orca-agent-cleanup 1.5.0 → 1.5.2

package/scripts/orca-cleanup-core.mjs

@@ -1,1842 +1,1852 @@
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { spawnSync } from 'node:child_process';
-import { createHash, randomUUID } from 'node:crypto';
-
-export const OFFICIAL_ORCA_SKILLS = Object.freeze([
-  'computer-use',
-  'linear-tickets',
-  'orca-cli',
-  'orca-emulator',
-  'orca-emulator-android',
-  'orca-linear',
-  'orca-per-workspace-env',
-  'orchestration',
-]);
-
-// Orca src/main/skills/skill-discovery-sources.ts 기준 사용자 홈 스킬 루트.
-export const HOME_SKILL_ROOTS = Object.freeze([
-  '.codex/skills',
-  '.agents/skills',
-  '.claude/skills',
-  '.grok/skills',
-  '.config/opencode/skills',
-  '.pi/agent/skills',
-  '.omp/agent/skills',
-  '.hermes/skills',
-  '.prime/agent/skills',
-  '.gemini/skills',
-  '.gemini/config/skills',
-  '.gemini/antigravity/skills',
-  '.cursor/skills',
-  '.factory/skills',
-  '.continue/skills',
-  '.trae-cn/skills',
-  '.augment/skills',
-  '.config/muse/skills',
-  '.zcode/skills',
-]);
-
-// Orca가 프로젝트에서 추가로 검사하는 스킬 루트.
-export const PROJECT_SKILL_ROOTS = Object.freeze([
-  '.agents/skills',
-  '.claude/skills',
-  '.factory/skills',
-  '.continue/skills',
-  '.trae/skills',
-  '.grok/skills',
-  '.augment/skills',
-]);
-
-const LINUX_CLI_DISPATCHER_MARKER = '# orca-serve-bare-orca-dispatcher';
-const LINUX_CLI_COMMAND_NAME = 'orca-ide';
-const PI_EXTENSION_MARKER = '@orca-managed-pi-extension';
-const PLUGIN_CACHE_MAX_DEPTH = 9;
-const PLUGIN_CACHE_MAX_ENTRIES = 16_384;
-const PLUGIN_CACHE_MAX_CANDIDATES = 64;
-const CODEX_LEGACY_START = '# BEGIN ORCA AGENT STATUS HOOKS';
-const CODEX_LEGACY_END = '# END ORCA AGENT STATUS HOOKS';
-
-const ORCA_SOURCE_PATTERN = /(?:^|[\s/:])stablyai\/orca(?:\.git)?(?:$|[\s/#?])/i;
-const ORCA_SKILL_SIGNATURES = [
-  ORCA_SOURCE_PATTERN,
-  /\bORCA\s+skills\s+get\b/i,
-  /\bEngage\s+Orca\b/i,
-  /Use Orca(?:'s|’s)? computer-use CLI/i,
-];
-const ORCA_HOOK_PATTERN = /(?:[\\/]\.orca(?:-wsl|-relay)?[\\/]agent-hooks[\\/]|ORCA_AGENT_HOOK)/i;
-const MANAGED_FILE_PATTERN = /Managed by Orca\. Do not edit; changes may be overwritten\./i;
-const KIMI_START = '# >>> orca-managed-kimi-hooks (managed by Orca; do not edit) >>>';
-const KIMI_END = '# <<< orca-managed-kimi-hooks <<<';
-// Orca src/main/dsh/dsh-home-patch.ts의 관리 블록 표식.
-const DSH_START = '# >>> orca-managed-dsh-hooks (managed by Orca; do not edit) >>>';
-const DSH_END = '# <<< orca-managed-dsh-hooks <<<';
-// 경로 구분자를 '/'로 정규화한 뒤 검사한다. PowerShell 명령은 '.orca\agent-hooks\'처럼
-// 앞에 구분자 없이 따옴표로 시작하므로 ORCA_HOOK_PATTERN만으로는 놓친다.
-const ORCA_HOOK_PATH_PATTERN = /(?:^|[^A-Za-z0-9_.-])\.orca(?:-wsl|-relay)?\/agent-hooks\//i;
-// Orca src/main/muse/hook-config-json.ts의 MUSE_MANAGED_HOOK_ENV_VARS 중 Orca 전용 이름.
-// USERPROFILE은 사용자가 직접 넣었을 수도 있어 남긴다.
-const MUSE_ORCA_ENV_VARS = new Set([
-  'ORCA_AGENT_HOOK_PORT',
-  'ORCA_AGENT_HOOK_TOKEN',
-  'ORCA_AGENT_HOOK_ENV',
-  'ORCA_AGENT_HOOK_VERSION',
-  'ORCA_AGENT_HOOK_TRANSPORT',
-  'ORCA_AGENT_HOOK_ENDPOINT',
-  'ORCA_PANE_KEY',
-  'ORCA_TAB_ID',
-  'ORCA_WORKTREE_ID',
-  'ORCA_AGENT_LAUNCH_TOKEN',
-]);
-// Orca가 사용자 OpenCode 설정 폴더의 plugins/에 직접 쓰는 상태 플러그인.
-const OPENCODE_PLUGIN_ENTRIES = Object.freeze([
-  'orca-opencode-status.js',
-  'orca-opencode2-status.js',
-  'orca-opencode-status-tui',
-  'orca-opencode2-status-tui',
-  'orca-opencode-startup-prompt',
-]);
-const OPENCODE_PLUGIN_SIGNATURE = /ORCA_OPENCODE_AGENT|ORCA_STATUS_AGENT|["']orca-opencode(?:2-status|-status|-startup-prompt)["']/;
-const OPENCODE_TUI_ENTRY_PATTERN = /[\\/]plugins[\\/](?:orca-opencode2?-status-tui|orca-opencode-startup-prompt)[\\/]tui\.js$/i;
-// ~/.orca 안의 Orca 전용 자격증명. Orca 앱 키로 암호화돼 앱 없이는 쓸 수 없다.
-const ORCA_CREDENTIAL_FILES = Object.freeze([
-  'openai-speech-token.enc',
-  'bitbucket-credential.enc',
-  'bitbucket-credential.json',
-  'linear-token.enc',
-  'linear-workspaces.json',
-  'jira-tokens',
-  'jira-sites.json',
-  'zcode-plan-api-key.enc',
-  'opencode-go-api-key.enc',
-  'minimax-api-key.enc',
-  'minimax-session-cookie.enc',
-]);
-const ORCA_VOICE_MODEL_IDS = new Set([
-  'parakeet-tdt-0.6b-v3-int8',
-  'parakeet-tdt-0.6b-v2-int8',
-  'zipformer-bilingual-zh-en',
-  'paraformer-bilingual-zh-en',
-  'zipformer-streaming-en-20m',
-  'zipformer-streaming-zh-14m',
-  'zipformer-streaming-korean',
-  'parakeet-tdt-ctc-0.6b-ja-int8',
-  'whisper-tiny',
-  'sense-voice-zh-en-ja-ko-yue',
-]);
-
-function unique(values) {
-  return [...new Set(values.filter(Boolean).map((value) => path.resolve(value)))];
-}
-
-function pathExists(target) {
-  try {
-    fs.lstatSync(target);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-function readText(target) {
-  try {
-    return fs.readFileSync(target, 'utf8');
-  } catch {
-    return '';
-  }
-}
-
-function readJson(target) {
-  try {
-    return JSON.parse(fs.readFileSync(target, 'utf8'));
-  } catch {
-    return null;
-  }
-}
-
-// Orca createManagedCommandMatcher와 같은 방식: -EncodedCommand(UTF-16LE base64)를 풀어 함께 본다.
-function hookSearchText(value) {
-  const decoded = [...value.matchAll(/\s-EncodedCommand\s+([A-Za-z0-9+/=]+)/gi)].map((match) => {
-    try {
-      return Buffer.from(match[1], 'base64').toString('utf16le');
-    } catch {
-      return '';
-    }
-  });
-  return [value, ...decoded].join('\n').replace(/[\\/]+/g, '/');
-}
-
-function isOrcaHookString(value) {
-  if (typeof value !== 'string') return false;
-  return ORCA_HOOK_PATTERN.test(value) || ORCA_HOOK_PATH_PATTERN.test(hookSearchText(value));
-}
-
-function defaultHomeSkillRoots(home) {
-  return HOME_SKILL_ROOTS.map((relative) => path.join(home, ...relative.split('/')));
-}
-
-function existingFilesystemIdentity(target) {
-  try {
-    const stat = fs.lstatSync(target);
-    if (stat.isSymbolicLink()) return `link:${path.resolve(target)}`;
-    const real = fs.realpathSync.native(target);
-    return `real:${process.platform === 'win32' ? real.toLowerCase() : real}`;
-  } catch {
-    return `path:${path.resolve(target)}`;
-  }
-}
-
-function environmentSkillRoots(platform, home, env) {
-  const roots = [
-    env.CLAUDE_CONFIG_DIR && path.join(env.CLAUDE_CONFIG_DIR, 'skills'),
-    env.GROK_HOME && path.join(env.GROK_HOME, 'skills'),
-    env.HERMES_HOME && path.join(env.HERMES_HOME, 'skills'),
-  ];
-  if (platform === 'win32' && env.LOCALAPPDATA) {
-    roots.push(path.join(env.LOCALAPPDATA, 'hermes', 'skills'));
-  }
-  return unique(roots);
-}
-
-function defaultProjectSkillRoots(projects) {
-  return projects.flatMap((project) => PROJECT_SKILL_ROOTS.map((relative) => path.join(project, ...relative.split('/'))));
-}
-
-function defaultHookCandidates(home, env) {
-  const kimiHome = env.KIMI_CODE_HOME || path.join(home, '.kimi-code');
-  const hermesHomes = unique([
-    env.HERMES_HOME,
-    path.join(home, '.hermes'),
-    env.LOCALAPPDATA && path.join(env.LOCALAPPDATA, 'hermes'),
-  ]);
-  const configHomes = unique([env.XDG_CONFIG_HOME, path.join(home, '.config')]);
-  const codexHomes = unique([env.CODEX_HOME, path.join(home, '.codex')]);
-  const kiroAgentsDir = path.join(env.KIRO_HOME || path.join(home, '.kiro'), 'agents');
-  const candidates = [
-    ['json', path.join(home, '.claude', 'settings.json')],
-    ['json', path.join(home, '.openclaude', 'settings.json')],
-    ...codexHomes.map((codexHome) => ['json', path.join(codexHome, 'hooks.json')]),
-    // Orca가 Claude 형식 설정을 그대로 쓰는 에이전트(src/main/claude/hook-settings.ts).
-    ['json', path.join(home, '.qoder', 'settings.json')],
-    ['json', path.join(home, '.qoder-cn', 'settings.json')],
-    ['json', path.join(home, '.qwen', 'settings.json')],
-    ['json', path.join(home, '.codebuddy', 'settings.json')],
-    ['json', path.join(home, '.zcode', 'cli', 'config.json')],
-    // Kiro는 전역 훅 설정이 없어 Orca가 에이전트 파일마다 훅을 넣는다.
-    ['json-dir', kiroAgentsDir],
-    ['jcode', path.join(env.JCODE_HOME || path.join(home, '.jcode'), 'config.toml')],
-    ['dsh', path.join(env.DSH_HOME || path.join(home, '.dsh'), 'cordis.patch.yml')],
-    ...configHomes.flatMap((configHome) => [
-      ['muse', path.join(configHome, 'muse', 'settings.json')],
-      ['opencode-tui', path.join(configHome, 'opencode', 'tui.json')],
-      ['opencode-tui', path.join(configHome, 'opencode', 'tui.jsonc')],
-      ...OPENCODE_PLUGIN_ENTRIES.map((name) => ['opencode-plugin', path.join(configHome, 'opencode', 'plugins', name)]),
-    ]),
-    ['json', path.join(home, '.gemini', 'settings.json')],
-    ['json', path.join(home, '.gemini', 'config', 'hooks.json')],
-    ['json', path.join(home, '.cursor', 'hooks.json')],
-    ['json', path.join(home, '.commandcode', 'settings.json')],
-    ['json', path.join(home, '.factory', 'settings.json')],
-    // Orca가 통째로 만드는 파일. Orca 항목만 있던 파일은 빈 껍데기를 남기지 않고 격리한다.
-    ['json', path.join(env.COPILOT_HOME || path.join(home, '.copilot'), 'hooks', 'orca.json'), true],
-    ['json', path.join(env.GROK_HOME || path.join(home, '.grok'), 'hooks', 'orca-status.json'), true],
-    ['json', path.join(home, '.config', 'devin', 'config.json')],
-    ['kimi', path.join(kimiHome, 'config.toml')],
-    ['amp', path.join(home, '.config', 'amp', 'plugins', 'orca-agent-status.ts')],
-    ['codex-legacy', path.join(home, '.codex', 'orca-agent-status.config.toml')],
-    ['codex-legacy', path.join(home, '.codex', 'config.toml')],
-  ];
-  for (const hermesHome of hermesHomes) {
-    candidates.push(['hermes', path.join(hermesHome, 'plugins', 'orca-status')]);
-    candidates.push(['hermes-config', path.join(hermesHome, 'config.yaml')]);
-  }
-  if (env.APPDATA) candidates.push(['json', path.join(env.APPDATA, 'Devin', 'config.json')]);
-  return candidates.map(([type, filePath, ownedFile = false]) => ({ type, path: filePath, ownedFile }));
-}
-
-function defaultExtensionCandidates(home) {
-  const files = [
-    ['.pi', 'orca-agent-status.ts'],
-    ['.pi', 'orca-prefill.ts'],
-    ['.pi', 'orca-titlebar-spinner.ts'],
-    ['.omp', 'orca-agent-status.ts'],
-    ['.omp', 'orca-prefill.ts'],
-    ['.omp', 'orca-titlebar-spinner.ts'],
-    ['.prime', 'orca-agent-status.ts'],
-  ];
-  return files.map(([agent, name]) => path.join(home, agent, 'agent', 'extensions', name));
-}
-
-function defaultAppDataCandidates(platform, home, env) {
-  if (platform === 'darwin') {
-    return [
-      path.join(home, 'Library', 'Application Support', 'Orca'),
-      path.join(home, 'Library', 'Application Support', 'orca'),
-      path.join(home, 'Library', 'Caches', 'com.stablyai.orca'),
-      path.join(home, 'Library', 'Caches', 'com.stablyai.orca.ShipIt'),
-      path.join(home, 'Library', 'Caches', 'orca-updater'),
-      path.join(home, 'Library', 'HTTPStorages', 'com.stablyai.orca'),
-      path.join(home, 'Library', 'Preferences', 'com.stablyai.orca.plist'),
-      path.join(home, 'Library', 'Saved Application State', 'com.stablyai.orca.savedState'),
-    ];
-  }
-  if (platform === 'win32') {
-    return [
-      env.APPDATA && path.join(env.APPDATA, 'Orca'),
-      env.LOCALAPPDATA && path.join(env.LOCALAPPDATA, 'Orca'),
-      env.LOCALAPPDATA && path.join(env.LOCALAPPDATA, 'orca-updater'),
-    ].filter(Boolean);
-  }
-  const configHome = env.XDG_CONFIG_HOME || path.join(home, '.config');
-  const cacheHome = env.XDG_CACHE_HOME || path.join(home, '.cache');
-  return unique([
-    path.join(configHome, 'Orca'),
-    path.join(configHome, 'orca'),
-    path.join(cacheHome, 'Orca'),
-    path.join(cacheHome, 'orca', 'appimage'),
-    path.join(cacheHome, 'orca-updater'),
-    path.join(home, '.config', 'Orca'),
-    path.join(home, '.config', 'orca'),
-    path.join(home, '.cache', 'Orca'),
-    path.join(home, '.cache', 'orca', 'appimage'),
-    path.join(home, '.cache', 'orca-updater'),
-  ]);
-}
-
-function pluginCacheOrcaSkills(root) {
-  if (!pathExists(root)) return [];
-  let resolvedRoot;
-  try {
-    resolvedRoot = fs.realpathSync.native(root);
-  } catch {
-    return [];
-  }
-  const candidates = [];
-  const visited = new Set();
-  let entriesSeen = 0;
-
-  function visit(directory, depth) {
-    if (depth > PLUGIN_CACHE_MAX_DEPTH
-        || entriesSeen >= PLUGIN_CACHE_MAX_ENTRIES
-        || candidates.length >= PLUGIN_CACHE_MAX_CANDIDATES) return;
-    let resolved;
-    let entries;
-    try {
-      resolved = fs.realpathSync.native(directory);
-      if (!isSameOrDescendant(resolvedRoot, resolved) || visited.has(resolved)) return;
-      visited.add(resolved);
-      entries = fs.readdirSync(directory, { withFileTypes: true });
-    } catch {
-      return;
-    }
-    entriesSeen += entries.length;
-    if (entriesSeen > PLUGIN_CACHE_MAX_ENTRIES) return;
-
-    if (path.basename(directory) === 'skills') {
-      for (const name of OFFICIAL_ORCA_SKILLS) {
-        const candidate = path.join(directory, name);
-        if (pathExists(candidate) && hasOrcaSkillSignature(candidate)) candidates.push(candidate);
-        if (candidates.length >= PLUGIN_CACHE_MAX_CANDIDATES) return;
-      }
-    }
-    for (const entry of entries) {
-      if (entry.name === 'node_modules' || entry.isSymbolicLink() || !entry.isDirectory()) continue;
-      visit(path.join(directory, entry.name), depth + 1);
-    }
-  }
-
-  visit(resolvedRoot, 0);
-  return unique(candidates);
-}
-
-function defaultVoiceCandidates(platform, env) {
-  if (platform !== 'win32') return [];
-  const roots = [
-    env.PROGRAMDATA,
-    env.ProgramData,
-    env.ALLUSERSPROFILE,
-    env.PUBLIC && path.join(env.PUBLIC, 'Documents'),
-    env.PUBLIC,
-    env.SystemDrive && path.join(env.SystemDrive, 'ProgramData'),
-    'C:\\ProgramData',
-  ];
-  return unique(roots.map((root) => root && path.join(root, 'Orca', 'speech-models')));
-}
-
-function readWindowsUserPath(platform) {
-  if (platform !== 'win32' || process.platform !== 'win32') return '';
-  const script = "[Console]::OutputEncoding=[Text.UTF8Encoding]::new(); [Environment]::GetEnvironmentVariable('Path','User')";
-  const result = spawnSync('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', script], { encoding: 'utf8' });
-  return result.status === 0 ? result.stdout.trim() : '';
-}
-
-function decodeProcessOutput(value) {
-  if (!value) return '';
-  const buffer = Buffer.isBuffer(value) ? value : Buffer.from(value);
-  const hasNul = buffer.subarray(0, Math.min(buffer.length, 256)).includes(0);
-  return buffer.toString(hasNul ? 'utf16le' : 'utf8').replace(/^\uFEFF/, '');
-}
-
-function discoverRunningWslHomes(platform) {
-  if (platform !== 'win32' || process.platform !== 'win32') return [];
-  try {
-    const listed = spawnSync('wsl.exe', ['--list', '--running', '--quiet'], {
-      windowsHide: true,
-      timeout: 8000,
-    });
-    if (listed.status !== 0) return [];
-    const distros = decodeProcessOutput(listed.stdout).split(/\r?\n/).map((value) => value.trim()).filter(Boolean);
-    const homes = [];
-    for (const distro of distros) {
-      const probed = spawnSync('wsl.exe', ['-d', distro, '--', 'sh', '-lc', 'printf %s "$HOME"'], {
-        windowsHide: true,
-        timeout: 8000,
-      });
-      const linuxHome = decodeProcessOutput(probed.stdout).trim();
-      if (probed.status !== 0 || !/^\/(?:[^\0\\]+)$/.test(linuxHome) || linuxHome.includes('..')) continue;
-      const relative = linuxHome.replace(/^\/+/, '').split('/');
-      homes.push(path.join(`\\\\wsl.localhost\\${distro}`, ...relative));
-    }
-    return unique(homes);
-  } catch {
-    return [];
-  }
-}
-
-// Orca가 아직 설치돼 있거나 실행 중이면 앱이 켜질 때 훅·플러그인을 다시 설치하고,
-// 쓰던 자격증명을 격리하면 앱이 망가진다. 정리 전에 이 상태를 확인한다.
-function runPowerShellJson(script) {
-  const result = spawnSync('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command',
-    `[Console]::OutputEncoding=[Text.UTF8Encoding]::new(); ${script}`], {
-    encoding: 'utf8', windowsHide: true, timeout: 20000,
-  });
-  if (result.status !== 0 || !result.stdout.trim()) return [];
-  try {
-    const value = JSON.parse(result.stdout);
-    return Array.isArray(value) ? value : [value];
-  } catch {
-    return [];
-  }
-}
-
-function listRunningProcesses(platform) {
-  if (platform === 'win32') {
-    return runPowerShellJson('Get-CimInstance Win32_Process | Select-Object ProcessId,Name,ExecutablePath | ConvertTo-Json -Compress')
-      .map((item) => ({ pid: item.ProcessId, name: item.Name || '', path: item.ExecutablePath || '' }));
-  }
-  if (platform === 'linux') {
-    return listMatchingChildren('/proc', /^\d+$/).map((entry) => {
-      const pid = Number(path.basename(entry));
-      try {
-        const exe = fs.readlinkSync(path.join(entry, 'exe'));
-        return { pid, name: path.basename(exe), path: exe };
-      } catch {
-        return null;
-      }
-    }).filter(Boolean);
-  }
-  const result = spawnSync('ps', ['-axo', 'pid=,comm='], { encoding: 'utf8', timeout: 10000 });
-  if (result.status !== 0) return [];
-  return result.stdout.split('\n').map((line) => line.match(/^\s*(\d+)\s+(.+?)\s*$/)).filter(Boolean)
-    .map((match) => ({ pid: Number(match[1]), name: path.basename(match[2]), path: match[2] }));
-}
-
-function listOrcaInstallations(platform, home, env) {
-  if (platform === 'win32') {
-    const fixed = [
-      env.LOCALAPPDATA && path.join(env.LOCALAPPDATA, 'Programs', 'orca'),
-      env.ProgramFiles && path.join(env.ProgramFiles, 'Orca'),
-      env.PROGRAMFILES && path.join(env.PROGRAMFILES, 'Orca'),
-    ].filter((dir) => dir && pathExists(path.join(dir, 'Orca.exe')));
-    // electron-builder NSIS 제거 정보. 사용자가 다른 폴더(/D)에 설치했어도 여기서 찾는다.
