leerness 1.36.166 → 1.36.168

package/lib/claims-baseline.js

@@ -0,0 +1,272 @@
+// lib/claims-baseline.js — explicit, fingerprint-bound legacy claim debt.
+//
+// A baseline never edits historical evidence and never makes a new failure pass.
+// It can acknowledge only failures that existed before an explicit tracker-row
+// boundary, and only while the complete row plus the verifier reasons remain
+// byte-for-byte equivalent after canonical JSON normalization.
+'use strict';
+
+const crypto = require('crypto');
+const fs = require('fs');
+const path = require('path');
+const { absRoot, exists, read, mkdirp, writeUtf8 } = require('./io');
+
+const SCHEMA_VERSION = 1;
+const KIND = 'leerness-claims-baseline';
+const POLICY = 'exact-progress-row-and-reasons';
+const FILE_NAME = 'claims-baseline.json';
+
+function baselinePath(root) {
+  return path.join(absRoot(root), '.leerness', FILE_NAME);
+}
+
+function _canonical(value) {
+  if (Array.isArray(value)) return '[' + value.map(_canonical).join(',') + ']';
+  if (value && typeof value === 'object') {
+    return '{' + Object.keys(value).sort().map(k => JSON.stringify(k) + ':' + _canonical(value[k])).join(',') + '}';
+  }
+  return JSON.stringify(value);
+}
+
+function _sha256(value) {
+  return crypto.createHash('sha256').update(_canonical(value)).digest('hex');
+}
+
+function _normalizedRow(row) {
+  return {
+    id: String(row && row.id || ''),
+    status: String(row && row.status || ''),
+    request: String(row && row.request || ''),
+    evidence: String(row && row.evidence || ''),
+    nextAction: String(row && row.nextAction || ''),
+    updated: String(row && row.updated || ''),
+  };
+}
+
+function normalizeReasons(reasons) {
+  return Array.from(new Set((Array.isArray(reasons) ? reasons : [])
+    .map(x => String(x || '').trim()).filter(Boolean))).sort();
+}
+
+function claimFingerprint(row, reasons) {
+  return _sha256({ row: _normalizedRow(row), reasons: normalizeReasons(reasons) });
+}
+
+function _withoutIntegrity(doc) {
+  const out = { ...doc };
+  delete out.integrity;
+  return out;
+}
+
+function _integrity(doc) {
+  return 'sha256:' + _sha256(_withoutIntegrity(doc));
+}
+
+function validateBaseline(doc) {
+  const problems = [];
+  if (!doc || typeof doc !== 'object' || Array.isArray(doc)) return { ok: false, problems: ['root-not-object'] };
+  if (doc.schemaVersion !== SCHEMA_VERSION) problems.push('unsupported-schema');
+  if (doc.kind !== KIND) problems.push('wrong-kind');
+  if (doc.policy !== POLICY) problems.push('wrong-policy');
+  if (typeof doc.createdAt !== 'string' || Number.isNaN(Date.parse(doc.createdAt))) problems.push('invalid-created-at');
+  if (typeof doc.createdByVersion !== 'string' || !doc.createdByVersion.trim()) problems.push('invalid-created-by-version');
+  if (typeof doc.beforeTaskId !== 'string' || !/^[A-Z]+-\d{3,}$/.test(doc.beforeTaskId)) problems.push('invalid-before-task');
+  if (!Number.isInteger(doc.evaluatedBefore) || doc.evaluatedBefore < 0) problems.push('invalid-evaluated-before');
+  if (!Number.isInteger(doc.rawFailedBefore) || doc.rawFailedBefore < 0) problems.push('invalid-raw-failed-before');
+  if (!Array.isArray(doc.entries)) problems.push('entries-not-array');
+  const ids = new Set();
+  for (const entry of Array.isArray(doc.entries) ? doc.entries : []) {
+    if (!entry || typeof entry !== 'object' || Array.isArray(entry)) { problems.push('invalid-entry'); continue; }
+    if (typeof entry.id !== 'string' || !/^[A-Z]+-\d{3,}$/.test(entry.id)) problems.push('invalid-entry-id');
+    else if (ids.has(entry.id)) problems.push('duplicate-entry-id');
+    else ids.add(entry.id);
+    if (!/^[a-f0-9]{64}$/.test(String(entry.fingerprint || ''))) problems.push('invalid-entry-fingerprint');
+    const reasons = normalizeReasons(entry.reasons);
+    const reasonsAreCanonical = Array.isArray(entry.reasons)
+      && entry.reasons.every(reason => typeof reason === 'string' && reason.trim())
+      && JSON.stringify(entry.reasons) === JSON.stringify(reasons);
+    if (!reasons.length || !reasonsAreCanonical) problems.push('invalid-entry-reasons');
