elanous 0.2.41 → 0.2.43

package/src/cli/release-checklist-read-cli.ts

@@ -76,6 +76,26 @@ function evidenceJson(stdout: string): Record<string, unknown> | null {
   return null;
 }
 
+// E4 reads only the exact event near the evidence timestamp; absent timestamps fail closed.
+const E4_LOG_WINDOW_MS = 30 * 60_000;
+const EVIDENCE_ISO_TIMESTAMP = /\b\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})\b/gu;
+
+function evidenceTimestampNearIdentity(evidence: string, identity: string): number | null {
+  const identityAt = evidence.indexOf(identity);
+  if (identityAt < 0) return null;
+  const lineStart = evidence.lastIndexOf('\n', identityAt) + 1;
+  const lineEnd = evidence.indexOf('\n', identityAt);
+  const identityLine = evidence.slice(lineStart, lineEnd < 0 ? undefined : lineEnd);
+  let nearest: { distance: number; timestamp: number } | null = null;
+  for (const match of identityLine.matchAll(EVIDENCE_ISO_TIMESTAMP)) {
+    const timestamp = Date.parse(match[0]);
+    if (!Number.isFinite(timestamp)) continue;
+    const distance = Math.abs((match.index ?? 0) - (identityAt - lineStart));
+    if (!nearest || distance < nearest.distance) nearest = { distance, timestamp };
+  }
+  return nearest?.timestamp ?? null;
+}
+
 export function collectChecklistEvidenceStages(item: ReturnType<typeof listChecklist>['items'][number], run: ChecklistEvidenceCommandRunner = evidenceCommand): ChecklistEvidenceStage[] {
   const measuredAt = new Date().toISOString();
   const evidence = item.evidence ?? '';
@@ -109,8 +129,11 @@ export function collectChecklistEvidenceStages(item: ReturnType<typeof listCheck
       const origin = run('git', ['remote', 'get-url', 'origin']);
       const pinObject = run('git', ['cat-file', '-e', `${pinSha}^{commit}`]);
       const repoUrl = origin.stdout.trim().replace(/^git@github\.com:/i, 'https://github.com/').replace(/\.git$/i, '').replace(/\/$/u, '').toLowerCase();
-      const expectedRepo = 'https://github.com/elanvitalai/elanous';
-      if (repoRoot.status !== 0 || !repoRoot.stdout.trim() || origin.status !== 0 || repoUrl !== expectedRepo || pinObject.status !== 0) {
+      const expectedRepos = new Set([
+        'https://github.com/elanvitalai/elanous',
+        'https://github.com/ElanvitalAI/elanous',
+      ]);
+      if (repoRoot.status !== 0 || !repoRoot.stdout.trim() || origin.status !== 0 || !expectedRepos.has(repoUrl) || pinObject.status !== 0) {
         e3.reason = '현재 git 저장소가 elanous 원본이 아니거나 설치본 pin 객체가 없어 조상 관계를 판정할 수 없다';
       } else {
       const ancestry = run('git', ['merge-base', '--is-ancestor', mergeSha, pinSha]);
@@ -122,29 +145,44 @@ export function collectChecklistEvidenceStages(item: ReturnType<typeof listCheck
     }
   }
 
