elanous 0.2.6 → 0.2.8

package/src/cli/doctor-bundle.ts

@@ -0,0 +1,128 @@
+import { spawnSync } from 'node:child_process';
+import { closeSync, existsSync, lstatSync, mkdtempSync, mkdirSync, openSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { homedir, platform, arch } from 'node:os';
+import { join, resolve, sep } from 'node:path';
+import { getElanousConfigDir } from '../elanous-config-dir.js';
+import { resolveCurrentInstance } from '../instance/current.js';
+import { LogStore, logsDbPath, type LogStoreRow } from '../mss/logging/log-store.js';
+import { cliVersion, codeRevision, packageVersion } from '../version/code-revision.js';
+import { runDoctor, defaultReadInstallPrefix, type DoctorOptions, type DoctorReport } from './doctor-cli.js';
+
+const REDACTED = '<redacted>';
+
+/** Recursively redact named secrets and secret-shaped text before serialization. */
+export function redactForBundle(value: unknown, home: string = homedir(), redactNamedFields: boolean = true): unknown {
+  if (typeof value === 'string') {
+    let text = value;
+    if (home && home !== sep) {
+      // Match the home as a path component, including JSON-escaped slashes.
+      const escaped = home.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+      text = text.replace(new RegExp(`${escaped}(?=[/\\\\]|$)`, 'g'), '~');
+    }
+    // By kind, not by the last example found: headers that carry credentials, credentials inside URLs,
+    // known token shapes, and any `name=value` / `"name": "value"` whose name says it is a credential.
+    return text
+      .replace(/\b((?:Proxy-)?Authorization\s*:\s*)[^\r\n"']+/gi, `$1${REDACTED}`)
+      .replace(/\b((?:Set-)?Cookie\s*:\s*)[^\r\n"']+/gi, `$1${REDACTED}`)
+      .replace(/\b([a-z][a-z0-9+.-]*:\/\/)[^\s/@"'<>]+@/gi, `$1${REDACTED}@`)
+      .replace(/(["']?(?:[\w-]*(?:token|key|secret|password|passwd|pwd|cookie|session|credential|auth))["']?\s*[:=]\s*["']?)[^\s"',}&]+/gi, `$1${REDACTED}`)
+      .replace(/\b(Bearer|Basic|Token)\s+[A-Za-z0-9._~+/=-]{8,}/g, `$1 ${REDACTED}`)
+      .replace(/\b(?:sk-[A-Za-z0-9_-]+|gh[pousr]_[A-Za-z0-9_]+|github_pat_[A-Za-z0-9_]+|glpat-[A-Za-z0-9_-]+|xox[a-z]-[A-Za-z0-9-]+|AKIA[0-9A-Z]{16}|AIza[0-9A-Za-z_-]{35})\b/g, REDACTED)
+      .replace(/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g, REDACTED);
+  }
+  if (Array.isArray(value)) return value.map((entry) => redactForBundle(entry, home, redactNamedFields));
+  if (value && typeof value === 'object') {
+    const result: Record<string, unknown> = Object.create(null);
+    for (const [key, entry] of Object.entries(value)) {
+      const safeKey = redactForBundle(key, home) as string;
+      result[safeKey] = redactNamedFields && /(?:token|key|secret|password|passwd|pwd|authorization|cookie|session|credential|auth)/i.test(key)
+        ? REDACTED : redactForBundle(entry, home, redactNamedFields);
+    }
+    return result;
+  }
+  return value;
+}
+
+export interface DoctorBundleOptions {
+  outDir: string;
+  now?: Date;
+  /** Read-only doctor seams for isolated tests. */
+  doctorOptions?: DoctorOptions;
+  home?: string;
+  configDir?: string;
+  logDbPath?: string;
+  doctorReport?: DoctorReport;
+}
+
+export interface DoctorBundleResult { path: string; files: string[]; bytes: number }
+
+/** Bundle only generated, redacted entries. Never put an unprocessed source file into tar. */
+export function buildDoctorBundle({ outDir, now = new Date(), doctorOptions = {}, home = homedir(), configDir = getElanousConfigDir(), logDbPath = logsDbPath(), doctorReport }: DoctorBundleOptions): DoctorBundleResult {
+  const instant = now.toISOString();
+  const stamp = instant.replace(/[-:]/g, '').slice(0, 15).replace('T', '-');
+  mkdirSync(outDir, { recursive: true, mode: 0o700 });
+  const destination = resolve(outDir, `elanous-diagnostics-${stamp}.tar.gz`);
+  if (existsSync(destination)) throw new Error('diagnostics archive already exists');
+  const work = mkdtempSync(join(outDir, '.elanous-diagnostics-'));
+  const files: string[] = [];
+  const put = (name: string, data: unknown): void => {
+    writeFileSync(join(work, name), JSON.stringify(redactForBundle(data, home, name === 'config.redacted.json' || name === 'onboarding.json'), null, 2) + '\n', { mode: 0o600 });
+    files.push(name);
+  };
+  try {
+    const report = doctorReport ?? runDoctor(doctorOptions);
+    const universe = resolveCurrentInstance({ cwd: () => process.cwd() });
+    const packageRoot = resolve(import.meta.dir, '../..');
+    const installPrefix = doctorOptions.readInstallPrefix?.() ?? defaultReadInstallPrefix(packageRoot, existsSync);
+    let logs: LogStoreRow[] = [];
+    let logStatus: 'ok' | 'no-store' = 'no-store';
+    if (existsSync(logDbPath)) {
+      try {
+        const store = LogStore.openReadOnly(logDbPath);
+        try {
+          logs = store.query({ sinceMs: now.getTime() - 86_400_000, untilMs: now.getTime(), limit: 500 });
+          logStatus = 'ok';
+        } finally { store.close(); }
+      } catch { /* Unreadable store: export no unverified log bytes. */ }
+    }
+    put('summary.json', {
+      version: packageVersion(), sha: codeRevision() ?? 'unknown', cliVersion: cliVersion(),
+      os: platform(), arch: arch(), node: process.version, bun: typeof Bun === 'undefined' ? null : Bun.version,
+      installPath: installPrefix ?? packageRoot,
+      universe: { kind: universe.kind, root: universe.root }, createdAt: instant, logs: logStatus,
+    });
+    put('doctor.json', report);
+    let config: unknown = {};
+    const configPath = doctorOptions.configPath ?? join(configDir, 'config.json');
+    try {
+      if (lstatSync(configPath).isFile()) config = JSON.parse(readFileSync(configPath, 'utf8'));
+    } catch { config = { status: 'unavailable' }; }
+    put('config.redacted.json', config);
+    put('credentials.json', report.credentials.map(({ name, resolved, source }) => ({ name, present: resolved, source })));
+    writeFileSync(join(work, 'logs-recent.jsonl'), logs.map((row) => {
+      const entry = row as { data: string | null };
+      let data = entry.data;
+      if (data) {
+        try { data = JSON.stringify(redactForBundle(JSON.parse(data), home)); }
+        catch { /* Non-JSON log bodies are redacted as plain text below. */ }
+      }
+      return JSON.stringify(redactForBundle({ ...row, data }, home, false));
+    }).join('\n') + (logs.length ? '\n' : ''), { mode: 0o600 });
+    files.push('logs-recent.jsonl');
+    const onboardingPath = join(configDir, 'onboarding.json');
+    try {
+      if (lstatSync(onboardingPath).isFile()) put('onboarding.json', JSON.parse(readFileSync(onboardingPath, 'utf8')));
+    } catch { /* An absent or unreadable optional record is not exported. */ }
+    const archiveFd = openSync(destination, 'wx', 0o600);
+    let tarSucceeded = false;
+    try {
+      const tar = spawnSync('tar', ['-czf', '-', '-C', work, ...files], { stdio: ['ignore', archiveFd, 'pipe'], timeout: 30_000 });
+      tarSucceeded = !tar.error && tar.status === 0;
+    } finally {
+      closeSync(archiveFd);
+      if (!tarSucceeded) rmSync(destination, { force: true });
+    }
+    if (!tarSucceeded) throw new Error('could not create diagnostics archive');
+    return { path: destination, files, bytes: statSync(destination).size };
+  } finally { rmSync(work, { recursive: true, force: true }); }
+}

