leerness 1.36.167 → 1.36.168

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 1.36.168 — 2026-08-26
+
+- Windows which가 동일 npm 설치의 extensionless/.cmd/.ps1 shim을 실제 package bin target과 npm 실행문까지 검증한 뒤 한 설치로 그룹화하고, pathCandidates 원문은 유지한 채 pathInstallations를 추가해 PATH 충돌 오탐을 제거. 독립 검토에서 잡힌 주석·더미 인자 우회까지 막아 변조·미증명·다른 디렉터리·비표준 .bat·POSIX 후보를 보수적으로 분리하며 15개 회귀 프로브와 제품 배선 가드 추가.
+
 ## 1.36.167 — 2026-08-26
 
 - T-0145: 장기 운영 프로젝트의 레거시 완료 증거를 소급 수정하지 않고 명시적 tracker 경계 이전의 현재 실패만 exact 행+사유 SHA-256 지문으로 격리하는 claims baseline을 추가했습니다. verify-claim --all과 gate --claims는 원판정 실패·baseline 부채·현재 차단 및 진단 상세를 분리해 보고하고, --raw/개별 검증은 원판정을 유지합니다. 행 변경·신규 실패·경계 밖 항목·손상 baseline은 fail-closed하며, 생성 명령은 기존 baseline을 덮어쓰지 않아 변경 행의 재승인을 차단합니다. CLI·MCP·클린룸 프로브로 검증합니다.

package/README.md

@@ -138,7 +138,7 @@ MIT
 <!-- leerness:project-readme:start -->
 ## Leerness Project Harness
 
-이 프로젝트는 Leerness v1.36.167 하네스를 사용합니다. AI 에이전트는 작업 전 `leerness handoff`로 컨텍스트를 적재하고, 작업 후 `leerness check`/`leerness audit`/`leerness session close`를 수행해야 합니다.
+이 프로젝트는 Leerness v1.36.168 하네스를 사용합니다. AI 에이전트는 작업 전 `leerness handoff`로 컨텍스트를 적재하고, 작업 후 `leerness check`/`leerness audit`/`leerness session close`를 수행해야 합니다.
 
 ### 정체성 — AI 에이전트 운영 레이어 (UR-0030)
 
@@ -192,7 +192,7 @@ leerness memory restore decision <date|title>
 
 ### MCP server (외부 AI 통합)
 
-Leerness v1.36.167는 stdio JSON-RPC MCP server를 내장합니다 — Claude Code · Cursor · Codex CLI 등 외부 AI에 **89개 도구**를 노출:
+Leerness v1.36.168는 stdio JSON-RPC MCP server를 내장합니다 — Claude Code · Cursor · Codex CLI 등 외부 AI에 **89개 도구**를 노출:
 
 ```jsonc
 // 카테고리별
@@ -213,7 +213,7 @@ Leerness v1.36.167는 stdio JSON-RPC MCP server를 내장합니다 — Claude Co
 `<<autonomous-loop-dynamic>>` 신호만 보내면 AI가:
 1) 다음 라운드 후보 선정 → 2) 코드 변경 → 3) 회귀 테스트 갱신 → 4) 전체 e2e 스위트 통과 → 5) npm publish + git tag → 6) main push → 7) session close → 8) 다음 라운드 예약.
 
-현재 누적: **v1.9.x → 1.36.167 릴리스 태그 이력** (수백 라운드) · _reports/는 비공개 보존.
+현재 누적: **v1.9.x → 1.36.168 릴리스 태그 이력** (수백 라운드) · _reports/는 비공개 보존.
 
 ### 성능 가이드
 
@@ -251,5 +251,5 @@ leerness release pack --close --auto-main-push
 - `.leerness/session-handoff.md`: 다음 세션 인수인계 (자동 작성)
 - `.leerness/lessons.md` / `decisions.md` / `rules.md`: 영구 메모리 (5 surface)
 
-Last synced by Leerness v1.36.167: 2026-08-26
+Last synced by Leerness v1.36.168: 2026-08-26
 <!-- leerness:project-readme:end -->

package/bin/leerness.js

@@ -48,7 +48,7 @@ const {
   migrateLegacyWorkspace,
 } = require('../lib/workspace-dir');
 
-const VERSION = '1.36.167';
+const VERSION = '1.36.168';
 
 // 1.9.290 (UR-0037, Codex gpt-5.5 #4 수렴): CLI 전용 부작용은 require 시 실행하지 않는다.
 //   이전: warning listener 제거 / NODE_OPTIONS 변경 / chcp IIFE 가 top-level 즉시 실행 → require('harness') 시 호스트 프로세스 오염.

package/lib/diagnostics.js

@@ -3,13 +3,151 @@
 //   - I/O: ./io(log).  node: child_process.
 //   - harness 고유 의존(VERSION · _selfTestCases · _detectShellCtx · _mcpToolCount · argv 파서 has · harnessPath)은 deps 주입(DI).
