elanous 0.2.9 → 0.2.11

package/src/cli/drive-input-jail.ts

@@ -0,0 +1,101 @@
+import { realpathSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, isAbsolute, relative, sep } from 'node:path';
+
+export type DriveInputJailVerdict =
+  | { readonly allowed: true }
+  | { readonly allowed: false; readonly reason: 'outside-jail'; readonly path: string };
+
+/** Resolve each existing component before applying the next '..', including write targets. */
+function canonicalPath(path: string): string {
+  let current = isAbsolute(path) ? sep : realpathSync(process.cwd());
+  for (const part of path.split(sep)) {
+    if (!part || part === '.') continue;
+    if (part === '..') {
+      current = dirname(current);
+      continue;
+    }
+    const next = `${current === sep ? '' : current}${sep}${part}`;
+    try {
+      current = realpathSync(next);
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error;
+      current = next;
+    }
+  }
+  return current;
+}
+
+function insideJail(boundary: string, candidate: string): boolean {
+  const rel = relative(boundary, candidate);
+  return rel !== '..' && !rel.startsWith(`..${sep}`) && !isAbsolute(rel);
+}
+
+/**
+ * Check path literals in brain-generated PTY text without executing or rewriting the text.
+ * Absolute paths and home paths (~ and ~/) are checked against the canonical jail, including symlink
+ * ancestors. This is a path-literal guard, not a shell interpreter or a sandbox for the child.
+ */
+export function checkDriveInputJail(input: string, boundary: string, home: string = homedir()): DriveInputJailVerdict {
+  const jail = canonicalPath(boundary);
+  // Quoted path arguments can contain spaces. Inspect those as one literal before scanning
+  // unquoted tokens (which also covers option assignments such as --prefix=/opt/homebrew).
+  const quotedRanges: Array<[number, number]> = [];
+  const literals: string[] = [];
+  for (const match of input.matchAll(/(["'])(.*?)\1/gs)) {
+    const start = match.index ?? 0;
+    if (match[2]?.startsWith('/') || match[2] === '~' || match[2]?.startsWith('~/')) {
+      // A double-quoted string still runs $(…) and `…` — keep scanning inside it so a substituted
+      // command's own paths (e.g. "/jail/$(cat /etc/passwd)") are checked too.
+      const expands = match[1] === '"' && /\$\(|`/.test(match[2]);
+      if (!expands) quotedRanges.push([start, start + match[0].length]);
+      if (/\bPATH=$/.test(input.slice(0, start))) literals.push(...match[2].split(':').filter(Boolean));
+      else literals.push(match[2]);
+    }
+  }
+  const candidates = /(^|[\s"'`|&=:<>(\[,;])((?:~\/|\/)[^\s"'`|:;&<>()[\]{}]*|~(?=$|[\s"'`|:;&<>()[\]{},]))/gm;
+  for (const match of input.matchAll(candidates)) {
+    const literal = match[2]!;
+    const start = (match.index ?? 0) + match[1]!.length;
+    if (quotedRanges.some(([from, to]) => from < start && start < to)) continue;
+    if (literal.startsWith('//') && /\w+:$/.test(input.slice(Math.max(0, start - 12), start))) continue;
+    literals.push(literal);
+  }
+  for (const literal of literals) {
+    const expanded = literal === '~' ? home : literal.startsWith('~/') ? `${home.replace(/\/$/, '')}/${literal.slice(2)}` : literal;
+    if (!insideJail(jail, canonicalPath(expanded))) return { allowed: false, reason: 'outside-jail', path: literal };
+  }
+  return { allowed: true };
+}
+
+export interface DriveJailDeps {
+  inject(text: string): boolean;
+  observe(): string | Promise<string>;
+}
+
+/**
+ * Put a drive's PTY input behind the jail. A blocked input is never sent to the PTY; the next screen the brain
+ * reads carries one line saying why, so it can try another way inside the jail (returning false from inject
+ * would end the loop as a human takeover). No jail → the deps come back unchanged.
+ */
+export function withDriveJail<T extends DriveJailDeps>(deps: T, jail: string | undefined, log?: (event: string, data: Record<string, unknown>) => void): T {
+  if (!jail) return deps;
+  let notice: string | null = null;
+  return {
+    ...deps,
+    inject: (text: string) => {
+      const verdict = checkDriveInputJail(text, jail);
+      if (verdict.allowed) return deps.inject(text);
+      notice = `⚠ elanous: input blocked — ${verdict.path} is outside the boundary ${jail} · try another way inside it`;
+      log?.('jail-block', { path: verdict.path, input: text.slice(0, 80) });
+      return true;
+    },
+    observe: async (): Promise<string> => {
+      const frame = await deps.observe();
+      if (notice === null) return frame;
+      const line = notice;
+      notice = null;
+      return `${frame}\n${line}`;
+    },
+  };
+}

