elanous 0.2.42 → 0.2.43

package/src/cli/release-checklist-read-cli.ts

@@ -76,6 +76,26 @@ function evidenceJson(stdout: string): Record<string, unknown> | null {
   return null;
 }
 
+// E4 reads only the exact event near the evidence timestamp; absent timestamps fail closed.
+const E4_LOG_WINDOW_MS = 30 * 60_000;
+const EVIDENCE_ISO_TIMESTAMP = /\b\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})\b/gu;
+
+function evidenceTimestampNearIdentity(evidence: string, identity: string): number | null {
+  const identityAt = evidence.indexOf(identity);
+  if (identityAt < 0) return null;
+  const lineStart = evidence.lastIndexOf('\n', identityAt) + 1;
+  const lineEnd = evidence.indexOf('\n', identityAt);
+  const identityLine = evidence.slice(lineStart, lineEnd < 0 ? undefined : lineEnd);
+  let nearest: { distance: number; timestamp: number } | null = null;
+  for (const match of identityLine.matchAll(EVIDENCE_ISO_TIMESTAMP)) {
+    const timestamp = Date.parse(match[0]);
+    if (!Number.isFinite(timestamp)) continue;
+    const distance = Math.abs((match.index ?? 0) - (identityAt - lineStart));
+    if (!nearest || distance < nearest.distance) nearest = { distance, timestamp };
+  }
+  return nearest?.timestamp ?? null;
+}
+
 export function collectChecklistEvidenceStages(item: ReturnType<typeof listChecklist>['items'][number], run: ChecklistEvidenceCommandRunner = evidenceCommand): ChecklistEvidenceStage[] {
   const measuredAt = new Date().toISOString();
   const evidence = item.evidence ?? '';
@@ -135,22 +155,30 @@ export function collectChecklistEvidenceStages(item: ReturnType<typeof listCheck
   const verificationCommand = /(?:완료 경계 증거 명령|증거 명령|verification command)\s*[:=]\s*([^\r\n]+)/iu.exec(`${item.title}\n${evidence}`)?.[1]?.trim() ?? null;
   const e4: ChecklistEvidenceStage = { id: 'E4', state: 'missing', source: null, measuredAt, verificationCommand, reason: '근거에 runId·missionId·taskId 중 하나와 event·원문 검증 명령이 모두 필요하다' };
   if (runId && event && verificationCommand) {
-    const logs = run('eln', ['logs', '--grep', runId, '--since', '365d', '--all', '--include-test', '--limit', '1000', '--json'], 30_000);
-    if (logs.status !== 0) { e4.state = 'unmeasurable'; e4.reason = `runId 로그 조회 실패${logs.error ? `: ${logs.error}` : ''}`; }
-    else {
-      const rows = logs.stdout.split(/\r?\n/u).flatMap((line) => { try { return [JSON.parse(line) as Record<string, unknown>]; } catch { return []; } });
-      const truncated = rows.length >= 1000 || rows.some((row) => row._meta && typeof row._meta === 'object' && (row._meta as { limitReached?: unknown }).limitReached === true);
-      const observed = rows.some((row) => {
-        if (row.event !== event || typeof row.data !== 'string') return false;
-        try {
-          const data = JSON.parse(row.data) as { runId?: unknown; missionId?: unknown; taskId?: unknown };
-          return data[identityField] === runId;
-        } catch { return false; }
-      });
-      e4.source = `eln logs --grep ${runId} --since 365d --all --include-test --limit 1000 --json (${identityField}=${runId}, event=${event})`;
-      if (observed) { e4.state = 'observed'; e4.reason = `같은 ${identityField}의 ${event} 실물 이벤트를 찾았다`; }
-      else if (truncated) { e4.state = 'unmeasurable'; e4.reason = '로그 결과가 잘려 사건 부재를 판정할 수 없다'; }
-      else { e4.reason = `같은 ${identityField}의 ${event} 이벤트가 없다`; }
+    const identityAt = evidenceTimestampNearIdentity(evidence, runId);
+    if (identityAt === null) {
+      e4.state = 'unmeasurable';
+      e4.reason = `근거의 ${identityField}=${runId} 주변에 시간대가 명시된 ISO 시각이 없어 로그 조회 창을 만들 수 없다`;
+    } else {
+      const since = new Date(identityAt - E4_LOG_WINDOW_MS).toISOString();
+      const until = new Date(identityAt + E4_LOG_WINDOW_MS).toISOString();
+      const logs = run('eln', ['logs', '--event', event, '--since', since, '--until', until, '--all', '--include-test', '--limit', '1000', '--json'], 30_000);
+      if (logs.status !== 0) { e4.state = 'unmeasurable'; e4.reason = `runId 로그 조회 실패${logs.error ? `: ${logs.error}` : ''}`; }
+      else {
+        const rows = logs.stdout.split(/\r?\n/u).flatMap((line) => { try { return [JSON.parse(line) as Record<string, unknown>]; } catch { return []; } });
+        const truncated = rows.length >= 1000 || rows.some((row) => row._meta && typeof row._meta === 'object' && (row._meta as { limitReached?: unknown }).limitReached === true);
+        const observed = rows.some((row) => {
+          if (row.event !== event || typeof row.data !== 'string') return false;
+          try {
+            const data = JSON.parse(row.data) as { runId?: unknown; missionId?: unknown; taskId?: unknown };
+            return data[identityField] === runId;
+          } catch { return false; }
+        });
+        e4.source = `eln logs --event ${event} --since ${since} --until ${until} --all --include-test --limit 1000 --json (${identityField}=${runId})`;
+        if (observed) { e4.state = 'observed'; e4.reason = `같은 ${identityField}의 ${event} 실물 이벤트를 찾았다`; }
+        else if (truncated) { e4.state = 'unmeasurable'; e4.reason = '로그 결과가 잘려 사건 부재를 판정할 수 없다'; }
+        else { e4.reason = `같은 ${identityField}의 ${event} 이벤트가 없다`; }
+      }
     }
   }
 

