elanous 0.2.5 → 0.2.7

package/src/cli/machine-cli.ts

@@ -1,4 +1,6 @@
 import type { Command } from 'commander';
+import { readFileSync, writeFileSync } from 'node:fs';
+import { loadMachineLedger, machineMarkdownPath, renderLedgerMarkdown, setMachineField } from '../machines/machine-ledger.js';
 import { MACHINE_NAME, resolveMachineName } from '../roles/machine-name.js';
 import { readMachineProfile, seatRank, validSeatRank, writeMachineProfile } from '../roles/machine-profile.js';
 
@@ -28,6 +30,27 @@ export function registerMachineCommands(program: Command, root?: string): void {
       writeMachineProfile({ id, duties, seats }, root);
       console.log(`machine · ${id} · ${duties.join(',') || '-'} · ${Object.entries(seats).map(([seat, value]) => `${seat}:${value.rank}`).join(',') || '-'}`);
     });
+  machine.command('render').description('YAML 원장에서 Markdown 생성·검증')
+    .option('--check', 'Markdown 과 YAML 동기화 검증')
+    .action((opts: { check?: boolean }) => {
+      const markdown = renderLedgerMarkdown(loadMachineLedger(process.cwd()));
+      const path = machineMarkdownPath(process.cwd());
+      if (opts.check) {
+        let current: string;
+        try { current = readFileSync(path, 'utf8'); } catch { throw new Error(`machine ledger Markdown missing: ${path}`); }
+        if (current !== markdown) throw new Error(`machine ledger Markdown stale: ${path}`);
+        console.log('machine render --check OK');
+      } else {
+        writeFileSync(path, markdown, 'utf8');
+        console.log(`machine render · ${path}`);
+      }
+    });
+  machine.command('ledger-set').description('YAML 보유 자원 필드 수정')
+    .argument('<id>').argument('<field>').argument('<value>')
+    .action((id: string, field: string, value: string) => {
+      setMachineField(process.cwd(), id, field, value);
+      console.log(`machine ledger-set · ${id} · ${field}`);
+    });
   machine.command('show').option('--json', 'JSON 출력')
     .action((opts: { json?: boolean }) => {
       const resolved = resolveMachineName({ root });

