therookie 0.4.3

package/src/lib/self-update.js

@@ -0,0 +1,79 @@
+// task 77b93db0 — rookie update 자가 갱신.
+// 서버가 더 새 cli_version 을 배포했으면 자기(구) 번들 템플릿을 설치하면 안 된다 —
+// install.sh(단일 설치 구현, sha256 검증 포함)를 받아 실행해 새 버전을 깔고,
+// 새 CLI 의 update 로 위임한다. 재귀는 ROOKIE_UPDATE_REEXEC env 로 차단.
+
+import { existsSync } from 'node:fs'
+import { spawnSync } from 'node:child_process'
+import { homedir } from 'node:os'
+import { join, sep } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+// npm(공식 채널)으로 설치된 CLI 는 node_modules 아래에 위치한다. 자체 tarball 설치본은
+// ~/.rookie/cli/<ver>/ 아래다. npm 설치본에서 install.sh 자가 갱신을 돌리면 ~/.rookie/cli 에
+// 이중 설치되므로, update 는 여기서 분기해 `npm i -g therookie@latest` 안내로 뺀다.
+export function isNpmManagedInstall(moduleUrl = import.meta.url) {
+  try {
+    return fileURLToPath(moduleUrl).includes(`${sep}node_modules${sep}`)
+  } catch {
+    return false
+  }
+}
+
+export function semverGt(a, b) {
+  const pa = String(a).split('.').map((n) => parseInt(n, 10) || 0)
+  const pb = String(b).split('.').map((n) => parseInt(n, 10) || 0)
+  for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+    const d = (pa[i] || 0) - (pb[i] || 0)
+    if (d !== 0) return d > 0
+  }
+  return false
+}
+
+// GET /rookie-cli/manifest.json (public 정적 파일, 인증 불요). fail-soft — 없거나 못 읽으면 null.
+export async function fetchReleaseManifest(endpoint, { fetchImpl = fetch } = {}) {
+  try {
+    const res = await fetchImpl(`${endpoint}/rookie-cli/manifest.json`)
+    if (!res.ok) return null
+    const m = await res.json()
+    return m && typeof m.cli_version === 'string' ? m : null
+  } catch {
+    return null
+  }
+}
+
+// install.sh 로 자가 재설치 후 새 CLI 의 `update` 를 같은 flag 로 재실행. exit code 반환.
+export async function selfUpdateAndRerun({ endpoint, targetVersion, force = false, fetchImpl = fetch, spawn = spawnSync }) {
+  let script
+  try {
+    const res = await fetchImpl(`${endpoint}/install.sh`)
+    if (!res.ok) throw new Error(`HTTP ${res.status}`)
+    script = await res.text()
+  } catch (e) {
+    console.log(`✗ install.sh 다운로드 실패: ${e.message}`)
+    return 1
+  }
+
+  const install = spawn('sh', ['-s'], {
+    input: script,
+    stdio: ['pipe', 'inherit', 'inherit'],
+    env: { ...process.env, ROOKIE_ENDPOINT: endpoint },
+  })
+  if (install.error || install.status !== 0) {
+    console.log(`✗ 자가 갱신 실패 — 수동 재설치: curl -fsSL ${endpoint}/install.sh | bash`)
+    return 1
+  }
+
+  const rookieHome = process.env.ROOKIE_HOME || join(homedir(), '.rookie')
+  const nextCli = join(rookieHome, 'cli', targetVersion, 'bin', 'rookie.js')
+  if (!existsSync(nextCli)) {
+    console.log(`✗ 갱신된 CLI 를 찾지 못했습니다: ${nextCli}`)
+    return 1
+  }
+
+  const rerun = spawn(process.execPath, [nextCli, 'update', ...(force ? ['--force'] : [])], {
+    stdio: 'inherit',
+    env: { ...process.env, ROOKIE_UPDATE_REEXEC: '1' },
+  })
+  return rerun.status ?? 1
+}

package/src/lib/skill-installer.js

@@ -0,0 +1,55 @@
+// v6 P0b — Skill 본문 install/upgrade. 기존 init/update 의 인라인 skill 쓰기 로직을
+// backup 옵션과 함께 모듈화. 같은 내용이면 no-op, 다른 내용이면 .bak.<ts> 백업 후 덮어쓰기.