package/src/cli/release-cli.ts

@@ -52,7 +52,7 @@ import type { PrereleaseKind } from '../../scripts/release-loop/release-version.
 import { releaseReadiness } from '../../scripts/release-loop/release-readiness.js';
 import { runReleaseIfReady } from './release-run-if-ready.js';
 import { ReleaseRunClaimConflict, findActiveReleaseRun, readActiveForceReleaseRun, isPidAlive, readReleaseRunLock, withDirectReleaseRunLock, withForceReleaseRunMarker } from './release-single-flight.js';
-import { formatPreflight, releasePreflight } from '../../scripts/release-loop/preflight.js';
+import { formatCountdown, formatPreflight, releasePreflight, runReleaseCountdown } from '../../scripts/release-loop/preflight.js';
 import { defaultReleaseGraphRunsRoot, formatPublishProposal, measurePublishWindow, proposePublishAt, publishWindowWarning } from '../../scripts/release-loop/publish-window.js';
 import { autoStartScheduledRelease, type AutoStartDeferral } from '../release-loop/auto-start.js';
 import { runRehearsalTick, type RehearsalDeps } from '../release-loop/rehearsal.js';
@@ -62,6 +62,7 @@ import { formatLightRc, runLightRc, type LightRcDeps } from '../release-loop/lig
 import { applyWatchList, formatGateHistory, gateHistory, ghMergedPrs } from '../../scripts/release-loop/gate-history.js';
 import { registerRfcCommands } from './rfc-cli.js';
 import { checklistCodenames, checklistVersion, isReleaseVersion, readChecklistContext, registerChecklistReadCommands, type ChecklistEvidenceReader } from './release-checklist-read-cli.js';
+import { syncLinearProgress } from '../decisions/linear-progress-sync.js';
 
 export { isReleaseVersion } from './release-checklist-read-cli.js';
 