+  }
+  if (doc.rawFailedBefore !== (Array.isArray(doc.entries) ? doc.entries.length : -1)) problems.push('failed-count-mismatch');
+  if (!/^sha256:[a-f0-9]{64}$/.test(String(doc.integrity || ''))) problems.push('invalid-integrity-format');
+  else if (doc.integrity !== _integrity(doc)) problems.push('integrity-mismatch');
+  return { ok: problems.length === 0, problems: Array.from(new Set(problems)) };
+}
+
+function loadBaseline(root) {
+  const file = baselinePath(root);
+  if (!exists(file)) return { state: 'absent', file, doc: null, problems: [] };
+  let doc;
+  try { doc = JSON.parse(read(file)); }
+  catch (error) { return { state: 'invalid', file, doc: null, problems: ['invalid-json'], error: error.message }; }
+  const checked = validateBaseline(doc);
+  if (!checked.ok) return { state: 'invalid', file, doc, problems: checked.problems };
+  return { state: 'valid', file, doc, problems: [] };
+}
+
+function buildBaseline(rows, rawResult, options = {}) {
+  const beforeTaskId = String(options.beforeTaskId || '');
+  const boundaryIndex = rows.findIndex(row => row.id === beforeTaskId);
+  if (boundaryIndex < 0) {
+    const error = new Error(`progress-tracker boundary not found: ${beforeTaskId}`);
+    error.code = 'E_CLAIMS_BASELINE_BOUNDARY';
+    throw error;
+  }
+  const eligibleRows = rows.slice(0, boundaryIndex).filter(row => /done|완료|completed/i.test(String(row.status || '')));
+  const eligible = new Map(eligibleRows.map(row => [row.id, row]));
+  const failures = (rawResult.results || []).filter(result => result && !result.ok && eligible.has(result.id));
+  const entries = failures.map(result => ({
+    id: result.id,
+    fingerprint: claimFingerprint(eligible.get(result.id), result.reasons),
+    reasons: normalizeReasons(result.reasons),
+  }));
+  const doc = {
+    schemaVersion: SCHEMA_VERSION,
+    kind: KIND,
+    createdAt: String(options.createdAt || new Date().toISOString()),
+    createdByVersion: String(options.version || 'unknown'),
+    beforeTaskId,
+    policy: POLICY,
+    evaluatedBefore: eligibleRows.length,
+    rawFailedBefore: entries.length,
+    entries,
+  };
+  doc.integrity = _integrity(doc);
+  return {
+    doc,
+    stats: {
+      evaluatedBefore: eligibleRows.length,
+      baselined: entries.length,
+      failuresAtOrAfterBoundary: (rawResult.results || []).filter(result => result && !result.ok && !eligible.has(result.id)).length,
+    },
+  };
+}
+
+function saveBaseline(root, doc, withLock) {
+  const checked = validateBaseline(doc);
+  if (!checked.ok) {
+    const error = new Error(`refusing to write invalid claims baseline: ${checked.problems.join(', ')}`);
+    error.code = 'E_CLAIMS_BASELINE_INVALID';
+    throw error;
+  }
+  const file = baselinePath(root);
+  const write = () => {
+    mkdirp(path.dirname(file));
+    if (exists(file)) {
+      const error = new Error(`claims baseline already exists and will not be overwritten: ${file}`);
+      error.code = 'E_CLAIMS_BASELINE_EXISTS';
+      throw error;
+    }
+    const temp = file + `.tmp-${process.pid}-${Date.now()}`;
+    writeUtf8(temp, JSON.stringify(doc, null, 2) + '\n');
+    try { fs.renameSync(temp, file); }
+    catch (error) {
+      try { fs.rmSync(temp, { force: true }); } catch {}
+      throw error;
+    }
+  };
+  if (typeof withLock === 'function') withLock(file, write);
+  else write();
+  return file;
+}
+
+function _rawResult(rawResult, state, extra = {}) {
+  return {
+    ...rawResult,
+    rawFailed: rawResult.failed,
+    baselined: 0,
+    baseline: { state, ...extra },
+    errors: [],
+  };
+}
+
+function applyBaseline(rows, rawResult, loaded, options = {}) {
+  if (options.raw) return _rawResult(rawResult, 'ignored');
+  if (!loaded || loaded.state === 'absent') return _rawResult(rawResult, 'absent', { file: loaded && loaded.file });
+  if (loaded.state !== 'valid') {
+    return {
+      ..._rawResult(rawResult, 'invalid', { file: loaded.file, problems: loaded.problems || [] }),
+      ok: false,
+      errors: ['baseline-invalid'],
+    };
+  }
+