-    const registered = runPowerShellJson([
-      "$keys = 'HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*',",
-      "'HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*',",
-      "'HKLM:\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*';",
-      "Get-ItemProperty $keys -ErrorAction SilentlyContinue | Where-Object { $_.DisplayName -eq 'Orca' -and $_.UninstallString -match 'Uninstall Orca\\.exe' } |",
-      'Select-Object InstallLocation,UninstallString | ConvertTo-Json -Compress',
-    ].join(' ')).map((item) => item.InstallLocation || path.dirname(String(item.UninstallString || '').replace(/^"|"(?:\s.*)?$/g, '')));
-    return unique([...fixed, ...registered.filter(Boolean)]);
-  }
-  if (platform === 'darwin') {
-    return ['/Applications/Orca.app', path.join(home, 'Applications', 'Orca.app')]
-      .filter((app) => readText(path.join(app, 'Contents', 'Info.plist')).includes('com.stablyai.orca'));
-  }
-  return [];
-}
-
-function probeRuntime(platform, home, env) {
-  return { installations: listOrcaInstallations(platform, home, env), processes: listRunningProcesses(platform) };
-}
-
-// 설치 폴더 안의 프로세스는 앱 본체, 앱 데이터 아래(daemon-host 등)로 옮겨 돌던 프로세스는 남은 데몬이다.
-function classifyOrcaProcesses(context) {
-  const runtime = context.runtime || { installations: [], processes: [] };
-  const installDirs = unique([
-    ...runtime.installations,
-    ...(context.platform === 'win32' && context.env.LOCALAPPDATA ? [path.join(context.env.LOCALAPPDATA, 'Programs', 'orca')] : []),
-    ...(context.platform === 'darwin' ? ['/Applications/Orca.app', path.join(context.home, 'Applications', 'Orca.app')] : []),
-  ]);
-  const dataDirs = unique(defaultAppDataCandidates(context.platform, context.home, context.env));
-  const inside = (dirs, target) => dirs.some((dir) => isSameOrDescendant(dir, target)
-    || (context.platform !== 'linux' && isSameOrDescendant(dir.toLowerCase(), target.toLowerCase())));
-  const app = [];
-  const leftover = [];
-  for (const item of runtime.processes) {
-    if (!item?.path || item.pid === process.pid) continue;
-    const target = path.resolve(item.path);
-    const appImage = context.platform === 'linux' && /^\/tmp\/\.mount_orca/i.test(item.path);
-    if (inside(installDirs, target) || appImage) app.push(item);
-    else if (inside(dataDirs, target) || /^orca-terminal-daemon(?:\.exe)?$/i.test(item.name)) leftover.push(item);
-  }
-  return { installations: runtime.installations, app, leftover };
-}
-
-function stopProcess(pid, platform) {
-  if (platform === 'win32') {
-    const result = spawnSync('taskkill.exe', ['/PID', String(pid), '/T', '/F'], { encoding: 'utf8', windowsHide: true });
-    if (result.status !== 0) throw new Error(`프로세스를 끄지 못했습니다(PID ${pid}): ${(result.stderr || result.stdout).trim()}`);
-    return;
-  }
-  process.kill(pid, 'SIGTERM');
-}
-
-function isWindowsOrcaPathEntry(entry, context) {
-  if (context.platform !== 'win32') return false;
-  const expanded = entry.replace(/%([^%]+)%/g, (_, name) => context.env[name] || context.env[name.toUpperCase()] || `%${name}%`);
-  const candidate = path.normalize(expanded.replace(/^"|"$/g, '')).replace(/[\\/]+$/, '');
-  const normalized = candidate.toLowerCase();
-  const expected = context.env.LOCALAPPDATA
-    ? path.normalize(path.join(context.env.LOCALAPPDATA, 'Programs', 'orca', 'resources', 'bin')).toLowerCase()
-    : '';
-  if (expected && normalized === expected) return true;
-  const wrapper = path.join(candidate, 'orca.cmd');
-  const launcher = path.join(candidate, 'orca.exe');
-  const wrapperText = readText(wrapper);
-  return pathExists(launcher)
-    && /native Orca CLI launcher/i.test(wrapperText)
-    && /orca\.cmd cannot safely forward orchestration message bodies/i.test(wrapperText);
-}
-
-export function buildContext(overrides = {}) {
-  const platform = overrides.platform || process.platform;
-  const home = path.resolve(overrides.home || os.homedir());
-  const env = { ...process.env, ...(overrides.env || {}) };
-  const projects = unique(overrides.projects || []);
-  const explicitWslHomes = unique(overrides.wslHomes || []);
-  const wslHomes = unique([
-    ...explicitWslHomes,
-    ...(overrides.includeWsl && explicitWslHomes.length === 0 ? discoverRunningWslHomes(platform) : []),
-  ]);
-  const remoteHomes = unique(overrides.remoteHomes || []);
-  const scopedHomes = [
-    ...wslHomes.map((scopedHome) => ({ home: scopedHome, requires: 'includeWsl' })),
-    ...remoteHomes.map((scopedHome) => ({ home: scopedHome, requires: 'includeRemote' })),
-  ];
-  const homeSkillRoots = overrides.homeSkillRoots || unique([
-    ...defaultHomeSkillRoots(home),
-    ...environmentSkillRoots(platform, home, env),
-  ]);
-  const projectSkillRoots = defaultProjectSkillRoots(projects);
-  const scopedSkillRoots = scopedHomes.flatMap((scope) => defaultHomeSkillRoots(scope.home)
-    .map((root) => ({ root, requires: scope.requires })));
-  const skillRootRequirements = new Map(scopedSkillRoots.map((item) => [path.resolve(item.root), item.requires]));
-  const lockFiles = overrides.lockFiles || unique([
-    path.join(home, '.agents', '.skill-lock.json'),
-    ...projects.map((project) => path.join(project, '.agents', '.skill-lock.json')),
-    ...scopedHomes.map((scope) => path.join(scope.home, '.agents', '.skill-lock.json')),
-  ]);
-  const lockFileRequirements = new Map(scopedHomes.map((scope) => [
-    path.resolve(path.join(scope.home, '.agents', '.skill-lock.json')),
-    scope.requires,
-  ]));
-  const hookCandidates = [
-    ...defaultHookCandidates(home, env),
-    ...scopedHomes.flatMap((scope) => defaultHookCandidates(scope.home, {})
-      .map((candidate) => ({ ...candidate, requires: scope.requires }))),
-  ];
-  const extensionCandidates = [
-    ...defaultExtensionCandidates(home).map((target) => ({ path: target, requires: null })),
-    ...scopedHomes.flatMap((scope) => defaultExtensionCandidates(scope.home)
-      .map((target) => ({ path: target, requires: scope.requires }))),
-  ];
-  const grokHome = env.GROK_HOME || path.join(home, '.grok');
-
-  return {
-    platform,
-    home,
-    env,
-    projects,
-    wslHomes,
-    remoteHomes,
-    skillRoots: unique([...homeSkillRoots, ...projectSkillRoots, ...scopedSkillRoots.map((item) => item.root)]),
-    pluginCacheRoots: unique(overrides.pluginCacheRoots || [path.join(home, '.codex', 'plugins', 'cache')]),
-    skillRootRequirements,
-    lockFiles,
-    lockFileRequirements,
-    hookCandidates: overrides.hookCandidates || hookCandidates,
-    extensionCandidates: overrides.extensionCandidates || extensionCandidates,
-    filesystemIdentity: overrides.filesystemIdentity || existingFilesystemIdentity,
-    sharedStateCandidates: unique(overrides.sharedStateCandidates || [
-      path.join(home, '.orca', 'agent-hooks'),
-      path.join(home, '.orca', 'claude-agent-teams-bin'),
-      path.join(home, '.orca', 'managed-hook-install.lock'),
-      ...ORCA_CREDENTIAL_FILES.map((name) => path.join(home, '.orca', name)),
-      path.join(grokHome, 'hooks', 'orca-status.json.orca-cleaned-symlink'),
-    ]),
-    conditionalStateCandidates: overrides.conditionalStateCandidates || [
-      ...projects.flatMap((project) => [
-        { kind: 'project-state', path: path.join(project, '.orca'), requires: 'includeProjectState', reason: '프로젝트 Orca issue-command·drop 상태' },
-        { kind: 'project-state', path: path.join(path.dirname(project), '.orca-worktree-trash'), requires: 'includeProjectState', reason: '프로젝트 인접 Orca worktree 휴지통' },
-      ]),
-      ...wslHomes.flatMap((scopedHome) => [
-        { kind: 'wsl-state', path: path.join(scopedHome, '.orca-wsl'), requires: 'includeWsl', reason: 'WSL Orca 릴레이·훅 상태' },
-        { kind: 'wsl-state', path: path.join(scopedHome, '.local', 'share', 'orca'), requires: 'includeWsl', reason: 'WSL Orca 브리지·관리형 계정 상태' },
-      ]),
-      ...unique([home, ...remoteHomes]).flatMap((scopedHome) => [
-        { kind: 'remote-state', path: path.join(scopedHome, '.orca-remote'), requires: 'includeRemote', reason: 'SSH Orca 버전별 릴레이·업로드 상태' },
-        { kind: 'remote-state', path: path.join(scopedHome, '.orca-relay'), requires: 'includeRemote', reason: 'SSH Orca CLI·훅 오버레이' },
-        { kind: 'remote-state', path: path.join(scopedHome, '.orca', 'sessions'), requires: 'includeRemote', reason: '원격 Orca 세션 상태' },
-        { kind: 'remote-state', path: path.join(scopedHome, '.orca', 'skill-installs'), requires: 'includeRemote', reason: '원격 Orca Skills 설치 상태' },
-      ]),
-      ...remoteHomes.map((scopedHome) => (
-        { kind: 'remote-state', path: path.join(scopedHome, '.orca', 'agent-hooks'), requires: 'includeRemote', reason: '원격 Orca 관리형 에이전트 훅' }
-      )),
-    ],
-    userStateCandidates: unique(overrides.userStateCandidates || [path.join(home, '.orca')]),
-    appDataCandidates: unique(overrides.appDataCandidates || defaultAppDataCandidates(platform, home, env)),
-    voiceCandidates: unique([...(overrides.voiceCandidates || defaultVoiceCandidates(platform, env)), ...(overrides.customVoicePaths || [])]),
-    customVoicePaths: unique(overrides.customVoicePaths || []),
-    cliCandidates: unique(overrides.cliCandidates || defaultCliCandidates(platform, home)),
-    conditionalCliCandidates: overrides.conditionalCliCandidates || [
-      ...wslHomes.flatMap((scopedHome) => defaultCliCandidates('linux', scopedHome)
-        .map((target) => ({ path: target, requires: 'includeWsl' }))),
-      ...remoteHomes.flatMap((scopedHome) => defaultCliCandidates('linux', scopedHome)
-        .map((target) => ({ path: target, requires: 'includeRemote' }))),
-    ],
-    userPath: overrides.userPath ?? readWindowsUserPath(platform),
-    // 실제 사용자 홈을 검사할 때만 이 PC의 설치·프로세스 상태를 읽는다(임시 홈을 쓰는 테스트는 제외).
-    runtime: overrides.runtime || (platform === process.platform && home === path.resolve(os.homedir())
-      ? probeRuntime(platform, home, env)
-      : { installations: [], processes: [] }),
-    stopProcess: overrides.stopProcess || ((pid) => stopProcess(pid, platform)),
-    backupRoot: path.resolve(overrides.backupRoot || path.join(home, 'OrcaAgentCleanupBackups', timestamp())),
-  };
-}
-
-function timestamp() {
-  const time = new Date().toISOString().replace(/[-:]/g, '').replace(/T/, '-').replace(/\..+/, '');
-  return `${time}-${randomUUID()}`;
-}
-
-function operationId(now = new Date(), uuid = randomUUID()) {
-  return `${now.toISOString().replace(/[-:]/g, '').replace(/T/, '-').replace(/Z$/, '').replace('.', '-')}-${process.pid}-${uuid}`;
-}
-
-function cleanupManifestPayload(manifest) {
-  return {
-    manifestVersion: manifest.manifestVersion,
-    createdAt: manifest.createdAt,
-    platform: manifest.platform,
-    backupRoot: manifest.backupRoot,
-    cleanupStatus: manifest.cleanupStatus,
-    actions: manifest.actions,
-    errors: manifest.errors,
-  };
-}
-
-function cleanupManifestDigest(manifest) {
-  return createHash('sha256').update(JSON.stringify(cleanupManifestPayload(manifest))).digest('hex');
-}
-
-function signedCleanupManifest(value) {
-  return {
-    ...value,
-    integrity: { algorithm: 'sha256', digest: cleanupManifestDigest(value) },
-  };
-}
-
-function updateDigestField(hash, value) {
-  const bytes = Buffer.from(String(value), 'utf8');
-  hash.update(`${bytes.length}:`);
-  hash.update(bytes);
-}
-
-function updateDigestForPath(hash, target, relative = '.') {
-  const stat = fs.lstatSync(target);
-  if (stat.isSymbolicLink()) {
-    updateDigestField(hash, 'link');
-    updateDigestField(hash, relative);
-    updateDigestField(hash, fs.readlinkSync(target));
-    return;
-  }
-  if (stat.isDirectory()) {
-    updateDigestField(hash, 'directory');
-    updateDigestField(hash, relative);
-    for (const name of fs.readdirSync(target).sort()) {
-      updateDigestForPath(hash, path.join(target, name), path.join(relative, name));
-    }
-    return;
-  }
-  if (!stat.isFile()) throw new Error(`지원하지 않는 백업 파일 형식입니다: ${target}`);
-  updateDigestField(hash, 'file');
-  updateDigestField(hash, relative);
-  updateDigestField(hash, stat.size);
-  const handle = fs.openSync(target, 'r');
-  const buffer = Buffer.allocUnsafe(1024 * 1024);
-  try {
-    for (;;) {
-      const bytesRead = fs.readSync(handle, buffer, 0, buffer.length, null);
-      if (bytesRead === 0) break;
-      hash.update(buffer.subarray(0, bytesRead));
-    }
-  } finally {
-    fs.closeSync(handle);
-  }
-}
-
-function pathIntegrity(target) {
-  const hash = createHash('sha256');
-  updateDigestForPath(hash, target);
-  return { algorithm: 'sha256', digest: hash.digest('hex') };
-}
-
-function integrityMatches(target, integrity) {
-  return integrity?.algorithm === 'sha256'
-    && /^[a-f0-9]{64}$/u.test(integrity.digest || '')
-    && pathIntegrity(target).digest === integrity.digest;
-}
-
-function entriesFromLock(lock) {
-  if (!lock || typeof lock !== 'object') return [];
-  const containers = [lock.skills, lock.installed, lock.dependencies, lock];
-  const result = [];
-  for (const container of containers) {
-    if (!container || typeof container !== 'object' || Array.isArray(container)) continue;
-    for (const [name, value] of Object.entries(container)) {
-      if (name === 'skills' || name === 'installed' || name === 'dependencies') continue;
-      const details = typeof value === 'string' ? { source: value } : (value || {});
-      const source = [details.source, details.sourceUrl, details.repository, details.repo, details.url]
-        .filter(Boolean).join(' ');
-      result.push({ name, source });
-    }
-  }
-  return result;
-}
-
-function lockedOrcaSkillNamesByRoot(context) {
-  const namesByRoot = new Map();
-  for (const lockFile of context.lockFiles) {
-    const skillRoot = path.resolve(path.dirname(lockFile), 'skills');
-    const names = namesByRoot.get(skillRoot) || new Set();
-    for (const entry of entriesFromLock(readJson(lockFile))) {
-      if (ORCA_SOURCE_PATTERN.test(entry.source)) names.add(entry.name);
-    }
-    namesByRoot.set(skillRoot, names);
-  }
-  return namesByRoot;
-}
-
-function hasOrcaSkillSignature(skillPath) {
-  const text = [
-    readText(path.join(skillPath, 'SKILL.md')),
-    readText(path.join(skillPath, 'README.md')),
-    readText(path.join(skillPath, 'package.json')),
-  ].join('\n');
-  return ORCA_SKILL_SIGNATURES.some((pattern) => pattern.test(text));
-}
-
-function defaultCliCandidates(platform, home) {
-  if (platform === 'darwin') {
-    return ['/usr/local/bin/orca', path.join(home, '.local', 'bin', 'orca')];
-  }
-  if (platform === 'linux') {
-    // Linux 공식 명령은 orca-ide다. /usr/bin/orca는 GNOME 스크린 리더라 건드리지 않는다.
-    return [
-      path.join(home, '.local', 'bin', LINUX_CLI_COMMAND_NAME),
-      path.join(home, '.local', 'bin', 'orca'),
-    ];
-  }
-  return [];
-}
-
-function isOrcaCli(candidate) {
-  if (!pathExists(candidate)) return false;
-  let linkTarget = '';
-  try {
-    const stat = fs.lstatSync(candidate);
-    if (stat.isSymbolicLink()) linkTarget = fs.readlinkSync(candidate);
-  } catch {
-    return false;
-  }
-  const text = readText(candidate);
-  const haystack = `${linkTarget}\n${text}`;
-  if (/Orca\.app[\\/]Contents[\\/]Resources[\\/]bin/i.test(haystack)) return true;
-  if (haystack.includes(LINUX_CLI_DISPATCHER_MARKER)) return true;
-  if (/stablyai\/orca|Managed by Orca/i.test(haystack)) return true;
-  if (/[\\/]resources[\\/]bin[\\/]orca-ide(?:\.exe)?$/i.test(linkTarget)) return true;
-  return false;
-}
-
-function stripDelimitedBlock(content, startMarker, endMarker) {
-  const start = content.indexOf(startMarker);
-  if (start < 0) return content;
-  const endMarkerIndex = content.indexOf(endMarker, start + startMarker.length);
-  const end = endMarkerIndex < 0 ? content.length : endMarkerIndex + endMarker.length;
-  const before = content.slice(0, start).replace(/[ \t]*(?:\r?\n)*$/, '');
-  const after = content.slice(end).replace(/^(?:\r?\n)+/, '');
-  if (!before) return after;
-  if (!after) return before.endsWith('\n') ? before : `${before}\n`;
-  return `${before}\n\n${after}`;
-}
-
-function splitLinesWithEol(text) {
-  return { lines: text.split('\n').map((line) => line.replace(/\r$/, '')), eol: text.includes('\r\n') ? '\r\n' : '\n' };
-}
-
-function parseTomlSingleLineString(valueText) {
-  const literal = valueText.match(/^'([^']*)'\s*(?:#.*)?$/);
-  if (literal) return literal[1];
-  const basic = valueText.match(/^"((?:[^"\\]|\\.)*)"\s*(?:#.*)?$/);
-  if (!basic) return null;
-  const escapes = { b: '\b', t: '\t', n: '\n', f: '\f', r: '\r', '"': '"', '\\': '\\' };
-  return basic[1].replace(/\\(u[0-9a-fA-F]{4}|U[0-9a-fA-F]{8}|.)/g, (_, escape) => (
-    escape.length > 1 ? String.fromCodePoint(Number.parseInt(escape.slice(1), 16)) : (escapes[escape] ?? escape)
-  ));
-}
-
-// jcode ~/.jcode/config.toml의 [hooks] 표에서 Orca 스크립트를 부르는 줄 번호(src/main/jcode/hook-config.ts).
-function jcodeManagedHookLines(text) {
-  const { lines } = splitLinesWithEol(text);
-  const managed = new Set();
-  let inHooks = false;
-  let multiline = null;
-  lines.forEach((line, index) => {
-    if (multiline) {
-      if (line.includes(multiline)) multiline = null;
-      return;
-    }
-    if (/^\s*\[\[/.test(line)) {
-      inHooks = false;
-      return;
-    }
-    const header = line.match(/^\s*\[\s*([^[\]]+?)\s*\]\s*(?:#.*)?$/);
-    if (header) {
-      inHooks = header[1] === 'hooks';
-      return;
-    }
-    const pair = line.match(/^\s*[A-Za-z0-9_-]+\s*=\s*(.*)$/);
-    if (!pair) return;
-    const opener = ['"""', "'''"].find((quote) => pair[1].startsWith(quote));
-    if (opener) {
-      if (pair[1].indexOf(opener, opener.length) < 0) multiline = opener;
-      return;
-    }
-    if (inHooks && isOrcaHookString(parseTomlSingleLineString(pair[1]))) managed.add(index);
-  });
-  return managed;
-}
-
-// dsh-home-patch.ts와 같이 가장 가까운 시작 표식과 그 뒤 첫 끝 표식을 짝짓는다.
-function dshManagedRegion(lines) {
-  let start = -1;
-  for (const [index, line] of lines.entries()) {
-    if (line.trim() === DSH_START) start = index;
-    else if (line.trim() === DSH_END && start !== -1) return { start, end: index };
-  }
-  return null;
-}
-
-function isOrcaOpenCodeTuiEntry(item) {
-  const raw = Array.isArray(item) ? item[0] : item;
-  if (typeof raw !== 'string') return false;
-  let decoded = raw;
-  try {
-    decoded = decodeURIComponent(raw);
-  } catch {
-    // 잘못된 퍼센트 인코딩이면 원문으로 판단한다.
-  }
-  return OPENCODE_TUI_ENTRY_PATTERN.test(decoded);
-}
-
-function hasOpenCodePluginSignature(target) {
-  try {
-    const file = fs.lstatSync(target).isDirectory() ? path.join(target, 'tui.js') : target;
-    return OPENCODE_PLUGIN_SIGNATURE.test(readText(file));
-  } catch {
-    return false;
-  }
-}
-
-// Orca grok-hook-config-cleanup.ts의 isOrcaOwnedRemnant와 같은 기준: Orca 항목을 빼면 hooks가 비고
-// version 말고 남는 키가 없다. 사용자가 dotfiles로 연결한 심볼릭 링크는 파일을 지우지 않고 고친다.