@@ -814,6 +815,16 @@ export function registerReleaseCommands(program: Command, releaseRunDeps: Unatte
       console.log(`칸 ${rows.length} · 🟢 ${byStatus.green} · 🟡 ${byStatus.yellow} · 🔴 ${byStatus.red} · ✅ ${byStatus.done}`);
     });
   registerChecklistReadCommands(checklist, checklistEvidenceReader);
+  withContext(checklist.command('progress-sync').description('Linear 일일 진행 요약 계획 · --live 에서만 댓글 발송'))
+    .option('--live', '요약을 Linear 에 댓글로 발송(판별 뒤에만 사용)')
+    .action(async (opts: { live?: boolean }, cmd: Command) => {
+      const { version, json } = context(cmd);
+      if (!version) throw new CliUserError('조회할 판을 지정하라', '--version <v>');
+      const result = await syncLinearProgress({ version, live: opts.live === true });
+      if (json) { await writeStdoutJson(`${JSON.stringify(result)}\n`); return; }
+      console.log(`Linear 진행 요약 ${result.day} · 계획 ${result.planned} · 발송 ${result.posted} · 중복 건너뜀 ${result.skipped} · 실패 ${result.failed}`);
+      for (const row of result.plan) console.log(`· ${row.issue} ${row.action}: ${row.body.split('\n').slice(0, 4).join(' / ')}`);
+    });
   withContext(checklist.command('landed-but-yellow').description('병합 PR 이 있지만 노랑·빨강인 칸(기본 읽기 전용)'))
     .option('--owner <owner>', '자리 또는 하위 자리로 거르기')
     .option('--open', '미발행 일정 판 중 칸이 있는 판 전부')
@@ -1261,12 +1272,21 @@ export function registerReleaseCommands(program: Command, releaseRunDeps: Unatte
     .option('--json', '결과 한 줄 JSON(stdout) · 사람 줄은 stderr')
     .action(async (o: { version: string; cutCommit?: string; mainCut?: boolean; prerelease?: string; dryRun?: boolean; ifReady?: boolean; publishAt?: string; forceFreeze?: boolean; forceNew?: boolean; gateExecutor?: string; gateHost?: string; json?: boolean }) => { await runAction(o); });
   release.command('preflight')
-    .description('컷 전 사전 점검(읽기 전용) — 체크리스트·런 입력·동결·일정 + 컷 − 60분 origin/main export(자동 예약 없음). ⛔ 있으면 exit 1')
+    .description('컷 전 사전 점검(기본 읽기 전용) — --countdown 은 단계 판정 모델만 표시하고 컷을 실행하지 않는다. --allow-side-effects 를 명시해야 실패 우편·원장을 기록한다.')
     .requiredOption('--version <v>', '점검할 판(x.y.z)')
     .option('--publish-at <iso>', '계획 발행 시각(기본: 컷 뒤 첫 07·18시 KST)')
+    .option('--countdown', '발사 카운트다운 — T−120 노트·export·게이트 모의 → T−60 컷 트리 고정⊕node-b 자리 → T−30 gate 모드 → T0 컷 · 기본 dry-run')
+    .option('--allow-side-effects', '카운트다운 실패 때 담당 자리 우편·부적합 보고 원장 기록 허용(명시적 opt-in)')
     .option('--json', '결과 한 줄 JSON(stdout)')
-    .action(async (o: { version: string; publishAt?: string; json?: boolean }) => {
+    .action(async (o: { version: string; publishAt?: string; countdown?: boolean; allowSideEffects?: boolean; json?: boolean }) => {
       try {
+        if (o.countdown) {
+          const countdown = await runReleaseCountdown(o.version, { publishAt: o.publishAt, releaseRunDeps, allowSideEffects: o.allowSideEffects });
+          if (o.json) await writeStdoutJson(`${JSON.stringify(countdown)}\n`);
+          else for (const line of formatCountdown(countdown)) console.log(line);
+          if (countdown.verdict === 'block') process.exitCode = 1;
+          return;
+        }
         const result = await releasePreflight(o.version, { publishAt: o.publishAt, releaseRunDeps });
         if (o.json) await writeStdoutJson(`${JSON.stringify(result)}\n`);
         else for (const line of formatPreflight(result)) console.log(line);

package/src/cli/research-cli.ts

@@ -9,6 +9,7 @@ export interface ResearchCliDeps {
   readonly availableEngines?: () => string[];
   readonly maxDetailOn?: (runId?: string) => boolean;
   readonly log?: typeof debug.log;
+  readonly registerLogSink?: (surface: string) => Promise<unknown>;
 }
 
 export function registerResearchCommand(program: Command, deps: ResearchCliDeps = {}): void {
@@ -31,6 +32,14 @@ export function registerResearchCommand(program: Command, deps: ResearchCliDeps
         return;
       }
 
+      // 독립 CLI 프로세스는 데몬의 StoreSink 를 상속하지 않는다. Sink 등록이 없으면
+      // debug.log 이벤트가 파일 trail 에만 남아 `eln logs` 에서 관측되지 않는다.
+      try {
+        const register = deps.registerLogSink
+          ?? (async (surface: string) => (await import('../domains/standalone-log-sink.js')).registerStandaloneLogSink(surface));
+        await register('research');
+      } catch { /* fail-open: logging must not prevent research */ }
+
       const log = deps.log ?? ((category: string, event: string, data?: unknown) => debug.log(category, event, data));
       const maxDetailOn = deps.maxDetailOn ?? isLiveDetailOn;
       const runId = process.env.ELANOUS_RUN_ID?.trim() || undefined;

package/src/cli/setup-cli.ts

@@ -1,6 +1,6 @@
-import { existsSync, readFileSync } from 'node:fs';
+import { accessSync, constants, existsSync, readFileSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { join } from 'node:path';
+import { delimiter, join } from 'node:path';
 import { createHash } from 'node:crypto';
 import { addSource, listSources } from '../intake-plane/intake-sources.js';
 import { effectiveInstanceRoot } from '../instance/resolve.js';
@@ -11,6 +11,18 @@ import { recommendedSetup } from './setup-recommend.js';
 import { detectSkillCliAuth, type CliAuthStatus } from '../onboarding/cli-auth-status.js';
 import { debug } from '../debug/log.js';
 import { getUserConfig, saveUserConfig, userConfigPath, type UserConfig } from '../user-config.js';
+import { collectServiceKeys, printKeySetupReport } from '../onboarding/key-setup.js';
+import { getSecretAsync, setSecretAsync } from '../nexus/config/secrets/index.js';
+import { probeProvider } from '../llm/provider-probe.js';
+import { createSecretPrompt } from '../onboarding/secret-prompt.js';
+import { realIO } from '../onboarding.js';
+import { parseServiceKeyEnv, readMaskedServiceEnvPaste } from '../setup/service-keys.js';
+import { importServiceKeys, renderServiceKeyStatus, runSetupKeys } from './setup-keys.js';
+import { SERVICE_KEY_CATALOG, type ServiceKeyCatalogEntry } from '../setup/llm-env-detect.js';
+import { serviceKeyStatus } from '../setup/service-keys.js';
+import { detectProviders } from '../llm/provider-detect.js';
+import { DEFAULT_PLUGIN_GROUP, defaultPluginStatuses } from '../plugins/install/plugin-install.js';
+import type { DefaultPluginStatus } from '../plugins/install/plugin-install.js';
 