package/src/cli/hooks-cli.ts

@@ -1,6 +1,7 @@
 import type { Command } from 'commander';
 import { startHookReceiver } from '../hooks/receiver.js';
 import { HookQueue } from '../hooks/queue.js';
+import { closeIngressAndExposure, hookExposurePlan, hookExposureStatus, startPublicHookIngress, turnHookExposureOff, turnHookExposureOn, type HookExposureDeps } from '../hooks/expose.js';
 import { getSecretAsync, setSecretAsync } from '../nexus/config/secrets/index.js';
 import { getUserConfig } from '../user-config.js';
 
@@ -9,7 +10,7 @@ export function asanaEnabled(raw: unknown = getUserConfig().raw): boolean {
   return tox?.external?.asana?.enabled === true;
 }
 
-export function registerHooksCommands(program: Command): void {
+export function registerHooksCommands(program: Command, exposureDeps: HookExposureDeps = {}): void {
   const hooks = program.command('hooks').description('외부 웹훅 수신·재전송');
   hooks.command('serve').description('웹훅 수신기를 포그라운드에서 실행')
     .option('--host <host>', '리스닝 주소', '127.0.0.1')
@@ -20,22 +21,35 @@ export function registerHooksCommands(program: Command): void {
         throw new Error('invalid hooks port');
       const secrets = {
         linear: await getSecretAsync('hooks.linear'), asana: await getSecretAsync('hooks.asana'),
+        github: await getSecretAsync('hooks.github'),
         // 첫 핸드셰이크의 비밀을 저장하는 것은 «먼저 온 사람이 이긴다» — Asana 를 켠 설치에서만 연다.
         ...(asanaEnabled() ? { saveAsana: (value: string) => setSecretAsync('hooks.asana', value) } : {}),
       };
       const server = startHookReceiver({ host: opts.host, port, secrets });
+      let ingress: ReturnType<typeof startPublicHookIngress> | undefined;
+      try { if (opts.host === '127.0.0.1' && port === 31480) ingress = startPublicHookIngress(server.url); }
+      catch (error) { server.stop(); throw error; }
       console.log(`hooks listening ${new URL(server.url).host}`);
       await new Promise<void>(resolve => {
         const stop = () => {
           process.removeListener('SIGINT', stop);
           process.removeListener('SIGTERM', stop);
-          server.stop();
-          resolve();
+          void closeIngressAndExposure(ingress, exposureDeps).finally(() => { server.stop(); resolve(); });
         };
         process.once('SIGINT', stop);
         process.once('SIGTERM', stop);
       });
     });
+  const expose = hooks.command('expose').description('결정 원장에 묶인 웹훅 공개 진입');
+  expose.command('plan').description('공개 경로와 tailscale 명령만 표시').action(() => console.log(JSON.stringify(hookExposurePlan())));
+  expose.command('on').description('결정 뒤 공개 진입 켜기').option('--decision <D-id>')
+    .action(async (opts: { decision?: string }) => console.log(JSON.stringify(await turnHookExposureOn(opts.decision, exposureDeps))));
+  expose.command('off').description('이 도구가 켠 공개 진입 끄기(결정 불필요)').option('--force', '기록·대상 확인 없이 8443 Funnel 을 끈다')
+    .action(async (opts: { force?: boolean }) => {
+      const result = await turnHookExposureOff(exposureDeps, { force: opts.force });
+      console.log(result.changed ? `hooks exposure off (${result.reason})` : 'hooks exposure: nothing of ours to turn off (8443 Funnel is not recorded and does not target the hook ingress; --force to turn it off anyway)');
+    });
+  expose.command('status').description('기록된 공개 경로·결정·시각').action(() => console.log(JSON.stringify(hookExposureStatus(exposureDeps))));
   hooks.command('status').description('대기 중인 웹훅 수와 마지막 전달 시각')
     .action(() => {
       const queue = new HookQueue();

