elanous 0.2.4 → 0.2.6

package/src/execution-loop/gate-decision-summary.ts

@@ -0,0 +1,29 @@
+import { redactSecrets } from '../task-cards/card-store.js';
+import type { BudgetDecision } from '../self-implement/budget-gate.js';
+import type { GateResult, MemoryDecision, PlacementDecision, RelationDecision } from './gates.js';
+
+export type GateName = 'budget' | 'placement' | 'relation' | 'memory';
+
+/** Only decision metadata belongs in the live log; full results remain in the card. */
+export function summarizeGateDecision(gate: GateName, result: GateResult<unknown>): string {
+  const { decision } = result;
+  let summary: string;
+  if (typeof decision === 'string') {
+    summary = gate === 'memory' ? 'unavailable' : `unavailable · explanation=${redactSecrets(result.explanation).slice(0, 80)}`;
+  } else if (gate === 'budget') {
+    const budget = decision as BudgetDecision;
+    summary = `action=${budget.action}${budget.provider ? ` · provider=${budget.provider}` : ''} · reason=${redactSecrets(budget.reasons[0] ?? '').slice(0, 80)}`;
+  } else if (gate === 'placement') {
+    const placement = decision as PlacementDecision;
+    summary = `substrate=${placement.substrate} · pool=${placement.pool ?? 'none'}${placement.memory ? ` · memory=${placement.memory.limit}` : ''} · unknown=${placement.unknownInputs.join(',')}`;
+  } else if (gate === 'relation') {
+    const relation = decision as RelationDecision;
+    const unknown = (['preflightOverlaps', 'dependsOn', 'similarCards', 'sameGoalActiveRuns'] as const)
+      .filter((key) => relation[key] === 'unknown');
+    summary = `overlap=${relation.overlappingCards.length} · unknown=${unknown.join(',')}`;
+  } else {
+    const memory = decision as MemoryDecision;
+    summary = `context=${memory.context ? 'recalled' : 'none'} · fragments=${memory.fragmentIds.length}`;
+  }
+  return redactSecrets(summary).slice(0, 250);
+}

package/src/execution-loop/gates.ts

@@ -0,0 +1,197 @@
+import type { TaskCard } from '../task-cards/card-store.js';
+import { decideBudget, readBudgetInputsLive, type BudgetDecision, type BudgetInputs } from '../self-implement/budget-gate.js';
+import { resolveHarnessSubstrate, type ResolvedHarnessSubstrate } from '../harness/harness-substrate-default.js';
+import { podMemoryLimitFor } from '../task-orchestrator/surfaces/self-implement-pod.js';
+import { recallMemoryContext } from '../agent-substrate/execution/memory-context.js';
+
+export interface GateResult<T> {
+  decision: T;
+  explanation: string;
+}
+
+export interface BudgetGateDeps {
+  readInputs: () => Promise<BudgetInputs>;
+  decide: (inputs: BudgetInputs) => BudgetDecision;
+}
+
+/** Observe the existing quota decision; callers record it, not apply it to the launch. */
+export async function budgetGate(
+  deps: BudgetGateDeps = { readInputs: readBudgetInputsLive, decide: decideBudget },
+): Promise<GateResult<BudgetDecision>> {
+  const decision = deps.decide(await deps.readInputs());
+  return { decision, explanation: decision.reasons.join(' · ') || `budget: ${decision.action}` };
+}
+
+export interface PlacementGateInput {
+  goal: string;
+  /** A local-only capability or file is an observation, not a reason to probe a remote pool. */
+  needsBrowser?: boolean;
+  needsVideo?: boolean;
+  needsAppSigning?: boolean;
+  localFiles?: readonly string[];
+  flag?: { substrate?: 'pod' | 'local'; podPool?: string };
+}
+
+export interface PlacementGateDeps {
+  resolveSubstrate: (input: { flag?: { substrate?: 'pod' | 'local'; podPool?: string } }) => ResolvedHarnessSubstrate;
+  memoryLimit: (goal: string) => { limit: string; tier: string; source: string };
+}
+
+export type PlacementDecision = (ResolvedHarnessSubstrate | {
+  substrate: 'unknown';
+  pool: null;
+  source: 'unknown';
+}) & {
+  /** Reachability is deliberately not probed by this observational gate. */
+  poolReachability: 'unknown' | 'not-applicable';
+  memory?: { limit: string; tier: string; source: string };
+  localReasons: string[];
+  /** Omitted observations must not be silently treated as negative evidence. */
+  unknownInputs: string[];
+};
+
+const defaultPlacementDeps: PlacementGateDeps = {
+  resolveSubstrate: ({ flag }) => resolveHarnessSubstrate({ flag, env: process.env, currentContext: () => undefined }),
+  memoryLimit: (goal) => podMemoryLimitFor(goal, process.env),
+};
+
+export function placementGate(
+  input: PlacementGateInput,
+  deps: PlacementGateDeps = defaultPlacementDeps,
+): GateResult<PlacementDecision> {
+  const unknownInputs = [
+    ...(input.needsBrowser === undefined ? ['needsBrowser'] : []),
+    ...(input.needsVideo === undefined ? ['needsVideo'] : []),
+    ...(input.needsAppSigning === undefined ? ['needsAppSigning'] : []),
+    ...(input.localFiles === undefined ? ['localFiles'] : []),
+    ...(input.flag?.substrate === undefined ? ['substrate'] : []),
+  ];
+  const localReasons = [
+    ...(input.needsBrowser ? ['browser'] : []),
+    ...(input.needsVideo ? ['video'] : []),
+    ...(input.needsAppSigning ? ['app signing'] : []),
+    ...(input.localFiles?.length ? [`local files: ${input.localFiles.join(', ')}`] : []),
+  ];
+  // A measured local-only need wins; otherwise unknown needs cannot justify a remote assertion.