+  const doc = loaded.doc;
+  const duplicateIds = rows.map(row => row.id).filter((id, index, all) => all.indexOf(id) !== index);
+  const boundaryIndex = rows.findIndex(row => row.id === doc.beforeTaskId);
+  const rowIndex = new Map(rows.map((row, index) => [row.id, index]));
+  const outOfScope = doc.entries.filter(entry => !rowIndex.has(entry.id) || rowIndex.get(entry.id) >= boundaryIndex).map(entry => entry.id);
+  if (boundaryIndex < 0 || duplicateIds.length || outOfScope.length) {
+    const problems = [
+      ...(boundaryIndex < 0 ? ['boundary-missing'] : []),
+      ...(duplicateIds.length ? ['duplicate-progress-id'] : []),
+      ...(outOfScope.length ? ['entry-outside-boundary'] : []),
+    ];
+    return {
+      ..._rawResult(rawResult, 'invalid-context', { file: loaded.file, problems, outOfScope: outOfScope.slice(0, 20) }),
+      ok: false,
+      errors: ['baseline-invalid-context'],
+    };
+  }
+
+  const rowsById = new Map(rows.map(row => [row.id, row]));
+  const entriesById = new Map(doc.entries.map(entry => [entry.id, entry]));
+  let accepted = 0;
+  const mismatched = [];
+  const newFailures = [];
+  const acceptedIds = new Set();
+  const results = (rawResult.results || []).map(result => {
+    if (!result || result.ok) return result;
+    const entry = entriesById.get(result.id);
+    if (!entry) { newFailures.push(result.id); return result; }
+    const fingerprint = claimFingerprint(rowsById.get(result.id), result.reasons);
+    if (fingerprint !== entry.fingerprint) {
+      mismatched.push(result.id);
+      return { ...result, baselineAccepted: false, baselineMismatch: true };
+    }
+    accepted++;
+    acceptedIds.add(result.id);
+    return {
+      ...result,
+      ok: true,
+      rawOk: false,
+      reasons: [],
+      baselineAccepted: true,
+      baselineReasons: normalizeReasons(result.reasons),
+    };
+  });
+  const failed = results.filter(result => result && !result.ok).length;
+  const inactiveEntries = doc.entries.filter(entry => !acceptedIds.has(entry.id) && !mismatched.includes(entry.id)).map(entry => entry.id);
+  return {
+    ok: failed === 0,
+    total: rawResult.total,
+    failed,
+    rawFailed: rawResult.failed,
+    baselined: accepted,
+    results,
+    baseline: {
+      state: 'applied',
+      file: loaded.file,
+      beforeTaskId: doc.beforeTaskId,
+      entries: doc.entries.length,
+      accepted,
+      mismatched: mismatched.slice(0, 20),
+      newFailures: newFailures.slice(0, 20),
+      inactiveEntries: inactiveEntries.slice(0, 20),
+    },
+    errors: [],
+  };
+}
+
+module.exports = {
+  SCHEMA_VERSION,
+  FILE_NAME,
+  baselinePath,
+  normalizeReasons,
+  claimFingerprint,
+  validateBaseline,
+  loadBaseline,
+  buildBaseline,
+  saveBaseline,
+  applyBaseline,
+};

package/lib/diagnostics.js

@@ -3,13 +3,151 @@
 //   - I/O: ./io(log).  node: child_process.
 //   - harness 고유 의존(VERSION · _selfTestCases · _detectShellCtx · _mcpToolCount · argv 파서 has · harnessPath)은 deps 주입(DI).
 //     _selfTestCases 의 각 case.run 클로저는 harness 스코프를 유지하므로 함수 참조 주입만으로 정상 동작.
-'use strict';
-const cp = require('child_process');
-const path = require('path');
+'use strict';
+const cp = require('child_process');
+const fs = require('fs');
+const path = require('path');
 const { log, fail, absRoot, exists, read } = require('./io');
 const { parseHarnessVersion, _parseChangelogBetween, compareVer } = require('./pure-utils');
 const { spawnNpmSync } = require('./npm-process');
 const { windowsPathCandidates } = require('./portable-process');
+
+const _WINDOWS_NPM_SHIM_EXTS = new Set(['', '.cmd', '.ps1']);
+
+function _pathKey(value, platform) {
+  const pathApi = platform === 'win32' ? path.win32 : path.posix;
+  let normalized = pathApi.normalize(String(value || ''));
+  if (platform === process.platform) {
+    try { normalized = fs.realpathSync.native(normalized); } catch {}
+  }
+  return platform === 'win32' ? normalized.toLowerCase() : normalized;
+}
+
+function _escapeRegExp(value) {
+  return String(value).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+function _readSmallText(filePath) {