package/src/cli/msg-cli.ts

@@ -0,0 +1,137 @@
+import type { Command } from 'commander';
+import { canonicalSeatId, openMsgStore, type Message, type MsgStore } from '../msg/msg-store.js';
+
+export interface MsgCliDeps {
+  openStore?: () => MsgStore;
+  out?: Pick<Console, 'log' | 'error'>;
+  readStdin?: () => Promise<string>;
+  sleep?: (ms: number) => Promise<void>;
+  setExitCode?: (code: number) => void;
+  signal?: AbortSignal;
+}
+
+type CommonOptions = { json?: boolean };
+type RecipientOptions = CommonOptions & { to?: string; after?: string; limit?: string };
+
+function seat(raw: string | undefined, flag: string): string {
+  if (raw === undefined) throw new Error(`${flag} is required`);
+  return canonicalSeatId(raw);
+}
+
+function integer(raw: string | undefined, flag: string, fallback: number, min: number, max: number): number {
+  if (raw === undefined) return fallback;
+  if (!/^(0|[1-9]\d*)$/.test(raw)) throw new Error(`${flag} must be an integer between ${min} and ${max}`);
+  const value = Number(raw);
+  if (!Number.isSafeInteger(value) || value < min || value > max) throw new Error(`${flag} must be an integer between ${min} and ${max}`);
+  return value;
+}
+
+function formatMessage(message: Message): string {
+  return `#${message.id} ${message.createdAt} ${message.from} → ${message.to}${message.kind ? ` [${message.kind}]` : ''}: ${message.body}`;
+}
+
+/** Register the durable, recipient-addressed CLI. Reading never advances the acknowledgement cursor. */
+export function registerMsgCommands(program: Command, deps: MsgCliDeps = {}): void {
+  const open = deps.openStore ?? (() => openMsgStore());
+  const out = deps.out ?? console;
+  const readStdin = deps.readStdin ?? (() => Bun.stdin.text());
+  const sleep = deps.sleep ?? ((ms: number) => new Promise<void>(resolve => setTimeout(resolve, ms)));
+  const setExitCode = deps.setExitCode ?? ((code: number) => { process.exitCode = code; });
+  const msg = program.command('msg').description('Durable seat-addressed messages');
+
+  const run = (action: () => void | Promise<void>) => async () => {
+    try { await action(); }
+    catch (error) {
+      out.error(`msg: ${error instanceof Error ? error.message : String(error)}`);
+      setExitCode(2);
+    }
+  };
+  const withStore = <T>(action: (store: MsgStore) => T): T => {
+    const store = open();
+    try { return action(store); }
+    finally { store.close(); }
+  };
+  const emit = (value: unknown, json: boolean | undefined, human: () => void) => {
+    if (json) out.log(JSON.stringify(value));
+    else human();
+  };
+
+  msg.command('post [body]').description('Post a message; use - or omit body to read stdin')
+    .option('--from <seat>').option('--to <seat>').option('--kind <kind>').option('--body <text>').option('--json')
+    .action((body: string | undefined, opts: CommonOptions & { from?: string; to?: string; kind?: string; body?: string }) => run(async () => {
+      const from = seat(opts.from, '--from');
+      const to = seat(opts.to, '--to');
+      if (body !== undefined && body !== '-' && opts.body !== undefined) throw new Error('provide body once (argument or --body)');
+      const text = opts.body ?? (body !== undefined && body !== '-' ? body : await readStdin());
+      const posted = withStore(store => store.post({ from, to, body: text, ...(opts.kind === undefined ? {} : { kind: opts.kind }) }));
+      emit(posted, opts.json, () => out.log(formatMessage(posted)));
+    })());
+
+  msg.command('list').description('List messages for one recipient without acknowledging them')
+    .option('--to <seat>').option('--after <id>', 'exclusive message ID (default: acknowledged cursor)')
+    .option('--limit <count>', 'maximum messages (1–1000)').option('--json')
+    .action((opts: RecipientOptions) => run(() => {
+      const to = seat(opts.to, '--to');
+      const limit = integer(opts.limit, '--limit', 100, 1, 1000);
+      const after = opts.after === undefined ? undefined : integer(opts.after, '--after', 0, 0, Number.MAX_SAFE_INTEGER);
+      const messages = withStore(store => store.list(to, after ?? store.getCursor(to), limit));
+      emit(messages, opts.json, () => {
+        if (!messages.length) out.log('No messages.');
+        for (const message of messages) out.log(formatMessage(message));
+      });
+    })());
+
+  msg.command('ack [id]').description('Explicitly acknowledge messages through this ID for one recipient')
+    .option('--to <seat>').option('--json')
+    .action((id: string | undefined, opts: CommonOptions & { to?: string }) => run(() => {
+      const to = seat(opts.to, '--to');
+      if (id === undefined) throw new Error('message ID is required');
+      const cursor = integer(id, 'message ID', 0, 0, Number.MAX_SAFE_INTEGER);
+      const acknowledged = withStore(store => store.ack(to, cursor));
+      emit({ recipient: to, cursor: acknowledged }, opts.json, () => out.log(`${to} acknowledged through #${acknowledged}`));
+    })());
+
+  msg.command('unread').description('Show recipients with unacknowledged messages')
+    .option('--to <seat>').option('--json')
+    .action((opts: CommonOptions & { to?: string }) => run(() => {
+      const to = opts.to === undefined ? undefined : seat(opts.to, '--to');
+      const rows = withStore(store => store.unread().filter(row => to === undefined || row.recipient === to));
+      emit(rows, opts.json, () => {
+        if (!rows.length) out.log('No unread messages.');
+        for (const row of rows) out.log(`${row.recipient}: ${row.count} unread`);
+      });
+    })());
+
+  msg.command('watch').description('Poll for new messages without acknowledging them (Ctrl-C to stop)')
+    .option('--to <seat>').option('--after <id>', 'exclusive message ID (default: acknowledged cursor)')
+    .option('--interval <ms>', 'poll interval in milliseconds', '1000')
+    .option('--once', 'poll once and exit').option('--json')
+    .action((opts: RecipientOptions & { interval?: string; once?: boolean }) => run(async () => {
+      const to = seat(opts.to, '--to');
+      const interval = integer(opts.interval, '--interval', 1000, 1, 60000);
+      const after = opts.after === undefined ? undefined : integer(opts.after, '--after', 0, 0, Number.MAX_SAFE_INTEGER);
+      const store = open();
+      try {
+        let cursor = after ?? store.getCursor(to);
+        do {
+          let messages: Message[];
+          do {
+            messages = store.list(to, cursor, 1000);
+            for (const message of messages) {
+              emit(message, opts.json, () => out.log(formatMessage(message)));
+              cursor = message.id;
+            }
+          } while (messages.length === 1000 && !deps.signal?.aborted);
+          if (opts.once || deps.signal?.aborted) break;
+          await sleep(interval);
+        } while (!deps.signal?.aborted);
+      } finally { store.close(); }
+    })());
+
+  // Commander reports option/argument errors before action handlers run. Scope their exit code
+  // to msg so unrelated commands keep their own error and help behavior.
+  for (const command of [msg, ...msg.commands]) {
+    const reportError = command.error.bind(command);
+    command.error = (message, options) => reportError(message, { ...options, exitCode: 2 });
+  }
+}

package/src/cli/nexus-ios-bind.ts

@@ -59,6 +59,9 @@ export interface IosBindOpts {
   readTokenFn?: () => string | null;
   /** Test seam — host fallback (production daily driver 의 default). */
   hostFallback?: string;
+  /** Test seam — `defaults write` 가 쓸 도메인. 기본은 설치된 앱 «컨테이너»의 plist 경로다.
+   *  `spawnSyncFn` 만 주입된 시험은 bundle id 그대로(실 `xcrun` 을 부르지 않는다). */
+  resolveDomainFn?: (bundleId: string) => string;
 }
 
 export interface IosBindResult {
@@ -90,6 +93,16 @@ function defaultReadToken(): string | null {
   }
 }
 