package/src/cli/doctor-cli.ts

@@ -34,6 +34,10 @@ import { ADVISABLE_DOCTOR_FIX_IDS, adviseDoctorFixes, type DoctorAdvice } from '
 import { gitInstallPlan } from './git-install-plan.js';
 import { detectDistroFamily, parseOsRelease } from './doctor-distro.js';
 import { checkPythonEnv } from './python-cli.js';
+import { describeModes, formatModeLine, type DoctorMode } from './doctor-modes.js';
+import { formatDoctorLocalLlm, probeDoctorLocalLlm, type DoctorLocalLlm } from './doctor-local-llm.js';
+import type { LlmInventory } from '../llm/local-manager/types.js';
+import { buildDoctorBundle } from './doctor-bundle.js';
 
 function defaultCheckPythonEnv(): { status: 'ok' | 'fixable' | 'manual'; evidence: string; remedy?: string } {
   const c = checkPythonEnv(false);
@@ -99,6 +103,10 @@ export interface DoctorReport {
   externalCommands: DoctorExternalCommand[];
   requiredMissing?: string[];
   capabilitySummary?: DoctorCapabilitySummary;
+  /** Read-only configuration and chat-use status. Present on a successful report. */
+  modes?: DoctorMode[];
+  /** Local LLM inventory; CLI probes separately so synchronous credential reports stay read-only and unchanged. */
+  localLlm?: DoctorLocalLlm;
   /** F1 readiness. Present on a successful report. Absent when the report itself failed. */
   readiness?: ReadinessReport;
   reason?: string;
@@ -183,6 +191,8 @@ export interface DoctorCliDeps extends DoctorOptions, Pick<DoctorFixDeps, 'home'
   resolveAdviceProvider?: (config: UserConfig) => { provider: string; model: string; auth: string };
   confirmAdvice?: (message: string) => Promise<boolean>;
   adviceInteractive?: boolean;
+  /** Local-manager inventory seam; default calls getInventory(). */
+  localLlmInventory?: () => Promise<LlmInventory>;
 }
 