+  if (!localReasons.length && input.flag?.substrate !== 'local' && unknownInputs.length) {
+    return {
+      decision: { substrate: 'unknown', pool: null, source: 'unknown', poolReachability: 'unknown', localReasons, unknownInputs },
+      explanation: `placement=unknown; unmeasured=${unknownInputs.join(', ')}; pool reachability not checked`,
+    };
+  }
+  const flag = localReasons.length ? { substrate: 'local' as const } : input.flag;
+  let resolved: ResolvedHarnessSubstrate;
+  try {
+    resolved = deps.resolveSubstrate({ flag });
+  } catch (error) {
+    if (flag?.substrate !== 'pod' || !(error instanceof Error) || !error.message.includes('Pod 풀 또는 현재 컨텍스트에 닿지 못했다')) throw error;
+    // No configured pool is not evidence that a remote pool is unreachable.
+    resolved = { substrate: 'pod', pool: null, source: 'flag' };
+  }
+  const poolReachability = resolved.substrate === 'pod' ? 'unknown' : 'not-applicable';
+  const memory = resolved.substrate === 'pod' ? deps.memoryLimit(input.goal) : undefined;
+  const decision: PlacementDecision = {
+    ...resolved, poolReachability, localReasons, unknownInputs,
+    ...(memory ? { memory } : {}),
+  };
+  return {
+    decision,
+    explanation: (resolved.substrate === 'local'
+      ? `local: ${localReasons.join(' · ') || `substrate ${resolved.source}`}`
+      : `pod: pool=${resolved.pool ?? 'unknown'}; reachability=unknown (not checked); memory=${memory?.tier ?? 'unknown'} (${memory?.limit ?? 'unknown'})`)
+      + (unknownInputs.length ? `; unmeasured=${unknownInputs.join(', ')}` : ''),
+  };
+}
+
+export interface RelationGateDeps {
+  openCards: () => Promise<readonly TaskCard[]> | readonly TaskCard[];
+  /** A previous completed run is reported as a fact, never inferred from a matching title. */
+  priorTermination: (goalId: string) => Promise<string | undefined> | string | undefined;
+  /** 'unknown' = the caller cannot observe running runs; recorded as unknown, never as none. */
+  activeRuns: (goalId: string) => Promise<readonly string[] | 'unknown'> | readonly string[] | 'unknown';
+  /** Optional preflight overlap observations are kept separate from open-card overlap. */
+  preflightOverlaps?: (paths: readonly string[]) => Promise<readonly string[]> | readonly string[];
+  dependsOn?: (goalId: string) => Promise<readonly string[]> | readonly string[];
+  similarCards?: (card: TaskCard, openCards: readonly TaskCard[]) => Promise<readonly string[]> | readonly string[];
+}
+
+export interface RelationDecision {
+  overlappingCards: string[];
+  preflightOverlaps: string[] | 'unknown';
+  dependsOn: string[] | 'unknown';
+  similarCards: string[] | 'unknown';
+  sameGoalActiveRuns: string[] | 'unknown';
+  priorTermination?: string;
+  /** Overlaps and similarity are observations, not dispatch locks. */
+  action: 'record';
+}
+
+export async function relationGate(
+  card: TaskCard,
+  targetPaths: readonly string[],
+  deps: RelationGateDeps,
+): Promise<GateResult<RelationDecision>> {
+  const [cards, priorTermination, sameGoalActiveRuns] = await Promise.all([
+    deps.openCards(), deps.priorTermination(card.goalId), deps.activeRuns(card.goalId),
+  ]);
+  const [preflightOverlaps, dependsOn, similarCards] = await Promise.all([