+  const stat = fs.statSync(filePath);
+  if (!stat.isFile() || stat.size > 64 * 1024) return null;
+  return fs.readFileSync(filePath, 'utf8');
+}
+
+function _npmShimTargetsEntry(candidate, expectedEntry, platform) {
+  if (platform !== 'win32' || platform !== process.platform) return false;
+  const pathApi = path.win32;
+  const ext = pathApi.extname(candidate).toLowerCase();
+  if (!_WINDOWS_NPM_SHIM_EXTS.has(ext)) return false;
+  if (!ext) {
+    try {
+      if (_pathKey(fs.realpathSync.native(candidate), platform) === _pathKey(expectedEntry, platform)) return true;
+    } catch {}
+  }
+
+  let source;
+  try { source = _readSmallText(candidate); } catch { return false; }
+  if (source == null) return false;
+  const relative = pathApi.relative(pathApi.dirname(candidate), expectedEntry);
+  if (!relative || pathApi.isAbsolute(relative)) return false;
+  const lines = source.split(/\r?\n/);
+
+  if (!ext) {
+    const target = _escapeRegExp(`"$basedir/${relative.replace(/\\/g, '/')}"`);
+    const invocation = new RegExp(`^\\s*exec\\s+(?:"\\$basedir[\\\\/]node(?:\\.exe)?"|node(?:\\.exe)?)\\s+${target}\\s+"\\$@"\\s*$`, 'i');
+    const forwarded = lines.filter(line => !/^\s*#/.test(line) && /"\$@"\s*$/.test(line));
+    return forwarded.length > 0 && forwarded.every(line => invocation.test(line));
+  }
+
+  if (ext === '.cmd') {
+    const target = _escapeRegExp(`"%dp0%\\${relative.replace(/\//g, '\\')}"`);
+    const invocation = new RegExp(`^\\s*endLocal\\s+&\\s+goto\\s+#_undefined_#\\s+2>NUL\\s+\\|\\|\\s+title\\s+%COMSPEC%\\s+&\\s+"%_prog%"\\s+${target}\\s+%\\*\\s*$`, 'i');
+    const forwarded = lines.filter(line => !/^\s*(?:@?rem\b|::)/i.test(line) && /%\*\s*$/.test(line));
+    return forwarded.length === 1 && invocation.test(forwarded[0]);
+  }
+
+  const target = _escapeRegExp(`"$basedir/${relative.replace(/\\/g, '/')}"`);
+  const invocation = new RegExp(`^\\s*(?:\\$input\\s*\\|\\s*)?&\\s+(?:"\\$basedir[\\\\/]node\\$exe"|"node\\$exe")\\s+${target}\\s+\\$args\\s*$`, 'i');
+  const forwarded = lines.filter(line => !/^\s*#/.test(line) && /&/.test(line) && /\$args\s*$/.test(line));
+  return forwarded.length > 0 && forwarded.every(line => invocation.test(line));
+}
+
+function _npmPackageIdentity(candidate, options = {}) {
+  const platform = options.platform || process.platform;
+  if (platform !== process.platform) return null;
+  const pathApi = platform === 'win32' ? path.win32 : path.posix;
+  const command = String(options.command || 'leerness');
+  const packageName = String(options.packageName || command);
+  const dir = pathApi.dirname(candidate);
+  const manifests = [pathApi.join(dir, 'node_modules', packageName, 'package.json')];
+  if (pathApi.basename(dir).toLowerCase() === '.bin') {
+    manifests.push(pathApi.join(dir, '..', packageName, 'package.json'));
+  }
+  for (const manifest of manifests) {
+    try {
+      const stat = fs.statSync(manifest);
+      if (!stat.isFile() || stat.size > 64 * 1024) continue;
+      const pkg = JSON.parse(fs.readFileSync(manifest, 'utf8'));
+      const declaredBin = typeof pkg.bin === 'string' ? pkg.bin
+        : (pkg.bin && typeof pkg.bin === 'object'
+          && Object.prototype.hasOwnProperty.call(pkg.bin, command) ? pkg.bin[command] : null);
+      if (pkg.name !== packageName || typeof declaredBin !== 'string'
+          || !declaredBin.trim() || /\u0000/.test(declaredBin)) continue;
+      const expectedEntry = pathApi.resolve(pathApi.dirname(manifest), declaredBin);
+      if (!fs.statSync(expectedEntry).isFile()) continue;
+      if (!_npmShimTargetsEntry(candidate, expectedEntry, platform)) continue;
+      return _pathKey(expectedEntry, platform);
+    } catch {}
+  }
+  return null;
+}
+
+// `where leerness` returns each executable shim, not each PATH installation. A normal
+// Windows npm install therefore yields both `leerness` and `leerness.cmd`. Only merge
+// variants when the adjacent package manifest and the shim's resolved bin target
+// prove they belong to the same package; unproven same-stem files remain separate.
