makdoong2-team 1.3.0

package/scripts/state.sh

@@ -0,0 +1,192 @@
+#!/usr/bin/env bash
+# state.sh — makdoong2-team workflow 상태 파일(state.json) read/write 헬퍼.
+# 상태 파일 경로: <현재 컨텍스트 git toplevel>/.makdoong2-team/<issue>/state.json
+# (main repo에서 호출: main repo, worktree에서 호출: worktree — 실행 컨텍스트 local)
+#
+# 사용:
+#   state.sh root                                  # 현재 컨텍스트의 git toplevel 출력 (worktree-local)
+#   state.sh issue                                 # 현재 브랜치에서 이슈키 추출 (없으면 빈 값)
+#   state.sh init    <issue> [worktree]            # state.json 최초 생성 (이미 있으면 auto-migrate)
+#   state.sh get     <issue> <jq-path>             # 값 조회. 예: '.stages."3_delivery".substages."commit".done'
+#   state.sh set     <issue> <jq-path> <json-value># 값 설정. 문자열은 '"pass"' 형태로 전달
+#   state.sh migrate <issue>                       # legacy stage key → 계층형 substages 이관 (idempotent)
+#
+# ── 스키마 규약 (hardrule) ──
+# state.json 은 hierarchical 스키마다:
+#   .stages."<PHASE>".substages."<SUBSTAGE>".<field>
+# 예: .stages."1_planning".substages."requirements".done
+#
+# flat 표기 `.stages."<PHASE>.<SUBSTAGE>"` (예: `.stages."1_planning.requirements"`) 는
+# phantom 키를 생성하여 verifier / auto_advance_stage 를 무력화한다. `set` 및 `get`
+# 명령이 flat 표기를 감지하면 정확한 hierarchical 대체 경로를 안내하며 exit 65 로
+# 즉시 중단한다. 예외: `.policy.*` 하위 딕셔너리 키는 flat 형태 (auto_approve.
+# "1_planning.requirements": true) 를 유지한다 — opencode-plugin.ts 의 STAGE_ORDER
+# 상수가 flat 스타일 stage-id 로 정의되어 있기 때문.
+#
+# 의존: jq
+set -euo pipefail
+
+root()  {
+  # 호출 컨텍스트의 git toplevel 을 반환한다.
+  # - main repo에서 호출: main repo 경로
+  # - worktree에서 호출: 해당 worktree 경로
+  # 각 실행 컨텍스트가 자신의 state.json 사본을 사용하므로
+  # external-directory guard 가 발동하지 않는다.
+  # sub-agent 세션 시작 전 wt-sync-ignored.sh 가 이미 .makdoong2-team/<issue>/
+  # 를 worktree로 복사하고, 완료 후 --reverse 로 main repo에 병합한다.
+  git rev-parse --show-toplevel 2>/dev/null \
+    || pwd
+}
+issue() {
+  # 현재 브랜치명에서 이슈키 추출. worktree(feature/PROJ-123) 컨텍스트에서만 신뢰성 있음.
+  # main repo(branch=main)에서 호출하면 빈 문자열 반환 — hooks/guards 는 이 함수 대신
+  # `root()` + `git worktree list --porcelain` 조합으로 ISSUE를 추출해야 한다.
+  git rev-parse --abbrev-ref HEAD 2>/dev/null | grep -oE '[A-Z]+-[0-9]+' | head -n1 || true
+}
+sp()    { echo "$(root)/.makdoong2-team/$1/state.json"; }
+
+# ── phantom-key guard ──
+# jq path 안에 `.stages."<PHASE>.<SUBSTAGE>"` 형태 (dot 포함 stage-id 를 단일 키로
+# 지정) 가 나타나면 flat 표기로 판정한다. hierarchical 표기는 dot 이 phase 밖으로
+# 벗어나 있으므로 (`.stages."1_planning".substages."jira"`) 이 패턴에 매칭되지
+# 않는다.
+#
+# 매칭되면 정확한 대체 경로를 안내하고 exit 65 로 즉시 실패한다.
+check_flat_stage_notation() {
+  local q="$1"
+  if [[ "$q" =~ \.stages\.\"([0-9]+_[a-z_]+)\.([a-z]+)\" ]]; then
+    local phase="${BASH_REMATCH[1]}"
+    local sub="${BASH_REMATCH[2]}"
+    local suggested=".stages.\"${phase}\".substages.\"${sub}\""
+    cat >&2 <<ERR
+[state.sh] flat stage notation detected — refusing to touch state.json.
