leerness 1.36.148 → 1.36.161

package/scripts/platform-smoke.js

@@ -0,0 +1,185 @@
+#!/usr/bin/env node
+'use strict';
+
+// Windows/Linux 플랫폼 경계의 빠른 회귀:
+// 1) selftest가 Windows 8.3(`RUNNER~1`) 실행 경로를 허용하는지,
+// 2) 공유 hooksPath의 같은 pre-commit이 현재 sibling worktree의 handoff를 보는지.
+// 전체 e2e의 같은 검증은 Windows에서 80분가량 걸리므로 CI fast 단계에서 먼저 실행한다.
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const cp = require('child_process');
+
+const CLI = path.resolve(__dirname, '..', 'bin', 'leerness.js');
+const sandbox = fs.mkdtempSync(path.join(os.tmpdir(), 'leerness-platform-smoke-'));
+const env = Object.assign({}, process.env, {
+  TMPDIR: sandbox,
+  TEMP: sandbox,
+  TMP: sandbox,
+  LEERNESS_OFFLINE: '1',
+  LEERNESS_NO_PROMPT: '1',
+  LEERNESS_NO_STALE_CHECK: '1',
+  // 일부 POSIX 셸은 CDPATH를 사용한 cd 성공 경로를 stdout에 출력한다. 훅의 명령 치환이
+  // 그 출력에 오염되지 않는지 실제로 검증하도록 일부러 비어 있지 않게 둔다.
+  CDPATH: '.',
+});
+for (const key of [
+  'CLAUDE_CODE_SESSION_ID', 'CLAUDE_CODE_HOST_SESSION_ID', 'CLAUDE_CODE_CHILD_SESSION',
+  'LEERNESS_INTERNAL', 'LEERNESS_HOOK', 'LEERNESS_SESSION_ID', 'CODEX_THREAD_ID',
+  'CI', 'GITHUB_ACTIONS', 'CLAUDECODE', 'CURSOR_AGENT', 'CODEX_MANAGED_BY_NPM',
+  'LEERNESS_WORKSPACE_DIR', 'LEERNESS_LANG', 'LEERNESS_ENFORCE_BYPASS',
+  'GIT_DIR', 'GIT_CONFIG_PARAMETERS', 'GIT_CONFIG_NOSYSTEM',
+]) delete env[key];
+env.GIT_CONFIG_GLOBAL = path.join(sandbox, 'gitconfig-global');
+env.GIT_CONFIG_SYSTEM = path.join(sandbox, 'gitconfig-system');
+fs.writeFileSync(env.GIT_CONFIG_GLOBAL, '');
+fs.writeFileSync(env.GIT_CONFIG_SYSTEM, '');
+
+const run = (cmd, args, cwd, timeout = 120000) => cp.spawnSync(cmd, args, {
+  cwd,
+  env,
+  encoding: 'utf8',
+  timeout,
+  maxBuffer: 32 * 1024 * 1024,
+});
+const git = (cwd, args) => run('git', args, cwd, 60000);
+const leerness = (cwd, args, timeout = 120000) => run(process.execPath, [CLI, ...args], cwd, timeout);
+const parseJson = (r) => {
+  try { return JSON.parse(String(r.stdout || '')); } catch { return null; }
+};
+const output = (r) => ({
+  status: r && r.status,
+  signal: r && r.signal,
+  stdout: String((r && r.stdout) || '').slice(0, 500),
+  stderr: String((r && r.stderr) || '').slice(0, 500),
+  error: r && r.error ? String(r.error.code || r.error.message) : null,
+});
+const hookPath = (cwd) => {
+  const r = git(cwd, ['rev-parse', '--git-path', 'hooks/pre-commit']);
+  const raw = String(r.stdout || '').trim();
+  return path.isAbsolute(raw) ? raw : path.join(cwd, raw);
+};
+
+let failed = null;
+let cleanupError = null;
+const debug = {};
+try {
+  // Windows Node 20 runner에서 enforce의 실제 sh 발화 검증까지 포함한 전체 selftest가
+  // 120초를 근소하게 넘는다. 전체 E2E보다 먼저 실패를 잡는 fast gate 목적은 유지하되
+  // 프로세스를 중간에 잘라 거짓 실패로 만들지 않도록 이 단계만 240초를 허용한다.
