elanous 0.2.6 → 0.2.8

package/plugins/geo-check/README.md

@@ -6,8 +6,10 @@ Run from the repository without installing the plugin:
 elanous graph run plugins/geo-check/graphs/geo-check.yaml --input '{"brand":"Elanous","domain":"elanous.ai"}' --json
 ```
 
-Inputs: `brand` (required name), `domain` (optional website; without it, citation is unknown rather than no), `questions` (optional array of up to 8 questions; `[]` generates five unbranded customer questions), `engines` (optional array of up to 3 distinct provider names; defaults to `openai-codex` and `grok`), and `outDir` (optional output directory, default beside the graph run state file). Questions are passed to each engine via `elanous ask --json`, and searched with `elanous research --json --limit 5`. Each step's final stdout line is JSON with `calls` and `errors`. For test fixtures, `GEO_CHECK_ELANOUS_BIN` substitutes the CLI executable.
+Inputs: `brand` (required name), `domain` (optional website; without it, citation is unknown rather than no), `questions` (optional array of up to 8 questions; `[]` generates five unbranded customer questions), `engines` (optional array of up to 3 distinct provider names; defaults to `openai-codex` and `grok`), and `outDir` (optional output directory, default beside the graph run state file). Questions are passed to each engine via `elanous ask --bare --json` (the question alone, with no Elanous preamble or session; an older `elanous` without `--bare` falls back to `elanous ask --json` and the answer row carries `bare: false`), and searched with `elanous research --json --limit 5`. Each step's final stdout line is JSON with `calls` and `errors`. For test fixtures, `GEO_CHECK_ELANOUS_BIN` substitutes the CLI executable.
 
 Outputs: `report.md` has a one-line summary, question × engine mention/citation/rank/error table, evidence-linked suggestions when any question × engine cell is missing a mention or citation (no suggestions when no cells are missing), and the first 400 characters of each answer. `report.json` contains the same data and full answers. One engine can fail while the other completes; if every answer fails, the graph ends at `failed`. Research failures leave empty URL lists and an error count. The table is **a sample at that instant**, not a stable brand ranking: model answers change between runs.
 
 Release note metadata: feat — New geo-check plugin measures whether AI answer engines mention and cite your brand, and suggests fixes · kind: feat · document: plugins/geo-check/README.md · target: next.
+
+Every question is asked from a fresh empty folder, so files in the folder you run from (a brand repository, `AGENTS.md`, notes) never reach the answer engines. Rows marked `bare: false` passed through the Elanous assistant; when the brand being checked is Elanous itself, treat mentions in those rows as an upper bound.

package/plugins/geo-check/graphs/run-step.ts

@@ -1,4 +1,5 @@
-import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { mkdirSync, mkdtempSync, readFileSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
 
 type Data = Record<string, unknown>;
@@ -22,9 +23,18 @@ const engines = input.engines === undefined ? ['openai-codex', 'grok'] : strings
 if (!engines.length || engines.length > 3 || engines.length !== new Set(engines).size || (input.engines !== undefined && (!Array.isArray(input.engines) || strings(input.engines).length !== input.engines.length))) throw new Error('engines must contain 1 to 3 distinct names');
 const cli = process.env.GEO_CHECK_ELANOUS_BIN || 'elanous';
 
+// Ask from an empty folder: run inside a brand's own repository, `elanous ask` carries that project's
+// context (AGENTS.md and the like) and the answers «know» the brand — a marketer's folder inflated mentions 0/10 → 9/10.
+const neutralDir = mkdtempSync(join(tmpdir(), 'geo-check-'));
+function neutralEnv(engine?: string): Record<string, string | undefined> {
+  const { ELANOUS_TOOL_CWD: _tool, ...rest } = process.env;
+  return { ...rest, PWD: neutralDir, ...(engine ? { ELANOUS_LLM_PROVIDER: engine } : {}) };