 //     _selfTestCases 의 각 case.run 클로저는 harness 스코프를 유지하므로 함수 참조 주입만으로 정상 동작.
-'use strict';
-const cp = require('child_process');
-const path = require('path');
+'use strict';
+const cp = require('child_process');
+const fs = require('fs');
+const path = require('path');
 const { log, fail, absRoot, exists, read } = require('./io');
 const { parseHarnessVersion, _parseChangelogBetween, compareVer } = require('./pure-utils');
 const { spawnNpmSync } = require('./npm-process');
 const { windowsPathCandidates } = require('./portable-process');
+
+const _WINDOWS_NPM_SHIM_EXTS = new Set(['', '.cmd', '.ps1']);
+
+function _pathKey(value, platform) {
+  const pathApi = platform === 'win32' ? path.win32 : path.posix;
+  let normalized = pathApi.normalize(String(value || ''));
+  if (platform === process.platform) {
+    try { normalized = fs.realpathSync.native(normalized); } catch {}
+  }
+  return platform === 'win32' ? normalized.toLowerCase() : normalized;
+}
+
+function _escapeRegExp(value) {
+  return String(value).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+function _readSmallText(filePath) {
+  const stat = fs.statSync(filePath);
+  if (!stat.isFile() || stat.size > 64 * 1024) return null;
+  return fs.readFileSync(filePath, 'utf8');
+}
+
+function _npmShimTargetsEntry(candidate, expectedEntry, platform) {
+  if (platform !== 'win32' || platform !== process.platform) return false;
+  const pathApi = path.win32;
+  const ext = pathApi.extname(candidate).toLowerCase();
+  if (!_WINDOWS_NPM_SHIM_EXTS.has(ext)) return false;
+  if (!ext) {
+    try {
+      if (_pathKey(fs.realpathSync.native(candidate), platform) === _pathKey(expectedEntry, platform)) return true;
+    } catch {}
+  }
+
+  let source;
+  try { source = _readSmallText(candidate); } catch { return false; }
+  if (source == null) return false;
+  const relative = pathApi.relative(pathApi.dirname(candidate), expectedEntry);
+  if (!relative || pathApi.isAbsolute(relative)) return false;
+  const lines = source.split(/\r?\n/);
+
+  if (!ext) {
+    const target = _escapeRegExp(`"$basedir/${relative.replace(/\\/g, '/')}"`);
+    const invocation = new RegExp(`^\\s*exec\\s+(?:"\\$basedir[\\\\/]node(?:\\.exe)?"|node(?:\\.exe)?)\\s+${target}\\s+"\\$@"\\s*$`, 'i');
+    const forwarded = lines.filter(line => !/^\s*#/.test(line) && /"\$@"\s*$/.test(line));
+    return forwarded.length > 0 && forwarded.every(line => invocation.test(line));
+  }
+
+  if (ext === '.cmd') {
+    const target = _escapeRegExp(`"%dp0%\\${relative.replace(/\//g, '\\')}"`);
+    const invocation = new RegExp(`^\\s*endLocal\\s+&\\s+goto\\s+#_undefined_#\\s+2>NUL\\s+\\|\\|\\s+title\\s+%COMSPEC%\\s+&\\s+"%_prog%"\\s+${target}\\s+%\\*\\s*$`, 'i');
+    const forwarded = lines.filter(line => !/^\s*(?:@?rem\b|::)/i.test(line) && /%\*\s*$/.test(line));
+    return forwarded.length === 1 && invocation.test(forwarded[0]);
+  }
+
+  const target = _escapeRegExp(`"$basedir/${relative.replace(/\\/g, '/')}"`);
+  const invocation = new RegExp(`^\\s*(?:\\$input\\s*\\|\\s*)?&\\s+(?:"\\$basedir[\\\\/]node\\$exe"|"node\\$exe")\\s+${target}\\s+\\$args\\s*$`, 'i');
+  const forwarded = lines.filter(line => !/^\s*#/.test(line) && /&/.test(line) && /\$args\s*$/.test(line));
+  return forwarded.length > 0 && forwarded.every(line => invocation.test(line));
+}
+
+function _npmPackageIdentity(candidate, options = {}) {
+  const platform = options.platform || process.platform;
+  if (platform !== process.platform) return null;
+  const pathApi = platform === 'win32' ? path.win32 : path.posix;
+  const command = String(options.command || 'leerness');
+  const packageName = String(options.packageName || command);
+  const dir = pathApi.dirname(candidate);
+  const manifests = [pathApi.join(dir, 'node_modules', packageName, 'package.json')];
+  if (pathApi.basename(dir).toLowerCase() === '.bin') {
+    manifests.push(pathApi.join(dir, '..', packageName, 'package.json'));
+  }
+  for (const manifest of manifests) {
+    try {
+      const stat = fs.statSync(manifest);
+      if (!stat.isFile() || stat.size > 64 * 1024) continue;
+      const pkg = JSON.parse(fs.readFileSync(manifest, 'utf8'));
+      const declaredBin = typeof pkg.bin === 'string' ? pkg.bin
+        : (pkg.bin && typeof pkg.bin === 'object'
+          && Object.prototype.hasOwnProperty.call(pkg.bin, command) ? pkg.bin[command] : null);
+      if (pkg.name !== packageName || typeof declaredBin !== 'string'
+          || !declaredBin.trim() || /\u0000/.test(declaredBin)) continue;
+      const expectedEntry = pathApi.resolve(pathApi.dirname(manifest), declaredBin);
+      if (!fs.statSync(expectedEntry).isFile()) continue;
+      if (!_npmShimTargetsEntry(candidate, expectedEntry, platform)) continue;
+      return _pathKey(expectedEntry, platform);
+    } catch {}
+  }
+  return null;
+}
+
+// `where leerness` returns each executable shim, not each PATH installation. A normal
+// Windows npm install therefore yields both `leerness` and `leerness.cmd`. Only merge
+// variants when the adjacent package manifest and the shim's resolved bin target
+// prove they belong to the same package; unproven same-stem files remain separate.