-  const runId = /\b(run-[a-f0-9]{8}-[a-f0-9-]{27,})\b/i.exec(evidence)?.[1]
-    ?? /\b([a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})\b/i.exec(evidence)?.[1];
+  const identityToken = '(?:run-[a-f0-9]{8}-[a-f0-9-]{27,}|[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}|[a-z0-9][a-z0-9._:-]{2,})';
+  const labelledIdentity = new RegExp(`\\b(runId|missionId|taskId)\\s*[:=]?\\s*(${identityToken})\\b`, 'i').exec(evidence);
+  const runId = labelledIdentity?.[2]
+    ?? /\b(run-[a-f0-9]{8}-[a-f0-9-]{27,}|[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})\b/i.exec(evidence)?.[1];
+  const identityLabel = labelledIdentity?.[1]?.toLowerCase();
+  const identityField = identityLabel === 'missionid' ? 'missionId' : identityLabel === 'taskid' ? 'taskId' : 'runId';
   const event = /(?:event|이벤트)\s*[:=]\s*([A-Za-z0-9_.:-]+)/iu.exec(evidence)?.[1];
   const verificationCommand = /(?:완료 경계 증거 명령|증거 명령|verification command)\s*[:=]\s*([^\r\n]+)/iu.exec(`${item.title}\n${evidence}`)?.[1]?.trim() ?? null;
-  const e4: ChecklistEvidenceStage = { id: 'E4', state: 'missing', source: null, measuredAt, verificationCommand, reason: '근거에 runId·event·원문 검증 명령이 모두 필요하다' };
+  const e4: ChecklistEvidenceStage = { id: 'E4', state: 'missing', source: null, measuredAt, verificationCommand, reason: '근거에 runId·missionId·taskId 중 하나와 event·원문 검증 명령이 모두 필요하다' };
   if (runId && event && verificationCommand) {
-    const logs = run('eln', ['logs', '--grep', runId, '--since', '365d', '--all', '--include-test', '--limit', '1000', '--json'], 30_000);
-    if (logs.status !== 0) { e4.state = 'unmeasurable'; e4.reason = `runId 로그 조회 실패${logs.error ? `: ${logs.error}` : ''}`; }
-    else {
-      const rows = logs.stdout.split(/\r?\n/u).flatMap((line) => { try { return [JSON.parse(line) as Record<string, unknown>]; } catch { return []; } });
-      const truncated = rows.length >= 1000 || rows.some((row) => row._meta && typeof row._meta === 'object' && (row._meta as { limitReached?: unknown }).limitReached === true);
-      const observed = rows.some((row) => {
-        if (row.event !== event || typeof row.data !== 'string') return false;
-        try { return (JSON.parse(row.data) as { runId?: unknown }).runId === runId; } catch { return false; }
-      });
-      e4.source = `eln logs --grep ${runId} --since 365d --all --include-test --limit 1000 --json (event=${event})`;
-      if (observed) { e4.state = 'observed'; e4.reason = `같은 runId의 ${event} 실물 이벤트를 찾았다`; }
-      else if (truncated) { e4.state = 'unmeasurable'; e4.reason = '로그 결과가 잘려 사건 부재를 판정할 수 없다'; }
-      else { e4.reason = `같은 runId의 ${event} 이벤트가 없다`; }
+    const identityAt = evidenceTimestampNearIdentity(evidence, runId);
+    if (identityAt === null) {
+      e4.state = 'unmeasurable';
+      e4.reason = `근거의 ${identityField}=${runId} 주변에 시간대가 명시된 ISO 시각이 없어 로그 조회 창을 만들 수 없다`;
+    } else {
+      const since = new Date(identityAt - E4_LOG_WINDOW_MS).toISOString();
+      const until = new Date(identityAt + E4_LOG_WINDOW_MS).toISOString();
+      const logs = run('eln', ['logs', '--event', event, '--since', since, '--until', until, '--all', '--include-test', '--limit', '1000', '--json'], 30_000);
+      if (logs.status !== 0) { e4.state = 'unmeasurable'; e4.reason = `runId 로그 조회 실패${logs.error ? `: ${logs.error}` : ''}`; }
+      else {
+        const rows = logs.stdout.split(/\r?\n/u).flatMap((line) => { try { return [JSON.parse(line) as Record<string, unknown>]; } catch { return []; } });
+        const truncated = rows.length >= 1000 || rows.some((row) => row._meta && typeof row._meta === 'object' && (row._meta as { limitReached?: unknown }).limitReached === true);
+        const observed = rows.some((row) => {
+          if (row.event !== event || typeof row.data !== 'string') return false;
+          try {
+            const data = JSON.parse(row.data) as { runId?: unknown; missionId?: unknown; taskId?: unknown };
+            return data[identityField] === runId;
+          } catch { return false; }
+        });
+        e4.source = `eln logs --event ${event} --since ${since} --until ${until} --all --include-test --limit 1000 --json (${identityField}=${runId})`;
+        if (observed) { e4.state = 'observed'; e4.reason = `같은 ${identityField}의 ${event} 실물 이벤트를 찾았다`; }
+        else if (truncated) { e4.state = 'unmeasurable'; e4.reason = '로그 결과가 잘려 사건 부재를 판정할 수 없다'; }
+        else { e4.reason = `같은 ${identityField}의 ${event} 이벤트가 없다`; }
+      }
     }
   }
 