+  const selftest = leerness(sandbox, ['selftest', '--json'], 240000);
+  const selfJson = parseJson(selftest);
+  const pathCase = selfJson && Array.isArray(selfJson.results)
+    ? selfJson.results.find(row => /Windows 8\.3 tilde/.test(row.name || ''))
+    : null;
+  const selfFailures = selfJson && Array.isArray(selfJson.results)
+    ? selfJson.results.filter(row => row.ok !== true).slice(0, 10)
+    : [];
+  debug.shortPath = { command: output(selftest), case: pathCase || null, selfFailures };
+  if (selftest.error && selftest.error.code === 'ETIMEDOUT') {
+    failed = 'platform smoke 선행 selftest가 240초 안에 끝나지 않음';
+  } else if (!pathCase || pathCase.ok !== true) {
+    failed = 'Windows 8.3 실행 경로 selftest가 통과하지 않음';
+  } else if (selftest.status !== 0) {
+    failed = `platform smoke 선행 selftest 실패: ${selfFailures.map(row => row.name).join(', ') || '원인 미확인'}`;
+  }
+
+  const main = path.join(sandbox, 'main');
+  const sibling = path.join(sandbox, 'sibling');
+  fs.mkdirSync(main, { recursive: true });
+  const setup = [
+    git(main, ['init', '-q', '-b', 'main', '.']),
+    git(main, ['config', 'user.email', 'platform-smoke@example.invalid']),
+    git(main, ['config', 'user.name', 'platform-smoke']),
+  ];
+  fs.writeFileSync(path.join(main, 'package.json'), '{"name":"platform-smoke","version":"0.0.0"}\n');
+  fs.writeFileSync(path.join(main, 'seed.txt'), 'seed\n');
+  setup.push(git(main, ['add', '-A']), git(main, ['commit', '-qm', 'seed']));
+  const initMain = leerness(main, ['init', main, '--yes', '--minimal', '--no-enforce', '--no-stale-check']);
+  const mainHandoff = leerness(main, ['handoff', main]);
+  const addWorktree = git(main, ['worktree', 'add', '-qb', 'sibling', sibling]);
+  const initSibling = leerness(sibling, ['init', sibling, '--yes', '--minimal', '--no-enforce', '--no-stale-check']);
+  for (const marker of [path.join(sibling, '.harness', 'last-handoff.json'), path.join(sibling, '.harness', 'cache', 'handoffs')]) {
+    try { fs.rmSync(marker, { recursive: true, force: true }); } catch {}
+  }
+  debug.fixture = {
+    setup: setup.map(output), initMain: output(initMain), mainHandoff: output(mainHandoff),
+    addWorktree: output(addWorktree), initSibling: output(initSibling),
+  };
+  if (!failed && (setup.some(r => r.status !== 0) || initMain.status !== 0 || mainHandoff.status !== 0
+      || addWorktree.status !== 0 || initSibling.status !== 0)) {
+    failed = '공유 훅 worktree 픽스처 생성 실패';
+  }
+
+  const actual = path.join(main, '.git', 'shared-hooks');
+  const alias = path.join(main, '.git', 'link-hooks');
+  fs.mkdirSync(actual, { recursive: true });
+  fs.symlinkSync(actual, alias, process.platform === 'win32' ? 'junction' : 'dir');
+  const configs = [
+    git(main, ['config', 'extensions.worktreeConfig', 'true']),
+    git(main, ['config', '--worktree', 'core.hooksPath', alias]),
+    git(sibling, ['config', '--worktree', 'core.hooksPath', actual]),
+  ];
+  const before = parseJson(leerness(main, ['enforce', 'status', '--path', main, '--json']));
+  const installResult = leerness(main, ['enforce', 'install', '--path', main, '--json', '--skip-verify']);
+  const installed = parseJson(installResult);
+  const mainHook = hookPath(main);
+  const siblingHook = hookPath(sibling);
+  const installedHookBody = fs.existsSync(mainHook) ? fs.readFileSync(mainHook, 'utf8') : '';
+  debug.hooks = {
+    configs: configs.map(output), before, installed, install: output(installResult),
+    mainHook, siblingHook,
+    mainHookExists: fs.existsSync(mainHook), siblingHookExists: fs.existsSync(siblingHook),
+    sameTarget: fs.existsSync(mainHook) && fs.existsSync(siblingHook)
+      ? fs.realpathSync(mainHook) === fs.realpathSync(siblingHook) : false,
+    dynamicWorktreeRoot: installedHookBody.includes('LRN_REL=')
+      && installedHookBody.includes('git rev-parse --show-toplevel')
+      && installedHookBody.includes('CDPATH= cd "$LRN_TOP"'),
+  };
+  if (!failed && (configs.some(r => r.status !== 0) || !before || before.worktrees !== 2
+      || installResult.status !== 0 || !installed || installed.worktrees !== 2
+      || !debug.hooks.sameTarget || !debug.hooks.dynamicWorktreeRoot)) {
+    failed = '공유 hooksPath를 두 worktree가 함께 본다는 설치 계약 실패';
+  }
+
+  // main에는 fresh handoff가 있지만 sibling에는 없다. 공유 훅이 설치한 main 상태를 빌려보지 않고
+  // 현재 commit 대상의 toplevel을 계산해야 두 호출 모두 sibling에서 차단된다.