+function _groupPathInstallations(candidates, options = {}) {
+  const platform = options.platform || process.platform;
+  const pathApi = platform === 'win32' ? path.win32 : path.posix;
+  const command = String(options.command || 'leerness').toLowerCase();
+  const packageIdentity = typeof options.packageIdentity === 'function'
+    ? options.packageIdentity
+    : candidate => _npmPackageIdentity(candidate, {
+      platform, command, packageName: options.packageName || command,
+    });
+  const groups = [];
+  const byKey = new Map();
+
+  for (const rawCandidate of Array.isArray(candidates) ? candidates : []) {
+    const candidate = String(rawCandidate || '').trim();
+    if (!candidate) continue;
+    const normalized = pathApi.normalize(candidate);
+    const base = pathApi.basename(normalized);
+    const ext = pathApi.extname(base).toLowerCase();
+    const isNpmShimVariant = platform === 'win32' && _WINDOWS_NPM_SHIM_EXTS.has(ext);
+    const stem = isNpmShimVariant && ext ? base.slice(0, -ext.length) : base;
+    const directory = pathApi.dirname(normalized);
+    let kind = 'candidate';
+    let key = `candidate:${_pathKey(normalized, platform)}`;
+
+    if (isNpmShimVariant && stem.toLowerCase() === command) {
+      let identity = null;
+      try { identity = packageIdentity(normalized); } catch { identity = null; }
+      if (identity) {
+        kind = 'npm-package';
+        key = `npm:${_pathKey(directory, platform)}:${String(identity).toLowerCase()}`;
+      }
+    }
+
+    let group = byKey.get(key);
+    if (!group) {
+      group = { directory, kind, candidates: [] };
+      byKey.set(key, group);
+      groups.push(group);
+    }
+    group.candidates.push(candidate);
+  }
+  return groups;
+}
 
 function doctorCmd(opts = {}, deps = {}) {
   const { VERSION, uiLang, _selfTestCases, _selfTestReport, _controlSelftestEnv,
@@ -86,59 +224,70 @@ function doctorCmd(opts = {}, deps = {}) {
   return report;
 }
 
-function whichCmd(deps = {}) {
-  const { VERSION, uiLang, has, harnessPath } = deps;
-  const t = (ko, en) => (uiLang === 'en' ? en : ko);  // 1.28.2 (UR-0010 Phase 10c)
-  const out = {
+function whichCmd(deps = {}) {
+  const { VERSION, uiLang, has, harnessPath } = deps;
+  const t = (ko, en) => (uiLang === 'en' ? en : ko);  // 1.28.2 (UR-0010 Phase 10c)
+  const platform = deps.platform || process.platform;
+  const out = {
     version: VERSION,
     runningFrom: harnessPath,
     nodeVersion: process.version,
-    platform: process.platform,
+    platform,
     arch: process.arch,
     npm: {},
-    pathCandidates: []
+    pathCandidates: [],
+    pathInstallations: []
   };
-  // npm root -g (글로벌 설치 경로)
-  try {
-    const r = spawnNpmSync(['root', '-g'], { encoding: 'utf8', timeout: 5000 });
-    if (r.status === 0) out.npm.globalRoot = (r.stdout || '').trim();
-  } catch {}
-  // npm cache (npx 캐시 경로)
-  try {
-    const r = spawnNpmSync(['config', 'get', 'cache'], { encoding: 'utf8', timeout: 5000 });
-    if (r.status === 0) out.npm.cacheDir = (r.stdout || '').trim();
-  } catch {}
-  // npm 글로벌 leerness 설치 정보
-  try {
-    const r = spawnNpmSync(['ls', '-g', 'leerness', '--depth=0', '--json'], { encoding: 'utf8', timeout: 8000 });
-    if (r.stdout) {
-      try {
-        const j = JSON.parse(r.stdout);
-        if (j.dependencies?.leerness) out.npm.globalInstalled = j.dependencies.leerness.version;
-      } catch {}
-    }
-  } catch {}
+  if (!deps.skipNpm) {
+    // npm root -g (글로벌 설치 경로)
+    try {
+      const r = spawnNpmSync(['root', '-g'], { encoding: 'utf8', timeout: 5000 });
+      if (r.status === 0) out.npm.globalRoot = (r.stdout || '').trim();
+    } catch {}
+    // npm cache (npx 캐시 경로)
+    try {
+      const r = spawnNpmSync(['config', 'get', 'cache'], { encoding: 'utf8', timeout: 5000 });
+      if (r.status === 0) out.npm.cacheDir = (r.stdout || '').trim();
+    } catch {}
+    // npm 글로벌 leerness 설치 정보
+    try {
+      const r = spawnNpmSync(['ls', '-g', 'leerness', '--depth=0', '--json'], { encoding: 'utf8', timeout: 8000 });
+      if (r.stdout) {