-  const acceptance = /- 완료 경계 실물:([^\r\n]+)/u.exec(item.title)?.[1]?.trim();
+  const acceptance = /^\s*(?:[-*]\s*)?완료 경계 실물\s*:\s*([^\r\n]+)/mu.exec(item.title)?.[1]?.trim();
   const e5Observed = Boolean(acceptance && evidence.includes(acceptance));
   const e5: ChecklistEvidenceStage = { id: 'E5', state: e5Observed ? 'observed' : 'missing', source: 'checklist title/evidence exact acceptance-text comparison', measuredAt,
     reason: e5Observed ? '완료 경계 실물 문구가 기록된 근거와 일치한다' : '완료 경계 실물 문구와 일치하는 근거가 없다' };

package/src/cli/release-cli.ts

@@ -52,7 +52,7 @@ import type { PrereleaseKind } from '../../scripts/release-loop/release-version.
 import { releaseReadiness } from '../../scripts/release-loop/release-readiness.js';
 import { runReleaseIfReady } from './release-run-if-ready.js';
 import { ReleaseRunClaimConflict, findActiveReleaseRun, readActiveForceReleaseRun, isPidAlive, readReleaseRunLock, withDirectReleaseRunLock, withForceReleaseRunMarker } from './release-single-flight.js';
-import { formatPreflight, releasePreflight } from '../../scripts/release-loop/preflight.js';
+import { formatCountdown, formatPreflight, releasePreflight, runReleaseCountdown } from '../../scripts/release-loop/preflight.js';
 import { defaultReleaseGraphRunsRoot, formatPublishProposal, measurePublishWindow, proposePublishAt, publishWindowWarning } from '../../scripts/release-loop/publish-window.js';
 import { autoStartScheduledRelease, type AutoStartDeferral } from '../release-loop/auto-start.js';
 import { runRehearsalTick, type RehearsalDeps } from '../release-loop/rehearsal.js';
@@ -62,6 +62,7 @@ import { formatLightRc, runLightRc, type LightRcDeps } from '../release-loop/lig
 import { applyWatchList, formatGateHistory, gateHistory, ghMergedPrs } from '../../scripts/release-loop/gate-history.js';
 import { registerRfcCommands } from './rfc-cli.js';
 import { checklistCodenames, checklistVersion, isReleaseVersion, readChecklistContext, registerChecklistReadCommands, type ChecklistEvidenceReader } from './release-checklist-read-cli.js';
+import { syncLinearProgress } from '../decisions/linear-progress-sync.js';
 
 export { isReleaseVersion } from './release-checklist-read-cli.js';
 