-function isOrcaOwnedRemnant(target) {
-  try {
-    if (fs.lstatSync(target).isSymbolicLink()) return false;
-  } catch {
-    return false;
-  }
-  const value = readJson(target);
-  if (!value || typeof value !== 'object' || Array.isArray(value)) return false;
-  return Object.keys(pruneJsonHooks(value)).every((key) => key === 'version');
-}
-
-function hasHookMarker(candidate) {
-  if (!pathExists(candidate.path)) return false;
-  if (candidate.type === 'hermes') {
-    const markerFiles = ['plugin.json', 'README.md', '__init__.py', 'orca-status.py'];
-    return markerFiles.some((name) => {
-      const text = readText(path.join(candidate.path, name));
-      return MANAGED_FILE_PATTERN.test(text) || ORCA_HOOK_PATTERN.test(text);
-    });
-  }
-  if (candidate.type === 'opencode-plugin') return hasOpenCodePluginSignature(candidate.path);
-  const text = readText(candidate.path);
-  if (candidate.type === 'kimi') return text.includes(KIMI_START) && text.includes(KIMI_END);
-  if (candidate.type === 'dsh') return dshManagedRegion(splitLinesWithEol(text).lines) !== null;
-  if (candidate.type === 'jcode') return jcodeManagedHookLines(text).size > 0;
-  if (candidate.type === 'muse') return isOrcaHookString(readJson(candidate.path)?.managed_hooks_path);
-  if (candidate.type === 'opencode-tui') {
-    const plugins = readJson(candidate.path)?.plugin;
-    // 주석이 있는 JSONC는 해석하지 못하지만 Orca 항목이 보이면 알린다. 수정 단계에서 오류로 멈춘다.
-    return Array.isArray(plugins)
-      ? plugins.some(isOrcaOpenCodeTuiEntry)
-      : /plugins[\\/]+(?:orca-opencode2?-status-tui|orca-opencode-startup-prompt)[\\/]+tui\.js/i.test(text);
-  }
-  if (candidate.type === 'codex-legacy') return text.includes(CODEX_LEGACY_START);
-  if (candidate.type === 'amp') return MANAGED_FILE_PATTERN.test(text);
-  if (candidate.type === 'hermes-config') return /^\s*-\s*orca-status\s*$/m.test(text);
-  return isOrcaHookString(text) || MANAGED_FILE_PATTERN.test(text);
-}
-
-function hasManagedExtensionMarker(target) {
-  return pathExists(target) && readText(target).includes(PI_EXTENSION_MARKER);
-}
-
-function listMatchingChildren(directory, pattern) {
-  try {
-    return fs.readdirSync(directory, { withFileTypes: true })
-      .filter((entry) => pattern.test(entry.name))
-      .map((entry) => path.join(directory, entry.name));
-  } catch {
-    return [];
-  }
-}
-
-function managedHookLockResidues(home) {
-  return listMatchingChildren(path.join(home, '.orca'),
-    /^managed-hook-install\.(?:owner(?:-draft)?|claimed|claim)-.+\.json$/u);
-}
-
-function managedSkillTransactionResidues(root) {
-  return listMatchingChildren(root,
-    /^(?:\.orca-skill-extract-.+|\..+\.orca-(?:staging|backup|copy|skill-delete|remove-backup|placement-backup|placement-staging)-.+)$/u);
-}
-
-function hasOrcaVoiceModelSignature(target) {
-  const containsKnownModel = (directory) => {
-    try {
-      return fs.readdirSync(directory, { withFileTypes: true }).some((entry) => {
-        const normalized = entry.name.replace(/(?:\.partial|\.tar\.bz2)$/i, '');
-        return ORCA_VOICE_MODEL_IDS.has(normalized);
-      });
-    } catch {
-      return false;
-    }
-  };
-  if (containsKnownModel(target)) return true;
-  try {
-    return fs.readdirSync(target, { withFileTypes: true })
-      .filter((entry) => entry.isDirectory() && /^[a-f0-9]{16}$/i.test(entry.name))
-      .some((entry) => containsKnownModel(path.join(target, entry.name)));
-  } catch {
-    return false;
-  }
-}
-
-function finding(kind, target, reason, requires = null, meta = {}) {
-  return { kind, path: path.resolve(target), reason, requires, ...meta };
-}
-
-export function scanOrcaResidue(context) {
-  const findings = [];
-  const runtime = classifyOrcaProcesses(context);
-  for (const target of runtime.installations) {
-    findings.push(finding('app-installed', target, 'Orca 앱이 아직 설치돼 있습니다. 운영체제의 제거 기능으로 먼저 지우세요', 'never'));
-  }
-  for (const item of runtime.app) {
-    findings.push(finding('app-running', item.path, `Orca 앱이 실행 중입니다(PID ${item.pid}). 앱을 끄고 제거한 뒤 정리하세요`, 'never', { pid: item.pid }));
-  }
-  for (const item of runtime.leftover) {
-    findings.push(finding('process', item.path, `앱 없이 남아 돌고 있는 Orca 백그라운드 프로세스(PID ${item.pid})`, 'stopProcesses', { pid: item.pid }));
-  }
-  const lockedNamesByRoot = lockedOrcaSkillNamesByRoot(context);
-
-  for (const root of context.skillRoots) {
-    const requirement = context.skillRootRequirements?.get(path.resolve(root)) || null;
-    const lockedNames = lockedNamesByRoot.get(path.resolve(root)) || new Set();
-    for (const name of OFFICIAL_ORCA_SKILLS) {
-      const skillPath = path.join(root, name);
-      if (!pathExists(skillPath)) continue;
-      const isAgentsSkillRoot = path.basename(root) === 'skills' && path.basename(path.dirname(root)) === '.agents';
-      if ((isAgentsSkillRoot && lockedNames.has(name)) || hasOrcaSkillSignature(skillPath)) {
-        findings.push(finding('skill', skillPath, `Orca 공식 스킬(${name}) 출처 확인`, requirement));
-      }
-    }
-    for (const target of managedSkillTransactionResidues(root)) {
-      findings.push(finding('skill-transaction', target, '중단된 Orca Skills 설치·삭제 트랜잭션', requirement));
-    }
-  }
-
-  for (const root of context.pluginCacheRoots || []) {
-    for (const skillPath of pluginCacheOrcaSkills(root)) {
-      findings.push(finding('skill', skillPath, 'Codex 플러그인 캐시의 Orca 공식 스킬 출처 확인'));
-    }
-  }
-
-  for (const lockFile of context.lockFiles) {
-    const entries = entriesFromLock(readJson(lockFile)).filter((entry) => ORCA_SOURCE_PATTERN.test(entry.source));
-    if (entries.length) {
-      const requirement = context.lockFileRequirements?.get(path.resolve(lockFile)) || null;
-      findings.push(finding('skill-lock', lockFile, 'stablyai/orca 잠금 항목', requirement, { names: entries.map((entry) => entry.name) }));
-    }
-  }
-
-  const hookCandidates = context.hookCandidates.flatMap((candidate) => (candidate.type === 'json-dir'
-    ? listMatchingChildren(candidate.path, /\.json$/i).map((file) => ({ ...candidate, type: 'json', path: file }))
-    : [candidate]));
-  for (const candidate of hookCandidates) {
-    if (candidate.type === 'hermes-config') {
-      const plugin = context.hookCandidates.find((item) => item.type === 'hermes'
-        && path.dirname(path.dirname(item.path)) === path.dirname(candidate.path));
-      if (!plugin || !hasHookMarker(plugin)) continue;
-    }
-    if (hasHookMarker(candidate)) {
-      const removeWhole = (candidate.type === 'codex-legacy'
-        && stripDelimitedBlock(readText(candidate.path), CODEX_LEGACY_START, CODEX_LEGACY_END).trim() === '')
-        || (candidate.ownedFile && isOrcaOwnedRemnant(candidate.path));
-      findings.push(finding('hook', candidate.path, `Orca 관리형 ${candidate.type} 훅`, candidate.requires || null,
-        { hookType: candidate.type, removeWhole }));
-    }
-  }
-
-  for (const candidate of context.extensionCandidates || []) {
-    if (hasManagedExtensionMarker(candidate.path)) {
-      findings.push(finding('extension', candidate.path, 'Orca 관리형 Pi·OMP·Prime 확장', candidate.requires || null));
-    }
-  }
-
-  for (const target of context.sharedStateCandidates) {
-    if (pathExists(target)) {
-      findings.push(finding('shared-state', target, '경로가 고정된 Orca 훅·암호화 자격증명·관리 파일'));
-    }
-  }
-  for (const target of managedHookLockResidues(context.home)) {
-    findings.push(finding('shared-state', target, '중단된 Orca 관리형 훅 잠금 복구 파일'));
-  }
-  for (const candidate of context.conditionalStateCandidates || []) {
-    if (pathExists(candidate.path)) {
-      findings.push(finding(candidate.kind, candidate.path, candidate.reason, candidate.requires));
-    }
-  }
-  for (const target of context.userStateCandidates || []) {
-    if (pathExists(target)) {
-      findings.push(finding('user-state', target, 'Orca 자격증명·세션·키 설정을 포함한 전체 사용자 상태', 'includeUserState'));
-    }
-  }
-
-  const seenAppData = new Set();
-  for (const target of context.appDataCandidates) {
-    if (!pathExists(target)) continue;
-    const identity = context.filesystemIdentity(target);
-    if (seenAppData.has(identity)) continue;
-    seenAppData.add(identity);
-    findings.push(finding('app-data', target, 'Orca 애플리케이션 데이터', 'includeAppData'));
-  }
-  for (const target of context.voiceCandidates) {
-    if (!pathExists(target)) continue;
-    if (hasOrcaVoiceModelSignature(target)) {
-      findings.push(finding('voice-data', target, 'Orca 음성 모델 캐시', 'includeVoiceData'));
-    } else {
-      findings.push(finding('unverified', target, 'Orca 음성 모델 서명을 확인할 수 없어 자동 정리하지 않음', 'never'));
-    }
-  }
-  for (const target of context.cliCandidates) {
-    if (isOrcaCli(target)) findings.push(finding('cli', target, 'Orca 앱 또는 공식 런처를 가리키는 CLI'));
-  }
-  for (const candidate of context.conditionalCliCandidates || []) {
-    if (isOrcaCli(candidate.path)) {
-      findings.push(finding('cli', candidate.path, 'Orca 앱 또는 공식 런처를 가리키는 CLI', candidate.requires));
-    }
-  }
-  for (const entry of (context.userPath || '').split(';').filter(Boolean)) {
-    if (isWindowsOrcaPathEntry(entry, context)) {
-      findings.push(finding('path-entry', entry, 'Windows 사용자 PATH의 Orca CLI 경로', null, { rawPathEntry: entry }));
-    }
-  }
-
-  const uniqueFindings = new Map();
-  for (const item of findings) uniqueFindings.set(`${item.kind}\0${item.path}\0${item.pid ?? ''}`, item);
-  return [...uniqueFindings.values()].sort((a, b) => a.path.localeCompare(b.path));
-}
-
-function safeRelative(target) {
-  const parsed = path.parse(target);
-  const withoutRoot = target.slice(parsed.root.length).replace(/:/g, '_');
-  const rootLabel = parsed.root.replace(/[\\/:]+/g, '_') || 'root';
-  return path.join(rootLabel, withoutRoot);
-}
-
-function isSameOrDescendant(parent, candidate) {
-  const relative = path.relative(path.resolve(parent), path.resolve(candidate));
-  return relative === '' || (!relative.startsWith('..') && !path.isAbsolute(relative));
-}
-
-function assertSafeQuarantineSource(source, context) {
-  const resolved = path.resolve(source);
-  if (resolved === path.parse(resolved).root || resolved === path.resolve(context.home)) {
-    throw new Error(`사용자 홈 또는 파일시스템 루트는 격리할 수 없습니다: ${resolved}`);
-  }
-  if (isSameOrDescendant(resolved, context.backupRoot)) {
-    throw new Error(`백업 폴더가 정리 대상 내부에 있어 작업을 거부했습니다: ${resolved}`);
-  }
-}
-
-function ensureParent(target) {
-  fs.mkdirSync(path.dirname(target), { recursive: true });
-}
-
-function quarantine(source, context, category, dryRun) {
-  assertSafeQuarantineSource(source, context);
-  const destination = path.join(context.backupRoot, category, safeRelative(source));
-  if (dryRun) return destination;
-  ensureParent(destination);
-  if (pathExists(destination)) throw new Error(`백업 대상이 이미 존재합니다: ${destination}`);
-  try {
-    fs.renameSync(source, destination);
-  } catch (error) {
-    if (error.code !== 'EXDEV') throw error;
-    const stat = fs.lstatSync(source);
-    if (stat.isSymbolicLink()) {
-      fs.symlinkSync(fs.readlinkSync(source), destination);
-      fs.unlinkSync(source);
-    } else {
-      fs.cpSync(source, destination, { recursive: true, force: false, errorOnExist: true });
-      fs.rmSync(source, { recursive: true, force: false });
-    }
-  }
-  return destination;
-}
-
-function backupConfig(source, context, dryRun) {
-  const destination = path.join(context.backupRoot, 'config-original', safeRelative(source));
-  if (!dryRun) {
-    ensureParent(destination);
-    fs.copyFileSync(source, destination, fs.constants.COPYFILE_EXCL);
-  }
-  return destination;
-}
-
-function directManagedString(value) {
-  if (!value || typeof value !== 'object' || Array.isArray(value)) return false;
-  return Object.values(value).some((item) => isOrcaHookString(item));
-}
-
-function pruneJsonHooks(value) {
-  if (Array.isArray(value)) {
-    const next = [];
-    for (const item of value) {
-      if (isOrcaHookString(item)) continue;
-      if (directManagedString(item)) continue;
-      const cleaned = pruneJsonHooks(item);
-      if (item && typeof item === 'object' && Array.isArray(item.hooks)
-          && (!cleaned.hooks || cleaned.hooks.length === 0)) continue;
-      if (cleaned !== undefined) next.push(cleaned);
-    }
-    return next;
-  }
-  if (!value || typeof value !== 'object') return value;
-  const next = {};
-  for (const [key, child] of Object.entries(value)) {
-    if (isOrcaHookString(child)) continue;
-    if (directManagedString(child)) continue;
-    const cleaned = pruneJsonHooks(child);
-    if (cleaned === undefined) continue;
-    if (Array.isArray(cleaned) && cleaned.length === 0) continue;
-    if (cleaned && typeof cleaned === 'object' && !Array.isArray(cleaned) && Object.keys(cleaned).length === 0) continue;
-    next[key] = cleaned;
-  }
-  return next;
-}
-
-function writeAtomic(target, text) {
-  const temp = `${target}.orca-cleanup-${process.pid}-${randomUUID()}.tmp`;
-  fs.writeFileSync(temp, text, { encoding: 'utf8', flag: 'wx' });
-  try {
-    fs.renameSync(temp, target);
-  } finally {
-    try { fs.unlinkSync(temp); } catch { /* rename 성공 시 이미 사라진다. */ }
-  }
-}
-
-function cleanJsonHook(target, context, dryRun) {
-  const value = readJson(target);
-  if (!value) throw new Error(`JSON을 해석할 수 없어 자동 수정하지 않았습니다: ${target}`);
-  const cleaned = pruneJsonHooks(value);
-  const before = `${JSON.stringify(value, null, 2)}\n`;
-  const after = `${JSON.stringify(cleaned, null, 2)}\n`;
-  if (before === after) return null;
-  const backup = backupConfig(target, context, dryRun);
-  if (!dryRun) writeAtomic(target, after);
-  return backup;
-}
-
-function cleanKimiHook(target, context, dryRun) {
-  const text = readText(target);
-  const start = text.indexOf(KIMI_START);
-  const end = text.indexOf(KIMI_END, start + KIMI_START.length);
-  if (start < 0 || end < 0) return null;
-  const backup = backupConfig(target, context, dryRun);
-  const after = `${text.slice(0, start)}${text.slice(end + KIMI_END.length)}`.replace(/\n{3,}/g, '\n\n');
-  if (!dryRun) writeAtomic(target, after);
-  return backup;
-}
-
-function cleanCodexLegacyHook(target, context, dryRun) {
-  const text = readText(target);
-  const after = stripDelimitedBlock(text, CODEX_LEGACY_START, CODEX_LEGACY_END);
-  if (after === text) return null;
-  const backup = backupConfig(target, context, dryRun);
-  if (!dryRun) writeAtomic(target, after);
-  return backup;
-}
-
-function cleanHermesConfig(target, context, dryRun) {
-  const text = readText(target);
-  const after = text.split(/(?<=\n)/).filter((line) => !/^\s*-\s*orca-status\s*(?:\r?\n)?$/.test(line)).join('');
-  if (after === text) return null;
-  const backup = backupConfig(target, context, dryRun);
-  if (!dryRun) writeAtomic(target, after);
-  return backup;
-}
-
-function editText(target, after, context, dryRun) {
-  if (after === readText(target)) return null;
-  const backup = backupConfig(target, context, dryRun);
-  if (!dryRun) writeAtomic(target, after);
-  return backup;
-}
-
-function cleanJcodeHook(target, context, dryRun) {
-  const text = readText(target);
-  const managed = jcodeManagedHookLines(text);
-  if (managed.size === 0) return null;
-  const { lines, eol } = splitLinesWithEol(text);
-  return editText(target, lines.filter((_, index) => !managed.has(index)).join(eol), context, dryRun);
-}
-
-function cleanDshHook(target, context, dryRun) {
-  const text = readText(target);
-  const { lines, eol } = splitLinesWithEol(text);
-  const region = dshManagedRegion(lines);
-  if (!region) return null;
-  const kept = [...lines.slice(0, region.start), ...lines.slice(region.end + 1)];
-  while (kept.length > 0 && kept[kept.length - 1].trim() === '') kept.pop();
-  // 주석만 남으면 DSH가 읽지 못하므로 Orca와 같이 빈 목록을 되돌려 놓는다.
-  if (kept.every((line) => line.trim() === '' || line.trim().startsWith('#'))) kept.push('[]');
-  return editText(target, `${kept.join(eol)}${eol}`, context, dryRun);
-}
-
-function cleanMuseHook(target, context, dryRun) {
-  const value = readJson(target);
-  if (!value || typeof value !== 'object' || Array.isArray(value)) {
-    throw new Error(`Muse 설정을 해석할 수 없어 자동 수정하지 않았습니다: ${target}`);
-  }
-  if (!isOrcaHookString(value.managed_hooks_path)) return null;
-  const next = { ...value };
-  delete next.managed_hooks_path;
-  if (Array.isArray(next.managed_hooks_env_vars)) {
-    const kept = next.managed_hooks_env_vars.filter((name) => !MUSE_ORCA_ENV_VARS.has(name));
-    if (kept.length > 0) next.managed_hooks_env_vars = kept;
-    else delete next.managed_hooks_env_vars;
-  }
-  return editText(target, `${JSON.stringify(next, null, 2)}\n`, context, dryRun);
-}
-
-function cleanOpenCodeTuiConfig(target, context, dryRun) {
-  const value = readJson(target);
-  if (!value || typeof value !== 'object' || Array.isArray(value) || !Array.isArray(value.plugin)) {
-    throw new Error(`OpenCode TUI 설정을 해석할 수 없어 자동 수정하지 않았습니다: ${target}`);
-  }
-  const kept = value.plugin.filter((item) => !isOrcaOpenCodeTuiEntry(item));
-  if (kept.length === value.plugin.length) return null;
-  const next = { ...value, plugin: kept };
-  if (kept.length === 0) delete next.plugin;
-  return editText(target, `${JSON.stringify(next, null, 2)}\n`, context, dryRun);
-}
-
-const HOOK_EDITORS = Object.freeze({
-  json: cleanJsonHook,
-  kimi: cleanKimiHook,
-  'hermes-config': cleanHermesConfig,
-  jcode: cleanJcodeHook,
-  dsh: cleanDshHook,
-  muse: cleanMuseHook,
-  'opencode-tui': cleanOpenCodeTuiConfig,
-});
-
-function cleanWindowsUserPath(context, dryRun) {
-  const parts = (context.userPath || '').split(';');
-  const next = parts.filter((entry) => !isWindowsOrcaPathEntry(entry, context)).join(';');
-  if (next === context.userPath) return null;
-  const backup = path.join(context.backupRoot, 'config-original', 'windows-user-path.txt');
-  if (!dryRun) {
-    ensureParent(backup);
-    fs.writeFileSync(backup, `${context.userPath}\n`, { encoding: 'utf8', flag: 'wx' });
-    if (process.platform !== 'win32') throw new Error('Windows 사용자 PATH는 Windows에서만 수정할 수 있습니다.');
-    const script = "[Environment]::SetEnvironmentVariable('Path',$env:ORCA_CLEAN_PATH,'User')";
-    const result = spawnSync('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', script], {
-      encoding: 'utf8', env: { ...process.env, ORCA_CLEAN_PATH: next },
-    });
-    if (result.status !== 0) throw new Error(`Windows 사용자 PATH 수정 실패: ${result.stderr.trim()}`);
-    context.userPath = next;
-  }
-  return backup;
-}
-
-function removeLockEntries(target, names, context, dryRun) {
-  const value = readJson(target);
-  if (!value) throw new Error(`잠금 JSON을 해석할 수 없습니다: ${target}`);
-  const wanted = new Set(names);
-  let changed = false;
-  const containers = [value.skills, value.installed, value.dependencies, value];
-  for (const container of containers) {
-    if (!container || typeof container !== 'object' || Array.isArray(container)) continue;
-    for (const [name, details] of Object.entries(container)) {
-      if (!wanted.has(name)) continue;
-      const source = typeof details === 'string'
-        ? details
-        : [details?.source, details?.sourceUrl, details?.repository, details?.repo, details?.url]
-          .filter(Boolean).join(' ');
-      if (ORCA_SOURCE_PATTERN.test(source)) {
-        delete container[name];
-        changed = true;
-      }
-    }
-  }
-  if (!changed) return null;
-  const backup = backupConfig(target, context, dryRun);
-  if (!dryRun) writeAtomic(target, `${JSON.stringify(value, null, 2)}\n`);
-  return backup;
-}
-
-function selected(finding, options) {
-  return !finding.requires || Boolean(options[finding.requires]);
-}
-
-function plannedMutationForFinding(item) {
-  if (item.kind === 'skill-lock' || item.kind === 'path-entry') return 'edit';
-  if (item.kind !== 'hook' || item.removeWhole) return 'quarantine';
-  if (Object.hasOwn(HOOK_EDITORS, item.hookType) || item.hookType === 'codex-legacy') return 'edit';
-  return 'quarantine';
-}
-
-function plannedBackupForFinding(item, context, mutation) {
-  if (mutation === 'edit') {
-    return item.kind === 'path-entry'
-      ? path.join(context.backupRoot, 'config-original', 'windows-user-path.txt')
-      : path.join(context.backupRoot, 'config-original', safeRelative(item.path));
-  }
-  const category = item.kind.replace(/[^a-z0-9-]/gi, '-');
-  return path.join(context.backupRoot, category, safeRelative(item.path));
-}
-
-function cleanupJournalValue(context, createdAt, cleanupStatus, actions, errors) {
-  return signedCleanupManifest({
-    manifestVersion: 2,
-    createdAt,
-    platform: context.platform,
-    backupRoot: context.backupRoot,
-    cleanupStatus,
-    actions,
-    errors,
-  });
-}
-
-function initializeCleanupJournal(context, createdAt, actions, errors) {
-  if (pathExists(context.backupRoot) && fs.readdirSync(context.backupRoot).length > 0) {
-    throw new Error(`비어 있지 않은 백업 폴더는 사용할 수 없습니다: ${context.backupRoot}`);
-  }
-  fs.mkdirSync(context.backupRoot, { recursive: true });
-  const manifestPath = path.join(context.backupRoot, 'manifest.json');
-  const manifest = cleanupJournalValue(context, createdAt, 'in-progress', actions, errors);
-  fs.writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`, { encoding: 'utf8', flag: 'wx' });
-  return manifestPath;
-}
-
-function updateCleanupJournal(manifestPath, context, createdAt, cleanupStatus, actions, errors) {
-  const manifest = cleanupJournalValue(context, createdAt, cleanupStatus, actions, errors);
-  writeAtomic(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`);
-}
-
-export function cleanOrcaResidue(context, options = {}) {
-  const dryRun = Boolean(options.dryRun);
-  const findings = scanOrcaResidue(context);
-  const actions = [];
-  const errors = [];
-  const createdAt = new Date().toISOString();
-  const blockers = findings.filter((item) => item.kind === 'app-installed' || item.kind === 'app-running');
-  const blocked = blockers.length > 0 && !options.force;
-  if (blocked && !dryRun) {
-    errors.push({
-      path: blockers[0].path,
-      message: 'Orca 앱이 아직 설치돼 있거나 실행 중이라 정리하지 않았습니다. 앱이 켜질 때 훅을 다시 설치하기 때문입니다. 앱을 먼저 제거하고, 그래도 진행하려면 --force를 붙이세요.',
-    });
-    return { findings, actions, errors, backupRoot: context.backupRoot, dryRun, blocked };
-  }
-
-  // 백그라운드 프로세스가 앱 데이터를 붙잡고 있으면 격리가 실패하므로 먼저 끈다. 되돌릴 수 없는 작업이라 복원 대상이 아니다.