 const ELANOUS_LOGIN_COMMAND = 'elanous login openai-codex';
 const PROVIDER_COMMAND = 'elanous config set llm.provider openai-codex';
@@ -38,11 +50,18 @@ export interface SetupCliDeps extends DoctorOptions {
   planClaudePluginSetup?: typeof planClaudePluginSetup;
   applyClaudePluginSetup?: typeof applyClaudePluginSetup;
   prompt?: (message: string) => Promise<string | undefined>;
+  promptSecret?: (message: string) => Promise<string | undefined>;
+  getSecretAsync?: typeof getSecretAsync;
+  setSecretAsync?: typeof setSecretAsync;
+  probeKey?: typeof probeProvider;
   isStdinTty?: () => boolean;
   out?: { log: (value: string) => void; error?: (value: string) => void };
   setExitCode?: (code: number) => void;
   /** 런타임이 이 config 로 «실제로» 고르는 provider(`decideProviderForConfig().provider`). 시험 seam. */
   resolveRuntimeProvider?: (config: UserConfig) => string | undefined;
+  detectProviders?: typeof detectProviders;
+  getServiceKeyStatus?: typeof serviceKeyStatus;
+  isCommandAvailable?: (command: string) => boolean;
 }
 
 /** ⛔ 2026-09-23 — provider 단계는 «문자열 비교»가 아니라 ***런타임의 최종 결정***으로 잰다.
@@ -118,6 +137,10 @@ function missingRequiredCommands(doctor: DoctorReport): boolean {
   return doctor.externalCommands.some((command) => command.status === 'missing' && command.tier === 'required');
 }
 
+function missingGitCapability(doctor: DoctorReport): boolean {
+  return doctor.externalCommands.some((command) => command.name === 'git' && command.status !== 'found');
+}
+
 function displayCommand(command: string[]): string {
   return command.map((arg) => /^[A-Za-z0-9_@%+=:,./-]+$/.test(arg)
     ? arg
@@ -128,7 +151,7 @@ export function formatSetupReport(doctor: DoctorReport, steps: SetupStep[], nonI
   const elanousLogin = steps[0]!.complete;
   const provider = steps[1]!.complete;
   const codexLogin = steps[2]!.complete;
-  const externalReady = doctor.ok && !missingRequiredCommands(doctor);
+  const externalReady = doctor.ok && !missingRequiredCommands(doctor) && !missingGitCapability(doctor);
   const capabilities = [
     { name: 'OpenAI Codex-backed elanous sessions', ready: elanousLogin && provider },
     { name: 'Codex app-server integration', ready: codexLogin && externalReady },
@@ -215,13 +238,82 @@ function formatDefaultBundleProposal(): string[] {
   ];
 }
 