package/src/cli/make-cli.ts

@@ -0,0 +1,43 @@
+import type { Command } from 'commander';
+import { debug } from '../debug/log.js';
+import { judge } from '../llm/judge-layer.js';
+import { runPluginMake } from './plugin-cli.js';
+import { workflowRun } from './workflow.js';
+
+type MakeKind = 'plugin' | 'workflow';
+type MakeDeps = {
+  decide?: (request: string) => Promise<MakeKind | null>;
+  pluginMake?: (request: string) => Promise<void>;
+  workflowMake?: (request: string) => Promise<number>;
+};
+
+export async function classifyMakeRequest(request: string, call?: (args: { prompt: string; provider: string; model: string }) => Promise<{ text: string }>): Promise<MakeKind | null> {
+  if (!request.trim()) return null;
+  const result = await judge<MakeKind>({
+    site: 'cli.make',
+    ...(call ? { call } : {}),
+    prompt: `Classify this request for an Elanous creator. Choose "plugin" for a reusable connector, integration, skill, or capability (including reading a file format). Choose "workflow" for a sequence of jobs, recurring schedule, automation, or publishing task, even when it uses a connector. If you cannot decide, return {"kind":"unclear"}. Respond with JSON only, exactly {"kind":"plugin"} or {"kind":"workflow"} or {"kind":"unclear"}. Do not execute the request.\nRequest: ${JSON.stringify(request)}`,
+    schema: value => {
+      if (!value || typeof value !== 'object' || Array.isArray(value)) return null;
+      const kind = (value as { kind?: unknown }).kind;
+      return kind === 'plugin' || kind === 'workflow' ? kind : null;
+    },
+  });
+  return result.ok ? result.value : null;
+}
+
+export function registerMakeCommand(program: Command, deps: MakeDeps = {}): void {
+  program.command('make <request>')
+    .description('Classify a one-line request and make a plugin or build a workflow')
+    .action(async (request: string) => {
+      const kind = await (deps.decide ?? classifyMakeRequest)(request).catch(() => null);
+      debug.log('cli.make', 'route', { kind: kind ?? 'undecided' });
+      if (!kind) {
+        console.log('플러그인(커넥터·스킬)을 만들까요, 워크플로(잡)를 만들까요?');
+        process.exitCode = 1;
+        return;
+      }
+      if (kind === 'plugin') await (deps.pluginMake ?? runPluginMake)(request);
+      else process.exitCode = await (deps.workflowMake ?? ((text: string) => workflowRun('build-workflow', text)))(request);
+    });
+}

package/src/cli/ops-cli.ts

@@ -1,6 +1,11 @@
 import type { Command } from 'commander';
 import * as ui from '../ui.js';
 import { writeStdoutJson } from './stdout-json.js';
+import type { OpsNowResult } from '../ops-now/ops-now-refresh.js';
+
+export function opsNowExitCode(outcome: OpsNowResult['outcome']): number {
+  return outcome === 'channel-unreadable' || outcome === 'summarize-failed' ? 2 : 0;
+}
 
 export function registerOpsCommands(program: Command): void {
 const opsCmd = program.command('ops')
@@ -173,6 +178,21 @@ async function runOpsBuild(buildId: string | undefined, opts: OpsBuildOpts): Pro
   process.exit(0);
 }
 
+opsCmd.command('now-refresh').description('채널 📌안내로 ops-now 고정 기억 갱신(1회)')
+  .option('--once', '한 번 실행(기본)')
+  .option('--dry-run', '기억을 쓰지 않고 새 본문 출력')
+  .option('--json', '결과를 JSON으로 출력')
+  .action(async (o: { dryRun?: boolean; json?: boolean }) => {
+    const { refreshOpsNow } = await import('../ops-now/ops-now-refresh.js');
+    const result = await refreshOpsNow({ dryRun: o.dryRun === true });
+    if (o.json) await writeStdoutJson(JSON.stringify(result, null, 2) + '\n');
+    else {
+      console.log(`ops-now: ${result.outcome} · 안내 ${result.notices}개`);
+      if (o.dryRun && result.body !== undefined) console.log(result.body);
+    }
+    process.exitCode = opsNowExitCode(result.outcome);
+  });
+
 opsCmd.command('status').description('현재 상태 종합(미션·태스크·루프·오케스트레이션·스케줄) · --all-instances 로 fleet 전체 종합(미션/태스크/loops/스케줄/오케스트레이션) · -r/--remote 로 원격 GET 조립')
   .option('--json').option('--all-instances', '등록 인스턴스 전체 종합(미션/태스크/loops/스케줄/오케스트레이션 · fleet · read-only · §10)')
   .option('--include-test', '연합에 격리 test 인스턴스도 포함(기본 제외)')

