elanous 0.2.4 → 0.2.5

package/src/plugins/install/plugin-install.ts

@@ -1,12 +1,15 @@
-import { createHash } from 'node:crypto';
+import { createHash, randomUUID } from 'node:crypto';
 import { spawnSync } from 'node:child_process';
 import { closeSync, cpSync, existsSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { basename, dirname, isAbsolute, join, resolve, sep } from 'node:path';
 import { dlopen, FFIType } from 'bun:ffi';
 import { loadPluginManifestFromDir, type PluginManifest } from '../core/manifest.js';
+import { loadPluginNodes } from '../../graph-kinds/plugin-nodes.js';
+import { getNodeKindRegistration, listNodeKinds, unregisterPluginNodeKind } from '../../graph-kinds/registry.js';
 import { verifyIndex, type MarketplaceIndex, type VerifyIndexResult } from '../../market/signed-index.js';
 import { elanousStateRoot } from '../../autopilot/state-paths.js';
+import { ensureMarketIndex, MarketFetchError, type MarketFetchOptions } from './market-fetch.js';
 
 const NAME = /^[a-z0-9][a-z0-9-]{1,39}$/;
 const VERSION = /^[0-9]+\.[0-9]+\.[0-9]+(?:[-+][a-zA-Z0-9.-]+)?$/;
@@ -18,7 +21,7 @@ export type InstallEvent =
   | { event: 'verify'; signature: 'ok' | 'missing' | 'bad'; scan: 'safe' | 'caution' | 'dangerous' }
   | { event: 'consent'; capabilities: string[]; required: boolean }
   | { event: 'credentials'; connectors: Array<{ id: string; fields: Array<{ name: string; secret: boolean }> }> }
-  | { event: 'registered'; kinds: string[]; graphs: string[]; skills: string[] }
+  | { event: 'registered'; /** Vocab file paths, not graph node kinds. */ kinds: string[]; nodes: string[]; nodeErrors: number; graphs: string[]; skills: string[] }
   | { event: 'done'; plugin: string; version: string; path: string };
 
 export interface InstalledPlugin {
@@ -27,6 +30,8 @@ export interface InstalledPlugin {
   market: string;
   path: string;
   sha256: string | null;
+  /** Absent for installations recorded before timestamps were introduced. */
+  installedAt?: string;
 }
 
 export interface InstallOptions {
@@ -34,12 +39,15 @@ export interface InstallOptions {
   marketDir?: string;
   cwd?: string;
   allowUnsigned?: boolean;
+  refresh?: boolean;
   yes?: boolean;
   trustedKeys?: ReadonlyArray<{ keyId: string; publicKey: string }>;
   verifySignature?: typeof verifyIndex;
   hashArtifact?: (bytes: Uint8Array) => string;
   onEvent?: (event: InstallEvent) => void;
   consent?: (capabilities: string[]) => boolean | Promise<boolean>;
+  fetcher?: MarketFetchOptions['fetcher'];
+  configPath?: string;
 }
 
 export class PluginInstallError extends Error {
@@ -115,28 +123,8 @@ function marketEntry(spec: string, opts: InstallOptions): { market: string; entr
   return { market, entry: matches[0]!, signature };
 }
 
-function unpackArchive(bytes: Uint8Array, target: string): void {
-  const archive = join(dirname(target), 'artifact.tgz');
-  writeFileSync(archive, bytes);
-  try {
-    const entries = child('tar', ['-tzf', archive]).split('\n');
-    for (const item of entries) {
-      if (item === '.' || item === './') continue;
-      inside(target, item.replace(/^\.\//, ''));
-    }
-    // Links and special entries can write outside the destination before a post-extract scan.
-    const types = child('tar', ['-tvzf', archive]).split('\n');
-    if (types.some(line => line && !['-', 'd'].includes(line[0]!))) fail('scan', 'artifact contains links or special files');
-    mkdirSync(target);
-    child('tar', ['-xzf', archive, '-C', target, '--no-same-owner', '--no-same-permissions']);
-    safeTree(target);
-  } finally {
-    rmSync(archive, { force: true });
-  }
-}
-
-export function resolvePluginSource(spec: string, target: string, opts: InstallOptions = {}): { market: string; sha256: string | null; signature: 'ok' | 'missing'; expectedName?: string; expectedVersion?: string } {
-  if (/^[a-z0-9][a-z0-9-]{1,39}@[a-z0-9][a-z0-9-]{1,39}$/.test(spec) && !existsSync(resolve(opts.cwd ?? process.cwd(), spec))) {
+/** Offline: a signed index placed in `<markets>/<name>/` without a configured URL (pre-fetch behaviour — kept). */
+function localMarketSource(spec: string, target: string, opts: InstallOptions): ResolvedPluginSource {
     const { market, entry, signature } = marketEntry(spec, opts);
     const source = entry.source;
     const sourceRoot = dirname(indexPath(market, opts));
@@ -159,7 +147,100 @@ export function resolvePluginSource(spec: string, target: string, opts: InstallO
       fail('io', `market entry has no verifiable artifact: ${entry.name}`);
     }
     return { market, sha256: entry.artifact?.sha256 ?? null, signature, expectedName: entry.name, expectedVersion: entry.version };
+}
+
+function hasLocalMarketIndex(market: string, opts: InstallOptions): boolean {
+  const base = resolve(opts.marketDir ?? join(opts.root ?? elanousStateRoot(), 'markets'));
+  return [join(base, market, 'marketplace.json'), join(base, market, '.agents', 'plugins', 'marketplace.json')].some(existsSync);
+}
+
+function unpackArchive(bytes: Uint8Array, target: string): void {
+  const archive = join(dirname(target), 'artifact.tgz');
+  writeFileSync(archive, bytes);
+  try {
+    const entries = child('tar', ['-tzf', archive]).split('\n');
+    for (const item of entries) {
+      if (item === '.' || item === './') continue;
+      inside(target, item.replace(/^\.\//, ''));
+    }
+    // Links and special entries can write outside the destination before a post-extract scan.