@@ -814,6 +815,16 @@ export function registerReleaseCommands(program: Command, releaseRunDeps: Unatte
       console.log(`칸 ${rows.length} · 🟢 ${byStatus.green} · 🟡 ${byStatus.yellow} · 🔴 ${byStatus.red} · ✅ ${byStatus.done}`);
     });
   registerChecklistReadCommands(checklist, checklistEvidenceReader);
+  withContext(checklist.command('progress-sync').description('Linear 일일 진행 요약 계획 · --live 에서만 댓글 발송'))
+    .option('--live', '요약을 Linear 에 댓글로 발송(판별 뒤에만 사용)')
+    .action(async (opts: { live?: boolean }, cmd: Command) => {
+      const { version, json } = context(cmd);
+      if (!version) throw new CliUserError('조회할 판을 지정하라', '--version <v>');
+      const result = await syncLinearProgress({ version, live: opts.live === true });
+      if (json) { await writeStdoutJson(`${JSON.stringify(result)}\n`); return; }
+      console.log(`Linear 진행 요약 ${result.day} · 계획 ${result.planned} · 발송 ${result.posted} · 중복 건너뜀 ${result.skipped} · 실패 ${result.failed}`);
+      for (const row of result.plan) console.log(`· ${row.issue} ${row.action}: ${row.body.split('\n').slice(0, 4).join(' / ')}`);
+    });
   withContext(checklist.command('landed-but-yellow').description('병합 PR 이 있지만 노랑·빨강인 칸(기본 읽기 전용)'))
     .option('--owner <owner>', '자리 또는 하위 자리로 거르기')
     .option('--open', '미발행 일정 판 중 칸이 있는 판 전부')
@@ -1261,12 +1272,21 @@ export function registerReleaseCommands(program: Command, releaseRunDeps: Unatte
     .option('--json', '결과 한 줄 JSON(stdout) · 사람 줄은 stderr')
     .action(async (o: { version: string; cutCommit?: string; mainCut?: boolean; prerelease?: string; dryRun?: boolean; ifReady?: boolean; publishAt?: string; forceFreeze?: boolean; forceNew?: boolean; gateExecutor?: string; gateHost?: string; json?: boolean }) => { await runAction(o); });
   release.command('preflight')
-    .description('컷 전 사전 점검(읽기 전용) — 체크리스트·런 입력·동결·일정 + 컷 − 60분 origin/main export(자동 예약 없음). ⛔ 있으면 exit 1')
+    .description('컷 전 사전 점검(기본 읽기 전용) — --countdown 은 단계 판정 모델만 표시하고 컷을 실행하지 않는다. --allow-side-effects 를 명시해야 실패 우편·원장을 기록한다.')
     .requiredOption('--version <v>', '점검할 판(x.y.z)')
     .option('--publish-at <iso>', '계획 발행 시각(기본: 컷 뒤 첫 07·18시 KST)')
+    .option('--countdown', '발사 카운트다운 — T−120 노트·export·게이트 모의 → T−60 컷 트리 고정⊕node-b 자리 → T−30 gate 모드 → T0 컷 · 기본 dry-run')
+    .option('--allow-side-effects', '카운트다운 실패 때 담당 자리 우편·부적합 보고 원장 기록 허용(명시적 opt-in)')
     .option('--json', '결과 한 줄 JSON(stdout)')
-    .action(async (o: { version: string; publishAt?: string; json?: boolean }) => {
+    .action(async (o: { version: string; publishAt?: string; countdown?: boolean; allowSideEffects?: boolean; json?: boolean }) => {
       try {
+        if (o.countdown) {
+          const countdown = await runReleaseCountdown(o.version, { publishAt: o.publishAt, releaseRunDeps, allowSideEffects: o.allowSideEffects });
+          if (o.json) await writeStdoutJson(`${JSON.stringify(countdown)}\n`);
+          else for (const line of formatCountdown(countdown)) console.log(line);
+          if (countdown.verdict === 'block') process.exitCode = 1;
+          return;
+        }
         const result = await releasePreflight(o.version, { publishAt: o.publishAt, releaseRunDeps });
         if (o.json) await writeStdoutJson(`${JSON.stringify(result)}\n`);
         else for (const line of formatPreflight(result)) console.log(line);

package/src/cli/research-cli.ts

@@ -1,15 +1,15 @@
 import type { Command } from 'commander';
 import { debug } from '../debug/log.js';
 import { isLiveDetailOn } from '../live/detail-switch.js';
-import { dispatchOmniSearch } from '../skills/tools/omni-search.js';
-import { getAvailableWebSearchProviders } from '../web-search/index.js';
+import { dispatchResearchOmniSearch, getAvailableResearchSearchEngineIds } from '../skills/tools/omni-search.js';
 
 export interface ResearchCliDeps {
   readonly out?: { log: (line: string) => void; error: (line: string) => void };
-  readonly search?: typeof dispatchOmniSearch;
+  readonly search?: typeof dispatchResearchOmniSearch;
   readonly availableEngines?: () => string[];
   readonly maxDetailOn?: (runId?: string) => boolean;
   readonly log?: typeof debug.log;
+  readonly registerLogSink?: (surface: string) => Promise<unknown>;
 }
 
 export function registerResearchCommand(program: Command, deps: ResearchCliDeps = {}): void {
@@ -23,7 +23,7 @@ export function registerResearchCommand(program: Command, deps: ResearchCliDeps
       const query = parts.join(' ').trim();
       const limit = Number(opts.limit);
       const engines = opts.engines?.split(',').map(id => id.trim()).filter(Boolean);
-      const available = (deps.availableEngines ?? (() => getAvailableWebSearchProviders().map(p => p.id)))();
+      const available = (deps.availableEngines ?? getAvailableResearchSearchEngineIds)();
       const unknown = engines?.filter(id => !available.some(p => p.toLowerCase() === id.toLowerCase())) ?? [];
       if (!query || !Number.isInteger(limit) || limit < 1 || limit > 20 || (opts.engines !== undefined && !engines?.length) || unknown.length) {
         out.error(unknown.length ? `research: 사용할 수 없는 엔진: ${unknown.join(', ')} (사용 가능: ${available.join(', ') || '없음'})`
@@ -32,6 +32,14 @@ export function registerResearchCommand(program: Command, deps: ResearchCliDeps
         return;
       }
 
