elanous 0.2.9 → 0.2.11

package/scripts/ci-public-export-leak-gate.ts

@@ -3,12 +3,15 @@
  * manifest transforms and private redactions applied, then the leak markers. A hit here fails the next prepare
  * (0.2.7: one test title), so `pr land` and the harness policy gates run it before landing.
  *
- *   bun scripts/ci-public-export-leak-gate.ts --changed-files a b …   # exit 1 on a hit · 0 when clean or not measurable
+ *   bun scripts/ci-public-export-leak-gate.ts --changed-files a b …   # exit 1 on a hit · 0 when clean
  */
 import { spawnSync } from 'node:child_process';
-import { existsSync } from 'node:fs';
-import { join, resolve } from 'node:path';
-import { privateRedactionsPath } from './public-export.js';
+import { existsSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, relative, resolve } from 'node:path';
+import { stringify } from 'yaml';
+import { computeSkillBoundaries, filterFilesBySkillVerdict } from './skill-boundary.js';
+import { loadExportConfig, privateRedactionsPath, selectExportFiles } from './public-export.js';
 
 export interface ExportLeakCheck {
   readonly measured: boolean;
@@ -16,29 +19,87 @@ export interface ExportLeakCheck {
   readonly detail?: string;
 }
 
-export function exportLeakCheck(changedFiles: readonly string[], root: string): ExportLeakCheck {
+/** Changed source paths that the public manifest would export; unknown skill boundaries remain in scope. */
+export function publicExportChangedFiles(changedFiles: readonly string[], root: string): string[] {
+  const config = loadExportConfig(root);
+  const selected = [...new Set([
+    ...selectExportFiles(changedFiles, config),
+    ...changedFiles.filter((file) => Object.values(config.replace).includes(file)),
+  ])];
+  if (!config.skills || !selected.some((file) => file.startsWith('skills/'))) return selected;
+  try {
+    const boundary = computeSkillBoundaries(root);
+    if (boundary.errors.length) return selected;
+    return filterFilesBySkillVerdict(selected, boundary, config.skills);
+  } catch { return selected; }
+}
+
+export function exportLeakCheck(changedFiles: readonly string[], root: string, spawn: typeof spawnSync = spawnSync): ExportLeakCheck {
   const script = join(root, 'scripts', 'public-export.ts');
   if (!existsSync(script)) return { measured: false, hits: [], detail: 'scripts/public-export.ts 없음' };
   // Without the private table (a Pod, a fresh machine) the markers still run; private identifiers are not checked.
   const privateList = existsSync(privateRedactionsPath()) ? [] : ['--no-private-list'];
-  const r = spawnSync('bun', [script, '--leak-check', '--json', '--all', ...privateList, '--files', ...changedFiles], { cwd: root, encoding: 'utf-8', timeout: 180_000, maxBuffer: 64 * 1024 * 1024 });
+  const args = ['--leak-check', '--json', '--all', ...privateList, '--files', ...changedFiles];
+  const run = (flags: string[]) => spawn('bun', [script, ...flags], { cwd: root, encoding: 'utf-8', timeout: 180_000, maxBuffer: 64 * 1024 * 1024 });
+  const initial = run(args);
+  if (initial.status !== 2) return measuredLeaks(initial);
+
+  const hits = [...String(initial.stderr).matchAll(/^⛔ skill boundary: ([^:\r\n]+):[^\r\n]*$/gm)]
+    .map((match) => ({ file: `skills/${match[1]}/SKILL.md`, line: 1, marker: 'skill-boundary' }));
+  if (!hits.length || !String(initial.stderr).trim().split(/\r?\n/).every((line) => /^⛔ skill boundary: [^:\r\n]+:[^\r\n]*$/.test(line))) {
+    return { measured: false, hits: [], detail: 'rc=2' };
+  }
+
+  // The exporter stops before scanning any changed file on a boundary error. Re-run its
+  // same transforms and leak check with only boundary selection disabled; retain the boundary hits.
+  let dir: string | undefined;
+  try {
+    const config = loadExportConfig(root);
+    dir = mkdtempSync(join(tmpdir(), 'public-export-leak-'));
+    const configPath = join(dir, 'export.yaml');
+    writeFileSync(configPath, stringify({ ...config, skills: undefined }));
+    const measured = measuredLeaks(run(['--config', relative(root, configPath), ...args]));
+    return { ...measured, hits: [...hits, ...measured.hits] };
+  } catch {
+    return { measured: false, hits, detail: 'skill boundary 뒤 재검사 실패' };
+  } finally {
+    if (dir) rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+function measuredLeaks(r: ReturnType<typeof spawnSync>): ExportLeakCheck {
   if (r.status !== 0 && r.status !== 1) return { measured: false, hits: [], detail: `rc=${r.status ?? r.signal}` };
   try {
-    const parsed = JSON.parse(String(r.stdout).trim().split('\n').at(-1) ?? '') as { hits?: Array<{ file: string; line: number; marker: string }> };
-    return { measured: true, hits: (parsed.hits ?? []).map((h) => ({ file: h.file, line: h.line, marker: h.marker })) };
+    const parsed: unknown = JSON.parse(String(r.stdout).trim().split('\n').at(-1) ?? '');
+    if (!parsed || typeof parsed !== 'object' || !('hits' in parsed) || !Array.isArray(parsed.hits)
+      || parsed.hits.some((h: unknown) => !h || typeof h !== 'object'
+        || typeof (h as { file?: unknown }).file !== 'string'
+        || typeof (h as { line?: unknown }).line !== 'number'
+        || typeof (h as { marker?: unknown }).marker !== 'string')) throw new Error('invalid hits');
+    return { measured: true, hits: parsed.hits.map((h: { file: string; line: number; marker: string }) => ({ file: h.file, line: h.line, marker: h.marker })) };
   } catch { return { measured: false, hits: [], detail: 'JSON 을 못 읽었다' }; }
 }
 
