elanous 0.2.4 → 0.2.6

package/src/cli/mcp-gateway-cli.ts

@@ -6,6 +6,7 @@ import { getElanousConfigDir } from '../elanous-config-dir.js';
 import { effectiveInstanceRoot } from '../instance/resolve.js';
 import { issueMcpPat, listMcpPats, revokeMcpPat } from '../mcp-gateway/pat-store.js';
 import { startMcpGateway } from '../mcp-gateway/gateway.js';
+import { resolveDaemonEndpoint } from '../nexus/daemon-endpoint.js';
 
 function privateTokenFile(path: string): string {
   const fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW);
@@ -47,12 +48,15 @@ export function registerMcpGatewayCommands(mcp: Command): void {
     .description('Owner-PAT authenticated public MCP relay to the scoped NEXUS endpoint')
     .option('--host <host>', 'Bind host', '127.0.0.1')
     .option('--port <port>', 'Bind port', '31482')
-    .requiredOption('--nexus-url <url>', 'NEXUS base URL')
+    .option('--nexus-url <url>', 'NEXUS base URL. Default: the current daemon (elanous nexus show).')
     .option('--public-url <url>', 'Public HTTPS origin used in protected resource metadata')
     .option('--nexus-token-file <path>', 'Private file holding the mcp-public NEXUS token; use - for stdin')
-    .action(safeAction(async (opts: { host: string; port: string; nexusUrl: string; publicUrl?: string; nexusTokenFile?: string }) => {
+    .action(safeAction(async (opts: { host: string; port: string; nexusUrl?: string; publicUrl?: string; nexusTokenFile?: string }) => {
       const port = Number(opts.port);
       if (!Number.isSafeInteger(port) || port < 1 || port > 65535) throw new Error('invalid gateway port');
+      // 데몬 주소는 짐작하지 않는다 — 통합관제(daemon-endpoint)에 묻고, 모르면 멈춘다(대표 09-28).
+      const nexusUrl = opts.nexusUrl ?? resolveDaemonEndpoint()?.baseUrl;
+      if (!nexusUrl) throw new Error('daemon address unknown — pass --nexus-url or start the daemon (elanous nexus show)');
       if (!opts.publicUrl) throw new Error('--public-url <url> required for protected-resource metadata');
       if (!opts.nexusTokenFile) throw new Error('--nexus-token-file <path|-> required (no token argv)');
       if (opts.nexusTokenFile === '-' && process.stdin.isTTY) throw new Error('pipe the nexus token on stdin');
@@ -66,7 +70,7 @@ export function registerMcpGatewayCommands(mcp: Command): void {
         if (!stat.isFile() || (stat.mode & 0o077) !== 0) throw new Error('PAT store must be a private regular file (0600)');
       } finally { closeSync(fd); }
       listMcpPats(patRoot);
-      const server = startMcpGateway({ host: opts.host, port, nexusUrl: opts.nexusUrl, nexusToken, patRoot, publicUrl: opts.publicUrl });
+      const server = startMcpGateway({ host: opts.host, port, nexusUrl, nexusToken, patRoot, publicUrl: opts.publicUrl });
       process.stderr.write(`MCP gateway listening on ${server.hostname}:${server.port}\n`);
     }));
 

package/src/cli/nexus-ios-bind.ts

@@ -59,6 +59,9 @@ export interface IosBindOpts {
   readTokenFn?: () => string | null;
   /** Test seam — host fallback (production daily driver 의 default). */
   hostFallback?: string;
+  /** Test seam — `defaults write` 가 쓸 도메인. 기본은 설치된 앱 «컨테이너»의 plist 경로다.
+   *  `spawnSyncFn` 만 주입된 시험은 bundle id 그대로(실 `xcrun` 을 부르지 않는다). */
+  resolveDomainFn?: (bundleId: string) => string;
 }
 
 export interface IosBindResult {
@@ -90,6 +93,16 @@ function defaultReadToken(): string | null {
   }
 }
 
