-memory: ${result.saved} new · ${result.updated} overwritten · ${result.items.length} imported (${files.length} files from ${opts.root})`);
+    for (const [reason, count] of Object.entries(result.skipped)) ui.info(`  skipped ${reason}:${count}`);
+  });
+}

package/src/cli/msg-cli.ts

@@ -1,9 +1,16 @@
 import type { Command } from 'commander';
 import { ensureAuthToken } from '../auth/acp-token.js';
+import { elanousStateRoot } from '../autopilot/state-paths.js';
 import { canonicalSeatId, openMsgStore, openMsgStoreReadOnly, type Message, type MsgStore } from '../msg/msg-store.js';
+import { clearPostOffice, ensurePostOffice, writePostOffice } from '../msg/msg-post-office.js';
 import { startMsgSseServer } from '../msg/msg-sse-server.js';
+import type { AgentReplyAddress, AgentReplyInput, AgentReplyResult } from '../loops/agent-reply.js';
 import { messageRouteFor, noReplyBodyNotice, unsupportedLoopAddressNotice } from '../loops/msg-address.js';
 import { resolveWake, wakeRecipient, type WakeDeps, type WakeOutcome } from '../loops/msg-wake.js';
+import type { RoleLlmSpec } from '../user-config.js';
+
+/** The loop rows whose reply body is an LLM agent: `--agent-reply` picks one of these. */
+const AGENT_REPLY_ROLES = { COORDINATOR: 'coordinator', GUARDIAN: 'guardian' } as const;
 
 export interface MsgCliDeps {
   openStore?: () => MsgStore;
@@ -21,6 +28,24 @@ export interface MsgCliDeps {
   registerLogSink?: () => Promise<unknown>;
   /** Wake the recipient after a durable post; never changes the post outcome. */
   wake?: (address: string, msgId: number, message: { from: string; kind?: string }, deps: WakeDeps) => Promise<WakeOutcome>;
+  /**
+   * Agent auto-reply producer (`--agent-reply`). The default resolves the selected role LLM, loads its pack,
+   * and calls the real `replyWithAgent`; the seams exist so a test still traverses that producer.
+   */
+  agentReply?: {
+    role?: RoleLlmSpec;
+    pack?: string;
+    /** Test seam: a fake turn still goes through `replyWithAgent` and its ledger transaction. */
+    runAgent?: AgentReplyInput['runAgent'];
+    /** Test seam for the role ladder — `undefined` means «역할 LLM 미설정». */
+    resolveRole?: (address: AgentReplyAddress) => RoleLlmSpec | undefined;
+    observationRoot?: string;
+  };
+  /** `msg serve --sse` discovery file root (default: the state root). `msg post` restarts a dead service found here. */
+  postOfficeStateRoot?: string;
+  postOfficeAlive?: (pid: number) => boolean;
+  postOfficeProbe?: (url: string) => Promise<boolean>;
+  postOfficeLaunch?: (input: { port: number }) => void;
   /** Test seams for the existing self-send transport and the selected task-card ledger. */
   readCard?: typeof import('../task-agent/task-hand.js').readTaskCard;
   podFragmentsForRun?: typeof import('../harness/self-send-target.js').listPodFragmentsForRun;
@@ -32,7 +57,7 @@ export interface MsgCliDeps {
 }
 
 type CommonOptions = { json?: boolean };
-type RecipientOptions = CommonOptions & { to?: string; after?: string; limit?: string };
+type RecipientOptions = CommonOptions & { to?: string; after?: string; limit?: string; thread?: string };
 