-/** Gate form for the harness policy gates: 1 on a hit, 0 when clean or not measurable (said in a line). */
+/** Gate form for the harness policy gates: 1 on a hit, 0 when clean (said in a line). */
 export function runPublicExportLeakGate(io: { args: readonly string[]; cwd: string; log: (line: string) => void; error: (line: string) => void }): number {
   const at = io.args.indexOf('--changed-files');
   const files = at >= 0 ? io.args.slice(at + 1).filter((a) => !a.startsWith('--')) : [];
   if (files.length === 0) return 0;
-  const result = exportLeakCheck(files, io.cwd);
-  if (!result.measured) { io.log(`⚠ public-export-leak: 못 쟀다(${result.detail ?? '?'})`); return 0; }
-  if (result.hits.length === 0) return 0;
-  io.error(`✗ public-export-leak: 바뀐 파일 ${result.hits.length}곳이 공개본에 사적 흔적을 싣는다 — 다음 release prepare 가 여기서 실패한다:`);
-  for (const h of result.hits) io.error(`   ${h.file}:${h.line}  ${h.marker}`);
+  let result: ExportLeakCheck;
+  try { result = exportLeakCheck(files, io.cwd); }
+  catch { result = { measured: false, hits: [], detail: '검사 실행 실패' }; }
+  if (!result.measured) {
+    let publicFiles: string[];
+    try { publicFiles = publicExportChangedFiles(files, io.cwd); }
+    catch { publicFiles = files; }
+    if (publicFiles.length === 0) { io.log('⚠ public-export-leak: 못 쟀다 — 공개 대상 변경 없음'); return 0; }
+    io.error(`✗ public-export-leak: 못 쟀다 — 막는다(${result.detail ?? '?'})`);
+    return 1;
+  }
+  const hits = result.hits.filter((hit) => hit.marker !== 'skill-boundary' || files.includes(hit.file));
+  if (hits.length === 0) return 0;
+  io.error(`✗ public-export-leak: 바뀐 파일 ${hits.length}곳이 공개본에 사적 흔적을 싣는다 — 다음 release prepare 가 여기서 실패한다:`);
+  for (const h of hits) io.error(`   ${h.file}:${h.line} · ${h.marker}`);
   io.error('   그 줄에서 표식·홈 경로·내부 문서 이름을 빼라(주석이면 공개본 변환이 지우는지 bun scripts/public-export.ts --leak-check --files <파일> 로 확인).');
   return 1;
 }

package/scripts/ci-public-leak-gate.ts

@@ -10,8 +10,8 @@
  *   bun scripts/ci-public-leak-gate.ts --changed-files a b …    # 그 파일들만 검사
  *   bun scripts/ci-public-leak-gate.ts --update                 # 기준선 재스냅샷(치운 뒤)
  *
- * ⛔ 이 게이트는 아직 `pr land` 에 «배선하지 않았다» — 다른 트랙의 주석 관례(대표 표기 기호 등)가 매일 늘어 배선 즉시 착지가 막힌다.
- *    배선은 조율 채널 합의 뒤(2026-09-24 🅢).
+ * `pr land` 는 변경 파일을 PR 트리에서 스캔하고 기준선은 base ref 에서 읽어 방향을 경고 전용으로 표시한다.
+ * 단독 CLI 의 기본 기준선은 현재 트리의 파일이며, 증가는 exit 1 이다.
  */
 import { existsSync, readFileSync, writeFileSync } from 'node:fs';
 import { join, resolve } from 'node:path';
@@ -57,6 +57,19 @@ export function renderBaseline(counts: ReadonlyMap<string, number>): string {
 
 export interface LeakGrowth { readonly marker: string; readonly file: string; readonly allowed: number; readonly now: number }
 