+        try {
+          const j = JSON.parse(r.stdout);
+          if (j.dependencies?.leerness) out.npm.globalInstalled = j.dependencies.leerness.version;
+        } catch {}
+      }
+    } catch {}
+  }
   // PATH 후보 (Windows: absolute System32 where + PATH-only 필터 / Unix: which)
   try {
-    const isWin = process.platform === 'win32';
-    if (isWin) {
+    const isWin = platform === 'win32';
+    if (Array.isArray(deps.pathCandidates)) {
+      out.pathCandidates = deps.pathCandidates.slice();
+    } else if (isWin) {
       out.pathCandidates = windowsPathCandidates('leerness', { env: process.env, cwd: process.cwd() });
     } else {
       const r = cp.spawnSync('which', ['-a', 'leerness'], { encoding: 'utf8', timeout: 5000, shell: false });
       if (r.stdout) out.pathCandidates = (r.stdout || '').trim().split(/\r?\n/).filter(Boolean);
     }
   } catch {}
+  out.pathInstallations = _groupPathInstallations(out.pathCandidates, {
+    platform, command: 'leerness', packageName: 'leerness',
+    ...(typeof deps.packageIdentity === 'function' ? { packageIdentity: deps.packageIdentity } : {}),
+  });
   // 진단: 글로벌 설치된 leerness 와 현재 실행 버전이 다르면 경고
   out.diagnostics = [];
   if (out.npm.globalInstalled && out.npm.globalInstalled !== VERSION) {
     out.diagnostics.push(t(`⚠ 글로벌 설치 ${out.npm.globalInstalled} ≠ 현재 실행 ${VERSION} — npx 캐시 또는 PATH 충돌 의심`, `⚠ global install ${out.npm.globalInstalled} ≠ running ${VERSION} — suspect npx cache or PATH conflict`));
     out.diagnostics.push(t(`  → 강제 최신: npm i -g leerness@latest  /  또는 npx --yes leerness@latest <command>`, `  → force latest: npm i -g leerness@latest  /  or npx --yes leerness@latest <command>`));
   }
-  if (out.pathCandidates.length > 1) {
-    out.diagnostics.push(t(`⚠ PATH 에 leerness 가 ${out.pathCandidates.length}개 — 우선순위 충돌 가능`, `⚠ leerness appears ${out.pathCandidates.length}× on PATH — possible precedence conflict`));
+  if (out.pathInstallations.length > 1) {
+    out.diagnostics.push(t(`⚠ PATH 에 leerness 설치가 ${out.pathInstallations.length}개 — 우선순위 충돌 가능`, `⚠ ${out.pathInstallations.length} leerness installations appear on PATH — possible precedence conflict`));
     out.diagnostics.push(t(`  → 명시적 경로 사용: ${out.runningFrom}`, `  → use the explicit path: ${out.runningFrom}`));
   }
-  if (has('--json')) { log(JSON.stringify(out, null, 2)); return; }
+  if (deps.quiet) return out;
+  if (has('--json')) { log(JSON.stringify(out, null, 2)); return out; }
   log(`# leerness which (1.9.164)`);
   log(`${t('현재 실행', 'running from')}: ${out.runningFrom}`);
   log(`${t('버전', 'version')}:      v${out.version}`);
@@ -149,10 +298,15 @@ function whichCmd(deps = {}) {
   if (out.npm.cacheDir)   log(t(`  npm cache:   ${out.npm.cacheDir}  (npx 옛 버전이 여기 캐싱 — 의심 시 \`npm cache clean --force\`)`, `  npm cache:   ${out.npm.cacheDir}  (npx caches old versions here — if suspect: \`npm cache clean --force\`)`));
   if (out.npm.globalInstalled) log(t(`  글로벌 설치: leerness@${out.npm.globalInstalled}`, `  global install: leerness@${out.npm.globalInstalled}`));
   else log(t(`  글로벌 설치: (없음 — npx 또는 로컬 경로만 사용 중)`, `  global install: (none — using npx or a local path only)`));
-  if (out.pathCandidates.length) {
-    log('');
-    log(t(`## PATH 후보 (${out.pathCandidates.length}개)`, `## PATH candidates (${out.pathCandidates.length})`));
-    for (const p of out.pathCandidates) log(`  - ${p}`);
+  if (out.pathCandidates.length) {
+    log('');
+    log(t(`## PATH 후보 (${out.pathCandidates.length}개 · 설치 ${out.pathInstallations.length}개)`, `## PATH candidates (${out.pathCandidates.length} · ${out.pathInstallations.length} installation(s))`));
+    for (const p of out.pathCandidates) log(`  - ${p}`);
+    const groupedShims = out.pathInstallations.filter(group => group.kind === 'npm-package' && group.candidates.length > 1);
+    if (groupedShims.length) {
+      const variants = groupedShims.reduce((sum, group) => sum + group.candidates.length, 0);
+      log(t(`  ⓘ 동일 npm 설치의 shim 변형 ${variants}개를 설치 ${groupedShims.length}개로 그룹화`, `  ⓘ grouped ${variants} shim variants into ${groupedShims.length} npm installation(s)`));
