elanous 0.2.4 → 0.2.6

package/scripts/lib/tui-sim-keys.ts

@@ -0,0 +1,42 @@
+// Named tui-sim keys and raw PTY input bytes.
+const KEYS: Record<string, string> = {
+  enter: '\r', return: '\r', tab: '\t', 'shift-tab': '\x1b[Z', esc: '\x1b', escape: '\x1b',
+  space: ' ', backspace: '\x7f', delete: '\x1b[3~',
+  up: '\x1b[A', down: '\x1b[B', right: '\x1b[C', left: '\x1b[D',
+  pageup: '\x1b[5~', pagedown: '\x1b[6~', home: '\x1b[H', end: '\x1b[F',
+  'shift-enter': '\x1b[13;2u',
+};
+
+export function resolveKeyBytes(name: string): string | null {
+  const key = name.toLowerCase();
+  if (Object.hasOwn(KEYS, key)) return KEYS[key]!;
+  if (/^ctrl-[a-z]$/.test(key)) return String.fromCharCode(key.charCodeAt(5) - 96);
+  if (key === 'ctrl-\\') return '\x1c';
+  if (key === 'ctrl-]') return '\x1d';
+  if (key.startsWith('hex:')) {
+    const hex = key.slice(4);
+    return hex.length > 0 && hex.length % 2 === 0 && /^[0-9a-f]+$/.test(hex)
+      ? Buffer.from(hex, 'hex').toString('latin1')
+      : null;
+  }
+  if (key.startsWith('alt-')) {
+    const suffix = name.slice(4);
+    const bytes = Object.hasOwn(KEYS, suffix.toLowerCase()) ? KEYS[suffix.toLowerCase()]!
+      : suffix.toLowerCase().startsWith('ctrl-') ? resolveKeyBytes(suffix)
+      : [...suffix].length === 1 ? suffix : null;
+    return bytes === null ? null : `\x1b${bytes}`;
+  }
+  return null;
+}
+
+/** Keep raw hex as a Buffer: passing a latin1 string to the PTY would UTF-8 encode bytes >= 0x80. */
+export function resolveKeyInput(name: string): string | Buffer | null {
+  const bytes = resolveKeyBytes(name);
+  if (bytes === null) return null;
+  return name.toLowerCase().startsWith('hex:') ? Buffer.from(name.slice(4), 'hex') : bytes;
+}
+
+/** Bun's native PTY passes Buffer bytes through unchanged; its typed registry API only declares strings. */
+export function writeKeyInput(handle: { write(chars: string): void }, input: string | Buffer): void {
+  handle.write(input as string);
+}

package/scripts/measure-front-route-classifier.ts

@@ -0,0 +1,56 @@
+import { readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import type { ResolveRoleProviderFn } from '../src/intake-plane/runtime-callables.js';
+import type { LLMProvider } from '../src/llm.js';
+import { formatFrontRouteReport, loadFrontRouteCorpus, measureFrontRoute } from './lib/front-route-measurement.js';
+
+interface RunnerOptions { providers: string[]; runs: number; json: boolean }
+
+export function parseFrontRouteArgs(args: readonly string[]): RunnerOptions {
+  const options: RunnerOptions = { providers: [], runs: 1, json: false };
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (arg === '--json') options.json = true;
+    else if (arg === '--provider') {
+      const value = args[++i];
+      if (!value || value.startsWith('--') || !/^[\w-]+(?:\/\S+)?$/.test(value)) throw new Error('--provider requires <name>[/<model>]');
+      options.providers.push(value);
+    } else if (arg === '--runs') {
+      const value = args[++i];
+      if (!value || !/^[1-9]\d*$/.test(value) || !Number.isSafeInteger(Number(value))) throw new Error('--runs requires a positive integer');
+      options.runs = Number(value);
+    } else throw new Error(`Unknown option: ${arg}`);
+  }
+  return options;
+}
+
+export function frontRouteProviders(specs: readonly string[], registry: Record<string, LLMProvider>): { label: string; resolve: ResolveRoleProviderFn }[] {
+  return specs.map((label) => {
+    const slash = label.indexOf('/');
+    const name = slash < 0 ? label : label.slice(0, slash);
+    const model = slash < 0 ? undefined : label.slice(slash + 1);
+    const provider = registry[name];
+    if (!provider) throw new Error(`Unknown provider: ${name}`);
+    const selectedModel = model ?? provider.defaultModel;
+    const resolveRole: ResolveRoleProviderFn = (_role) => ({ provider: provider as unknown as ReturnType<ResolveRoleProviderFn>['provider'], ...(typeof selectedModel === 'string' ? { model: selectedModel } : {}) });
+    return { label, resolve: resolveRole };
+  });
+}
+
+export async function main(args: readonly string[] = process.argv.slice(2), env: NodeJS.ProcessEnv = process.env): Promise<void> {
+  const options = parseFrontRouteArgs(args);
+  if (!env.CORPUS_PATH?.trim()) throw new Error('CORPUS_PATH is required (path to front-route corpus JSON)');
+  const corpus = loadFrontRouteCorpus(readFileSync(resolve(process.cwd(), env.CORPUS_PATH), 'utf8'));
+  const { PROVIDERS } = await import('../src/llm.js');
+  let selected = options.providers;
+  if (!selected.length) {
+    const { resolveRoleLlm } = await import('../src/user-config.js');
+    const { provider, model } = resolveRoleLlm('classify');
+    selected = [model ? `${provider}/${model}` : provider];
+  }
+  const providers = frontRouteProviders(selected, PROVIDERS);
+  const result = await measureFrontRoute(corpus.items, { providers, runs: options.runs });
+  console.log(options.json ? JSON.stringify(result, null, 2) : formatFrontRouteReport(result));
+}
+
+if (import.meta.main) await main();