+  const directBefore = git(sibling, ['hook', 'run', 'pre-commit']);
+  fs.writeFileSync(path.join(sibling, 'platform-probe.txt'), 'probe\n');
+  const staged = git(sibling, ['add', '-A']);
+  const commitBefore = git(sibling, ['commit', '-m', 'must-block-before-sibling-handoff']);
+  const siblingHandoff = leerness(sibling, ['handoff', sibling]);
+  const directAfter = git(sibling, ['hook', 'run', 'pre-commit']);
+  const commitAfter = git(sibling, ['commit', '-m', 'passes-after-sibling-handoff']);
+  debug.lifecycle = {
+    directBefore: output(directBefore), staged: output(staged), commitBefore: output(commitBefore),
+    siblingHandoff: output(siblingHandoff), directAfter: output(directAfter), commitAfter: output(commitAfter),
+  };
+  if (!failed && (directBefore.status === 0 || staged.status !== 0 || commitBefore.status === 0
+      || siblingHandoff.status !== 0 || directAfter.status !== 0 || commitAfter.status !== 0)) {
+    failed = '공유 훅이 sibling handoff 전 차단/후 통과 수명주기를 지키지 않음';
+  }
+} catch (e) {
+  failed = `platform smoke 예외: ${String(e && (e.stack || e.message) || e).slice(0, 800)}`;
+} finally {
+  try {
+    fs.rmSync(sandbox, { recursive: true, force: true, maxRetries: 8, retryDelay: 75 });
+    if (fs.existsSync(sandbox)) cleanupError = 'rmSync 뒤에도 sandbox가 남음';
+  } catch (e) {
+    let remaining = [];
+    try { remaining = fs.readdirSync(sandbox).slice(0, 20); } catch {}
+    cleanupError = `${String(e && (e.code || e.message) || e).slice(0, 200)}; remaining=${JSON.stringify(remaining)}`;
+  }
+}
+
+if (cleanupError) {
+  debug.cleanup = cleanupError;
+  failed = failed ? `${failed}; cleanup 실패: ${cleanupError}` : `sandbox cleanup 실패: ${cleanupError}`;
+}
+
+if (failed) {
+  process.stderr.write(`platform smoke failed: ${failed}\n${JSON.stringify(debug, null, 2)}\n`);
+  process.exit(1);
+}
+process.stdout.write('platform smoke passed: Windows 8.3 paths + shared-hook sibling handoff lifecycle\n');

package/scripts/release-bump-probe.js

@@ -0,0 +1,137 @@
+#!/usr/bin/env node
+'use strict';
+
+const cp = require('child_process');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const sourceRoot = path.resolve(__dirname, '..');
+
+function nextPatch(version) {
+  const match = String(version).match(/^(\d+)\.(\d+)\.(\d+)(-[0-9A-Za-z.-]+)?$/);
+  if (!match) throw new Error(`unsupported fixture version: ${version}`);
+  return match[4] ? `${match[1]}.${match[2]}.${match[3]}` : `${match[1]}.${match[2]}.${Number(match[3]) + 1}`;
+}
+
+function versionFromSource(file) {
+  const match = fs.readFileSync(file, 'utf8').match(/const VERSION = '([^']+)'/);
+  return match && match[1];
+}
+
+function copyFixture(root) {
+  for (const dir of ['bin', 'lib']) fs.cpSync(path.join(sourceRoot, dir), path.join(root, dir), { recursive: true });
+  for (const file of ['package.json', 'README.md']) fs.copyFileSync(path.join(sourceRoot, file), path.join(root, file));
+  fs.mkdirSync(path.join(root, '.harness'), { recursive: true });
+  const version = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8')).version;
+  fs.writeFileSync(path.join(root, '.harness', 'HARNESS_VERSION'), `${version}\n`);
+}
+
+function runProbe(root) {
+  const before = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8')).version;
+  const expected = nextPatch(before);
+  const cli = path.join(root, 'bin', 'leerness.js');
+  // Windows는 대소문자를 구별하지 않지만 path.resolve는 문자열 대소문자를 보존한다.