+    }
   }
   if (out.diagnostics.length) {
     log('');
@@ -166,8 +320,9 @@ function whichCmd(deps = {}) {
   log(t(`💡 강제 최신 실행 방법:`, `💡 how to force the latest:`));
   log(t(`  1) npx --yes leerness@latest <command>        # npx 캐시 무시하고 최신 다운로드`, `  1) npx --yes leerness@latest <command>        # bypass npx cache, download latest`));
   log(t(`  2) npm i -g leerness@latest                    # 글로벌 설치 갱신`, `  2) npm i -g leerness@latest                    # update the global install`));
-  log(t(`  3) npm cache clean --force                     # npx 캐시 강제 비우기 (의심 시)`, `  3) npm cache clean --force                     # force-clear the npx cache (if suspect)`));
-}
+  log(t(`  3) npm cache clean --force                     # npx 캐시 강제 비우기 (의심 시)`, `  3) npm cache clean --force                     # force-clear the npx cache (if suspect)`));
+  return out;
+}
 
 // 1.9.394 (UR-0025): whats-new — 현재 워크스페이스 버전 → 도구 버전 CHANGELOG 차분(신규 명령/플래그/파일 요약). introspection 핸들러.
 //   순수 파서 _parseChangelogBetween(pure-utils) 사용. deps: VERSION/arg/has. CHANGELOG 경로는 root 우선, 없으면 pkg 자체(lib/../).
@@ -261,4 +416,4 @@ function whatsNewCmd(root, deps = {}) {
   log(t(`  4. 상세: \`cat CHANGELOG.md\` 또는 \`leerness whats-new --json\``, `  4. Details: \`cat CHANGELOG.md\` or \`leerness whats-new --json\``));
 }
 
-module.exports = { doctorCmd, whichCmd, whatsNewCmd };
+module.exports = { doctorCmd, whichCmd, whatsNewCmd, _groupPathInstallations, _npmPackageIdentity };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "leerness",
-  "version": "1.36.167",
+  "version": "1.36.168",
   "description": "The AI-coding operations layer that makes \"done\" require evidence — persistent memory, evidence-gated completion checks, and clean handoffs for any AI agent (Claude Code, Codex, Cursor). State lives as plain files in your repo. CLI + MCP, 0 runtime dependencies.",
   "keywords": [
     "leerness",
@@ -48,12 +48,12 @@
     "LICENSE"
   ],
   "scripts": {
-    "test": "node ./scripts/lint.js && node ./scripts/workspace-dir-source-ratchet.js && node ./scripts/workspace-dir-migration-probe.js && node ./scripts/lock-probe.js && node ./scripts/platform-smoke.js && node ./scripts/verify-code-cross-runtime-probe.js && node ./scripts/release-runtime-probe.js && node ./bin/leerness.js --version && node ./bin/leerness.js selftest && node ./scripts/e2e-core.js && node ./scripts/handoff-readonly-probe.js && npm run test:commands && npm run test:installed && node ./scripts/e2e.js",
-    "test:core": "node ./scripts/lint.js && node ./scripts/workspace-dir-source-ratchet.js && node ./scripts/workspace-dir-migration-probe.js && node ./scripts/lock-probe.js && node ./scripts/platform-smoke.js && node ./scripts/verify-code-cross-runtime-probe.js && node ./scripts/release-runtime-probe.js && node ./bin/leerness.js --version && node ./bin/leerness.js selftest && node ./scripts/e2e-core.js && node ./scripts/handoff-readonly-probe.js",
+    "test": "node ./scripts/lint.js && node ./scripts/workspace-dir-source-ratchet.js && node ./scripts/workspace-dir-migration-probe.js && node ./scripts/lock-probe.js && node ./scripts/platform-smoke.js && node ./scripts/verify-code-cross-runtime-probe.js && node ./scripts/release-runtime-probe.js && node ./scripts/which-shim-probe.js && node ./bin/leerness.js --version && node ./bin/leerness.js selftest && node ./scripts/e2e-core.js && node ./scripts/handoff-readonly-probe.js && npm run test:commands && npm run test:installed && node ./scripts/e2e.js",
+    "test:core": "node ./scripts/lint.js && node ./scripts/workspace-dir-source-ratchet.js && node ./scripts/workspace-dir-migration-probe.js && node ./scripts/lock-probe.js && node ./scripts/platform-smoke.js && node ./scripts/verify-code-cross-runtime-probe.js && node ./scripts/release-runtime-probe.js && node ./scripts/which-shim-probe.js && node ./bin/leerness.js --version && node ./bin/leerness.js selftest && node ./scripts/e2e-core.js && node ./scripts/handoff-readonly-probe.js",