+/** Check the default plugin group's required/optional connector declarations against the runtime catalog. */
+export function validateDefaultPluginServiceKeys(
+  group: readonly { id: string; requiredServiceKeys: readonly string[]; optionalServiceKeys: readonly string[] }[] = DEFAULT_PLUGIN_GROUP,
+  catalog: readonly Pick<ServiceKeyCatalogEntry, 'id' | 'kind'>[] = SERVICE_KEY_CATALOG,
+): string[] {
+  const errors: string[] = [];
+  const catalogIds = new Set<string>();
+  for (const item of catalog) {
+    if (catalogIds.has(item.id)) errors.push(`중복 서비스 카탈로그 id: ${item.id}`);
+    catalogIds.add(item.id);
+  }
+  for (const plugin of group) {
+    const required = new Set<string>();
+    const optional = new Set<string>();
+    for (const id of plugin.requiredServiceKeys) {
+      if (required.has(id)) errors.push(`${plugin.id}: 필수 키 중복 ${id}`);
+      required.add(id);
+    }
+    for (const id of plugin.optionalServiceKeys) {
+      if (optional.has(id)) errors.push(`${plugin.id}: 선택 키 중복 ${id}`);
+      optional.add(id);
+      if (required.has(id)) errors.push(`${plugin.id}: required/optional 중복 ${id}`);
+    }
+    for (const id of [...required, ...optional]) {
+      const item = catalog.find(candidate => candidate.id === id);
+      if (!item) errors.push(`${plugin.id}: 서비스 카탈로그에 없는 키 ${id}`);
+      else if (item.kind !== 'api-key') errors.push(`${plugin.id}: API 키가 아닌 서비스 참조 ${id} (${item.kind})`);
+    }
+  }
+  return errors;
+}
+
+function commandAvailable(command: string): boolean {
+  const path = process.env.PATH ?? '';
+  return path.split(delimiter).some(directory => {
+    try { accessSync(join(directory, command), constants.X_OK); return true; } catch { return false; }
+  });
+}
+
+function formatDefaultPluginStatuses(statuses: readonly DefaultPluginStatus[]): string[] {
+  return [
+    'Setup: 기본 플러그인 묶음 상태 (실제 키·선행 조건)',
+    ...statuses.map(plugin => {
+      const missing = [
+        ...(plugin.missingRequiredKeys.length ? [`필수 키 ${plugin.missingRequiredKeys.join(', ')}`] : []),
+        ...(plugin.missingPrerequisites.length ? [`선행 조건 ${plugin.missingPrerequisites.join(', ')}`] : []),
+      ];
+      const optional = plugin.optionalKeysMissing.length
+        ? ` · 선택 키 미설정 ${plugin.optionalKeysMissing.join(', ')}` : '';
+      return `${plugin.status === 'ready' ? '✓' : '○'} ${plugin.label}: ${plugin.status}${missing.length ? ` · ${missing.join(' · ')}` : ''}${optional}`;
+    }),
+  ];
+}
+
+async function readDefaultPluginStatuses(deps: SetupCliDeps): Promise<DefaultPluginStatus[]> {
+  const catalogErrors = validateDefaultPluginServiceKeys();
+  if (catalogErrors.length) throw new Error(`기본 플러그인 서비스 카탈로그 오류: ${catalogErrors.join('; ')}`);
+  const keys = (deps.getServiceKeyStatus ?? serviceKeyStatus)()
+    .filter(item => item.configured).map(item => item.id);
+  const providers = await (deps.detectProviders ?? detectProviders)();
+  const prerequisites = new Set<string>();
+  if (providers.some(provider => provider.available && provider.auth !== 'agent-cli')) prerequisites.add('llm-provider');
+  if ((deps.isCommandAvailable ?? commandAvailable)('aside')) prerequisites.add('aside');
+  if ((deps.isCommandAvailable ?? commandAvailable)('claude')) prerequisites.add('claude-cli');
+  if ((deps.isCommandAvailable ?? commandAvailable)('gh')) prerequisites.add('github-cli');
+  return defaultPluginStatuses({ readyServiceKeyIds: keys, satisfiedPrerequisites: [...prerequisites] });
+}
+
 export function registerSetupCommand(program: Command, deps: SetupCliDeps = {}): void {
   const out = deps.out ?? { log: (value: string) => console.log(value), error: (value: string) => console.error(value) };
   const setExitCode = deps.setExitCode ?? ((code: number) => { process.exitCode = code; });
   const doctorRunner = deps.runDoctor ?? runDoctor;
   const isFirstRunSetup = (): boolean => deps.firstRunTopics ?? (!deps.getUserConfig && !existsSync(userConfigPath()));
-  const showDefaultBundleProposal = (): void => {
+  const showDefaultBundleProposal = async (): Promise<void> => {
     for (const line of formatDefaultBundleProposal()) out.log(line);
+    for (const line of formatDefaultPluginStatuses(await readDefaultPluginStatuses(deps))) out.log(line);
   };
   const showCliSkills = (apply: boolean) => {
     out.log('Setup: CLI skills (public GitHub repository reads remain available without login)');
@@ -233,6 +325,8 @@ export function registerSetupCommand(program: Command, deps: SetupCliDeps = {}):
     const rl = createInterface({ input: process.stdin, output: process.stdout });
     try { return await rl.question(message); } finally { rl.close(); }
   });
+  // API keys must never fall back to the ordinary (echoing) setup prompt.
+  const askSecret = deps.promptSecret ?? createSecretPrompt();
 
   const setup = program.command('setup')
     .description('Check OpenAI Codex setup and guide each missing credential step')
@@ -243,7 +337,7 @@ export function registerSetupCommand(program: Command, deps: SetupCliDeps = {}):
       if (opts.nonInteractive) {
         out.log(formatSetupReport(doctor, setupSteps(deps), true));
         showCliSkills(false);
-        if (isFirstRunSetup()) showDefaultBundleProposal();
+        if (isFirstRunSetup()) await showDefaultBundleProposal();
         for (const line of recommendedSetup((deps.getUserConfig ?? getUserConfig)())) out.log(line);
         setExitCode(0);
         return;
@@ -268,7 +362,7 @@ export function registerSetupCommand(program: Command, deps: SetupCliDeps = {}):
       }
       out.log(formatSetupReport(doctor, steps, false));
       showCliSkills(false);
-      if (isFirstRun) showDefaultBundleProposal();
+      if (isFirstRun) await showDefaultBundleProposal();
       for (const line of recommendedSetup((deps.getUserConfig ?? getUserConfig)())) out.log(line);
       let configured = (deps.getUserConfig ?? getUserConfig)();
       if (!configured.starter?.topics && configured.watch?.enabled !== false
@@ -314,6 +408,31 @@ export function registerSetupCommand(program: Command, deps: SetupCliDeps = {}):
       setExitCode(0);
     });
 