+/** 앱이 실제로 읽는 도메인 — 설치된 앱의 데이터 컨테이너 plist(확장자 없이).
+ *  ⚠️ `defaults write <bundleId>` 는 시뮬레이터 «전역» 도메인에 쓴다. 앱은 자기 컨테이너 plist 를 읽으므로,
+ *  앱이 한 번이라도 설정을 저장한 뒤로는 그 값이 이긴다(2026-09-30 실측: 연결 링크로 받은 만료 임시 토큰이
+ *  컨테이너에 남아 ios-bind 가 «✓» 를 찍고도 앱은 401 을 받았다). 컨테이너를 못 찾으면 bundle id 로 폴백한다. */
+function defaultResolveDomain(bundleId: string): string {
+  const r = defaultSpawnSync('xcrun', ['simctl', 'get_app_container', 'booted', bundleId, 'data'], { stdio: 'pipe' });
+  const dir = r.status === 0 ? String(r.stdout ?? '').trim() : '';
+  return dir ? join(dir, 'Library', 'Preferences', bundleId) : bundleId;
+}
+
 /** UserDefaults write 1 회. spawnSync exit code 0 = 성공. */
 function defaultsWrite(
   spawnFn: typeof defaultSpawnSync,
@@ -119,6 +132,8 @@ export function runNexusIosBind(opts: IosBindOpts = {}): IosBindResult {
   const readToken = opts.readTokenFn ?? defaultReadToken;
   const hostFallback = opts.hostFallback ?? DEFAULT_HOST_FALLBACK;
   const dryRun = opts.dryRun ?? false;
+  const resolveDomain = opts.resolveDomainFn
+    ?? (opts.spawnSyncFn || dryRun ? (id: string) => id : defaultResolveDomain);
 
   // 1) daemon 현재 host/port — override 가 우선 · 없으면 runtime sidecar ·
   //    port 가 없으면 현재 우주의 daemon endpoint 를 조회한다.
@@ -150,20 +165,22 @@ export function runNexusIosBind(opts: IosBindOpts = {}): IosBindResult {
   const tokenRaw = opts.noToken ? null : readToken();
   const token = tokenRaw ?? '';
 
-  // 3) UserDefaults write 3 회 (host · port · token)
+  // 3) UserDefaults write 3 회 (host · port · token) — 앱 컨테이너 도메인에
+  const domain = resolveDomain(bundleId);
   const lines: string[] = [];
-  const hostResult = defaultsWrite(spawnFn, bundleId, 'nexusHost', 'string', host, dryRun);
+  if (domain !== bundleId) lines.push(`  domain  앱 컨테이너 (${bundleId}) — 앱이 실행 중이면 끄고 다시 켜야 읽는다`);
+  const hostResult = defaultsWrite(spawnFn, domain, 'nexusHost', 'string', host, dryRun);
   lines.push(`  host  ${hostResult.ok ? '✓' : '✗'}  ${hostResult.cmd}`);
-  const portResult = defaultsWrite(spawnFn, bundleId, 'nexusPort', 'int', String(port), dryRun);
+  const portResult = defaultsWrite(spawnFn, domain, 'nexusPort', 'int', String(port), dryRun);
   lines.push(`  port  ${portResult.ok ? '✓' : '✗'}  ${portResult.cmd}`);
 
   let tokenInjected = false;
   let tokenLength = 0;
   if (!opts.noToken && token.length > 0) {
-    const tokenResult = defaultsWrite(spawnFn, bundleId, 'bearerToken', 'string', token, dryRun);
+    const tokenResult = defaultsWrite(spawnFn, domain, 'bearerToken', 'string', token, dryRun);
     tokenInjected = tokenResult.ok;
     tokenLength = token.length;
-    lines.push(`  token ${tokenResult.ok ? '✓' : '✗'}  xcrun simctl spawn booted defaults write ${bundleId} bearerToken <${tokenLength}-char redacted>`);
+    lines.push(`  token ${tokenResult.ok ? '✓' : '✗'}  xcrun simctl spawn booted defaults write ${domain} bearerToken <${tokenLength}-char redacted>`);
   } else if (opts.noToken) {
     lines.push(`  token —   (skipped · --no-token)`);
   } else {
@@ -173,19 +190,19 @@ export function runNexusIosBind(opts: IosBindOpts = {}): IosBindResult {
   let asciiKeyboardOk = true;
   if (opts.asciiKeyboard !== undefined) {
     const value = opts.asciiKeyboard ? 'true' : 'false';
-    const r = defaultsWrite(spawnFn, bundleId, 'asciiKeyboard', 'bool', value, dryRun);
+    const r = defaultsWrite(spawnFn, domain, 'asciiKeyboard', 'bool', value, dryRun);
     asciiKeyboardOk = r.ok;
     lines.push(`  ascii ${r.ok ? '✓' : '✗'}  ${r.cmd}`);
   }
 