+function _groupPathInstallations(candidates, options = {}) {
+  const platform = options.platform || process.platform;
+  const pathApi = platform === 'win32' ? path.win32 : path.posix;
+  const command = String(options.command || 'leerness').toLowerCase();
+  const packageIdentity = typeof options.packageIdentity === 'function'
+    ? options.packageIdentity
+    : candidate => _npmPackageIdentity(candidate, {
+      platform, command, packageName: options.packageName || command,
+    });
+  const groups = [];
+  const byKey = new Map();
+
+  for (const rawCandidate of Array.isArray(candidates) ? candidates : []) {
+    const candidate = String(rawCandidate || '').trim();
+    if (!candidate) continue;
+    const normalized = pathApi.normalize(candidate);
+    const base = pathApi.basename(normalized);
+    const ext = pathApi.extname(base).toLowerCase();
+    const isNpmShimVariant = platform === 'win32' && _WINDOWS_NPM_SHIM_EXTS.has(ext);
+    const stem = isNpmShimVariant && ext ? base.slice(0, -ext.length) : base;
+    const directory = pathApi.dirname(normalized);
+    let kind = 'candidate';
+    let key = `candidate:${_pathKey(normalized, platform)}`;
+
+    if (isNpmShimVariant && stem.toLowerCase() === command) {
+      let identity = null;
+      try { identity = packageIdentity(normalized); } catch { identity = null; }
+      if (identity) {
+        kind = 'npm-package';
+        key = `npm:${_pathKey(directory, platform)}:${String(identity).toLowerCase()}`;
+      }
+    }
+
+    let group = byKey.get(key);
+    if (!group) {
+      group = { directory, kind, candidates: [] };
+      byKey.set(key, group);
+      groups.push(group);
+    }
+    group.candidates.push(candidate);
+  }
+  return groups;
+}
 
 function doctorCmd(opts = {}, deps = {}) {
   const { VERSION, uiLang, _selfTestCases, _selfTestReport, _controlSelftestEnv,
@@ -86,59 +224,70 @@ function doctorCmd(opts = {}, deps = {}) {
   return report;
 }
 
-function whichCmd(deps = {}) {
-  const { VERSION, uiLang, has, harnessPath } = deps;
-  const t = (ko, en) => (uiLang === 'en' ? en : ko);  // 1.28.2 (UR-0010 Phase 10c)
-  const out = {
+function whichCmd(deps = {}) {
+  const { VERSION, uiLang, has, harnessPath } = deps;
+  const t = (ko, en) => (uiLang === 'en' ? en : ko);  // 1.28.2 (UR-0010 Phase 10c)
+  const platform = deps.platform || process.platform;
+  const out = {
     version: VERSION,
     runningFrom: harnessPath,
     nodeVersion: process.version,
-    platform: process.platform,
+    platform,
     arch: process.arch,
     npm: {},
-    pathCandidates: []
+    pathCandidates: [],
+    pathInstallations: []
   };
-  // npm root -g (글로벌 설치 경로)
-  try {
-    const r = spawnNpmSync(['root', '-g'], { encoding: 'utf8', timeout: 5000 });
-    if (r.status === 0) out.npm.globalRoot = (r.stdout || '').trim();
-  } catch {}
-  // npm cache (npx 캐시 경로)
-  try {
-    const r = spawnNpmSync(['config', 'get', 'cache'], { encoding: 'utf8', timeout: 5000 });
-    if (r.status === 0) out.npm.cacheDir = (r.stdout || '').trim();
-  } catch {}
-  // npm 글로벌 leerness 설치 정보
-  try {
-    const r = spawnNpmSync(['ls', '-g', 'leerness', '--depth=0', '--json'], { encoding: 'utf8', timeout: 8000 });
-    if (r.stdout) {
-      try {
-        const j = JSON.parse(r.stdout);
-        if (j.dependencies?.leerness) out.npm.globalInstalled = j.dependencies.leerness.version;
-      } catch {}
-    }
-  } catch {}
+  if (!deps.skipNpm) {
+    // npm root -g (글로벌 설치 경로)
+    try {
+      const r = spawnNpmSync(['root', '-g'], { encoding: 'utf8', timeout: 5000 });
+      if (r.status === 0) out.npm.globalRoot = (r.stdout || '').trim();
+    } catch {}
+    // npm cache (npx 캐시 경로)
+    try {
+      const r = spawnNpmSync(['config', 'get', 'cache'], { encoding: 'utf8', timeout: 5000 });
+      if (r.status === 0) out.npm.cacheDir = (r.stdout || '').trim();
+    } catch {}
+    // npm 글로벌 leerness 설치 정보
+    try {
+      const r = spawnNpmSync(['ls', '-g', 'leerness', '--depth=0', '--json'], { encoding: 'utf8', timeout: 8000 });
+      if (r.stdout) {
+        try {
+          const j = JSON.parse(r.stdout);
+          if (j.dependencies?.leerness) out.npm.globalInstalled = j.dependencies.leerness.version;
+        } catch {}
+      }
+    } catch {}
+  }
   // PATH 후보 (Windows: absolute System32 where + PATH-only 필터 / Unix: which)
   try {
-    const isWin = process.platform === 'win32';
-    if (isWin) {
+    const isWin = platform === 'win32';
+    if (Array.isArray(deps.pathCandidates)) {
+      out.pathCandidates = deps.pathCandidates.slice();