+    deps.preflightOverlaps?.(targetPaths) ?? 'unknown',
+    deps.dependsOn?.(card.goalId) ?? 'unknown',
+    deps.similarCards?.(card, cards) ?? 'unknown',
+  ]);
+  const target = new Set(targetPaths);
+  const overlappingCards = cards
+    .filter((other) => other.id !== card.id && other.status === 'open' && other.sections.some((section) => {
+      if (!section.key.startsWith('workspace')) return false;
+      try {
+        const workspace = JSON.parse(section.content) as { targetPaths?: unknown; paths?: unknown };
+        const paths = workspace.targetPaths ?? workspace.paths;
+        return Array.isArray(paths) && paths.some((path) => typeof path === 'string' && target.has(path));
+      } catch { return false; }
+    }))
+    .map((other) => other.id);
+  const observed = (value: readonly string[] | string): string =>
+    typeof value === 'string' ? value : value.join(',') || 'none';
+  const decision: RelationDecision = {
+    action: 'record', overlappingCards,
+    preflightOverlaps: preflightOverlaps === 'unknown' ? 'unknown' : [...preflightOverlaps],
+    dependsOn: dependsOn === 'unknown' ? 'unknown' : [...dependsOn],
+    similarCards: similarCards === 'unknown' ? 'unknown' : [...similarCards],
+    sameGoalActiveRuns: sameGoalActiveRuns === 'unknown' ? 'unknown' : [...sameGoalActiveRuns],
+    ...(priorTermination === undefined ? {} : { priorTermination }),
+  };
+  return {
+    decision,
+    explanation: `overlap=${observed(overlappingCards)}; preflight=${observed(preflightOverlaps)}; dependsOn=${observed(dependsOn)}; similar=${observed(similarCards)}; active=${observed(sameGoalActiveRuns)}; prior=${priorTermination ?? 'unknown'}; overlaps do not block launch`,
+  };
+}
+
+export interface MemoryGateDeps {
+  recall: (query: string) => Promise<string>;
+  priorAbandonment: (goalId: string) => Promise<string | undefined> | string | undefined;
+}
+
+export interface MemoryDecision {
+  context: string;
+  priorAbandonment?: string;
+  /** The existing recall API returns formatted context, not stable fragment IDs. */
+  fragmentIds: string[];
+  action: 'record';
+}
+
+export async function memoryGate(
+  card: Pick<TaskCard, 'goalId' | 'title'>,
+  deps: MemoryGateDeps = { recall: recallMemoryContext, priorAbandonment: () => undefined },
+): Promise<GateResult<MemoryDecision>> {
+  const [context, priorAbandonment] = await Promise.all([
+    deps.recall(card.title), deps.priorAbandonment(card.goalId),
+  ]);
+  const decision: MemoryDecision = {
+    action: 'record', context, fragmentIds: [],
+    ...(priorAbandonment === undefined ? {} : { priorAbandonment }),
+  };
+  return {
+    decision,
+    explanation: `memory=${context ? 'recalled' : 'none or unavailable'}; prior abandonment=${priorAbandonment ?? 'unknown'}; fragment IDs unavailable from recall API`,
+  };
+}

package/src/field/field-media.ts

@@ -0,0 +1,245 @@
+// 현장(field) 업로드 폴더 계약 — HTTP 입구(`/v1/field/uploads`)와 텔레그램 `#현장` 이 «같은» 저장 함수를 쓴다.
+//
+// 폴더 계약(2026-09-30 합의 · 소비자 = reel 파이프라인):
+//   <configDir>/field/<event>/<ISO 기본형 타임스탬프>-<device>-<원래 이름>
+//   타임스탬프 = 클라이언트가 준 촬영 시각(있으면) · 없으면 업로드 시각 · UTC · `20261015T193012Z`(ISO 8601 기본형 —
+//   파일 이름에 콜론을 넣지 않으려고 기본형을 쓴다. 사전순 = 시간순).
+//   배치가 끝나면 `<folder>/.ready` 를 한 줄(= 폴더의 미디어 파일 수)로 덮어쓴다.