+
+import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'node:fs'
+import { join, dirname } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { homedir } from 'node:os'
+
+const __filename = fileURLToPath(import.meta.url)
+const DEFAULT_TEMPLATE = join(
+  dirname(__filename),
+  '..',
+  '..',
+  'templates',
+  'skill',
+  'SKILL.md'
+)
+
+export function installSkill({
+  home = homedir(),
+  scope = 'global',
+  version,
+  installedBy,
+  templatePath = DEFAULT_TEMPLATE,
+  now = () => new Date().toISOString(),
+} = {}) {
+  if (!version) throw new Error('installSkill: version required')
+  if (!installedBy) throw new Error('installSkill: installedBy required')
+
+  const base = scope === 'global' ? join(home, '.claude') : home
+  const targetDir = join(base, 'skills', 'rookie')
+  const targetPath = join(targetDir, 'SKILL.md')
+
+  const raw = readFileSync(templatePath, 'utf8')
+  const rendered = raw
+    .replaceAll('__VERSION__', version)
+    .replaceAll('__SCOPE__', scope)
+    .replaceAll('__INSTALLED_AT__', now())
+    .replaceAll('__INSTALLED_BY__', installedBy)
+
+  mkdirSync(targetDir, { recursive: true })
+
+  let backupPath = null
+  if (existsSync(targetPath)) {
+    const existing = readFileSync(targetPath, 'utf8')
+    if (existing === rendered) {
+      return { installed: false, reason: 'no_change', path: targetPath }
+    }
+    backupPath = `${targetPath}.bak.${Date.now()}`
+    writeFileSync(backupPath, existing)
+  }
+
+  writeFileSync(targetPath, rendered)
+  return { installed: true, path: targetPath, backup: backupPath }
+}

package/src/lib/spec-scanner.js

@@ -0,0 +1,85 @@
+// spec markdown → 후속 섹션 후보. 의존성 0 (Node 내장만). LLM 0.
+// 분류: deferred 우선(매칭 시 active 무시) → 기본 제외. active = 할 후속.
+
+const DEFERRED = /(Post-?MVP|범위\s*밖|비범위|비목표|미결정|미해결|보류)/
+// PR-[A-Z] 는 실측에서 '(PR-A 핵심)'·'(PR-A 동반)' 같은 단순 언급 섹션까지 잡아 노이즈가 커서 제외.
+// 진짜 PR 분할 후속은 'N차 PR'·'다음 단계'·'후속' 으로 대부분 커버됨(실측 2026-06-28).
+const ACTIVE = /(\d+\s*차\s*PR|다음\s*단계|후속|남은|미착수)/
+
+// GitHub 앵커 규칙: 소문자화, 공백→'-', 영숫자·'_'·'-'·한글 외 제거.
+export function slugify(title) {
+  return title
+    .trim()
+    .toLowerCase()
+    .replace(/[^\w\sㄱ-ㆎ가-힣-]/g, '')
+    .replace(/\s+/g, '-')
+}
+
+export function classify(title) {
+  if (DEFERRED.test(title)) return 'deferred'
+  if (ACTIVE.test(title)) return 'active'
+  return null
+}
+
+// §A 완료 마커 인식 — 이미 끝난 후속을 후보에서 제외(spec 2026-06-28 분류 시스템화).
+// ✅ 동반 완료 선언만 done(plain '구현 완료'·표 셀 ✅ 단독 제외). 미완·조건·예정 신호 우선.