-  for (const item of findings.filter((candidate) => candidate.kind === 'process' && selected(candidate, options))) {
-    if (dryRun) {
-      actions.push({ action: 'would-stop', ...item });
-      continue;
-    }
-    try {
-      context.stopProcess(item.pid);
-      actions.push({ action: 'stopped', ...item });
-    } catch (error) {
-      errors.push({ path: item.path, message: error.message });
-      actions.push({ action: 'error', error: error.message, ...item });
-    }
-  }
-
-  const hasSelectedWork = findings.some((item) => item.kind !== 'process' && selected(item, options));
-  let manifestPath = null;
-  if (!dryRun && hasSelectedWork) {
-    try {
-      for (const item of findings.filter((candidate) => selected(candidate, options))) {
-        if (plannedMutationForFinding(item) === 'quarantine') assertSafeQuarantineSource(item.path, context);
-      }
-      manifestPath = initializeCleanupJournal(context, createdAt, actions, errors);
-    } catch (error) {
-      errors.push({ path: context.backupRoot, message: error.message });
-      actions.push({ action: 'error', path: context.backupRoot, error: error.message });
-      return { findings, actions, errors, backupRoot: context.backupRoot, dryRun };
-    }
-  }
-
-  const selectedUserStateRoots = findings
-    .filter((item) => item.kind === 'user-state' && selected(item, options))
-    .map((item) => item.path);
-
-  for (const item of findings) {
-    if (item.kind === 'process' && selected(item, options)) continue;
-    if (item.kind !== 'user-state'
-        && selectedUserStateRoots.some((root) => isSameOrDescendant(root, item.path))) {
-      actions.push({ action: 'covered', ...item });
-      if (manifestPath) updateCleanupJournal(manifestPath, context, createdAt, 'in-progress', actions, errors);
-      continue;
-    }
-    if (!selected(item, options)) {
-      actions.push({ action: 'skipped', ...item });
-      if (manifestPath) updateCleanupJournal(manifestPath, context, createdAt, 'in-progress', actions, errors);
-      continue;
-    }
-    let pendingIndex = -1;
-    if (manifestPath) {
-      const mutation = plannedMutationForFinding(item);
-      const pending = {
-        action: mutation === 'edit' ? 'pending-edit' : 'pending-quarantine',
-        backup: plannedBackupForFinding(item, context, mutation),
-        ...item,
-      };
-      pendingIndex = actions.push(pending) - 1;
-      updateCleanupJournal(manifestPath, context, createdAt, 'in-progress', actions, errors);
-    }
-    try {
-      let action;
-      if (item.kind === 'hook' && !item.removeWhole && Object.hasOwn(HOOK_EDITORS, item.hookType)) {
-        const backup = HOOK_EDITORS[item.hookType](item.path, context, dryRun);
-        action = { action: backup ? (dryRun ? 'would-edit' : 'edited') : 'unchanged', backup, ...item };
-      } else if (item.kind === 'hook' && item.hookType === 'codex-legacy' && !item.removeWhole) {
-        const backup = cleanCodexLegacyHook(item.path, context, dryRun);
-        action = { action: backup ? (dryRun ? 'would-edit' : 'edited') : 'unchanged', backup, ...item };
-      } else if (item.kind === 'skill-lock') {
-        const backup = removeLockEntries(item.path, item.names, context, dryRun);
-        action = { action: backup ? (dryRun ? 'would-edit' : 'edited') : 'unchanged', backup, ...item };
-      } else if (item.kind === 'path-entry') {
-        const backup = cleanWindowsUserPath(context, dryRun);
-        action = { action: backup ? (dryRun ? 'would-edit' : 'edited') : 'unchanged', backup, ...item };
-      } else {
-        const category = item.kind.replace(/[^a-z0-9-]/gi, '-');
-        const backup = quarantine(item.path, context, category, dryRun);
-        action = { action: dryRun ? 'would-quarantine' : 'quarantined', backup, ...item };
-      }
-      if (!dryRun && ['edited', 'quarantined'].includes(action.action)) {
-        action.backupIntegrity = pathIntegrity(action.backup);
-      }
-      if (pendingIndex >= 0) actions[pendingIndex] = action;
-      else actions.push(action);
-    } catch (error) {
-      errors.push({ path: item.path, message: error.message });
-      if (pendingIndex >= 0) actions[pendingIndex] = { ...actions[pendingIndex], error: error.message };
-      else actions.push({ action: 'error', error: error.message, ...item });
-    }
-    if (manifestPath) updateCleanupJournal(manifestPath, context, createdAt, 'in-progress', actions, errors);
-  }
-
-  if (manifestPath) updateCleanupJournal(manifestPath, context, createdAt, 'complete', actions, errors);
-  return { findings, actions, errors, backupRoot: context.backupRoot, dryRun, blocked };
-}
-
-function assertSafeRestorePath(target, backupRoot, home) {
-  const resolved = path.resolve(target);
-  if (!path.isAbsolute(target) || resolved === path.parse(resolved).root || resolved === path.resolve(home)) {
-    throw new Error(`복원 대상이 안전하지 않습니다: ${target}`);
-  }
-  if (isSameOrDescendant(backupRoot, resolved) || isSameOrDescendant(resolved, backupRoot)) {
-    throw new Error(`복원 대상과 백업 폴더가 겹칩니다: ${resolved}`);
-  }
-  return resolved;
-}
-
-function assertBackupBelongsToManifest(backup, backupRoot) {
-  if (!backup || !path.isAbsolute(backup)) throw new Error(`유효하지 않은 백업 경로입니다: ${backup || '(없음)'}`);
-  const resolved = path.resolve(backup);
-  if (!isSameOrDescendant(backupRoot, resolved) || resolved === backupRoot) {
-    throw new Error(`manifest 밖의 백업 경로는 복원하지 않습니다: ${resolved}`);
-  }
-  return resolved;
-}
-
-const QUARANTINED_RESTORE_KINDS = new Set([
-  'app-data', 'cli', 'extension', 'hook', 'project-state', 'remote-state',
-  'shared-state', 'skill', 'skill-transaction', 'user-state', 'voice-data', 'wsl-state',
-]);
-const EDITED_RESTORE_KINDS = new Set(['hook', 'path-entry', 'skill-lock']);
-
-function sameManifestPath(left, right, platform) {
-  const normalizedLeft = path.resolve(left);
-  const normalizedRight = path.resolve(right);
-  return platform === 'win32'
-    ? normalizedLeft.toLowerCase() === normalizedRight.toLowerCase()
-    : normalizedLeft === normalizedRight;
-}
-
-function expectedBackupForRestoreItem(item, backupRoot) {
-  const sourceAction = item.action === 'pending-quarantine'
-    ? 'quarantined'
-    : item.action === 'pending-edit' ? 'edited' : item.action;
-  if (sourceAction === 'quarantined' && QUARANTINED_RESTORE_KINDS.has(item.kind)) {
-    const category = item.kind.replace(/[^a-z0-9-]/gi, '-');
-    return path.join(backupRoot, category, safeRelative(item.path));
-  }
-  if (sourceAction === 'edited' && EDITED_RESTORE_KINDS.has(item.kind)) {
-    return item.kind === 'path-entry'
-      ? path.join(backupRoot, 'config-original', 'windows-user-path.txt')
-      : path.join(backupRoot, 'config-original', safeRelative(item.path));
-  }
-  throw new Error(`지원하지 않는 복원 작업입니다: ${item.action}/${item.kind}`);
-}
-
-function assertBackupContentIntegrity(item, backup, manifestVersion) {
-  if (manifestVersion < 2 || item.action.startsWith('pending-')) return;
-  if (!integrityMatches(backup, item.backupIntegrity)) {
-    throw new Error(`백업 내용 무결성 검증에 실패했습니다: ${backup}`);
-  }
-}
-
-function assertExpectedBackupForItem(item, state) {
-  const backup = assertBackupBelongsToManifest(item.backup, state.backupRoot);
-  const expected = expectedBackupForRestoreItem(item, state.backupRoot);
-  if (!sameManifestPath(backup, expected, state.platform)) {
-    throw new Error(`대상 경로와 백업 경로의 매핑이 일치하지 않습니다: ${item.path}`);
-  }
-  return backup;
-}
-
-function validateCleanupManifest(manifest, resolvedManifest, platform) {
-  if (![1, 2].includes(manifest.manifestVersion)) {
-    throw new Error(`지원하지 않는 manifest 버전입니다: ${manifest.manifestVersion ?? '(없음)'}`);
-  }
-  if (!['win32', 'darwin', 'linux'].includes(manifest.platform) || manifest.platform !== platform) {
-    throw new Error(`manifest 운영체제가 현재 복원 환경과 다릅니다: ${manifest.platform ?? '(없음)'} -> ${platform}`);
-  }
-  const backupRoot = path.dirname(resolvedManifest);
-  if (!manifest.backupRoot || !sameManifestPath(manifest.backupRoot, backupRoot, platform)) {
-    throw new Error('manifest의 backupRoot가 manifest 위치와 일치하지 않습니다.');
-  }
-  if (!Array.isArray(manifest.actions) || !Array.isArray(manifest.errors)) {
-    throw new Error('manifest의 actions 또는 errors 형식이 올바르지 않습니다.');
-  }
-  if (manifest.manifestVersion === 2 && !['in-progress', 'complete'].includes(manifest.cleanupStatus)) {
-    throw new Error(`manifest 정리 상태가 올바르지 않습니다: ${manifest.cleanupStatus ?? '(없음)'}`);
-  }
-  if (manifest.integrity?.algorithm !== 'sha256'
-      || manifest.integrity.digest !== cleanupManifestDigest(manifest)) {
-    throw new Error('manifest 무결성 검증에 실패했습니다. 파일이 수정되었을 수 있습니다.');
-  }
-  return backupRoot;
-}
-
-export function verifyOrcaBackup(manifestPath, options = {}) {
-  const resolvedManifest = path.resolve(manifestPath);
-  const manifest = readJson(resolvedManifest);
-  if (!manifest) throw new Error(`유효한 Orca 정리 manifest가 아닙니다: ${resolvedManifest}`);
-  const platform = options.platform || process.platform;
-  const backupRoot = validateCleanupManifest(manifest, resolvedManifest, platform);
-  const actions = [];
-  const errors = [];
-  const restorable = manifest.actions.filter((item) => [
-    'quarantined', 'edited', 'pending-quarantine', 'pending-edit',
-  ].includes(item.action));
-
-  for (const item of restorable) {
-    try {
-      const backup = assertExpectedBackupForItem(item, { backupRoot, platform });
-      if (!pathExists(backup)) {
-        if (item.action.startsWith('pending-') && pathExists(item.path)) {
-          actions.push({ path: item.path, backup, status: 'not-applied' });
-          continue;
-        }
-        throw new Error(`백업 항목이 없습니다: ${backup}`);
-      }
-      if (!item.backupIntegrity) {
-        actions.push({ path: item.path, backup, status: item.action.startsWith('pending-')
-          ? 'recoverable-unverified' : 'not-recorded' });
-        continue;
-      }
-      if (!integrityMatches(backup, item.backupIntegrity)) {
-        throw new Error(`백업 내용 무결성 검증에 실패했습니다: ${backup}`);
-      }
-      actions.push({ path: item.path, backup, status: 'verified' });
-    } catch (error) {
-      errors.push({ path: item.path, message: error.message });
-      actions.push({ path: item.path, backup: item.backup, status: 'error', error: error.message });
-    }
-  }
-  return {
-    manifestPath: resolvedManifest,
-    manifestVersion: manifest.manifestVersion,
-    cleanupStatus: manifest.cleanupStatus || 'legacy-complete',
-    backupRoot,
-    actions,
-    errors,
-    valid: errors.length === 0,
-  };
-}
-
-function copyForRestore(source, destination) {
-  const stat = fs.lstatSync(source);
-  ensureParent(destination);
-  if (stat.isSymbolicLink()) {
-    fs.symlinkSync(fs.readlinkSync(source), destination);
-  } else if (stat.isDirectory()) {
-    fs.cpSync(source, destination, { recursive: true, force: false, errorOnExist: true });
-  } else if (stat.isFile()) {
-    fs.copyFileSync(source, destination, fs.constants.COPYFILE_EXCL);
-  } else {
-    throw new Error(`지원하지 않는 백업 파일 형식입니다: ${source}`);
-  }
-}
-
-function filesHaveSameBytes(left, right, size) {
-  const leftHandle = fs.openSync(left, 'r');
-  const rightHandle = fs.openSync(right, 'r');
-  const leftBuffer = Buffer.allocUnsafe(64 * 1024);
-  const rightBuffer = Buffer.allocUnsafe(64 * 1024);
-  try {
-    let offset = 0;
-    while (offset < size) {
-      const length = Math.min(leftBuffer.length, size - offset);
-      const leftRead = fs.readSync(leftHandle, leftBuffer, 0, length, offset);
-      const rightRead = fs.readSync(rightHandle, rightBuffer, 0, length, offset);
-      if (leftRead === 0 || rightRead === 0) return false;
-      if (leftRead !== rightRead || !leftBuffer.subarray(0, leftRead).equals(rightBuffer.subarray(0, rightRead))) return false;
-      offset += leftRead;
-    }
-    return true;
-  } finally {
-    fs.closeSync(leftHandle);
-    fs.closeSync(rightHandle);
-  }
-}
-
-function pathsEquivalent(left, right) {
-  try {
-    const leftStat = fs.lstatSync(left);
-    const rightStat = fs.lstatSync(right);
-    if (leftStat.isSymbolicLink() || rightStat.isSymbolicLink()) {
-      return leftStat.isSymbolicLink() && rightStat.isSymbolicLink()
-        && fs.readlinkSync(left) === fs.readlinkSync(right);
-    }
-    if (leftStat.isFile() || rightStat.isFile()) {
-      return leftStat.isFile() && rightStat.isFile() && leftStat.size === rightStat.size
-        && filesHaveSameBytes(left, right, leftStat.size);
-    }
-    if (!leftStat.isDirectory() || !rightStat.isDirectory()) return false;
-    const leftEntries = fs.readdirSync(left).sort();
-    const rightEntries = fs.readdirSync(right).sort();
-    return leftEntries.length === rightEntries.length
-      && leftEntries.every((name, index) => name === rightEntries[index]
-        && pathsEquivalent(path.join(left, name), path.join(right, name)));
-  } catch {
-    return false;
-  }
-}
-
-function removePartialRestore(target) {
-  if (!pathExists(target)) return;
-  fs.rmSync(target, { recursive: true, force: false });
-}
-
-function setWindowsUserPath(value) {
-  if (process.platform !== 'win32') throw new Error('Windows 사용자 PATH는 Windows에서만 복원할 수 있습니다.');
-  const script = "[Environment]::SetEnvironmentVariable('Path',$env:ORCA_RESTORE_PATH,'User')";
-  const result = spawnSync('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', script], {
-    encoding: 'utf8', env: { ...process.env, ORCA_RESTORE_PATH: value },
-  });
-  if (result.status !== 0) throw new Error(`Windows 사용자 PATH 복원 실패: ${result.stderr.trim()}`);
-}
-
-function restoreWindowsPathEntry(item, state) {
-  const backup = assertExpectedBackupForItem(item, state);
-  if (!pathExists(backup)) {
-    if (item.action === 'pending-edit') return { action: 'already-restored', conflictBackup: null };
-    throw new Error(`PATH 백업이 없습니다: ${backup}`);
-  }
-  assertBackupContentIntegrity(item, backup, state.manifestVersion);
-  const original = readText(backup).replace(/\r?\n$/, '');
-  const current = state.readUserPath();
-  if (current === original) return { action: 'already-restored', conflictBackup: null };
-  const conflictBackup = path.join(state.conflictRoot, 'windows-user-path.txt');
-  if (state.dryRun) return { action: 'would-restore', conflictBackup };
-  ensureParent(conflictBackup);
-  fs.writeFileSync(conflictBackup, `${current}\n`, { encoding: 'utf8', flag: 'wx' });
-  try {
-    state.writeUserPath(original);
-  } catch (error) {
-    try { state.writeUserPath(current); } catch { /* 원래 PATH 백업은 conflictBackup에 남긴다. */ }
-    throw error;
-  }
-  return { action: 'restored', conflictBackup };
-}
-
-function restoreFilesystemItem(item, state) {
-  const source = assertExpectedBackupForItem(item, state);
-  const target = assertSafeRestorePath(item.path, state.backupRoot, state.home);
-  if (!pathExists(source)) {
-    if (pathExists(target)) return { action: 'already-restored', conflictBackup: null };
-    throw new Error(`복원할 백업이 없습니다: ${source}`);
-  }
-  assertBackupContentIntegrity(item, source, state.manifestVersion);
-  if (pathExists(target) && pathsEquivalent(source, target)) {
-    return { action: 'already-restored', conflictBackup: null };
-  }
-  const conflictContext = { home: state.home, backupRoot: state.conflictRoot };
-  const conflictBackup = pathExists(target)
-    ? quarantine(target, conflictContext, 'current', state.dryRun)
-    : null;
-  if (state.dryRun) return { action: 'would-restore', conflictBackup };
-  try {
-    copyForRestore(source, target);
-  } catch (error) {
-    try {
-      removePartialRestore(target);
-      if (conflictBackup && pathExists(conflictBackup)) copyForRestore(conflictBackup, target);
-    } catch (rollbackError) {
-      throw new Error(`${error.message}; 현재 파일 자동 복귀도 실패했습니다: ${rollbackError.message}`);
-    }
-    throw error;
-  }
-  return { action: 'restored', conflictBackup };
-}
-
-export function restoreOrcaBackup(manifestPath, options = {}) {
-  const resolvedManifest = path.resolve(manifestPath);
-  const manifest = readJson(resolvedManifest);
-  if (!manifest) {
-    throw new Error(`유효한 Orca 정리 manifest가 아닙니다: ${resolvedManifest}`);
-  }
-  const platform = options.platform || process.platform;
-  const backupRoot = validateCleanupManifest(manifest, resolvedManifest, platform);
-  const dryRun = Boolean(options.dryRun);
-  const conflictRoot = path.join(backupRoot, 'restore-conflicts', operationId());
-  const state = {
-    backupRoot,
-    conflictRoot,
-    dryRun,
-    home: path.resolve(options.home || os.homedir()),
-    platform,
-    manifestVersion: manifest.manifestVersion,
-    readUserPath: options.readUserPath || (() => readWindowsUserPath('win32')),
-    writeUserPath: options.writeUserPath || setWindowsUserPath,
-  };
-  const actions = [];
-  const errors = [];
-  const restorable = manifest.actions.filter((item) => [
-    'quarantined', 'edited', 'pending-quarantine', 'pending-edit',
-  ].includes(item.action));
-
-  for (const item of restorable) {
-    const base = {
-      kind: item.kind,
-      path: item.path,
-      backup: item.backup,
-      sourceAction: item.action,
-    };
-    try {
-      const result = item.kind === 'path-entry'
-        ? restoreWindowsPathEntry(item, state)
-        : restoreFilesystemItem(item, state);
-      actions.push({ ...base, ...result });
-    } catch (error) {
-      errors.push({ path: item.path, message: error.message });
-      actions.push({ ...base, action: 'error', error: error.message });
-    }
-  }
-
-  let reportPath = null;
-  if (!dryRun) {
-    reportPath = path.join(backupRoot, `restore-manifest-${operationId()}.json`);
-    fs.writeFileSync(reportPath, `${JSON.stringify({
-      restoreVersion: 1,
-      restoredAt: new Date().toISOString(),
-      sourceManifest: resolvedManifest,
-      conflictRoot: actions.some((item) => item.conflictBackup) ? conflictRoot : null,
-      actions,
-      errors,
-    }, null, 2)}\n`, { encoding: 'utf8', flag: 'wx' });
-  }
-  return {
-    manifestPath: resolvedManifest,
-    manifestVersion: manifest.manifestVersion,
-    cleanupStatus: manifest.cleanupStatus || 'legacy-complete',
-    backupRoot,
-    conflictRoot,
-    reportPath,
-    actions,
-    errors,
-    dryRun,
-  };
-}
-
-export const internals = {
-  CODEX_LEGACY_END,
-  CODEX_LEGACY_START,
-  DSH_END,
-  DSH_START,
-  KIMI_START,
-  KIMI_END,
-  isOrcaHookString,
-  jcodeManagedHookLines,
-  LINUX_CLI_DISPATCHER_MARKER,
-  LINUX_CLI_COMMAND_NAME,
-  hasOrcaSkillSignature,
-  isOrcaCli,
-  operationId,
-  pruneJsonHooks,
-  signedCleanupManifest,
-  stripDelimitedBlock,
-};
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { createHash, randomUUID } from 'node:crypto';
+
+export const OFFICIAL_ORCA_SKILLS = Object.freeze([
+  'computer-use',
+  'jira-tickets',
+  'linear-tickets',
+  'orca-cli',
+  'orca-emulator',
+  'orca-emulator-android',
+  'orca-jira',
+  'orca-linear',
+  'orca-per-workspace-env',
+  'orchestration',
+]);
+
+// Orca src/main/skills/skill-discovery-sources.ts 기준 사용자 홈 스킬 루트.