+
+import { appendFileSync, mkdirSync, readdirSync, renameSync, statSync, unlinkSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { randomUUID } from 'node:crypto';
+
+export const FIELD_SLUG_RE = /^[a-z0-9][a-z0-9._-]{0,63}$/;
+export const FIELD_MAX_FILE_BYTES = 100 * 1024 * 1024; // 폰 현장 사진·짧은 영상 — 데몬 전역 요청 한도를 과하게 올리지 않으려고 낮게(2026-09-30)
+export const FIELD_MAX_REQUEST_BYTES = 250 * 1024 * 1024;
+export const FIELD_READY_FILE = '.ready';
+const MAX_ORIGINAL_NAME = 80;
+
+/** 허용 MIME → 대표 확장자. heif 는 heic 의 별칭으로 받는다. */
+const MIME_EXT: Record<string, string> = {
+  'image/jpeg': 'jpg',
+  'image/jpg': 'jpg',
+  'image/png': 'png',
+  'image/heic': 'heic',
+  'image/heif': 'heic',
+  'image/webp': 'webp',
+  'video/mp4': 'mp4',
+  'video/quicktime': 'mov',
+};
+const EXT_MIME: Record<string, string> = {
+  jpg: 'image/jpeg', jpeg: 'image/jpeg', png: 'image/png', heic: 'image/heic', heif: 'image/heif',
+  webp: 'image/webp', mp4: 'video/mp4', mov: 'video/quicktime',
+};
+
+export type FieldUploadErrorCode = 'bad-slug' | 'unsupported-media-type' | 'too-large' | 'no-files' | 'bad-request';
+
+export class FieldUploadError extends Error {
+  constructor(readonly code: FieldUploadErrorCode, message: string) {
+    super(message);
+    this.name = 'FieldUploadError';
+  }
+  get status(): number {
+    if (this.code === 'unsupported-media-type') return 415;
+    if (this.code === 'too-large') return 413;
+    return 400;
+  }
+}
+
+export interface FieldMediaInput {
+  originalName: string;
+  mimeType?: string;
+  bytes: Uint8Array;
+  /** 촬영 시각(ISO 문자열·epoch ms). 못 읽으면 업로드 시각. */
+  capturedAt?: string | number | Date;
+}
+
+export interface FieldSaveOptions {
+  /** config 뿌리(`~/.elanous` 또는 격리 뿌리). 폴더 = `<rootDir>/field/<event>`. */
+  rootDir: string;
+  event: string;
+  device: string;
+  now?: () => Date;
+  /** 사람이 쓴 한 줄(텔레그램 캡션·앱 입력칸) — 있으면 `captions.txt` 에 «<첫 파일 이름> | <글>» 로 덧붙인다(reel 자막 · MK 2026-09-30). */
+  caption?: string;
+}
+
+export interface FieldSaveResult {
+  event: string;
+  dir: string;
+  saved: Array<{ name: string; bytes: number }>;
+  /** 저장 «후» 폴더의 미디어 파일 수(= `.ready` 에 쓴 값). */
+  count: number;
+}
+
+export function isFieldSlug(value: unknown): value is string {
+  return typeof value === 'string' && FIELD_SLUG_RE.test(value);
+}
+
+export function fieldEventDir(rootDir: string, event: string): string {
+  if (!isFieldSlug(event)) throw new FieldUploadError('bad-slug', 'event slug must match ^[a-z0-9][a-z0-9._-]{0,63}$');
+  return join(rootDir, 'field', event);
+}
+
+function extOf(name: string): string {
+  const dot = name.lastIndexOf('.');
+  return dot > 0 ? name.slice(dot + 1).toLowerCase() : '';
+}
+
+/** 허용 MIME 이면 정규화한 MIME, 아니면 null. MIME 이 비었거나 octet-stream 이면 확장자로 추정한다. */
+export function resolveFieldMime(mimeType: string | undefined, originalName: string): string | null {
+  const mime = (mimeType ?? '').split(';')[0]!.trim().toLowerCase();
+  if (mime && mime !== 'application/octet-stream') return MIME_EXT[mime] ? mime : null;
+  return EXT_MIME[extOf(originalName)] ?? null;
+}
+
+/** basename · `[A-Za-z0-9._-]` 외는 `_` · 앞 점 제거 · 최대 80자(확장자 보존) · 확장자가 MIME 과 안 맞으면 붙인다. */
+export function sanitizeFieldName(originalName: string, mime?: string): string {
+  const base = originalName.split(/[\\/]/).pop() ?? '';
+  let name = base.replace(/[^A-Za-z0-9._-]/g, '_').replace(/_+/g, '_').replace(/^\.+/, '');
+  const wantExt = mime ? MIME_EXT[mime] : undefined;
+  const ext = extOf(name);
+  if (wantExt && EXT_MIME[ext] === undefined) name = name ? `${name}.${wantExt}` : `media.${wantExt}`;
+  if (!name) name = 'media';
+  if (name.length > MAX_ORIGINAL_NAME) {
+    const e = extOf(name);
+    const suffix = e && e.length < 10 ? `.${e}` : '';
+    name = name.slice(0, MAX_ORIGINAL_NAME - suffix.length) + suffix;
+  }
+  return name;
+}
+
+/** `20261015T193012Z` — ISO 8601 기본형 UTC(초 단위). */
+export function fieldTimestamp(capturedAt: FieldMediaInput['capturedAt'], now: Date): string {
+  let at: Date | null = null;
+  if (capturedAt instanceof Date) at = capturedAt;
+  else if (typeof capturedAt === 'number') at = new Date(capturedAt);
+  else if (typeof capturedAt === 'string' && capturedAt.trim()) {