+const DONE = /✅[^\n]{0,40}완료|✅\s*\d{4}-\d{2}-\d{2}[^\n]{0,20}완료/
+const STILL_OPEN =
+  /(미착수|진행\s*예정|착수\s*대기|TODO|남은\s|미구현|미완료|예정|완료\s*(시|후|되면|여부|하면|전|기준|게이트|조건|아님))/
+
+function isDone(body) {
+  if (STILL_OPEN.test(body)) return false
+  return DONE.test(body)
+}
+
+// markdown 을 줄 단위로 훑어 H2/H3 헤더를 모은다. fenced code 안은 무시.
+// 모든 H2/H3 헤더에 slug 카운터(-1,-2) 부여(후보 여부 무관 = GitHub 규칙).
+export function parseFollowups(specRef, markdown) {
+  const lines = markdown.split(/\r?\n/)
+  const slugCount = new Map()
+  const headers = [] // {level, title, anchor, start}
+  let inFence = false
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i]
+    if (/^\s*```/.test(line)) {
+      inFence = !inFence
+      continue
+    }
+    if (inFence) continue
+    const m = /^(#{2,3})\s+(.+?)\s*$/.exec(line)
+    if (!m) continue
+    const level = m[1].length
+    const title = m[2]
+    const base = slugify(title)
+    const n = slugCount.get(base) || 0
+    slugCount.set(base, n + 1)
+    const anchor = n === 0 ? base : `${base}-${n}`
+    headers.push({ level, title, anchor, start: i })
+  }
+
+  const out = []
+  for (let h = 0; h < headers.length; h++) {
+    const hd = headers[h]
+    const klass = classify(hd.title)
+    if (!klass) continue
+    // 본문: 다음 줄부터, level <= hd.level 인 다음 헤더 직전까지(하위 헤더 포함).
+    let end = lines.length
+    for (let k = h + 1; k < headers.length; k++) {
+      if (headers[k].level <= hd.level) {
+        end = headers[k].start
+        break
+      }
+    }
+    const body = lines.slice(hd.start + 1, end).join('\n').trim()
+    // §A: active 인데 본문에 완료 선언이 있으면 이미 끝난 후속 → 제외.
+    if (klass === 'active' && isDone(body)) continue
+    out.push({
+      specRef,
+      sectionAnchor: hd.anchor,
+      sectionTitle: hd.title,
+      sectionBody: body,
+      klass,
+    })
+  }
+  return out
+}

package/src/lib/sweep-core.mjs

@@ -0,0 +1,423 @@
+import fs from 'node:fs'
+import path from 'node:path'
+import os from 'node:os'
+import crypto from 'node:crypto'
+import { execFileSync } from 'node:child_process'
+import { configPathForCwd } from '../config.js'
+
+// B6-3 (codex R1 P1-1): 세션 identity pin 비교 — pin(sha256 hash 앞 16자)이 있고 현재 토큰과
+// 다르면 그 orphan 은 다른 계정 세션의 산물 → 현재 토큰으로 재전송하면 오귀속. bash
+// identity_pin_check(config-resolve.sh)와 동일 산식·동일 fail-open(pin 없음·읽기 실패 통과).