+  jq path : $q
+  problem : ".stages.\"${phase}.${sub}\"" creates a phantom key that
+            verifier / auto_advance_stage never read (they use hierarchical).
+  fix     : replace with hierarchical form:
+            $suggested
+  legacy  : if you have existing flat/phantom nodes, run 'state.sh migrate <issue>'
+            to normalize them into the hierarchical tree.
+ERR
+    exit 65
+  fi
+}
+
+cmd="${1:-}"; shift || true
+case "$cmd" in
+  root)  root ;;
+  issue) issue ;;
+  init)
+    ISSUE="${1:?issue required}"; WT="${2:-$(root)}"
+    P="$(sp "$ISSUE")"; mkdir -p "$(dirname "$P")"
+    if [ ! -f "$P" ]; then
+      cat > "$P" <<JSON
+{
+  "issue": "$ISSUE",
+  "worktree": "$WT",
+  "stages": {
+    "1_planning": {
+      "done": false,
+      "substages": {
+        "jira":         {"done": false},
+        "requirements": {"done": false, "approved_by_user": false},
+        "scope":        {"done": false, "approved_by_user": false}
+      }
+    },
+    "2_implementation": {
+      "done": false,
+      "substages": {
+        "analysis": {
+          "done": false,
+          "skipped": false,
+          "skip_reason": null,
+          "artifact_path": null,
+          "self_check": {}
+        },
+        "dev":  {"done": false},
+        "test": {"done": false, "unit": "none", "integration": "none", "coverage": "none"}
+      }
+    },
+    "3_delivery": {
+      "done": false,
+      "substages": {
+        "commit": {"done": false},
+        "pr":     {"draft_url": null},
+        "review": {"comments": 0, "comments_per_commit": {}, "plan_path": null, "all_comments_inline": false}
+      }
+    }
+  },
+  "policy": null
+}
+JSON
+    else
+      "$0" migrate "$ISSUE" >/dev/null 2>&1 || true
+    fi
+    echo "$P" ;;
+  get)
+    ISSUE="${1:?}"; Q="${2:?}"; P="$(sp "$ISSUE")"
+    check_flat_stage_notation "$Q"
+    # Semantics contract (rely on this in all gate scripts):
+    #   * always print exactly one line = the value (jq -r style: null/false/0/{}/"str")
+    #   * exit 0 for any value that jq successfully evaluated, including null and false
+    #   * exit 1 only when jq errored (bad expression, corrupt JSON) or file missing
+    #
+    # Rationale: the historical implementation used `jq -er` which conflates
+    # "value is null/false" with "path missing" and emits both jq's own "null"
+    # AND a fallback "null" (producing "null\nnull" for null values). Downstream
+    # gates then wrap with `|| echo "__MISSING__"` and check `[ "$U" = "null" ]`
+    # or `[ "$U" = "__MISSING__" ]`. Multi-line output breaks every such check.
+    # Using `jq -r` (no -e) gives clean one-line output and success exit; the
+    # `if` form suppresses `set -e` on parse errors so we can emit "null" as
+    # missing-marker without doubling.