package/scripts/media/ocr-leak-scan.sh

@@ -0,0 +1,21 @@
+#!/bin/zsh
+# 공개 영상 누출 관문 — 1초 한 장(또는 --fps N) 전수 OCR → 금지 목록 → 초 단위 표(hits.tsv).
+# 사용: scripts/media/ocr-leak-scan.sh <영상> <산출 폴더> [--fps N]
+# 한계: tesseract eng — 한글 칸·이모지는 사람 눈으로 따로 본다(내부 문서 `TC` §2). 걸림은 오독이 많다 → 그 초 프레임을 눈으로 대조한다.
+V=$1; O=$2; FPS=1
+[ "${3:-}" = "--fps" ] && FPS=${4:-1}
+[ -f "$V" ] && [ -n "$O" ] || { echo "사용: $0 <영상> <산출 폴더> [--fps N]" >&2; exit 2; }
+command -v tesseract >/dev/null && command -v ffmpeg >/dev/null || { echo "tesseract·ffmpeg 가 필요하다" >&2; exit 2; }
+mkdir -p "$O/f" && ffmpeg -loglevel error -i "$V" -vf "fps=$FPS" "$O/f/%05d.png" || exit 2
+# 금지: 홈 경로 · 실명 계정 표지 · 사설 호스트 · tailnet · 금액 · 크레딧 수 · 메일 · 키·토큰 모양(elanous 단기 토큰 elt_ · bearer · GitHub 토큰 · 40자+ 연속)
+PAT='/Users/|msb[0-9]|\bmbp\b|tail[0-9a-f]{4,}|ts\.net|\$[0-9]|USD|credit[s]? *[0-9]|@gmail|api[_-]?key|sk-[A-Za-z0-9]{8}|elt_[A-Za-z0-9_-]{6}|bearer|ghs_|gh[po]_|[A-Za-z0-9_-]{40,}'
+[ -n "${OCR_EXTRA_PATTERN:-}" ] && PAT="$PAT|$OCR_EXTRA_PATTERN"   # 계정 실명 등은 저장소에 적지 않고 환경변수로 준다
+: > "$O/hits.tsv"
+for f in "$O"/f/*.png; do
+  n=${${f:t:r}#0*}; s=$(( (n - 1) / FPS ))
+  t=$(tesseract "$f" - -l eng --psm 11 2>/dev/null)
+  print -r -- "$t" > "$O/f/${f:t:r}.txt"
+  print -r -- "$t" | grep -inE "$PAT" | grep -vE '^[0-9]+:[^ ]*run-[0-9a-f]{8}-[0-9a-f-]{27}$' \
+    | while read -r line; do print -r -- "$s\t$line" >> "$O/hits.tsv"; done
+done
+print "frames=$(ls "$O"/f/*.png | wc -l | tr -d ' ') hits=$(wc -l < "$O/hits.tsv" | tr -d ' ')"