+    const trimmed = capturedAt.trim();
+    at = /^\d{10,13}$/.test(trimmed) ? new Date(Number(trimmed) * (trimmed.length === 10 ? 1000 : 1)) : new Date(trimmed);
+  }
+  if (!at || Number.isNaN(at.getTime())) at = now;
+  return at.toISOString().replace(/\.\d{3}Z$/, 'Z').replace(/[-:]/g, '');
+}
+
+function isMediaFile(name: string): boolean {
+  return !name.startsWith('.') && EXT_MIME[extOf(name)] !== undefined;
+}
+
+export function listFieldMedia(dir: string): Array<{ name: string; bytes: number }> {
+  let names: string[];
+  try { names = readdirSync(dir); }
+  catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return [];
+    throw error;
+  }
+  const out: Array<{ name: string; bytes: number }> = [];
+  for (const name of names.sort()) {
+    if (!isMediaFile(name)) continue;
+    try {
+      const st = statSync(join(dir, name));
+      if (st.isFile()) out.push({ name, bytes: st.size });
+    } catch { /* 사이에 지워졌다 */ }
+  }
+  return out;
+}
+
+function atomicWrite(dir: string, name: string, bytes: Uint8Array | string): void {
+  const tmp = join(dir, `.tmp-${randomUUID()}`);
+  try {
+    writeFileSync(tmp, bytes);
+    renameSync(tmp, join(dir, name));
+  } catch (error) {
+    try { unlinkSync(tmp); } catch { /* 없음 */ }
+    throw error;
+  }
+}
+
+/** `.ready` 를 «지금» 폴더의 미디어 파일 수로 덮어쓴다. */
+export function refreshFieldReady(dir: string): number {
+  const count = listFieldMedia(dir).length;
+  atomicWrite(dir, FIELD_READY_FILE, `${count}\n`);
+  return count;
+}
+
+/** 검증(전부) → 쓰기(전부, 원자적) → `.ready` 갱신. 하나라도 검증에 걸리면 아무것도 안 쓴다. */
+export function saveFieldMedia(inputs: FieldMediaInput[], opts: FieldSaveOptions): FieldSaveResult {
+  const dir = fieldEventDir(opts.rootDir, opts.event);
+  if (!isFieldSlug(opts.device)) throw new FieldUploadError('bad-slug', 'device slug must match ^[a-z0-9][a-z0-9._-]{0,63}$');
+  if (inputs.length === 0) throw new FieldUploadError('no-files', 'at least one file is required');
+  const now = (opts.now ?? (() => new Date()))();
+  let total = 0;
+  const planned = inputs.map((input) => {
+    const mime = resolveFieldMime(input.mimeType, input.originalName);
+    if (!mime) throw new FieldUploadError('unsupported-media-type', 'only jpeg/png/heic/webp images and mp4/mov videos are accepted');
+    const size = input.bytes.byteLength;
+    if (size === 0) throw new FieldUploadError('bad-request', 'empty file');
+    if (size > FIELD_MAX_FILE_BYTES) throw new FieldUploadError('too-large', 'a file exceeds 100 MB');
+    total += size;
+    if (total > FIELD_MAX_REQUEST_BYTES) throw new FieldUploadError('too-large', 'the request exceeds 250 MB');
+    const name = `${fieldTimestamp(input.capturedAt, now)}-${opts.device}-${sanitizeFieldName(input.originalName, mime)}`;
+    return { name, bytes: input.bytes };
+  });
+
+  mkdirSync(dir, { recursive: true });
+  const taken = new Set<string>();
+  const saved: FieldSaveResult['saved'] = [];
+  for (const item of planned) {
+    const name = uniqueName(dir, item.name, item.bytes.byteLength, taken);
+    taken.add(name);
+    atomicWrite(dir, name, item.bytes);
+    saved.push({ name, bytes: item.bytes.byteLength });
+  }
+  const line = normalizeFieldCaption(opts.caption);
+  if (line && saved[0]) appendFileSync(join(dir, FIELD_CAPTIONS_FILE), `${saved[0].name} | ${line}\n`);
+  const count = refreshFieldReady(dir);
+  return { event: opts.event, dir, saved, count };
+}
+
+/** 같은 이름·같은 크기면 재전송으로 보고 덮는다(중복 방지). 크기가 다르면 `-1`,`-2`… 를 붙인다. */
+function uniqueName(dir: string, name: string, size: number, taken: Set<string>): string {
+  const dot = name.lastIndexOf('.');
+  const stem = dot > 0 ? name.slice(0, dot) : name;
+  const ext = dot > 0 ? name.slice(dot) : '';
+  for (let i = 0; ; i += 1) {
+    const candidate = i === 0 ? name : `${stem}-${i}${ext}`;
+    if (taken.has(candidate)) continue;
+    let existing: number | null = null;
+    try { existing = statSync(join(dir, candidate)).size; } catch { existing = null; }
+    if (existing === null || existing === size) return candidate;
+  }
+}
+
+// ── 텔레그램 캡션 문법 ──────────────────────────────────────────────
+
+export const FIELD_CAPTION_TAG = '#현장';
+
+/** 캡션에 독립 토큰 `#현장` 이 있으면 `{ event? }`, 없으면 null.