+/** 기준선과 현재 트리의 모든 차이(사라진 표지 포함). */
+export function findLeakChanges(current: ReadonlyMap<string, number>, baseline: ReadonlyMap<string, number>, only?: ReadonlySet<string>): LeakGrowth[] {
+  const out: LeakGrowth[] = [];
+  for (const key of new Set([...baseline.keys(), ...current.keys()])) {
+    const [marker, file] = key.split('\t') as [string, string];
+    if (only && !only.has(file)) continue;
+    const allowed = baseline.get(key) ?? 0;
+    const now = current.get(key) ?? 0;
+    if (now !== allowed) out.push({ marker, file, allowed, now });
+  }
+  return out.sort((a, b) => a.file.localeCompare(b.file) || a.marker.localeCompare(b.marker));
+}
+
 /** 기준선보다 «늘어난» (표지, 파일). `only` 가 있으면 그 파일만 본다. */
 export function findGrowth(current: ReadonlyMap<string, number>, baseline: ReadonlyMap<string, number>, only?: ReadonlySet<string>): LeakGrowth[] {
   const out: LeakGrowth[] = [];
@@ -81,6 +94,8 @@ export interface PublicLeakGateIo {
   readonly args?: readonly string[];
   readonly root?: string;
   readonly scan?: () => LeakHit[];
+  /** Read the baseline from the landing base commit, not the PR's working tree. */
+  readonly baselineRef?: string;
   readonly log?: (s: string) => void;
   readonly error?: (s: string) => void;
 }
@@ -100,14 +115,34 @@ export function runPublicLeakGate(io: PublicLeakGateIo = {}): number {
     log(`[public-leak-gate] baseline updated — ${[...current.values()].reduce((a, n) => a + n, 0)} hits · ${current.size} entries`);
     return 0;
   }
-  if (!existsSync(baselinePath)) { error(`[public-leak-gate] FAIL — 기준선이 없다: ${BASELINE_REL} (--update 로 만든다)`); return 2; }
-  const growth = findGrowth(current, parseBaseline(readFileSync(baselinePath, 'utf8')), only);
+  let baselineText: string;
+  if (io.baselineRef) {
+    const shown = spawnSync('git', ['-C', root, 'show', `${io.baselineRef}:${BASELINE_REL}`], { encoding: 'utf8', maxBuffer: 1 << 28 });
+    if (shown.status !== 0) { error(`[public-leak-gate] FAIL — ${io.baselineRef} 기준선을 못 읽었다: ${BASELINE_REL}`); return 2; }
+    baselineText = shown.stdout;
+  } else {
+    if (!existsSync(baselinePath)) { error(`[public-leak-gate] FAIL — 기준선이 없다: ${BASELINE_REL} (--update 로 만든다)`); return 2; }
+    baselineText = readFileSync(baselinePath, 'utf8');
+  }
+  const baseline = parseBaseline(baselineText);
+  const growth = findGrowth(current, baseline, only);
   const scope = only ? `변경 파일 ${only.size}개` : '전체';
-  if (growth.length === 0) { log(`[public-leak-gate] PASS — 유출이 늘지 않았다 (${scope})`); return 0; }
-  error(`[public-leak-gate] FAIL — 유출이 늘었다 (${scope} · ${growth.length}곳):`);
-  for (const g of growth) error(`  ${g.file}  ${g.marker}  ${g.allowed} → ${g.now}`);
-  error('  확인: bun scripts/public-export.ts --leak-check --path <파일> --all');
-  return 1;
+  if (growth.length > 0) {
+    error(`[public-leak-gate] FAIL — 유출이 늘었다 (${scope} · ${growth.length}곳):`);
+    for (const g of growth) error(`  ${g.file}  ${g.marker}  ${g.allowed} → ${g.now}`);
+    error('  확인: bun scripts/public-export.ts --leak-check --path <파일> --all');
+    return 1;
+  }
+  if (io.baselineRef) {
+    const shrunk = findLeakChanges(current, baseline, only).filter((change) => change.now < change.allowed);
+    if (shrunk.length > 0) {
+      log(`[public-leak-gate] SHRANK — 유출이 줄었다 · 기준선 --update 권장 (${scope} · ${shrunk.length}곳):`);
+      for (const g of shrunk) log(`  ${g.file}  ${g.marker}  ${g.allowed} → ${g.now}`);
+      return 3;
+    }
+  }
+  log(`[public-leak-gate] PASS — 유출이 늘지 않았다 (${scope})`);
+  return 0;
 }
 