+    if OUT="$(jq -r "$Q" "$P" 2>/dev/null)"; then
+      printf '%s\n' "$OUT"
+    else
+      echo "null"; exit 1
+    fi
+    ;;
+  set)
+    ISSUE="${1:?}"; Q="${2:?}"; V="${3:?}"; P="$(sp "$ISSUE")"
+    check_flat_stage_notation "$Q"
+    tmp="$(mktemp)"; jq "$Q = $V" "$P" > "$tmp" && mv "$tmp" "$P"
+    echo "state[$ISSUE] $Q = $V" ;;
+  append)
+    ISSUE="${1:?}"; Q="${2:?}"; V="${3:?}"; P="$(sp "$ISSUE")"
+    check_flat_stage_notation "$Q"
+    tmp="$(mktemp)"
+    jq --argjson entry "$V" "$Q = ((($Q) // []) + [\$entry])" "$P" > "$tmp" && mv "$tmp" "$P"
+    echo "state[$ISSUE] $Q += $V" ;;
+  migrate)
+    ISSUE="${1:?issue required}"; P="$(sp "$ISSUE")"
+    [ -f "$P" ] || { echo "state.json not found: $P" >&2; exit 1; }
+    tmp="$(mktemp)"
+    jq '
+      def move($legacy; $phase; $sub):
+        if has("stages") and (.stages | has($legacy)) then
+          .stages[$phase] = (.stages[$phase] // {"done": false, "substages": {}})
+          | .stages[$phase].substages = (.stages[$phase].substages // {})
+          | .stages[$phase].substages[$sub] =
+              ((.stages[$phase].substages[$sub] // {}) * .stages[$legacy])
+          | del(.stages[$legacy])
+        else . end;
+
+      move("1_jira";          "1_planning";       "jira")
+      | move("2_requirements"; "1_planning";       "requirements")
+      | move("3_scope";        "1_planning";       "scope")
+      | move("4_dev";          "2_implementation"; "dev")
+      | move("5_test";         "2_implementation"; "test")
+      | move("6_commit";       "3_delivery";       "commit")
+      | move("7_pr";           "3_delivery";       "pr")
+      | move("8_review";       "3_delivery";       "review")
+      | move("2_implementation.dev";  "2_implementation"; "dev")
+      | move("2_implementation.test"; "2_implementation"; "test")
+      | move("1_planning.jira";         "1_planning"; "jira")
+      | move("1_planning.requirements"; "1_planning"; "requirements")
+      | move("1_planning.scope";        "1_planning"; "scope")
+      | move("3_delivery.commit";       "3_delivery"; "commit")
+      | move("3_delivery.pr";           "3_delivery"; "pr")
+      | move("3_delivery.review";       "3_delivery"; "review")
+    ' "$P" > "$tmp" && mv "$tmp" "$P"
+    echo "migrated[$ISSUE] $P" ;;
+  *) echo "usage: state.sh {root|issue|init|get|set|append|migrate} ..." >&2; exit 64 ;;
+esac

package/scripts/test-postinstall.mjs

@@ -0,0 +1,141 @@
+#!/usr/bin/env node
+// scripts/test-postinstall.mjs — integration test for npm install -g postinstall hook
+//
+// Simulates global install in isolated HOME directory:
+//   1) npm pack → produces tarball
+//   2) npm install -g <tarball> with isolated HOME
+//   3) Verify deployment artifacts
+//   4) Verify idempotency (re-install doesn't create duplicate backups)
+//   5) Verify secrets.env preservation
+
+import { mkdtempSync, rmSync, existsSync, writeFileSync, readFileSync, readdirSync, statSync } from "node:fs";
+import { tmpdir, platform } from "node:os";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+import { spawnSync } from "node:child_process";
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const PKG_ROOT = join(HERE, "..");
+
+function run(cmd, args, opts = {}) {
+  const result = spawnSync(cmd, args, { stdio: "pipe", encoding: "utf8", ...opts });
+  if (result.error) throw result.error;
+  return result;
+}
+
+function assert(cond, msg) {
+  if (!cond) {
+    console.error(`✗ FAIL: ${msg}`);
+    process.exit(1);
+  }
+  console.log(`✓ ${msg}`);
+}
+
+console.log("[test-postinstall] Starting npm install -g smoke test");
+
+// 1) npm pack
+console.log("\n[1/6] Running npm pack...");
+const packResult = run("npm", ["pack"], { cwd: PKG_ROOT });
+if (packResult.status !== 0) {
+  console.error("npm pack failed:", packResult.stderr);
+  process.exit(1);
+}
+const tarballLine = packResult.stdout.trim().split("\n").pop();
+const tarball = join(PKG_ROOT, tarballLine);
+assert(existsSync(tarball), `tarball created: ${tarball}`);
+
+try {
+  // 2) Create isolated HOME
+  console.log("\n[2/6] Setting up isolated HOME...");
+  const tmpHome = mkdtempSync(join(tmpdir(), "mkd2-postinstall-"));