+ *  `#현장 <slug>` — 바로 다음 토큰을 소문자로 바꿔 슬러그 규칙에 맞으면 행사 이름, 아니면 기본 행사. */
+export function parseFieldCaption(caption: string | undefined | null): { event?: string; text?: string } | null {
+  if (!caption) return null;
+  const tokens = caption.trim().split(/\s+/);
+  const at = tokens.indexOf(FIELD_CAPTION_TAG);
+  if (at < 0) return null;
+  const next = tokens[at + 1]?.toLowerCase();
+  const hasEvent = !!next && isFieldSlug(next);
+  // 태그·행사 이름을 뺀 나머지가 «글»(자막) — 태그 앞에 쓴 글도 같이.
+  const rest = tokens.filter((_, i) => i !== at && !(hasEvent && i === at + 1)).join(' ');
+  const text = normalizeFieldCaption(rest);
+  return { ...(hasEvent ? { event: next } : {}), ...(text ? { text } : {}) };
+}
+
+export const FIELD_CAPTIONS_FILE = 'captions.txt';
+
+/** 자막 한 줄 — 줄바꿈은 공백으로, `|` 는 구분자라 전각 `｜` 로, 280자까지. 비면 빈 값. */
+export function normalizeFieldCaption(value: string | undefined | null): string {
+  if (typeof value !== 'string') return '';
+  return value.replace(/[\r\n]+/g, ' ').replace(/\|/g, '｜').replace(/\s+/g, ' ').trim().slice(0, 280);
+}
+
+/** 기본 행사 = 유효한 config 값 · 없으면 `field-<로컬 YYYY-MM-DD>`. */
+export function defaultFieldEvent(configured: string | undefined, now: Date = new Date()): string {
+  if (configured && isFieldSlug(configured)) return configured;
+  const pad = (n: number) => String(n).padStart(2, '0');
+  return `field-${now.getFullYear()}-${pad(now.getMonth() + 1)}-${pad(now.getDate())}`;
+}

package/src/graph-kinds/installed-plugin-nodes.ts

@@ -0,0 +1,95 @@
+import { createHash } from 'node:crypto';
+import { readFileSync, realpathSync, statSync } from 'node:fs';
+import { isAbsolute, join, relative, resolve } from 'node:path';
+import { debug } from '../debug/log.js';
+import { listInstalledPlugins, type InstalledPlugin } from '../plugins/install/plugin-install.js';
+import { loadPluginManifestFromDir, type PluginManifest } from '../plugins/core/manifest.js';
+import { loadPluginNodes } from './plugin-nodes.js';
+import { getNodeKindRegistration, listNodeKinds, unregisterPluginNodeKind, type GraphKind, type NodeKindEntry } from './registry.js';
+
+export interface InstalledPluginNodeSyncResult {
+  registered: number;
+  removed: number;
+  errors: Array<{ plugin: string; reason: string }>;
+}
+
+type OwnedNode = { graph: GraphKind; kind: string; plugin: string; registered: NodeKindEntry };
+type InstalledNodeState = { stamp: string; owned: Map<string, { fingerprint: string; nodes: OwnedNode[] }> };
+const states = new Map<string, InstalledNodeState>();
+
+function fingerprint(item: InstalledPlugin, manifest: PluginManifest): string {
+  const root = realpathSync(item.path);
+  const hash = createHash('sha256');
+  hash.update(JSON.stringify([item.name, item.version, item.market, item.sha256, item.installedAt, manifest]));
+  for (const path of manifest.contributes.nodes ?? []) {
+    const file = realpathSync(resolve(root, path));
+    const rel = relative(root, file);
+    if (!path.startsWith('./') || !rel || rel === '..' || rel.startsWith('../') || isAbsolute(rel)) {
+      throw new Error(`node path must remain inside the plugin dir: ${path}`);
+    }
+    hash.update(path);
+    hash.update(readFileSync(file));
+  }
+  return hash.digest('hex');
+}
+
+/** Reconcile only registrations made by this sync; the registry's identity check protects other owners. */
+export function syncInstalledPluginNodes(root: string): InstalledPluginNodeSyncResult {
+  const result: InstalledPluginNodeSyncResult = { registered: 0, removed: 0, errors: [] };
+  const stateRoot = resolve(root);
+  const ledger = statSync(join(stateRoot, 'plugins', 'installed.json'), { throwIfNoEntry: false, bigint: true });
+  // The installer atomically replaces the ledger, so mtime and size alone can
+  // coincide across installs. File identity and ctime detect that replacement.