   let seedPromptOk = true;
   if (opts.seedPrompt !== undefined) {
-    const r = defaultsWrite(spawnFn, bundleId, 'seedPrompt', 'string', opts.seedPrompt, dryRun);
+    const r = defaultsWrite(spawnFn, domain, 'seedPrompt', 'string', opts.seedPrompt, dryRun);
     seedPromptOk = r.ok;
     const preview = opts.seedPrompt.length > 24
       ? opts.seedPrompt.slice(0, 24) + '…'
       : opts.seedPrompt;
-    lines.push(`  seed  ${r.ok ? '✓' : '✗'}  xcrun simctl spawn booted defaults write ${bundleId} seedPrompt "${preview}" (${opts.seedPrompt.length} chars)`);
+    lines.push(`  seed  ${r.ok ? '✓' : '✗'}  xcrun simctl spawn booted defaults write ${domain} seedPrompt "${preview}" (${opts.seedPrompt.length} chars)`);
   }
 
   const allOk = hostResult.ok && portResult.ok

package/src/cli/phone-link.ts

@@ -0,0 +1,117 @@
+// `elanous phone link` — 휴대폰 앱을 이 Mac 의 넥서스에 «한 번에» 붙이는 연결 링크(⊕ 터미널 QR).
+// 대표 2026-09-30: 아이폰 첫 화면이 개발용 연결 카드라 복잡하다 → 앱은 링크 하나로 온보딩한다.
+// 링크 = `elanous://connect?host=…&port=…&tls=1|0&token=…` — 앱이 `.onOpenURL` 로 받아 저장하고 바로 연결한다.
+import { spawnSync } from 'node:child_process';
+import { debug } from '../debug/log.js';
+
+export interface PhoneEndpoint { host: string; port: number; tls: boolean }
+
+/** REST/PWA 기준 URL(예 `https://mbp.x.ts.net:31415/v1/`) → 앱이 쓰는 host·port·tls. 못 읽으면 null. */
+export function endpointFromBaseUrl(base: string): PhoneEndpoint | null {
+  let u: URL;
+  try { u = new URL(base); } catch { return null; }
+  if (u.protocol !== 'http:' && u.protocol !== 'https:') return null;
+  const tls = u.protocol === 'https:';
+  const port = u.port ? Number(u.port) : tls ? 443 : 80;
+  if (!u.hostname || !Number.isInteger(port) || port < 1 || port > 65_535) return null;
+  return { host: u.hostname, port, tls };
+}
+
+/** 앱이 여는 연결 링크. 토큰은 URL 인코딩한다. */
+export function buildPhoneConnectLink(ep: PhoneEndpoint, token: string): string {
+  const q = new URLSearchParams({ host: ep.host, port: String(ep.port), tls: ep.tls ? '1' : '0', token });
+  return `elanous://connect?${q.toString()}`;
+}
+
+/** 어느 주소를 휴대폰에 줄까 — 기본은 tailnet(휴대폰이 닿는다) · `local` 이면 루프백(같은 Mac 의 시뮬레이터). */
+export function pickPhoneBase(urls: { loopback: string; tailnet?: string }, opts: { local?: boolean } = {}): { base: string; kind: 'tailnet' | 'loopback' } {
+  if (!opts.local && urls.tailnet) return { base: urls.tailnet, kind: 'tailnet' };
+  return { base: urls.loopback, kind: 'loopback' };
+}
+
+/** USB 로 꽂힌 안드로이드에 링크를 «직접» 건넨다 — `adb reverse` 로 폰의 127.0.0.1:<port> 를 이 Mac 으로 잇고
+ *  `am start` 로 elanous://connect 를 연다. 토큰은 화면·로그에 찍지 않는다(adb 인자로만 간다). */
+export function androidDeliverySteps(link: string, port: number, serial?: string): string[][] {
+  const dev = serial ? ['-s', serial] : [];
+  return [
+    [...dev, 'reverse', `tcp:${port}`, `tcp:${port}`],
+    [...dev, 'shell', 'am', 'start', '-a', 'android.intent.action.VIEW', '-d', `'${link}'`, 'com.elanvitalai.elanous.android'],
+  ];
+}
+
+export interface RunPhoneLinkOpts {
+  local?: boolean;
+  /** USB 안드로이드에 adb 로 바로 건넨다(루프백 ⊕ adb reverse). 문자열이면 기기 serial. */
+  android?: boolean | string;
+  temp?: boolean;
+  ttl?: string;
+  qr?: boolean;
+  out?: { log: (s: string) => void; error: (s: string) => void };
+}
+
+export async function runPhoneLink(opts: RunPhoneLinkOpts = {}): Promise<number> {
+  const out = opts.out ?? { log: (s: string) => console.log(s), error: (s: string) => console.error(s) };
+  const { runNexusShow } = await import('./nexus-show.js');
+  const silent = { log: () => {}, error: () => {} };
+  const shown = await runNexusShow({ format: 'json', out: silent });
+  if (!shown.urls) {