+export function identityPinMismatch(sid, token, { pinDir = path.join(os.homedir(), '.rookie', 'session-identity') } = {}) {
+  if (!sid || !token) return false
+  try {
+    const pinFile = path.join(pinDir, sid)
+    if (!fs.existsSync(pinFile)) return false
+    const pinned = fs.readFileSync(pinFile, 'utf8').trim()
+    if (!pinned) return false
+    const current = crypto.createHash('sha256').update(token).digest('hex').slice(0, 16)
+    return pinned !== current
+  } catch { return false }
+}
+
+const TURN_LIMIT = 200
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i
+const UUID_TAIL_RE = /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i
+
+function capTurns(out) {
+  let pairs = 0
+  for (let i = 1; i < out.length; i++) if (out[i-1].role === 'user' && out[i].role === 'assistant') pairs++
+  if (pairs > TURN_LIMIT) {
+    let dropPairs = pairs - TURN_LIMIT, dropIdx = 0
+    while (dropPairs > 0 && dropIdx < out.length - 1) {
+      if (out[dropIdx].role === 'user' && out[dropIdx+1].role === 'assistant') { dropIdx += 2; dropPairs-- }
+      else dropIdx++
+    }
+    out.splice(0, dropIdx)
+  }
+  return out
+}
+
+export function parseClaudeMessages(filePath) {
+  let raw
+  try { if (!filePath || !fs.existsSync(filePath)) return []; raw = fs.readFileSync(filePath, 'utf8') } catch { return [] }
+  const out = []
+  for (const line of raw.split('\n')) {
+    const t = line.trim(); if (!t) continue
+    try {
+      const j = JSON.parse(t); const m = j.message || j
+      if (m.role !== 'user' && m.role !== 'assistant') continue
+      let c = m.content
+      if (typeof c !== 'string') {
+        c = Array.isArray(c)
+          ? c.filter(b => b && b.type === 'text' && typeof b.text === 'string').map(b => b.text).join('\n').trim()
+          : ''
+      } else c = c.trim()
+      if (!c) continue
+      out.push({ role: m.role, content: c })
+    } catch {}
+  }
+  return capTurns(out)
+}
+
+export function parseCodexMessages(filePath) {
+  let raw
+  try { if (!filePath || !fs.existsSync(filePath)) return []; raw = fs.readFileSync(filePath, 'utf8') } catch { return [] }
+  const out = []
+  for (const line of raw.split('\n')) {
+    const t = line.trim(); if (!t) continue
+    let j; try { j = JSON.parse(t) } catch { continue }
+    const p = j.payload || {}
+    if (p.type !== 'message') continue
+    if (p.role !== 'user' && p.role !== 'assistant') continue
+    let c = p.content
+    if (Array.isArray(c)) {
+      c = c.filter(b => b && typeof b.text === 'string' && (b.type === 'input_text' || b.type === 'output_text' || b.type === 'text')).map(b => b.text).join('\n').trim()
+    } else if (typeof c === 'string') c = c.trim()
+    else c = ''
+    if (!c) continue
+    out.push({ role: p.role, content: c })
+  }
+  return capTurns(out)
+}
+
+export function codexCwd(filePath) {
+  try {
+    const fd = fs.openSync(filePath, 'r'); const buf = Buffer.alloc(65536)
+    const n = fs.readSync(fd, buf, 0, 65536, 0); fs.closeSync(fd)
+    const first = buf.toString('utf8', 0, n).split('\n').find(l => l.trim())
+    const j = JSON.parse(first)
+    if (j.type === 'session_meta' && j.payload && j.payload.cwd) return j.payload.cwd
+  } catch {}
+  return ''
+}
+
+// Claude transcript jsonl 의 첫 cwd 필드 (없으면 ''). codexCwd 와 대칭 — 이슈② repo 역산용.
+// orphan 회수 시 repo 를 실행 셸 process.cwd() 가 아니라 후보 transcript 의 실제 cwd 로 잡는다.
+export function claudeCwd(filePath) {
+  try {
+    for (const l of fs.readFileSync(filePath, 'utf8').split('\n')) {
+      if (!l.trim()) continue
+      try { const j = JSON.parse(l); if (j.cwd) return String(j.cwd) } catch {}
+    }
+  } catch {}
+  return ''
+}
+
+// cwd 의 git origin url (없으면 ''). git -C <cwd> remote get-url origin.