+  // 실제 사용자가 소문자 드라이브 문자로 넘긴 경우도 자체 패키지 판별이 유지돼야 한다.
+  const rootArg = process.platform === 'win32' ? root.slice(0, 1).toLowerCase() + root.slice(1) : root;
+  const run = cp.spawnSync(process.execPath, [cli, 'release', 'bump', '--patch', '--path', rootArg], {
+    cwd: root,
+    encoding: 'utf8',
+    timeout: 30000
+  });
+  const after = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8')).version;
+  const harnessVersion = fs.readFileSync(path.join(root, '.harness', 'HARNESS_VERSION'), 'utf8').trim();
+  const binVersion = versionFromSource(cli);
+  const readme = fs.readFileSync(path.join(root, 'README.md'), 'utf8');
+  const unknownFlag = /unknown flag|알 수 없는 플래그/i.test(`${run.stdout}\n${run.stderr}`);
+  const ok = run.status === 0 && !unknownFlag && after === expected && harnessVersion === expected
+    && binVersion === expected && readme.includes(`Leerness v${expected}`);
+  return { ok, before, expected, after, harnessVersion, binVersion, unknownFlag, exit: run.status };
+}
+
+function runGenericProbe(root) {
+  const readmeBefore = '# Independent package\n';
+  fs.mkdirSync(root);
+  fs.writeFileSync(path.join(root, 'package.json'), JSON.stringify({ name: 'independent-package', version: '1.0.0' }, null, 2) + '\n');
+  fs.writeFileSync(path.join(root, 'README.md'), readmeBefore);
+  const run = cp.spawnSync(process.execPath, [path.join(sourceRoot, 'bin', 'leerness.js'), 'release', 'bump', '--patch', '--path', root], {
+    cwd: root,
+    encoding: 'utf8',
+    timeout: 30000
+  });
+  const after = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8')).version;
+  const readmeAfter = fs.readFileSync(path.join(root, 'README.md'), 'utf8');
+  const unknownFlag = /unknown flag|알 수 없는 플래그/i.test(`${run.stdout}\n${run.stderr}`);
+  return { ok: run.status === 0 && !unknownFlag && after === '1.0.1' && readmeAfter === readmeBefore, after, unknownFlag, exit: run.status };
+}
+
+function runPreflightFailureProbe(root) {
+  copyFixture(root);
+  const cli = path.join(root, 'bin', 'leerness.js');
+  const source = fs.readFileSync(cli, 'utf8');
+  // 유효한 JS이지만 release preflight가 요구하는 단일 선언 표면은 의도적으로 깨뜨린다.
+  fs.writeFileSync(cli, source.replace(/^const VERSION = '([^']+)';$/m, "const VERSION = String('$1');"));
+  const targets = [
+    path.join(root, 'package.json'),
+    path.join(root, '.harness', 'HARNESS_VERSION'),
+    cli,
+    path.join(root, 'README.md')
+  ];
+  const before = new Map(targets.map(file => [file, fs.readFileSync(file)]));
+  const run = cp.spawnSync(process.execPath, [cli, 'release', 'bump', '--patch', '--path', root, '--json'], {
+    cwd: root,
+    encoding: 'utf8',
+    timeout: 30000
+  });
+  const unchanged = targets.every(file => fs.readFileSync(file).equals(before.get(file)));
+  let payload = null; try { payload = JSON.parse(run.stdout || ''); } catch {}
+  return { ok: run.status !== 0 && unchanged && payload?.code === 'release_preflight_failed', exit: run.status, unchanged, code: payload?.code };
+}
+
+function runPartialRollbackProbe(root) {
+  copyFixture(root);
+  const cli = path.join(root, 'bin', 'leerness.js');
+  const targets = [
+    path.join(root, 'package.json'),
+    path.join(root, '.harness', 'HARNESS_VERSION'),
+    cli,
+    path.join(root, 'README.md')
+  ];
+  const before = new Map(targets.map(file => [file, fs.readFileSync(file)]));
+  const api = require(cli);
+  const snapshots = targets.map(api._releaseFileSnapshot);
+  const transaction = api._runReleaseTransaction(snapshots, () => {
+    // 실제 release 순서와 같이 package → harness → bin까지 일부 변경한 뒤 실패를 주입한다.