+export const HOME_SKILL_ROOTS = Object.freeze([
+  '.codex/skills',
+  '.agents/skills',
+  '.claude/skills',
+  '.grok/skills',
+  '.config/opencode/skills',
+  '.pi/agent/skills',
+  '.omp/agent/skills',
+  '.hermes/skills',
+  '.prime/agent/skills',
+  '.gemini/skills',
+  '.gemini/config/skills',
+  '.gemini/antigravity/skills',
+  '.cursor/skills',
+  '.factory/skills',
+  '.continue/skills',
+  '.trae-cn/skills',
+  '.augment/skills',
+  '.config/muse/skills',
+  '.zcode/skills',
+  '.codebuddy/skills',
+  '.kiro/skills',
+  '.openclaude/skills',
+]);
+
+// Orca가 프로젝트에서 추가로 검사하는 스킬 루트.
+export const PROJECT_SKILL_ROOTS = Object.freeze([
+  '.agents/skills',
+  '.claude/skills',
+  '.factory/skills',
+  '.continue/skills',
+  '.trae/skills',
+  '.grok/skills',
+  '.augment/skills',
+  '.codebuddy/skills',
+  '.kiro/skills',
+  '.openclaude/skills',
+]);
+
+const LINUX_CLI_DISPATCHER_MARKER = '# orca-serve-bare-orca-dispatcher';
+const LINUX_CLI_COMMAND_NAME = 'orca-ide';
+const PI_EXTENSION_MARKER = '@orca-managed-pi-extension';
+const PLUGIN_CACHE_MAX_DEPTH = 9;
+const PLUGIN_CACHE_MAX_ENTRIES = 16_384;
+const PLUGIN_CACHE_MAX_CANDIDATES = 64;
+const CODEX_LEGACY_START = '# BEGIN ORCA AGENT STATUS HOOKS';
+const CODEX_LEGACY_END = '# END ORCA AGENT STATUS HOOKS';
+
+const ORCA_SOURCE_PATTERN = /(?:^|[\s/:])stablyai\/orca(?:\.git)?(?:$|[\s/#?])/i;
+const ORCA_SKILL_SIGNATURES = [
+  ORCA_SOURCE_PATTERN,
+  /\bORCA\s+skills\s+get\b/i,
+  /\bEngage\s+Orca\b/i,
+  /Use Orca(?:'s|’s)? computer-use CLI/i,
+];
+const ORCA_HOOK_PATTERN = /(?:[\\/]\.orca(?:-wsl|-relay)?[\\/]agent-hooks[\\/]|ORCA_AGENT_HOOK)/i;
+const MANAGED_FILE_PATTERN = /Managed by Orca\. Do not edit; changes may be overwritten\./i;
+const KIMI_START = '# >>> orca-managed-kimi-hooks (managed by Orca; do not edit) >>>';
+const KIMI_END = '# <<< orca-managed-kimi-hooks <<<';
+// Orca src/main/dsh/dsh-home-patch.ts의 관리 블록 표식.
+const DSH_START = '# >>> orca-managed-dsh-hooks (managed by Orca; do not edit) >>>';
+const DSH_END = '# <<< orca-managed-dsh-hooks <<<';
+// 경로 구분자를 '/'로 정규화한 뒤 검사한다. PowerShell 명령은 '.orca\agent-hooks\'처럼
+// 앞에 구분자 없이 따옴표로 시작하므로 ORCA_HOOK_PATTERN만으로는 놓친다.
+const ORCA_HOOK_PATH_PATTERN = /(?:^|[^A-Za-z0-9_.-])\.orca(?:-wsl|-relay)?\/agent-hooks\//i;
+// Orca src/main/muse/hook-config-json.ts의 MUSE_MANAGED_HOOK_ENV_VARS 중 Orca 전용 이름.
+// USERPROFILE은 사용자가 직접 넣었을 수도 있어 남긴다.
+const MUSE_ORCA_ENV_VARS = new Set([
+  'ORCA_AGENT_HOOK_PORT',
+  'ORCA_AGENT_HOOK_TOKEN',
+  'ORCA_AGENT_HOOK_ENV',
+  'ORCA_AGENT_HOOK_VERSION',
+  'ORCA_AGENT_HOOK_TRANSPORT',
+  'ORCA_AGENT_HOOK_ENDPOINT',
+  'ORCA_PANE_KEY',
+  'ORCA_TAB_ID',
+  'ORCA_WORKTREE_ID',
+  'ORCA_AGENT_LAUNCH_TOKEN',
+]);
+// Orca가 사용자 OpenCode 설정 폴더의 plugins/에 직접 쓰는 상태 플러그인.
+const OPENCODE_PLUGIN_ENTRIES = Object.freeze([
+  'orca-opencode-status.js',
+  'orca-opencode2-status.js',
+  'orca-opencode-status-tui',
+  'orca-opencode2-status-tui',
+  'orca-opencode-startup-prompt',
+]);
+const OPENCODE_PLUGIN_SIGNATURE = /ORCA_OPENCODE_AGENT|ORCA_STATUS_AGENT|["']orca-opencode(?:2-status|-status|-startup-prompt)["']/;
+const OPENCODE_TUI_ENTRY_PATTERN = /[\\/]plugins[\\/](?:orca-opencode2?-status-tui|orca-opencode-startup-prompt)[\\/]tui\.js$/i;
+// ~/.orca 안의 Orca 전용 자격증명. Orca 앱 키로 암호화돼 앱 없이는 쓸 수 없다.
+const ORCA_CREDENTIAL_FILES = Object.freeze([
+  'openai-speech-token.enc',
+  'bitbucket-credential.enc',
+  'bitbucket-credential.json',
+  'linear-token.enc',
+  'linear-workspaces.json',
+  'jira-tokens',
+  'jira-sites.json',
+  'zcode-plan-api-key.enc',
+  'opencode-go-api-key.enc',
+  'minimax-api-key.enc',
+  'minimax-session-cookie.enc',
+]);
+const ORCA_VOICE_MODEL_IDS = new Set([
+  'parakeet-tdt-0.6b-v3-int8',
+  'parakeet-tdt-0.6b-v2-int8',
+  'zipformer-bilingual-zh-en',
+  'paraformer-bilingual-zh-en',
+  'zipformer-streaming-en-20m',
+  'zipformer-streaming-zh-14m',
+  'zipformer-streaming-korean',
+  'parakeet-tdt-ctc-0.6b-ja-int8',
+  'whisper-tiny',
+  'sense-voice-zh-en-ja-ko-yue',
+]);
+
+function unique(values) {
+  return [...new Set(values.filter(Boolean).map((value) => path.resolve(value)))];
+}
+
+function pathExists(target) {
+  try {
+    fs.lstatSync(target);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function readText(target) {
+  try {
+    return fs.readFileSync(target, 'utf8');
+  } catch {
+    return '';
+  }
+}
+
+function readJson(target) {
+  try {
+    return JSON.parse(fs.readFileSync(target, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+// Orca createManagedCommandMatcher와 같은 방식: -EncodedCommand(UTF-16LE base64)를 풀어 함께 본다.
+function hookSearchText(value) {
+  const decoded = [...value.matchAll(/\s-EncodedCommand\s+([A-Za-z0-9+/=]+)/gi)].map((match) => {
+    try {
+      return Buffer.from(match[1], 'base64').toString('utf16le');
+    } catch {
+      return '';
+    }
+  });
+  return [value, ...decoded].join('\n').replace(/[\\/]+/g, '/');
+}
+
+function isOrcaHookString(value) {
+  if (typeof value !== 'string') return false;
+  return ORCA_HOOK_PATTERN.test(value) || ORCA_HOOK_PATH_PATTERN.test(hookSearchText(value));
+}
+
+function defaultHomeSkillRoots(home) {
+  return HOME_SKILL_ROOTS.map((relative) => path.join(home, ...relative.split('/')));
+}
+
+function existingFilesystemIdentity(target) {
+  try {
+    const stat = fs.lstatSync(target);
+    if (stat.isSymbolicLink()) return `link:${path.resolve(target)}`;
+    const real = fs.realpathSync.native(target);
+    return `real:${process.platform === 'win32' ? real.toLowerCase() : real}`;
+  } catch {
+    return `path:${path.resolve(target)}`;
+  }
+}
+
+function environmentSkillRoots(platform, home, env) {
+  const roots = [
+    env.CLAUDE_CONFIG_DIR && path.join(env.CLAUDE_CONFIG_DIR, 'skills'),
+    env.GROK_HOME && path.join(env.GROK_HOME, 'skills'),
+    env.HERMES_HOME && path.join(env.HERMES_HOME, 'skills'),
+    env.KIRO_HOME && path.join(env.KIRO_HOME, 'skills'),
+    env.OPENCLAUDE_CONFIG_DIR && path.join(env.OPENCLAUDE_CONFIG_DIR, 'skills'),
+  ];
+  if (platform === 'win32' && env.LOCALAPPDATA) {
+    roots.push(path.join(env.LOCALAPPDATA, 'hermes', 'skills'));
+  }
+  return unique(roots);
+}
+
+function defaultProjectSkillRoots(projects) {
+  return projects.flatMap((project) => PROJECT_SKILL_ROOTS.map((relative) => path.join(project, ...relative.split('/'))));
+}
+
+function defaultHookCandidates(home, env) {
+  const kimiHome = env.KIMI_CODE_HOME || path.join(home, '.kimi-code');
+  const hermesHomes = unique([
+    env.HERMES_HOME,
+    path.join(home, '.hermes'),
+    env.LOCALAPPDATA && path.join(env.LOCALAPPDATA, 'hermes'),
+  ]);
+  const configHomes = unique([env.XDG_CONFIG_HOME, path.join(home, '.config')]);
+  const codexHomes = unique([env.CODEX_HOME, path.join(home, '.codex')]);
+  const kiroAgentsDir = path.join(env.KIRO_HOME || path.join(home, '.kiro'), 'agents');
+  const candidates = [
+    ['json', path.join(home, '.claude', 'settings.json')],
+    ['json', path.join(home, '.openclaude', 'settings.json')],
+    ...codexHomes.map((codexHome) => ['json', path.join(codexHome, 'hooks.json')]),
+    // Orca가 Claude 형식 설정을 그대로 쓰는 에이전트(src/main/claude/hook-settings.ts).
+    ['json', path.join(home, '.qoder', 'settings.json')],
+    ['json', path.join(home, '.qoder-cn', 'settings.json')],
+    ['json', path.join(home, '.qwen', 'settings.json')],
+    ['json', path.join(home, '.codebuddy', 'settings.json')],
+    ['json', path.join(home, '.zcode', 'cli', 'config.json')],
+    // Kiro는 전역 훅 설정이 없어 Orca가 에이전트 파일마다 훅을 넣는다.
+    ['json-dir', kiroAgentsDir],
+    ['jcode', path.join(env.JCODE_HOME || path.join(home, '.jcode'), 'config.toml')],
+    ['dsh', path.join(env.DSH_HOME || path.join(home, '.dsh'), 'cordis.patch.yml')],
+    ...configHomes.flatMap((configHome) => [
+      ['muse', path.join(configHome, 'muse', 'settings.json')],
+      ['opencode-tui', path.join(configHome, 'opencode', 'tui.json')],
+      ['opencode-tui', path.join(configHome, 'opencode', 'tui.jsonc')],
+      ...OPENCODE_PLUGIN_ENTRIES.map((name) => ['opencode-plugin', path.join(configHome, 'opencode', 'plugins', name)]),
+    ]),
+    ['json', path.join(home, '.gemini', 'settings.json')],
+    ['json', path.join(home, '.gemini', 'config', 'hooks.json')],
+    ['json', path.join(home, '.cursor', 'hooks.json')],
+    ['json', path.join(home, '.commandcode', 'settings.json')],
+    ['json', path.join(home, '.factory', 'settings.json')],
+    // Orca가 통째로 만드는 파일. Orca 항목만 있던 파일은 빈 껍데기를 남기지 않고 격리한다.
+    ['json', path.join(env.COPILOT_HOME || path.join(home, '.copilot'), 'hooks', 'orca.json'), true],
+    ['json', path.join(env.GROK_HOME || path.join(home, '.grok'), 'hooks', 'orca-status.json'), true],
+    ['json', path.join(home, '.config', 'devin', 'config.json')],
+    ['kimi', path.join(kimiHome, 'config.toml')],
+    ['amp', path.join(home, '.config', 'amp', 'plugins', 'orca-agent-status.ts')],
+    ['codex-legacy', path.join(home, '.codex', 'orca-agent-status.config.toml')],
+    ['codex-legacy', path.join(home, '.codex', 'config.toml')],
+  ];
+  for (const hermesHome of hermesHomes) {
+    candidates.push(['hermes', path.join(hermesHome, 'plugins', 'orca-status')]);
+    candidates.push(['hermes-config', path.join(hermesHome, 'config.yaml')]);
+  }
+  if (env.APPDATA) candidates.push(['json', path.join(env.APPDATA, 'Devin', 'config.json')]);
+  return candidates.map(([type, filePath, ownedFile = false]) => ({ type, path: filePath, ownedFile }));
+}
+
+function defaultExtensionCandidates(home) {
+  const files = [
+    ['.pi', 'orca-agent-status.ts'],
+    ['.pi', 'orca-prefill.ts'],
+    ['.pi', 'orca-titlebar-spinner.ts'],
+    ['.omp', 'orca-agent-status.ts'],
+    ['.omp', 'orca-prefill.ts'],
+    ['.omp', 'orca-titlebar-spinner.ts'],
+    ['.prime', 'orca-agent-status.ts'],
+  ];
+  return files.map(([agent, name]) => path.join(home, agent, 'agent', 'extensions', name));
+}
+
+function defaultAppDataCandidates(platform, home, env) {
+  if (platform === 'darwin') {
+    return [
+      path.join(home, 'Library', 'Application Support', 'Orca'),
+      path.join(home, 'Library', 'Application Support', 'orca'),
+      path.join(home, 'Library', 'Caches', 'com.stablyai.orca'),
+      path.join(home, 'Library', 'Caches', 'com.stablyai.orca.ShipIt'),
+      path.join(home, 'Library', 'Caches', 'orca-updater'),
+      path.join(home, 'Library', 'HTTPStorages', 'com.stablyai.orca'),
+      path.join(home, 'Library', 'Preferences', 'com.stablyai.orca.plist'),
+      path.join(home, 'Library', 'Saved Application State', 'com.stablyai.orca.savedState'),
+    ];
+  }
+  if (platform === 'win32') {
+    return [
+      env.APPDATA && path.join(env.APPDATA, 'Orca'),
+      env.LOCALAPPDATA && path.join(env.LOCALAPPDATA, 'Orca'),
+      env.LOCALAPPDATA && path.join(env.LOCALAPPDATA, 'orca-updater'),
+    ].filter(Boolean);
+  }
+  const configHome = env.XDG_CONFIG_HOME || path.join(home, '.config');
+  const cacheHome = env.XDG_CACHE_HOME || path.join(home, '.cache');
+  return unique([
+    path.join(configHome, 'Orca'),
+    path.join(configHome, 'orca'),
+    path.join(cacheHome, 'Orca'),
+    path.join(cacheHome, 'orca', 'appimage'),
+    path.join(cacheHome, 'orca-updater'),
+    path.join(home, '.config', 'Orca'),
+    path.join(home, '.config', 'orca'),
+    path.join(home, '.cache', 'Orca'),
+    path.join(home, '.cache', 'orca', 'appimage'),
+    path.join(home, '.cache', 'orca-updater'),
+  ]);
+}
+
+function pluginCacheOrcaSkills(root) {
+  if (!pathExists(root)) return [];
+  let resolvedRoot;
+  try {
+    resolvedRoot = fs.realpathSync.native(root);
+  } catch {
+    return [];
+  }
+  const candidates = [];
+  const visited = new Set();
+  let entriesSeen = 0;
+
+  function visit(directory, depth) {
+    if (depth > PLUGIN_CACHE_MAX_DEPTH
+        || entriesSeen >= PLUGIN_CACHE_MAX_ENTRIES
+        || candidates.length >= PLUGIN_CACHE_MAX_CANDIDATES) return;
+    let resolved;
+    let entries;
+    try {
+      resolved = fs.realpathSync.native(directory);
+      if (!isSameOrDescendant(resolvedRoot, resolved) || visited.has(resolved)) return;
+      visited.add(resolved);
+      entries = fs.readdirSync(directory, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    entriesSeen += entries.length;
+    if (entriesSeen > PLUGIN_CACHE_MAX_ENTRIES) return;
+
+    if (path.basename(directory) === 'skills') {
+      for (const name of OFFICIAL_ORCA_SKILLS) {
+        const candidate = path.join(directory, name);
+        if (pathExists(candidate) && hasOrcaSkillSignature(candidate)) candidates.push(candidate);
+        if (candidates.length >= PLUGIN_CACHE_MAX_CANDIDATES) return;
+      }
+    }
+    for (const entry of entries) {
+      if (entry.name === 'node_modules' || entry.isSymbolicLink() || !entry.isDirectory()) continue;
+      visit(path.join(directory, entry.name), depth + 1);
+    }
+  }
+
+  visit(resolvedRoot, 0);
+  return unique(candidates);
+}
+
+function defaultVoiceCandidates(platform, env) {
+  if (platform !== 'win32') return [];
+  const roots = [
+    env.PROGRAMDATA,
+    env.ProgramData,
+    env.ALLUSERSPROFILE,
+    env.PUBLIC && path.join(env.PUBLIC, 'Documents'),
+    env.PUBLIC,
+    env.SystemDrive && path.join(env.SystemDrive, 'ProgramData'),
+    'C:\\ProgramData',
+  ];
+  return unique(roots.map((root) => root && path.join(root, 'Orca', 'speech-models')));
+}
+
+function readWindowsUserPath(platform) {
+  if (platform !== 'win32' || process.platform !== 'win32') return '';
+  const script = "[Console]::OutputEncoding=[Text.UTF8Encoding]::new(); [Environment]::GetEnvironmentVariable('Path','User')";
+  const result = spawnSync('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', script], { encoding: 'utf8' });
+  return result.status === 0 ? result.stdout.trim() : '';
+}
+
+function decodeProcessOutput(value) {
+  if (!value) return '';
+  const buffer = Buffer.isBuffer(value) ? value : Buffer.from(value);
+  const hasNul = buffer.subarray(0, Math.min(buffer.length, 256)).includes(0);
+  return buffer.toString(hasNul ? 'utf16le' : 'utf8').replace(/^\uFEFF/, '');
+}
+
+function discoverRunningWslHomes(platform) {
+  if (platform !== 'win32' || process.platform !== 'win32') return [];
+  try {
+    const listed = spawnSync('wsl.exe', ['--list', '--running', '--quiet'], {
+      windowsHide: true,
+      timeout: 8000,
+    });
+    if (listed.status !== 0) return [];
+    const distros = decodeProcessOutput(listed.stdout).split(/\r?\n/).map((value) => value.trim()).filter(Boolean);
+    const homes = [];
+    for (const distro of distros) {
+      const probed = spawnSync('wsl.exe', ['-d', distro, '--', 'sh', '-lc', 'printf %s "$HOME"'], {
+        windowsHide: true,
+        timeout: 8000,
+      });
+      const linuxHome = decodeProcessOutput(probed.stdout).trim();
+      if (probed.status !== 0 || !/^\/(?:[^\0\\]+)$/.test(linuxHome) || linuxHome.includes('..')) continue;
+      const relative = linuxHome.replace(/^\/+/, '').split('/');
+      homes.push(path.join(`\\\\wsl.localhost\\${distro}`, ...relative));
+    }
+    return unique(homes);
+  } catch {
+    return [];
+  }
+}
+
+// Orca가 아직 설치돼 있거나 실행 중이면 앱이 켜질 때 훅·플러그인을 다시 설치하고,
+// 쓰던 자격증명을 격리하면 앱이 망가진다. 정리 전에 이 상태를 확인한다.
+function runPowerShellJson(script) {
+  const result = spawnSync('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command',
+    `[Console]::OutputEncoding=[Text.UTF8Encoding]::new(); ${script}`], {
+    encoding: 'utf8', windowsHide: true, timeout: 20000,
+  });
+  if (result.status !== 0 || !result.stdout.trim()) return [];
+  try {
+    const value = JSON.parse(result.stdout);
+    return Array.isArray(value) ? value : [value];
+  } catch {
+    return [];
+  }
+}
+
+function listRunningProcesses(platform) {
+  if (platform === 'win32') {
+    return runPowerShellJson('Get-CimInstance Win32_Process | Select-Object ProcessId,Name,ExecutablePath | ConvertTo-Json -Compress')
+      .map((item) => ({ pid: item.ProcessId, name: item.Name || '', path: item.ExecutablePath || '' }));
+  }
+  if (platform === 'linux') {
+    return listMatchingChildren('/proc', /^\d+$/).map((entry) => {
+      const pid = Number(path.basename(entry));
+      try {
+        const exe = fs.readlinkSync(path.join(entry, 'exe'));
+        return { pid, name: path.basename(exe), path: exe };
+      } catch {
+        return null;
+      }
+    }).filter(Boolean);
+  }
+  const result = spawnSync('ps', ['-axo', 'pid=,comm='], { encoding: 'utf8', timeout: 10000 });
+  if (result.status !== 0) return [];
+  return result.stdout.split('\n').map((line) => line.match(/^\s*(\d+)\s+(.+?)\s*$/)).filter(Boolean)
+    .map((match) => ({ pid: Number(match[1]), name: path.basename(match[2]), path: match[2] }));
+}
+
+function listOrcaInstallations(platform, home, env) {
+  if (platform === 'win32') {
+    const fixed = [
+      env.LOCALAPPDATA && path.join(env.LOCALAPPDATA, 'Programs', 'orca'),
+      env.ProgramFiles && path.join(env.ProgramFiles, 'Orca'),
+      env.PROGRAMFILES && path.join(env.PROGRAMFILES, 'Orca'),
+    ].filter((dir) => dir && pathExists(path.join(dir, 'Orca.exe')));
+    // electron-builder NSIS 제거 정보. 사용자가 다른 폴더(/D)에 설치했어도 여기서 찾는다.