+  setup.command('service-keys')
+    .description('Import and verify service API keys without rendering their values')
+    .action(async () => {
+      if (!isStdinTty()) {
+        (out.error ?? out.log)('키 설정은 stdin TTY가 있는 자리에서만 실행할 수 있다.');
+        setExitCode(1);
+        return;
+      }
+      try {
+        const results = await collectServiceKeys({
+          config: (deps.getUserConfig ?? getUserConfig)(),
+          promptSecret: askSecret,
+          print: out.log,
+          getSecret: deps.getSecretAsync,
+          setSecret: deps.setSecretAsync,
+          probe: deps.probeKey,
+        });
+        printKeySetupReport(results, out.log);
+        setExitCode(results.some((result) => result.status === 'failed') ? 1 : 0);
+      } catch {
+        (out.error ?? out.log)('키 설정을 완료하지 못했습니다. 민감한 오류 내용은 숨겼습니다.');
+        setExitCode(1);
+      }
+    });
+
   setup.command('claude-code')
     .description('Plan or install the elanous Claude Code plugin')
     .option('--apply', 'Install missing steps and verify the MCP connection')
@@ -365,4 +484,45 @@ export function registerSetupCommand(program: Command, deps: SetupCliDeps = {}):
         setExitCode(1);
       }
     });
+
+  setup.command('keys')
+    .description('Set up service credentials without printing secret values')
+    .option('--status', 'Show credential presence only')
+    .option('--import-env-file <path>', 'Import catalogued keys from a dotenv file')
+    .option('--paste-env', 'Paste a dotenv block into a hidden terminal prompt')
+    .option('--all', 'Include optional service keys during interactive setup; --status always shows all services')
+    .action(async (opts: { status?: boolean; importEnvFile?: string; pasteEnv?: boolean; all?: boolean }) => {
+      const keyConfig = (deps.getUserConfig ?? getUserConfig)();
+      const keyOptions = { config: keyConfig, includeOptional: opts.all === true };
+      try {
+        if (opts.status) {
+          if (opts.all) throw new Error('--status already shows the full catalog; omit --all');
+          for (const line of renderServiceKeyStatus()) out.log(line);
+          for (const line of formatDefaultPluginStatuses(await readDefaultPluginStatuses(deps))) out.log(line);
+          setExitCode(0);
+          return;
+        }
+        let text: string | undefined;
+        if (opts.importEnvFile) text = readFileSync(opts.importEnvFile, 'utf8');
+        else if (opts.pasteEnv) {
+          if (!isStdinTty()) throw new Error('hidden paste import requires a terminal');
+          text = await readMaskedServiceEnvPaste();
+        }
+        if (text !== undefined) {
+          const parsed = parseServiceKeyEnv(text);
+          const result = await importServiceKeys(parsed, { print: (line) => out.log(line) }, keyOptions);
+          setExitCode(result.rejected.length ? 1 : 0);
+          return;
+        }
+        if (!isStdinTty()) throw new Error('secret input requires a terminal; use --import-env-file for a protected dotenv file');
+        const io = realIO();
+        try { await runSetupKeys(io, keyOptions); }
+        finally { io.close(); }
+        setExitCode(0);
+      } catch (error) {
+        const message = error instanceof Error ? error.message : 'setup keys failed';
+        (out.error ?? out.log)(message.replace(/\r?\n/g, ' '));
+        setExitCode(1);
+      }
+    });
 }