+function gitOriginOf(cwd) {
+  if (!cwd) return ''
+  try {
+    return execFileSync('git', ['-C', cwd, 'remote', 'get-url', 'origin'],
+      { stdio: ['ignore', 'pipe', 'ignore'] }).toString().trim()
+  } catch { return '' }
+}
+
+export function sessionIdFromPath(filePath, runtime = 'claude') {
+  const base = String(filePath).split('/').pop().replace(/\.jsonl$/, '')
+  if (runtime === 'codex') { const m = base.match(UUID_TAIL_RE); return m ? m[0] : '' }
+  return base
+}
+
+export { UUID_RE, UUID_TAIL_RE }
+
+// ── marker 계층 + sweep 날짜 스탬프 ─────────────────────────────────────
+
+const DEFER_CAP = 3
+const DEFAULT_ROOT = path.join(os.homedir(), '.rookie', 'orphan-recovery')
+function rootOf(opts = {}) {
+  const base = opts.root || process.env.ROOKIE_ORPHAN_DIR || DEFAULT_ROOT
+  return opts.codex ? path.join(base, 'codex') : base
+}
+export function markerRoot(opts) { return rootOf(opts) }
+const subdir = (opts, name) => path.join(rootOf(opts), name)
+const isUuid = (sid) => UUID_RE.test(String(sid || ''))
+
+function ensureDir(d) { try { fs.mkdirSync(d, { recursive: true, mode: 0o700 }); fs.chmodSync(d, 0o700) } catch {} }
+function writeMarker(dir, sid, payload) {
+  if (!isUuid(sid)) return false
+  ensureDir(dir)
+  const tmp = path.join(dir, '.tmp.' + process.pid + '.' + Math.random().toString(36).slice(2))
+  try {
+    fs.writeFileSync(tmp, payload, { mode: 0o600 })
+    fs.renameSync(tmp, path.join(dir, sid + '.json'))
+    return true
+  } catch { try { fs.unlinkSync(tmp) } catch {}; return false }
+}
+
+export function markFlushed(sid, source = 'stop', mc = 0, opts) {
+  return writeMarker(subdir(opts, 'flushed'), sid, JSON.stringify({ status: 'flushed', source, message_count: mc }))
+}
+export function markBaseline(sid, reason, opts) {
+  return writeMarker(subdir(opts, 'baseline'), sid, JSON.stringify({ status: 'baseline_skipped', reason }))
+}
+// P0.4 대칭 (bash orphan_mark_low_value): 짧고 운영사실 흔적 없는 세션은 pending 대신 low_value.
+// bash 와 같은 marker 루트를 공유하므로 Node 도 동일 marker 를 쓰고 isMarked 에서 제외해야 재포획이 막힌다.
+export function markLowValue(sid, reason = 'low_value', mc = 0, opts) {
+  return writeMarker(subdir(opts, 'low_value'), sid, JSON.stringify({ status: 'low_value', reason, message_count: mc }))
+}
+export function isClientExtracted(sid, opts) {
+  if (!isUuid(sid)) return false
+  return fs.existsSync(path.join(subdir(opts, 'client_extracted'), sid + '.json'))
+}
+export function recordPending(sid, transcriptPath, opts) {
+  if (!isUuid(sid)) return false
+  if (isClientExtracted(sid, opts)) return true
+  return writeMarker(subdir(opts, 'pending-extraction'), sid, JSON.stringify({ status: 'pending_extraction', transcript_path: transcriptPath || '', recovered_at: new Date().toISOString() }))
+}
+export function markClientExtracted(sid, opts) {
+  if (!isUuid(sid)) return false
+  if (!writeMarker(subdir(opts, 'client_extracted'), sid, JSON.stringify({ status: 'client_extracted' }))) return false
+  try { fs.unlinkSync(path.join(subdir(opts, 'pending-extraction'), sid + '.json')) } catch {}
+  return true
+}
+export function deferBlocked(sid, opts) {
+  try {
+    const j = JSON.parse(fs.readFileSync(path.join(subdir(opts, 'deferred'), sid + '.json'), 'utf8'))
+    if ((j.fail_count || 0) >= DEFER_CAP) return true
+    const nr = Date.parse(j.next_retry_at); return !isNaN(nr) && nr / 1000 > Date.now() / 1000
+  } catch { return false }
+}
+export function recordDeferred(sid, error, opts) {
+  if (!isUuid(sid)) return false
+  const dir = subdir(opts, 'deferred')
+  let prev = { fail_count: 0 }
+  try { prev = JSON.parse(fs.readFileSync(path.join(dir, sid + '.json'), 'utf8')) } catch {}
+  const fc = (prev.fail_count || 0) + 1
+  const next = new Date(Date.now() + fc * 21600 * 1000).toISOString()
+  return writeMarker(dir, sid, JSON.stringify({ fail_count: fc, next_retry_at: next, last_error: error || '' }))
+}
+export function clearDeferred(sid, opts) {
+  if (!isUuid(sid)) return
+  try { fs.unlinkSync(path.join(subdir(opts, 'deferred'), sid + '.json')) } catch {}
+}
+export function isMarked(sid, opts) {
+  if (fs.existsSync(path.join(subdir(opts, 'flushed'), sid + '.json'))) return true
+  if (fs.existsSync(path.join(subdir(opts, 'baseline'), sid + '.json'))) return true
+  // P3 (2026-06-24 audit): bash scanner 의 marked() 와 제외 집합 통일. bash 가 쓴 low_value(짧은 세션)·
+  // expired(만료 pending) marker 를 Node sweep 이 못 보고 재후보화하던 비대칭 차단 — marker 루트 공유.