+    const types = child('tar', ['-tvzf', archive]).split('\n');
+    if (types.some(line => line && !['-', 'd'].includes(line[0]!))) fail('scan', 'artifact contains links or special files');
+    mkdirSync(target);
+    child('tar', ['-xzf', archive, '-C', target, '--no-same-owner', '--no-same-permissions']);
+    safeTree(target);
+  } finally {
+    rmSync(archive, { force: true });
+  }
+}
+
+type ResolvedPluginSource = { market: string; sha256: string | null; signature: 'ok' | 'missing'; expectedName?: string; expectedVersion?: string };
+
+function marketSpec(spec: string, opts: InstallOptions): boolean {
+  return /^[a-z0-9][a-z0-9-]{1,39}@[a-z0-9][a-z0-9-]{1,39}$/.test(spec) && !existsSync(resolve(opts.cwd ?? process.cwd(), spec));
+}
+
+async function fetchedMarketSource(spec: string, target: string, opts: InstallOptions): Promise<ResolvedPluginSource> {
+  const [name, marketName] = spec.split('@') as [string, string];
+  let marketIndex: Awaited<ReturnType<typeof ensureMarketIndex>>;
+  try {
+    marketIndex = await ensureMarketIndex(marketName, {
+      root: opts.root, marketDir: opts.marketDir, configPath: opts.configPath, fetcher: opts.fetcher,
+      refresh: opts.refresh, verifySignature: opts.verifySignature, trustedKeys: opts.trustedKeys,
+    });
+  } catch (error) {
+    if (error instanceof MarketFetchError && /^market not configured: /.test(error.message) && hasLocalMarketIndex(marketName, opts)) {
+      return localMarketSource(spec, target, opts);
+    }
+    if (error instanceof MarketFetchError) throw new PluginInstallError(error.reason, error.message);
+    throw error;
+  }
+  const matches = marketIndex.index.plugins.filter(entry => entry.name === name);
+  if (matches.length !== 1) fail('io', `plugin not found or ambiguous in ${marketName}: ${name}`);
+  const entry = matches[0]!;
+  const artifact = entry.artifact;
+  if (!artifact || typeof artifact.key !== 'string' || !artifact.key || !HASH.test(artifact.sha256)
+    || !Number.isSafeInteger(artifact.bytes) || artifact.bytes < 0) fail('io', 'invalid artifact key, hash or size');
+  // Check the key as written, before URL resolution folds `..`/`.` or percent-encoded separators away.
+  if (!/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/.test(artifact.key) || artifact.key.split('/').some(part => part === '.' || part === '..')) fail('io', 'unsafe artifact key');
+  const base = new URL(marketIndex.market.url);
+  const url = new URL(artifact.key, base);
+  if (url.protocol !== 'https:' || url.origin !== base.origin || !url.pathname.startsWith(base.pathname)
+    || url.username || url.password || url.search || url.hash || /[\\?#]/.test(artifact.key)) fail('io', 'unsafe artifact key');
+  let response: Response;
+  // The URL checks above hold only if no redirect moves the download elsewhere.