+/** 앱이 실제로 읽는 도메인 — 설치된 앱의 데이터 컨테이너 plist(확장자 없이).
+ *  ⚠️ `defaults write <bundleId>` 는 시뮬레이터 «전역» 도메인에 쓴다. 앱은 자기 컨테이너 plist 를 읽으므로,
+ *  앱이 한 번이라도 설정을 저장한 뒤로는 그 값이 이긴다(2026-09-30 실측: 연결 링크로 받은 만료 임시 토큰이
+ *  컨테이너에 남아 ios-bind 가 «✓» 를 찍고도 앱은 401 을 받았다). 컨테이너를 못 찾으면 bundle id 로 폴백한다. */
+function defaultResolveDomain(bundleId: string): string {
+  const r = defaultSpawnSync('xcrun', ['simctl', 'get_app_container', 'booted', bundleId, 'data'], { stdio: 'pipe' });
+  const dir = r.status === 0 ? String(r.stdout ?? '').trim() : '';
+  return dir ? join(dir, 'Library', 'Preferences', bundleId) : bundleId;
+}
+
 /** UserDefaults write 1 회. spawnSync exit code 0 = 성공. */
 function defaultsWrite(
   spawnFn: typeof defaultSpawnSync,
@@ -119,6 +132,8 @@ export function runNexusIosBind(opts: IosBindOpts = {}): IosBindResult {
   const readToken = opts.readTokenFn ?? defaultReadToken;
   const hostFallback = opts.hostFallback ?? DEFAULT_HOST_FALLBACK;
   const dryRun = opts.dryRun ?? false;
+  const resolveDomain = opts.resolveDomainFn
+    ?? (opts.spawnSyncFn || dryRun ? (id: string) => id : defaultResolveDomain);
 
   // 1) daemon 현재 host/port — override 가 우선 · 없으면 runtime sidecar ·
   //    port 가 없으면 현재 우주의 daemon endpoint 를 조회한다.
@@ -150,20 +165,22 @@ export function runNexusIosBind(opts: IosBindOpts = {}): IosBindResult {
   const tokenRaw = opts.noToken ? null : readToken();
   const token = tokenRaw ?? '';
 
-  // 3) UserDefaults write 3 회 (host · port · token)
+  // 3) UserDefaults write 3 회 (host · port · token) — 앱 컨테이너 도메인에
+  const domain = resolveDomain(bundleId);
   const lines: string[] = [];
-  const hostResult = defaultsWrite(spawnFn, bundleId, 'nexusHost', 'string', host, dryRun);
+  if (domain !== bundleId) lines.push(`  domain  앱 컨테이너 (${bundleId}) — 앱이 실행 중이면 끄고 다시 켜야 읽는다`);
+  const hostResult = defaultsWrite(spawnFn, domain, 'nexusHost', 'string', host, dryRun);
   lines.push(`  host  ${hostResult.ok ? '✓' : '✗'}  ${hostResult.cmd}`);
-  const portResult = defaultsWrite(spawnFn, bundleId, 'nexusPort', 'int', String(port), dryRun);
+  const portResult = defaultsWrite(spawnFn, domain, 'nexusPort', 'int', String(port), dryRun);
   lines.push(`  port  ${portResult.ok ? '✓' : '✗'}  ${portResult.cmd}`);
 
   let tokenInjected = false;
   let tokenLength = 0;
   if (!opts.noToken && token.length > 0) {
-    const tokenResult = defaultsWrite(spawnFn, bundleId, 'bearerToken', 'string', token, dryRun);
+    const tokenResult = defaultsWrite(spawnFn, domain, 'bearerToken', 'string', token, dryRun);
     tokenInjected = tokenResult.ok;
     tokenLength = token.length;
-    lines.push(`  token ${tokenResult.ok ? '✓' : '✗'}  xcrun simctl spawn booted defaults write ${bundleId} bearerToken <${tokenLength}-char redacted>`);
+    lines.push(`  token ${tokenResult.ok ? '✓' : '✗'}  xcrun simctl spawn booted defaults write ${domain} bearerToken <${tokenLength}-char redacted>`);
   } else if (opts.noToken) {
     lines.push(`  token —   (skipped · --no-token)`);
   } else {
@@ -173,19 +190,19 @@ export function runNexusIosBind(opts: IosBindOpts = {}): IosBindResult {
   let asciiKeyboardOk = true;
   if (opts.asciiKeyboard !== undefined) {
     const value = opts.asciiKeyboard ? 'true' : 'false';
-    const r = defaultsWrite(spawnFn, bundleId, 'asciiKeyboard', 'bool', value, dryRun);
+    const r = defaultsWrite(spawnFn, domain, 'asciiKeyboard', 'bool', value, dryRun);
     asciiKeyboardOk = r.ok;
     lines.push(`  ascii ${r.ok ? '✓' : '✗'}  ${r.cmd}`);
   }
 