 const repositoryRoot = resolve(dirname(fileURLToPath(import.meta.url)), '../..');
@@ -1044,6 +1054,7 @@ export function runDoctor(options: DoctorOptions = {}): DoctorReport {
       externalCommands: externalCommands.commands,
       requiredMissing,
       capabilitySummary: summarizeDoctorCapabilities(credentials),
+      modes: describeModes(resolutionOptions.userConfig),
       readiness: evaluateReadiness(readiness),
       retiredConfigKeys: findRetiredConfigKeysInFile(options.configPath, readFile),
       ...(resourceMetadata.available ? {} : { catalogMetadataUnavailable: true }),
@@ -1136,6 +1147,8 @@ export function formatDoctorReport(report: DoctorReport, options: { credentials?
     }),
     ...(report.externalCommandsCatalogUnavailable ? [`External commands catalog unavailable: ${report.externalCommandsCatalogReason ?? 'catalog/external-commands.yaml is unavailable.'}`] : []),
     ...formatCapabilitySummary(capabilitySummary),
+    ...(report.modes ? ['모드:', ...report.modes.map((row) => `  ${formatModeLine(row)}`)] : []),
+    ...(report.localLlm ? formatDoctorLocalLlm(report.localLlm) : []),
   ].join('\n');
 }
 
@@ -1203,12 +1216,37 @@ export function registerDoctorCommand(program: Command, deps: DoctorCliDeps = {}
     .description('Reports whether credentials resolve and where each resolution comes from')
     .option('--json', 'structured output')
     .option('--credentials', 'show per-credential details in human-readable output')
+    .option('--bundle', 'write a redacted diagnostics archive for support')
+    .option('--out <dir>', 'output directory for --bundle')
     .option('--fix', 'show repairs; git installation asks on a TTY (other repairs require --yes)')
     .option('--advise', 'ask the configured LLM to rank catalog repairs (read-only advice)')
     .option('--yes', 'apply planned doctor repairs (requires --fix)')
     .option('--sudo', 'also run the planned sudo install lines — only where `sudo -n true` works (requires --fix --yes)')
     .option('--restart', 'restart the nexus service when it runs a different version than this installed copy, then verify it (requires --fix --yes · interrupts bots, terminals and running turns)')
-    .action(async (opts: { json?: boolean; credentials?: boolean; fix?: boolean; advise?: boolean; yes?: boolean; sudo?: boolean; restart?: boolean }) => {
+    .action(async (opts: { json?: boolean; credentials?: boolean; bundle?: boolean; out?: string; fix?: boolean; advise?: boolean; yes?: boolean; sudo?: boolean; restart?: boolean }) => {
+      if (opts.bundle) {
+        if (opts.fix || opts.advise || opts.yes || opts.sudo || opts.restart) {
+          err.error('--bundle cannot be combined with repair or advice options');
+          setExitCode(1);
+          return;
+        }
+        try {
+          // Same report as `doctor --json`, local LLM section included, so support sees what the user saw.
+          const doctorReport = runDoctor(deps);
+          if (doctorReport.ok) doctorReport.localLlm = await probeDoctorLocalLlm(deps.localLlmInventory);
+          const result = buildDoctorBundle({ outDir: opts.out ?? process.cwd(), doctorOptions: deps, doctorReport });
+          out.log(opts.json ? JSON.stringify(result) : [`Diagnostics: ${result.path} (${result.bytes} bytes)`, 'Contents:', ...result.files.map((file) => `  ${file}`)].join('\n'));
+        } catch {
+          err.error('Could not create diagnostics archive.');
+          setExitCode(1);
+        }
+        return;
+      }
+      if (opts.out !== undefined) {
+        err.error('--out requires --bundle');
+        setExitCode(1);
+        return;
+      }
       if (opts.yes && !opts.fix) {
         err.error('--yes requires --fix');
         setExitCode(1);
@@ -1235,6 +1273,7 @@ export function registerDoctorCommand(program: Command, deps: DoctorCliDeps = {}
         setExitCode(1);
         return;
       }
+      report.localLlm = await probeDoctorLocalLlm(deps.localLlmInventory);
       if (!opts.fix && !opts.advise) {
         out.log(opts.json ? JSON.stringify(report, null, 2) : formatDoctorReport(report, { credentials: opts.credentials }));
         if (report.requiredMissing?.length) setExitCode(1);
@@ -1353,6 +1392,7 @@ export function registerDoctorCommand(program: Command, deps: DoctorCliDeps = {}
         : undefined;
       // PATH cannot change in this process; re-probe readiness rather than treating a saved block as PATH=ok.
       const currentReport = results || gitInstall?.ran ? runDoctor(deps) : report;
+      if (currentReport.ok) currentReport.localLlm = report.localLlm;
       if (gitInstall?.ran && gitInstall.ok && currentReport.requiredMissing?.includes('git')) {
         gitInstall.detail = 'git init 성공 · 현재 doctor PATH 에서 git 을 찾지 못했습니다. 새 셸에서 다시 확인하세요.';
       }