+      // 독립 CLI 프로세스는 데몬의 StoreSink 를 상속하지 않는다. Sink 등록이 없으면
+      // debug.log 이벤트가 파일 trail 에만 남아 `eln logs` 에서 관측되지 않는다.
+      try {
+        const register = deps.registerLogSink
+          ?? (async (surface: string) => (await import('../domains/standalone-log-sink.js')).registerStandaloneLogSink(surface));
+        await register('research');
+      } catch { /* fail-open: logging must not prevent research */ }
+
       const log = deps.log ?? ((category: string, event: string, data?: unknown) => debug.log(category, event, data));
       const maxDetailOn = deps.maxDetailOn ?? isLiveDetailOn;
       const runId = process.env.ELANOUS_RUN_ID?.trim() || undefined;
@@ -41,7 +49,7 @@ export function registerResearchCommand(program: Command, deps: ResearchCliDeps
       if (!wanted.length) log('research.query', 'query', { query, engines: [], limit });
       for (const engine of wanted) log('research.query', 'query', { query, engine, limit });
       try {
-        const result = await (deps.search ?? dispatchOmniSearch)({ query, ...(engines?.length ? { engines } : {}), limit }, {
+        const result = await (deps.search ?? dispatchResearchOmniSearch)({ query, ...(engines?.length ? { engines } : {}), limit }, {
           onEngine: event => {
             if (event.phase === 'complete') log('research.result', 'result', { query, engine: event.engine, hits: event.hits, durationMs: event.durationMs, ...(event.error ? { error: event.error } : {}) });
           },

package/src/cli/setup-cli.ts

@@ -1,6 +1,6 @@
-import { existsSync, readFileSync } from 'node:fs';
+import { accessSync, constants, existsSync, readFileSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { join } from 'node:path';
+import { delimiter, join } from 'node:path';
 import { createHash } from 'node:crypto';
 import { addSource, listSources } from '../intake-plane/intake-sources.js';
 import { effectiveInstanceRoot } from '../instance/resolve.js';
@@ -11,6 +11,18 @@ import { recommendedSetup } from './setup-recommend.js';
 import { detectSkillCliAuth, type CliAuthStatus } from '../onboarding/cli-auth-status.js';
 import { debug } from '../debug/log.js';
 import { getUserConfig, saveUserConfig, userConfigPath, type UserConfig } from '../user-config.js';
+import { collectServiceKeys, printKeySetupReport } from '../onboarding/key-setup.js';
+import { getSecretAsync, setSecretAsync } from '../nexus/config/secrets/index.js';
+import { probeProvider } from '../llm/provider-probe.js';
+import { createSecretPrompt } from '../onboarding/secret-prompt.js';
+import { realIO } from '../onboarding.js';
+import { parseServiceKeyEnv, readMaskedServiceEnvPaste } from '../setup/service-keys.js';
+import { importServiceKeys, renderServiceKeyStatus, runSetupKeys } from './setup-keys.js';
+import { SERVICE_KEY_CATALOG, type ServiceKeyCatalogEntry } from '../setup/llm-env-detect.js';
+import { serviceKeyStatus } from '../setup/service-keys.js';
+import { detectProviders } from '../llm/provider-detect.js';
+import { DEFAULT_PLUGIN_GROUP, defaultPluginStatuses } from '../plugins/install/plugin-install.js';
+import type { DefaultPluginStatus } from '../plugins/install/plugin-install.js';
 