+    out.error('✗ 넥서스가 떠 있지 않다 — 먼저 `elanous nexus run` (또는 `elanous nexus status` 로 확인).');
+    return 1;
+  }
+  const picked = pickPhoneBase(shown.urls.rest, { local: opts.local || !!opts.android });
+  const ep = endpointFromBaseUrl(picked.base);
+  if (!ep) { out.error(`✗ 넥서스 주소를 읽지 못했다: ${picked.base}`); return 1; }
+
+  let token: string;
+  let tokenNote: string;
+  if (opts.temp) {
+    const { issueTempToken, parseTtl } = await import('../auth/temp-tokens.js');
+    const issued = issueTempToken({ ttlMs: parseTtl(opts.ttl ?? '24h'), label: 'phone' });
+    token = issued.token;
+    tokenNote = `단기 토큰 · ${issued.expiresAt} 까지 · 폐기: elanous token revoke ${issued.id}`;
+  } else {
+    const { loadEnvelope } = await import('../auth/token-store.js');
+    const env = loadEnvelope();
+    if (!env?.active) { out.error('✗ 소유자 토큰이 없다 — `elanous token rotate` 로 한 번 만든 뒤 다시.'); return 1; }
+    token = env.active;
+    tokenNote = '소유자 토큰(설정의 Bearer 와 같다) · 바꾸려면 elanous token rotate';
+  }
+
+  const link = buildPhoneConnectLink(ep, token);
+  try { debug.log('phone.link', 'issued', { kind: picked.kind, tls: ep.tls, temp: !!opts.temp }); } catch { /* 관측 실패가 발급을 막지 않는다 */ }
+
+  if (opts.android) {
+    const serial = typeof opts.android === 'string' ? opts.android : undefined;
+    const lanEp = { ...ep, host: '127.0.0.1', tls: false };
+    const androidLink = buildPhoneConnectLink(lanEp, token);
+    for (const args of androidDeliverySteps(androidLink, lanEp.port, serial)) {
+      const r = spawnSync('adb', args, { encoding: 'utf8' });
+      if (r.status !== 0) {
+        // ⛔ 인자에 토큰이 있으므로 명령을 그대로 찍지 않는다 — 단계 이름과 adb 의 말만.
+        const why = (r.error?.message ?? r.stderr ?? '').trim().split('\n')[0] ?? '';
+        out.error(`✗ adb ${args.includes('reverse') ? 'reverse' : 'am start'} 실패 — ${why || `exit ${r.status}`}`);
+        out.error('  USB 디버깅 허용 · `adb devices` 에 기기가 «device» 로 보이는지 · 기기가 여럿이면 --android <serial>.');
+        return 1;
+      }
+    }
+    try { debug.log('phone.link', 'android-delivered', { port: lanEp.port, serial: !!serial, temp: !!opts.temp }); } catch { /* 관측 실패가 연결을 막지 않는다 */ }
+    out.log(`✓ 안드로이드 앱에 연결 링크를 건넸다 — 폰에서 앱이 열리고 바로 붙는다 (127.0.0.1:${lanEp.port} ⇄ 이 Mac · adb reverse).`);
+    out.error('⚠ USB 를 뽑으면 끊긴다. 계속 쓰려면 폰의 Tailscale 을 켜고 `elanous phone link` 의 QR 을 찍는다.');
+    out.error(`토큰: ${tokenNote}`);
+    return 0;
+  }
+
+  out.log('휴대폰에서 이 링크를 열면 앱이 바로 연결된다 (카메라로 QR · AirDrop · 메모 붙여넣기):');
+  out.log('');
+  out.log(link);
+  out.log('');
+  if (opts.qr !== false) {
+    const qr = spawnSync('qrencode', ['-t', 'ANSIUTF8', link], { encoding: 'utf8' });
+    if (qr.status === 0 && qr.stdout) out.log(qr.stdout);
+  }
+  out.error(`주소: ${ep.tls ? 'https' : 'http'}://${ep.host}:${ep.port} (${picked.kind === 'tailnet' ? 'tailnet — 휴대폰이 같은 tailnet 에 있어야 한다' : '루프백 — 이 Mac 의 시뮬레이터 전용'})`);
+  if (picked.kind === 'loopback' && !opts.local) out.error('⚠ tailnet 주소가 없다 — 실제 휴대폰에서는 닿지 않는다. `elanous nexus show` 로 tailnet 을 확인하라.');
+  out.error(`토큰: ${tokenNote}`);
+  out.error('⚠ 이 링크는 이 Mac 을 조작할 수 있는 토큰을 담는다 — 남에게 보내거나 공개 캡처에 싣지 않는다.');
+  return 0;
+}

package/src/cli/plugin-cli.ts

@@ -11,6 +11,8 @@ import { emitDecision } from '../live/detail-switch.js';
 import { OFFICIAL_INDEX_KEYS } from '../market/official-keys.js';
 import { installPlugin, listInstalledPlugins, PluginInstallError, removePlugin, type InstallEvent } from '../plugins/install/plugin-install.js';
 import { credentialStatus, setPluginCredentials } from '../plugins/install/plugin-credentials.js';
+import { makePlugin } from '../plugins/maker/plugin-maker.js';
+import { addAndInstallNode } from '../plugins/maker/node-install.js';
 