+}
+
 async function invoke(args: string[], engine?: string): Promise<unknown> {
   const proc = Bun.spawn([cli, ...args], {
-    env: { ...process.env, ...(engine ? { ELANOUS_LLM_PROVIDER: engine } : {}) },
+    cwd: neutralDir,
+    env: neutralEnv(engine),
     stdout: 'pipe', stderr: 'pipe',
   });
   const [stdout, stderr, exit] = await Promise.all([new Response(proc.stdout).text(), new Response(proc.stderr).text(), proc.exited]);
@@ -33,6 +43,14 @@ async function invoke(args: string[], engine?: string): Promise<unknown> {
   if (!last) throw new Error('CLI returned no JSON');
   return JSON.parse(last) as unknown;
 }
+// An installed elanous older than `ask --bare` rejects the flag; ask the plain way and mark the row so the report can say so.
+async function askEngine(question: string, engine: string): Promise<{ answer: string; bare: boolean }> {
+  try { return { answer: reply(await invoke(['ask', '--bare', '--json', question], engine)), bare: true }; }
+  catch (e) {
+    if (!/unknown option '--bare'/.test(errorLine(e))) throw e;
+    return { answer: reply(await invoke(['ask', '--json', question], engine)), bare: false };
+  }
+}
 function reply(raw: unknown): string {
   const result = object(raw);
   if (typeof result.reply !== 'string') throw new Error('ask returned no reply');
@@ -105,7 +123,10 @@ async function run(step: string): Promise<void> {
     const answers: Data[] = [];
     let failures = 0;
     for (const question of questions) for (const engine of engines) {
-      try { answers.push({ question, engine, answer: reply(await invoke(['ask', '--json', question], engine)) }); }
+      try {
+        const { answer, bare } = await askEngine(question, engine);
+        answers.push({ question, engine, answer, ...(bare ? {} : { bare: false }) });
+      }
       catch (e) { failures++; answers.push({ question, engine, error: errorLine(e) }); }
     }
     output({ answers, outcome: failures === answers.length ? 'fail' : 'ok' }, answers.length, failures);
@@ -137,18 +158,42 @@ async function run(step: string): Promise<void> {
     if (!table.length) throw new Error('missing score table');
     const gaps = table.filter(cell => cell.error || !cell.mention || cell.citation === false).map(cell => ({ question: cell.question, engine: cell.engine, error: cell.error ?? null, mention: cell.mention, citation: cell.citation }));
     if (!gaps.length) { output({ suggestions: [] }); return; }
-    try {
-      const raw = parseArray(reply(await invoke(['ask', '--json', `Using ONLY this score table, return a JSON array of 3 to 5 improvement suggestions. Each must have "suggestion" (FAQ question, FAQPage/Organization structured data, comparison document, etc.) and "evidence" containing a question and engine from the missing cells. Evidence cells: ${JSON.stringify(gaps)}. Score table: ${JSON.stringify(table)}`])));
-      if (!Array.isArray(raw) || raw.length < 3 || raw.length > 5) throw new Error('invalid suggestion count');
-      const suggestions = raw.map(item => {
+    // A5c — the model often rewords a question or the engine name; one such item used to fail the whole step,
+    // so the same input passed and failed by turns. Evidence is now picked by id, matched leniently, and a wrong
+    // item is dropped (not fatal). Only «no valid suggestion at all» retries once, with a stricter prompt.
+    const cells = gaps.map((cell, id) => ({ id, ...cell }));
+    const norm = (value: unknown) => text(value).toLowerCase().replace(/["'“”‘’`]/g, '').replace(/\s+/g, ' ').trim();
+    const pick = (evidence: unknown) => {
+      if (typeof evidence === 'number') return cells[evidence];
+      const ev = object(evidence);
+      if (typeof ev.id === 'number' && cells[ev.id]) return cells[ev.id];
+      const q = norm(ev.question), e = norm(ev.engine);
+      const exact = cells.find(cell => norm(cell.question) === q && (!e || norm(cell.engine) === e));
+      if (exact) return exact;
+      const byQuestion = cells.filter(cell => q && (norm(cell.question).includes(q) || q.includes(norm(cell.question))));