package/scripts/public-export.ts

@@ -23,6 +23,7 @@ import { userInfo } from 'node:os';
 import { dirname, join, posix, resolve } from 'node:path';
 import ts from 'typescript';
 import { parse } from 'yaml';
+import { spawnSyncText } from '../src/util/spawn-sync-output.js';
 
 export interface ExportTransform {
   readonly id: string;
@@ -369,9 +370,7 @@ export function summarizeLeaks(hits: readonly LeakHit[]): Record<string, { hits:
 }
 
 function trackedFiles(root: string): string[] {
-  const listed = spawnSync('git', ['-C', root, 'ls-files', '-z'], { encoding: 'utf8' });
-  if (listed.status !== 0) throw new Error(`git ls-files failed: ${listed.stderr.trim()}`);
-  return listed.stdout.split('\0').filter(Boolean);
+  return spawnSyncText('git', ['-C', root, 'ls-files', '-z']).split('\0').filter(Boolean);
 }
 
 export function run(argv: readonly string[], root = resolve(import.meta.dir, '..')): number {

package/scripts/public-import-pr.ts

@@ -1,10 +1,12 @@
 #!/usr/bin/env bun
-/** Import a public PR patch without fetching, committing, or publishing it. */
+/** Import a public PR patch without committing or publishing it. */
 import { spawnSync } from 'node:child_process';
 import { existsSync, lstatSync, mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync, unlinkSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { dirname, isAbsolute, join } from 'node:path';
 import { loadExportConfig, selectExportFiles, transformExportFiles } from './public-export.js';
+import { debug } from '../src/debug/log.js';
+import { spawnSyncText } from '../src/util/spawn-sync-output.js';
 
 export type ImportKind = 'clean' | 'renamed' | 'transformed' | 'outside-export';
 export interface ImportFile { publicPath: string; sourcePath?: string; kind: ImportKind; reason?: string }
@@ -83,9 +85,7 @@ function gitApply(root: string, patch: string, check = false): string | undefine
 }
 
 function trackedFiles(root: string): string[] {
-  const result = spawnSync('git', ['ls-files', '-z'], { cwd: root, encoding: 'utf8' });
-  if (result.status !== 0) throw new Error(`git ls-files failed: ${result.stderr}`);
-  return result.stdout.split('\0').filter(Boolean);
+  return spawnSyncText('git', ['ls-files', '-z'], { cwd: root, encoding: 'utf8' }).split('\0').filter(Boolean);
 }
 
 /** Classify against the real export, stage eligible edits, then write only on --apply. */
@@ -177,8 +177,82 @@ export function importPublicPatch(patch: string, root: string, apply = false, au
   } finally { rmSync(staging, { recursive: true, force: true }); }
 }
 