package/src/cli/persona-cli.ts

@@ -1,4 +1,4 @@
-// PS1 — `elanous persona list|add|show`: 프리셋(persona-presets/)을 보고, 골라서 «내 페르소나»를 만들고, 만든 것을 본다.
+// `elanous persona list|add|edit|show`: 프리셋을 보고, 내 페르소나를 만들고 꾸민다.
 // 만든 페르소나는 기존 페르소나 저장소(resolveStatePersonaDir · Discord·PWA 가 읽는 곳)의 `<id>.yaml` 한 파일이다.
 import type { Command } from 'commander';
 import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
@@ -7,7 +7,8 @@ import { parse as parseYaml } from 'yaml';
 import { debug } from '../debug/log.js';
 import { parsePersonaYaml } from '../persona/loader.js';
 import { resolveRepositoryPersonaDir, resolveStatePersonaDir } from '../persona/global-registry.js';
-import { choosePersonaId, describePreset, findPreset, loadPresetIndex, loadPresets, presetToProfileYaml } from '../persona/presets.js';
+import { choosePersonaId, clonePreset, describePreset, editPersona, findPreset, loadPresetIndex, loadPresets, presetToProfileYaml } from '../persona/presets.js';
+import { addTeamSet, listTeamSets, removeTeamSet } from '../persona/team-set.js';
 
 interface StoredPersona { personaId: string; displayName: string; description?: string; preset?: string; title?: string; path: string }
 
@@ -36,8 +37,52 @@ function takenIds(stateDir: string): Set<string> {
   return ids;
 }
 
+function mapping(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+
+function setEdit(edits: Record<string, unknown>, assignment: string): void {
+  const equals = assignment.indexOf('=');
+  if (equals < 1) throw new Error(`--set requires key=value: ${assignment}`);
+  const key = assignment.slice(0, equals);
+  const parts = key.split('.');
+  if (parts.some((part) => !part || ['__proto__', 'prototype', 'constructor'].includes(part))) {
+    throw new Error(`invalid --set key: ${key}`);
+  }
+  const value: unknown = parseYaml(assignment.slice(equals + 1));
+  let target = edits;
+  for (const part of parts.slice(0, -1)) {
+    if (!Object.hasOwn(target, part)) target[part] = {};
+    if (!mapping(target[part])) throw new Error(`--set key conflicts with a scalar: ${key}`);
+    target = target[part];
+  }
+  target[parts.at(-1)!] = value;
+}
+
+function editOptions(fromFile: string | undefined, assignments: readonly string[]): Record<string, unknown> {
+  const parsed: unknown = fromFile ? parseYaml(readFileSync(fromFile, 'utf8')) : {};
+  if (!mapping(parsed)) throw new Error('--from-file must contain a YAML mapping');
+  const edits = { ...parsed };
+  for (const assignment of assignments) setEdit(edits, assignment);
+  return edits;
+}
+
 export function registerPersonaCommands(program: Command): void {
-  const persona = program.command('persona').description('Persona presets — AI coworkers you pick and customise (list · add · show)');
+  const team = program.command('team-set').description('Install, remove and list persona team sets');
+  team.command('add <file>').description('Install a YAML team set').action((file: string) => {
+    try { const result = addTeamSet(file); console.log(`Installed team-set ${result['team-set']}`); }
+    catch (error) { console.error(error instanceof Error ? error.message : String(error)); process.exitCode = 1; }
+  });
+  team.command('remove <name>').description('Remove an installed team set').action((name: string) => {
+    try { removeTeamSet(name); console.log(`Removed team-set ${name}`); }
+    catch (error) { console.error(error instanceof Error ? error.message : String(error)); process.exitCode = 1; }
+  });
+  team.command('list').description('List installed team sets').action(() => {
+    try { for (const item of listTeamSets()) console.log(`${item['team-set']}  ${item.members.map((member) => `${member.persona} (${member.title})`).join(', ')}`); }
+    catch (error) { console.error(error instanceof Error ? error.message : String(error)); process.exitCode = 1; }
+  });
+
+  const persona = program.command('persona').description('Persona presets — AI coworkers you pick and customise (list · add · edit · show)');
 