package/src/cli/doctor-local-llm.ts

@@ -0,0 +1,95 @@
+import { debug } from '../debug/log.js';
+import { probeDocker } from '../llm/local-manager/docker-probe.js';
+import { probeLmstudio } from '../llm/local-manager/lmstudio-probe.js';
+import { probeMlx } from '../llm/local-manager/mlx-probe.js';
+import { listNodes } from '../llm/local-manager/node-registry.js';
+import { probeOllama } from '../llm/local-manager/ollama-probe.js';
+import type { LlmInventory, LlmModel, LlmNode, LlmRuntime } from '../llm/local-manager/types.js';
+
+export interface DoctorLocalLlm {
+  nodes: { kind: 'ollama' | 'lmstudio' | 'mlx' | 'docker'; baseUrl: string; reachable: boolean; models: string[] }[];
+  timedOut: boolean;
+  /** Inventory lookup failed; absence of servers was not established. */
+  failed?: boolean;
+}
+
+const kinds = ['ollama', 'lmstudio', 'mlx', 'docker'] as const;
+type Kind = (typeof kinds)[number];
+
+const baseUrlFields: Record<Kind, 'ollamaBaseUrl' | 'lmstudioBaseUrl' | 'mlxBaseUrl' | 'dockerBaseUrl'> = {
+  ollama: 'ollamaBaseUrl', lmstudio: 'lmstudioBaseUrl', mlx: 'mlxBaseUrl', docker: 'dockerBaseUrl',
+};
+
+type Probe = (node: { id: string; isLocal: boolean }, deps: { timeoutMs?: number }) => Promise<{ reachable: boolean; models: readonly LlmModel[]; warnings: readonly string[] }>;
+
+/** Doctor shows only this machine, so it probes only the local node — the full inventory also probes every remote
+ *  fleet node over ssh and took ~7 s cold, past the 3 s cap («시간 초과» with LM Studio running · 10-01). */
+export async function localInventory(deps: {
+  nodes?: () => readonly LlmNode[];
+  probes?: Record<'lmstudio' | 'ollama' | 'mlx' | 'docker', Probe>;
+  now?: () => number;
+} = {}): Promise<LlmInventory> {
+  const probes = deps.probes ?? { lmstudio: probeLmstudio, ollama: probeOllama, mlx: probeMlx, docker: probeDocker } as Record<'lmstudio' | 'ollama' | 'mlx' | 'docker', Probe>;
+  const read = deps.nodes ?? listNodes;
+  const nodes: LlmNode[] = [];
+  const models: LlmModel[] = [];
+  const warnings: string[] = [];
+  for (const node of read().filter((n) => n.isLocal)) {
+    const seed = { id: node.id, isLocal: true };
+    const order = ['lmstudio', 'ollama', 'mlx', 'docker'] as const;
+    const results = await Promise.all(order.map((kind) => probes[kind](seed, { timeoutMs: 2500 })));
+    const runtimes: LlmRuntime[] = order.filter((_, i) => results[i]!.reachable);
+    for (const [i, r] of results.entries()) { models.push(...r.models); for (const w of r.warnings) warnings.push(`${node.id}:${order[i]}:${w}`); }
+    // Probes record base URLs in the registry on success — read the node back for them.
+    const fresh = read().find((n) => n.id === node.id) ?? node;
+    nodes.push({ ...fresh, reachable: runtimes.length > 0, runtimes });
+  }
+  return { nodes, models, at: (deps.now ?? Date.now)(), cached: false, warnings };
+}
+
+export async function probeDoctorLocalLlm(inventory: () => Promise<LlmInventory> = () => localInventory(), timeoutMs = 3000): Promise<DoctorLocalLlm> {
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  let result: DoctorLocalLlm;
+  try {
+    const snapshot = await Promise.race([
+      Promise.resolve().then(inventory),
+      new Promise<null>((resolve) => { timer = setTimeout(() => resolve(null), timeoutMs); }),
+    ]);
+    result = snapshot === null
+      ? { nodes: [], timedOut: true }
+      : {
+        nodes: snapshot.nodes.filter((node) => node.isLocal).flatMap((node) => kinds.flatMap((kind) => {
+          const baseUrl = node[baseUrlFields[kind]];
+          if (!node.runtimes.includes(kind) && !baseUrl) return [];
+          return [{
+            kind,
+            baseUrl: baseUrl ?? '',
+            reachable: node.reachable === true && node.runtimes.includes(kind),
+            models: snapshot.models.filter((model) => model.nodeId === node.id && model.runtime === kind).map((model) => model.id),
+          }];
+        })),
+        timedOut: false,
+      };
+  } catch {
+    result = { nodes: [], timedOut: false, failed: true };
+  } finally {
+    if (timer !== undefined) clearTimeout(timer);
+  }
+  debug.log('doctor.local-llm', 'probed', {
+    nodes: result.nodes.length,
+    reachable: result.nodes.filter((node) => node.reachable).length,
+    models: result.nodes.reduce((total, node) => total + node.models.length, 0),
+    timedOut: result.timedOut,
+  });
+  return result;
+}
+
+export function formatDoctorLocalLlm(result: DoctorLocalLlm): string[] {
+  if (result.timedOut) return ['Local LLM:', '  시간 초과'];
+  if (result.failed) return ['Local LLM:', '  로컬 LLM 인벤토리를 조회하지 못했다'];
+  if (result.nodes.length === 0) return ['Local LLM:', '  로컬 LLM 서버를 찾지 못했다 — Ollama(:11434) · LM Studio(:1234) 를 띄우면 여기 보인다'];
+  return [
+    'Local LLM:',
+    ...result.nodes.map((node) => `  ${node.kind} · ${node.baseUrl} · ${node.reachable ? '닿음' : '안 닿음'} · 모델 ${node.models.length}개${node.models.length ? ` · ${node.models.slice(0, 5).join(', ')}` : ''}`),
+  ];
+}