 const ELANOUS_LOGIN_COMMAND = 'elanous login openai-codex';
 const PROVIDER_COMMAND = 'elanous config set llm.provider openai-codex';
@@ -38,11 +50,18 @@ export interface SetupCliDeps extends DoctorOptions {
   planClaudePluginSetup?: typeof planClaudePluginSetup;
   applyClaudePluginSetup?: typeof applyClaudePluginSetup;
   prompt?: (message: string) => Promise<string | undefined>;
+  promptSecret?: (message: string) => Promise<string | undefined>;
+  getSecretAsync?: typeof getSecretAsync;
+  setSecretAsync?: typeof setSecretAsync;
+  probeKey?: typeof probeProvider;
   isStdinTty?: () => boolean;
   out?: { log: (value: string) => void; error?: (value: string) => void };
   setExitCode?: (code: number) => void;
   /** 런타임이 이 config 로 «실제로» 고르는 provider(`decideProviderForConfig().provider`). 시험 seam. */
   resolveRuntimeProvider?: (config: UserConfig) => string | undefined;
+  detectProviders?: typeof detectProviders;
+  getServiceKeyStatus?: typeof serviceKeyStatus;
+  isCommandAvailable?: (command: string) => boolean;
 }
 
 /** ⛔ 2026-09-23 — provider 단계는 «문자열 비교»가 아니라 ***런타임의 최종 결정***으로 잰다.
@@ -118,6 +137,10 @@ function missingRequiredCommands(doctor: DoctorReport): boolean {
   return doctor.externalCommands.some((command) => command.status === 'missing' && command.tier === 'required');
 }
 
+function missingGitCapability(doctor: DoctorReport): boolean {
+  return doctor.externalCommands.some((command) => command.name === 'git' && command.status !== 'found');
+}
+
 function displayCommand(command: string[]): string {
   return command.map((arg) => /^[A-Za-z0-9_@%+=:,./-]+$/.test(arg)
     ? arg
@@ -128,7 +151,7 @@ export function formatSetupReport(doctor: DoctorReport, steps: SetupStep[], nonI
   const elanousLogin = steps[0]!.complete;
   const provider = steps[1]!.complete;
   const codexLogin = steps[2]!.complete;
-  const externalReady = doctor.ok && !missingRequiredCommands(doctor);
+  const externalReady = doctor.ok && !missingRequiredCommands(doctor) && !missingGitCapability(doctor);
   const capabilities = [
     { name: 'OpenAI Codex-backed elanous sessions', ready: elanousLogin && provider },
     { name: 'Codex app-server integration', ready: codexLogin && externalReady },
@@ -215,13 +238,82 @@ function formatDefaultBundleProposal(): string[] {
   ];
 }
 