+  try { response = await (opts.fetcher ?? fetch)(url.href, { redirect: 'error' }); }
+  catch { fail('io', 'artifact fetch failed: network error'); }
+  if (!response.ok || !response.body) fail('io', `artifact fetch failed: HTTP ${response.status}`);
+  if (response.redirected || (response.url && response.url !== url.href)) fail('io', 'artifact fetch was redirected');
+  const reader = response.body.getReader();
+  const chunks: Uint8Array[] = [];
+  let length = 0;
+  try {
+    for (;;) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      length += value.byteLength;
+      if (length > artifact.bytes) fail('scan', 'artifact sha256 or size mismatch');
+      chunks.push(value);
+    }
+  } finally {
+    void reader.cancel().catch(() => {});
+    reader.releaseLock();
+  }
+  const bytes = new Uint8Array(length);
+  let offset = 0;
+  for (const chunk of chunks) { bytes.set(chunk, offset); offset += chunk.byteLength; }
+  if (length !== artifact.bytes || (opts.hashArtifact ?? (data => createHash('sha256').update(data).digest('hex')))(bytes).toLowerCase() !== artifact.sha256.toLowerCase()) {
+    fail('scan', 'artifact sha256 or size mismatch');
   }
+  unpackArchive(bytes, target);
+  return { market: marketName, sha256: artifact.sha256, signature: marketIndex.signature, expectedName: name, expectedVersion: entry.version };
+}
+
+export function resolvePluginSource(spec: string, target: string, opts: InstallOptions = {}): ResolvedPluginSource {
+  // Synchronous callers keep the offline contract: a signed index already placed under `<markets>/<name>/`.
+  if (marketSpec(spec, opts)) return localMarketSource(spec, target, opts);
   const local = resolve(opts.cwd ?? process.cwd(), spec);
   if (existsSync(local)) {
     copyPlugin(realpathSync(local), target);
@@ -187,19 +268,63 @@ function gitSource(url: string, destination: string, path?: unknown, sha?: unkno
   }
 }
 
+function hasSkill(dir: string): boolean {
+  if (!existsSync(dir)) return false;
+  return readdirSync(dir, { withFileTypes: true }).some(entry => entry.isDirectory() && existsSync(join(dir, entry.name, 'SKILL.md')));
+}
+
+function inspectPluginNodes(packageRoot: string, manifest: PluginManifest): { nodes: string[]; nodeErrors: number } {
+  if (!manifest.contributes.nodes?.length) return { nodes: [], nodeErrors: 0 };
+  // Registration validates each staged definition. Use a private identity so existing installations
+  // cannot reject an otherwise valid kind as a duplicate; only this inspection's entries are removed.
+  const inspectionId = `inspect-${randomUUID().replaceAll('-', '')}`;
+  let nodeErrors = 0;
+  const nodes: string[] = [];
+  try {
+    nodeErrors = loadPluginNodes(packageRoot, { ...manifest, id: inspectionId }).errors.length;
+  } finally {
+    for (const entry of listNodeKinds()) {
+      if (entry.plugin !== inspectionId) continue;
+      nodes.push(`${manifest.id}:${entry.kind.slice(inspectionId.length + 1)}`);
+      const registered = getNodeKindRegistration(entry.graph, entry.kind);
+      if (registered) unregisterPluginNodeKind(entry.graph, entry.kind, inspectionId, registered);
+    }
+  }
+  return { nodes, nodeErrors };
+}
+
+function declaresMain(packageRoot: string): boolean {
+  for (const file of ['plugin.json', join('.codex-plugin', 'plugin.json')]) {
+    const path = join(packageRoot, file);
+    if (!existsSync(path)) continue;
+    try {
+      const raw: unknown = JSON.parse(readFileSync(path, 'utf8'));
+      if (raw && typeof raw === 'object' && 'main' in raw) return true;
+    } catch { return true; }
+  }
+  return !existsSync(join(packageRoot, 'plugin.json')) && !existsSync(join(packageRoot, '.codex-plugin', 'plugin.json'));
+}
+
 export async function installPlugin(spec: string, opts: InstallOptions = {}): Promise<InstalledPlugin> {
   const root = resolve(opts.root ?? elanousStateRoot());
   const stageRoot = join(root, 'plugins', '.staging');
   mkdirSync(stageRoot, { recursive: true });
   const stage = mkdtempSync(join(stageRoot, 'plugin-'));
   try {
-    const source = resolvePluginSource(spec, join(stage, 'package'), opts);
+    const source = marketSpec(spec, opts)
+      ? await fetchedMarketSource(spec, join(stage, 'package'), opts)
+      : resolvePluginSource(spec, join(stage, 'package'), opts);
     const manifest: PluginManifest = loadPluginManifestFromDir(join(stage, 'package'), { id: source.expectedName ?? basename(spec) }).manifest;
     if (!NAME.test(manifest.id) || !VERSION.test(manifest.version)) fail('io', 'invalid plugin name or version');
     if (source.expectedName && (manifest.id !== source.expectedName || manifest.version !== source.expectedVersion)) fail('conflict', 'market name or version differs from manifest');
     const packageRoot = join(stage, 'package');
     const mainPath = inside(packageRoot, manifest.main);
-    if (!existsSync(mainPath) || !realpathSync(mainPath).startsWith(`${realpathSync(packageRoot)}${sep}`)) fail('io', `plugin main not found or unsafe: ${manifest.main}`);
+    // A skills/graphs-only pack (official `elanous-basics`) declares no `main` — the default `./plugin.ts` is not a promise.
+    // …but only a pack that ships something to install (skills or graphs) may omit it.