 function keys(): ReadonlyArray<{ keyId: string; publicKey: string }> {
   const configPath = userConfigPath();
@@ -56,6 +58,56 @@ function safeCause(error: unknown): string {
 
 export function registerPluginCommands(program: Command): void {
   const plugin = program.command('plugin').description('Install and manage Elanous plugins');
+  plugin.command('make <request>').description('Write, validate and install a local graph plugin from one request')
+    .option('--name <slug>', 'Local plugin name')
+    .option('--dir <parent>', 'Parent directory (default: instance plugins-local)')
+    .option('--run', 'Run the installed graph')
+    .option('--input <json>', 'JSON input for --run')
+    .option('--json', 'Print the result as JSON')
+    .action(async (request: string, opts: { name?: string; dir?: string; run?: boolean; input?: string; json?: boolean }) => {
+      try {
+        const result = await makePlugin({ request, name: opts.name, parentDir: opts.dir, run: opts.run,
+          ...(opts.input === undefined ? {} : { input: JSON.parse(opts.input) as unknown }) });
+        if (opts.json) stdout.write(JSON.stringify(result) + '\n');
+        else {
+          console.log(`뼈대 ${result.timings.scaffold}ms · 작성 ${result.timings.write}ms`);
+          console.log(`검증 오류 ${result.errors.length} · ${result.timings.validate}ms${result.timings.repair === undefined ? '' : ` · 수리 ${result.timings.repair}ms`}`);
+          console.log(`설치 ${result.timings.install === 0 && result.status === 'failed' ? '미실행' : result.status === 'failed' && result.timings.run === undefined ? '실패' : '완료'} · ${result.timings.install}ms (${result.dir})`);
+          if (opts.run) console.log(`실행 ${result.runStatus ?? '미실행'} · ${result.timings.run ?? 0}ms`);
+          for (const error of result.errors) console.error(error);
+        }
+        if (result.status === 'failed') process.exitCode = 1;
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        if (opts.json) stdout.write(JSON.stringify({ status: 'failed', errors: [message] }) + '\n');
+        else console.error(`plugin make failed: ${message}`);
+        process.exitCode = 1;
+      }
+    });
+  plugin.command('node').description('Manage plugin workflow nodes')
+    .command('add <dir> <request>').description('Write, validate and install a workflow node in a plugin')
+    .option('--kind <slug>', 'Workflow node kind')
+    .option('--yes', 'Accept requested capabilities')
+    .option('--json', 'Print the result as one JSON line')
+    .action(async (dir: string, request: string, opts: { kind?: string; yes?: boolean; json?: boolean }) => {
+      try {
+        const result = await addAndInstallNode({ dir, request, kind: opts.kind, yes: opts.yes,
+          deps: { consent: capabilities => askConsent(capabilities, !!opts.json) } });
+        if (opts.json) stdout.write(JSON.stringify(result) + '\n');
+        else {
+          console.log(`작성 ${result.timings.write}ms · 검증 ${result.timings.validate}ms${result.timings.repair === undefined ? '' : ` · 수리 ${result.timings.repair}ms`}`);
+          console.log(`설치 ${result.plugin ? '완료' : result.status === 'failed' && result.timings.install === 0 ? '미실행' : '실패'} · ${result.timings.install}ms`);
+          console.log(`동기화 ${result.status === 'installed' ? '완료' : result.plugin ? '실패' : '미실행'} · ${result.timings.sync}ms`);
+          for (const error of result.errors) console.error(error);
+        }
+        if (result.status === 'failed') process.exitCode = 1;
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        if (opts.json) stdout.write(JSON.stringify({ status: 'failed', errors: [message] }) + '\n');
+        else console.error(`plugin node add failed: ${message}`);
+        process.exitCode = 1;
+      }
+    });
   plugin.command('add <spec>').description('Install a local path, pinned git plugin or signed market plugin')
     .option('--yes', 'Accept requested capabilities')
     .option('--json', 'NDJSON progress events')

package/src/cli/pr-cli.ts

@@ -17,6 +17,7 @@ import { runMockModuleRestoreGate } from '../../scripts/ci-mock-module-restore-g
 import { runModelHardcodeGate } from '../../scripts/ci-model-hardcode-gate.js';
 import { runDaemonPortGate } from '../../scripts/ci-daemon-port-gate.js';
 import { runPublicLeakGate } from '../../scripts/ci-public-leak-gate.js';
+import { exportLeakCheck, type ExportLeakCheck } from '../../scripts/ci-public-export-leak-gate.js';
 import { checkCommands, extractElanousCommands, type Finding as DocsCliFinding } from '../../scripts/docs-cli-check.js';
 import { runTestInterferenceGate } from '../../scripts/ci-test-interference-gate.js';
 import { isGoalDocumentFileName } from '../self-implement/goal-document.js';
@@ -68,6 +69,8 @@ export interface PrLandOpts {
   excludeActiveRunFiles?: boolean;
   excludeActiveRunSources?: boolean;
   landReason?: string;
+  /** Land even though changed files would leak into the public export (the reason goes in --land-reason). */
+  allowPublicLeak?: boolean;
 }
 