+  const npmPrefix = join(tmpHome, "npm");
+  const configDir = join(tmpHome, ".config", "opencode");
+
+  console.log(`  tmpHome: ${tmpHome}`);
+  console.log(`  npmPrefix: ${npmPrefix}`);
+  console.log(`  configDir: ${configDir}`);
+
+  // 3) npm install -g with isolated env
+  console.log("\n[3/6] Running npm install -g (first install)...");
+  const installEnv = {
+    ...process.env,
+    HOME: tmpHome,
+    npm_config_prefix: npmPrefix,
+    npm_config_global: "true",
+    CI: undefined,
+    CONTINUOUS_INTEGRATION: undefined,
+  };
+  const installResult = run("npm", ["install", "-g", tarball], { env: installEnv });
+  if (installResult.status !== 0) {
+    console.error("npm install -g failed:", installResult.stderr);
+    process.exit(1);
+  }
+  console.log("  npm install -g completed");
+
+  // 4) Verify deployment artifacts
+  console.log("\n[4/6] Verifying deployment artifacts...");
+
+  // Binary shim
+  const isWin = platform() === "win32";
+  const binName = isWin ? "makdoong2-team.cmd" : "makdoong2-team";
+  const binPath = join(npmPrefix, "bin", binName);
+  assert(existsSync(binPath), `binary shim exists: ${binPath}`);
+
+  // Agents in configDir
+  const agentPath = join(configDir, "agents", "makdoong2-team-leader.md");
+  assert(existsSync(agentPath), `agent deployed to configDir: ${agentPath}`);
+
+  // Skills in configDir
+  const skillPath = join(configDir, "skills", "jira-research", "SKILL.md");
+  assert(existsSync(skillPath), `skill deployed to configDir: ${skillPath}`);
+
+  // opencode.json plugin ref (relative path to npm module)
+  const ocPath = join(configDir, "opencode.json");
+  assert(existsSync(ocPath), `opencode.json created: ${ocPath}`);
+  const oc = JSON.parse(readFileSync(ocPath, "utf8"));
+  assert(
+    Array.isArray(oc.plugin) && oc.plugin.some(p => 
+      (typeof p === "string" && p.includes("opencode-plugin.ts")) ||
+      (Array.isArray(p) && p[0].includes("opencode-plugin.ts"))
+    ),
+    "opencode.json has plugin ref"
+  );
+  assert(oc.tools?.verify_stage === true, "opencode.json has tools");
+
+  // makdoong2-team doctor
+  console.log("\n[5/6] Running makdoong2-team doctor...");
+  const doctorResult = run(binPath, ["doctor"], { env: installEnv });
+  assert(doctorResult.status === 0, "makdoong2-team doctor exits 0");
+
+  // 5) Re-install (idempotency test)
+  console.log("\n[6/6] Re-installing (idempotency check)...");
+  const beforeOcBackups = readdirSync(configDir).filter(f => f.startsWith("opencode.json.bak."));
+  const reinstallResult = run("npm", ["install", "-g", tarball], { env: installEnv });
+  assert(reinstallResult.status === 0, "re-install succeeds");
+
+  const afterOcBackups = readdirSync(configDir).filter(f => f.startsWith("opencode.json.bak."));
+  assert(
+    afterOcBackups.length === beforeOcBackups.length,
+    `no new opencode.json backups on re-install (idempotent): ${beforeOcBackups.length} → ${afterOcBackups.length}`
+  );
+
+  // 6) secrets.env preservation
+  console.log("\n[Bonus] Testing secrets.env preservation...");
+  const secretsPath = join(configDir, "skills", "jira-research", "secrets.env");
+  const secretContent = "JIRA_TOKEN=test123";
+  writeFileSync(secretsPath, secretContent);
+
+  const reinstall2Result = run("npm", ["install", "-g", tarball], { env: installEnv });
+  assert(reinstall2Result.status === 0, "third install succeeds");
+
+  const afterSecrets = readFileSync(secretsPath, "utf8");
+  assert(afterSecrets === secretContent, "secrets.env preserved across re-install");
+
+  console.log("\n✅ [test-postinstall] All checks passed!");
+
+  // Cleanup
+  rmSync(tmpHome, { recursive: true, force: true });
+} finally {
+  // Cleanup tarball
+  if (existsSync(tarball)) rmSync(tarball);
+}

package/scripts/with-fallback.sh

@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+# with-fallback.sh — production-grade model fallback wrapper (Track B).
+#
+# Wraps `opencode run` and retries with the next model in an agent's chain
+# when the LLM call hits a rate limit / 5xx. Complements the in-plugin
+# `next_model` tool by handling cases where the failure aborts the run
+# before the agent can call the tool itself.