+    const shipsAssets = hasSkill(join(packageRoot, 'skills')) || (manifest.contributes.graphs?.length ?? 0) > 0;
+    if (existsSync(mainPath) || declaresMain(packageRoot) || !shipsAssets) {
+      if (!existsSync(mainPath) || !realpathSync(mainPath).startsWith(`${realpathSync(packageRoot)}${sep}`)) fail('io', `plugin main not found or unsafe: ${manifest.main}`);
+    }
     const name = manifest.id;
     const version = manifest.version;
     for (const asset of [...(manifest.contributes.graphs ?? []), ...(manifest.contributes.vocab ?? [])]) {
@@ -228,12 +353,13 @@ export async function installPlugin(spec: string, opts: InstallOptions = {}): Pr
           .map(entry => entry.name).sort()
         : []
       : manifest.contributes.skills.map(skill => skill.name ?? skill.id ?? '').filter(Boolean);
-    emit({ event: 'registered', kinds, graphs, skills });
+    const { nodes, nodeErrors } = inspectPluginNodes(packageRoot, manifest);
+    emit({ event: 'registered', kinds, nodes, nodeErrors, graphs, skills });
     const installed = withLedgerLock(root, () => {
       if (existsSync(destination)) fail('conflict', `plugin already installed: ${name}@${version}`);
       mkdirSync(dirname(destination), { recursive: true });
       renameSync(join(stage, 'package'), destination);
-      const item = { name, version, market: source.market, path: destination, sha256: source.sha256 };
+      const item = { name, version, market: source.market, path: destination, sha256: source.sha256, installedAt: new Date().toISOString() };
       try {
         writeLedger(root, [...listInstalledPlugins(root), item]);
       } catch (error) {
@@ -323,7 +449,8 @@ function writeLedger(root: string, entries: InstalledPlugin[]): void {
   const unique = new Map(entries.map(entry => [`${entry.market}/${entry.name}/${entry.version}`, entry]));
   const temp = `${ledger}.${process.pid}.tmp`;
   try {
-    writeFileSync(temp, JSON.stringify([...unique.values()].map(({ name, version, market, sha256 }) => ({ name, version, market, sha256 })), null, 2));
+    writeFileSync(temp, JSON.stringify([...unique.values()].map(({ name, version, market, sha256, installedAt }) =>
+      ({ name, version, market, sha256, ...(installedAt === undefined ? {} : { installedAt }) })), null, 2));
     renameSync(temp, ledger);
   } finally {
     rmSync(temp, { force: true });
@@ -334,7 +461,7 @@ export function listInstalledPlugins(root = elanousStateRoot()): InstalledPlugin
   const base = join(root, 'plugins');
   if (!existsSync(base)) return [];
   const result: InstalledPlugin[] = [];
-  let ledger: Array<Pick<InstalledPlugin, 'name' | 'version' | 'market' | 'sha256'>> = [];
+  let ledger: Array<Pick<InstalledPlugin, 'name' | 'version' | 'market' | 'sha256' | 'installedAt'>> = [];
   try {
     ledger = JSON.parse(readFileSync(join(base, 'installed.json'), 'utf8'));
     if (!Array.isArray(ledger)) ledger = [];
@@ -348,8 +475,12 @@ export function listInstalledPlugins(root = elanousStateRoot()): InstalledPlugin
         const path = join(base, market.name, name.name, version.name);
         try {
           const manifest = loadPluginManifestFromDir(path, { id: name.name }).manifest;
-          if (manifest.id === name.name && manifest.version === version.name) result.push({ name: name.name, version: version.name, market: market.name, path,
-            sha256: ledger.find(entry => entry.name === name.name && entry.version === version.name && entry.market === market.name)?.sha256 ?? null });
+          if (manifest.id === name.name && manifest.version === version.name) {
+            const recorded = ledger.find(entry => entry.name === name.name && entry.version === version.name && entry.market === market.name);
+            result.push({ name: name.name, version: version.name, market: market.name, path,
+              sha256: recorded?.sha256 ?? null,
+              ...(typeof recorded?.installedAt === 'string' ? { installedAt: recorded.installedAt } : {}) });
+          }
         } catch { /* malformed packages are not installed plugins */ }
       }
     }

package/src/prompt-library/universal-preamble.ts

@@ -59,6 +59,10 @@ export const PROJECT_ANCHOR_NON_CANDIDATE_FILENAMES = ['CLAUDE.md'] as const;
 export const PROJECT_TREE_MAX_CHARS = 8 * 1024;
 export const PROJECT_TREE_DIR_ENTRY_LIMIT = 20;
 
+const NO_TOOLS_VERIFICATION_GUIDANCE = `## Chat without tools — verify rather than guess
+This conversation has tools disabled. Do not guess repository or real-time facts that require verification, such as file counts, file contents, commits, or the current time. Say you cannot check them here. The project tree above is for navigation, not evidence for counts.