   let seedPromptOk = true;
   if (opts.seedPrompt !== undefined) {
-    const r = defaultsWrite(spawnFn, bundleId, 'seedPrompt', 'string', opts.seedPrompt, dryRun);
+    const r = defaultsWrite(spawnFn, domain, 'seedPrompt', 'string', opts.seedPrompt, dryRun);
     seedPromptOk = r.ok;
     const preview = opts.seedPrompt.length > 24
       ? opts.seedPrompt.slice(0, 24) + '…'
       : opts.seedPrompt;
-    lines.push(`  seed  ${r.ok ? '✓' : '✗'}  xcrun simctl spawn booted defaults write ${bundleId} seedPrompt "${preview}" (${opts.seedPrompt.length} chars)`);
+    lines.push(`  seed  ${r.ok ? '✓' : '✗'}  xcrun simctl spawn booted defaults write ${domain} seedPrompt "${preview}" (${opts.seedPrompt.length} chars)`);
   }
 
   const allOk = hostResult.ok && portResult.ok

package/src/cli/phone-link.ts

@@ -0,0 +1,117 @@
+// `elanous phone link` — 휴대폰 앱을 이 Mac 의 넥서스에 «한 번에» 붙이는 연결 링크(⊕ 터미널 QR).
+// 대표 2026-09-30: 아이폰 첫 화면이 개발용 연결 카드라 복잡하다 → 앱은 링크 하나로 온보딩한다.
+// 링크 = `elanous://connect?host=…&port=…&tls=1|0&token=…` — 앱이 `.onOpenURL` 로 받아 저장하고 바로 연결한다.
+import { spawnSync } from 'node:child_process';
+import { debug } from '../debug/log.js';
+
+export interface PhoneEndpoint { host: string; port: number; tls: boolean }
+
+/** REST/PWA 기준 URL(예 `https://mbp.x.ts.net:31415/v1/`) → 앱이 쓰는 host·port·tls. 못 읽으면 null. */
+export function endpointFromBaseUrl(base: string): PhoneEndpoint | null {
+  let u: URL;
+  try { u = new URL(base); } catch { return null; }
+  if (u.protocol !== 'http:' && u.protocol !== 'https:') return null;
+  const tls = u.protocol === 'https:';
+  const port = u.port ? Number(u.port) : tls ? 443 : 80;
+  if (!u.hostname || !Number.isInteger(port) || port < 1 || port > 65_535) return null;
+  return { host: u.hostname, port, tls };
+}
+
+/** 앱이 여는 연결 링크. 토큰은 URL 인코딩한다. */
+export function buildPhoneConnectLink(ep: PhoneEndpoint, token: string): string {
+  const q = new URLSearchParams({ host: ep.host, port: String(ep.port), tls: ep.tls ? '1' : '0', token });
+  return `elanous://connect?${q.toString()}`;
+}
+
+/** 어느 주소를 휴대폰에 줄까 — 기본은 tailnet(휴대폰이 닿는다) · `local` 이면 루프백(같은 Mac 의 시뮬레이터). */
+export function pickPhoneBase(urls: { loopback: string; tailnet?: string }, opts: { local?: boolean } = {}): { base: string; kind: 'tailnet' | 'loopback' } {
+  if (!opts.local && urls.tailnet) return { base: urls.tailnet, kind: 'tailnet' };
+  return { base: urls.loopback, kind: 'loopback' };
+}
+
+/** USB 로 꽂힌 안드로이드에 링크를 «직접» 건넨다 — `adb reverse` 로 폰의 127.0.0.1:<port> 를 이 Mac 으로 잇고
+ *  `am start` 로 elanous://connect 를 연다. 토큰은 화면·로그에 찍지 않는다(adb 인자로만 간다). */
+export function androidDeliverySteps(link: string, port: number, serial?: string): string[][] {
+  const dev = serial ? ['-s', serial] : [];
+  return [
+    [...dev, 'reverse', `tcp:${port}`, `tcp:${port}`],
+    [...dev, 'shell', 'am', 'start', '-a', 'android.intent.action.VIEW', '-d', `'${link}'`, 'com.elanvitalai.elanous.android'],
+  ];
+}
+
+export interface RunPhoneLinkOpts {
+  local?: boolean;
+  /** USB 안드로이드에 adb 로 바로 건넨다(루프백 ⊕ adb reverse). 문자열이면 기기 serial. */
+  android?: boolean | string;
+  temp?: boolean;
+  ttl?: string;
+  qr?: boolean;
+  out?: { log: (s: string) => void; error: (s: string) => void };
+}
+
+export async function runPhoneLink(opts: RunPhoneLinkOpts = {}): Promise<number> {
+  const out = opts.out ?? { log: (s: string) => console.log(s), error: (s: string) => console.error(s) };