+#
+# Usage:
+#   with-fallback.sh <agent-id> -- <opencode args>
+#
+# Example:
+#   with-fallback.sh stage4-dev -- run --agent stage4-dev "Implement PROJ-12345"
+#
+# Reads model chain from the same model-router.ts via a tiny shim:
+#   node $SCRIPT_DIR/../dist/model-chain-cli.js <agent-id>
+# (the shim emits JSON: [{"id": "...", "variant": "..."}, ...])
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+
+AGENT="${1:?usage: with-fallback.sh <agent-id> -- <opencode args>}"
+shift
+[ "${1:-}" = "--" ] && shift || true
+
+CHAIN_JSON="$(node "$SCRIPT_DIR/../dist/model-chain-cli.js" "$AGENT" 2>/dev/null || echo '[]')"
+LEN=$(printf '%s' "$CHAIN_JSON" | jq 'length')
+
+if [ "$LEN" -eq 0 ]; then
+  echo "[with-fallback] no chain for $AGENT — running primary only" >&2
+  exec opencode "$@"
+fi
+
+for i in $(seq 0 $((LEN - 1))); do
+  MODEL=$(printf '%s' "$CHAIN_JSON" | jq -r ".[$i].id")
+  echo "[with-fallback] attempt $((i+1))/$LEN with model=$MODEL" >&2
+
+  # Inject --model. If user already passed --model, that wins (skip injection).
+  if printf '%s\n' "$@" | grep -qE '^--model$|^--model='; then
+    opencode "$@" && exit 0
+  else
+    opencode --model "$MODEL" "$@" && exit 0
+  fi
+  CODE=$?
+
+  # Decide whether to retry. Treat 1 / 124 (timeout) / 137 (oom) as
+  # retryable; SIGINT (130) and everything else as terminal so user cancel
+  # or real errors are not masked.
+  case "$CODE" in
+    1|124|137) echo "[with-fallback] exit $CODE — trying next model" >&2 ;;
+    *) echo "[with-fallback] exit $CODE — terminal, not retrying" >&2; exit "$CODE" ;;
+  esac
+done
+
+echo "[with-fallback] chain exhausted for $AGENT" >&2
+exit 1

package/scripts/wt-sync-ignored.sh

@@ -0,0 +1,193 @@
+#!/usr/bin/env bash
+# wt-sync-ignored.sh <worktree-path> [issue]
+#   메인 repo의 gitignore된(추적 안 되는) 파일을 새 worktree로 복사한다.
+#   [issue]: 특정 이슈 스코프의 .makdoong2-team/<issue>/ 디렉토리만 복사 (다른 이슈 디렉토리는 제외).
+#   .env, .env.local, .idea/, .metals/, .bsp/ 등 로컬 셋업 파일이
+#   worktree마다 수동 복사되지 않도록 자동화한다.
+#
+#   기본 제외: 빌드 산출물·캐시 디렉토리(target/, build/, .gradle/, node_modules/, .venv/, .bloop/ 등).
+#   워크트리마다 독립 빌드를 권장하므로 빌드 산출물은 복사하지 않는다.
+#   추가 제외가 필요하면 makdoong2-team.json 의 worktree.extra_exclude 에 ':' 구분으로 지정.