+    const pkg = JSON.parse(fs.readFileSync(targets[0], 'utf8'));
+    pkg.version = '9.9.9';
+    fs.writeFileSync(targets[0], JSON.stringify(pkg, null, 2) + '\n');
+    fs.writeFileSync(targets[1], '9.9.9\n');
+    fs.writeFileSync(targets[2], fs.readFileSync(targets[2], 'utf8')
+      .replace(/^const VERSION = '[^']+';$/m, "const VERSION = '9.9.9';"));
+    throw new Error('injected after partial release writes');
+  });
+  const unchanged = targets.every(file => fs.readFileSync(file).equals(before.get(file)));
+  return {
+    ok: transaction.ok === false && unchanged && transaction.rollbackErrors.length === 0
+      && /injected after partial/.test(String(transaction.error && transaction.error.message)),
+    unchanged,
+    rollbackErrors: transaction.rollbackErrors
+  };
+}
+
+const fixture = fs.mkdtempSync(path.join(os.tmpdir(), 'leerness-release-bump-probe-'));
+try {
+  copyFixture(fixture);
+  const own = runProbe(fixture);
+  const generic = runGenericProbe(path.join(fixture, 'generic-package'));
+  const preflight = runPreflightFailureProbe(path.join(fixture, 'broken-own-package'));
+  const partialRollback = runPartialRollbackProbe(path.join(fixture, 'partial-rollback-own-package'));
+  if (!(own.ok && generic.ok && preflight.ok && partialRollback.ok)) {
+    process.stderr.write(`release-bump probe failed: ${JSON.stringify({ own, generic, preflight, partialRollback })}\n`);
+    process.exitCode = 1;
+  } else {
+    process.stdout.write(`release-bump probe passed: ${own.before} -> ${own.after}; harness ${own.harnessVersion}; generic ${generic.after}; preflight ${preflight.code}; partial rollback restored\n`);
+  }
+} finally {
+  fs.rmSync(fixture, { recursive: true, force: true });
+}

package/scripts/release-runtime-probe.js

@@ -0,0 +1,210 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const cp = require('child_process');
+
+const root = path.resolve(__dirname, '..');
+const cliPath = path.join(root, 'bin', 'leerness.js');
+const npmProcessPath = path.join(root, 'lib', 'npm-process.js');
+const sandbox = fs.mkdtempSync(path.join(os.tmpdir(), 'leerness-release-runtime-'));
+const marker = path.join(sandbox, 'shell-injection-marker');
+const fakeNpmDir = path.join(sandbox, 'fake-npm');
+const fakeNpmCli = path.join(fakeNpmDir, 'npm-cli.js');
+const fakeNpmLog = path.join(sandbox, 'fake-npm-calls.jsonl');
+const failures = [];
+
+function readFakeCalls() {
+  try {
+    return fs.readFileSync(fakeNpmLog, 'utf8').split(/\r?\n/).filter(Boolean).map(line => JSON.parse(line));
+  } catch { return []; }
+}
+
+function runCli(args, env = process.env) {
+  return cp.spawnSync(process.execPath, [cliPath, ...args], {
+    cwd: sandbox,
+    env,
+    encoding: 'utf8',
+    timeout: 60000,
+  });
+}
+
+function overrideEnvCaseInsensitive(base, overrides) {
+  const env = { ...base };
+  for (const [name, value] of Object.entries(overrides)) {
+    for (const key of Object.keys(env)) {
+      if (key.toLowerCase() === name.toLowerCase()) delete env[key];
+    }
+    env[name] = value;
+  }
+  return env;
+}
+
+try {
+  fs.mkdirSync(fakeNpmDir, { recursive: true });
+  fs.writeFileSync(path.join(sandbox, 'package.json'), JSON.stringify({ name: 'release-runtime-probe', version: '9.9.9' }) + '\n');
+  fs.writeFileSync(fakeNpmCli, [
+    "'use strict';",
+    "const fs = require('fs');",
+    'const args = process.argv.slice(2);',
+    "if (process.env.LEERNESS_NPM_PROBE_LOG) fs.appendFileSync(process.env.LEERNESS_NPM_PROBE_LOG, JSON.stringify(args) + '\\n');",