+To check these facts, enable tools with \`elanous agent …\` or \`elanous chat --tools …\`.`;
+
 // P4 (2026-05-03) — Family-agnostic coding-agent lifecycle. Maps the
 // three user-facing pipelines to an explicit tool-batch sequence so every
 // model (not just codex) follows the same shape. Pattern source:
@@ -673,8 +677,7 @@ export function loadProjectAnchor(cwd: string): ProjectAnchorResult {
   return result;
 }
 
-/** Build the surface-agnostic preamble. Currently MVP — emits zero or
- *  one system message (project anchor). Surfaces spread the result
+/** Build the surface-agnostic preamble. Surfaces spread the result
  *  into their own preamble; e.g.
  *
  *  ```ts
@@ -729,6 +732,9 @@ export function buildUniversalPreamble(ctx: UniversalPreambleContext): LLMMessag
       content: `## Project Layout (top-level + 1 depth)\n\n\`\`\`\n${tree.content}\n\`\`\`\n\nUse this layout to pick directories directly instead of issuing broad project-root Grep/Glob calls. When AGENTS.md / CLAUDE.md describe a track or subsystem, this layout shows where its files actually live.`,
     });
   }
+  if (!ctx.enabledTools?.length) {
+    out.push({ role: 'system', content: NO_TOOLS_VERIFICATION_GUIDANCE });
+  }
   // P4 (2026-05-03) — Family-agnostic coding-agent lifecycle. Append
   // before family addendum so codex (which has its own discipline
   // overlay) sees both: lifecycle (what shape) + addendum (how to behave

package/src/release-loop/checklist.ts

@@ -0,0 +1,191 @@
+import { chmodSync, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { Database } from 'bun:sqlite';
+import { dirname, join } from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { debug } from '../debug/log.js';
+import { releaseLedgerRoot } from '../instance/resolve.js';
+
+export type ChecklistStatus = 'green' | 'yellow' | 'red' | 'done';
+export interface ChecklistItem {
+  id: string;
+  title: string;
+  status: ChecklistStatus;
+  owner?: string;
+  evidence?: string;
+  updatedAt: string;
+  updatedBy: string;
+}
+export interface ChecklistHistory {
+  at: string;
+  by: string;
+  id: string;
+  field: string;
+  from: unknown;
+  to: unknown;
+  released: string;
+  dev: string;
+}
+export interface Checklist {
+  version: string;
+  released: string;
+  dev: string;
+  items: ChecklistItem[];
+  history: ChecklistHistory[];
+}
+
+export function devVersion(): string {
+  return (JSON.parse(readFileSync(join(import.meta.dir, '..', '..', 'package.json'), 'utf8')) as { version: string }).version;
+}
+
+function releasedVersion(): string {
+  const dir = join(releaseLedgerRoot(), 'release');
+  if (!existsSync(dir)) return '';
+  return readdirSync(dir).filter((v) => /^\d+\.\d+\.\d+$/.test(v) && existsSync(join(dir, v, 'release.json')))
+    .filter((v) => {
+      try { const record = JSON.parse(readFileSync(join(dir, v, 'release.json'), 'utf8')) as { version?: string; publishedAt?: string }; return record.version === v && typeof record.publishedAt === 'string'; }
+      catch { return false; }
+    })
+    .sort((a, b) => {
+      const aa = a.split('.').map(Number), bb = b.split('.').map(Number);
+      return (bb[0]! - aa[0]!) || (bb[1]! - aa[1]!) || (bb[2]! - aa[2]!);
+    })[0] ?? '';
+}
+
+function pathFor(v: string): string {
+  if (!/^\d+\.\d+\.\d+(?:-(?:rc|alpha|beta)\.\d+)?$/.test(v)) throw new Error(`체크리스트 판이 아니다: ${v}`);
+  return join(releaseLedgerRoot(), 'release', v, 'checklist.json');
+}
+
+export function listChecklist(v: string): Checklist {
+  const path = pathFor(v);
+  if (existsSync(path)) {
+    const data = JSON.parse(readFileSync(path, 'utf8')) as Checklist;
+    refresh(data);
+    return data;
+  }
+  return { version: v, released: releasedVersion(), dev: devVersion(), items: [], history: [] };
+}
+
+// SQLite's OS-backed write lock is released when the owning process exits, even without a finally block.
+// Hold it across the JSON read/modify/atomic-rename sequence so writers never use stale snapshots.