+/** Check the default plugin group's required/optional connector declarations against the runtime catalog. */
+export function validateDefaultPluginServiceKeys(
+  group: readonly { id: string; requiredServiceKeys: readonly string[]; optionalServiceKeys: readonly string[] }[] = DEFAULT_PLUGIN_GROUP,
+  catalog: readonly Pick<ServiceKeyCatalogEntry, 'id' | 'kind'>[] = SERVICE_KEY_CATALOG,
+): string[] {
+  const errors: string[] = [];
+  const catalogIds = new Set<string>();
+  for (const item of catalog) {
+    if (catalogIds.has(item.id)) errors.push(`중복 서비스 카탈로그 id: ${item.id}`);
+    catalogIds.add(item.id);
+  }
+  for (const plugin of group) {
+    const required = new Set<string>();
+    const optional = new Set<string>();
+    for (const id of plugin.requiredServiceKeys) {
+      if (required.has(id)) errors.push(`${plugin.id}: 필수 키 중복 ${id}`);
+      required.add(id);
+    }
+    for (const id of plugin.optionalServiceKeys) {
+      if (optional.has(id)) errors.push(`${plugin.id}: 선택 키 중복 ${id}`);
+      optional.add(id);
+      if (required.has(id)) errors.push(`${plugin.id}: required/optional 중복 ${id}`);
+    }
+    for (const id of [...required, ...optional]) {
+      const item = catalog.find(candidate => candidate.id === id);
+      if (!item) errors.push(`${plugin.id}: 서비스 카탈로그에 없는 키 ${id}`);
+      else if (item.kind !== 'api-key') errors.push(`${plugin.id}: API 키가 아닌 서비스 참조 ${id} (${item.kind})`);
+    }
+  }
+  return errors;
+}
+
+function commandAvailable(command: string): boolean {
+  const path = process.env.PATH ?? '';
+  return path.split(delimiter).some(directory => {
+    try { accessSync(join(directory, command), constants.X_OK); return true; } catch { return false; }
+  });
+}
+
+function formatDefaultPluginStatuses(statuses: readonly DefaultPluginStatus[]): string[] {
+  return [
+    'Setup: 기본 플러그인 묶음 상태 (실제 키·선행 조건)',
+    ...statuses.map(plugin => {
+      const missing = [
+        ...(plugin.missingRequiredKeys.length ? [`필수 키 ${plugin.missingRequiredKeys.join(', ')}`] : []),
+        ...(plugin.missingPrerequisites.length ? [`선행 조건 ${plugin.missingPrerequisites.join(', ')}`] : []),
+      ];
+      const optional = plugin.optionalKeysMissing.length
+        ? ` · 선택 키 미설정 ${plugin.optionalKeysMissing.join(', ')}` : '';
+      return `${plugin.status === 'ready' ? '✓' : '○'} ${plugin.label}: ${plugin.status}${missing.length ? ` · ${missing.join(' · ')}` : ''}${optional}`;
+    }),
+  ];
+}
+
+async function readDefaultPluginStatuses(deps: SetupCliDeps): Promise<DefaultPluginStatus[]> {
+  const catalogErrors = validateDefaultPluginServiceKeys();
+  if (catalogErrors.length) throw new Error(`기본 플러그인 서비스 카탈로그 오류: ${catalogErrors.join('; ')}`);
+  const keys = (deps.getServiceKeyStatus ?? serviceKeyStatus)()
+    .filter(item => item.configured).map(item => item.id);
+  const providers = await (deps.detectProviders ?? detectProviders)();
+  const prerequisites = new Set<string>();
+  if (providers.some(provider => provider.available && provider.auth !== 'agent-cli')) prerequisites.add('llm-provider');
+  if ((deps.isCommandAvailable ?? commandAvailable)('aside')) prerequisites.add('aside');
+  if ((deps.isCommandAvailable ?? commandAvailable)('claude')) prerequisites.add('claude-cli');
+  if ((deps.isCommandAvailable ?? commandAvailable)('gh')) prerequisites.add('github-cli');
+  return defaultPluginStatuses({ readyServiceKeyIds: keys, satisfiedPrerequisites: [...prerequisites] });
+}
+
 export function registerSetupCommand(program: Command, deps: SetupCliDeps = {}): void {
   const out = deps.out ?? { log: (value: string) => console.log(value), error: (value: string) => console.error(value) };
   const setExitCode = deps.setExitCode ?? ((code: number) => { process.exitCode = code; });
   const doctorRunner = deps.runDoctor ?? runDoctor;
   const isFirstRunSetup = (): boolean => deps.firstRunTopics ?? (!deps.getUserConfig && !existsSync(userConfigPath()));
-  const showDefaultBundleProposal = (): void => {
+  const showDefaultBundleProposal = async (): Promise<void> => {
     for (const line of formatDefaultBundleProposal()) out.log(line);
+    for (const line of formatDefaultPluginStatuses(await readDefaultPluginStatuses(deps))) out.log(line);
   };
   const showCliSkills = (apply: boolean) => {
     out.log('Setup: CLI skills (public GitHub repository reads remain available without login)');
@@ -233,6 +325,8 @@ export function registerSetupCommand(program: Command, deps: SetupCliDeps = {}):
     const rl = createInterface({ input: process.stdin, output: process.stdout });
     try { return await rl.question(message); } finally { rl.close(); }
   });
+  // API keys must never fall back to the ordinary (echoing) setup prompt.
+  const askSecret = deps.promptSecret ?? createSecretPrompt();
 