+    "if (args[0] === '--version') process.stdout.write('99.0.0\\n');",
+    "else if (args[0] === 'view' && args.includes('dist-tags')) process.stdout.write(JSON.stringify({ latest: '9.9.9', next: '10.0.0-next.1' }) + '\\n');",
+    "else if (args[0] === 'view') process.stdout.write('9.9.9\\n');",
+    "else if (args[0] === 'pack') process.stdout.write('release-runtime-probe-9.9.9.tgz\\n');",
+    "else if (args[0] === 'publish') process.stdout.write('+ release-runtime-probe@9.9.9\\n');",
+    'const exitCode = Number(process.env.LEERNESS_NPM_PROBE_EXIT || 0);',
+    'if (Number.isFinite(exitCode) && exitCode !== 0) process.exit(exitCode);',
+  ].join('\n') + '\n');
+
+  const childScript = [
+    `const { spawnNpmSync } = require(${JSON.stringify(npmProcessPath)});`,
+    'const warnings = [];',
+    "process.on('warning', warning => warnings.push({ code: warning.code, message: warning.message }));",
+    "const result = spawnNpmSync(['--version'], { encoding: 'utf8', timeout: 30000 });",
+    'setImmediate(() => {',
+    '  process.stdout.write(JSON.stringify({',
+    '    status: result.status,',
+    "    stdout: String(result.stdout || '').trim(),",
+    "    stderr: String(result.stderr || ''),",
+    '    error: result.error ? String(result.error.code || result.error.message) : null,',
+    '    warnings,',
+    '  }));',
+    '});',
+  ].join('\n');
+  const child = cp.spawnSync(process.execPath, ['--trace-deprecation', '-e', childScript], {
+    cwd: root,
+    encoding: 'utf8',
+    timeout: 60000,
+  });
+  let result = null;
+  try { result = JSON.parse(String(child.stdout || '')); } catch {}
+  if (child.status !== 0 || !result || result.status !== 0 || !/^\d+\.\d+\.\d+/.test(result.stdout || '')) {
+    failures.push(`shell 없는 npm --version 실행 실패: ${String(child.stderr || child.stdout || '').slice(0, 300)}`);
+  }
+  const warningText = `${String(child.stderr || '')} ${JSON.stringify(result && result.warnings || [])}`;
+  if (/DEP0190|shell option true/i.test(warningText)) failures.push('npm 실행에서 DEP0190 경고가 발생함');
+
+  const { resolveNpmCliPath, spawnNpmSync } = require(npmProcessPath);
+  const fakeEnv = overrideEnvCaseInsensitive(process.env, {
+    // test:fast deliberately runs the product offline. These cases exercise the
+    // real npm-backed release paths with a local fake CLI, so keep that parent
+    // policy from short-circuiting the behavior under test.
+    LEERNESS_OFFLINE: '0',
+    npm_execpath: fakeNpmCli,
+    LEERNESS_NPM_PROBE_LOG: fakeNpmLog,
+  });
+  const casingProbe = overrideEnvCaseInsensitive(
+    { NPM_EXECPATH: path.join(sandbox, 'inherited-wrong-npm-cli.js') },
+    { npm_execpath: fakeNpmCli },
+  );
+  const casingKeys = Object.keys(casingProbe).filter(key => key.toLowerCase() === 'npm_execpath');
+  if (casingKeys.length !== 1 || casingKeys[0] !== 'npm_execpath' || casingProbe.npm_execpath !== fakeNpmCli) {
+    failures.push(`Windows npm_execpath 대소문자 alias 정규화 실패: ${JSON.stringify(casingKeys)}`);
+  }
+  const resolved = resolveNpmCliPath({ env: fakeEnv });
+  if (resolved !== fakeNpmCli) {
+    failures.push(`자식 env의 npm_execpath를 사용하지 않음: ${resolved || '(없음)'}`);
+  }
+  fs.writeFileSync(fakeNpmLog, '');
+  const argvResult = spawnNpmSync([
+    '--version',
+    '&&',
+    process.execPath,
+    '-e',
+    `require('fs').writeFileSync(${JSON.stringify(marker)}, 'unsafe')`,
+  ], { cwd: sandbox, env: fakeEnv, encoding: 'utf8', timeout: 30000 });
+  const argvCalls = readFakeCalls();