+function mutate(v: string, apply: (data: Checklist) => boolean): Checklist {
+  const path = pathFor(v);
+  mkdirSync(dirname(path), { recursive: true });
+  const lock = `${path}.mutex.sqlite`;
+  const db = new Database(lock, { create: true, strict: true });
+  try {
+    chmodSync(lock, 0o600);
+    db.exec('PRAGMA busy_timeout = 10000');
+    db.exec('BEGIN IMMEDIATE');
+    try {
+      const data = listChecklist(v);
+      if (apply(data)) save(v, data);
+      db.exec('COMMIT');
+      return data;
+    } catch (error) {
+      db.exec('ROLLBACK');
+      throw error;
+    }
+  } finally { db.close(); }
+}
+
+function save(v: string, data: Checklist): void {
+  const path = pathFor(v);
+  mkdirSync(dirname(path), { recursive: true });
+  const temp = `${path}.${process.pid}.${randomUUID()}.tmp`;
+  try {
+    writeFileSync(temp, `${JSON.stringify(data, null, 2)}\n`, { mode: 0o600 });
+    chmodSync(temp, 0o600);
+    renameSync(temp, path);
+  } finally { if (existsSync(temp)) rmSync(temp); }
+}
+
+function change(data: Checklist, id: string, field: string, from: unknown, to: unknown, by: string, at: string): void {
+  data.history.push({ at, by, id, field, from: from ?? null, to: to ?? null, released: data.released, dev: data.dev });
+  debug.log('release-loop.checklist', 'change', { version: data.version, id, field, from: from ?? null, to: to ?? null, by });
+}
+
+function refresh(data: Checklist): void { data.released = releasedVersion(); data.dev = devVersion(); }
+
+export function addItem(v: string, input: { id: string; title: string; owner?: string }): Checklist {
+  if (!input.id.trim()) throw new Error('칸 id 가 비었다');
+  if (!input.title.trim()) throw new Error('칸 제목이 비었다');
+  return mutate(v, (data) => {
+    if (data.items.some((item) => item.id === input.id)) throw new Error(`이미 있는 칸: ${input.id}`);
+    const by = process.env.ELANOUS_TRACK || 'cli';
+    const at = new Date().toISOString();
+    const item: ChecklistItem = { id: input.id, title: input.title, status: 'yellow', ...(input.owner !== undefined ? { owner: input.owner } : {}), updatedAt: at, updatedBy: by };
+    data.items.push(item);
+    change(data, item.id, 'add', null, item, by, at);
+    return true;
+  });
+}
+
+export function setItem(v: string, id: string, patch: { status?: ChecklistStatus; evidence?: string; owner?: string }, by: string): Checklist {
+  return mutate(v, (data) => {
+    const item = data.items.find((i) => i.id === id);
+    if (!item) throw new Error(`없는 칸: ${id}`);
+    if (patch.status !== undefined && !['green', 'yellow', 'red', 'done'].includes(patch.status)) throw new Error(`잘못된 상태: ${patch.status}`);
+    const fields = (['evidence', 'owner', 'status'] as const).filter((field) => patch[field] !== undefined && patch[field] !== item[field]);
+    if (fields.length === 0) return false;
+    const at = new Date().toISOString();
+    for (const field of fields) {
+      const from = item[field];
+      const to = patch[field]!;
+      (item as unknown as Record<string, unknown>)[field] = to;
+      item.updatedAt = at;
+      item.updatedBy = by;
+      change(data, id, field, from, to, by, at);
+    }
+    return true;
+  });
+}
+
+export function removeItem(v: string, id: string, by: string): Checklist {
+  return mutate(v, (data) => {
+    const index = data.items.findIndex((i) => i.id === id);
+    if (index < 0) throw new Error(`없는 칸: ${id}`);
+    const at = new Date().toISOString();
+    const [item] = data.items.splice(index, 1);
+    change(data, id, 'remove', item, null, by, at);
+    return true;
+  });
+}
+
+export function summarize(v: string): ChecklistSummary {
+  return summarizeChecklist(listChecklist(v));
+}
+
+export interface ChecklistSummary { green: number; yellow: number; red: number; done: number; blocked: string[]; byOwner: Record<string, number> }
+
+export function summarizeChecklist(data: Checklist): ChecklistSummary {
+  const summary = { green: 0, yellow: 0, red: 0, done: 0, blocked: [] as string[], byOwner: Object.create(null) as Record<string, number> };
+  for (const item of data.items) {
+    summary[item.status]++;
+    if (item.status === 'red') summary.blocked.push(item.id);
+    const owner = item.owner ?? 'unassigned';
+    summary.byOwner[owner] = (summary.byOwner[owner] ?? 0) + 1;
+  }
+  return summary;
+}
+
+export function seedFromRoadmap(v: string, markdown: string): Checklist {
+  return mutate(v, (data) => {