-/** CLI entrypoint: bun scripts/public-import-pr.ts [patch-file] --author 'Name <email>' [--apply]. */
-export function run(argv: readonly string[], root = process.cwd(), stdin?: string): number {
+interface GhResult { status: number | null; stdout: string; stderr?: string }
+interface RunDeps { gh?: (argv: readonly string[], root: string) => GhResult }
+
+function prAuthors(raw: string, databaseIdForLogin: (login: string) => number): string[] {
+  const parsed: unknown = JSON.parse(raw);
+  if (!parsed || typeof parsed !== 'object' || !('commits' in parsed) || !Array.isArray(parsed.commits) || !parsed.commits.length) {
+    throw new Error('PR has no commits');
+  }
+  const unique = new Map<string, string>();
+  const seenEmails = new Set<string>();
+  for (const commit of parsed.commits) {
+    const identities = commit?.authors ?? (commit?.author ? [commit.author] : []);
+    if (!Array.isArray(identities) || !identities.length) throw new Error('PR commit has no author');
+    for (const identity of identities) {
+      const name = identity?.name?.trim();
+      const email = identity?.email?.trim();
+      const login = identity?.login?.trim() ?? identity?.user?.login?.trim();
+      const key = login ? `login:${login.toLowerCase()}` : `email:${email?.toLowerCase()}`;
+      if (unique.has(key) || (email && seenEmails.has(email.toLowerCase()))) continue;
+      const id = identity?.user?.databaseId ?? identity?.id;
+      const numericId = /^[1-9]\d*$/.test(String(id)) ? Number(id) : undefined;
+      const address = email || (login && /^[A-Za-z0-9-]+$/.test(login)
+        ? `${numericId && Number.isSafeInteger(numericId) ? numericId : databaseIdForLogin(login)}+${login}@users.noreply.github.com`
+        : undefined);
+      if (typeof name !== 'string' || !/^[^<>\r\n]+$/.test(name) || !address || !/^[^<>\s@]+@[^<>\s@]+$/.test(address)) {
+        throw new Error('PR commit author lacks a valid name or email/identity');
+      }
+      unique.set(key, `${name} <${address}>`);
+      seenEmails.add(address.toLowerCase());
+    }
+  }
+  return [...unique.values()];
+}
+
+/** CLI entrypoint: patch + --author, or --pr <number> --repo <owner/name>. */
+export function run(argv: readonly string[], root = process.cwd(), stdin?: string, deps: RunDeps = {}): number {
+  const prMode = argv.includes('--pr') || argv.includes('--repo');
+  if (prMode) {
+    const prIndex = argv.indexOf('--pr');
+    const repoIndex = argv.indexOf('--repo');
+    const pr = argv[prIndex + 1];
+    const repo = argv[repoIndex + 1];
+    const flags = argv.filter((arg) => arg === '--apply' || arg === '--dry-run');
+    if (prIndex < 0 || repoIndex < 0 || !pr || !/^[1-9]\d*$/.test(pr) || !repo ||
+        !/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(repo) ||
+        argv.length !== 4 + flags.length || flags.length > 1 ||
+        argv.some((arg, i) => (arg === '--pr' && i !== prIndex) || (arg === '--repo' && i !== repoIndex))) {
+      console.error('usage: bun scripts/public-import-pr.ts --pr <number> --repo <owner/name> [--dry-run|--apply]');
+      return 2;
+    }
+    try {
+      const gh = deps.gh ?? ((args: readonly string[], cwd: string) => spawnSync('gh', [...args], { cwd, encoding: 'utf8' }));
+      const fetch = (args: string[]): string => {
+        const result = gh(args, root);
+        if (result.status !== 0) throw new Error(result.stderr || `gh ${args[1]} failed`);
+        return result.stdout;
+      };
+      const patch = fetch(['pr', 'diff', pr, '--repo', repo]);
+      const authors = prAuthors(fetch(['pr', 'view', pr, '--repo', repo, '--json', 'commits']), (login) => {
+        const user: unknown = JSON.parse(fetch(['api', `users/${login}`]));
+        const id = user && typeof user === 'object' && 'id' in user ? user.id : undefined;
+        const resolvedLogin = user && typeof user === 'object' && 'login' in user ? user.login : undefined;
+        if (typeof id !== 'number' || !Number.isSafeInteger(id) || id <= 0 ||
+            typeof resolvedLogin !== 'string' || resolvedLogin.toLowerCase() !== login.toLowerCase()) {
+          throw new Error('GitHub user lacks a matching login or numeric database ID');
+        }
+        return id;
+      });
+      const result = importPublicPatch(patch, root, flags.includes('--apply'));
+      debug.log('public-import.pr', 'fetched', { repo, pr: Number(pr), files: result.files.length, authors: authors.length });
+      for (const file of result.files) console.log(`${file.kind}\t${file.publicPath}\t${file.sourcePath ?? '-'}${file.reason ? `\t${file.reason}` : ''}`);
+      console.log(`\nCommit message draft (not committed):\nImport public PR ${repo}#${pr}\n\nhttps://github.com/${repo}/pull/${pr}\n\n${authors.map((author) => `Co-Authored-By: ${author}`).join('\n')}`);
+      if (result.rc) console.error('import incomplete: one or more files were not applied');
+      return result.rc;
+    } catch (error) { console.error(`import failed: ${String(error)}`); return 1; }
+  }
   const apply = argv.includes('--apply');
   const authorIndex = argv.indexOf('--author');
   const author = authorIndex >= 0 ? argv[authorIndex + 1] : undefined;