 export interface PrGranularityOpts {
@@ -101,6 +104,8 @@ export interface PrLandDeps {
   runDaemonPortGate?: (out: { log: (message: string) => void; error: (message: string) => void }) => boolean;
   /** 공개 유출 래칫(경고 전용) — 반환 0 통과 · 1 늘었다 · 2 못 쟀다. */
   runPublicLeakGate?: (changedFiles: readonly string[], out: { log: (message: string) => void; error: (message: string) => void }) => number;
+  /** Test seam — the post-transform export leak check on changed files. */
+  runExportLeakCheck?: (changedFiles: readonly string[], cwd: string) => ExportLeakCheck;
   /** 공개 문서의 `elanous …` 호출 ↔ 실제 `--help` 대조(경고 전용) — 바뀐 공개 문서 경로를 받아 어긋남 목록을 돌려준다. */
   runDocsCliCheck?: (docFiles: readonly string[]) => DocsCliFinding[];
   /** 변경 시험 파일 간 간섭 검사 심(시험 주입용). */
@@ -269,6 +274,35 @@ function runPrLandPublicLeakGate(changedFiles: readonly string[], out: { log: (m
   return runPublicLeakGate({ args: ['--changed-files', ...changedFiles], log: out.log, error: out.log });
 }
 
+/** The prepare check on this landing's changed files — scripts/ci-public-export-leak-gate.ts. */
+export function runPrLandExportLeakCheck(changedFiles: readonly string[], cwd: string): ExportLeakCheck {
+  const top = runGitCommand(cwd, ['rev-parse', '--show-toplevel'], { encoding: 'utf-8' });
+  return exportLeakCheck(changedFiles, top.status === 0 && String(top.stdout ?? '').trim() ? String(top.stdout).trim() : cwd);
+}
+
+/** Blocks the landing when changed files would leak into the public export, unless allowPublicLeak. Returns false to stop. */
+export function exportLeakBlock(
+  changedFiles: readonly string[] | undefined,
+  check: () => ExportLeakCheck,
+  allow: boolean,
+  out: { log: (message: string) => void; error: (message: string) => void },
+): boolean {
+  if (!changedFiles || changedFiles.length === 0) return true;
+  let result: ExportLeakCheck;
+  try { result = check(); } catch (error) { result = { measured: false, hits: [], detail: error instanceof Error ? error.message : String(error) }; }
+  record('public-export-leak', result.measured ? result.hits.length === 0 || allow : true, { measured: result.measured, hits: result.hits.length, allowed: allow && result.hits.length > 0 });
+  if (!result.measured) { out.log(`⚠ public-export-leak: 못 쟀다(${result.detail ?? '?'}) — 착지는 막지 않는다. 확인: bun scripts/public-export.ts --leak-check --files <파일…>`); return true; }
+  if (result.hits.length === 0) { out.log('✓ public-export-leak: 바뀐 파일이 공개본에 사적 흔적을 싣지 않는다(prepare 와 같은 변환 뒤).'); return true; }
+  const write = allow ? out.log : out.error;
+  write(`${allow ? '⚠' : '✗'} public-export-leak: 바뀐 파일 ${result.hits.length}곳이 공개본에 사적 흔적을 싣는다 — 다음 release prepare 가 여기서 실패한다:`);
+  for (const h of result.hits.slice(0, 20)) write(`   ${h.file}:${h.line}  ${h.marker}`);
+  if (result.hits.length > 20) write(`   … 외 ${result.hits.length - 20}곳`);
+  write('   확인: bun scripts/public-export.ts --leak-check --all --files <파일…>');
+  if (allow) { out.log('   --allow-public-leak 로 넘긴다(이유는 --land-reason).'); return true; }
+  out.error('   고치거나, 공개본과 무관한 것이 확실하면 --allow-public-leak --land-reason "<이유>" 로 넘긴다.');
+  return false;
+}
+
 export function publicLeakWarning(
   changedFiles: readonly string[] | undefined,
   gate: (changedFiles: readonly string[], out: { log: (message: string) => void; error: (message: string) => void }) => number,
@@ -1286,6 +1320,7 @@ export async function runPrLand(opts: PrLandOpts = {}, deps: PrLandDeps = {}): P
 
   const changedPaths = currentChangePaths(run, cwd, staged, base, out);
   publicLeakWarning(changedPaths, deps.runPublicLeakGate ?? runPrLandPublicLeakGate, out);
+  if (!exportLeakBlock(changedPaths, () => (deps.runExportLeakCheck ?? runPrLandExportLeakCheck)(changedPaths ?? [], cwd), opts.allowPublicLeak === true, out)) return 1;
   if (publicDocPaths(changedPaths, () => true).length > 0) {
     const top = run('git', ['rev-parse', '--show-toplevel'], { cwd });
     const docsRoot = top.ok && top.out.trim() ? top.out.trim() : cwd;
@@ -1549,6 +1584,7 @@ export function registerPrCommands(program: Command, deps: PrLandDeps = {}): voi
     .option('--exclude-active-run-files', '도는 런과 겹친 파일을 이번 착지에서 제외')
     .option('--exclude-active-run-sources', '⚠ 위험: --exclude-active-run-files 가 골 문서가 아닌 파일(소스)을 빼도 착지를 강행')
     .option('--land-reason <text>', '권고를 보고도 지금 내는 이유(예: 남이 기다리는 차단 해제)')
+    .option('--allow-public-leak', '바뀐 파일이 공개본에 사적 흔적을 실어도 착지(이유는 --land-reason)')
     .action(async (opts: PrLandOpts) => {
       // ⛔⭐⭐⭐ **관측 sink 를 먼저 건다** — 라이브 도그푸드가 잡은 결함(2026-08-03).
       //   단위 테스트는 `debug.log` 가 **불렸다**를 단언하지만, standalone CLI 는 sink 를 등록하지