+  const stamp = ledger ? `${ledger.dev}:${ledger.ino}:${ledger.ctimeNs}:${ledger.mtimeNs}:${ledger.size}` : 'missing';
+  const previous = states.get(stateRoot);
+  if (previous?.stamp === stamp) return result;
+
+  // The installer commits a new ledger via rename after the package directory is in place.
+  // If discovery itself fails, the stamp is not advanced and the next request retries.
+  const installed = listInstalledPlugins(stateRoot);
+  const current = new Set(installed.map(item => item.path));
+  const owned = previous?.owned ?? new Map<string, { fingerprint: string; nodes: OwnedNode[] }>();
+  const removeOwned = (path: string): void => {
+    for (const node of owned.get(path)?.nodes ?? []) {
+      if (unregisterPluginNodeKind(node.graph, node.kind, node.plugin, node.registered)) result.removed++;
+    }
+    owned.delete(path);
+  };
+  for (const path of owned.keys()) {
+    if (!current.has(path)) removeOwned(path);
+  }
+
+  for (const item of installed) {
+    try {
+      const manifest = loadPluginManifestFromDir(item.path, { id: item.name }).manifest;
+      if (!manifest.contributes.nodes?.length) {
+        removeOwned(item.path);
+        continue;
+      }
+      const version = fingerprint(item, manifest);
+      if (owned.get(item.path)?.fingerprint === version) continue;
+      removeOwned(item.path);
+      const before = new Set(listNodeKinds().filter(entry => entry.plugin === manifest.id).map(entry => `${entry.graph}:${entry.kind}`));
+      const loaded = loadPluginNodes(item.path, manifest);
+      const nodes: OwnedNode[] = [];
+      for (const entry of listNodeKinds().filter(entry => entry.plugin === manifest.id && !before.has(`${entry.graph}:${entry.kind}`))) {
+        const registered = getNodeKindRegistration(entry.graph, entry.kind);
+        if (registered) nodes.push({ graph: entry.graph, kind: entry.kind, plugin: manifest.id, registered });
+      }
+      if (loaded.errors.length) {
+        for (const node of nodes) unregisterPluginNodeKind(node.graph, node.kind, node.plugin, node.registered);
+        result.errors.push({ plugin: item.name, reason: loaded.errors.join('; ') });
+        owned.set(item.path, { fingerprint: version, nodes: [] });
+        continue;
+      }
+      result.registered += nodes.length;
+      owned.set(item.path, { fingerprint: version, nodes });
+    } catch (error) {
+      removeOwned(item.path);
+      result.errors.push({ plugin: item.name, reason: error instanceof Error ? error.message : String(error) });
+    }
+  }
+  states.set(stateRoot, { stamp, owned });
+  debug.log('graph.kinds', 'installed-sync', { root: stateRoot, ...result });
+  return result;
+}

package/src/graph-kinds/plugin-nodes.ts

@@ -34,8 +34,16 @@ export function loadPluginNodes(pluginDir: string, manifest: PluginManifest): Pl
       if (node.graph === 'workflow') {
         if (!node.run || typeof node.run !== 'object' || Array.isArray(node.run)) throw new Error('run must be an object');
         const spec = node.run as Record<string, unknown>;
-        if (Object.keys(spec).length !== 1 || !['bash', 'http', 'skill'].some((key) => key in spec)) {
-          throw new Error('run must contain exactly one bash, http or skill executor');
+        if (Object.keys(spec).length !== 1 || !['bash', 'http', 'skill', 'mcp'].some((key) => key in spec)) {
+          throw new Error('run must contain exactly one bash, http, skill or mcp executor');
+        }
+        if ('mcp' in spec) {
+          const mcp = spec.mcp;
+          if (!mcp || typeof mcp !== 'object' || Array.isArray(mcp)
+            || typeof (mcp as Record<string, unknown>).server !== 'string'
+            || typeof (mcp as Record<string, unknown>).tool !== 'string') {
+            throw new Error('mcp run requires server and tool');
+          }
         }
         run = spec as NodeKindRun;
       } else if (node.run !== undefined) {

package/src/graph-runner/runner.ts

@@ -1,9 +1,13 @@
 import { createHash, randomUUID } from 'node:crypto';
 import { execFile } from 'node:child_process';
-import { linkSync, mkdirSync, readFileSync, readdirSync, renameSync, rmdirSync, statSync, unlinkSync, writeFileSync } from 'node:fs';
-import { dirname, join, resolve } from 'node:path';
+import { existsSync, linkSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmdirSync, statSync, unlinkSync, writeFileSync } from 'node:fs';
+import { dirname, join, resolve, sep } from 'node:path';
 import { parse as parseYaml, stringify as stringifyYaml } from 'yaml';