+    const registered = runPowerShellJson([
+      "$keys = 'HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*',",
+      "'HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*',",
+      "'HKLM:\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*';",
+      "Get-ItemProperty $keys -ErrorAction SilentlyContinue | Where-Object { $_.DisplayName -eq 'Orca' -and $_.UninstallString -match 'Uninstall Orca\\.exe' } |",
+      'Select-Object InstallLocation,UninstallString | ConvertTo-Json -Compress',
+    ].join(' ')).map((item) => item.InstallLocation || path.dirname(String(item.UninstallString || '').replace(/^"|"(?:\s.*)?$/g, '')));
+    return unique([...fixed, ...registered.filter(Boolean)]);
+  }
+  if (platform === 'darwin') {
+    return ['/Applications/Orca.app', path.join(home, 'Applications', 'Orca.app')]
+      .filter((app) => readText(path.join(app, 'Contents', 'Info.plist')).includes('com.stablyai.orca'));
+  }
+  return [];
+}
+
+function probeRuntime(platform, home, env) {
+  return { installations: listOrcaInstallations(platform, home, env), processes: listRunningProcesses(platform) };
+}
+
+// 설치 폴더 안의 프로세스는 앱 본체, 앱 데이터 아래(daemon-host 등)로 옮겨 돌던 프로세스는 남은 데몬이다.
+function classifyOrcaProcesses(context) {
+  const runtime = context.runtime || { installations: [], processes: [] };
+  const installDirs = unique([
+    ...runtime.installations,
+    ...(context.platform === 'win32' && context.env.LOCALAPPDATA ? [path.join(context.env.LOCALAPPDATA, 'Programs', 'orca')] : []),
+    ...(context.platform === 'darwin' ? ['/Applications/Orca.app', path.join(context.home, 'Applications', 'Orca.app')] : []),
+  ]);
+  const dataDirs = unique(defaultAppDataCandidates(context.platform, context.home, context.env));
+  const inside = (dirs, target) => dirs.some((dir) => isSameOrDescendant(dir, target)
+    || (context.platform !== 'linux' && isSameOrDescendant(dir.toLowerCase(), target.toLowerCase())));
+  const app = [];
+  const leftover = [];
+  for (const item of runtime.processes) {
+    if (!item?.path || item.pid === process.pid) continue;
+    const target = path.resolve(item.path);
+    const appImage = context.platform === 'linux' && /^\/tmp\/\.mount_orca/i.test(item.path);
+    if (inside(installDirs, target) || appImage) app.push(item);
+    else if (inside(dataDirs, target) || /^orca-terminal-daemon(?:\.exe)?$/i.test(item.name)) leftover.push(item);
+  }
+  return { installations: runtime.installations, app, leftover };
+}
+
+function stopProcess(pid, platform) {
+  if (platform === 'win32') {
+    const result = spawnSync('taskkill.exe', ['/PID', String(pid), '/T', '/F'], { encoding: 'utf8', windowsHide: true });
+    if (result.status !== 0) throw new Error(`프로세스를 끄지 못했습니다(PID ${pid}): ${(result.stderr || result.stdout).trim()}`);
+    return;
+  }
+  process.kill(pid, 'SIGTERM');
+}
+
+function isWindowsOrcaPathEntry(entry, context) {
+  if (context.platform !== 'win32') return false;
+  const expanded = entry.replace(/%([^%]+)%/g, (_, name) => context.env[name] || context.env[name.toUpperCase()] || `%${name}%`);
+  const candidate = path.normalize(expanded.replace(/^"|"$/g, '')).replace(/[\\/]+$/, '');
+  const normalized = candidate.toLowerCase();
+  const expected = context.env.LOCALAPPDATA
+    ? path.normalize(path.join(context.env.LOCALAPPDATA, 'Programs', 'orca', 'resources', 'bin')).toLowerCase()
+    : '';
+  if (expected && normalized === expected) return true;
+  const wrapper = path.join(candidate, 'orca.cmd');
+  const launcher = path.join(candidate, 'orca.exe');
+  const wrapperText = readText(wrapper);
+  return pathExists(launcher)
+    && /native Orca CLI launcher/i.test(wrapperText)
+    && /orca\.cmd cannot safely forward orchestration message bodies/i.test(wrapperText);
+}
+
+export function buildContext(overrides = {}) {
+  const platform = overrides.platform || process.platform;
+  const home = path.resolve(overrides.home || os.homedir());
+  const env = { ...process.env, ...(overrides.env || {}) };
+  const projects = unique(overrides.projects || []);
+  const explicitWslHomes = unique(overrides.wslHomes || []);
+  const wslHomes = unique([
+    ...explicitWslHomes,
+    ...(overrides.includeWsl && explicitWslHomes.length === 0 ? discoverRunningWslHomes(platform) : []),
+  ]);
+  const remoteHomes = unique(overrides.remoteHomes || []);
+  const scopedHomes = [
+    ...wslHomes.map((scopedHome) => ({ home: scopedHome, requires: 'includeWsl' })),
+    ...remoteHomes.map((scopedHome) => ({ home: scopedHome, requires: 'includeRemote' })),
+  ];
+  const homeSkillRoots = overrides.homeSkillRoots || unique([
+    ...defaultHomeSkillRoots(home),
+    ...environmentSkillRoots(platform, home, env),
+  ]);
+  const projectSkillRoots = defaultProjectSkillRoots(projects);
+  const scopedSkillRoots = scopedHomes.flatMap((scope) => defaultHomeSkillRoots(scope.home)
+    .map((root) => ({ root, requires: scope.requires })));
+  const skillRootRequirements = new Map(scopedSkillRoots.map((item) => [path.resolve(item.root), item.requires]));
+  const lockFiles = overrides.lockFiles || unique([
+    path.join(home, '.agents', '.skill-lock.json'),
+    ...projects.map((project) => path.join(project, '.agents', '.skill-lock.json')),
+    ...scopedHomes.map((scope) => path.join(scope.home, '.agents', '.skill-lock.json')),
+  ]);
+  const lockFileRequirements = new Map(scopedHomes.map((scope) => [
+    path.resolve(path.join(scope.home, '.agents', '.skill-lock.json')),
+    scope.requires,
+  ]));
+  const hookCandidates = [
+    ...defaultHookCandidates(home, env),
+    ...scopedHomes.flatMap((scope) => defaultHookCandidates(scope.home, {})
+      .map((candidate) => ({ ...candidate, requires: scope.requires }))),
+  ];
+  const extensionCandidates = [
+    ...defaultExtensionCandidates(home).map((target) => ({ path: target, requires: null })),
+    ...scopedHomes.flatMap((scope) => defaultExtensionCandidates(scope.home)
+      .map((target) => ({ path: target, requires: scope.requires }))),
+  ];
+  const grokHome = env.GROK_HOME || path.join(home, '.grok');
+
+  return {
+    platform,
+    home,
+    env,
+    projects,
+    wslHomes,
+    remoteHomes,
+    skillRoots: unique([...homeSkillRoots, ...projectSkillRoots, ...scopedSkillRoots.map((item) => item.root)]),
+    pluginCacheRoots: unique(overrides.pluginCacheRoots || [path.join(home, '.codex', 'plugins', 'cache')]),
+    skillRootRequirements,
+    lockFiles,
+    lockFileRequirements,
+    hookCandidates: overrides.hookCandidates || hookCandidates,
+    extensionCandidates: overrides.extensionCandidates || extensionCandidates,
+    filesystemIdentity: overrides.filesystemIdentity || existingFilesystemIdentity,
+    sharedStateCandidates: unique(overrides.sharedStateCandidates || [
+      path.join(home, '.orca', 'agent-hooks'),
+      path.join(home, '.orca', 'claude-agent-teams-bin'),
+      path.join(home, '.orca', 'managed-hook-install.lock'),
+      ...ORCA_CREDENTIAL_FILES.map((name) => path.join(home, '.orca', name)),
+      path.join(grokHome, 'hooks', 'orca-status.json.orca-cleaned-symlink'),
+    ]),
+    conditionalStateCandidates: overrides.conditionalStateCandidates || [
+      ...projects.flatMap((project) => [
+        { kind: 'project-state', path: path.join(project, '.orca'), requires: 'includeProjectState', reason: '프로젝트 Orca issue-command·drop 상태' },
+        { kind: 'project-state', path: path.join(path.dirname(project), '.orca-worktree-trash'), requires: 'includeProjectState', reason: '프로젝트 인접 Orca worktree 휴지통' },
+      ]),
+      ...wslHomes.flatMap((scopedHome) => [
+        { kind: 'wsl-state', path: path.join(scopedHome, '.orca-wsl'), requires: 'includeWsl', reason: 'WSL Orca 릴레이·훅 상태' },
+        { kind: 'wsl-state', path: path.join(scopedHome, '.local', 'share', 'orca'), requires: 'includeWsl', reason: 'WSL Orca 브리지·관리형 계정 상태' },
+      ]),
+      ...unique([home, ...remoteHomes]).flatMap((scopedHome) => [
+        { kind: 'remote-state', path: path.join(scopedHome, '.orca-remote'), requires: 'includeRemote', reason: 'SSH Orca 버전별 릴레이·업로드 상태' },
+        { kind: 'remote-state', path: path.join(scopedHome, '.orca-relay'), requires: 'includeRemote', reason: 'SSH Orca CLI·훅 오버레이' },
+        { kind: 'remote-state', path: path.join(scopedHome, '.orca', 'sessions'), requires: 'includeRemote', reason: '원격 Orca 세션 상태' },
+        { kind: 'remote-state', path: path.join(scopedHome, '.orca', 'skill-installs'), requires: 'includeRemote', reason: '원격 Orca Skills 설치 상태' },
+      ]),
+      ...remoteHomes.map((scopedHome) => (
+        { kind: 'remote-state', path: path.join(scopedHome, '.orca', 'agent-hooks'), requires: 'includeRemote', reason: '원격 Orca 관리형 에이전트 훅' }
+      )),
+    ],
+    userStateCandidates: unique(overrides.userStateCandidates || [path.join(home, '.orca')]),
+    appDataCandidates: unique(overrides.appDataCandidates || defaultAppDataCandidates(platform, home, env)),
+    voiceCandidates: unique([...(overrides.voiceCandidates || defaultVoiceCandidates(platform, env)), ...(overrides.customVoicePaths || [])]),
+    customVoicePaths: unique(overrides.customVoicePaths || []),
+    cliCandidates: unique(overrides.cliCandidates || defaultCliCandidates(platform, home)),
+    conditionalCliCandidates: overrides.conditionalCliCandidates || [
+      ...wslHomes.flatMap((scopedHome) => defaultCliCandidates('linux', scopedHome)
+        .map((target) => ({ path: target, requires: 'includeWsl' }))),
+      ...remoteHomes.flatMap((scopedHome) => defaultCliCandidates('linux', scopedHome)
+        .map((target) => ({ path: target, requires: 'includeRemote' }))),
+    ],
+    userPath: overrides.userPath ?? readWindowsUserPath(platform),
+    // 실제 사용자 홈을 검사할 때만 이 PC의 설치·프로세스 상태를 읽는다(임시 홈을 쓰는 테스트는 제외).
+    runtime: overrides.runtime || (platform === process.platform && home === path.resolve(os.homedir())
+      ? probeRuntime(platform, home, env)
+      : { installations: [], processes: [] }),
+    stopProcess: overrides.stopProcess || ((pid) => stopProcess(pid, platform)),
+    backupRoot: path.resolve(overrides.backupRoot || path.join(home, 'OrcaAgentCleanupBackups', timestamp())),
+  };
+}
+
+function timestamp() {
+  const time = new Date().toISOString().replace(/[-:]/g, '').replace(/T/, '-').replace(/\..+/, '');
+  return `${time}-${randomUUID()}`;
+}
+
+function operationId(now = new Date(), uuid = randomUUID()) {
+  return `${now.toISOString().replace(/[-:]/g, '').replace(/T/, '-').replace(/Z$/, '').replace('.', '-')}-${process.pid}-${uuid}`;
+}
+
+function cleanupManifestPayload(manifest) {
+  return {
+    manifestVersion: manifest.manifestVersion,
+    createdAt: manifest.createdAt,
+    platform: manifest.platform,
+    backupRoot: manifest.backupRoot,
+    cleanupStatus: manifest.cleanupStatus,
+    actions: manifest.actions,
+    errors: manifest.errors,
+  };
+}
+
+function cleanupManifestDigest(manifest) {
+  return createHash('sha256').update(JSON.stringify(cleanupManifestPayload(manifest))).digest('hex');
+}
+
+function signedCleanupManifest(value) {
+  return {
+    ...value,
+    integrity: { algorithm: 'sha256', digest: cleanupManifestDigest(value) },
+  };
+}
+
+function updateDigestField(hash, value) {
+  const bytes = Buffer.from(String(value), 'utf8');
+  hash.update(`${bytes.length}:`);
+  hash.update(bytes);
+}
+
+function updateDigestForPath(hash, target, relative = '.') {
+  const stat = fs.lstatSync(target);
+  if (stat.isSymbolicLink()) {
+    updateDigestField(hash, 'link');
+    updateDigestField(hash, relative);
+    updateDigestField(hash, fs.readlinkSync(target));
+    return;
+  }
+  if (stat.isDirectory()) {
+    updateDigestField(hash, 'directory');
+    updateDigestField(hash, relative);
+    for (const name of fs.readdirSync(target).sort()) {
+      updateDigestForPath(hash, path.join(target, name), path.join(relative, name));
+    }
+    return;
+  }
+  if (!stat.isFile()) throw new Error(`지원하지 않는 백업 파일 형식입니다: ${target}`);
+  updateDigestField(hash, 'file');
+  updateDigestField(hash, relative);
+  updateDigestField(hash, stat.size);
+  const handle = fs.openSync(target, 'r');
+  const buffer = Buffer.allocUnsafe(1024 * 1024);
+  try {
+    for (;;) {
+      const bytesRead = fs.readSync(handle, buffer, 0, buffer.length, null);
+      if (bytesRead === 0) break;
+      hash.update(buffer.subarray(0, bytesRead));
+    }
+  } finally {
+    fs.closeSync(handle);
+  }
+}
+
+function pathIntegrity(target) {
+  const hash = createHash('sha256');
+  updateDigestForPath(hash, target);
+  return { algorithm: 'sha256', digest: hash.digest('hex') };
+}
+
+function integrityMatches(target, integrity) {
+  return integrity?.algorithm === 'sha256'
+    && /^[a-f0-9]{64}$/u.test(integrity.digest || '')
+    && pathIntegrity(target).digest === integrity.digest;
+}
+
+function entriesFromLock(lock) {
+  if (!lock || typeof lock !== 'object') return [];
+  const containers = [lock.skills, lock.installed, lock.dependencies, lock];
+  const result = [];
+  for (const container of containers) {
+    if (!container || typeof container !== 'object' || Array.isArray(container)) continue;
+    for (const [name, value] of Object.entries(container)) {
+      if (name === 'skills' || name === 'installed' || name === 'dependencies') continue;
+      const details = typeof value === 'string' ? { source: value } : (value || {});
+      const source = [details.source, details.sourceUrl, details.repository, details.repo, details.url]
+        .filter(Boolean).join(' ');
+      result.push({ name, source });
+    }
+  }
+  return result;
+}
+
+function lockedOrcaSkillNamesByRoot(context) {
+  const namesByRoot = new Map();
+  for (const lockFile of context.lockFiles) {
+    const skillRoot = path.resolve(path.dirname(lockFile), 'skills');
+    const names = namesByRoot.get(skillRoot) || new Set();
+    for (const entry of entriesFromLock(readJson(lockFile))) {
+      if (ORCA_SOURCE_PATTERN.test(entry.source)) names.add(entry.name);
+    }
+    namesByRoot.set(skillRoot, names);
+  }
+  return namesByRoot;
+}
+
+function hasOrcaSkillSignature(skillPath) {
+  const text = [
+    readText(path.join(skillPath, 'SKILL.md')),
+    readText(path.join(skillPath, 'README.md')),
+    readText(path.join(skillPath, 'package.json')),
+  ].join('\n');
+  return ORCA_SKILL_SIGNATURES.some((pattern) => pattern.test(text));
+}
+
+function defaultCliCandidates(platform, home) {
+  if (platform === 'darwin') {
+    return ['/usr/local/bin/orca', path.join(home, '.local', 'bin', 'orca')];
+  }
+  if (platform === 'linux') {
+    // Linux 공식 명령은 orca-ide다. /usr/bin/orca는 GNOME 스크린 리더라 건드리지 않는다.
+    return [
+      path.join(home, '.local', 'bin', LINUX_CLI_COMMAND_NAME),
+      path.join(home, '.local', 'bin', 'orca'),
+    ];
+  }
+  return [];
+}
+
+function isOrcaCli(candidate) {
+  if (!pathExists(candidate)) return false;
+  let linkTarget = '';
+  try {
+    const stat = fs.lstatSync(candidate);
+    if (stat.isSymbolicLink()) linkTarget = fs.readlinkSync(candidate);
+  } catch {
+    return false;
+  }
+  const text = readText(candidate);
+  const haystack = `${linkTarget}\n${text}`;
+  if (/Orca\.app[\\/]Contents[\\/]Resources[\\/]bin/i.test(haystack)) return true;
+  if (haystack.includes(LINUX_CLI_DISPATCHER_MARKER)) return true;
+  if (/stablyai\/orca|Managed by Orca/i.test(haystack)) return true;
+  if (/[\\/]resources[\\/]bin[\\/]orca-ide(?:\.exe)?$/i.test(linkTarget)) return true;
+  return false;
+}
+
+function stripDelimitedBlock(content, startMarker, endMarker) {
+  const start = content.indexOf(startMarker);
+  if (start < 0) return content;
+  const endMarkerIndex = content.indexOf(endMarker, start + startMarker.length);
+  const end = endMarkerIndex < 0 ? content.length : endMarkerIndex + endMarker.length;
+  const before = content.slice(0, start).replace(/[ \t]*(?:\r?\n)*$/, '');
+  const after = content.slice(end).replace(/^(?:\r?\n)+/, '');
+  if (!before) return after;
+  if (!after) return before.endsWith('\n') ? before : `${before}\n`;
+  return `${before}\n\n${after}`;
+}
+
+function splitLinesWithEol(text) {
+  return { lines: text.split('\n').map((line) => line.replace(/\r$/, '')), eol: text.includes('\r\n') ? '\r\n' : '\n' };
+}
+
+function parseTomlSingleLineString(valueText) {
+  const literal = valueText.match(/^'([^']*)'\s*(?:#.*)?$/);
+  if (literal) return literal[1];
+  const basic = valueText.match(/^"((?:[^"\\]|\\.)*)"\s*(?:#.*)?$/);
+  if (!basic) return null;
+  const escapes = { b: '\b', t: '\t', n: '\n', f: '\f', r: '\r', '"': '"', '\\': '\\' };
+  return basic[1].replace(/\\(u[0-9a-fA-F]{4}|U[0-9a-fA-F]{8}|.)/g, (_, escape) => (
+    escape.length > 1 ? String.fromCodePoint(Number.parseInt(escape.slice(1), 16)) : (escapes[escape] ?? escape)
+  ));
+}
+
+// jcode ~/.jcode/config.toml의 [hooks] 표에서 Orca 스크립트를 부르는 줄 번호(src/main/jcode/hook-config.ts).
+function jcodeManagedHookLines(text) {
+  const { lines } = splitLinesWithEol(text);
+  const managed = new Set();
+  let inHooks = false;
+  let multiline = null;
+  lines.forEach((line, index) => {
+    if (multiline) {
+      if (line.includes(multiline)) multiline = null;
+      return;
+    }
+    if (/^\s*\[\[/.test(line)) {
+      inHooks = false;
+      return;
+    }
+    const header = line.match(/^\s*\[\s*([^[\]]+?)\s*\]\s*(?:#.*)?$/);
+    if (header) {
+      inHooks = header[1] === 'hooks';
+      return;
+    }
+    const pair = line.match(/^\s*[A-Za-z0-9_-]+\s*=\s*(.*)$/);
+    if (!pair) return;
+    const opener = ['"""', "'''"].find((quote) => pair[1].startsWith(quote));
+    if (opener) {
+      if (pair[1].indexOf(opener, opener.length) < 0) multiline = opener;
+      return;
+    }
+    if (inHooks && isOrcaHookString(parseTomlSingleLineString(pair[1]))) managed.add(index);
+  });
+  return managed;
+}
+
+// dsh-home-patch.ts와 같이 가장 가까운 시작 표식과 그 뒤 첫 끝 표식을 짝짓는다.
+function dshManagedRegion(lines) {
+  let start = -1;
+  for (const [index, line] of lines.entries()) {
+    if (line.trim() === DSH_START) start = index;
+    else if (line.trim() === DSH_END && start !== -1) return { start, end: index };
+  }
+  return null;
+}
+
+function isOrcaOpenCodeTuiEntry(item) {
+  const raw = Array.isArray(item) ? item[0] : item;
+  if (typeof raw !== 'string') return false;
+  let decoded = raw;
+  try {
+    decoded = decodeURIComponent(raw);
+  } catch {
+    // 잘못된 퍼센트 인코딩이면 원문으로 판단한다.
+  }
+  return OPENCODE_TUI_ENTRY_PATTERN.test(decoded);
+}
+
+function hasOpenCodePluginSignature(target) {
+  try {
+    const file = fs.lstatSync(target).isDirectory() ? path.join(target, 'tui.js') : target;
+    return OPENCODE_PLUGIN_SIGNATURE.test(readText(file));
+  } catch {
+    return false;
+  }
+}
+
+// Orca grok-hook-config-cleanup.ts의 isOrcaOwnedRemnant와 같은 기준: Orca 항목을 빼면 hooks가 비고
+// version 말고 남는 키가 없다. 사용자가 dotfiles로 연결한 심볼릭 링크는 파일을 지우지 않고 고친다.