package/scripts/publish-internal-dist.ts

@@ -3,6 +3,7 @@ import { createHash } from 'node:crypto';
 import { spawnSync } from 'node:child_process';
 import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, renameSync, rmSync, statSync, symlinkSync, writeFileSync } from 'node:fs';
 import { join, resolve } from 'node:path';
+import { spawnSyncText } from '../src/util/spawn-sync-output.js';
 
 export function publishInternalDist(checkout: string, out: string, keep = 3): { ok: true; version: string; commit: string; sha256: string; out: string; pwaBuild: 'present' | 'missing' } {
   checkout = resolve(checkout);
@@ -42,9 +43,7 @@ export function publishInternalDist(checkout: string, out: string, keep = 3): {
     const isBuildOutput = (path: string): boolean => path.startsWith('apps/pwa/out/') || path === 'src/version/packed-revision.json';
     const publishedPaths = [...new Set([...packedPaths, 'scripts/install.sh'])].filter((path) => !isBuildOutput(path));
     const pwaBuild: 'present' | 'missing' = packedPaths.includes('apps/pwa/out/index.html') ? 'present' : 'missing';
-    const tracked = spawnSync('git', ['ls-files', '--cached', '-z'], { cwd: checkout, encoding: 'utf8' });
-    if (tracked.status !== 0) throw new Error(`cannot list committed files: ${tracked.stderr}`);
-    const committed = new Set(tracked.stdout.split('\0').filter(Boolean));
+    const committed = new Set(spawnSyncText('git', ['ls-files', '--cached', '-z'], { cwd: checkout, encoding: 'utf8' }).split('\0').filter(Boolean));
     const uncommitted = publishedPaths.filter((path) => !committed.has(path));
     if (uncommitted.length) throw new Error(`packed files not committed at HEAD: ${uncommitted.join(', ')}`);
     const changed = spawnSync('git', ['diff', '--quiet', 'HEAD', '--', ...publishedPaths], { cwd: checkout, encoding: 'utf8' });

package/scripts/red-sweep-diff.ts

@@ -71,7 +71,7 @@ export async function main(argv: readonly string[]): Promise<number> {
   const grown = diffs.filter((d) => d.newRed.length > 0);
   if (argv.includes('--notify') && grown.length > 0) {
     const { sendOutbound } = await import('../src/domains/outbound-alert.js');
-    sendOutbound(`⚠️ **파일별 빨강 스윕 — 새 빨강**\n\n${grown.map(renderDiff).join('\n\n')}`, 'alert');
+    sendOutbound(`⚠️ **파일별 빨강 스윕 — 새 빨강**\n\n${grown.map(renderDiff).join('\n\n')}`, 'ops-alert');
   }
   return diffs.length === 0 ? 2 : 0;
 }