+  if (fs.existsSync(path.join(subdir(opts, 'low_value'), sid + '.json'))) return true
+  if (fs.existsSync(path.join(subdir(opts, 'expired'), sid + '.json'))) return true
+  return deferBlocked(sid, opts)
+}
+function localDateStamp() {
+  const d = new Date()
+  const p = (n) => String(n).padStart(2, '0')
+  return `${d.getFullYear()}-${p(d.getMonth() + 1)}-${p(d.getDate())}`
+}
+function stampFile(opts) {
+  const base = opts && opts.root ? opts.root : (process.env.ROOKIE_ORPHAN_DIR || DEFAULT_ROOT)
+  return path.join(base, 'last-sweep-date')
+}
+export function sweepDueToday(opts) {
+  try { return fs.readFileSync(stampFile(opts), 'utf8').trim() !== localDateStamp() } catch { return true }
+}
+export function markSweptToday(opts) {
+  const f = stampFile(opts)
+  ensureDir(path.dirname(f))
+  try { fs.writeFileSync(f, localDateStamp(), { mode: 0o600 }) } catch {}
+}
+
+// ── scan 후보 수집 ────────────────────────────────────────────────────
+
+const AGE_HOLD = 60, BOOTSTRAP_T = 172800, CAP = 3, MAX_BYTES = 52428800
+const CODEX_DAYS = 7, CODEX_CAP = 20
+// SSOT: src/lib/ai/internal-marker.ts (bash/mjs 는 import 불가 → 동일 리터럴 유지).
+// drift 는 cli-provider.test.ts(TS 고정값) + sweep-core.test.mjs(mjs 고정값) 양쪽이 잡는다.
+const ROOKIE_INTERNAL_MARKER = '[[ROOKIE_INTERNAL_INVOCATION::v1]]'
+const LEGACY_SELF_REF = 'the Rookie의 기억 정리 모듈'   // 과거 fact-extraction transcript 하위호환
+const num = (envKey, dflt) => { const v = +process.env[envKey]; return Number.isFinite(v) && v > 0 ? v : dflt }
+
+export function claudeProjectDirForCwd(cwd) { return String(cwd).replace(/[^a-zA-Z0-9-]/g, '-') }
+
+// transcript jsonl 의 첫 user 메시지 content 문자열을 뽑는다 (없으면 '').
+function firstUserContent(fp) {
+  let raw
+  try { raw = fs.readFileSync(fp, 'utf8') } catch { return '' }
+  for (const line of raw.split('\n')) {
+    const t = line.trim(); if (!t) continue
+    let j; try { j = JSON.parse(t) } catch { continue }
+    const m = j.message || j
+    if (m.role !== 'user') continue
+    const c = m.content
+    if (typeof c === 'string') return c
+    if (Array.isArray(c)) return (c.find(b => b && b.type === 'text' && typeof b.text === 'string')?.text) ?? ''
+    return ''
+  }
+  return ''
+}
+
+// self-reference 판정 (P1-4): 첫 user 메시지 선두가 센티넬이거나(구조적, 신규)
+// 첫 user 메시지에 legacy 마커 포함(하위호환). 전역 4KB substring 폐기 — 본문 인용 false positive 차단.