+function isOrcaOwnedRemnant(target) {
+  try {
+    if (fs.lstatSync(target).isSymbolicLink()) return false;
+  } catch {
+    return false;
+  }
+  const value = readJson(target);
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return false;
+  return Object.keys(pruneJsonHooks(value)).every((key) => key === 'version');
+}
+
+function hasHookMarker(candidate) {
+  if (!pathExists(candidate.path)) return false;
+  if (candidate.type === 'hermes') {
+    const markerFiles = ['plugin.json', 'README.md', '__init__.py', 'orca-status.py'];
+    return markerFiles.some((name) => {
+      const text = readText(path.join(candidate.path, name));
+      return MANAGED_FILE_PATTERN.test(text) || ORCA_HOOK_PATTERN.test(text);
+    });
+  }
+  if (candidate.type === 'opencode-plugin') return hasOpenCodePluginSignature(candidate.path);
+  const text = readText(candidate.path);
+  if (candidate.type === 'kimi') return text.includes(KIMI_START) && text.includes(KIMI_END);
+  if (candidate.type === 'dsh') return dshManagedRegion(splitLinesWithEol(text).lines) !== null;
+  if (candidate.type === 'jcode') return jcodeManagedHookLines(text).size > 0;
+  if (candidate.type === 'muse') return isOrcaHookString(readJson(candidate.path)?.managed_hooks_path);
+  if (candidate.type === 'opencode-tui') {
+    const plugins = readJson(candidate.path)?.plugin;
+    // 주석이 있는 JSONC는 해석하지 못하지만 Orca 항목이 보이면 알린다. 수정 단계에서 오류로 멈춘다.
+    return Array.isArray(plugins)
+      ? plugins.some(isOrcaOpenCodeTuiEntry)
+      : /plugins[\\/]+(?:orca-opencode2?-status-tui|orca-opencode-startup-prompt)[\\/]+tui\.js/i.test(text);
+  }
+  if (candidate.type === 'codex-legacy') return text.includes(CODEX_LEGACY_START);
+  if (candidate.type === 'amp') return MANAGED_FILE_PATTERN.test(text);
+  if (candidate.type === 'hermes-config') return /^\s*-\s*orca-status\s*$/m.test(text);
+  return isOrcaHookString(text) || MANAGED_FILE_PATTERN.test(text);
+}
+
+function hasManagedExtensionMarker(target) {
+  return pathExists(target) && readText(target).includes(PI_EXTENSION_MARKER);
+}
+
+function listMatchingChildren(directory, pattern) {
+  try {
+    return fs.readdirSync(directory, { withFileTypes: true })
+      .filter((entry) => pattern.test(entry.name))
+      .map((entry) => path.join(directory, entry.name));
+  } catch {
+    return [];
+  }
+}
+
+function managedHookLockResidues(home) {
+  return listMatchingChildren(path.join(home, '.orca'),
+    /^managed-hook-install\.(?:owner(?:-draft)?|claimed|claim)-.+\.json$/u);
+}
+
+function managedSkillTransactionResidues(root) {
+  return listMatchingChildren(root,
+    /^(?:\.orca-skill-extract-.+|\..+\.orca-(?:staging|backup|copy|skill-delete|remove-backup|placement-backup|placement-staging)-.+)$/u);
+}
+
+function hasOrcaVoiceModelSignature(target) {
+  const containsKnownModel = (directory) => {
+    try {
+      return fs.readdirSync(directory, { withFileTypes: true }).some((entry) => {
+        const normalized = entry.name.replace(/(?:\.partial|\.tar\.bz2)$/i, '');
+        return ORCA_VOICE_MODEL_IDS.has(normalized);
+      });
+    } catch {
+      return false;
+    }
+  };
+  if (containsKnownModel(target)) return true;
+  try {
+    return fs.readdirSync(target, { withFileTypes: true })
+      .filter((entry) => entry.isDirectory() && /^[a-f0-9]{16}$/i.test(entry.name))
+      .some((entry) => containsKnownModel(path.join(target, entry.name)));
+  } catch {
+    return false;
+  }
+}
+
+function finding(kind, target, reason, requires = null, meta = {}) {
+  return { kind, path: path.resolve(target), reason, requires, ...meta };
+}
+
+export function scanOrcaResidue(context) {
+  const findings = [];
+  const runtime = classifyOrcaProcesses(context);
+  for (const target of runtime.installations) {
+    findings.push(finding('app-installed', target, 'Orca 앱이 아직 설치돼 있습니다. 운영체제의 제거 기능으로 먼저 지우세요', 'never'));
+  }
+  for (const item of runtime.app) {
+    findings.push(finding('app-running', item.path, `Orca 앱이 실행 중입니다(PID ${item.pid}). 앱을 끄고 제거한 뒤 정리하세요`, 'never', { pid: item.pid }));
+  }
+  for (const item of runtime.leftover) {
+    findings.push(finding('process', item.path, `앱 없이 남아 돌고 있는 Orca 백그라운드 프로세스(PID ${item.pid})`, 'stopProcesses', { pid: item.pid }));
+  }
+  const lockedNamesByRoot = lockedOrcaSkillNamesByRoot(context);
+
+  for (const root of context.skillRoots) {
+    const requirement = context.skillRootRequirements?.get(path.resolve(root)) || null;
+    const lockedNames = lockedNamesByRoot.get(path.resolve(root)) || new Set();
+    for (const name of OFFICIAL_ORCA_SKILLS) {
+      const skillPath = path.join(root, name);
+      if (!pathExists(skillPath)) continue;
+      const isAgentsSkillRoot = path.basename(root) === 'skills' && path.basename(path.dirname(root)) === '.agents';
+      if ((isAgentsSkillRoot && lockedNames.has(name)) || hasOrcaSkillSignature(skillPath)) {
+        findings.push(finding('skill', skillPath, `Orca 공식 스킬(${name}) 출처 확인`, requirement));
+      }
+    }
+    for (const target of managedSkillTransactionResidues(root)) {
+      findings.push(finding('skill-transaction', target, '중단된 Orca Skills 설치·삭제 트랜잭션', requirement));
+    }
+  }
+
+  for (const root of context.pluginCacheRoots || []) {
+    for (const skillPath of pluginCacheOrcaSkills(root)) {
+      findings.push(finding('skill', skillPath, 'Codex 플러그인 캐시의 Orca 공식 스킬 출처 확인'));
+    }
+  }
+
+  for (const lockFile of context.lockFiles) {
+    const entries = entriesFromLock(readJson(lockFile)).filter((entry) => ORCA_SOURCE_PATTERN.test(entry.source));
+    if (entries.length) {
+      const requirement = context.lockFileRequirements?.get(path.resolve(lockFile)) || null;
+      findings.push(finding('skill-lock', lockFile, 'stablyai/orca 잠금 항목', requirement, { names: entries.map((entry) => entry.name) }));
+    }
+  }
+
+  const hookCandidates = context.hookCandidates.flatMap((candidate) => (candidate.type === 'json-dir'
+    ? listMatchingChildren(candidate.path, /\.json$/i).map((file) => ({ ...candidate, type: 'json', path: file }))
+    : [candidate]));
+  for (const candidate of hookCandidates) {
+    if (candidate.type === 'hermes-config') {
+      const plugin = context.hookCandidates.find((item) => item.type === 'hermes'
+        && path.dirname(path.dirname(item.path)) === path.dirname(candidate.path));
+      if (!plugin || !hasHookMarker(plugin)) continue;
+    }
+    if (hasHookMarker(candidate)) {
+      const removeWhole = (candidate.type === 'codex-legacy'
+        && stripDelimitedBlock(readText(candidate.path), CODEX_LEGACY_START, CODEX_LEGACY_END).trim() === '')
+        || (candidate.ownedFile && isOrcaOwnedRemnant(candidate.path));
+      findings.push(finding('hook', candidate.path, `Orca 관리형 ${candidate.type} 훅`, candidate.requires || null,
+        { hookType: candidate.type, removeWhole }));
+    }
+  }
+
+  for (const candidate of context.extensionCandidates || []) {
+    if (hasManagedExtensionMarker(candidate.path)) {
+      findings.push(finding('extension', candidate.path, 'Orca 관리형 Pi·OMP·Prime 확장', candidate.requires || null));
+    }
+  }
+
+  for (const target of context.sharedStateCandidates) {
+    if (pathExists(target)) {
+      findings.push(finding('shared-state', target, '경로가 고정된 Orca 훅·암호화 자격증명·관리 파일'));
+    }
+  }
+  for (const target of managedHookLockResidues(context.home)) {
+    findings.push(finding('shared-state', target, '중단된 Orca 관리형 훅 잠금 복구 파일'));
+  }
+  for (const candidate of context.conditionalStateCandidates || []) {
+    if (pathExists(candidate.path)) {
+      findings.push(finding(candidate.kind, candidate.path, candidate.reason, candidate.requires));
+    }
+  }
+  for (const target of context.userStateCandidates || []) {
+    if (pathExists(target)) {
+      findings.push(finding('user-state', target, 'Orca 자격증명·세션·키 설정을 포함한 전체 사용자 상태', 'includeUserState'));
+    }
+  }
+
+  const seenAppData = new Set();
+  for (const target of context.appDataCandidates) {
+    if (!pathExists(target)) continue;
+    const identity = context.filesystemIdentity(target);
+    if (seenAppData.has(identity)) continue;
+    seenAppData.add(identity);
+    findings.push(finding('app-data', target, 'Orca 애플리케이션 데이터', 'includeAppData'));
+  }
+  for (const target of context.voiceCandidates) {
+    if (!pathExists(target)) continue;
+    if (hasOrcaVoiceModelSignature(target)) {
+      findings.push(finding('voice-data', target, 'Orca 음성 모델 캐시', 'includeVoiceData'));
+    } else {
+      findings.push(finding('unverified', target, 'Orca 음성 모델 서명을 확인할 수 없어 자동 정리하지 않음', 'never'));
+    }
+  }
+  for (const target of context.cliCandidates) {
+    if (isOrcaCli(target)) findings.push(finding('cli', target, 'Orca 앱 또는 공식 런처를 가리키는 CLI'));
+  }
+  for (const candidate of context.conditionalCliCandidates || []) {
+    if (isOrcaCli(candidate.path)) {
+      findings.push(finding('cli', candidate.path, 'Orca 앱 또는 공식 런처를 가리키는 CLI', candidate.requires));
+    }
+  }
+  for (const entry of (context.userPath || '').split(';').filter(Boolean)) {
+    if (isWindowsOrcaPathEntry(entry, context)) {
+      findings.push(finding('path-entry', entry, 'Windows 사용자 PATH의 Orca CLI 경로', null, { rawPathEntry: entry }));
+    }
+  }
+
+  const uniqueFindings = new Map();
+  for (const item of findings) uniqueFindings.set(`${item.kind}\0${item.path}\0${item.pid ?? ''}`, item);
+  return [...uniqueFindings.values()].sort((a, b) => a.path.localeCompare(b.path));
+}
+
+function safeRelative(target) {
+  const parsed = path.parse(target);
+  const withoutRoot = target.slice(parsed.root.length).replace(/:/g, '_');
+  const rootLabel = parsed.root.replace(/[\\/:]+/g, '_') || 'root';
+  return path.join(rootLabel, withoutRoot);
+}
+
+function isSameOrDescendant(parent, candidate) {
+  const relative = path.relative(path.resolve(parent), path.resolve(candidate));
+  return relative === '' || (!relative.startsWith('..') && !path.isAbsolute(relative));
+}
+
+function assertSafeQuarantineSource(source, context) {
+  const resolved = path.resolve(source);
+  if (resolved === path.parse(resolved).root || resolved === path.resolve(context.home)) {
+    throw new Error(`사용자 홈 또는 파일시스템 루트는 격리할 수 없습니다: ${resolved}`);
+  }
+  if (isSameOrDescendant(resolved, context.backupRoot)) {
+    throw new Error(`백업 폴더가 정리 대상 내부에 있어 작업을 거부했습니다: ${resolved}`);
+  }
+}
+
+function ensureParent(target) {
+  fs.mkdirSync(path.dirname(target), { recursive: true });
+}
+
+function quarantine(source, context, category, dryRun) {
+  assertSafeQuarantineSource(source, context);
+  const destination = path.join(context.backupRoot, category, safeRelative(source));
+  if (dryRun) return destination;
+  ensureParent(destination);
+  if (pathExists(destination)) throw new Error(`백업 대상이 이미 존재합니다: ${destination}`);
+  try {
+    fs.renameSync(source, destination);
+  } catch (error) {
+    if (error.code !== 'EXDEV') throw error;
+    const stat = fs.lstatSync(source);
+    if (stat.isSymbolicLink()) {
+      fs.symlinkSync(fs.readlinkSync(source), destination);
+      fs.unlinkSync(source);
+    } else {
+      fs.cpSync(source, destination, { recursive: true, force: false, errorOnExist: true });
+      fs.rmSync(source, { recursive: true, force: false });
+    }
+  }
+  return destination;
+}
+
+function backupConfig(source, context, dryRun) {
+  const destination = path.join(context.backupRoot, 'config-original', safeRelative(source));
+  if (!dryRun) {
+    ensureParent(destination);
+    fs.copyFileSync(source, destination, fs.constants.COPYFILE_EXCL);
+  }
+  return destination;
+}
+
+function directManagedString(value) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return false;
+  return Object.values(value).some((item) => isOrcaHookString(item));
+}
+
+function pruneJsonHooks(value) {
+  if (Array.isArray(value)) {
+    const next = [];
+    for (const item of value) {
+      if (isOrcaHookString(item)) continue;
+      if (directManagedString(item)) continue;
+      const cleaned = pruneJsonHooks(item);
+      if (item && typeof item === 'object' && Array.isArray(item.hooks)
+          && (!cleaned.hooks || cleaned.hooks.length === 0)) continue;
+      if (cleaned !== undefined) next.push(cleaned);
+    }
+    return next;
+  }
+  if (!value || typeof value !== 'object') return value;
+  const next = {};
+  for (const [key, child] of Object.entries(value)) {
+    if (isOrcaHookString(child)) continue;
+    if (directManagedString(child)) continue;
+    const cleaned = pruneJsonHooks(child);
+    if (cleaned === undefined) continue;
+    if (Array.isArray(cleaned) && cleaned.length === 0) continue;
+    if (cleaned && typeof cleaned === 'object' && !Array.isArray(cleaned) && Object.keys(cleaned).length === 0) continue;
+    next[key] = cleaned;
+  }
+  return next;
+}
+
+function writeAtomic(target, text) {
+  const temp = `${target}.orca-cleanup-${process.pid}-${randomUUID()}.tmp`;
+  fs.writeFileSync(temp, text, { encoding: 'utf8', flag: 'wx' });
+  try {
+    fs.renameSync(temp, target);
+  } finally {
+    try { fs.unlinkSync(temp); } catch { /* rename 성공 시 이미 사라진다. */ }
+  }
+}
+
+function cleanJsonHook(target, context, dryRun) {
+  const value = readJson(target);
+  if (!value) throw new Error(`JSON을 해석할 수 없어 자동 수정하지 않았습니다: ${target}`);
+  const cleaned = pruneJsonHooks(value);
+  const before = `${JSON.stringify(value, null, 2)}\n`;
+  const after = `${JSON.stringify(cleaned, null, 2)}\n`;
+  if (before === after) return null;
+  const backup = backupConfig(target, context, dryRun);
+  if (!dryRun) writeAtomic(target, after);
+  return backup;
+}
+
+function cleanKimiHook(target, context, dryRun) {
+  const text = readText(target);
+  const start = text.indexOf(KIMI_START);
+  const end = text.indexOf(KIMI_END, start + KIMI_START.length);
+  if (start < 0 || end < 0) return null;
+  const backup = backupConfig(target, context, dryRun);
+  const after = `${text.slice(0, start)}${text.slice(end + KIMI_END.length)}`.replace(/\n{3,}/g, '\n\n');
+  if (!dryRun) writeAtomic(target, after);
+  return backup;
+}
+
+function cleanCodexLegacyHook(target, context, dryRun) {
+  const text = readText(target);
+  const after = stripDelimitedBlock(text, CODEX_LEGACY_START, CODEX_LEGACY_END);
+  if (after === text) return null;
+  const backup = backupConfig(target, context, dryRun);
+  if (!dryRun) writeAtomic(target, after);
+  return backup;
+}
+
+function cleanHermesConfig(target, context, dryRun) {
+  const text = readText(target);
+  const after = text.split(/(?<=\n)/).filter((line) => !/^\s*-\s*orca-status\s*(?:\r?\n)?$/.test(line)).join('');
+  if (after === text) return null;
+  const backup = backupConfig(target, context, dryRun);
+  if (!dryRun) writeAtomic(target, after);
+  return backup;
+}
+
+function editText(target, after, context, dryRun) {
+  if (after === readText(target)) return null;
+  const backup = backupConfig(target, context, dryRun);
+  if (!dryRun) writeAtomic(target, after);
+  return backup;
+}
+
+function cleanJcodeHook(target, context, dryRun) {
+  const text = readText(target);
+  const managed = jcodeManagedHookLines(text);
+  if (managed.size === 0) return null;
+  const { lines, eol } = splitLinesWithEol(text);
+  return editText(target, lines.filter((_, index) => !managed.has(index)).join(eol), context, dryRun);
+}
+
+function cleanDshHook(target, context, dryRun) {
+  const text = readText(target);
+  const { lines, eol } = splitLinesWithEol(text);
+  const region = dshManagedRegion(lines);
+  if (!region) return null;
+  const kept = [...lines.slice(0, region.start), ...lines.slice(region.end + 1)];
+  while (kept.length > 0 && kept[kept.length - 1].trim() === '') kept.pop();
+  // 주석만 남으면 DSH가 읽지 못하므로 Orca와 같이 빈 목록을 되돌려 놓는다.
+  if (kept.every((line) => line.trim() === '' || line.trim().startsWith('#'))) kept.push('[]');
+  return editText(target, `${kept.join(eol)}${eol}`, context, dryRun);
+}
+
+function cleanMuseHook(target, context, dryRun) {
+  const value = readJson(target);
+  if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    throw new Error(`Muse 설정을 해석할 수 없어 자동 수정하지 않았습니다: ${target}`);
+  }
+  if (!isOrcaHookString(value.managed_hooks_path)) return null;
+  const next = { ...value };
+  delete next.managed_hooks_path;
+  if (Array.isArray(next.managed_hooks_env_vars)) {
+    const kept = next.managed_hooks_env_vars.filter((name) => !MUSE_ORCA_ENV_VARS.has(name));
+    if (kept.length > 0) next.managed_hooks_env_vars = kept;
+    else delete next.managed_hooks_env_vars;
+  }
+  return editText(target, `${JSON.stringify(next, null, 2)}\n`, context, dryRun);
+}
+
+function cleanOpenCodeTuiConfig(target, context, dryRun) {
+  const value = readJson(target);
+  if (!value || typeof value !== 'object' || Array.isArray(value) || !Array.isArray(value.plugin)) {
+    throw new Error(`OpenCode TUI 설정을 해석할 수 없어 자동 수정하지 않았습니다: ${target}`);
+  }
+  const kept = value.plugin.filter((item) => !isOrcaOpenCodeTuiEntry(item));
+  if (kept.length === value.plugin.length) return null;
+  const next = { ...value, plugin: kept };
+  if (kept.length === 0) delete next.plugin;
+  return editText(target, `${JSON.stringify(next, null, 2)}\n`, context, dryRun);
+}
+
+const HOOK_EDITORS = Object.freeze({
+  json: cleanJsonHook,
+  kimi: cleanKimiHook,
+  'hermes-config': cleanHermesConfig,
+  jcode: cleanJcodeHook,
+  dsh: cleanDshHook,
+  muse: cleanMuseHook,
+  'opencode-tui': cleanOpenCodeTuiConfig,
+});
+
+function cleanWindowsUserPath(context, dryRun) {
+  const parts = (context.userPath || '').split(';');
+  const next = parts.filter((entry) => !isWindowsOrcaPathEntry(entry, context)).join(';');
+  if (next === context.userPath) return null;
+  const backup = path.join(context.backupRoot, 'config-original', 'windows-user-path.txt');
+  if (!dryRun) {
+    ensureParent(backup);
+    fs.writeFileSync(backup, `${context.userPath}\n`, { encoding: 'utf8', flag: 'wx' });
+    if (process.platform !== 'win32') throw new Error('Windows 사용자 PATH는 Windows에서만 수정할 수 있습니다.');
+    const script = "[Environment]::SetEnvironmentVariable('Path',$env:ORCA_CLEAN_PATH,'User')";
+    const result = spawnSync('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', script], {
+      encoding: 'utf8', env: { ...process.env, ORCA_CLEAN_PATH: next },
+    });
+    if (result.status !== 0) throw new Error(`Windows 사용자 PATH 수정 실패: ${result.stderr.trim()}`);
+    context.userPath = next;
+  }
+  return backup;
+}
+
+function removeLockEntries(target, names, context, dryRun) {
+  const value = readJson(target);
+  if (!value) throw new Error(`잠금 JSON을 해석할 수 없습니다: ${target}`);
+  const wanted = new Set(names);
+  let changed = false;
+  const containers = [value.skills, value.installed, value.dependencies, value];
+  for (const container of containers) {
+    if (!container || typeof container !== 'object' || Array.isArray(container)) continue;
+    for (const [name, details] of Object.entries(container)) {
+      if (!wanted.has(name)) continue;
+      const source = typeof details === 'string'
+        ? details
+        : [details?.source, details?.sourceUrl, details?.repository, details?.repo, details?.url]
+          .filter(Boolean).join(' ');
+      if (ORCA_SOURCE_PATTERN.test(source)) {
+        delete container[name];
+        changed = true;
+      }
+    }
+  }
+  if (!changed) return null;
+  const backup = backupConfig(target, context, dryRun);
+  if (!dryRun) writeAtomic(target, `${JSON.stringify(value, null, 2)}\n`);
+  return backup;
+}
+
+function selected(finding, options) {
+  return !finding.requires || Boolean(options[finding.requires]);
+}
+
+function plannedMutationForFinding(item) {
+  if (item.kind === 'skill-lock' || item.kind === 'path-entry') return 'edit';
+  if (item.kind !== 'hook' || item.removeWhole) return 'quarantine';
+  if (Object.hasOwn(HOOK_EDITORS, item.hookType) || item.hookType === 'codex-legacy') return 'edit';
+  return 'quarantine';
+}
+
+function plannedBackupForFinding(item, context, mutation) {
+  if (mutation === 'edit') {
+    return item.kind === 'path-entry'
+      ? path.join(context.backupRoot, 'config-original', 'windows-user-path.txt')
+      : path.join(context.backupRoot, 'config-original', safeRelative(item.path));
+  }
+  const category = item.kind.replace(/[^a-z0-9-]/gi, '-');
+  return path.join(context.backupRoot, category, safeRelative(item.path));
+}
+
+function cleanupJournalValue(context, createdAt, cleanupStatus, actions, errors) {
+  return signedCleanupManifest({
+    manifestVersion: 2,
+    createdAt,
+    platform: context.platform,
+    backupRoot: context.backupRoot,
+    cleanupStatus,
+    actions,
+    errors,
+  });
+}
+
+function initializeCleanupJournal(context, createdAt, actions, errors) {
+  if (pathExists(context.backupRoot) && fs.readdirSync(context.backupRoot).length > 0) {
+    throw new Error(`비어 있지 않은 백업 폴더는 사용할 수 없습니다: ${context.backupRoot}`);
+  }
+  fs.mkdirSync(context.backupRoot, { recursive: true });
+  const manifestPath = path.join(context.backupRoot, 'manifest.json');
+  const manifest = cleanupJournalValue(context, createdAt, 'in-progress', actions, errors);
+  fs.writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`, { encoding: 'utf8', flag: 'wx' });
+  return manifestPath;
+}
+
+function updateCleanupJournal(manifestPath, context, createdAt, cleanupStatus, actions, errors) {
+  const manifest = cleanupJournalValue(context, createdAt, cleanupStatus, actions, errors);
+  writeAtomic(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`);
+}
+
+export function cleanOrcaResidue(context, options = {}) {
+  const dryRun = Boolean(options.dryRun);
+  const findings = scanOrcaResidue(context);
+  const actions = [];
+  const errors = [];
+  const createdAt = new Date().toISOString();
+  const blockers = findings.filter((item) => item.kind === 'app-installed' || item.kind === 'app-running');
+  const blocked = blockers.length > 0 && !options.force;
+  if (blocked && !dryRun) {
+    errors.push({
+      path: blockers[0].path,
+      message: 'Orca 앱이 아직 설치돼 있거나 실행 중이라 정리하지 않았습니다. 앱이 켜질 때 훅을 다시 설치하기 때문입니다. 앱을 먼저 제거하고, 그래도 진행하려면 --force를 붙이세요.',
+    });
+    return { findings, actions, errors, backupRoot: context.backupRoot, dryRun, blocked };
+  }
+
+  // 백그라운드 프로세스가 앱 데이터를 붙잡고 있으면 격리가 실패하므로 먼저 끈다. 되돌릴 수 없는 작업이라 복원 대상이 아니다.