     "test:commands": "node ./scripts/command-flags-probe.js && node ./scripts/claims-baseline-probe.js && node ./scripts/claims-baseline-concurrency-probe.js && node ./scripts/e2e-command-surface.js",
     "test:installed": "node ./scripts/installed-cleanroom-probe.js",
     "test:handoff": "node ./scripts/handoff-readonly-probe.js",
-    "test:fast": "node ./scripts/lint.js && node ./scripts/workspace-dir-source-ratchet.js && node ./scripts/workspace-dir-migration-probe.js && node ./scripts/lock-probe.js && node ./scripts/platform-smoke.js && node ./scripts/release-runtime-probe.js && node ./scripts/smoke.js",
+    "test:fast": "node ./scripts/lint.js && node ./scripts/workspace-dir-source-ratchet.js && node ./scripts/workspace-dir-migration-probe.js && node ./scripts/lock-probe.js && node ./scripts/platform-smoke.js && node ./scripts/release-runtime-probe.js && node ./scripts/which-shim-probe.js && node ./scripts/smoke.js",
     "test:smoke": "node ./scripts/smoke.js",
     "lint": "node ./scripts/lint.js",
     "prepack": "node ./bin/leerness.js readme sync . && node ./bin/leerness.js --version"

package/scripts/release-runtime-probe.js

@@ -1124,8 +1124,11 @@ try {
       || /spawnSync\(['"]where(?:\.exe)?['"]/.test(npmSource)) {
     failures.push('공용 npm resolver가 bare where 또는 동적 cmd wrapper로 후퇴함');
   }
-  if (!diagnosticsSource.includes("windowsPathCandidates('leerness'") || /spawnSync\(tool,/.test(diagnosticsSource)) {
-    failures.push('which 진단이 Windows bare where를 다시 실행함');
+  if (!diagnosticsSource.includes("windowsPathCandidates('leerness'")
+      || !diagnosticsSource.includes('out.pathInstallations = _groupPathInstallations')
+      || !diagnosticsSource.includes('if (out.pathInstallations.length > 1)')
+      || /spawnSync\(tool,/.test(diagnosticsSource)) {
+    failures.push('which 진단이 안전한 Windows PATH 수집 또는 설치 단위 그룹화를 잃음');
   }
   if (cliSource.includes("cp.execSync('npm root -g'") || cliSource.includes("cp.spawnSync('chcp.com'")
       || cliSource.includes("cp.spawnSync('powershell'") || cliSource.includes("cp.spawnSync('powershell.exe'")) {

package/scripts/which-shim-probe.js

@@ -0,0 +1,208 @@
+'use strict';
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const diagnostics = require('../lib/diagnostics');
+
+const failures = [];
+let checks = 0;
+const groupPathInstallations = diagnostics._groupPathInstallations;
+
+function check(condition, failure) {
+  checks++;
+  if (!condition) failures.push(failure);
+}
+
+if (typeof groupPathInstallations !== 'function') {
+  failures.push('diagnostics._groupPathInstallations is not implemented');
+} else {
+  const npmShimPair = [
+    'C:\\Users\\tester\\AppData\\Roaming\\npm\\leerness',
+    'C:\\Users\\tester\\AppData\\Roaming\\npm\\leerness.cmd',
+  ];
+  const samePackage = candidate => candidate.replace(/\//g, '\\').toLowerCase().includes('\\npm\\leerness')
+    ? 'c:\\users\\tester\\appdata\\roaming\\npm\\node_modules\\leerness\\package.json'
+    : null;
+
+  const oneInstall = groupPathInstallations(npmShimPair, {
+    platform: 'win32',
+    command: 'leerness',
+    packageIdentity: samePackage,
+  });
+  check(oneInstall.length === 1 && oneInstall[0].candidates.length === 2,
+    `same npm shim pair should be one install, got ${JSON.stringify(oneInstall)}`);
+
+  const npmShimTrio = groupPathInstallations([...npmShimPair,
+    'C:\\Users\\tester\\AppData\\Roaming\\npm\\leerness.ps1'], {
+    platform: 'win32', command: 'leerness', packageIdentity: samePackage,
+  });
+  check(npmShimTrio.length === 1 && npmShimTrio[0].candidates.length === 3,
+    `PowerShell shim should join the same npm install, got ${JSON.stringify(npmShimTrio)}`);
+
+  const mixedCaseAndSeparators = groupPathInstallations([npmShimPair[0],
+    'c:/Users/tester/AppData/Roaming/npm/leerness.cmd'], {
+    platform: 'win32', command: 'leerness', packageIdentity: samePackage,
+  });
+  check(mixedCaseAndSeparators.length === 1,
+    `Windows case and separator variants should share one install, got ${JSON.stringify(mixedCaseAndSeparators)}`);
+
+  const nonStandardBat = groupPathInstallations([npmShimPair[0],