   persona.command('list')
     .description('List the persona presets, then the personas you have made')
@@ -63,9 +108,10 @@ export function registerPersonaCommands(program: Command): void {
   persona.command('add <preset>')
     .description('Make your own persona from a preset (id, name or role) — the preset file is not changed')
     .option('--name <name>', 'What to call it (default: the preset’s first name)')
+    .option('--as <name>', 'Clone this preset under a new, unique name')
     .option('--title <title>', 'Optional title, e.g. CMO')
     .option('--json', 'JSON output')
-    .action((query: string, opts: { name?: string; title?: string; json?: boolean }) => {
+    .action((query: string, opts: { name?: string; as?: string; title?: string; json?: boolean }) => {
       const presets = loadPresets();
       const preset = findPreset(presets, query);
       if (!preset) {
@@ -73,6 +119,23 @@ export function registerPersonaCommands(program: Command): void {
         process.exitCode = 1;
         return;
       }
+      if (opts.as !== undefined) {
+        try {
+          if (opts.name !== undefined || opts.title !== undefined) throw new Error('--as cannot be combined with --name or --title');
+          const result = clonePreset(preset, opts.as);
+          debug.log('persona.cli', 'cloned', { preset: preset.personaId, personaId: result.personaId });
+          if (opts.json) console.log(JSON.stringify({ personaId: result.personaId, displayName: result.displayName, preset: preset.personaId, path: result.path }, null, 2));
+          else {
+            console.log(`만들었습니다 — ${result.displayName} (id ${result.personaId} · 프리셋 ${preset.personaId})`);
+            console.log(`  처음 묻는 것: ${preset.firstQuestions.join(' / ')}`);
+            console.log(`  보기: elanous persona show ${result.personaId}`);
+          }
+        } catch (err) {
+          console.error(err instanceof Error ? err.message : String(err));
+          process.exitCode = 1;
+        }
+        return;
+      }
       const dir = resolveStatePersonaDir();
       const personaId = choosePersonaId(preset, opts.name, takenIds(dir));
       const yaml = presetToProfileYaml(preset, loadPresetIndex().common, { personaId, ...(opts.name ? { name: opts.name } : {}), ...(opts.title ? { title: opts.title } : {}) });
@@ -89,6 +152,29 @@ export function registerPersonaCommands(program: Command): void {
       console.log(`  보기: elanous persona show ${personaId}`);
     });
 
+  persona.command('edit <name>')
+    .description('Edit a saved persona (schema fields only; the preset source is not changed)')
+    .option('--set <key=value>', 'Set a field (repeatable; YAML values)', (value: string, values: string[]) => [...values, value], [] as string[])
+    .option('--from-file <path>', 'Load edits from a YAML mapping')
+    .option('--dry-run', 'Validate and preview without writing')
+    .option('--json', 'JSON output')
+    .action((name: string, opts: { set: string[]; fromFile?: string; dryRun?: boolean; json?: boolean }) => {
+      try {
+        if (!opts.fromFile && !opts.set.length) throw new Error('persona edit requires --set or --from-file');
+        const result = editPersona(name, editOptions(opts.fromFile, opts.set), { dryRun: opts.dryRun });
+        debug.log('persona.cli', opts.dryRun ? 'edit-dry-run' : 'edited', { personaId: result.personaId });
+        if (opts.json) console.log(JSON.stringify(result, null, 2));
+        else {
+          console.log(`${opts.dryRun ? '미리 보기' : '수정했습니다'} — ${result.displayName} (id ${result.personaId})`);
+          console.log(result.yaml);
+          console.log(`  파일: ${result.path}`);
+        }
+      } catch (err) {
+        console.error(err instanceof Error ? err.message : String(err));
+        process.exitCode = 1;
+      }
+    });
+
   persona.command('show <name>')
     .description('Show one of your personas (id or name), or a preset')
     .option('--json', 'JSON output')

package/src/cli/plugin-cli.ts

@@ -12,6 +12,7 @@ import { OFFICIAL_INDEX_KEYS } from '../market/official-keys.js';
 import { installPlugin, listInstalledPlugins, PluginInstallError, removePlugin, type InstallEvent } from '../plugins/install/plugin-install.js';
 import { credentialStatus, setPluginCredentials } from '../plugins/install/plugin-credentials.js';
 import { makePlugin } from '../plugins/maker/plugin-maker.js';
+import { registerStandaloneLogSink } from '../domains/standalone-log-sink.js';
 import { addAndInstallNode } from '../plugins/maker/node-install.js';
 
 function keys(): ReadonlyArray<{ keyId: string; publicKey: string }> {
@@ -56,34 +57,42 @@ function safeCause(error: unknown): string {
   return redactSecretText(error.message.replace(/https?:\/\/[^\s"'<>]+/gi, '[redacted URL]'));
 }
 