 function seat(raw: string | undefined, flag: string): string {
   if (raw === undefined) throw new Error(`${flag} is required`);
@@ -160,16 +185,94 @@ export function registerMsgCommands(program: Command, deps: MsgCliDeps = {}): vo
     if (json) out.log(JSON.stringify(value));
     else human();
   };
+  const officeRoot = () => deps.postOfficeStateRoot ?? elanousStateRoot();
+
+  /** `--agent-reply <address>` — only the loop rows that answer with an LLM body. */
+  const agentReplyAddress = (raw: string | undefined): AgentReplyAddress | null => {
+    if (raw === undefined) return null;
+    const name = raw.trim().toUpperCase();
+    if (!Object.hasOwn(AGENT_REPLY_ROLES, name)) throw new Error('--agent-reply must be COORDINATOR or GUARDIAN');
+    return name as AgentReplyAddress;
+  };
+  const requireAgentTarget = (address: AgentReplyAddress, to: string): void => {
+    if (address !== to) throw new Error(`--agent-reply ${address} requires --to ${address}`);
+  };
+
+  /**
+   * Human-free live conversation: the selected address's LLM body answers the message that was just saved.
+   * The durable ledger stays authoritative — `replyWithAgent` owns the one-reply-per-request transaction and
+   * its dedupe, so a retry finds the existing link instead of generating again. A failure never changes the
+   * post's exit code; it is reported as one line on stderr.
+   */
+  const autoReply = async (address: AgentReplyAddress, request: Message, json: boolean | undefined): Promise<void> => {
+    const seam = deps.agentReply;
+    let role = seam?.role;
+    if (role === undefined) {
+      if (seam?.resolveRole) role = seam.resolveRole(address);
+      else {
+        const { resolveConfiguredAgentRoleLlm } = await import('../user-config.js');
+        // Only an explicitly selected provider/tier/model starts an agent body; effort alone is not a selection.
+        role = resolveConfiguredAgentRoleLlm(AGENT_REPLY_ROLES[address]);
+      }
+    }
+    if (role === undefined) {
+      out.error(`msg: ${address} 역할 LLM 미설정 — 자동 답 없음`);
+      return;
+    }
+    let pack = seam?.pack;
+    if (pack === undefined) {
+      try {
+        const { loadAgentRolePack } = await import('../loops/agent-reply.js');
+        pack = loadAgentRolePack(AGENT_REPLY_ROLES[address]);
+      } catch (error) {
+        out.error(`msg: ${address} 역할 팩 없음 — 자동 답 없음: ${error instanceof Error ? error.message : String(error)}`);
+        return;
+      }
+    }
+    try {
+      const { replyWithAgent } = await import('../loops/agent-reply.js');
+      const store = open();
+      let result: AgentReplyResult;
+      try {
+        result = await replyWithAgent({ address, role, pack, store,
+          request: { id: request.id, from: request.from, body: request.body,
+            ...(request.kind === undefined ? {} : { kind: request.kind }) },
+          ...(seam?.runAgent ? { runAgent: seam.runAgent } : {}),
+          ...(seam?.observationRoot ? { observationRoot: seam.observationRoot } : {}) });
+      } finally { store.close(); }
+      emit({ agentReply: { address, requestId: request.id, ...result } }, json,
+        () => out.log(`자동 답 ${result.replyId === null ? '없음' : `#${result.replyId}`} (${address} → ${request.from})${result.posted ? '' : ' — 이미 있음'}`));
+    } catch (error) {
+      out.error(`msg: 자동 답 실패: ${error instanceof Error ? error.message : String(error)}`);
+    }
+  };
+
+  /**
+   * Installed post-office supervision: a registered `msg serve --sse` that no longer answers is restarted on
+   * its recorded port. Nothing is spawned when no service registered itself, so a plain post is unchanged.
+   */
+  const supervisePostOffice = async (): Promise<void> => {
+    const result = await ensurePostOffice({ stateRoot: officeRoot(),
+      ...(deps.postOfficeAlive ? { alive: deps.postOfficeAlive } : {}),
+      ...(deps.postOfficeProbe ? { probe: deps.postOfficeProbe } : {}),
+      ...(deps.postOfficeLaunch ? { launch: deps.postOfficeLaunch } : {}) });
+    if (result.state === 'restarted')
+      out.error(`msg: post office 재시작 (port ${result.port}) — 원장이 정본이라 저장된 글은 다시 밀린다`);
+  };
 