+      return byQuestion.length === 1 ? byQuestion[0] : undefined;
+    };
+    const ask = async (strict: boolean) => parseArray(reply(await invoke(['ask', '--json', `Using ONLY this score table, return a JSON array of 3 to 5 improvement suggestions. Each item: {"suggestion": "<FAQ question, FAQPage/Organization structured data, comparison document, etc.>", "evidence": <id of one cell below>}.${strict ? ' The evidence MUST be one of the listed ids as a number. Return only the JSON array.' : ''} Evidence cells (pick by id): ${JSON.stringify(cells)}. Score table: ${JSON.stringify(table)}`])));
+    const collect = (raw: unknown) => {
+      if (!Array.isArray(raw)) return [];
+      const seen = new Set<string>();
+      return raw.slice(0, 5).flatMap(item => {
         const candidate = object(item);
-        const evidence = object(candidate.evidence);
-        const match = gaps.find(cell => cell.question === evidence.question && cell.engine === evidence.engine);
-        if (!text(candidate.suggestion) || !match) throw new Error('suggestion missing valid score evidence');
-        return { suggestion: text(candidate.suggestion), evidence: { question: match.question, engine: match.engine } };
+        const match = pick(candidate.evidence);
+        const suggestion = text(candidate.suggestion);
+        if (!suggestion || !match || seen.has(suggestion)) return [];
+        seen.add(suggestion);
+        return [{ suggestion, evidence: { question: match.question, engine: match.engine } }];
       });
-      output({ suggestions }, 1);
-    } catch (e) { output({ outcome: 'fail', suggestions: [], error: errorLine(e) }, 1, 1); }
+    };
+    let calls = 0;
+    try {
+      calls++;
+      let suggestions = collect(await ask(false));
+      if (!suggestions.length) { calls++; suggestions = collect(await ask(true)); }
+      if (!suggestions.length) throw new Error('suggestion missing valid score evidence');
+      output({ suggestions }, calls);
+    } catch (e) { output({ outcome: 'fail', suggestions: [], error: errorLine(e) }, calls || 1, 1); }
   } else if (step === 'report') {
     const table = rows(object(outputs.score).table);
     const answers = rows(object(outputs.answers).answers);

package/plugins/geo-check/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://antigravity.google/schemas/v1/plugin.json",
   "name": "geo-check",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Measure brand mentions and citations in AI answers and web results.",
   "extensions": {
     "ai.elanous": {

package/plugins/job-coach/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "job-coach",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Interview-to-NCS competency gap and cited course report.",
   "skills": "./skills/",
   "contributes": {

package/plugins/job-coach/README.md

@@ -46,7 +46,7 @@ elanous graph run /absolute/path/to/installed/job-coach/graphs/report-enterprise
 
 ## 실행
 
-공공데이터포털 [한국산업인력공단 NCS 기준정보 조회](https://www.data.go.kr/data/15128213/openapi.do) 활용신청 후 키를 **환경변수 `NCS_SERVICE_KEY`** 로 설정한다. 설치 시 `credentials` 이벤트의 `ncs.serviceKey` 에 입력하는 경로는 플러그인 설치기가 담당한다. 저장소에는 키를 넣지 않는다. `.mcp.json`은 MCP stdio 서버를 번들로 제공한다. 레시피는 러너가 제공하는 `ELANOUS_GRAPH_DIR`을 기준으로 번들 스크립트를 찾고, MCP의 `${CODEX_PLUGIN_ROOT}`는 Codex가 설치한 플러그인의 절대 경로로 치환한다. 런타임에는 `bun`과 PATH의 `elanous research --json`가 필요하다. 중첩 elanous 호출에는 `--test`를 붙여 격리한다. 인터뷰 파일은 `## 희망 직무`, `## 경험`, `## 보유 역량`을 포함해야 한다.
+공공데이터포털 [한국산업인력공단 NCS 기준정보 조회](https://www.data.go.kr/data/15128213/openapi.do) 활용신청 후 키를 **환경변수 `NCS_SERVICE_KEY`** 로 설정한다. 설치 시 `credentials` 이벤트의 `ncs.serviceKey` 에 입력하는 경로는 플러그인 설치기가 담당한다. 저장소에는 키를 넣지 않는다. `.mcp.json`은 MCP stdio 서버를 번들로 제공한다. 레시피는 러너가 제공하는 `ELANOUS_GRAPH_DIR`을 기준으로 번들 스크립트를 찾고, MCP의 `${CODEX_PLUGIN_ROOT}`는 Codex가 설치한 플러그인의 절대 경로로 치환한다. 런타임에는 `bun`과 PATH의 `elanous research --json`가 필요하다. 중첩 elanous 호출은 그래프를 돌린 우주를 그대로 따른다(`--test` 를 붙이지 않는다 — 저장소 밖에서는 `--test` 가 격리 루트를 못 정해 멈춘다). 인터뷰 파일은 `## 희망 직무`, `## 경험`, `## 보유 역량`을 포함해야 한다.
 