+    } else if (isWin) {
       out.pathCandidates = windowsPathCandidates('leerness', { env: process.env, cwd: process.cwd() });
     } else {
       const r = cp.spawnSync('which', ['-a', 'leerness'], { encoding: 'utf8', timeout: 5000, shell: false });
       if (r.stdout) out.pathCandidates = (r.stdout || '').trim().split(/\r?\n/).filter(Boolean);
     }
   } catch {}
+  out.pathInstallations = _groupPathInstallations(out.pathCandidates, {
+    platform, command: 'leerness', packageName: 'leerness',
+    ...(typeof deps.packageIdentity === 'function' ? { packageIdentity: deps.packageIdentity } : {}),
+  });
   // 진단: 글로벌 설치된 leerness 와 현재 실행 버전이 다르면 경고
   out.diagnostics = [];
   if (out.npm.globalInstalled && out.npm.globalInstalled !== VERSION) {
     out.diagnostics.push(t(`⚠ 글로벌 설치 ${out.npm.globalInstalled} ≠ 현재 실행 ${VERSION} — npx 캐시 또는 PATH 충돌 의심`, `⚠ global install ${out.npm.globalInstalled} ≠ running ${VERSION} — suspect npx cache or PATH conflict`));
     out.diagnostics.push(t(`  → 강제 최신: npm i -g leerness@latest  /  또는 npx --yes leerness@latest <command>`, `  → force latest: npm i -g leerness@latest  /  or npx --yes leerness@latest <command>`));
   }
-  if (out.pathCandidates.length > 1) {
-    out.diagnostics.push(t(`⚠ PATH 에 leerness 가 ${out.pathCandidates.length}개 — 우선순위 충돌 가능`, `⚠ leerness appears ${out.pathCandidates.length}× on PATH — possible precedence conflict`));
+  if (out.pathInstallations.length > 1) {
+    out.diagnostics.push(t(`⚠ PATH 에 leerness 설치가 ${out.pathInstallations.length}개 — 우선순위 충돌 가능`, `⚠ ${out.pathInstallations.length} leerness installations appear on PATH — possible precedence conflict`));
     out.diagnostics.push(t(`  → 명시적 경로 사용: ${out.runningFrom}`, `  → use the explicit path: ${out.runningFrom}`));
   }
-  if (has('--json')) { log(JSON.stringify(out, null, 2)); return; }
+  if (deps.quiet) return out;
+  if (has('--json')) { log(JSON.stringify(out, null, 2)); return out; }
   log(`# leerness which (1.9.164)`);
   log(`${t('현재 실행', 'running from')}: ${out.runningFrom}`);
   log(`${t('버전', 'version')}:      v${out.version}`);
@@ -149,10 +298,15 @@ function whichCmd(deps = {}) {
   if (out.npm.cacheDir)   log(t(`  npm cache:   ${out.npm.cacheDir}  (npx 옛 버전이 여기 캐싱 — 의심 시 \`npm cache clean --force\`)`, `  npm cache:   ${out.npm.cacheDir}  (npx caches old versions here — if suspect: \`npm cache clean --force\`)`));
   if (out.npm.globalInstalled) log(t(`  글로벌 설치: leerness@${out.npm.globalInstalled}`, `  global install: leerness@${out.npm.globalInstalled}`));
   else log(t(`  글로벌 설치: (없음 — npx 또는 로컬 경로만 사용 중)`, `  global install: (none — using npx or a local path only)`));
-  if (out.pathCandidates.length) {
-    log('');
-    log(t(`## PATH 후보 (${out.pathCandidates.length}개)`, `## PATH candidates (${out.pathCandidates.length})`));
-    for (const p of out.pathCandidates) log(`  - ${p}`);
+  if (out.pathCandidates.length) {
+    log('');
+    log(t(`## PATH 후보 (${out.pathCandidates.length}개 · 설치 ${out.pathInstallations.length}개)`, `## PATH candidates (${out.pathCandidates.length} · ${out.pathInstallations.length} installation(s))`));
+    for (const p of out.pathCandidates) log(`  - ${p}`);
+    const groupedShims = out.pathInstallations.filter(group => group.kind === 'npm-package' && group.candidates.length > 1);
+    if (groupedShims.length) {
+      const variants = groupedShims.reduce((sum, group) => sum + group.candidates.length, 0);
+      log(t(`  ⓘ 동일 npm 설치의 shim 변형 ${variants}개를 설치 ${groupedShims.length}개로 그룹화`, `  ⓘ grouped ${variants} shim variants into ${groupedShims.length} npm installation(s)`));
+    }
   }
   if (out.diagnostics.length) {
     log('');
@@ -166,8 +320,9 @@ function whichCmd(deps = {}) {
   log(t(`💡 강제 최신 실행 방법:`, `💡 how to force the latest:`));
   log(t(`  1) npx --yes leerness@latest <command>        # npx 캐시 무시하고 최신 다운로드`, `  1) npx --yes leerness@latest <command>        # bypass npx cache, download latest`));
   log(t(`  2) npm i -g leerness@latest                    # 글로벌 설치 갱신`, `  2) npm i -g leerness@latest                    # update the global install`));
-  log(t(`  3) npm cache clean --force                     # npx 캐시 강제 비우기 (의심 시)`, `  3) npm cache clean --force                     # force-clear the npx cache (if suspect)`));
-}
+  log(t(`  3) npm cache clean --force                     # npx 캐시 강제 비우기 (의심 시)`, `  3) npm cache clean --force                     # force-clear the npx cache (if suspect)`));
+  return out;
+}
 
 // 1.9.394 (UR-0025): whats-new — 현재 워크스페이스 버전 → 도구 버전 CHANGELOG 차분(신규 명령/플래그/파일 요약). introspection 핸들러.