package/src/cli/setup-keys.ts

@@ -0,0 +1,187 @@
+import { SERVICE_KEY_CATALOG } from '../setup/llm-env-detect.js';
+import { serviceKeyStatus, storeServiceKeys, verifyServiceKey, type ParsedServiceKeyEnv } from '../setup/service-keys.js';
+import { detectProviders } from '../llm/provider-detect.js';
+import { loginWithCodex } from '../oauth/codex.js';
+import type { FirstRunProviderSetupResult } from '../onboarding/first-run.js';
+import { MODEL_ROLES, resolveRoleLlm, type LLMProviderName, type UserConfig } from '../user-config.js';
+import { parseMenuAnswer } from '../onboarding/menu-answer.js';
+
+export interface SetupKeysIO {
+  ask(prompt: string): Promise<string>;
+  askSecret?(prompt: string): Promise<string>;
+  print(message: string): void;
+}
+
+export interface SetupKeysOptions {
+  config: UserConfig;
+  env?: NodeJS.ProcessEnv;
+  cacheDir?: string;
+  includeOptional?: boolean;
+  /** Existing OAuth fetch injection used by deterministic login simulation. */
+  loginWithCodex?: typeof loginWithCodex;
+}
+
+function providerForService(id: string): string | undefined {
+  switch (id) {
+    case 'openai-api': return 'openai';
+    case 'anthropic-api': return 'anthropic';
+    case 'gemini-api': return 'gemini';
+    case 'openrouter': return 'openrouter';
+    case 'xai': return 'grok';
+    case 'opengateway': return 'opengateway';
+    default: return undefined;
+  }
+}
+
+function providerBaseUrl(config: UserConfig, serviceId: string): string | undefined {
+  const provider = providerForService(serviceId);
+  if (!provider) return undefined;
+  return config.llm.rotation?.find(item => item.provider === provider)?.baseUrl;
+}
+
+function renderProviderProposal(config: UserConfig, providers: Awaited<ReturnType<typeof detectProviders>>): string[] {
+  const available = providers.filter(provider => provider.available).sort((a, b) => a.rank - b.rank);
+  const ordered = [...new Set(available.map(provider => provider.provider))];
+  const defaultProvider = ordered.includes(config.llm.provider) ? config.llm.provider : ordered[0];
+  const fallback = config.llm.fallbackChain ?? [];
+  const suggestion = defaultProvider ? [defaultProvider, ...ordered.filter(name => name !== defaultProvider)] : [];
+  return [
+    `LLM 감지: ${available.length ? available.map(provider => `${provider.provider}(${provider.auth})`).join(' · ') : '사용 가능한 인증 없음'}`,
+    `기본 제안: ${defaultProvider ?? '설정 후 선택'} · 현재 기본: ${config.llm.provider}`,
+    `폴백 제안: ${suggestion.length ? suggestion.join(' → ') : '현재 설정 유지'} · 현재 llm.fallbackChain: ${fallback.length ? fallback.join(' → ') : '미설정'}`,
+    `역할별 현재 해석: ${MODEL_ROLES.map(role => {
+      try {
+        const resolved = resolveRoleLlm(role, { config });
+        return `${role}=${resolved.provider}/${resolved.model}`;
+      } catch {
+        return `${role}=미설정`;
+      }
+    }).join(' · ')}`,
+    '위 내용은 제안만 표시하며 roleLlm·llm.fallbackChain을 변경하지 않습니다.',
+  ];
+}
+
+export function renderServiceKeyStatus(options: { env?: NodeJS.ProcessEnv; cacheDir?: string } = {}): string[] {
+  const status = serviceKeyStatus(options);
+  return SERVICE_KEY_CATALOG.map(item => {
+    const row = status.find(candidate => candidate.id === item.id);
+    if (!row) return `${item.label}: 상태 확인 불가`;
+    if (item.kind === 'api-key') return `${item.label}: ${row.configured ? '키 있음' : '키 필요'} (${item.envNames.join(', ')})`;
+    return `${item.label}: ${item.kind === 'subscription' || item.kind === 'oauth' || item.kind === 'cli' ? '로그인/설치 상태는 별도 감지' : '로컬 도구 확인 필요'}`;
+  });
+}
+
+export async function importServiceKeys(values: ParsedServiceKeyEnv, io: Pick<SetupKeysIO, 'print'>, options: SetupKeysOptions): Promise<{ stored: string[]; rejected: string[]; unverified: string[] }> {
+  const accepted = new Map<string, string>();
+  const rejected: string[] = [];
+  const unverified: string[] = [];
+  const env = options.env ?? process.env;
+  for (const [name, value] of values) {
+    const item = SERVICE_KEY_CATALOG.find(candidate => candidate.kind === 'api-key' && candidate.envNames.includes(name));
+    if (!item) { rejected.push(name); continue; }
+    if (env[name]?.trim() === value) io.print(`${name}: 환경에서 이미 제공됨 · 캐시에도 저장합니다 · 값 출력 0`);
+    const verification = await verifyServiceKey(item.id, value, {
+      env,
+      cacheDir: options.cacheDir,
+      baseUrl: providerBaseUrl(options.config, item.id),
+    });
+    if (verification.result === 'verified') accepted.set(name, value);
+    else if (verification.result === 'unsupported') {
+      accepted.set(name, value);
+      unverified.push(name);
+      io.print(`${item.label}: 최소 확인을 지원하지 않아 검증 없이 저장합니다 · 값 출력 0`);
+    }
+    else {
+      rejected.push(name);
+      io.print(`${item.label}: 검증 ${verification.result}${verification.httpStatus ? ` (HTTP ${verification.httpStatus})` : ''} · 저장 안 함`);
+    }
+  }