 if (import.meta.main) process.exit(runPublicLeakGate());

package/scripts/ci-pwa-build-gate.ts

@@ -0,0 +1,160 @@
+#!/usr/bin/env bun
+// PWA build gate (GATE-PWA · 10-02 MAT1b near-miss: a PWA-bundled src module gained a TUI import and every gate passed).
+// The PWA is a static export outside `bun test`/tsc, so a change that reaches its bundle graph is built here.
+// Reach is decided by the TypeScript program of apps/pwa/tsconfig.json (aliases, extends, type imports included);
+// anything the program cannot decide is treated as reaching the PWA — «unsure» builds, it never skips.
+import { spawnSync } from 'node:child_process';
+import { existsSync, readdirSync } from 'node:fs';
+import { basename, dirname, extname, join, relative, resolve, sep } from 'node:path';
+import ts from 'typescript';
+import { debug } from '../src/debug/log.js';
+import { checkPwaBuildDeps } from '../src/cli/pwa-build.js';
+import { prepareDeterministicChildEnvironment } from './lib/deterministic-env.js';
+import { parseChangedFiles } from './ci-ios-unit-tests.js';
+
+const ROOT = join(import.meta.dir, '..');
+const PWA_PREFIX = 'apps/pwa/';
+const PWA_IGNORED = /^apps\/pwa\/(?:node_modules|\.next|out)\//;
+const TS_SOURCE = /\.(?:tsx?|mts|cts)$/;
+const CODE_OR_ASSET = /\.(?:[cm]?[jt]sx?|json|css|scss|svg|png|jpe?g|webp|woff2?)$/;
+
+export type BuildResult = { status: number | null; output: string; error?: Error };
+export type PwaGraph = { files: Set<string>; uncertain: string | null };
+export type PwaGateIo = {
+  args?: readonly string[];
+  cwd?: string;
+  log?: (line: string) => void;
+  error?: (line: string) => void;
+  /** Repo-relative changed files when `--changed-files` is absent (test seam · default git diff vs origin/main). */
+  changedFiles?: (root: string) => string[] | null;
+  graph?: (root: string) => PwaGraph;
+  runBuild?: (root: string) => BuildResult;
+};
+
+function defaultBuild(root: string): BuildResult {
+  const pwa = join(root, 'apps/pwa');
+  let deps = checkPwaBuildDeps(pwa);
+  if (!deps.ok) {
+    // Pod worktrees and fresh harvest trees often have no apps/pwa/node_modules — install once from the lockfile, then re-check.
+    const install = spawnSync('bun', ['install', '--frozen-lockfile'], { cwd: pwa, encoding: 'utf8', timeout: 300_000, maxBuffer: 16 * 1024 * 1024 });
+    try { debug.log('gate.pwa', 'deps-install', { status: install.status }); } catch { /* fail-soft */ }
+    deps = checkPwaBuildDeps(pwa);
+    if (!deps.ok) return { status: null, output: `apps/pwa/node_modules incomplete after install (rc=${install.status}): ${deps.missing.slice(0, 3).join(', ')}` };
+  }
+  const isolated = prepareDeterministicChildEnvironment('elanous-pwa-build-gate-');
+  try {
+    // Same build `nexus build` runs (runPwaBuild → bun run build), with HOME/state/config confined to a temp child env.
+    const result = spawnSync('bun', ['run', 'build'], { cwd: pwa, env: isolated.env, encoding: 'utf8', timeout: 300_000, maxBuffer: 32 * 1024 * 1024 });
+    return { status: result.status, output: `${result.stdout ?? ''}\n${result.stderr ?? ''}`, error: result.error };
+  } finally {
+    isolated.cleanup();
+  }
+}
+
+function defaultChangedFiles(root: string): string[] | null {
+  const r = spawnSync('git', ['diff', '--name-only', 'origin/main...HEAD'], { cwd: root, encoding: 'utf8' });
+  if (r.status !== 0) return null;
+  return r.stdout.split('\n').map((l) => l.trim()).filter(Boolean);
+}
+
+/** Dynamic import()/require() whose argument is not a string literal — the program cannot follow it. */
+function opaqueLoad(sf: ts.SourceFile): boolean {
+  let found = false;
+  const visit = (node: ts.Node): void => {
+    if (found) return;
+    if (ts.isCallExpression(node) && (node.expression.kind === ts.SyntaxKind.ImportKeyword
+      || (ts.isIdentifier(node.expression) && node.expression.text === 'require'))) {
+      const arg = node.arguments[0];
+      if (!arg || !(ts.isStringLiteral(arg) || ts.isNoSubstitutionTemplateLiteral(arg))) { found = true; return; }
+    }
+    ts.forEachChild(node, visit);
+  };
+  visit(sf);
+  return found;
+}
+
+/** Every repo file the PWA program loads, plus same-stem siblings (a `.d.ts` may stand in for the `.js` the bundler reads). */
+export function pwaGraph(root: string): PwaGraph {
+  const configPath = join(root, 'apps/pwa/tsconfig.json');
+  const read = ts.readConfigFile(configPath, ts.sys.readFile);
+  if (read.error) return { files: new Set(), uncertain: `tsconfig unreadable: ${ts.flattenDiagnosticMessageText(read.error.messageText, ' ')}` };
+  const parsed = ts.parseJsonConfigFileContent(read.config, ts.sys, dirname(configPath));