 //   순수 파서 _parseChangelogBetween(pure-utils) 사용. deps: VERSION/arg/has. CHANGELOG 경로는 root 우선, 없으면 pkg 자체(lib/../).
@@ -261,4 +416,4 @@ function whatsNewCmd(root, deps = {}) {
   log(t(`  4. 상세: \`cat CHANGELOG.md\` 또는 \`leerness whats-new --json\``, `  4. Details: \`cat CHANGELOG.md\` or \`leerness whats-new --json\``));
 }
 
-module.exports = { doctorCmd, whichCmd, whatsNewCmd };
+module.exports = { doctorCmd, whichCmd, whatsNewCmd, _groupPathInstallations, _npmPackageIdentity };

package/lib/mcp-tools.js

@@ -8,7 +8,7 @@ module.exports = [
   { name: 'leerness_drift_check', requiredTier: 'read-only', description: '1.9.136 — AI 에이전트 leerness 미사용 drift 자동 감지 JSON ({ root, score, level, signals[], healthy }). 5+ 신호 + 4단계 레벨 (🟢 healthy / 🟡 warning / 🟠 caution / 🔴 critical). 보안 신호 통합 (1.9.78)', inputSchema: { type: 'object', properties: { path: { type: 'string' } } } },
   { name: 'leerness_audit', requiredTier: 'safe-write', description: '1.9.102 — 워크스페이스 일관성 감사 JSON (warnings/failures/fixed/healthy + findings[]. kind 11종: design_dup/design_system_default/reuse_map_empty/milestone_unlinked/handoff_not_generated/current_state_stale/readme_version_mismatch/npm_cve/gitignore_missing_secrets/env_keys_missing/strict_promoted)', inputSchema: { type: 'object', properties: { path: { type: 'string' }, fix: { type: 'boolean' }, strict: { type: 'boolean' } } } },
   { name: 'leerness_verify_claim', requiredTier: 'read-only', description: 'AI 거짓 완료 자동 검증 (evidence 파일 + 실 테스트 실행). 1.9.309(UR-0048): done/완료 주장은 evidence(수정파일+테스트) 기본 강제 — 증거 없는 done 은 FAIL(exit 1). lenient=true 로 완화, runTests/strictClaims 추가 가능. 응답 verdict.evidenceComplete 포함.', inputSchema: { type: 'object', properties: { taskId: { type: 'string' }, path: { type: 'string' }, runTests: { type: 'boolean' }, strictClaims: { type: 'boolean' }, lenient: { type: 'boolean' }, refereeId: { type: 'string' } }, required: ['taskId'] } },
-  { name: 'leerness_verify_claim_all', requiredTier: 'read-only', description: '1.33.3 — 모든 done/완료 주장을 한 번에 검증(CI·스케일). progress-tracker 의 done 항목 전부를 verify-claim 정밀 검사(파일 존재·스텁·부풀린 카운트·증거 완전성)로 일괄 점검. 응답 { ok, total, failed, results:[{id,ok,reasons}] }. 세션 마감 전 "내 완료 주장 전부 증거와 맞는가?" 자가 점검용. runTests/strictClaims/lenient 추가 가능.', inputSchema: { type: 'object', properties: { path: { type: 'string' }, runTests: { type: 'boolean' }, strictClaims: { type: 'boolean' }, lenient: { type: 'boolean' } } } },
+  { name: 'leerness_verify_claim_all', requiredTier: 'read-only', description: '1.33.3/1.36.167 — 모든 done/완료 주장을 한 번에 검증(CI·스케일). 명시적 claims baseline이 있으면 exact 행+실패사유 지문이 같은 경계 이전 레거시 부채만 격리하고 새/변경 실패는 계속 차단한다. 응답 { ok, total, failed, rawFailed, baselined, baseline, results }. raw=true면 baseline을 무시하고 원판정을 감사한다.', inputSchema: { type: 'object', properties: { path: { type: 'string' }, runTests: { type: 'boolean' }, strictClaims: { type: 'boolean' }, lenient: { type: 'boolean' }, raw: { type: 'boolean' } } } },
   { name: 'leerness_contract_verify', requiredTier: 'read-only', description: '명세 ↔ 구현 함수/필드 일치 자동 검사', inputSchema: { type: 'object', properties: { spec: { type: 'string' }, impl: { type: 'string' } }, required: ['spec', 'impl'] } },
   { name: 'leerness_agents_list', requiredTier: 'read-only', description: '외부 AI CLI 가용성 표 (claude/codex/agy/copilot 상태 + 환경변수 활성화 여부)', inputSchema: { type: 'object', properties: {} } },
   { name: 'leerness_reuse_map', requiredTier: 'read-only', description: '워크스페이스 중복 함수/capability 자동 감지 (--all-apps + fuzzy 매칭)', inputSchema: { type: 'object', properties: { path: { type: 'string' }, allApps: { type: 'boolean' }, strictElements: { type: 'boolean' } } } },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "leerness",