+  const { runNexusShow } = await import('./nexus-show.js');
+  const silent = { log: () => {}, error: () => {} };
+  const shown = await runNexusShow({ format: 'json', out: silent });
+  if (!shown.urls) {
+    out.error('✗ 넥서스가 떠 있지 않다 — 먼저 `elanous nexus run` (또는 `elanous nexus status` 로 확인).');
+    return 1;
+  }
+  const picked = pickPhoneBase(shown.urls.rest, { local: opts.local || !!opts.android });
+  const ep = endpointFromBaseUrl(picked.base);
+  if (!ep) { out.error(`✗ 넥서스 주소를 읽지 못했다: ${picked.base}`); return 1; }
+
+  let token: string;
+  let tokenNote: string;
+  if (opts.temp) {
+    const { issueTempToken, parseTtl } = await import('../auth/temp-tokens.js');
+    const issued = issueTempToken({ ttlMs: parseTtl(opts.ttl ?? '24h'), label: 'phone' });
+    token = issued.token;
+    tokenNote = `단기 토큰 · ${issued.expiresAt} 까지 · 폐기: elanous token revoke ${issued.id}`;
+  } else {
+    const { loadEnvelope } = await import('../auth/token-store.js');
+    const env = loadEnvelope();
+    if (!env?.active) { out.error('✗ 소유자 토큰이 없다 — `elanous token rotate` 로 한 번 만든 뒤 다시.'); return 1; }
+    token = env.active;
+    tokenNote = '소유자 토큰(설정의 Bearer 와 같다) · 바꾸려면 elanous token rotate';
+  }
+
+  const link = buildPhoneConnectLink(ep, token);
+  try { debug.log('phone.link', 'issued', { kind: picked.kind, tls: ep.tls, temp: !!opts.temp }); } catch { /* 관측 실패가 발급을 막지 않는다 */ }
+
+  if (opts.android) {
+    const serial = typeof opts.android === 'string' ? opts.android : undefined;
+    const lanEp = { ...ep, host: '127.0.0.1', tls: false };
+    const androidLink = buildPhoneConnectLink(lanEp, token);
+    for (const args of androidDeliverySteps(androidLink, lanEp.port, serial)) {
+      const r = spawnSync('adb', args, { encoding: 'utf8' });
+      if (r.status !== 0) {
+        // ⛔ 인자에 토큰이 있으므로 명령을 그대로 찍지 않는다 — 단계 이름과 adb 의 말만.
+        const why = (r.error?.message ?? r.stderr ?? '').trim().split('\n')[0] ?? '';
+        out.error(`✗ adb ${args.includes('reverse') ? 'reverse' : 'am start'} 실패 — ${why || `exit ${r.status}`}`);
+        out.error('  USB 디버깅 허용 · `adb devices` 에 기기가 «device» 로 보이는지 · 기기가 여럿이면 --android <serial>.');
+        return 1;
+      }
+    }
+    try { debug.log('phone.link', 'android-delivered', { port: lanEp.port, serial: !!serial, temp: !!opts.temp }); } catch { /* 관측 실패가 연결을 막지 않는다 */ }
+    out.log(`✓ 안드로이드 앱에 연결 링크를 건넸다 — 폰에서 앱이 열리고 바로 붙는다 (127.0.0.1:${lanEp.port} ⇄ 이 Mac · adb reverse).`);
+    out.error('⚠ USB 를 뽑으면 끊긴다. 계속 쓰려면 폰의 Tailscale 을 켜고 `elanous phone link` 의 QR 을 찍는다.');
+    out.error(`토큰: ${tokenNote}`);
+    return 0;
+  }
+
+  out.log('휴대폰에서 이 링크를 열면 앱이 바로 연결된다 (카메라로 QR · AirDrop · 메모 붙여넣기):');
+  out.log('');
+  out.log(link);
+  out.log('');
+  if (opts.qr !== false) {
+    const qr = spawnSync('qrencode', ['-t', 'ANSIUTF8', link], { encoding: 'utf8' });
+    if (qr.status === 0 && qr.stdout) out.log(qr.stdout);
+  }
+  out.error(`주소: ${ep.tls ? 'https' : 'http'}://${ep.host}:${ep.port} (${picked.kind === 'tailnet' ? 'tailnet — 휴대폰이 같은 tailnet 에 있어야 한다' : '루프백 — 이 Mac 의 시뮬레이터 전용'})`);
+  if (picked.kind === 'loopback' && !opts.local) out.error('⚠ tailnet 주소가 없다 — 실제 휴대폰에서는 닿지 않는다. `elanous nexus show` 로 tailnet 을 확인하라.');
+  out.error(`토큰: ${tokenNote}`);
+  out.error('⚠ 이 링크는 이 Mac 을 조작할 수 있는 토큰을 담는다 — 남에게 보내거나 공개 캡처에 싣지 않는다.');
+  return 0;
+}