+  if (parsed.errors.some((d) => d.category === ts.DiagnosticCategory.Error)) {
+    return { files: new Set(), uncertain: `tsconfig invalid: ${ts.flattenDiagnosticMessageText(parsed.errors[0]!.messageText, ' ')}` };
+  }
+  const program = ts.createProgram({ rootNames: parsed.fileNames, options: { ...parsed.options, noEmit: true } });
+  const files = new Set<string>();
+  const absRoot = resolve(root) + sep;
+  for (const sf of program.getSourceFiles()) {
+    const abs = resolve(sf.fileName);
+    if (!abs.startsWith(absRoot) || abs.includes(`${sep}node_modules${sep}`)) continue;
+    const rel = relative(root, abs).split(sep).join('/');
+    files.add(rel);
+    // A non-literal import()/require() is a bundler «context»: anything beside it may be loaded — take the whole directory.
+    if (opaqueLoad(sf)) {
+      const dir = dirname(abs);
+      try {
+        for (const name of readdirSync(dir)) if (/\.(?:[cm]?[jt]sx?|json)$/.test(name)) files.add(relative(root, join(dir, name)).split(sep).join('/'));
+      } catch { return { files, uncertain: `cannot list ${relative(root, dir)} beside a non-literal import` }; }
+    }
+    const stem = basename(rel).replace(/\.d\.ts$|\.[^.]+$/, '');
+    for (const ext of ['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs', '.d.ts', '.json', '.css']) {
+      const sibling = join(dirname(rel), stem + ext).split(sep).join('/');
+      if (existsSync(join(root, sibling))) files.add(sibling);
+    }
+  }
+  return { files, uncertain: null };
+}
+
+export type PwaReach = { reaches: boolean; reason: string; hits: string[] };
+
+/** Decide whether a change set reaches the PWA build. Unknowns reach. */
+export function pwaReach(changed: readonly string[], graph: () => PwaGraph): PwaReach {
+  const pwaHits = changed.filter((f) => f.startsWith(PWA_PREFIX) && !PWA_IGNORED.test(f));
+  if (pwaHits.length) return { reaches: true, reason: `apps/pwa 변경 ${pwaHits.length}개`, hits: pwaHits };
+  // Any repo file the PWA program loads counts (src/, scripts/, shared roots); non-code files under src/ build conservatively.
+  const candidates = changed.filter((f) => CODE_OR_ASSET.test(f));
+  if (!candidates.length) return { reaches: false, reason: `변경 ${changed.length}개 중 코드·자산 파일 0개`, hits: [] };
+  let g: PwaGraph;
+  try { g = graph(); } catch (err) { return { reaches: true, reason: `PWA 그래프를 못 읽었다(${err instanceof Error ? err.message : String(err)}) — 닿는 것으로 본다`, hits: candidates }; }
+  if (g.uncertain) return { reaches: true, reason: `PWA 그래프 판정 불가(${g.uncertain}) — 닿는 것으로 본다`, hits: candidates };
+  const hits = candidates.filter((f) => g.files.has(f) || (f.startsWith('src/') && !TS_SOURCE.test(f)));
+  if (hits.length) return { reaches: true, reason: `PWA 가 닿는 파일 ${hits.length}개`, hits };
+  return { reaches: false, reason: `코드 변경 ${candidates.length}개 — PWA 그래프(${g.files.size}개) 밖`, hits: [] };
+}
+
+export function runPwaBuildGate(io: PwaGateIo = {}): number {
+  const log = io.log ?? console.log;
+  const error = io.error ?? console.error;
+  const root = io.cwd ?? ROOT;
+  if (!io.graph && !existsSync(join(root, 'apps/pwa/package.json'))) {
+    log('[pwa-gate] 해당 없음 — 이 트리에 apps/pwa 가 없다.');
+    return 0;
+  }
+  const changed = parseChangedFiles(io.args ?? process.argv.slice(2)) ?? (io.changedFiles ?? defaultChangedFiles)(root);
+  if (changed === null) {
+    error('[pwa-gate] 측정 불가 — 변경 파일 목록을 못 얻었다(git diff 실패).');
+    return 1;
+  }
+  const reach = pwaReach(changed, () => (io.graph ?? pwaGraph)(root));
+  try { debug.log('gate.pwa', reach.reaches ? 'reach' : 'skip', { changed: changed.length, hits: reach.hits.slice(0, 20), reason: reach.reason }); } catch { /* fail-soft */ }
+  if (!reach.reaches) {
+    log(`[pwa-gate] 해당 없음 — ${reach.reason}.`);
+    return 0;
+  }
+  log(`[pwa-gate] 대상 — ${reach.reason}${reach.hits.length ? ` (${reach.hits.slice(0, 5).join(', ')}${reach.hits.length > 5 ? ' …' : ''})` : ''} — PWA 빌드를 돌린다.`);
+  const started = Date.now();
+  const result = (io.runBuild ?? defaultBuild)(root);
+  const seconds = Math.round((Date.now() - started) / 1000);
+  try { debug.log('gate.pwa', 'build', { status: result.status, seconds }); } catch { /* fail-soft */ }
+  if (result.status === 0) {
+    log(`[pwa-gate] PASS — PWA 빌드 성공(${seconds}s).`);
+    return 0;
+  }
+  const tail = result.output.trim().split('\n').slice(-15).join('\n');
+  if (result.status === null) error(`[pwa-gate] 측정 불가 — 빌드를 못 돌렸다: ${result.error?.message ?? tail.split('\n').pop() ?? 'unknown'}`);
+  else error(`[pwa-gate] FAIL — PWA 빌드 실패(rc=${result.status} · ${seconds}s):\n${tail}`);
+  return 1;
+}
+
+if (import.meta.main) process.exit(runPwaBuildGate());