   const setup = program.command('setup')
     .description('Check OpenAI Codex setup and guide each missing credential step')
@@ -243,7 +337,7 @@ export function registerSetupCommand(program: Command, deps: SetupCliDeps = {}):
       if (opts.nonInteractive) {
         out.log(formatSetupReport(doctor, setupSteps(deps), true));
         showCliSkills(false);
-        if (isFirstRunSetup()) showDefaultBundleProposal();
+        if (isFirstRunSetup()) await showDefaultBundleProposal();
         for (const line of recommendedSetup((deps.getUserConfig ?? getUserConfig)())) out.log(line);
         setExitCode(0);
         return;
@@ -268,7 +362,7 @@ export function registerSetupCommand(program: Command, deps: SetupCliDeps = {}):
       }
       out.log(formatSetupReport(doctor, steps, false));
       showCliSkills(false);
-      if (isFirstRun) showDefaultBundleProposal();
+      if (isFirstRun) await showDefaultBundleProposal();
       for (const line of recommendedSetup((deps.getUserConfig ?? getUserConfig)())) out.log(line);
       let configured = (deps.getUserConfig ?? getUserConfig)();
       if (!configured.starter?.topics && configured.watch?.enabled !== false
@@ -314,6 +408,31 @@ export function registerSetupCommand(program: Command, deps: SetupCliDeps = {}):
       setExitCode(0);
     });
 
+  setup.command('service-keys')
+    .description('Import and verify service API keys without rendering their values')
+    .action(async () => {
+      if (!isStdinTty()) {
+        (out.error ?? out.log)('키 설정은 stdin TTY가 있는 자리에서만 실행할 수 있다.');
+        setExitCode(1);
+        return;
+      }
+      try {
+        const results = await collectServiceKeys({
+          config: (deps.getUserConfig ?? getUserConfig)(),
+          promptSecret: askSecret,
+          print: out.log,
+          getSecret: deps.getSecretAsync,
+          setSecret: deps.setSecretAsync,
+          probe: deps.probeKey,
+        });
+        printKeySetupReport(results, out.log);
+        setExitCode(results.some((result) => result.status === 'failed') ? 1 : 0);
+      } catch {
+        (out.error ?? out.log)('키 설정을 완료하지 못했습니다. 민감한 오류 내용은 숨겼습니다.');
+        setExitCode(1);
+      }
+    });
+
   setup.command('claude-code')
     .description('Plan or install the elanous Claude Code plugin')
     .option('--apply', 'Install missing steps and verify the MCP connection')
@@ -365,4 +484,45 @@ export function registerSetupCommand(program: Command, deps: SetupCliDeps = {}):
         setExitCode(1);
       }
     });
+
+  setup.command('keys')
+    .description('Set up service credentials without printing secret values')
+    .option('--status', 'Show credential presence only')
+    .option('--import-env-file <path>', 'Import catalogued keys from a dotenv file')
+    .option('--paste-env', 'Paste a dotenv block into a hidden terminal prompt')
+    .option('--all', 'Include optional service keys during interactive setup; --status always shows all services')
+    .action(async (opts: { status?: boolean; importEnvFile?: string; pasteEnv?: boolean; all?: boolean }) => {
+      const keyConfig = (deps.getUserConfig ?? getUserConfig)();
+      const keyOptions = { config: keyConfig, includeOptional: opts.all === true };
+      try {
+        if (opts.status) {
+          if (opts.all) throw new Error('--status already shows the full catalog; omit --all');
+          for (const line of renderServiceKeyStatus()) out.log(line);
+          for (const line of formatDefaultPluginStatuses(await readDefaultPluginStatuses(deps))) out.log(line);
+          setExitCode(0);
+          return;
+        }
+        let text: string | undefined;
+        if (opts.importEnvFile) text = readFileSync(opts.importEnvFile, 'utf8');
+        else if (opts.pasteEnv) {
+          if (!isStdinTty()) throw new Error('hidden paste import requires a terminal');
+          text = await readMaskedServiceEnvPaste();
+        }
+        if (text !== undefined) {
+          const parsed = parseServiceKeyEnv(text);
+          const result = await importServiceKeys(parsed, { print: (line) => out.log(line) }, keyOptions);
+          setExitCode(result.rejected.length ? 1 : 0);
+          return;
+        }
+        if (!isStdinTty()) throw new Error('secret input requires a terminal; use --import-env-file for a protected dotenv file');
+        const io = realIO();
+        try { await runSetupKeys(io, keyOptions); }
+        finally { io.close(); }
+        setExitCode(0);
+      } catch (error) {
+        const message = error instanceof Error ? error.message : 'setup keys failed';
+        (out.error ?? out.log)(message.replace(/\r?\n/g, ' '));
+        setExitCode(1);
+      }
+    });
 }