package/src/cli/doctor-modes.ts

@@ -0,0 +1,48 @@
+import { DEFAULT_MODEL_TIER, isModelTier, type ModelTier } from '../model-tier/types.js';
+
+export interface DoctorMode {
+  id: 'model-tier' | 'auto-route' | 'fast-mode';
+  value: ModelTier | boolean | 'none';
+  source: 'config' | 'default' | 'none';
+  usedByChat: boolean;
+  note: string;
+}
+
+/** Report configured switches without changing them or implying they affect chat turns. */
+export function describeModes(cfg: { modelTier?: { llm?: unknown }; llm?: { autoRoute?: { enabled?: unknown } } }): DoctorMode[] {
+  const tier = cfg.modelTier?.llm;
+  const autoRoute = cfg.llm?.autoRoute?.enabled;
+  return [
+    {
+      id: 'model-tier',
+      value: isModelTier(tier) ? tier : DEFAULT_MODEL_TIER,
+      source: isModelTier(tier) ? 'config' : 'default',
+      usedByChat: false,
+      note: '대화 턴 모델 선택에 쓰이지 않는다(표시·전환 계획만)',
+    },
+    {
+      id: 'auto-route',
+      value: typeof autoRoute === 'boolean' ? autoRoute : false,
+      source: typeof autoRoute === 'boolean' ? 'config' : 'default',
+      usedByChat: false,
+      note: '오토파일럿 턴만 읽는다 · 켜기 = elanous config set llm.autoRoute.enabled true',
+    },
+    {
+      id: 'fast-mode',
+      value: 'none',
+      source: 'none',
+      usedByChat: false,
+      note: '스위치 없음(분류기 호출부 0)',
+    },
+  ];
+}
+
+export function formatModeLine(row: DoctorMode): string {
+  const label = {
+    'model-tier': 'smart·등급',
+    'auto-route': 'smart·자동 라우팅',
+    'fast-mode': '빠른 모드',
+  }[row.id];
+  const source = { config: '설정', default: '기본', none: '없음' }[row.source];
+  return `${label}: ${String(row.value)}(${source}) · 대화에 ${row.usedByChat ? '쓰임' : '안 쓰임'} — ${row.note}`;
+}