+export function isSelfRefTranscript(fp) {
+  const first = firstUserContent(fp)
+  return first.trimStart().startsWith(ROOKIE_INTERNAL_MARKER)
+      || first.includes(LEGACY_SELF_REF)
+}
+
+export function scanClaudeCandidates({ projectDir, currentSid = '', opts = {} }) {
+  if (!projectDir || !fs.existsSync(projectDir)) return []
+  const hold = num('ROOKIE_ORPHAN_AGE_HOLD', AGE_HOLD), T = num('ROOKIE_ORPHAN_BOOTSTRAP_T', BOOTSTRAP_T)
+  const K = num('ROOKIE_ORPHAN_CAP', CAP), maxB = num('ROOKIE_ORPHAN_MAX_BYTES', MAX_BYTES)
+  const now = Date.now() / 1000
+  const isBoot = !fs.existsSync(subdir(opts, 'flushed'))
+  let names = []; try { names = fs.readdirSync(projectDir) } catch { return [] }
+  const entries = []
+  for (const name of names) {
+    if (!name.endsWith('.jsonl')) continue
+    const sid = name.slice(0, -6)
+    if (!UUID_RE.test(sid) || sid === currentSid) continue
+    const fp = path.join(projectDir, name)
+    let st; try { st = fs.lstatSync(fp) } catch { continue }
+    if (!st.isFile() || st.size > maxB) continue
+    if ((now - st.mtimeMs / 1000) < hold) continue
+    if (isMarked(sid, opts)) continue
+    if (isSelfRefTranscript(fp)) { markBaseline(sid, 'self_reference', opts); continue }
+    entries.push({ fp, sid, mtime: st.mtimeMs })
+  }
+  entries.sort((a, b) => b.mtime - a.mtime)
+  let pick
+  if (isBoot) {
+    pick = entries.filter(e => (now - e.mtime / 1000) <= T).slice(0, K)
+    const picked = new Set(pick.map(e => e.sid))
+    for (const e of entries) if (!picked.has(e.sid)) markBaseline(e.sid, 'bootstrap_old', opts)
+  } else pick = entries.slice(0, K)
+  return pick.map(e => e.fp)
+}
+
+export function scanCodexCandidates({ sessionsDir, opts = {} }) {
+  const codexOpts = { ...opts, codex: true }
+  if (!sessionsDir || !fs.existsSync(sessionsDir)) return []
+  const days = num('ROOKIE_CODEX_SWEEP_DAYS', CODEX_DAYS), cap = num('ROOKIE_CODEX_SWEEP_CAP', CODEX_CAP)
+  const hold = num('ROOKIE_ORPHAN_AGE_HOLD', AGE_HOLD), maxB = num('ROOKIE_ORPHAN_MAX_BYTES', MAX_BYTES)
+  const now = Date.now() / 1000, minMtime = now - days * 86400
+  const found = []
+  const walk = (d) => {
+    let names = []; try { names = fs.readdirSync(d) } catch { return }
+    for (const n of names) {
+      const fp = path.join(d, n); let st; try { st = fs.lstatSync(fp) } catch { continue }
+      if (st.isDirectory()) { walk(fp); continue }
+      if (!st.isFile() || !/^rollout-.*\.jsonl$/.test(n) || st.size > maxB) continue
+      if (st.mtimeMs / 1000 < minMtime || (now - st.mtimeMs / 1000) < hold) continue
+      const m = n.slice(0, -6).match(UUID_TAIL_RE); if (!m) continue
+      const sid = m[0]; if (isMarked(sid, codexOpts)) continue
+      found.push({ fp, sid, mtime: st.mtimeMs })
+    }
+  }
+  walk(sessionsDir)
+  found.sort((a, b) => b.mtime - a.mtime)
+  return found.slice(0, cap).map(e => e.fp)
+}
+
+// ── HTTP flush + recover + sweepAll ──────────────────────────────────────────
+
+const ORPHAN_BUDGET = 8, SWEEP_BUDGET = 30
+
+export async function postFlushSession({ endpoint, token, userId, body }) {
+  const ac = new AbortController(); const timer = setTimeout(() => ac.abort(), 10000)
+  try {
+    const res = await fetch(`${endpoint}/api/rookie/flush-session`, {
+      method: 'POST', signal: ac.signal,
+      headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json', 'x-rookie-user-id': userId || '' },
+      body: JSON.stringify(body),
+    })
+    const text = await res.text()
+    let json = null; try { json = JSON.parse(text) } catch {}
+    return { code: res.status, json: json ?? text }
+  } catch { return { code: 0, json: null } } finally { clearTimeout(timer) }
+}
+
+// P0.4 대칭 (bash orphan_pending_is_worthwhile): tail 추출 큐 적재 가치 판정.