+    let added = false;
+    for (const line of markdown.split('\n')) {
+      const match = /^\|\s*(K\d+[a-z]?[′']?)\s*\|\s*(.*?)\s*\|\s*(.*?)\s*\|/.exec(line);
+      if (!match || data.items.some((i) => i.id === match[1])) continue;
+      const id = match[1]!;
+      const title = match[2]!;
+      const icon = match[3]!.trim();
+      const status: ChecklistStatus = icon.startsWith('🟢') ? 'green' : icon.startsWith('🔴') ? 'red' : icon.startsWith('✅') ? 'done' : 'yellow';
+      const at = new Date().toISOString();
+      const by = process.env.ELANOUS_TRACK || 'cli';
+      const item: ChecklistItem = { id, title, status, updatedAt: at, updatedBy: by };
+      data.items.push(item);
+      change(data, id, 'add', null, item, by, at);
+      added = true;
+    }
+    return added;
+  });
+}

package/src/release-loop/release-note.ts

@@ -30,9 +30,10 @@ function blankFencedCode(text: string): string {
 
 export function parseReleaseNoteSection(rawPrBody: string): { fragment?: Section; problems: string[] } {
   const prBody = blankFencedCode(rawPrBody);
-  const start = /^## 릴리스 노트[ \t]*\r?$/m.exec(prBody);
+  const sections = [...prBody.matchAll(/^## 릴리스 노트[ \t]*\r?$/gm)];
+  const start = sections.at(-1);
   if (!start) return { problems: [] };
-  const rest = prBody.slice(start.index + start[0].length).replace(/^\r?\n/, '');
+  const rest = prBody.slice(start.index! + start[0].length).replace(/^\r?\n/, '');
   const nextHeading = /^ {0,3}#{1,6}(?:[ \t]+|$)/m.exec(rest);
   const body = nextHeading ? rest.slice(0, nextHeading.index) : rest;
   const fields = new Map<string, string>();
@@ -51,7 +52,9 @@ export function parseReleaseNoteSection(rawPrBody: string): { fragment?: Section
   if (duplicates.has('종류') || !kind || !['fix', 'feat', 'security', 'internal'].includes(kind)) problems.push('종류');
   if (duplicates.has('문서') || !doc || (doc.startsWith('없음') ? !/^없음\([^\s()]+(?:[^()]*)\)$/.test(doc) : !/^\S+$/.test(doc))) problems.push('문서');
   if (duplicates.has('대상') || (target !== 'next' && target !== 'later')) problems.push('대상');
-  if (problems.length) return { problems };
+  const invalid = problems.length > 0;
+  if (sections.length > 1) problems.push(`multiple release-note sections (${sections.length}); using the last`);
+  if (invalid) return { problems };
   return {
     fragment: {
       line: line!, kind: kind as Section['kind'],

package/src/self-dev/dev-cli.ts

@@ -45,6 +45,7 @@ import { getUserConfig, type UserConfig } from '../user-config.js';
 import { resolveChildLlmPreference, type ChildLlmPreferenceInput, type ResolvedChildLlmPreference } from '../self-implement/child-llm-preference.js';
 import { readCachedGrokQuota } from '../oauth/codex-account-store.js';
 import { queryAbandonedDraftPrs, type AbandonedDraftPr } from '../cli/logs-abandoned-draft-prs.js';
+import { branchLineageSlug } from '../cli/pr-lineage.js';
 import { decideDraft, type DraftTriagePr } from './draft-triage-rules.js';
 import { resolveLogTargets } from '../cli/logs-cli.js';
 import { LogStore } from '../mss/logging/log-store.js';
@@ -196,12 +197,12 @@ export interface DevSelfRunExecution {
 
 interface DraftTriage {
   closed: number[];
-  kept: number | null;
+  kept: number[] | null;
   closeFailed: number[];
   skippedNotDraft: number[];
 }
 
-export type DraftPrViewState = { isDraft: boolean; state: string } | null;
+export type DraftPrViewState = { isDraft: boolean; state: string; headRefName?: string } | null;
 
 export interface DraftPrInventory {
   readonly open: readonly (DraftTriagePr & { url: string; openedAtMs: number; runId?: string | null })[];
@@ -294,11 +295,13 @@ function defaultViewDraftPr(prUrl: string, timeoutMs?: number): DraftPrViewState
   if (IN_TEST_PROCESS()) return null;
   const target = draftPrTargetFromUrl(prUrl);
   if (!target) return null;
-  const view = spawnSync('gh', ['pr', 'view', String(target.number), '--repo', target.repository, '--json', 'isDraft,state'], { encoding: 'utf8', ...(timeoutMs === undefined ? {} : { timeout: timeoutMs }) });
+  const view = spawnSync('gh', ['pr', 'view', String(target.number), '--repo', target.repository, '--json', 'isDraft,state,headRefName'], { encoding: 'utf8', ...(timeoutMs === undefined ? {} : { timeout: timeoutMs }) });
   if (view.status !== 0) return null;
   try {
-    const parsed = JSON.parse(view.stdout) as { isDraft?: unknown; state?: unknown };