+#     예: "worktree": { "extra_exclude": ".idea/:tmp/" }
+set -euo pipefail
+
+# --reverse: worktree → main repo 역방향 동기화 (issue-scoped .makdoong2-team/<issue>/ 만)
+REVERSE=false
+while [[ "${1:-}" == --* ]]; do
+  case "$1" in
+    --reverse) REVERSE=true; shift ;;
+    *) echo "[wt-sync-ignored] 알 수 없는 옵션: $1" >&2; exit 1 ;;
+  esac
+done
+
+WT="${1:?usage: $0 [--reverse] <worktree-path> [issue]}"
+ISSUE="${2:-}"
+[ -d "$WT" ] || { echo "[wt-sync-ignored] worktree 경로 없음: $WT" >&2; exit 1; }
+
+# 메인 repo 식별 (worktree 안/밖 어디서 실행해도 동일)
+MAIN="$(git -C "$WT" worktree list --porcelain 2>/dev/null | awk '/^worktree /{print $2; exit}')"
+{ [ -n "$MAIN" ] && [ -d "$MAIN" ]; } || { echo "[wt-sync-ignored] 메인 repo 식별 실패" >&2; exit 1; }
+if [ "$WT" = "$MAIN" ]; then
+  echo "[wt-sync-ignored] worktree와 메인이 동일 경로 — 종료"
+  exit 0
+fi
+
+# ── reverse 모드: worktree → main repo (issue-scoped) ─────────────────────────
+if $REVERSE; then
+  if [ -z "$ISSUE" ]; then
+    echo "[wt-sync-ignored] --reverse 는 issue 인자 필수" >&2; exit 1
+  fi
+  SRC_DIR="$WT/.makdoong2-team/$ISSUE"
+  DST_DIR="$MAIN/.makdoong2-team/$ISSUE"
+  if [ -d "$SRC_DIR" ]; then
+    mkdir -p "$DST_DIR"
+    cp -a "$SRC_DIR/." "$DST_DIR/"
+    r_count=$(find "$SRC_DIR" -type f | wc -l | tr -d ' ')
+    echo "[wt-sync-ignored] reverse sync +${r_count} files: $WT → $MAIN (issue=$ISSUE)"
+  else
+    echo "[wt-sync-ignored] reverse sync: source 없음: $SRC_DIR" >&2
+  fi
+  exit 0
+fi
+# ─────────────────────────────────────────────────────────────────────────────
+
+# 기본 제외 (디렉토리는 '/' 끝)
+DEFAULT_EXCLUDES=(
+  "target/" "build/" "out/" "dist/"
+  "node_modules/" ".gradle/" ".venv/"
+  "__pycache__/" ".pytest_cache/" ".mypy_cache/"
+  ".bloop/" "project/target/" "project/project/"
+)
+EXCLUDES=("${DEFAULT_EXCLUDES[@]}")
+EXTRA_EXCLUDE="$("$(cd "$(dirname "$0")" && pwd)/config.sh" get worktree.extra_exclude "")"
+if [ -n "$EXTRA_EXCLUDE" ]; then
+  IFS=':' read -ra extra <<< "$EXTRA_EXCLUDE"
+  EXCLUDES+=("${extra[@]}")
+fi
+
+# 제외 패턴 매치 함수: 경로 $1 이 EXCLUDES 어느 하나에 걸리면 0(true)
+is_excluded() {
+  local f="$1" ex
+  if [ -n "$ISSUE" ] && [[ "$f" == ".makdoong2-team/"* ]]; then
+    return 0
+  fi
+  for ex in "${EXCLUDES[@]}"; do
+    if [[ "${ex: -1}" == "/" ]]; then
+      # 디렉토리 패턴: prefix 매치
+      [[ "$f" == "$ex"* || "$f" == "${ex%/}" ]] && return 0
+    else
+      # 파일 패턴: 정확 일치 또는 경로 하위
+      [[ "$f" == "$ex" || "$f" == "$ex/"* ]] && return 0
+    fi
+  done
+  return 1
+}
+
+# 메인 repo의 gitignore된 파일/디렉토리 목록 (null-delimited)
+copied=0; skipped=0
+while IFS= read -r -d '' f; do
+  if is_excluded "$f"; then
+    skipped=$((skipped+1))
+    continue
+  fi
+  src="$MAIN/$f"
+  dst="$WT/$f"
+  # f가 디렉토리로 끝나면(/) 통째로, 아니면 파일로 복사
+  if [[ "${f: -1}" == "/" ]]; then
+    mkdir -p "$dst"
+    cp -a "$src." "$dst" 2>/dev/null || cp -a "$src" "$(dirname "$dst")/"
+  else
+    mkdir -p "$(dirname "$dst")"
+    cp -a "$src" "$dst"
+  fi
+  copied=$((copied+1))
+done < <(cd "$MAIN" && git ls-files --others --ignored --exclude-standard -z)
+
+echo "[wt-sync-ignored] 복사 $copied / 제외 $skipped (제외 패턴: ${EXCLUDES[*]})"
+echo "[wt-sync-ignored] 소스: $MAIN"
+echo "[wt-sync-ignored] 대상: $WT"
+
+# issue-scoped whitelist
+if [ -n "$ISSUE" ]; then
+  wl_copied=0
+  SRC_DIR="$MAIN/.makdoong2-team/$ISSUE"
+  DST_DIR="$WT/.makdoong2-team/$ISSUE"
+  if [ -d "$SRC_DIR" ]; then
+    mkdir -p "$DST_DIR"
+    cp -a "$SRC_DIR/." "$DST_DIR/"
+    wl_copied=$(find "$SRC_DIR" -type f | wc -l | tr -d ' ')
+  fi
+  echo "[wt-sync-ignored] whitelist +$wl_copied (issue=$ISSUE)"
+else
+  echo "[wt-sync-ignored] whitelist skipped (issue 인자 없음)"
+fi
+
+# Baseline .git/info/exclude template — 프로젝트 종류를 감지해 부산물 패턴을 추가한다.