+export async function runPluginMake(request: string, opts: { name?: string; dir?: string; draftFile?: string; run?: boolean; marketBundleDir?: string; input?: string; json?: boolean } = {}): Promise<void> {
+  try {
+    await registerStandaloneLogSink('cli');
+    const result = await makePlugin({ request, name: opts.name, parentDir: opts.dir, draftFile: opts.draftFile, run: opts.run, marketBundleDir: opts.marketBundleDir,
+      ...(opts.input === undefined ? {} : { input: JSON.parse(opts.input) as unknown }) });
+    debug.flush();
+    if (opts.json) stdout.write(JSON.stringify(result) + '\n');
+    else {
+      console.log(`뼈대 ${result.timings.scaffold}ms · 작성 ${result.timings.write}ms`);
+      console.log(`검증 오류 ${result.errors.length} · ${result.timings.validate}ms${result.timings.repair === undefined ? '' : ` · 수리 ${result.timings.repair}ms`}`);
+      console.log(`설치 ${result.status === 'draft' || result.timings.install === 0 ? '미실행' : result.status === 'failed' && result.timings.run === undefined ? '실패' : '완료'} · ${result.timings.install}ms (${result.dir})`);
+      if (result.status === 'draft') console.log('연구 초안만 생성됨 — 요청 처리 단계 구현 후 별도로 검증·설치 필요');
+      if (result.marketBundle) console.log(`마켓 꾸러미 ${result.marketBundle.path} · ${result.marketBundle.signature} · 게시 안 함`);
+      if (opts.run) console.log(`실행 ${result.runStatus ?? '미실행'} · ${result.timings.run ?? 0}ms`);
+      for (const error of result.errors) console.error(error);
+    }
+    if (result.status === 'failed') process.exitCode = 1;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (opts.json) stdout.write(JSON.stringify({ status: 'failed', errors: [message] }) + '\n');
+    else console.error(`plugin make failed: ${message}`);
+    process.exitCode = 1;
+  }
+}
+
 export function registerPluginCommands(program: Command): void {
   const plugin = program.command('plugin').description('Install and manage Elanous plugins');
-  plugin.command('make <request>').description('Write, validate and install a local graph plugin from one request')
+  plugin.command('make <request>').description('Write, validate and install a local graph plugin, or generate an uninstalled research draft')
     .option('--name <slug>', 'Local plugin name')
     .option('--dir <parent>', 'Parent directory (default: instance plugins-local)')
-    .option('--run', 'Run the installed graph')
+    .option('--draft-file <path>', 'Generate an uninstalled research draft with connector and skill definitions')
+    .option('--run', 'Run the installed graph (not available for research drafts)')
+    .option('--market-bundle-dir <path>', 'Bundle installed plugin for human review; never publish')
     .option('--input <json>', 'JSON input for --run')
     .option('--json', 'Print the result as JSON')
-    .action(async (request: string, opts: { name?: string; dir?: string; run?: boolean; input?: string; json?: boolean }) => {
-      try {
-        const result = await makePlugin({ request, name: opts.name, parentDir: opts.dir, run: opts.run,
-          ...(opts.input === undefined ? {} : { input: JSON.parse(opts.input) as unknown }) });
-        if (opts.json) stdout.write(JSON.stringify(result) + '\n');
-        else {
-          console.log(`뼈대 ${result.timings.scaffold}ms · 작성 ${result.timings.write}ms`);
-          console.log(`검증 오류 ${result.errors.length} · ${result.timings.validate}ms${result.timings.repair === undefined ? '' : ` · 수리 ${result.timings.repair}ms`}`);
-          console.log(`설치 ${result.timings.install === 0 && result.status === 'failed' ? '미실행' : result.status === 'failed' && result.timings.run === undefined ? '실패' : '완료'} · ${result.timings.install}ms (${result.dir})`);
-          if (opts.run) console.log(`실행 ${result.runStatus ?? '미실행'} · ${result.timings.run ?? 0}ms`);
-          for (const error of result.errors) console.error(error);
-        }
-        if (result.status === 'failed') process.exitCode = 1;
-      } catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        if (opts.json) stdout.write(JSON.stringify({ status: 'failed', errors: [message] }) + '\n');
-        else console.error(`plugin make failed: ${message}`);
-        process.exitCode = 1;
-      }
-    });
+    .action(runPluginMake);
   plugin.command('node').description('Manage plugin workflow nodes')
     .command('add <dir> <request>').description('Write, validate and install a workflow node in a plugin')
     .option('--kind <slug>', 'Workflow node kind')

package/src/cli/pod-cli.ts

@@ -2,6 +2,11 @@
 // 산출 경로를 한 줄로 알리고 명령의 종료 코드로 끝난다. `--deadline` 생략 시 기존 Pod Job 상한.
 