package/src/cli/plugin-cli.ts

@@ -5,10 +5,13 @@ import { join } from 'node:path';
 import { existsSync, readFileSync } from 'node:fs';
 import { elanousStateRoot } from '../autopilot/state-paths.js';
 import { userConfigPath } from '../user-config.js';
-import { debug } from '../debug/log.js';
+import { debug, redactSecretText } from '../debug/log.js';
+import { addMarket, listMarkets, MarketFetchError, updateMarket } from '../plugins/install/market-fetch.js';
 import { emitDecision } from '../live/detail-switch.js';
 import { OFFICIAL_INDEX_KEYS } from '../market/official-keys.js';
 import { installPlugin, listInstalledPlugins, PluginInstallError, removePlugin, type InstallEvent } from '../plugins/install/plugin-install.js';
+import { credentialStatus, setPluginCredentials } from '../plugins/install/plugin-credentials.js';
+import { makePlugin } from '../plugins/maker/plugin-maker.js';
 
 function keys(): ReadonlyArray<{ keyId: string; publicKey: string }> {
   const configPath = userConfigPath();
@@ -32,43 +35,125 @@ async function askConsent(capabilities: string[], json: boolean): Promise<boolea
   }
 }
 
-function outputEvent(event: InstallEvent, json: boolean): void {
+function outputEvent(event: InstallEvent, json: boolean, nodeCount: { value: number }): void {
   // Connector field names are useful; values and secret-field metadata are not needed here.
   const safe = event.event === 'credentials'
     ? { event: 'credentials', connectors: event.connectors.map(({ id, fields }) => ({ id, fields: fields.map(({ name }) => name) })) }
     : event;
   debug.log('plugin.cli', event.event, { event: event.event });
+  if (event.event === 'registered') nodeCount.value = event.nodes.length;
   if (json) stdout.write(JSON.stringify(safe) + '\n');
   else if (event.event === 'credentials') {
     if (event.connectors.length) console.log(`Connectors: ${event.connectors.map(connector => connector.id).join(', ')} — configure via elanous connector settings (no secrets requested here)`);
-  } else if (event.event === 'done') console.log(`Installed ${event.plugin}@${event.version}`);
+  } else if (event.event === 'done') console.log(`Installed ${event.plugin}@${event.version} (${nodeCount.value} nodes)`);
   else if (event.event === 'consent' && event.required) console.log(`Permissions: ${event.capabilities.join(', ')}`);
 }
 