+    'C:\\Users\\tester\\AppData\\Roaming\\npm\\leerness.bat'], {
+    platform: 'win32', command: 'leerness', packageIdentity: samePackage,
+  });
+  check(nonStandardBat.length === 2,
+    `non-standard .bat must not be merged without content proof, got ${JSON.stringify(nonStandardBat)}`);
+
+  const trueConflict = groupPathInstallations([
+    ...npmShimPair,
+    'D:\\tools\\leerness.cmd',
+  ], {
+    platform: 'win32',
+    command: 'leerness',
+    packageIdentity: candidate => candidate.toLowerCase().startsWith('d:\\tools\\')
+      ? 'd:\\tools\\node_modules\\leerness\\package.json'
+      : samePackage(candidate),
+  });
+  check(trueConflict.length === 2,
+    `different PATH directories should remain a conflict, got ${JSON.stringify(trueConflict)}`);
+
+  const unprovenPair = groupPathInstallations(npmShimPair, {
+    platform: 'win32',
+    command: 'leerness',
+    packageIdentity: () => null,
+  });
+  check(unprovenPair.length === 2,
+    `same-stem files without a shared package must stay separate, got ${JSON.stringify(unprovenPair)}`);
+
+  const posixCandidates = groupPathInstallations([
+    '/usr/local/bin/leerness',
+    '/opt/leerness/bin/leerness',
+  ], {
+    platform: 'linux',
+    command: 'leerness',
+    packageIdentity: () => 'same-version-is-not-same-install',
+  });
+  check(posixCandidates.length === 2,
+    `POSIX candidates in separate PATH directories must not be grouped, got ${JSON.stringify(posixCandidates)}`);
+
+  const report = diagnostics.whichCmd({
+    VERSION: 'test', uiLang: 'en', has: () => false, harnessPath: 'fixture',
+    platform: 'win32', pathCandidates: npmShimPair, packageIdentity: samePackage,
+    skipNpm: true, quiet: true,
+  });
+  check(report.pathCandidates.length === 2 && report.pathInstallations.length === 1
+      && !report.diagnostics.some(line => /precedence conflict/.test(line)),
+  `product-level which report should preserve 2 raw shims without a conflict, got ${JSON.stringify(report)}`);
+
+  const conflictReport = diagnostics.whichCmd({
+    VERSION: 'test', uiLang: 'en', has: () => false, harnessPath: 'fixture',
+    platform: 'win32', pathCandidates: [...npmShimPair, 'D:\\tools\\leerness.cmd'],
+    packageIdentity: candidate => candidate.toLowerCase().startsWith('d:\\tools\\')
+      ? 'd:\\tools\\node_modules\\leerness\\package.json' : samePackage(candidate),
+    skipNpm: true, quiet: true,
+  });
+  check(conflictReport.pathInstallations.length === 2
+      && conflictReport.diagnostics.some(line => /2 leerness installations/.test(line)),
+  `product-level which report should retain true PATH conflicts, got ${JSON.stringify(conflictReport)}`);
+
+  if (process.platform === 'win32') {
+    const fixture = fs.mkdtempSync(path.join(os.tmpdir(), 'leerness-which-shim-'));
+    try {
+      const packageDir = path.join(fixture, 'node_modules', 'leerness');
+      const entryDir = path.join(packageDir, 'bin');
+      fs.mkdirSync(entryDir, { recursive: true });
+      fs.writeFileSync(path.join(packageDir, 'package.json'), JSON.stringify({
+        name: 'leerness', version: '9.9.9', bin: { leerness: 'bin/leerness.js' },
+      }));
+      fs.writeFileSync(path.join(entryDir, 'leerness.js'), '#!/usr/bin/env node\n');
+      const shShim = path.join(fixture, 'leerness');
+      const cmdShim = path.join(fixture, 'leerness.cmd');
+      const ps1Shim = path.join(fixture, 'leerness.ps1');
+      const validSh = '#!/bin/sh\nexec node "$basedir/node_modules/leerness/bin/leerness.js" "$@"\n';
+      const validCmd = '@ECHO off\nendLocal & goto #_undefined_# 2>NUL || title %COMSPEC% & "%_prog%" "%dp0%\\node_modules\\leerness\\bin\\leerness.js" %*\n';
+      const validPs1 = '#!/usr/bin/env pwsh\n& "node$exe" "$basedir/node_modules/leerness/bin/leerness.js" $args\n';
+      fs.writeFileSync(shShim, validSh);
+      fs.writeFileSync(cmdShim, validCmd);
+      fs.writeFileSync(ps1Shim, validPs1);
+      const detected = groupPathInstallations([
+        shShim, cmdShim, ps1Shim,
+      ], { platform: 'win32', command: 'leerness' });