 ```sh
 elanous graph run /absolute/path/to/installed/job-coach/graphs/report.yaml --input '{"interview":"/absolute/path/to/installed/job-coach/examples/interview-sample.md"}' --json

package/plugins/job-coach/graphs/run-step.ts

@@ -230,7 +230,7 @@ async function run(step: string) {
     const profile = value(outputs.profile);
     const query = `${list(profile.jobs).join(' ')} 역량 교육 과정 강의 공식 출처`;
     if (!query.trim()) throw new Error('missing job for research');
-    const cli = Bun.spawn(['elanous', '--test', 'research', query, '--json'], { env: process.env, stdout: 'pipe', stderr: 'pipe' });
+    const cli = Bun.spawn(['elanous', 'research', query, '--json'], { env: process.env, stdout: 'pipe', stderr: 'pipe' });
     const stdout = await new Response(cli.stdout).text();
     const stderr = await new Response(cli.stderr).text();
     if (await cli.exited !== 0) throw new Error(`research failed: ${stderr.slice(0, 300)}`);
@@ -253,7 +253,7 @@ async function run(step: string) {
       return;
     }
     const gaps = await judgeGaps(units, interview, async prompt => {
-      const cli = Bun.spawn(['elanous', '--test', 'ask', '--json', prompt], { env: process.env, stdout: 'pipe', stderr: 'pipe' });
+      const cli = Bun.spawn(['elanous', 'ask', '--json', prompt], { env: process.env, stdout: 'pipe', stderr: 'pipe' });
       const stdout = await new Response(cli.stdout).text();
       await new Response(cli.stderr).text();
       if (await cli.exited !== 0) throw new Error('gap LLM failed');

package/plugins/job-coach/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://antigravity.google/schemas/v1/plugin.json",
   "name": "job-coach",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Interview-to-NCS competency gap and cited course report.",
   "skills": "./skills/",
   "contributes": {

package/plugins/job-coach/plugin.ts

@@ -1,6 +1,6 @@
 export default {
   name: 'job-coach',
-  version: '0.1.0',
+  version: '0.1.1',
   initialState: () => ({}),
   panes: {},
 };

package/scripts/affinity/endcard.sh

@@ -15,13 +15,14 @@ CFG=$(OUT="$OUT" W="$W" H="$H" T="$TITLE" G="$TAG" F="$FOOT" python3 -c '
 import json, os
 print(json.dumps({"out": os.environ["OUT"], "width": int(os.environ["W"]), "height": int(os.environ["H"]),
                   "title": os.environ["T"], "tagline": os.environ["G"], "footer": os.environ["F"]}))')
-TMP=$(mktemp -t endcard).js
+TMP_DIR=$(mktemp -d "${TMPDIR:-/tmp}/endcard.XXXXXX") || { echo "⛔ 임시 스크립트를 만들지 못했다" >&2; exit 1; }
+TMP="$TMP_DIR/endcard.js"
 CFG="$CFG" python3 -c '
 import os, io, sys
 io.open(sys.argv[2], "w", encoding="utf-8").write(
   io.open(sys.argv[1], encoding="utf-8").read().replace("__CFG__", os.environ["CFG"]))' "$HERE/endcard.js" "$TMP"
 out=$(python3 "$AFF" run "$TMP" 2>&1); rc=$?
-rm -f "$TMP"; echo "$out"
+rm -f "$TMP"; rmdir "$TMP_DIR"; echo "$out"
 printf '%s' "$out" | grep -qE '^Error:|Uncaught|TypeError|ReferenceError' && exit 1
 [ $rc -ne 0 ] && exit 1
 [ -f "$OUT" ] || { echo "⛔ 산출이 «없다»: $OUT" >&2; exit 1; }

package/scripts/affinity/reframe.sh

@@ -37,7 +37,8 @@ print(json.dumps({"src": os.environ["SRC"], "out": os.environ["OUT"],
                   "width": int(os.environ["W"]), "height": int(os.environ["H"]),
                   "blur": float(os.environ["BLUR"]), "mirror": os.environ["MIRROR"] == "1"}))')
 