   msg.command('post [body]').description('Post a message; use - or omit body to read stdin')
     .option('--from <seat>').option('--to <seat>').option('--kind <kind>').option('--body <text>')
     .option('--reply-to <id>', 'point this reply at a question message ID')
+    .option('--agent-reply <address>', 'let this address\'s agent body (COORDINATOR · GUARDIAN) answer the saved message once')
     .option('--origin-key <key>', 'deduplicate a channel mirror by coord:<commentId>:<recipient>').option('--json')
-    .action((body: string | undefined, opts: CommonOptions & { from?: string; to?: string; kind?: string; body?: string; replyTo?: string; originKey?: string }) => run(async () => {
+    .action((body: string | undefined, opts: CommonOptions & { from?: string; to?: string; kind?: string; body?: string; replyTo?: string; originKey?: string; agentReply?: string }) => run(async () => {
       const from = seat(opts.from, '--from');
       const unsupported = opts.to === undefined ? null : unsupportedLoopAddressNotice(opts.to);
       if (unsupported) out.error(unsupported);
       const to = seat(opts.to, '--to');
+      // Validate the auto-reply target before saving — a mismatched flag must not leave a stored message behind.
+      const agentAddress = agentReplyAddress(opts.agentReply);
+      if (agentAddress !== null) requireAgentTarget(agentAddress, to);
       if (body !== undefined && body !== '-' && opts.body !== undefined) throw new Error('provide body once (argument or --body)');
       const text = opts.body ?? (body !== undefined && body !== '-' ? body : await readStdin());
       const envelope = { from, to, body: text,
@@ -192,10 +295,14 @@ export function registerMsgCommands(program: Command, deps: MsgCliDeps = {}): vo
           new Promise<void>(resolve => { sinkTimer = setTimeout(resolve, 1000); }),
         ]).finally(() => clearTimeout(sinkTimer));
       } catch { /* observability is fail-open */ }
+      // 설치본을 갈아 끼우면 우편국(SSE)은 조용히 사라진다 — 등록해 둔 서비스가 응답하지 않으면 같은 포트로 다시 띄운다.
+      // 재시작도 관측도 post 의 성패를 바꾸지 않는다.
+      try { await supervisePostOffice(); } catch { /* post office is fail-open */ }
       try {
         await (deps.wake ?? wakeRecipient)(to, posted.id, { from, ...(opts.kind === undefined ? {} : { kind: opts.kind }) },
           { ...deps.wakeDeps, warn: noBody ? () => {} : line => out.error(line) });
       } catch { /* the wake outcome is logged by wakeRecipient; the post is already durable */ }
+      if (agentAddress !== null) await autoReply(agentAddress, posted, opts.json);
     })());
 
   msg.command('route <address>').description('Show how a post to this address is read (replyBody) and woken (wake)')
@@ -209,14 +316,19 @@ export function registerMsgCommands(program: Command, deps: MsgCliDeps = {}): vo
         + `\t(${wake.source}${wake.reason ? `: ${wake.reason}` : ''})`));
     })());
 
-  msg.command('list').description('List messages for one recipient without acknowledging them')
-    .option('--to <seat>').option('--after <id>', 'exclusive message ID (default: acknowledged cursor)')
+  msg.command('list').description('List messages for one recipient or one thread without acknowledging them')
+    .option('--to <seat>').option('--thread <id>', 'request ID; list it and its replies, regardless of recipient')
+    .option('--after <id>', 'exclusive message ID (default: acknowledged cursor for a recipient, 0 for a thread)')
     .option('--limit <count>', 'maximum messages (1–1000)').option('--json')
     .action((opts: RecipientOptions) => run(() => {
-      const to = seat(opts.to, '--to');
+      if (opts.thread !== undefined && opts.to !== undefined) throw new Error('--thread cannot be used with --to');
+      const to = opts.thread === undefined ? seat(opts.to, '--to') : undefined;
+      const threadId = opts.thread === undefined ? undefined : integer(opts.thread, '--thread', 0, 1, Number.MAX_SAFE_INTEGER);
       const limit = integer(opts.limit, '--limit', 100, 1, 1000);
       const after = opts.after === undefined ? undefined : integer(opts.after, '--after', 0, 0, Number.MAX_SAFE_INTEGER);
-      const messages = withStore(store => store.list(to, after ?? store.getCursor(to), limit));
+      const messages = withStore(store => threadId === undefined
+        ? store.list(to!, after ?? store.getCursor(to!), limit)
+        : store.listThread(threadId, after ?? 0, limit));
       emit(messages, opts.json, () => {
         if (!messages.length) out.log('No messages.');
         for (const message of messages) out.log(formatMessage(message));
@@ -344,11 +456,14 @@ export function registerMsgCommands(program: Command, deps: MsgCliDeps = {}): vo
 