package/src/cli/import-cli.ts

@@ -0,0 +1,60 @@
+// EN4 — `elanous import`: one read-only plan over the agents you already use. Applying stays with the sub-commands each item names.
+import type { Command } from 'commander';
+import { homedir } from 'node:os';
+import { debug } from '../debug/log.js';
+import { formatImportPlan, planImport, type ImportPlan } from '../import/plan.js';
+import { applyImport, formatApplied, IMPORT_MODES, undoImport, type ImportMode } from '../import/apply.js';
+import { dirname, join } from 'node:path';
+
+export async function buildImportPlan(home = homedir()): Promise<ImportPlan> {
+  const { defaultSkillDirs, getUserConfig } = await import('../user-config.js');
+  const cfg = getUserConfig();
+  const plan = planImport({
+    home,
+    ...(process.env.CODEX_HOME ? { codexHome: process.env.CODEX_HOME } : {}),
+    activeSkillDirs: defaultSkillDirs(cfg),
+    mcpServerIds: (cfg.mcp?.servers ?? []).map((server) => server.id),
+  });
+  for (const item of plan.items) debug.log('import.plan', 'item', { source: item.source, kind: item.kind, status: item.status });
+  debug.log('import.plan', 'planned', { sources: plan.sources.filter((s) => s.detected).map((s) => s.id), items: plan.items.length });
+  return plan;
+}
+
+export function registerImportCommand(program: Command): void {
+  program.command('import')
+    .description('Show what elanous can bring over from Claude Code, Codex, ~/.agents, OpenClaw and Hermes — a plan first; `--apply` registers skills in place and adds MCP switched off, `--undo` puts everything back')
+    .option('--json', 'Print the plan (or the apply result) as JSON')
+    .option('--apply', 'Apply the plan: skills in place (ref) or as link/copy · MCP switched off · secrets and hooks only listed')
+    .option('--mode <mode>', `How skills come over: ${IMPORT_MODES.join('|')} (default ref — nothing copied)`)
+    .option('--pick <ids>', 'Only these item ids (comma-separated, see --json)')
+    .option('--undo', 'Undo the last --apply: restore the config bytes and remove links/copies')
+    .action(async (opts: { json?: boolean; apply?: boolean; mode?: string; pick?: string; undo?: boolean }) => {
+      const { userConfigPath } = await import('../user-config.js');
+      const importRoot = join(dirname(userConfigPath()), 'import');
+      if (opts.undo) {
+        const undone = undoImport(importRoot);
+        const { resetSkillIndex } = await import('../skills/index.js');
+        resetSkillIndex();
+        debug.log('import.apply', 'undone', { found: undone !== null, created: undone?.created.length ?? 0 });
+        if (opts.json) console.log(JSON.stringify({ undone: undone !== null }));
+        else console.log(undone ? `되돌렸습니다 — 설정을 ${undone.at} 이전으로 돌리고, 만든 것 ${undone.created.length}개를 지웠습니다.` : '되돌릴 가져오기가 없습니다.');
+        return;
+      }
+      const plan = await buildImportPlan();
+      if (!opts.apply) { console.log(opts.json ? JSON.stringify(plan, null, 2) : formatImportPlan(plan)); return; }
+      if (opts.mode !== undefined && !IMPORT_MODES.includes(opts.mode as ImportMode)) throw new Error(`--mode 는 ${IMPORT_MODES.join('|')} 중 하나다(받은 값: ${opts.mode})`);
+      const { getUserConfig, saveUserConfig } = await import('../user-config.js');
+      const cfg = getUserConfig();
+      const rawMcp = (cfg.raw.mcp && typeof cfg.raw.mcp === 'object' && !Array.isArray(cfg.raw.mcp) ? cfg.raw.mcp : {}) as Record<string, unknown>;
+      const manifest = applyImport(plan, { ...(opts.mode ? { mode: opts.mode as ImportMode } : {}), ...(opts.pick ? { pick: opts.pick.split(',').map((id) => id.trim()).filter(Boolean) } : {}) }, {
+        home: homedir(), configPath: userConfigPath(), importRoot,
+        sources: cfg.skills.sources ?? [],
+        rawMcpServers: (Array.isArray(rawMcp.servers) ? rawMcp.servers : []) as Array<Record<string, unknown>>,
+        save: (sources, servers) => saveUserConfig({ ...cfg, raw: { ...cfg.raw, mcp: { ...rawMcp, servers } }, skills: { ...cfg.skills, sources } }),
+      });
+      const { resetSkillIndex } = await import('../skills/index.js');
+      resetSkillIndex();
+      debug.log('import.apply', 'applied', { mode: manifest.mode, applied: manifest.applied.length, kept: manifest.kept.length, created: manifest.created.length });
+      console.log(opts.json ? JSON.stringify({ mode: manifest.mode, applied: manifest.applied, kept: manifest.kept, created: manifest.created.length }, null, 2) : formatApplied(manifest));
+    });
+}

package/src/cli/intake-cli.ts

@@ -11,6 +11,7 @@ import { writeStdoutFully } from './stdout-flush.js';
 import { runGitCommand } from '../git-fs/runner.js';
 import { debug } from '../debug/log.js';
 import { getUserConfig } from '../user-config.js';
+import { registerIntakeSourceCommands } from './intake-source-cli.js';
 