+/** Only our own install/market errors carry a cause (fixed wording that may name the user's own spec); URLs and secrets are masked; any other error stays generic. */
+function safeCause(error: unknown): string {
+  if (!(error instanceof PluginInstallError || error instanceof MarketFetchError)) return 'unexpected error';
+  return redactSecretText(error.message.replace(/https?:\/\/[^\s"'<>]+/gi, '[redacted URL]'));
+}
+
 export function registerPluginCommands(program: Command): void {
   const plugin = program.command('plugin').description('Install and manage Elanous plugins');
+  plugin.command('make <request>').description('Write, validate and install a local graph plugin from one request')
+    .option('--name <slug>', 'Local plugin name')
+    .option('--dir <parent>', 'Parent directory (default: instance plugins-local)')
+    .option('--run', 'Run the installed graph')
+    .option('--input <json>', 'JSON input for --run')
+    .option('--json', 'Print the result as JSON')
+    .action(async (request: string, opts: { name?: string; dir?: string; run?: boolean; input?: string; json?: boolean }) => {
+      try {
+        const result = await makePlugin({ request, name: opts.name, parentDir: opts.dir, run: opts.run,
+          ...(opts.input === undefined ? {} : { input: JSON.parse(opts.input) as unknown }) });
+        if (opts.json) stdout.write(JSON.stringify(result) + '\n');
+        else {
+          console.log(`뼈대 ${result.timings.scaffold}ms · 작성 ${result.timings.write}ms`);
+          console.log(`검증 오류 ${result.errors.length} · ${result.timings.validate}ms${result.timings.repair === undefined ? '' : ` · 수리 ${result.timings.repair}ms`}`);
+          console.log(`설치 ${result.timings.install === 0 && result.status === 'failed' ? '미실행' : result.status === 'failed' && result.timings.run === undefined ? '실패' : '완료'} · ${result.timings.install}ms (${result.dir})`);
+          if (opts.run) console.log(`실행 ${result.runStatus ?? '미실행'} · ${result.timings.run ?? 0}ms`);
+          for (const error of result.errors) console.error(error);
+        }
+        if (result.status === 'failed') process.exitCode = 1;
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        if (opts.json) stdout.write(JSON.stringify({ status: 'failed', errors: [message] }) + '\n');
+        else console.error(`plugin make failed: ${message}`);
+        process.exitCode = 1;
+      }
+    });
   plugin.command('add <spec>').description('Install a local path, pinned git plugin or signed market plugin')
     .option('--yes', 'Accept requested capabilities')
     .option('--json', 'NDJSON progress events')
     .option('--allow-unsigned', 'Allow unsigned marketplace indices')
-    .action(async (spec: string, opts: { yes?: boolean; json?: boolean; allowUnsigned?: boolean }) => {
+    .option('--refresh', 'Refresh the signed marketplace index before installing')
+    .action(async (spec: string, opts: { yes?: boolean; json?: boolean; allowUnsigned?: boolean; refresh?: boolean }) => {
       try {
         const root = elanousStateRoot();
+        const nodeCount = { value: 0 };
         await installPlugin(spec, {
           root, marketDir: join(root, 'plugins', 'markets'), trustedKeys: keys(),
-          yes: opts.yes, allowUnsigned: opts.allowUnsigned,
-          onEvent: event => outputEvent(event, !!opts.json),
+          yes: opts.yes, allowUnsigned: opts.allowUnsigned, refresh: opts.refresh,
+          onEvent: event => outputEvent(event, !!opts.json, nodeCount),
           consent: capabilities => askConsent(capabilities, !!opts.json),
         });
         emitDecision({ kind: 'ROUTE', what: 'plugin add', reason: 'plugin installed', purpose: 'make plugin available', target: 'plugin host' });
       } catch (error) {
         const reason = error instanceof PluginInstallError ? error.reason : 'io';
-        // Installer errors may embed an arbitrary source path or git URL; never echo them or config secrets.
         const detail = reason === 'consent-denied' ? 'plugin capabilities require consent' : `plugin installation ${reason} error`;
-        debug.log('plugin.cli', 'failed', { reason }, { level: 'error' });
+        const cause = safeCause(error);
+        debug.log('plugin.cli', 'failed', { reason, cause }, { level: 'error' });
         emitDecision({ kind: 'ESCALATE', what: 'plugin add', reason, purpose: 'report installation failure', target: 'user' });
-        if (opts.json) stdout.write(JSON.stringify({ event: 'failed', reason, detail }) + '\n');
-        else console.error(`plugin add failed: ${detail}`);
+        if (opts.json) stdout.write(JSON.stringify({ event: 'failed', reason, detail, ...(reason === 'consent-denied' ? {} : { cause }) }) + '\n');
+        else console.error(`plugin add failed: ${detail}${reason === 'consent-denied' ? '' : `: ${cause}`}`);
+        process.exitCode = 1;
+      }
+    });
+  const market = plugin.command('market').description('Manage signed plugin marketplaces');
+  market.command('add <name> <url>').description('Register a marketplace URL')
+    .action((name: string, url: string) => {
+      try {
+        const added = addMarket(name, url);
+        debug.log('plugin.cli', 'market.add', { name: added.name });
+        console.log(`Added market ${added.name} (${added.url})`);
+      } catch (error) {