 import type { Command } from 'commander';
+import { debug } from '../debug/log.js';
+import { getUserConfig } from '../user-config.js';
+import { listCodexAccountsInStore } from '../oauth/codex-account-store.js';
+import { parsePodPool, resolvePodPoolSpec, type PoolKubectl } from '../task-orchestrator/surfaces/pod-pool.js';
+import { leaseKubectl, measurePoolLease, probePoolDns, recommendConcurrency, type PoolLeaseMeasure, type PoolDnsProbe } from '../task-orchestrator/surfaces/pod-lease.js';
 import { POD_COMMAND_DEADLINE_SECONDS, runPodCommand, type PodCommandResult, type RunPodCommandOptions } from '../task-orchestrator/surfaces/pod-command-job.js';
 
 export interface PodCliIo {
@@ -13,6 +18,12 @@ export interface PodCliIo {
 export interface PodCliDeps {
   io?: PodCliIo;
   run?: (options: RunPodCommandOptions) => Promise<PodCommandResult>;
+  kubectl?: PoolKubectl;
+  dns?: (context: string, kubectl: PoolKubectl) => PoolDnsProbe;
+  accounts?: () => number;
+  perAccount?: () => number;
+  poolSpec?: (explicit?: string) => string | null;
+  harnessPool?: () => string | undefined;
 }
 