-TMP=$(mktemp -t reframe).js
+TMP_DIR=$(mktemp -d "${TMPDIR:-/tmp}/reframe.XXXXXX") || { echo "⛔ 임시 스크립트를 만들지 못했다" >&2; exit 1; }
+TMP="$TMP_DIR/reframe.js"
 CFG="$CFG" python3 -c '
 import os, io, sys
 src = io.open(sys.argv[1], encoding="utf-8").read()
@@ -46,6 +47,7 @@ io.open(sys.argv[2], "w", encoding="utf-8").write(src.replace("__CFG__", os.envi
 
 out=$(python3 "$AFF" run "$TMP" 2>&1); rc=$?
 rm -f "$TMP"
+rmdir "$TMP_DIR"
 echo "$out"
 # ⛔ aff.py 는 스크립트 «안»의 오류도 exit 0 으로 낼 수 있다 — 산출을 «읽어서» 가른다.
 if printf '%s' "$out" | grep -qE '^Error:|Uncaught|TypeError|ReferenceError'; then exit 1; fi

package/scripts/ci-public-export-leak-gate.ts

@@ -0,0 +1,48 @@
+/**
+ * Public export leak check on changed files (LEAK1) — the same check `release prepare` fails on:
+ * manifest transforms and private redactions applied, then the leak markers. A hit here fails the next prepare
+ * (0.2.7: one test title), so `pr land` and the harness policy gates run it before landing.
+ *
+ *   bun scripts/ci-public-export-leak-gate.ts --changed-files a b …   # exit 1 on a hit · 0 when clean or not measurable
+ */
+import { spawnSync } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { privateRedactionsPath } from './public-export.js';
+
+export interface ExportLeakCheck {
+  readonly measured: boolean;
+  readonly hits: ReadonlyArray<{ readonly file: string; readonly line: number; readonly marker: string }>;
+  readonly detail?: string;
+}
+
+export function exportLeakCheck(changedFiles: readonly string[], root: string): ExportLeakCheck {
+  const script = join(root, 'scripts', 'public-export.ts');
+  if (!existsSync(script)) return { measured: false, hits: [], detail: 'scripts/public-export.ts 없음' };
+  // Without the private table (a Pod, a fresh machine) the markers still run; private identifiers are not checked.
+  const privateList = existsSync(privateRedactionsPath()) ? [] : ['--no-private-list'];
+  const r = spawnSync('bun', [script, '--leak-check', '--json', '--all', ...privateList, '--files', ...changedFiles], { cwd: root, encoding: 'utf-8', timeout: 180_000, maxBuffer: 64 * 1024 * 1024 });
+  if (r.status !== 0 && r.status !== 1) return { measured: false, hits: [], detail: `rc=${r.status ?? r.signal}` };
+  try {
+    const parsed = JSON.parse(String(r.stdout).trim().split('\n').at(-1) ?? '') as { hits?: Array<{ file: string; line: number; marker: string }> };
+    return { measured: true, hits: (parsed.hits ?? []).map((h) => ({ file: h.file, line: h.line, marker: h.marker })) };
+  } catch { return { measured: false, hits: [], detail: 'JSON 을 못 읽었다' }; }
+}
+
+/** Gate form for the harness policy gates: 1 on a hit, 0 when clean or not measurable (said in a line). */
+export function runPublicExportLeakGate(io: { args: readonly string[]; cwd: string; log: (line: string) => void; error: (line: string) => void }): number {
+  const at = io.args.indexOf('--changed-files');
+  const files = at >= 0 ? io.args.slice(at + 1).filter((a) => !a.startsWith('--')) : [];
+  if (files.length === 0) return 0;
+  const result = exportLeakCheck(files, io.cwd);
+  if (!result.measured) { io.log(`⚠ public-export-leak: 못 쟀다(${result.detail ?? '?'})`); return 0; }
+  if (result.hits.length === 0) return 0;
+  io.error(`✗ public-export-leak: 바뀐 파일 ${result.hits.length}곳이 공개본에 사적 흔적을 싣는다 — 다음 release prepare 가 여기서 실패한다:`);
+  for (const h of result.hits) io.error(`   ${h.file}:${h.line}  ${h.marker}`);
+  io.error('   그 줄에서 표식·홈 경로·내부 문서 이름을 빼라(주석이면 공개본 변환이 지우는지 bun scripts/public-export.ts --leak-check --files <파일> 로 확인).');
+  return 1;
+}
+
+if (import.meta.main) {
+  process.exit(runPublicExportLeakGate({ args: process.argv.slice(2), cwd: resolve(import.meta.dir, '..'), log: console.log, error: console.error }));
+}