+        console.error(`plugin market add failed: ${safeCause(error)}`);
+        process.exitCode = 1;
+      }
+    });
+  market.command('list').description('List configured marketplaces').option('--json', 'JSON array')
+    .action((opts: { json?: boolean }) => {
+      try {
+        const markets = listMarkets();
+        debug.log('plugin.cli', 'market.list', { count: markets.length });
+        if (opts.json) stdout.write(JSON.stringify(markets) + '\n');
+        else for (const entry of markets) console.log(`${entry.name} (${entry.url})`);
+      } catch (error) {
+        if (opts.json) stdout.write(JSON.stringify({ event: 'failed', cause: safeCause(error) }) + '\n');
+        else console.error(`plugin market list failed: ${safeCause(error)}`);
+        process.exitCode = 1;
+      }
+    });
+  market.command('update [name]').description('Refresh signed marketplace indices')
+    .action(async (name?: string) => {
+      try {
+        const markets = listMarkets();
+        const selected = name ? markets.filter(entry => entry.name === name) : markets;
+        if (!selected.length) throw new Error('market not configured');
+        const root = elanousStateRoot();
+        for (const entry of selected) {
+          try {
+            const result = await updateMarket(entry.name, { root, marketDir: join(root, 'plugins', 'markets') });
+            debug.log('plugin.cli', 'market.update', { name: result.market.name, sequence: result.index.sequence });
+            console.log(`Updated market ${result.market.name} (sequence ${result.index.sequence})`);
+          } catch (error) {
+            console.error(`plugin market update ${entry.name} failed: ${safeCause(error)}`);
+            process.exitCode = 1;
+          }
+        }
+      } catch (error) {
+        console.error(`plugin market update failed: ${safeCause(error)}`);
         process.exitCode = 1;
       }
     });
@@ -83,12 +168,52 @@ export function registerPluginCommands(program: Command): void {
         const installed = listInstalledPlugins(root).filter(item => registered.has(`${item.market}/${item.name}/${item.version}`));
         debug.log('plugin.cli', 'list', { count: installed.length });
         if (opts.json) stdout.write(JSON.stringify(installed) + '\n');
-        else for (const item of installed) console.log(`${item.name}@${item.version} (${item.market})`);
+        else for (const item of installed) console.log(`${item.name}@${item.version} (${item.market})${item.installedAt ? ` — installed ${item.installedAt}` : ''}`);
       } catch {
         console.error('plugin list failed: invalid plugin ledger');
         process.exitCode = 1;
       }
     });
+  plugin.command('credentials <plugin>').description('Show or update installed plugin credential status')
+    .option('--set <NAME=VALUE>', 'Set a declared field', (value: string, values: string[]) => [...values, value], [] as string[])
+    .option('--unset <NAME>', 'Remove a declared field', (value: string, values: string[]) => [...values, value], [] as string[])
+    .option('--stdin <NAME>', 'Read one credential value from standard input')
+    .option('--json', 'JSON status')
+    .action(async (name: string, opts: { set: string[]; unset: string[]; stdin?: string; json?: boolean }) => {
+      try {
+        const root = elanousStateRoot();
+        const fields: Record<string, string | null> = Object.create(null);
+        for (const assignment of opts.set) {
+          const equal = assignment.indexOf('=');
+          if (equal < 1) throw new Error('invalid credential assignment');
+          fields[assignment.slice(0, equal)] = assignment.slice(equal + 1);
+        }
+        for (const field of opts.unset) fields[field] = null;
+        if (opts.stdin !== undefined) {
+          let input = '';
+          for await (const chunk of stdin) {
+            input += chunk.toString();
+            if (input.includes('\n')) break;
+          }
+          if (!input) throw new Error('credential stdin is empty');
+          fields[opts.stdin] = input.split(/\r?\n/, 1)[0]!;
+        }
+        if (Object.keys(fields).length > 0) {
+          setPluginCredentials(name, fields, root);
+          debug.log('plugin.credentials', 'set', { plugin: name, fields: Object.keys(fields), count: Object.keys(fields).length });
+        }
+        const status = credentialStatus(name, root);
+        if (opts.json) stdout.write(JSON.stringify(status) + '\n');
+        else for (const field of status.fields) console.log(`${field.name}\t${field.env}\t${field.set ? 'set' : 'unset'}`);
+        // The web app's PUT reloads MCP clients itself; a CLI write reaches an already-running daemon only after a reload.
+        // stderr in both modes, so `--json` stdout stays one JSON line.
+        if (Object.keys(fields).length > 0) console.error('A running daemon applies this to plugin MCP servers after `elanous mcp reload` (the web app does it for you).');
+      } catch {
+        if (opts.json) stdout.write(JSON.stringify({ error: 'plugin credentials failed' }) + '\n');
+        else console.error('plugin credentials failed');
+        process.exitCode = 1;
+      }
+    });
   plugin.command('remove <name>').description('Remove installed plugin versions')
     .action((name: string) => {
       try {