+  for (const item of findings.filter((candidate) => candidate.kind === 'process' && selected(candidate, options))) {
+    if (dryRun) {
+      actions.push({ action: 'would-stop', ...item });
+      continue;
+    }
+    try {
+      context.stopProcess(item.pid);
+      actions.push({ action: 'stopped', ...item });
+    } catch (error) {
+      errors.push({ path: item.path, message: error.message });
+      actions.push({ action: 'error', error: error.message, ...item });
+    }
+  }
+
+  const hasSelectedWork = findings.some((item) => item.kind !== 'process' && selected(item, options));
+  let manifestPath = null;
+  if (!dryRun && hasSelectedWork) {
+    try {
+      for (const item of findings.filter((candidate) => selected(candidate, options))) {
+        if (plannedMutationForFinding(item) === 'quarantine') assertSafeQuarantineSource(item.path, context);
+      }
+      manifestPath = initializeCleanupJournal(context, createdAt, actions, errors);
+    } catch (error) {
+      errors.push({ path: context.backupRoot, message: error.message });
+      actions.push({ action: 'error', path: context.backupRoot, error: error.message });
+      return { findings, actions, errors, backupRoot: context.backupRoot, dryRun };
+    }
+  }
+
+  const selectedUserStateRoots = findings
+    .filter((item) => item.kind === 'user-state' && selected(item, options))
+    .map((item) => item.path);
+
+  for (const item of findings) {
+    if (item.kind === 'process' && selected(item, options)) continue;
+    if (item.kind !== 'user-state'
+        && selectedUserStateRoots.some((root) => isSameOrDescendant(root, item.path))) {
+      actions.push({ action: 'covered', ...item });
+      if (manifestPath) updateCleanupJournal(manifestPath, context, createdAt, 'in-progress', actions, errors);
+      continue;
+    }
+    if (!selected(item, options)) {
+      actions.push({ action: 'skipped', ...item });
+      if (manifestPath) updateCleanupJournal(manifestPath, context, createdAt, 'in-progress', actions, errors);
+      continue;
+    }
+    let pendingIndex = -1;
+    if (manifestPath) {
+      const mutation = plannedMutationForFinding(item);
+      const pending = {
+        action: mutation === 'edit' ? 'pending-edit' : 'pending-quarantine',
+        backup: plannedBackupForFinding(item, context, mutation),
+        ...item,
+      };
+      pendingIndex = actions.push(pending) - 1;
+      updateCleanupJournal(manifestPath, context, createdAt, 'in-progress', actions, errors);
+    }
+    try {
+      let action;
+      if (item.kind === 'hook' && !item.removeWhole && Object.hasOwn(HOOK_EDITORS, item.hookType)) {
+        const backup = HOOK_EDITORS[item.hookType](item.path, context, dryRun);
+        action = { action: backup ? (dryRun ? 'would-edit' : 'edited') : 'unchanged', backup, ...item };
+      } else if (item.kind === 'hook' && item.hookType === 'codex-legacy' && !item.removeWhole) {
+        const backup = cleanCodexLegacyHook(item.path, context, dryRun);
+        action = { action: backup ? (dryRun ? 'would-edit' : 'edited') : 'unchanged', backup, ...item };
+      } else if (item.kind === 'skill-lock') {
+        const backup = removeLockEntries(item.path, item.names, context, dryRun);
+        action = { action: backup ? (dryRun ? 'would-edit' : 'edited') : 'unchanged', backup, ...item };
+      } else if (item.kind === 'path-entry') {
+        const backup = cleanWindowsUserPath(context, dryRun);
+        action = { action: backup ? (dryRun ? 'would-edit' : 'edited') : 'unchanged', backup, ...item };
+      } else {
+        const category = item.kind.replace(/[^a-z0-9-]/gi, '-');
+        const backup = quarantine(item.path, context, category, dryRun);
+        action = { action: dryRun ? 'would-quarantine' : 'quarantined', backup, ...item };
+      }
+      if (!dryRun && ['edited', 'quarantined'].includes(action.action)) {
+        action.backupIntegrity = pathIntegrity(action.backup);
+      }
+      if (pendingIndex >= 0) actions[pendingIndex] = action;
+      else actions.push(action);
+    } catch (error) {
+      errors.push({ path: item.path, message: error.message });
+      if (pendingIndex >= 0) actions[pendingIndex] = { ...actions[pendingIndex], error: error.message };
+      else actions.push({ action: 'error', error: error.message, ...item });
+    }
+    if (manifestPath) updateCleanupJournal(manifestPath, context, createdAt, 'in-progress', actions, errors);
+  }
+
+  if (manifestPath) updateCleanupJournal(manifestPath, context, createdAt, 'complete', actions, errors);
+  return { findings, actions, errors, backupRoot: context.backupRoot, dryRun, blocked };
+}
+
+function assertSafeRestorePath(target, backupRoot, home) {
+  const resolved = path.resolve(target);
+  if (!path.isAbsolute(target) || resolved === path.parse(resolved).root || resolved === path.resolve(home)) {
+    throw new Error(`복원 대상이 안전하지 않습니다: ${target}`);
+  }
+  if (isSameOrDescendant(backupRoot, resolved) || isSameOrDescendant(resolved, backupRoot)) {
+    throw new Error(`복원 대상과 백업 폴더가 겹칩니다: ${resolved}`);
+  }
+  return resolved;
+}
+
+function assertBackupBelongsToManifest(backup, backupRoot) {
+  if (!backup || !path.isAbsolute(backup)) throw new Error(`유효하지 않은 백업 경로입니다: ${backup || '(없음)'}`);
+  const resolved = path.resolve(backup);
+  if (!isSameOrDescendant(backupRoot, resolved) || resolved === backupRoot) {
+    throw new Error(`manifest 밖의 백업 경로는 복원하지 않습니다: ${resolved}`);
+  }
+  return resolved;
+}
+
+const QUARANTINED_RESTORE_KINDS = new Set([
+  'app-data', 'cli', 'extension', 'hook', 'project-state', 'remote-state',
+  'shared-state', 'skill', 'skill-transaction', 'user-state', 'voice-data', 'wsl-state',
+]);
+const EDITED_RESTORE_KINDS = new Set(['hook', 'path-entry', 'skill-lock']);
+
+function sameManifestPath(left, right, platform) {
+  const normalizedLeft = path.resolve(left);
+  const normalizedRight = path.resolve(right);
+  return platform === 'win32'
+    ? normalizedLeft.toLowerCase() === normalizedRight.toLowerCase()
+    : normalizedLeft === normalizedRight;
+}
+
+function expectedBackupForRestoreItem(item, backupRoot) {
+  const sourceAction = item.action === 'pending-quarantine'
+    ? 'quarantined'
+    : item.action === 'pending-edit' ? 'edited' : item.action;
+  if (sourceAction === 'quarantined' && QUARANTINED_RESTORE_KINDS.has(item.kind)) {
+    const category = item.kind.replace(/[^a-z0-9-]/gi, '-');
+    return path.join(backupRoot, category, safeRelative(item.path));
+  }
+  if (sourceAction === 'edited' && EDITED_RESTORE_KINDS.has(item.kind)) {
+    return item.kind === 'path-entry'
+      ? path.join(backupRoot, 'config-original', 'windows-user-path.txt')
+      : path.join(backupRoot, 'config-original', safeRelative(item.path));
+  }
+  throw new Error(`지원하지 않는 복원 작업입니다: ${item.action}/${item.kind}`);
+}
+
+function assertBackupContentIntegrity(item, backup, manifestVersion) {
+  if (manifestVersion < 2 || item.action.startsWith('pending-')) return;
+  if (!integrityMatches(backup, item.backupIntegrity)) {
+    throw new Error(`백업 내용 무결성 검증에 실패했습니다: ${backup}`);
+  }
+}
+
+function assertExpectedBackupForItem(item, state) {
+  const backup = assertBackupBelongsToManifest(item.backup, state.backupRoot);
+  const expected = expectedBackupForRestoreItem(item, state.backupRoot);
+  if (!sameManifestPath(backup, expected, state.platform)) {
+    throw new Error(`대상 경로와 백업 경로의 매핑이 일치하지 않습니다: ${item.path}`);
+  }
+  return backup;
+}
+
+function validateCleanupManifest(manifest, resolvedManifest, platform) {
+  if (![1, 2].includes(manifest.manifestVersion)) {
+    throw new Error(`지원하지 않는 manifest 버전입니다: ${manifest.manifestVersion ?? '(없음)'}`);
+  }
+  if (!['win32', 'darwin', 'linux'].includes(manifest.platform) || manifest.platform !== platform) {
+    throw new Error(`manifest 운영체제가 현재 복원 환경과 다릅니다: ${manifest.platform ?? '(없음)'} -> ${platform}`);
+  }
+  const backupRoot = path.dirname(resolvedManifest);
+  if (!manifest.backupRoot || !sameManifestPath(manifest.backupRoot, backupRoot, platform)) {
+    throw new Error('manifest의 backupRoot가 manifest 위치와 일치하지 않습니다.');
+  }
+  if (!Array.isArray(manifest.actions) || !Array.isArray(manifest.errors)) {
+    throw new Error('manifest의 actions 또는 errors 형식이 올바르지 않습니다.');
+  }
+  if (manifest.manifestVersion === 2 && !['in-progress', 'complete'].includes(manifest.cleanupStatus)) {
+    throw new Error(`manifest 정리 상태가 올바르지 않습니다: ${manifest.cleanupStatus ?? '(없음)'}`);
+  }
+  if (manifest.integrity?.algorithm !== 'sha256'
+      || manifest.integrity.digest !== cleanupManifestDigest(manifest)) {
+    throw new Error('manifest 무결성 검증에 실패했습니다. 파일이 수정되었을 수 있습니다.');
+  }
+  return backupRoot;
+}
+
+export function verifyOrcaBackup(manifestPath, options = {}) {
+  const resolvedManifest = path.resolve(manifestPath);
+  const manifest = readJson(resolvedManifest);
+  if (!manifest) throw new Error(`유효한 Orca 정리 manifest가 아닙니다: ${resolvedManifest}`);
+  const platform = options.platform || process.platform;
+  const backupRoot = validateCleanupManifest(manifest, resolvedManifest, platform);
+  const actions = [];
+  const errors = [];
+  const restorable = manifest.actions.filter((item) => [
+    'quarantined', 'edited', 'pending-quarantine', 'pending-edit',
+  ].includes(item.action));
+
+  for (const item of restorable) {
+    try {
+      const backup = assertExpectedBackupForItem(item, { backupRoot, platform });
+      if (!pathExists(backup)) {
+        if (item.action.startsWith('pending-') && pathExists(item.path)) {
+          actions.push({ path: item.path, backup, status: 'not-applied' });
+          continue;
+        }
+        throw new Error(`백업 항목이 없습니다: ${backup}`);
+      }
+      if (!item.backupIntegrity) {
+        actions.push({ path: item.path, backup, status: item.action.startsWith('pending-')
+          ? 'recoverable-unverified' : 'not-recorded' });
+        continue;
+      }
+      if (!integrityMatches(backup, item.backupIntegrity)) {
+        throw new Error(`백업 내용 무결성 검증에 실패했습니다: ${backup}`);
+      }
+      actions.push({ path: item.path, backup, status: 'verified' });
+    } catch (error) {
+      errors.push({ path: item.path, message: error.message });
+      actions.push({ path: item.path, backup: item.backup, status: 'error', error: error.message });
+    }
+  }
+  return {
+    manifestPath: resolvedManifest,
+    manifestVersion: manifest.manifestVersion,
+    cleanupStatus: manifest.cleanupStatus || 'legacy-complete',
+    backupRoot,
+    actions,
+    errors,
+    valid: errors.length === 0,
+  };
+}
+
+function copyForRestore(source, destination) {
+  const stat = fs.lstatSync(source);
+  ensureParent(destination);
+  if (stat.isSymbolicLink()) {
+    fs.symlinkSync(fs.readlinkSync(source), destination);
+  } else if (stat.isDirectory()) {
+    fs.cpSync(source, destination, { recursive: true, force: false, errorOnExist: true });
+  } else if (stat.isFile()) {
+    fs.copyFileSync(source, destination, fs.constants.COPYFILE_EXCL);
+  } else {
+    throw new Error(`지원하지 않는 백업 파일 형식입니다: ${source}`);
+  }
+}
+
+function filesHaveSameBytes(left, right, size) {
+  const leftHandle = fs.openSync(left, 'r');
+  const rightHandle = fs.openSync(right, 'r');
+  const leftBuffer = Buffer.allocUnsafe(64 * 1024);
+  const rightBuffer = Buffer.allocUnsafe(64 * 1024);
+  try {
+    let offset = 0;
+    while (offset < size) {
+      const length = Math.min(leftBuffer.length, size - offset);
+      const leftRead = fs.readSync(leftHandle, leftBuffer, 0, length, offset);
+      const rightRead = fs.readSync(rightHandle, rightBuffer, 0, length, offset);
+      if (leftRead === 0 || rightRead === 0) return false;
+      if (leftRead !== rightRead || !leftBuffer.subarray(0, leftRead).equals(rightBuffer.subarray(0, rightRead))) return false;
+      offset += leftRead;
+    }
+    return true;
+  } finally {
+    fs.closeSync(leftHandle);
+    fs.closeSync(rightHandle);
+  }
+}
+
+function pathsEquivalent(left, right) {
+  try {
+    const leftStat = fs.lstatSync(left);
+    const rightStat = fs.lstatSync(right);
+    if (leftStat.isSymbolicLink() || rightStat.isSymbolicLink()) {
+      return leftStat.isSymbolicLink() && rightStat.isSymbolicLink()
+        && fs.readlinkSync(left) === fs.readlinkSync(right);
+    }
+    if (leftStat.isFile() || rightStat.isFile()) {
+      return leftStat.isFile() && rightStat.isFile() && leftStat.size === rightStat.size
+        && filesHaveSameBytes(left, right, leftStat.size);
+    }
+    if (!leftStat.isDirectory() || !rightStat.isDirectory()) return false;
+    const leftEntries = fs.readdirSync(left).sort();
+    const rightEntries = fs.readdirSync(right).sort();
+    return leftEntries.length === rightEntries.length
+      && leftEntries.every((name, index) => name === rightEntries[index]
+        && pathsEquivalent(path.join(left, name), path.join(right, name)));
+  } catch {
+    return false;
+  }
+}
+
+function removePartialRestore(target) {
+  if (!pathExists(target)) return;
+  fs.rmSync(target, { recursive: true, force: false });
+}
+
+function setWindowsUserPath(value) {
+  if (process.platform !== 'win32') throw new Error('Windows 사용자 PATH는 Windows에서만 복원할 수 있습니다.');
+  const script = "[Environment]::SetEnvironmentVariable('Path',$env:ORCA_RESTORE_PATH,'User')";
+  const result = spawnSync('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', script], {
+    encoding: 'utf8', env: { ...process.env, ORCA_RESTORE_PATH: value },
+  });
+  if (result.status !== 0) throw new Error(`Windows 사용자 PATH 복원 실패: ${result.stderr.trim()}`);
+}
+
+function restoreWindowsPathEntry(item, state) {
+  const backup = assertExpectedBackupForItem(item, state);
+  if (!pathExists(backup)) {
+    if (item.action === 'pending-edit') return { action: 'already-restored', conflictBackup: null };
+    throw new Error(`PATH 백업이 없습니다: ${backup}`);
+  }
+  assertBackupContentIntegrity(item, backup, state.manifestVersion);
+  const original = readText(backup).replace(/\r?\n$/, '');
+  const current = state.readUserPath();
+  if (current === original) return { action: 'already-restored', conflictBackup: null };
+  const conflictBackup = path.join(state.conflictRoot, 'windows-user-path.txt');
+  if (state.dryRun) return { action: 'would-restore', conflictBackup };
+  ensureParent(conflictBackup);
+  fs.writeFileSync(conflictBackup, `${current}\n`, { encoding: 'utf8', flag: 'wx' });
+  try {
+    state.writeUserPath(original);
+  } catch (error) {
+    try { state.writeUserPath(current); } catch { /* 원래 PATH 백업은 conflictBackup에 남긴다. */ }
+    throw error;
+  }
+  return { action: 'restored', conflictBackup };
+}
+
+function restoreFilesystemItem(item, state) {
+  const source = assertExpectedBackupForItem(item, state);
+  const target = assertSafeRestorePath(item.path, state.backupRoot, state.home);
+  if (!pathExists(source)) {
+    if (pathExists(target)) return { action: 'already-restored', conflictBackup: null };
+    throw new Error(`복원할 백업이 없습니다: ${source}`);
+  }
+  assertBackupContentIntegrity(item, source, state.manifestVersion);
+  if (pathExists(target) && pathsEquivalent(source, target)) {
+    return { action: 'already-restored', conflictBackup: null };
+  }
+  const conflictContext = { home: state.home, backupRoot: state.conflictRoot };
+  const conflictBackup = pathExists(target)
+    ? quarantine(target, conflictContext, 'current', state.dryRun)
+    : null;
+  if (state.dryRun) return { action: 'would-restore', conflictBackup };
+  try {
+    copyForRestore(source, target);
+  } catch (error) {
+    try {
+      removePartialRestore(target);
+      if (conflictBackup && pathExists(conflictBackup)) copyForRestore(conflictBackup, target);
+    } catch (rollbackError) {
+      throw new Error(`${error.message}; 현재 파일 자동 복귀도 실패했습니다: ${rollbackError.message}`);
+    }
+    throw error;
+  }
+  return { action: 'restored', conflictBackup };
+}
+
+export function restoreOrcaBackup(manifestPath, options = {}) {
+  const resolvedManifest = path.resolve(manifestPath);
+  const manifest = readJson(resolvedManifest);
+  if (!manifest) {
+    throw new Error(`유효한 Orca 정리 manifest가 아닙니다: ${resolvedManifest}`);
+  }
+  const platform = options.platform || process.platform;
+  const backupRoot = validateCleanupManifest(manifest, resolvedManifest, platform);
+  const dryRun = Boolean(options.dryRun);
+  const conflictRoot = path.join(backupRoot, 'restore-conflicts', operationId());
+  const state = {
+    backupRoot,
+    conflictRoot,
+    dryRun,
+    home: path.resolve(options.home || os.homedir()),
+    platform,
+    manifestVersion: manifest.manifestVersion,
+    readUserPath: options.readUserPath || (() => readWindowsUserPath('win32')),
+    writeUserPath: options.writeUserPath || setWindowsUserPath,
+  };
+  const actions = [];
+  const errors = [];
+  const restorable = manifest.actions.filter((item) => [
+    'quarantined', 'edited', 'pending-quarantine', 'pending-edit',
+  ].includes(item.action));
+
+  for (const item of restorable) {
+    const base = {
+      kind: item.kind,
+      path: item.path,
+      backup: item.backup,
+      sourceAction: item.action,
+    };
+    try {
+      const result = item.kind === 'path-entry'
+        ? restoreWindowsPathEntry(item, state)
+        : restoreFilesystemItem(item, state);
+      actions.push({ ...base, ...result });
+    } catch (error) {
+      errors.push({ path: item.path, message: error.message });
+      actions.push({ ...base, action: 'error', error: error.message });
+    }
+  }
+
+  let reportPath = null;
+  if (!dryRun) {
+    reportPath = path.join(backupRoot, `restore-manifest-${operationId()}.json`);
+    fs.writeFileSync(reportPath, `${JSON.stringify({
+      restoreVersion: 1,
+      restoredAt: new Date().toISOString(),
+      sourceManifest: resolvedManifest,
+      conflictRoot: actions.some((item) => item.conflictBackup) ? conflictRoot : null,
+      actions,
+      errors,
+    }, null, 2)}\n`, { encoding: 'utf8', flag: 'wx' });
+  }
+  return {
+    manifestPath: resolvedManifest,
+    manifestVersion: manifest.manifestVersion,
+    cleanupStatus: manifest.cleanupStatus || 'legacy-complete',
+    backupRoot,
+    conflictRoot,
+    reportPath,
+    actions,
+    errors,
+    dryRun,
+  };
+}
+
+export const internals = {
+  CODEX_LEGACY_END,
+  CODEX_LEGACY_START,
+  DSH_END,
+  DSH_START,
+  KIMI_START,
+  KIMI_END,
+  isOrcaHookString,
+  jcodeManagedHookLines,
+  LINUX_CLI_DISPATCHER_MARKER,
+  LINUX_CLI_COMMAND_NAME,
+  hasOrcaSkillSignature,
+  isOrcaCli,
+  operationId,
+  pruneJsonHooks,
+  signedCleanupManifest,
+  stripDelimitedBlock,
+};