 const HELP = `elanous pod run [--pool <스펙>] [--skill <이름,…>] [--llm grok] [--clone] [--deadline <초>] -- <명령…>
@@ -27,16 +38,63 @@ export function registerPodCommands(program: Command, deps: PodCliDeps = {}): vo
   };
   const run = deps.run ?? ((options: RunPodCommandOptions) => runPodCommand(options));
   const pod = program.command('pod').description('Pod 명령 Job — 하니스 없이 명령 하나를 돌리고 산출을 돌려받는다');
+  pod.command('lease').description('Pod 풀 동시 실행 권장 (DNS 점검용 Pod 를 잠깐 만들었다 지움)')
+    .command('status').description('지금 추가로 쏠 수 있는 Pod 골과 제한 근거')
+    .option('--pool <spec>', '풀 스펙 — 컨텍스트[@ssh호스트][:상한][#레지스트리:포트] 쉼표')
+    .option('--json', '표 대신 동일 측정값을 JSON 으로')
+    .action((opts: { pool?: string; json?: boolean }) => {
+      try {
+        const kubectl = deps.kubectl ?? leaseKubectl;
+        const spec = (deps.poolSpec ?? ((explicit?: string) => resolvePodPoolSpec(explicit, process.env, () => {
+          const config = deps.harnessPool ? null : getUserConfig();
+          return (deps.harnessPool?.() ?? config?.harness?.podPool) || config?.pod?.pool;
+        })))(opts.pool);
+        // No pool configured: mirror the Pod launch fallback to kubectl's current context.
+        const current = spec ? null : kubectl(['config', 'current-context']);
+        const context = spec ?? (current?.status === 0 ? current.stdout.trim() : '');
+        const members = context ? parsePodPool(context) : [];
+        const measure: PoolLeaseMeasure = members.length ? measurePoolLease(members, { kubectl, dns: (context) => (deps.dns ?? probePoolDns)(context, kubectl) }) : { members: [] };
+        let accounts: number | null = null;
+        let accountReason: string | null = null;
+        try { accounts = (deps.accounts ?? (() => listCodexAccountsInStore().length))(); }
+        catch { accountReason = '측정 불가: accounts'; }
+        const perAccount = (deps.perAccount ?? (() => getUserConfig().pod?.lease?.perAccount ?? 4))();
+        const decision = recommendConcurrency(measure, { capacity: members.reduce((sum, m) => sum + m.capacity, 0), accounts: accounts ?? -1, perAccount });
+        if (!context) { decision.recommended = null; decision.limitedBy = null; decision.reason = '측정 불가: cluster (current context)'; }
+        const result = { pool: spec, ...measure, accounts, perAccount, ...decision };
+        debug.log('pod.lease', 'status', { pool: spec ? members.map((m) => ({ capacity: m.capacity })) : null, running: decision.running, pending: decision.pending, unleasedRunning: decision.unleasedRunning, recommended: decision.recommended, limitedBy: decision.limitedBy });
+        if (opts.json) io.log(JSON.stringify(result));
+        else {
+          io.log(`풀: ${(spec ?? context) || '?'}`);
+          io.log('컨텍스트 | 상한 | Running | Pending | 메모리(상한 합/할당 가능) | CPU(할당 가능)');
+          for (const m of measure.members) {
+            const mem = (v: number | null) => v === null ? '?' : `${(v / 1024 ** 3).toFixed(1)}Gi`;
+            io.log(`${m.context} | ${m.capacity} | ${m.running ?? '?'} | ${m.pending ?? '?'} | ${mem(m.memoryLimitBytes)}/${mem(m.allocatableMemoryBytes)} | ${m.allocatableCpuMillicores === null ? '?' : m.allocatableCpuMillicores / 1000}${m.reason ? ` (${m.reason})` : ''}`);
+          }
+          io.log(`권장 지금 ${decision.recommended ?? '?'} 개 더 (limitedBy=${decision.limitedBy ?? 'unknown'})${decision.reason ? ` · ${decision.reason}` : ''}`);
+          io.log(`임대 없는 실행 ${decision.unleasedRunning ?? '?'}`);
+          io.log(`capacity: ${decision.capacitySlots ?? '?'} 칸 (상한 ${members.reduce((sum, m) => sum + m.capacity, 0)} − Running ${decision.running ?? '?'} − Pending ${decision.pending ?? '?'}; 권장 수에서 건강한 멤버의 임대 없는 실행 차감)`);
+          io.log(`memory: ${decision.memorySlots ?? '?'} 칸 (할당 가능 − Running 하니스 상한 합; 골당 16Gi · 모든 네임스페이스의 노드별 기존 예약을 반영해 배치 가능 ${decision.placeableSlots ?? '?'} 칸)`);
+          io.log(`lite: ${decision.liteMemorySlots ?? '?'} 칸 (같은 여유를 lite 골 2Gi 로 센 값 · 관측만 — 권장 수는 위 standard 기준)`);
+          io.log(`accounts (관측만 · 상한 아님): ${decision.accountSlots ?? '?'} 칸 (${accounts ?? '?'} × ${perAccount} − Running ${decision.running ?? '?'})${accountReason ? ` · ${accountReason}` : ''}`);
+        }
+        io.exit(0);
+      } catch (err) {
+        io.error(err instanceof Error ? err.message : String(err));
+        io.exit(1);
+      }
+    });
   pod.command('run')
     .description(HELP)
-    .option('--pool <spec>', '풀 스펙 — 컨텍스트[@ssh호스트][:상한] 쉼표')
+    .option('--pool <spec>', '풀 스펙 — 컨텍스트[@ssh호스트][:상한][#레지스트리:포트] 쉼표')
     .option('--skill <names>', '스킬 이름(쉼표). 그 스킬 .env 만 Secret 으로 싣는다')
     .option('--llm <provider>', 'grok 만 허용 — access 사본(refresh 없음)')
     .option('--clone', '저장소를 clone 한다(비공개 · GitHub 토큰이 런 Secret 으로 간다 · 명시할 때만). 기본은 clone 없이 ~/work 에서 이미지의 elanous 로')
     .option('--deadline <seconds>', `Job 수명 상한(초). 생략 시 ${POD_COMMAND_DEADLINE_SECONDS}`)
     .allowUnknownOption(true)
     .allowExcessArguments(true)
-    .action(async (opts: { pool?: string; skill?: string; llm?: string; clone?: boolean; deadline?: string }, command: Command) => {
+    .option('--lite', '네트워크 스킬(omni-crawl·omni-digest)만 쓰는 명령 — 작은 이미지 ⊕ 2Gi 한도(POD7 · clone 불가)')
+    .action(async (opts: { pool?: string; skill?: string; llm?: string; clone?: boolean; deadline?: string; lite?: boolean }, command: Command) => {
       const argv = process.argv.slice(2);
       const sep = argv.indexOf('--');
       const fromArgv = sep >= 0 ? argv.slice(sep + 1) : [];
@@ -68,6 +126,7 @@ export function registerPodCommands(program: Command, deps: PodCliDeps = {}): vo
           ...(skills.length ? { skills } : {}),
           ...(opts.llm === 'grok' ? { llm: 'grok' as const } : {}),
           ...(opts.clone ? { clone: true } : {}),
+          ...(opts.lite ? { lite: true } : {}),
           ...(deadlineSeconds !== undefined ? { deadlineSeconds } : {}),
         });
         if (result.image) io.error(`[pod] image ${result.image} · job ${result.job}`);