package/scripts/release-loop/auto-approve-node.ts

@@ -0,0 +1,72 @@
+#!/usr/bin/env bun
+import { mkdirSync, readFileSync, readdirSync, writeFileSync } from 'node:fs';
+import { dirname, isAbsolute, join, resolve } from 'node:path';
+import { debug } from '../../src/debug/log.js';
+import { effectiveInstanceRoot } from '../../src/instance/resolve.js';
+import { emitNodeResult, readGraphContext, type GraphContext } from './node-verdict.js';
+
+export type MetricVerdict = 'pass' | 'fail' | 'unmeasured';
+export interface ApprovalMetric { name: string; value: string; verdict: MetricVerdict }
+
+const outcomeMetric = (name: string, node: Record<string, unknown> | undefined): ApprovalMetric => ({
+  name, value: node?.outcome === undefined ? 'missing' : String(node.outcome),
+  verdict: node?.outcome === undefined ? 'unmeasured' : node.outcome === 'ok' ? 'pass' : 'fail',
+});
+
+export function runAutoApprove(context: GraphContext = readGraphContext(), deps: { instanceRoot?: string; repo?: string; bunVersion?: string } = {}) {
+  const { version } = context.input;
+  const root = deps.instanceRoot ?? effectiveInstanceRoot();
+  const repo = deps.repo ?? resolve(import.meta.dir, '../..');
+  const gate = context.outputs.gate;
+  const prepare = context.outputs.prepare;
+  let pinned: string | undefined;
+  try { pinned = readFileSync(join(repo, '.bun-version'), 'utf8').trim(); } catch { pinned = undefined; }
+  const bunVersion = deps.bunVersion ?? Bun.version;
+  const out = prepare?.out;
+  let distCount: number | undefined;
+  if (prepare?.outcome === 'ok' && typeof out === 'string' && isAbsolute(out)
+    && resolve(out) === join(root, 'release', version, 'prepared')) {
+    try { distCount = readdirSync(join(out, 'dist'), { withFileTypes: true }).filter((entry) => entry.isFile()).length; }
+    catch { distCount = undefined; }
+  }
+  const gateErrorAbsent = gate && !Object.hasOwn(gate, 'error');
+  const metrics: ApprovalMetric[] = [
+    { name: 'gate regressions and measurement', value: JSON.stringify({ outcome: gate?.outcome ?? null, introduced: gate?.introduced ?? null, error: gate?.error ?? null }),
+      verdict: !gate || gate.outcome === undefined || !Array.isArray(gate.introduced) ? 'unmeasured'
+        : gate.outcome === 'ok' && gate.introduced.length === 0 && gateErrorAbsent ? 'pass' : 'fail' },
+    { name: 'bun version', value: `running=${bunVersion}; pinned=${pinned ?? 'missing'}`,
+      verdict: !pinned ? 'unmeasured' : bunVersion === pinned ? 'pass' : 'fail' },
+    outcomeMetric('upgrade', context.outputs.upgrade),
+    outcomeMetric('tui', context.outputs.tui),
+    outcomeMetric('notes-check', context.outputs['notes-check']),
+    { name: 'public leak and prepare completeness', value: `prepare=${prepare?.outcome ?? 'missing'}`,
+      verdict: prepare?.outcome === undefined ? 'unmeasured' : prepare.outcome === 'ok' ? 'pass' : 'fail' },
+    { name: 'docs notes page', value: `docs=${context.outputs.docs?.outcome ?? 'missing'}; notes=${String(context.outputs.docs?.notes ?? 'missing')}`,
+      verdict: context.outputs.docs?.outcome === undefined || context.outputs.docs.notes === undefined ? 'unmeasured'
+        : context.outputs.docs.outcome === 'ok' && typeof context.outputs.docs.notes === 'string' && context.outputs.docs.notes.trim() ? 'pass' : 'fail' },
+    { name: 'installation files', value: `dist files=${distCount ?? 'missing'}; prepare.out=${String(out ?? 'missing')}`,
+      verdict: prepare?.outcome !== 'ok' ? prepare?.outcome === undefined ? 'unmeasured' : 'fail'
+        : distCount === undefined ? 'unmeasured' : distCount === 5 ? 'pass' : 'fail' },
+  ];
+  const outcome = metrics.every((metric) => metric.verdict === 'pass') ? 'ok' as const : 'fail' as const;
+  const report = join(root, 'release', version, 'auto-approval.md');
+  const lines = [`# v${version} auto-approval`, '', `Outcome: ${outcome}`, '', '| # | Metric | Value | Verdict |', '|---|---|---|---|',
+    ...metrics.map((metric, i) => `| ${i + 1} | ${metric.name} | ${metric.value.replaceAll('|', '\\|').replace(/[\r\n]/g, ' ')} | ${metric.verdict} |`),
+    '', '## 되돌리는 법', `gh release edit v${version} --draft`, `git tag -d v${version} && git push origin :refs/tags/v${version}`, '해당 docs PR revert', ''];
+  mkdirSync(dirname(report), { recursive: true });
+  writeFileSync(report, lines.join('\n'));
+  debug.log('release-loop.approve', 'auto-decision', { version, outcome, metrics });
+  return { outcome, verdict: outcome === 'ok' ? 'pass' as const : 'fail' as const, summary: `auto approval ${outcome}: ${metrics.filter((metric) => metric.verdict === 'pass').length}/8`,
+    ...(outcome === 'ok' ? { decidedBy: 'release-loop metrics' as const } : {}), metrics, report };
+}
+
+if (import.meta.main) {
+  try {
+    const result = runAutoApprove();
+    emitNodeResult(result);
+    process.exitCode = result.outcome === 'ok' ? 0 : 1;
+  } catch (error) {
+    emitNodeResult({ outcome: 'fail', verdict: 'fail', summary: `auto approval unmeasured: ${error instanceof Error ? error.message : String(error)}` });
+    process.exitCode = 1;
+  }
+}