package/scripts/context-hooks/claude-stop.sh

@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+# Claude Code Stop hook; hook data travels only through stdin to the bounded extractor.
+SCRIPT_DIR="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)" || exit 0
+bun "$SCRIPT_DIR/emit.ts" stop </dev/stdin >/dev/null 2>&1 || true

package/scripts/context-hooks/emit.ts

@@ -0,0 +1,24 @@
+import { spawnSync } from 'node:child_process';
+
+const event = process.argv[2];
+if (event !== 'stop' && event !== 'post-tool-use') process.exit(0);
+
+try {
+  const payload = JSON.parse(await Bun.stdin.text()) as Record<string, unknown>;
+  // A locator is useful only when it is a session ID, not arbitrary hook input.
+  const session = payload.session_id;
+  if (typeof session !== 'string' || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(session)) process.exit(0);
+  const tool = payload.tool_name;
+  if (event === 'post-tool-use' && (typeof tool !== 'string' || !/^[a-z][a-z0-9_.:-]{0,63}$/i.test(tool))) process.exit(0);
+  // Only known tool identifiers can appear in the generated summary. Never copy hook free text.
+  const knownTools = new Set(['Read', 'Write', 'Edit', 'MultiEdit', 'Bash', 'Glob', 'Grep', 'LS',
+    'Task', 'WebFetch', 'WebSearch', 'NotebookEdit', 'TodoWrite', 'AskUserQuestion']);
+  const summary = event === 'stop' ? 'Claude Code session stopped'
+    : `Claude Code tool ${knownTools.has(tool as string) ? tool : 'other'} completed`;
+  const source = `elanous://context/claude-code/${session}`;
+  spawnSync('elanous', ['context', 'emit', '--kind', 'done', '--summary', summary, '--source', source], {
+    stdio: 'ignore', timeout: 3000,
+  });
+} catch {
+  // Hooks must not interrupt the seat session on malformed input or unavailable CLI.
+}

package/scripts/context-hooks/post-tool-use.sh

@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+# Claude Code PostToolUse hook; hook data travels only through stdin to the bounded extractor.
+SCRIPT_DIR="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)" || exit 0
+bun "$SCRIPT_DIR/emit.ts" post-tool-use </dev/stdin >/dev/null 2>&1 || true