+  const expectedArgv = ['--version', '&&', process.execPath, '-e', `require('fs').writeFileSync(${JSON.stringify(marker)}, 'unsafe')`];
+  if (argvResult.status !== 0 || argvCalls.length !== 1 || JSON.stringify(argvCalls[0]) !== JSON.stringify(expectedArgv)) {
+    failures.push(`npm argv 보존 실패: ${JSON.stringify(argvCalls)}`);
+  }
+  if (fs.existsSync(marker)) failures.push('npm 인자의 셸 메타문자가 별도 명령으로 실행됨');
+
+  const missing = spawnNpmSync(['--version'], {
+    npmCliPath: path.join(sandbox, 'missing', 'npm-cli.js'),
+    cwd: sandbox,
+    encoding: 'utf8',
+  });
+  if (missing.status !== null || !missing.error || missing.error.code !== 'ENOENT') {
+    failures.push(`npm CLI 누락 결과가 spawn 호환 ENOENT가 아님: ${JSON.stringify({ status: missing.status, code: missing.error && missing.error.code })}`);
+  }
+
+  fs.writeFileSync(fakeNpmLog, '');
+  const channel = runCli(['release', 'channel', sandbox, '--json'], fakeEnv);
+  let channelJson = null;
+  try { channelJson = JSON.parse(String(channel.stdout || '')); } catch {}
+  const channelCalls = readFakeCalls();
+  if (channel.status !== 0 || !channelJson || !channelJson.distTags || channelJson.distTags.latest !== '9.9.9'
+      || !channelCalls.some(call => JSON.stringify(call) === JSON.stringify(['view', 'leerness', 'dist-tags', '--json']))) {
+    failures.push(`release channel 실제 npm view 경로 실패: exit=${channel.status} calls=${JSON.stringify(channelCalls)}`);
+  }
+
+  const failingEnv = { ...fakeEnv, LEERNESS_NPM_PROBE_EXIT: '7' };
+  const channelFailure = runCli(['release', 'channel', sandbox, '--json'], failingEnv);
+  let channelFailureJson = null;
+  try { channelFailureJson = JSON.parse(String(channelFailure.stdout || '')); } catch {}
+  if (channelFailure.status !== 0 || !channelFailureJson || channelFailureJson.distTags !== null) {
+    failures.push(`release channel npm view 실패 폴백 오류: exit=${channelFailure.status}`);
+  }
+  const packFailure = runCli(['release', 'pack', sandbox, '--no-readme-sync'], failingEnv);
+  if (packFailure.status !== 1 || !/npm pack 실패/.test(String(packFailure.stdout || ''))) {
+    failures.push(`release pack npm 실패 전파 오류: exit=${packFailure.status}`);
+  }
+  const publishFailure = runCli(['release', 'publish', sandbox, '--dry-run', '--npm-publish'], failingEnv);
+  if (publishFailure.status !== 1 || !/npm publish 실패/.test(String(publishFailure.stdout || ''))) {
+    failures.push(`release publish npm 실패 전파 오류: exit=${publishFailure.status}`);
+  }
+
+  const workflow = fs.readFileSync(path.join(root, '.github', 'workflows', 'ci.yml'), 'utf8');
+  const refs = Array.from(workflow.matchAll(/uses:\s*actions\/(checkout|setup-node)@(v\d+)/g), match => `${match[1]}@${match[2]}`);
+  if (refs.length < 6 || refs.some(ref => !/@v7$/.test(ref))) {
+    failures.push(`CI 액션 런타임 major 불일치: ${refs.join(', ') || '(없음)'}`);
+  }
+  if (!/release-runtime:\s*[\s\S]*node:\s*\[24, 26\]/.test(workflow)
+      || !/name:\s*release runtime \(shell-free npm\)/.test(workflow)) {
+    failures.push('CI가 전체 게이트와 Node 24/26 매트릭스에서 릴리스 런타임 프로브를 실행하지 않음');
+  }
+
+  const ciFixture = path.join(sandbox, 'ci-init-fixture');
+  fs.mkdirSync(ciFixture, { recursive: true });
+  const ciInit = runCli(['ci', 'init', ciFixture, '--force', '--json'], { ...process.env, LEERNESS_OFFLINE: '1' });
+  const generatedWorkflowPath = path.join(ciFixture, '.github', 'workflows', 'leerness-gate.yml');
+  const generatedWorkflow = fs.existsSync(generatedWorkflowPath) ? fs.readFileSync(generatedWorkflowPath, 'utf8') : '';