+  const saved = accepted.size ? storeServiceKeys(accepted, { env, cacheDir: options.cacheDir }) : { stored: [] };
+  if (saved.stored.length) io.print(`저장 완료: ${saved.stored.join(', ')} · 값 출력 0`);
+  return { stored: saved.stored, rejected: rejected.sort(), unverified: unverified.sort() };
+}
+
+export async function runSetupKeys(io: SetupKeysIO, options: SetupKeysOptions): Promise<{ stored: string[]; skipped: string[] }> {
+  const providers = await detectProviders({ env: options.env });
+  for (const line of renderProviderProposal(options.config, providers)) io.print(line);
+  const { listCodexAccountsInStore } = await import('../oauth/codex-account-store.js');
+  const codexAccounts = listCodexAccountsInStore().map(account => account.name);
+  io.print(`Codex 계정: ${codexAccounts.length ? codexAccounts.join(', ') : '없음'} · 추가: 별도 CODEX_HOME에서 codex login 후 elanous provider codex account import <이름> --home <홈>`);
+  const statuses = serviceKeyStatus({ env: options.env, cacheDir: options.cacheDir });
+  const entries = SERVICE_KEY_CATALOG.filter(item => item.kind === 'api-key' && (item.demoRequired || options.includeOptional));
+  const stored: string[] = [];
+  const skipped: string[] = [];
+  for (const item of entries) {
+    const status = statuses.find(candidate => candidate.id === item.id);
+    if (!status) { io.print(`${item.label}: 상태 확인 불가 · 건너뜀`); skipped.push(item.id); continue; }
+    if (status.configured) { io.print(`${item.label}: 이미 설정됨`); continue; }
+    const envName = item.envNames[0];
+    if (!envName) continue;
+    io.print(`${item.label} · ${item.setupUrl} · ${item.demoRequired ? '데모 필요' : '선택'}`);
+    if (!io.askSecret) {
+      io.print(`${item.label}: 이 입력 화면은 비밀 입력을 지원하지 않습니다 · eln setup keys --paste-env 사용`);
+      skipped.push(item.id);
+      continue;
+    }
+    const value = (await io.askSecret(`${envName} (Enter=건너뜀): `)).trim();
+    if (!value) { skipped.push(item.id); continue; }
+    const result = await importServiceKeys(new Map([[envName, value]]), io, options);
+    if (result.stored.includes(envName)) stored.push(envName);
+    else skipped.push(item.id);
+  }
+  for (const line of renderServiceKeyStatus({ env: options.env, cacheDir: options.cacheDir })) io.print(line);
+  return { stored, skipped };
+}
+
+export const FIRST_RUN_PROVIDER_SETUP_MENU_HEADING = '처음 실행 LLM 설정';
+export const FIRST_RUN_PROVIDER_SETUP_MENU_CHOICES = '1 Codex 구독 로그인 · 2 API 키 입력 · Enter 건너뛰기';
+export const FIRST_RUN_PROVIDER_SETUP_MENU_MAX_MISSES = 3;
+
+/** First-run entry: offer the existing Codex device login or the same verified-key flow as `setup keys`. */
+export async function runFirstRunProviderSetup(io: SetupKeysIO, options: SetupKeysOptions): Promise<FirstRunProviderSetupResult> {
+  const choices = ['codex-login', 'api-key'] as const;
+  let misses = 0;
+  let choice: typeof choices[number];
+  for (;;) {
+    io.print(FIRST_RUN_PROVIDER_SETUP_MENU_HEADING);
+    io.print(FIRST_RUN_PROVIDER_SETUP_MENU_CHOICES);
+    const parsed = parseMenuAnswer(await io.ask('선택: '), choices);
+    if (parsed.kind === 'cancel') return null;
+    if (parsed.kind === 'miss') {
+      misses += 1;
+      if (misses >= FIRST_RUN_PROVIDER_SETUP_MENU_MAX_MISSES) return { kind: 'needs-llm' };
+      continue;
+    }
+    choice = parsed.provider;
+    break;
+  }
+
+  if (choice === 'codex-login') {
+    try {
+      await (options.loginWithCodex ?? loginWithCodex)({ onProgress: (event) => {
+        if (event.type === 'user_code') io.print(`Codex 로그인: ${event.loginUrl} · 코드 ${event.userCode}`);
+        else if (event.type === 'polling') io.print('Codex 로그인을 기다리는 중…');
+        else if (event.type === 'exchanging') io.print('Codex 로그인을 확인하는 중…');
+      } });
+      io.print('Codex 로그인 완료');
+      return 'openai-codex';
+    } catch {
+      io.print('Codex 로그인을 완료하지 못했습니다. 다시 시도하거나 Enter로 건너뛰세요.');
+      return null;
+    }
+  }
+  // Keep the exact environment object through storage and rediscovery: storeServiceKeys
+  // writes accepted values into it as well as the protected cache, so a newly entered
+  // key is immediately visible to detectProviders and resolveProviderCredential.
+  const env = options.env ?? process.env;
+  await runSetupKeys(io, { ...options, env });
+  // runSetupKeys handles an absent askSecret capability per item (skip + safe guidance);
+  // it does not throw or turn the first-run entry into a crash.
+  const providers = (await detectProviders({ env }))
+    .filter(provider => provider.available && provider.auth === 'apikey');
+  const available = [...new Set(providers.map(provider => provider.provider as LLMProviderName))];
+  if (!available.length) return null;
+  io.print(`기본 공급자 선택: ${available.map((provider, index) => `${index + 1} ${provider}`).join(' · ')}`);
+  const answer = (await io.ask('기본 공급자 번호 (Enter=건너뜀): ')).trim();
+  return available[Number(answer) - 1] ?? null;
+}