-    return typeof parsed.isDraft === 'boolean' && typeof parsed.state === 'string' ? { isDraft: parsed.isDraft, state: parsed.state } : null;
+    const parsed = JSON.parse(view.stdout) as { isDraft?: unknown; state?: unknown; headRefName?: unknown };
+    return typeof parsed.isDraft === 'boolean' && typeof parsed.state === 'string'
+      ? { isDraft: parsed.isDraft, state: parsed.state, ...(typeof parsed.headRefName === 'string' ? { headRefName: parsed.headRefName } : {}) }
+      : null;
   } catch {
     return null;
   }
@@ -946,41 +949,58 @@ export async function executeDevSelfRun(
     const view = supervise?.viewDraftPr ?? defaultViewDraftPr;
     const closeDraft = supervise?.closeDraftPr ?? defaultCloseDraftPr;
     const commentDraft = supervise?.commentDraftPr ?? defaultCommentDraftPr;
-    const openDrafts: string[] = [];
+    const openDrafts: Array<{ url: string; lineage: string | null }> = [];
     const skippedNotDraft: number[] = [];
     for (const prUrl of drafts) {
       let live: DraftPrViewState = null;
       try { live = view(prUrl); } catch { live = null; }
-      if (live?.isDraft === true && live.state === 'OPEN') openDrafts.push(prUrl);
-      else {
+      if (live?.isDraft === true && live.state === 'OPEN') {
+        openDrafts.push({ url: prUrl, lineage: live.headRefName ? branchLineageSlug(live.headRefName) : null });
+      } else {
         const number = prNumberFromUrl(prUrl);
         if (number !== null) skippedNotDraft.push(number);
       }
     }
-    const keptUrl = converged ? undefined : openDrafts.at(-1);
-    const kept = keptUrl === undefined ? null : prNumberFromUrl(keptUrl);
+    const keptByLineage = new Map<string, string>();
+    if (!converged) {
+      for (const draft of openDrafts) {
+        if (draft.lineage !== null) keptByLineage.set(draft.lineage, draft.url);
+      }
+    }
+    const keptDrafts = converged ? [] : openDrafts.filter(({ url, lineage }) => lineage === null || keptByLineage.get(lineage) === url);
+    const kept = keptDrafts.length === 0 ? null : keptDrafts.flatMap(({ url }) => {
+      const number = prNumberFromUrl(url);
+      return number === null ? [] : [number];
+    });
     const closed: number[] = [];
     const closeFailed: number[] = [];
     const landed = mergedNumbers.map((n) => `#${n}`).join(' ') || '없음';
-    for (const prUrl of openDrafts) {
-      if (prUrl === keptUrl) continue;
-      const number = prNumberFromUrl(prUrl);
+    for (const { url, lineage } of openDrafts) {
+      if (!converged && (lineage === null || keptByLineage.get(lineage) === url)) continue;
+      const number = prNumberFromUrl(url);
+      const keptInLineage = lineage === null ? null : prNumberFromUrl(keptByLineage.get(lineage)!);
       const comment = converged
         ? `하니스 종결 트리아지: 이 런이 수렴해 대체됨 — 착지 ${landed}`
-        : `하니스 종결 트리아지: 최신 산출 #${kept ?? 'unknown'} 로 대체됨`;
+        : `하니스 종결 트리아지: 최신 산출 #${keptInLineage ?? 'unknown'} 로 대체됨`;
       let ok = false;
-      try { ok = closeDraft(prUrl, comment); } catch { ok = false; }
+      try { ok = closeDraft(url, comment); } catch { ok = false; }
       if (number === null) continue;
       if (ok) closed.push(number);
       else closeFailed.push(number);
     }
-    if (keptUrl !== undefined) {
+    for (const { url, lineage } of keptDrafts) {
+      const keptLineage = [...keptByLineage.keys()].find((other) => other !== lineage);
+      if (lineage !== null && keptLineage !== undefined) {
+        try { debug.log('self-dev.triage', 'kept-distinct-piece', { pr: prNumberFromUrl(url), lineage, keptLineage }); } catch { /* fail-open */ }
+      }
       const rounds = Math.max(1, executedRounds);
-      const handoff = closeFailed.length === 0
-        ? '이 draft 가 이 골의 유일한 사람 판단 대상'
-        : `닫지 못한 draft 도 남아 있다: ${closeFailed.map((n) => `#${n}`).join(' ')}`;
+      const handoff = closeFailed.length > 0
+        ? `닫지 못한 draft 도 남아 있다: ${closeFailed.map((n) => `#${n}`).join(' ')}`
+        : lineage === null ? '브랜치 계보 미확인 — 사람 판단 대상'
+          : keptDrafts.length === 1 ? '이 draft 가 이 골의 유일한 사람 판단 대상'
+            : '이 draft 가 이 계보의 사람 판단 대상';
       const comment = `하니스 종결 트리아지: 멈춘 사유 ${supervisorStopReason ?? 'unsupervised'} · 라운드 ${rounds} · 착지한 조각 PR ${landed} · ${handoff}`;
-      try { commentDraft(keptUrl, comment); } catch { /* fail-open */ }
+      try { commentDraft(url, comment); } catch { /* fail-open */ }
     }
     draftTriage = { closed, kept, closeFailed, skippedNotDraft };
   };