+  if (ciInit.status !== 0 || !/actions\/checkout@v7/.test(generatedWorkflow)
+      || !/actions\/setup-node@v7/.test(generatedWorkflow)
+      || !/node-version:\s*'24'/.test(generatedWorkflow)
+      || !/package-manager-cache:\s*false/.test(generatedWorkflow)
+      || /actions\/(?:checkout|setup-node)@v4/.test(generatedWorkflow)) {
+    failures.push(`ci init 생성 워크플로 Node 24 런타임 전환 실패: exit=${ciInit.status}`);
+  }
+
+  const cliSource = fs.readFileSync(path.join(root, 'bin', 'leerness.js'), 'utf8');
+  const publishStart = cliSource.indexOf('function _publishToNpm');
+  const publishEnd = cliSource.indexOf('\nasync function releasePackCmd', publishStart);
+  const publishBlock = publishStart >= 0 && publishEnd > publishStart
+    ? cliSource.slice(publishStart, publishEnd) : '';
+  if (!publishBlock.includes('spawnNpmSync') || /cp\.spawnSync\(['"]npm['"]|shell:\s*true/.test(publishBlock)) {
+    failures.push('_publishToNpm이 shell 없는 공용 npm 실행 경로를 사용하지 않음');
+  }
+  const releaseStart = cliSource.indexOf('function releasePackCmd');
+  const releaseEnd = cliSource.indexOf('// ===== 1.9.7 A:', releaseStart);
+  const releaseBlock = releaseStart >= 0 && releaseEnd > releaseStart
+    ? cliSource.slice(releaseStart, releaseEnd) : '';
+  if (/cp\.spawnSync\(['"]npm['"]/.test(releaseBlock)) {
+    failures.push('release pack/publish 경로에 직접 npm spawn이 남아 있음');
+  }
+} catch (error) {
+  failures.push(String(error && (error.stack || error.message) || error));
+} finally {
+  try { fs.rmSync(sandbox, { recursive: true, force: true, maxRetries: 5, retryDelay: 50 }); } catch {}
+}
+
+if (failures.length) {
+  process.stderr.write(`release runtime probe failed:\n- ${failures.join('\n- ')}\n`);
+  process.exit(1);
+}
+
+process.stdout.write('release runtime probe passed: Node 24 actions + shell-free npm argv\n');

package/scripts/smoke.js

@@ -2,7 +2,9 @@
 'use strict';
 
 // 1.9.273 (UR-0027, GPT-5.5 리뷰): 빠른 핵심-경로 smoke 테스트.
-//   전체 e2e(220 케이스, 수 분)는 CI/릴리스 게이트용. 이 smoke 는 개발 중 빠른 피드백(<30s)용 —
+//   전체 e2e(수백 케이스)는 CI/릴리스 게이트용. 이 smoke 는 개발 중 제한된 핵심 명령만 확인한다.
+//   Windows 에서는 실제 Git shell 발화 검증까지 포함한 selftest가 120초를 넘을 수 있어
+//   해당 단계만 240초 상한을 사용한다(T-0133/T-0137).
 //   핵심 명령이 정상 동작하는지만 단일 임시 프로젝트에서 빠르게 확인한다.
 //   실패 시 exit 1 (CI 친화). 사용: npm run test:fast  또는  node scripts/smoke.js
 
@@ -20,7 +22,7 @@ const t0 = Date.now();
 // 단일 명령 실행 + assert. check(라벨, args, {expectFail?, match?(stdout)→bool})
 function check(label, args, opts = {}) {
   total++;
-  const r = cp.spawnSync(process.execPath, [CLI, ...args], { cwd: opts.cwd || tmp, encoding: 'utf8', timeout: 30000 });
+  const r = cp.spawnSync(process.execPath, [CLI, ...args], { cwd: opts.cwd || tmp, encoding: 'utf8', timeout: opts.timeout || 30000 });
   let ok = (r.status === 0) === !opts.expectFail;
   if (ok && typeof opts.match === 'function') { try { ok = !!opts.match(r.stdout || '', r.stderr || ''); } catch { ok = false; } }
   process.stdout.write(`${ok ? '✓' : '✗'} ${label}${opts.expectFail ? ' (expect-fail)' : ''}\n`);
@@ -32,7 +34,7 @@ console.log(`# leerness smoke (test:fast) @ ${tmp}`);
 
 // 1) 코어 무결성
 check('--version', ['--version'], { match: s => /^\d+\.\d+\.\d+/.test(s.trim()) });
-check('selftest (pure 함수 무결성)', ['selftest'], { match: s => /통과/.test(s) });
+check('selftest (pure 함수 무결성)', ['selftest'], { timeout: 240000, match: s => /통과/.test(s) });
 
 // 2) 설치 + 필수 파일
 check('init', ['init', tmp, '--yes', '--language', 'ko', '--skills', 'recommended']);