+# .gitignore 파일 대신 git 공통 디렉토리의 info/exclude 에 기록하므로
+# 모든 linked worktree 에 자동 적용되며 저장소에 커밋되지 않는다.
+# publisher 의 stage7 entry gate 가 pytest 결과물 (.coverage, .pytest_cache/) 이나
+# node_modules 부산물 때문에 false-positive 로 차단되는 문제를 예방.
+# 이미 존재하는 라인은 skip 하여 사용자 편집을 덮어쓰지 않는다.
+ensure_baseline_gitexclude() {
+  local wt=$1
+  local git_common_dir
+  git_common_dir="$(git -C "$wt" rev-parse --git-common-dir 2>/dev/null)"
+  if [ -z "$git_common_dir" ]; then
+    echo "[wt-sync-ignored] git-common-dir 식별 실패, exclude 스킵" >&2
+    return 0
+  fi
+  if [[ "$git_common_dir" != /* ]]; then
+    git_common_dir="$(cd "$wt/$git_common_dir" 2>/dev/null && pwd -P)" || {
+      echo "[wt-sync-ignored] git-common-dir 절대경로 변환 실패" >&2
+      return 0
+    }
+  fi
+  local exclude_file="$git_common_dir/info/exclude"
+  mkdir -p "$(dirname "$exclude_file")"
+  local added=0
+  local -a lines=()
+
+  # 공통 (모든 프로젝트)
+  lines+=(".DS_Store" "Thumbs.db" "*.log" "*.swp")
+
+  # Python
+  if [ -f "$wt/pyproject.toml" ] || [ -f "$wt/requirements.txt" ] || [ -f "$wt/setup.py" ] || [ -f "$wt/setup.cfg" ]; then
+    lines+=("__pycache__/" "*.pyc" "*.pyo" ".coverage" ".coverage.*" "htmlcov/" ".pytest_cache/" ".mypy_cache/" ".ruff_cache/" ".tox/" "*.egg-info/" "dist/" "build/" ".venv/" "venv/")
+  fi
+
+  # Node
+  if [ -f "$wt/package.json" ]; then
+    lines+=("node_modules/" ".npm/" ".pnp.*" ".yarn/*" "!.yarn/patches" "!.yarn/releases" "!.yarn/plugins" "!.yarn/sdks" "!.yarn/versions" ".next/" ".nuxt/" ".turbo/" "coverage/" ".nyc_output/")
+  fi
+
+  # JVM (Gradle/Maven/sbt)
+  if [ -f "$wt/build.gradle" ] || [ -f "$wt/build.gradle.kts" ] || [ -f "$wt/pom.xml" ] || [ -f "$wt/build.sbt" ]; then
+    lines+=("target/" "build/" ".gradle/" ".idea/" "*.iml" ".bloop/" ".metals/" ".bsp/" "project/target/" "project/project/")
+  fi
+
+  # Rust
+  if [ -f "$wt/Cargo.toml" ]; then
+    lines+=("target/" "Cargo.lock.bak")
+  fi
+
+  # Go
+  if [ -f "$wt/go.mod" ]; then
+    lines+=("vendor/" "*.test" "*.out")
+  fi
+
+  # 존재하지 않는 라인만 append
+  touch "$exclude_file"
+  local ln
+  for ln in "${lines[@]}"; do
+    if ! grep -qxF -- "$ln" "$exclude_file" 2>/dev/null; then
+      printf '%s\n' "$ln" >> "$exclude_file"
+      added=$((added+1))
+    fi
+  done
+
+  if [ "$added" -gt 0 ]; then
+    echo "[wt-sync-ignored] baseline .git/info/exclude +$added lines (project-type detected)"
+  fi
+}
+
+ensure_baseline_gitexclude "$WT"