   msg.command('ask <recipient> <question>').description('Post a question and wait for its first reply')
     .option('--from <seat>', 'asking seat (required)').option('--wait <seconds>', 'seconds to wait for a reply (default 60)', '60')
+    .option('--agent-reply <address>', 'let this address\'s agent body (COORDINATOR · GUARDIAN) answer before waiting')
     .option('--json')
-    .action((recipient: string, question: string, opts: CommonOptions & { from?: string; wait?: string }) => run(async () => {
+    .action((recipient: string, question: string, opts: CommonOptions & { from?: string; wait?: string; agentReply?: string }) => run(async () => {
       const from = seat(opts.from, '--from');
       const to = canonicalSeatId(recipient);
       const waitSeconds = integer(opts.wait, '--wait', 60, 0, 86400);
+      const agentAddress = agentReplyAddress(opts.agentReply);
+      if (agentAddress !== null) requireAgentTarget(agentAddress, to);
       const interrupt = deps.signal === undefined ? new AbortController() : undefined;
       const signal = deps.signal ?? interrupt!.signal;
       const onInterrupt = () => interrupt?.abort();
@@ -362,6 +477,8 @@ export function registerMsgCommands(program: Command, deps: MsgCliDeps = {}): vo
         emit(asked, opts.json, () => out.log(`#${asked.id}`));
         // msg ask uses the same saved-message handler before waiting for its linked reply.
         await handleTaMessage(asked);
+        // 사람 없는 live 대화: 답할 몸이 있으면 «기다리기 전»에 답을 원장에 남긴다 — 같은 대기 루프가 그 답을 집는다.
+        if (agentAddress !== null) await autoReply(agentAddress, asked, opts.json);
         const deadline = Date.now() + waitSeconds * 1000;
         let reply: Message | undefined;
         store = open();
@@ -387,18 +504,17 @@ export function registerMsgCommands(program: Command, deps: MsgCliDeps = {}): vo
     .action((id: string, opts: CommonOptions) => run(() => {
       const target = integer(id, 'message ID', 0, 1, Number.MAX_SAFE_INTEGER);
       const thread = withStore(store => {
-        const question = store.getMessage(target);
-        if (question === null) throw new Error(`message not found: #${target}`);
         // Keep paging until a short page so a thread longer than one store page is never truncated.
-        const replies: Message[] = [];
+        const messages: Message[] = [];
         let after = 0;
         let page: Message[];
         do {
-          page = store.listReplies(target, 100, after);
-          replies.push(...page);
+          page = store.listThread(target, after, 100);
+          messages.push(...page);
           after = page.at(-1)?.id ?? after;
         } while (page.length === 100);
-        return { question, replies };
+        const [question, ...replies] = messages;
+        return { question: question!, replies };
       });
       emit(thread, opts.json, () => {
         out.log(formatMessage(thread.question));
@@ -419,8 +535,10 @@ export function registerMsgCommands(program: Command, deps: MsgCliDeps = {}): vo
       try {
         const service = startMsgSseServer({ store, token: (deps.authToken ?? (() => ensureAuthToken().token))(),
           port, hostname: opts.host });
+        // 발견 줄 — 설치본을 갈아 끼운 뒤 `msg post` 가 이 줄을 읽어 죽은 서비스를 같은 포트로 다시 띄운다.
+        writePostOffice(officeRoot(), { port: service.port });
         out.log(`msg SSE listening on ${opts.host}:${service.port}`);
-        const stop = () => { service.stop(); store.close(); };
+        const stop = () => { service.stop(); store.close(); clearPostOffice(officeRoot()); };
         process.once('SIGINT', stop);
         process.once('SIGTERM', stop);
       } catch (error) { store.close(); throw error; }