package/scripts/coord-channel-watch.sh

@@ -48,8 +48,8 @@
 
 set -u
 
-PR_NUM="${CH_PR:-20798}"  # ⛔ 2026-09-27: #16815 가 2,500 상한에 닿아 채널 «5» 로 옮김(🅞 · 벽에 «닿은 뒤» — 미리 못 옮겼다)
-#   📏 이력: #5730(07-28~08-12) → #8328(08-11~08-25) → #12577(08-25~09-10) → #16815(09-10~09-27) → #20798.
+PR_NUM="${CH_PR:-23032}"  # ⛔ 2026-10-03: #20798 가 2,500 상한 → 채널 «6»(OP)  # ⛔ 2026-09-27: #16815 가 2,500 상한에 닿아 채널 «5» 로 옮김(🅞 · 벽에 «닿은 뒤» — 미리 못 옮겼다)
+#   📏 이력: #5730(07-28~08-12) → #8328(08-11~08-25) → #12577(08-25~09-10) → #16815(09-10~09-27) → #20798(09-27~10-03) → #23032.
 #   ***수명이 «2주 안팎»이다 — 세 판이 전부 그랬다.*** 다음 벽은 09-24 언저리.
 #   🩹 발신이 rc=1 이면 먼저 세라: gh api repos/ElanvitalAI/elanous/issues/<n> --jq .comments
 REPO="${CH_REPO:-ElanvitalAI/elanous}"
@@ -79,6 +79,18 @@ WATCH_EXIT_ANNOUNCED=0    # 종료 줄 중복 방지(INT→EXIT 로 trap 이 두
 # 「거의 비었다」로 «의심»할 자수 — 이 아래로 떨어지면 «변경»이 아니라 «의심»으로 말한다.
 BODY_MIN="${CH_BODY_MIN:-100}"
 
+# ⛔⭐ WATCH1(10-03 MK 6시간 실명): 감시자에 고정 토큰(GH_TOKEN·GITHUB_TOKEN — App 토큰은 1시간)을 넣어 띄우면
+#   만료 뒤 조회가 조용히 계속 실패한다. 읽기는 신원이 필요 없다 ⇒ 고정 토큰을 «비우고» keyring gh 인증으로 읽는다.
+#   그 토큰을 꼭 써야 하면 WATCH_KEEP_TOKEN=1 (그때도 경고 줄은 낸다).
+if [ -n "${GH_TOKEN:-}${GITHUB_TOKEN:-}" ]; then
+  if [ "${WATCH_KEEP_TOKEN:-}" = "1" ]; then
+    echo "⚠️ [watch] GH_TOKEN/GITHUB_TOKEN 고정 토큰으로 읽는다(WATCH_KEEP_TOKEN=1) — 만료되면 «⛔ 조회 실패» 줄이 뜬다"
+  else
+    echo "⚠️ [watch] GH_TOKEN/GITHUB_TOKEN 이 들어 있어 비웠다 — 읽기는 keyring gh 인증으로(고정 토큰은 만료돼 감시가 눈이 먼다 · WATCH1)"
+    unset GH_TOKEN GITHUB_TOKEN
+  fi
+fi
+
 CMD="ensure"
 TRACK=""
 ADOPT_PID=""
@@ -418,6 +430,23 @@ FALLBACK_USES=0
 #     「파이프를 통과하면 성패가 사라진다」와 같은 뿌리다.
 FALLBACK_FLAG="${TMPDIR:-/tmp}/ch-watch-fallback-$PR_NUM-$TRACK.$$"
 