package/src/cli/private-ledger-commands.ts

@@ -0,0 +1,31 @@
+import { existsSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { Command } from 'commander';
+
+// Private local ledgers (decisions · directives) are absent from the public export;
+// JS-only distributions still register them. Kept out of src/index.ts so the `self`
+// block stays free of direct sink registration (see self-cli-sink-surface.test.ts).
+export function registerPrivateLedgerCommands(program: Command): void {
+  if (existsSync(resolve(import.meta.dir, 'decisions-cli.ts')) || existsSync(resolve(import.meta.dir, 'decisions-cli.js'))) {
+    program.command('decisions').description('대표 결정 로컬 원장').allowUnknownOption().allowExcessArguments(true)
+      .action(async (_opts: unknown, command: Command) => {
+        try { await (await import('../domains/standalone-log-sink.js')).registerStandaloneLogSink('decisions'); }
+        catch { /* Logging must not prevent recording a decision. */ }
+        const privateDecisionsModule: string = './decisions-cli.js';
+        const { registerDecisionsCommands } = await import(privateDecisionsModule) as { registerDecisionsCommands: (program: Command) => void };
+        const privateProgram = new Command();
+        registerDecisionsCommands(privateProgram);
+        await privateProgram.parseAsync(['decisions', ...command.args], { from: 'user' });
+      });
+  }
+  if (existsSync(resolve(import.meta.dir, 'directives-cli.ts')) || existsSync(resolve(import.meta.dir, 'directives-cli.js'))) {
+    program.command('directives').description('대표 지시 로컬 색인·검색').allowUnknownOption().allowExcessArguments(true)
+      .action(async (_opts: unknown, command: Command) => {
+        const privateDirectivesModule: string = './directives-cli.js';
+        const { registerDirectivesCommands } = await import(privateDirectivesModule) as { registerDirectivesCommands: (program: Command) => void };
+        const privateProgram = new Command();
+        registerDirectivesCommands(privateProgram);
+        await privateProgram.parseAsync(['directives', ...command.args], { from: 'user' });
+      });
+  }
+}

package/src/cli/provider-cli.ts

@@ -239,6 +239,9 @@ export function registerProviderCommands(program: Command): void {
       // ⛔⭐ 「후보」는 판정기가 «자기 자신을 뺀» 것이다 — 표면이 현재 계정을 후보로 보여 주면
       //   ***있지도 않은 선택지를 말한다***(리뷰 must-fix). 판정기와 같은 기준(storeKey)으로 거른다.
       const shownCandidates = s.candidates.filter((c) => c.storeKey !== s.current.storeKey);
+      const { codexCreditPlanFromDisk } = await import('./codex-credit-plan-view.js');
+      const { formatCodexCreditPlan } = await import('../budget/codex-credit-plan.js');
+      const creditPlan = codexCreditPlanFromDisk(now);
       const ageMinOf = (home: string | undefined): number | null => {
         if (!home) return null;
         const at = home === s.currentHome ? s.currentObservedAt : s.observedAtByHome[home];
@@ -258,6 +261,7 @@ export function registerProviderCommands(program: Command): void {
       if (opts.json) {
         await writeStdoutJson(JSON.stringify({
           policy: { value: s.policy.policy, source: s.policy.source },
+          creditPlan,
           universe: {
             instanceRoot, signalDir, authStore: authStorePath(),
             // ⭐ JSON 에도 싣는다 — 화면만 알면 스크립트가 못 센다
@@ -303,6 +307,7 @@ export function registerProviderCommands(program: Command): void {
       const policySource = s.policy.source === 'legacy-credits' ? ' · 옛 codexCreditsAllowed 에서'
         : s.policy.source === 'default' ? ' · 기본값' : '';
       console.log(`정책      ${s.policy.policy} (${CODEX_QUOTA_POLICY_LABEL[s.policy.policy]} · llm.codexQuotaPolicy)${policySource}`);
+      for (const line of formatCodexCreditPlan(creditPlan)) console.log(line);
       console.log(`지금 계정 ${s.current.name}  (source=${s.current.source})`);
       console.log(`          홈=${s.currentHome ?? '(모름)'}  사용=${s.currentUsedPercent ?? '?'}%  찼나=${s.currentReached ?? '모름'}  신호=${ageOf(s.currentHome)}  크레딧=${creditText(s.currentCreditBalance, s.currentHasCredits)}`);
       console.log('후보');