package/src/cli/pr-lineage.ts

@@ -1,5 +1,6 @@
 const SELF_IMPL_PREFIX = 'self-impl/';
 const LINEAGE_HASH_SUFFIX = /-[0-9a-f]{7,8}$/i;
+const RUN_SUFFIX = /-r[a-z0-9]{6}$/i;
 /**
  * Formal new-generation segment after `self-impl/`: dash-delimited `-goalid-<id>-`.
  * ⛔ A substring like `mygoalid-foo` is not that segment — it has no leading `-`/`^` boundary.
@@ -9,7 +10,7 @@ const GOAL_ID_SEGMENT = /(?:^|-)goalid-([^/-]+)-/;
 /** Lineage slug of a harness branch: `self-impl/<slug>-<7–8 hex>`, or null when the name is not that shape. */
 export function branchLineageSlug(branch: string): string | null {
   if (!branch.startsWith(SELF_IMPL_PREFIX)) return null;
-  const rest = branch.slice(SELF_IMPL_PREFIX.length);
+  const rest = branch.slice(SELF_IMPL_PREFIX.length).replace(RUN_SUFFIX, '');
   const hash = LINEAGE_HASH_SUFFIX.exec(rest);
   return hash ? rest.slice(0, rest.length - hash[0].length) : rest;
 }

package/src/cli/private-ledger-commands.ts

@@ -0,0 +1,31 @@
+import { existsSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { Command } from 'commander';
+
+// Private local ledgers (decisions · directives) are absent from the public export;
+// JS-only distributions still register them. Kept out of src/index.ts so the `self`
+// block stays free of direct sink registration (see self-cli-sink-surface.test.ts).
+export function registerPrivateLedgerCommands(program: Command): void {
+  if (existsSync(resolve(import.meta.dir, 'decisions-cli.ts')) || existsSync(resolve(import.meta.dir, 'decisions-cli.js'))) {
+    program.command('decisions').description('대표 결정 로컬 원장').allowUnknownOption().allowExcessArguments(true)
+      .action(async (_opts: unknown, command: Command) => {
+        try { await (await import('../domains/standalone-log-sink.js')).registerStandaloneLogSink('decisions'); }
+        catch { /* Logging must not prevent recording a decision. */ }
+        const privateDecisionsModule: string = './decisions-cli.js';
+        const { registerDecisionsCommands } = await import(privateDecisionsModule) as { registerDecisionsCommands: (program: Command) => void };
+        const privateProgram = new Command();
+        registerDecisionsCommands(privateProgram);
+        await privateProgram.parseAsync(['decisions', ...command.args], { from: 'user' });
+      });
+  }
+  if (existsSync(resolve(import.meta.dir, 'directives-cli.ts')) || existsSync(resolve(import.meta.dir, 'directives-cli.js'))) {
+    program.command('directives').description('대표 지시 로컬 색인·검색').allowUnknownOption().allowExcessArguments(true)
+      .action(async (_opts: unknown, command: Command) => {
+        const privateDirectivesModule: string = './directives-cli.js';
+        const { registerDirectivesCommands } = await import(privateDirectivesModule) as { registerDirectivesCommands: (program: Command) => void };
+        const privateProgram = new Command();
+        registerDirectivesCommands(privateProgram);
+        await privateProgram.parseAsync(['directives', ...command.args], { from: 'user' });
+      });
+  }
+}

package/src/cli/pwa-start.ts

@@ -126,6 +126,8 @@ export interface PwaStartOpts {
    *  MCP-client boot is skipped (PR1 2026-05-13). Default undefined =
    *  leave the decision to the daemon-side `mcp.enabled` config. */
   mcpEnabled?: boolean;
+  /** Forward an explicit --no-auth opt-out to the detached Nexus child. */
+  noAuth?: boolean;
   out?: { log: (s: string) => void; error: (s: string) => void };
   // ─── Test seams ─────────────────────────────────────────────
   bgLaunchFn?: (opts: {
@@ -237,6 +239,7 @@ function collectForwardArgs(opts: PwaStartOpts, httpPort: number): string[] {
   // those gates only matter on the parent (build runs before fork).
   if (opts.watch && (opts.mode ?? 'static') === 'static') args.push('--watch');
   if (opts.mcpEnabled === false) args.push('--no-mcp');
+  if (opts.noAuth === true) args.push('--no-auth');
   return args;
 }