 export interface IntakeToTasksCliDeps {
   root: string;
@@ -91,6 +92,7 @@ export function resolveIntakeCheckRoot(
 export function registerIntakeCommands(program: Command): void {
   // ── intake check — 바깥 사실을 elanous 현재와 대조 (태스크 등록 없음) ──
   const intakeCmd = program.command('intake').description('바깥 사실·문서를 elanous 현재와 대조하거나 태스크로 받는다');
+  registerIntakeSourceCommands(intakeCmd);
   intakeCmd.hook('preAction', async () => {
     try {
       const { registerStandaloneLogSink } = await import('../domains/standalone-log-sink.js');
@@ -217,7 +219,9 @@ export function registerIntakeCommands(program: Command): void {
       const { readPipedStdin } = await import('./piped-stdin.js');
       const text = opts.file ? readFileSync(opts.file, 'utf8') : (await readPipedStdin()) ?? '';
       const { raws, bad } = parseRawIntakeJsonl(text);
-      const result = ingestIntakeItems(effectiveInstanceRoot(), opts.source as (typeof INTAKE_SOURCES)[number], raws);
+      let result: ReturnType<typeof ingestIntakeItems>;
+      try { result = ingestIntakeItems(effectiveInstanceRoot(), opts.source as (typeof INTAKE_SOURCES)[number], raws); }
+      catch (error) { console.error(error instanceof Error ? error.message : String(error)); process.exitCode = 2; return; }
       const out = { source: opts.source, inputLines: raws.length + bad, badInputLines: bad, ...result };
       if (opts.json) await writeStdoutFully(JSON.stringify(out, null, 2));
       else console.log(`흡수 원장 · ${opts.source}: 새 ${result.added} · 합침 ${result.merged} · 이미 끝난 것 ${result.seen} · 버림 ${result.skipped}${bad ? ` · 깨진 입력 ${bad}` : ''}${result.badLines ? ` · 깨진 원장 줄 ${result.badLines}` : ''}`);
@@ -228,14 +232,20 @@ export function registerIntakeCommands(program: Command): void {
     .description('흡수 원장 항목 보기 (최근 본 순)')
     .option('--status <status>', 'new | queued | absorbed | checked | routed | discarded | deferred')
     .option('--source <source>', '입력원으로 거르기')
+    .option('--seat <id>', '자리 id (별칭 허용; 자리 없는 옛 항목은 제외)')
     .option('--limit <n>', '최대 줄 수 (기본 30)')
     .option('--json', '구조화 출력')
-    .action(async (opts: { status?: string; source?: string; limit?: string; json?: boolean }) => {
+    .action(async (opts: { status?: string; source?: string; seat?: string; limit?: string; json?: boolean }) => {
       const { listIntakeItems } = await import('../intake-plane/items.js');
       const { effectiveInstanceRoot } = await import('../instance/resolve.js');
+      const { canonicalSeat } = await import('../intake-plane/intake-sources.js');
+      let seat: string | undefined;
+      try { seat = opts.seat === undefined ? undefined : canonicalSeat(opts.seat); }
+      catch (error) { console.error((error as Error).message); process.exitCode = 2; return; }
       const all = listIntakeItems(effectiveInstanceRoot(), {
         ...(opts.status ? { status: opts.status as never } : {}),
         ...(opts.source ? { source: opts.source as never } : {}),
+        ...(seat ? { seat } : {}),
       });
       const limit = Math.max(1, Number(opts.limit ?? 30) || 30);
       const shown = all.slice(0, limit);

package/src/cli/intake-source-cli.ts

@@ -0,0 +1,58 @@
+import type { Command } from 'commander';
+import { randomUUID } from 'node:crypto';
+import { effectiveInstanceRoot } from '../instance/resolve.js';
+import { addSource, canonicalSeat, dueSources, expiredSource, listSources, removeSource, runDue, type SourceKind } from '../intake-plane/intake-sources.js';
+
+export function registerIntakeSourceCommands(intake: Command, root: () => string = effectiveInstanceRoot): void {
+  const source = intake.command('source').description('자리별 흡수 원천과 주기 등록·조회·실행');
+  const fail = (error: unknown) => { console.error(error instanceof Error ? error.message : String(error)); process.exitCode = 2; };
+  source.command('add')
+    .requiredOption('--seat <id>', '자리 id 또는 별칭')
+    .requiredOption('--kind <kind>', 'github-query | rss | command')
+    .requiredOption('--spec <spec>', 'GitHub 질의 · 피드 URL · 명령')
+    .requiredOption('--every <cadence>', 'Nh | Nd | Nw')
+    .option('--until <date>', '만료 시작 날짜 YYYY-MM-DD (UTC)')
+    .option('--why <reason>', '등록 이유')
+    .option('--id <id>', '원천 id')
+    .action((opts: { seat: string; kind: string; spec: string; every: string; until?: string; why?: string; id?: string }) => {
+      try {
+        const added = addSource({ id: opts.id ?? `src-${randomUUID().slice(0, 8)}`, seat: opts.seat, kind: opts.kind as SourceKind,
+          spec: opts.spec, every: opts.every, ...(opts.until ? { until: opts.until } : {}), ...(opts.why ? { why: opts.why } : {}) }, root());
+        console.log(`${added.id}  ${added.seat}  ${added.kind}  ${added.every}`);
+      } catch (error) { fail(error); }
+    });
+  source.command('list')
+    .option('--seat <id>', '자리 id 또는 별칭')
+    .option('--json', 'JSON 출력')
+    .action((opts: { seat?: string; json?: boolean }) => {
+      try {
+        const now = new Date();
+        const sources = listSources({ seat: opts.seat }, root()).map((entry) => ({ ...entry, expired: expiredSource(entry, now) }));
+        if (opts.json) console.log(JSON.stringify(sources));
+        else for (const entry of sources) console.log(`${entry.id}  ${entry.seat}  ${entry.kind}  ${entry.every}  ${entry.expired ? '만료' : '활성'}  ${entry.spec}`);
+      } catch (error) { fail(error); }
+    });
+  source.command('remove <id>').action((id: string) => {
+    try { if (!removeSource(id, root())) { console.error(`원천 id 없음: ${id}`); process.exitCode = 2; return; } console.log(`removed ${id}`); }
+    catch (error) { fail(error); }
+  });
+  source.command('run-due')
+    .option('--seat <id>', '자리 id 또는 별칭')
+    .option('--dry-run', '기한 원천 목록만 · 수집·원장·마지막 실행 시각 무변')
+    .option('--json', 'JSON 출력')
+    .action(async (opts: { seat?: string; dryRun?: boolean; json?: boolean }) => {
+      try {
+        const seat = opts.seat === undefined ? undefined : canonicalSeat(opts.seat);
+        if (opts.dryRun) {
+          const sources = dueSources(new Date(), root()).filter((entry) => seat === undefined || entry.seat === seat);
+          if (opts.json) console.log(JSON.stringify(sources));
+          else for (const entry of sources) console.log(`${entry.id}  ${entry.seat}  ${entry.kind}  ${entry.every}`);
+          return;
+        }
+        const result = await runDue({ seat, deps: { stateDir: root() } });
+        if (opts.json) console.log(JSON.stringify(result));
+        else for (const row of result.ran) console.log(`${row.id}  ${row.items}${row.error ? `  실패: ${row.error}` : ''}`);
+        if (result.ran.some((row) => row.error)) process.exitCode = 1;
+      } catch (error) { fail(error); }
+    });
+}