-  "version": "1.36.166",
+  "version": "1.36.168",
   "description": "The AI-coding operations layer that makes \"done\" require evidence — persistent memory, evidence-gated completion checks, and clean handoffs for any AI agent (Claude Code, Codex, Cursor). State lives as plain files in your repo. CLI + MCP, 0 runtime dependencies.",
   "keywords": [
     "leerness",
@@ -48,12 +48,12 @@
     "LICENSE"
   ],
   "scripts": {
-    "test": "node ./scripts/lint.js && node ./scripts/workspace-dir-source-ratchet.js && node ./scripts/workspace-dir-migration-probe.js && node ./scripts/lock-probe.js && node ./scripts/platform-smoke.js && node ./scripts/verify-code-cross-runtime-probe.js && node ./scripts/release-runtime-probe.js && node ./bin/leerness.js --version && node ./bin/leerness.js selftest && node ./scripts/e2e-core.js && node ./scripts/handoff-readonly-probe.js && npm run test:commands && npm run test:installed && node ./scripts/e2e.js",
-    "test:core": "node ./scripts/lint.js && node ./scripts/workspace-dir-source-ratchet.js && node ./scripts/workspace-dir-migration-probe.js && node ./scripts/lock-probe.js && node ./scripts/platform-smoke.js && node ./scripts/verify-code-cross-runtime-probe.js && node ./scripts/release-runtime-probe.js && node ./bin/leerness.js --version && node ./bin/leerness.js selftest && node ./scripts/e2e-core.js && node ./scripts/handoff-readonly-probe.js",
-    "test:commands": "node ./scripts/command-flags-probe.js && node ./scripts/e2e-command-surface.js",
+    "test": "node ./scripts/lint.js && node ./scripts/workspace-dir-source-ratchet.js && node ./scripts/workspace-dir-migration-probe.js && node ./scripts/lock-probe.js && node ./scripts/platform-smoke.js && node ./scripts/verify-code-cross-runtime-probe.js && node ./scripts/release-runtime-probe.js && node ./scripts/which-shim-probe.js && node ./bin/leerness.js --version && node ./bin/leerness.js selftest && node ./scripts/e2e-core.js && node ./scripts/handoff-readonly-probe.js && npm run test:commands && npm run test:installed && node ./scripts/e2e.js",
+    "test:core": "node ./scripts/lint.js && node ./scripts/workspace-dir-source-ratchet.js && node ./scripts/workspace-dir-migration-probe.js && node ./scripts/lock-probe.js && node ./scripts/platform-smoke.js && node ./scripts/verify-code-cross-runtime-probe.js && node ./scripts/release-runtime-probe.js && node ./scripts/which-shim-probe.js && node ./bin/leerness.js --version && node ./bin/leerness.js selftest && node ./scripts/e2e-core.js && node ./scripts/handoff-readonly-probe.js",
+    "test:commands": "node ./scripts/command-flags-probe.js && node ./scripts/claims-baseline-probe.js && node ./scripts/claims-baseline-concurrency-probe.js && node ./scripts/e2e-command-surface.js",
     "test:installed": "node ./scripts/installed-cleanroom-probe.js",
     "test:handoff": "node ./scripts/handoff-readonly-probe.js",
-    "test:fast": "node ./scripts/lint.js && node ./scripts/workspace-dir-source-ratchet.js && node ./scripts/workspace-dir-migration-probe.js && node ./scripts/lock-probe.js && node ./scripts/platform-smoke.js && node ./scripts/release-runtime-probe.js && node ./scripts/smoke.js",
+    "test:fast": "node ./scripts/lint.js && node ./scripts/workspace-dir-source-ratchet.js && node ./scripts/workspace-dir-migration-probe.js && node ./scripts/lock-probe.js && node ./scripts/platform-smoke.js && node ./scripts/release-runtime-probe.js && node ./scripts/which-shim-probe.js && node ./scripts/smoke.js",
     "test:smoke": "node ./scripts/smoke.js",
     "lint": "node ./scripts/lint.js",
     "prepack": "node ./bin/leerness.js readme sync . && node ./bin/leerness.js --version"