+import { getElanousConfigDir, getElanousConfigDirOverride } from '../elanous-config-dir.js';
 import { debug } from '../debug/log.js';
+import { elanousStateRoot } from '../autopilot/state-paths.js';
+import { listInstalledPlugins } from '../plugins/install/plugin-install.js';
+import { credentialStatus, pluginEnv } from '../plugins/install/plugin-credentials.js';
 import { effectiveInstanceRoot } from '../instance/resolve.js';
 import { loadNodeCatalog } from '../self-implement/graph-catalog.js';
 import { parseGraphTemplateYaml, type GraphEdgeSpec, type GraphNodeSpec } from '../self-implement/graph-yaml.js';
@@ -215,6 +219,17 @@ export async function runGraph(path: string, options: GraphRunOptions = {}): Pro
   const parsed = parseGraphTemplateYaml(stringifyYaml(document), path);
   if (!parsed.template || parsed.errors.length) throw new Error(parsed.errors.map((e) => `${e.path}: ${e.message}`).join('\n'));
   const graph = parsed.template;
+  const pluginRoot = elanousStateRoot();
+  const graphFile = realpathSync(path);
+  const installed = listInstalledPlugins(pluginRoot);
+  const owner = installed.find(item => {
+    const graphsDir = join(item.path, 'graphs');
+    return existsSync(graphsDir) && graphFile.startsWith(`${realpathSync(graphsDir)}${sep}`);
+  });
+  const credentials = owner ? pluginEnv(owner.name, pluginRoot) : {};
+  const declaredEnv = [...new Set(installed.map(item => item.name))]
+    .flatMap(name => credentialStatus(name, pluginRoot).fields.map(field => field.env));
+  const credentialFields = owner ? credentialStatus(owner.name, pluginRoot).fields.filter(field => field.set).map(field => field.name) : [];
   for (const terminal of graph.terminalNodes) {
     if (terminal !== 'done' && terminal !== 'failed') {
       throw new Error(`unsupported terminal node: ${terminal} (expected done or failed)`);
@@ -390,17 +405,32 @@ export async function runGraph(path: string, options: GraphRunOptions = {}): Pro
       mkdirSync(dirname(contextPath), { recursive: true });
       writeFileSync(contextPath, JSON.stringify({ graphId, runId, nodeId: current, input: state.input ?? null, outputs }, null, 2) + '\n');
       let code: number | null = null;
+      const redactCredentials = (text: string) => Object.values(credentials).filter(value => value.length > 0)
+        .reduce((safe, value) => safe.replaceAll(value, '[REDACTED]'), text);
       const runBash: BashRun = async (body, opts) => {
         const result = await (options.deps?.runBash ?? realRunBash)(body, opts);
         code = result.exitCode;
-        return result;
+        return { ...result, stdout: redactCredentials(result.stdout), stderr: redactCredentials(result.stderr) };
       };
-      const ctx = { arguments: '', artifactsDir: dirname(statePath), outputs: {}, resolvedProvider: undefined, resolvedModel: undefined, toolPolicy: {}, env: { ...process.env, ELANOUS_GRAPH_CONTEXT: contextPath, ELANOUS_GRAPH_DIR: dirname(resolve(path)) } } as NodeExecContext;
+      if (owner) debug.log('plugin.credentials', 'injected', { plugin: owner.name, fields: credentialFields, count: credentialFields.length });
+      const env = { ...process.env };
+      for (const key of declaredEnv) delete env[key];
+      Object.assign(env, credentials);
+      // 러너가 명시로 받은 우주(`--config-dir`)를 `cmd:` 자식에 못 박는다 — 자식이 코드 위치(소스 트리)로 시험 우주를 새로 고르던 구멍
+      //   (09-30 🅢 스튜어드: 작업 트리 `graph run … --config-dir ~/.elanous` 의 자식 triage 가 «apiKey missing» · 0.2.5 컷 릴리스 루프도 같은 발사 줄).
+      if (getElanousConfigDirOverride()) {
+        env.ELANOUS_CONFIG_DIR = getElanousConfigDir();
+        env.ELANOUS_STATE_DIR = effectiveInstanceRoot();
+        debug.log('graph-runner', 'child-universe-pinned', { graphId, runId, node: current, configDir: env.ELANOUS_CONFIG_DIR, stateDir: env.ELANOUS_STATE_DIR });
+      }
+      env.ELANOUS_GRAPH_CONTEXT = contextPath;
+      env.ELANOUS_GRAPH_DIR = dirname(resolve(path));
+      const ctx = { arguments: '', artifactsDir: dirname(statePath), outputs: {}, resolvedProvider: undefined, resolvedModel: undefined, toolPolicy: {}, env } as NodeExecContext;
       const result = await executeBashNode({ id: current, type: 'bash', bash: command.command, ...(command.timeout_ms ? { idle_timeout: command.timeout_ms } : {}) } as BashNode, ctx, { runBash } as WorkflowDeps);
       output = result.output;
       ok = result.ok;
       exit = code;
-      error = result.error;
+      error = result.error ? redactCredentials(result.error) : undefined;
       state.executed++;
     }
     if (resumingCompleted && completed) {