package/scripts/release-loop/checklist-gate-node.ts

@@ -0,0 +1,35 @@
+#!/usr/bin/env bun
+import { addItem, checklistGate, listChecklist, summarizeChecklist } from '../../src/release-loop/checklist.js';
+import { emitNodeResult, errorResult, readGraphContext, type GraphContext } from './node-verdict.js';
+
+export function runChecklistGate(context: GraphContext = readGraphContext()) {
+  const version = context.input.version;
+  const data = listChecklist(version);
+  const gate = checklistGate(version);
+  const counts = summarizeChecklist(data);
+  const summary = `확인표 🟢${counts.green} 🟡${counts.yellow}(이동 ${gate.moved.length} · 알려진 문제 ${gate.knownIssues.length} · 막음 ${gate.blocked.length} · 판정 없음 ${gate.undecided.length}) 🔴${counts.red}${gate.red.length ? ` (${gate.red.join(', ')})` : ''}`;
+  if (gate.ok && gate.moved.length) {
+    const [major, minor, patch] = version.split('.').map(Number);
+    const next = `${major}.${minor}.${patch! + 1}`;
+    for (const id of gate.moved) {
+      const item = data.items.find((candidate) => candidate.id === id)!;
+      if (listChecklist(next).items.some((candidate) => candidate.id === id)) continue;
+      try { addItem(next, { id, title: item.title, ...(item.owner !== undefined ? { owner: item.owner } : {}) }); }
+      catch (error) {
+        if (!listChecklist(next).items.some((candidate) => candidate.id === id)) throw error;
+      }
+    }
+  }
+  return { outcome: gate.ok ? 'ok' as const : 'fail' as const, verdict: gate.ok ? 'pass' as const : 'fail' as const, summary, ...gate };
+}
+
+if (import.meta.main) {
+  try {
+    const result = runChecklistGate();
+    emitNodeResult(result);
+    process.exitCode = result.outcome === 'ok' ? 0 : 1;
+  } catch (error) {
+    emitNodeResult(errorResult(error));
+    process.exitCode = 2;
+  }
+}

package/scripts/release-loop/gate-diff.ts

@@ -18,6 +18,35 @@ export function parseFailures(output: string): string[] {
   return [...failures].sort();
 }
 
+const xmlText = (value: string): string => value
+  .replace(/&quot;/g, '"').replace(/&apos;/g, "'").replace(/&lt;/g, '<').replace(/&gt;/g, '>')
+  .replace(/&#(\d+);/g, (_, code: string) => String.fromCodePoint(Number(code))).replace(/&amp;/g, '&');
+
+/** Failed test names from a bun junit report, in the same `<file> > <describe> > <name>` shape as {@link parseFailures}.
+ *  Used when the console summary counts a failure but prints no `(fail)` line for it (09-30 0.2.6 gate: `--dots`). */
+export function junitFailures(xml: string): string[] {
+  const failures = new Set<string>();
+  const suites: string[] = [];
+  let file: string | undefined;
+  let open: string | undefined;
+  for (const match of xml.matchAll(/<(\/?)(testsuite|testcase|failure)\b([^>]*?)(\/?)>/g)) {
+    const [, closing, tag, attrs, selfClosing] = match;
+    const attr = (name: string) => { const m = new RegExp(`\\b${name}="([^"]*)"`).exec(attrs!); return m ? xmlText(m[1]!) : undefined; };
+    if (tag === 'testsuite') {
+      if (closing) { suites.pop(); continue; }
+      suites.push(attr('name') ?? '');
+      if (suites.length === 1) file = attr('file') ?? attr('name');
+    } else if (tag === 'testcase') {
+      if (closing) { open = undefined; continue; }
+      const name = [...suites.slice(1), attr('name') ?? ''].join(' > ');
+      open = selfClosing ? undefined : `${attr('file') ?? file} > ${name}`;
+    } else if (tag === 'failure' && !closing && open) {
+      failures.add(open);
+    }
+  }
+  return [...failures].sort();
+}
+
 export function diffFailures(cut: Iterable<string>, baseline: Iterable<string>): FailureDiff {
   const c = new Set(cut);
   const b = new Set(baseline);