+      check(detected.length === 1 && detected[0].kind === 'npm-package'
+          && detected[0].candidates.length === 3,
+        `default package-manifest detection should group a real fixture, got ${JSON.stringify(detected)}`);
+
+      fs.writeFileSync(shShim,
+        '#!/bin/sh\nexec echo "$basedir/node_modules/leerness/bin/leerness.js" "$@"\n');
+      const dummySh = groupPathInstallations([shShim, cmdShim], {
+        platform: 'win32', command: 'leerness',
+      });
+      check(dummySh.length === 2,
+        `a dummy extensionless target argument must not prove execution, got ${JSON.stringify(dummySh)}`);
+      fs.writeFileSync(shShim, validSh);
+
+      fs.writeFileSync(cmdShim,
+        '@rem "%dp0%\\node_modules\\leerness\\bin\\leerness.js" %*\n"evil.exe" %*\n');
+      const commentedCmd = groupPathInstallations([shShim, cmdShim], {
+        platform: 'win32', command: 'leerness',
+      });
+      check(commentedCmd.length === 2,
+        `a commented cmd target plus divergent invocation must not be grouped, got ${JSON.stringify(commentedCmd)}`);
+      fs.writeFileSync(cmdShim, validCmd);
+
+      fs.writeFileSync(ps1Shim,
+        '# "$basedir/node_modules/leerness/bin/leerness.js" $args\n& evil $args\n');
+      const commentedPs1 = groupPathInstallations([shShim, ps1Shim], {
+        platform: 'win32', command: 'leerness',
+      });
+      check(commentedPs1.length === 2,
+        `a commented PowerShell target plus divergent invocation must not be grouped, got ${JSON.stringify(commentedPs1)}`);
+      fs.writeFileSync(ps1Shim, validPs1);
+
+      const otherEntry = path.join(fixture, 'node_modules', 'other', 'bin');
+      fs.mkdirSync(otherEntry, { recursive: true });
+      fs.writeFileSync(path.join(otherEntry, 'other.js'), '#!/usr/bin/env node\n');
+      fs.writeFileSync(cmdShim,
+        '@ECHO off\n"%_prog%" "%dp0%\\node_modules\\other\\bin\\other.js" %*\n');
+      const tampered = groupPathInstallations([
+        shShim, cmdShim,
+      ], { platform: 'win32', command: 'leerness' });
+      check(tampered.length === 2,
+        `adjacent package metadata must not hide a divergent shim, got ${JSON.stringify(tampered)}`);
+
+      const localModules = path.join(fixture, 'local with space', 'node_modules');
+      const localBin = path.join(localModules, '.bin');
+      const localPackage = path.join(localModules, 'leerness');
+      fs.mkdirSync(path.join(localPackage, 'bin'), { recursive: true });
+      fs.mkdirSync(localBin, { recursive: true });
+      fs.writeFileSync(path.join(localPackage, 'package.json'), JSON.stringify({
+        name: 'leerness', version: '9.9.9', bin: { leerness: 'bin/leerness.js' },
+      }));
+      fs.writeFileSync(path.join(localPackage, 'bin', 'leerness.js'), '#!/usr/bin/env node\n');
+      const localSh = path.join(localBin, 'leerness');
+      const localCmd = path.join(localBin, 'leerness.cmd');
+      const localPs1 = path.join(localBin, 'leerness.ps1');
+      fs.writeFileSync(localSh,
+        '#!/bin/sh\nexec node "$basedir/../leerness/bin/leerness.js" "$@"\n');
+      fs.writeFileSync(localCmd,
+        '@ECHO off\nendLocal & goto #_undefined_# 2>NUL || title %COMSPEC% & "%_prog%" "%dp0%\\..\\leerness\\bin\\leerness.js" %*\n');
+      fs.writeFileSync(localPs1,
+        '#!/usr/bin/env pwsh\n& "node$exe" "$basedir/../leerness/bin/leerness.js" $args\n');
+      const localInstall = groupPathInstallations([localSh, localCmd, localPs1], {
+        platform: 'win32', command: 'leerness',
+      });
+      check(localInstall.length === 1 && localInstall[0].candidates.length === 3,
+        `local node_modules/.bin shims should be one install, got ${JSON.stringify(localInstall)}`);
+    } finally {
+      fs.rmSync(fixture, { recursive: true, force: true });
+    }
+  }
+}
+
+if (failures.length) {
+  console.error(`which shim grouping failures (${failures.length}):`);
+  failures.forEach(failure => console.error(`- ${failure}`));
+  process.exit(1);
+}
+
+console.log(`which shim grouping probe: ${checks}/${checks} passed`);