package/src/cli/machine-cli.ts

@@ -1,4 +1,6 @@
 import type { Command } from 'commander';
+import { readFileSync, writeFileSync } from 'node:fs';
+import { loadMachineLedger, machineMarkdownPath, renderLedgerMarkdown, setMachineField } from '../machines/machine-ledger.js';
 import { MACHINE_NAME, resolveMachineName } from '../roles/machine-name.js';
 import { readMachineProfile, seatRank, validSeatRank, writeMachineProfile } from '../roles/machine-profile.js';
 
@@ -28,6 +30,27 @@ export function registerMachineCommands(program: Command, root?: string): void {
       writeMachineProfile({ id, duties, seats }, root);
       console.log(`machine · ${id} · ${duties.join(',') || '-'} · ${Object.entries(seats).map(([seat, value]) => `${seat}:${value.rank}`).join(',') || '-'}`);
     });
+  machine.command('render').description('YAML 원장에서 Markdown 생성·검증')
+    .option('--check', 'Markdown 과 YAML 동기화 검증')
+    .action((opts: { check?: boolean }) => {
+      const markdown = renderLedgerMarkdown(loadMachineLedger(process.cwd()));
+      const path = machineMarkdownPath(process.cwd());
+      if (opts.check) {
+        let current: string;
+        try { current = readFileSync(path, 'utf8'); } catch { throw new Error(`machine ledger Markdown missing: ${path}`); }
+        if (current !== markdown) throw new Error(`machine ledger Markdown stale: ${path}`);
+        console.log('machine render --check OK');
+      } else {
+        writeFileSync(path, markdown, 'utf8');
+        console.log(`machine render · ${path}`);
+      }
+    });
+  machine.command('ledger-set').description('YAML 보유 자원 필드 수정')
+    .argument('<id>').argument('<field>').argument('<value>')
+    .action((id: string, field: string, value: string) => {
+      setMachineField(process.cwd(), id, field, value);
+      console.log(`machine ledger-set · ${id} · ${field}`);
+    });
   machine.command('show').option('--json', 'JSON 출력')
     .action((opts: { json?: boolean }) => {
       const resolved = resolveMachineName({ root });

package/src/cli/mcp-login.ts

@@ -12,6 +12,7 @@ import {
 } from '../mcp/mcp-oauth.js';
 import { parseWwwAuthenticate } from '../mcp/client.js';
 import { debug } from '../debug/log.js';
+import { browserUnavailableReason } from '../oauth/browser-availability.js';
 
 const CALLBACK_PATH = '/oauth/callback';
 const DEFAULT_TIMEOUT_MS = 120_000;
@@ -31,6 +32,8 @@ export interface McpLoginOpts {
   readConfigFn?: () => { mcp?: { servers: McpServerSpec[] } };
   fetch?: McpOAuthFetch;
   openBrowser?: (url: string) => Promise<void>;
+  browserEnv?: NodeJS.ProcessEnv;
+  browserPlatform?: NodeJS.Platform;
   createListener?: (handler: (req: IncomingMessage, res: ServerResponse) => void) => Server;
   /** 발견한 issuer/tokenEndpoint 를 config 에 되쓰는 자리. 테스트 심. */
   persistDiscoveryFn?: (input: PersistDiscoveryInput) => PersistDiscoveryResult;
@@ -91,10 +94,16 @@ export async function runMcpLogin(opts: McpLoginOpts): Promise<McpLoginResult> {
     void callbackPromise.catch(() => undefined);
     out.log(`Open this URL to authorize '${opts.serverId}':`);
     out.log(authorization.request.url);
-    try {
-      await (opts.openBrowser ?? openDefaultBrowser)(authorization.request.url);
-    } catch {
-      out.error('Could not open the default browser; open the URL above manually.');
+    const why = browserUnavailableReason(opts.browserEnv ?? process.env, opts.browserPlatform ?? process.platform);
+    if (why) {
+      out.log(why);
+      debug.log('browser.open', 'skipped', { reason: why.includes('ssh') ? 'ssh' : 'no-display' });
+    } else {
+      try {
+        await (opts.openBrowser ?? openDefaultBrowser)(authorization.request.url);
+      } catch {
+        out.error('Could not open the default browser; open the URL above manually.');
+      }
     }
     const callback = await callbackPromise;
     await exchangeAuthorizationCode(authorization.metadata, authorization.request, callback, {