+emit_comments() {  # $1=JSONL (line, archive, comment)
+  local out="$1" deferred
+  [ -n "$out" ] || return 0
+  if [ "${COORD_WATCH_SKIP_OTHERS_REPORTS:-}" = "1" ]; then
+    deferred=$(printf '%s\n' "$out" | jq -c 'select(.archive) | .comment') || return 1
+    if [ -n "$deferred" ]; then
+      mkdir -p "$HOME/.elanous/coord" || return 1
+      printf '%s\n' "$deferred" >> "$HOME/.elanous/coord/$SELF_ID-reports.jsonl" || return 1
+    fi
+  fi
+  if [ "${COORD_WATCH_SKIP_OTHERS_REPORTS:-}" = "1" ]; then
+    printf '%s\n' "$out" | jq -r 'select(.archive | not) | .line' || return 1
+  else
+    printf '%s\n' "$out" | jq -r '.line' || return 1
+  fi
+}
+
 fetch_comments() {   # $1=since(ISO8601) → stdout=포맷된 신규 행 · rc=0 성공 / rc=1 두 경로 다 실패
   local since="$1" out fmt
   # 두 경로가 «같은 형태»를 내도록 정규화된 객체 하나만 본다: {id, created_at, login, body}
@@ -426,13 +455,30 @@ fetch_comments() {   # $1=since(ISO8601) → stdout=포맷된 신규 행 · rc=0
   #     그 글은 필터를 «통과»했고 창에도 떴다 — 그런데 다른 글 사이에 섞여 «요청»으로 안 보였다.
   #   🔑 그러므로 결손은 「고르기」가 아니라 ***「고른 뒤 «구분»하지 않은 것」***이다.
   #   ⛔ 표지를 «본문 앞»에 둔다 — 뒤에 두면 BODY_CHARS 절단에 잘려 사라진다.
-  fmt="select(((.body | sub(\"^[[:space:]#]+\"; \"\")) | (startswith(\"**[$SELF_ID]\") or startswith(\"[$SELF_ID]\") or startswith(\"**[$SELF_ALIAS]\") or startswith(\"[$SELF_ALIAS]\"))) | not)
-       | \"[#$PR_NUM 신규 id=\" + (.id|tostring) + \" \" + .created_at + \" @\" + .login + \"]\"
-         + (if ((.body | test(\"$REQ_ADDR\")) or ((.body | test(\"$REQ_MARK\")) and (.body | test(\"부탁드립니다|부탁합니다\")))) then \" 🙋‼️ 나에게 온 «요청»\" else \"\" end)
-         + \" \" + (.body[:$BODY_CHARS] | gsub(\"\n\"; \" ⏎ \"))"
+  fmt=$(cat <<JQ
+select(((.body | sub("^[[:space:]#]+"; "")) | (startswith("**[$SELF_ID]") or startswith("[$SELF_ID]") or startswith("**[$SELF_ALIAS]") or startswith("[$SELF_ALIAS]"))) | not)
+| . as \$comment
+| ((.body | split("\n")[0] | capture("^[[:space:]#]*[*][*][[][^]]+[]][*][*][^\n]*→[[:space:]]*(?<to>[^\n]+?)[[:space:]]*·[[:space:]]*(?<kind>요청|결정|사고|보고|정정)[[:space:]]*·")) // null) as \$envelope
+| (if \$envelope == null then false else
+     (\$envelope.to | split("·") | map(gsub("^[[:space:]]+|[[:space:]]+$"; "")))
+     | any(.[]; . == "$SELF_ID" or . == "$SELF_ALIAS" or . == "전원")
+   end) as \$mine
+| ((.body | test("$REQ_ADDR")) or ((.body | test("$REQ_MARK")) and (.body | test("부탁드립니다|부탁합니다")))) as \$legacy_request
+| (\$envelope != null and \$envelope.kind == "보고" and (\$mine | not)) as \$archive
+| {comment: \$comment, archive: \$archive,
+   line: ("[#$PR_NUM 신규 id=" + (.id|tostring) + " " + .created_at + " @" + .login + "]"
+     + (if \$mine and \$envelope.kind == "결정" then " 🙋 나에게 «결정»"
+        elif \$mine and \$envelope.kind == "요청" then " 🙋 나에게 «요청»"
+        else "" end)
+     + (if \$legacy_request then " 🙋‼️ 나에게 온 «요청»" else "" end)
+     + (if \$envelope != null and (\$envelope.kind == "사고" or \$envelope.kind == "정정") then " 🚨"
+        elif \$archive then " 📄 보고" else "" end)
+     + " " + (.body[:$BODY_CHARS] | gsub("\n"; " ⏎ ")))}
+JQ
+)
   if out=$(gh api --paginate "repos/$REPO/issues/$PR_NUM/comments?since=$since" \
              --jq ".[] | {id, created_at, login: .user.login, body} | $fmt" 2>/dev/null); then
-    printf '%s' "$out"; return 0
+    emit_comments "$out"; return $?
   fi
   local owner="${REPO%%/*}" name="${REPO##*/}"
   if out=$(gh api graphql -f query="query{repository(owner:\"$owner\",name:\"$name\"){pullRequest(number:$PR_NUM){comments(last:$COMMENT_FALLBACK_LAST){nodes{databaseId createdAt author{login} body}}}}}" \
@@ -443,7 +489,7 @@ fetch_comments() {   # $1=since(ISO8601) → stdout=포맷된 신규 행 · rc=0
     # ⭐ 폴백이 «쓰였다»는 사실만 남긴다 — 세는 것도 알릴지 정하는 것도 «부모 셸»이 한다.
     #   ⛔ 여기서 세면 서브셸과 함께 사라진다(위 머리말).
     : > "$FALLBACK_FLAG" 2>/dev/null || true
-    printf '%s' "$out"; return 0
+    emit_comments "$out"; return $?
   fi
   return 1
 }