package/src/cli/pr-cli.ts

@@ -62,8 +62,8 @@ import { admitLandingMerge } from '../self-implement/frozen-merges.js';
 import { resolveOverlapEvidencePath, verifyAllSameHeadReviews, verifyAncestorAutoPass, verifyOverlapEvidence, verifyOverlapEvidenceVirtualRebase } from './pr-land-overlap-evidence.js';
 import type { VerifyOverlapEvidenceInput } from './pr-land-overlap-evidence.js';
 import { verifyVirtualRebasePatch } from './pr-land-virtual-rebase.js';
-import { observeDirectPrLandRefusal, observePrLandRefusal } from './pr-land-refusal.js';
-import { planPrLandRecovery } from './pr-land-recovery.js';
+import { classifyPrLandRefusal, observeDirectPrLandRefusal, observePrLandRefusal } from './pr-land-refusal.js';
+import { bindPrLandRefusalToRecover, PR_LAND_CARD_ID_ENV } from './pr-land-recovery.js';
 import { ensurePrLandHeavyRemote, type HeavyRemoteInput, type HeavyRemoteResult } from './pr-land-heavy-remote.js';
 import { readPrBaseNameWithRetry } from './pr-land-base-read.js';
 import { runHeavyOnPodShadow } from './pr-land-pod-shadow.js';
@@ -1319,26 +1319,39 @@ export async function runPrLand(opts: PrLandOpts = {}, deps: PrLandDeps = {}): P
   };
   // Observe actual merge refusals, including the measured remote gate and public export leak.
   // Option syntax and unmeasured prerequisite errors do not describe a recovery edge.
+  // LAND-REFUSAL-EDGES — a pinned refusal is also bound to the recover@1 edge with its raw line and card.
+  // The card arrives only through the child env set by TA defaultLand — never a shell export.
+  const cardId = process.env[PR_LAND_CARD_ID_ENV]?.trim() || undefined;
+  const bindRecover = (message: string, context: { isDraft?: boolean } = {}) => {
+    const pr = Number(opts.pr);
+    if (!Number.isSafeInteger(pr) || pr <= 0 || !opts.expectedHead) return undefined;
+    try { return bindPrLandRefusalToRecover({ refusal: message, pr, head: opts.expectedHead, isDraft: context.isDraft, cardId }); }
+    catch { return undefined; }
+  };
   const refuse = (message: string, context: { isDraft?: boolean } = {}): void => {
     out.error(message);
     observePrLandRefusal(message, context);
-    const pr = Number(opts.pr);
-    if (Number.isSafeInteger(pr) && pr > 0 && opts.expectedHead) {
-      try {
-        const plan = planPrLandRecovery({ refusal: message, pr, head: opts.expectedHead, isDraft: context.isDraft });
-        debug.log('pr.land', 'recover-shadow', {
-          pr, head: opts.expectedHead, label: plan.evidence.label, route: plan.evidence.route,
-          outcome: plan.outcome, action: plan.result.action, reason: plan.result.reason,
-          delayMs: plan.result.delayMs ?? null, execution: 'none',
-        });
-      } catch {
-        // Recovery observation must never replace the original landing refusal.
-      }
+    const plan = bindRecover(message, context);
+    if (!plan) return;
+    try {
+      debug.log('pr.land', 'recover-shadow', {
+        pr: Number(opts.pr), head: opts.expectedHead, label: plan.evidence.label, route: plan.evidence.route,
+        outcome: plan.outcome, action: plan.result.action, reason: plan.result.reason,
+        delayMs: plan.result.delayMs ?? null, execution: 'none',
+      });
+    } catch {
+      // Recovery observation must never replace the original landing refusal.
     }
   };
+  // A direct failure binds only when today's refusal shape is recognized — the same measured sample
+  // as observeDirectPrLandRefusal (#28939). An unclassified direct error is not a landing refusal.
+  const observeDirect = (message: string): void => {
+    observeDirectPrLandRefusal(message);
+    if (classifyPrLandRefusal(message) !== 'other') bindRecover(message);
+  };
   const refuseDirect = (message: string): void => {
     out.error(message);
-    observeDirectPrLandRefusal(message);
+    observeDirect(message);
   };
   if (opts.title !== undefined && opts.titleFile !== undefined) {
     out.error('✗ title: --title과 --title-file은 함께 사용할 수 없습니다.');
@@ -2043,7 +2056,7 @@ export async function runPrLand(opts: PrLandOpts = {}, deps: PrLandDeps = {}): P
   nextMdWarning(body ?? '', changedPaths, out);
   if (!conflictMarkerBlock(changedPaths, cwd, out)) return 1;
   publicLeakWarning(changedPaths, deps.runPublicLeakGate ?? ((files, sink) => runPrLandPublicLeakGate(files, sink, cwd, base)), out);
-  if (!exportLeakBlock(changedPaths, () => (deps.runExportLeakCheck ?? runPrLandExportLeakCheck)(changedPaths ?? [], cwd), opts.allowPublicLeak === true, out, cwd, observeDirectPrLandRefusal)) return 1;
+  if (!exportLeakBlock(changedPaths, () => (deps.runExportLeakCheck ?? runPrLandExportLeakCheck)(changedPaths ?? [], cwd), opts.allowPublicLeak === true, out, cwd, observeDirect)) return 1;
   if (!await exportImportBlock(changedPaths, () => (deps.runExportImportCheck ?? runPrLandExportImportCheck)(changedPaths ?? [], cwd), out)) return 1;
   if (publicDocPaths(changedPaths, () => true).length > 0) {
     const top = run('git', ['rev-parse', '--show-toplevel'], { cwd });