+// 메시지 >3 이면 무조건 가치. 아니면 본문에 운영사실 흔적(코드블록·SQL·URL·명령·포트·경로 등)이 있어야 적재.
+const WORTHWHILE_RE = /```|\bSELECT\b|\bINSERT\b|\bUPDATE\b|\bCREATE\b|https?:\/\/|\bnpm\b|\bgit\b|\bcurl\b|\bssh\b|:\d{2,5}\b|\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+|포트|배포|결정/i
+function pendingIsWorthwhile(messages) {
+  if (!Array.isArray(messages)) return true       // 파싱 실패는 보수적으로 적재
+  if (messages.length > 3) return true
+  const text = messages.map(m => (typeof m.content === 'string' ? m.content : '')).join('\n')
+  return WORTHWHILE_RE.test(text)
+}
+
+async function recoverOne({ endpoint, token, userId, fp, sid, messages, hostname, repoUrl, repoPath, opts }) {
+  const body = { session_id: sid, hostname, repo_path: repoPath, transcript_path: fp, messages }
+  if (repoUrl) body.repo_url = repoUrl
+  const { code } = await postFlushSession({ endpoint, token, userId, body })
+  // P2 (2026-06-24 audit): marker 조건 = code 200 + messages>0 (chunks_inserted 무관). bash orphan 과 통일.
+  // messages.length 는 호출부(recoverProject/recoverCodex)가 이미 >0 보장. 멱등 재전송(chunks 0)도 marker 박아
+  // 이미 서버에 있는 세션이 다음 sweep 에서 영구 재후보화되지 않게 한다.
+  if (code === 200 && messages.length > 0) {
+    if (markFlushed(sid, opts.codex ? 'sweep' : 'orphan', messages.length, opts)) {
+      clearDeferred(sid, opts)
+      // P3: bash 와 동일한 가치 판정. 짧고 내용 없는 세션은 pending 적재 대신 low_value marker.
+      if (pendingIsWorthwhile(messages)) recordPending(sid, fp, opts)
+      else markLowValue(sid, 'short_no_content', messages.length, opts)
+      return true
+    }
+    recordDeferred(sid, 'marker_write_failed', opts)
+  }
+  return false
+}
+
+// 이슈② 재발 차단: repo 를 함수 인자로 받아 모든 후보에 공통 적용하지 않는다. 후보 transcript 마다
+// 실제 cwd 를 읽어 repoPath/repoUrl 을 산정한다(Codex recoverCodex 의 codexCwd 대칭). process.cwd()/
+// 인자 폴백 금지 — sweepAll 이 the-rookie 본진에서 전 프로젝트를 순회하므로 고정값이면 전부 흡수된다.
+export async function recoverProject({ endpoint, token, userId, projectDir, currentSid = '', hostname = os.hostname(), opts = {} }) {
+  if (!endpoint || !token) return 0
+  const deadline = Date.now() + num('ROOKIE_ORPHAN_TIME_BUDGET', ORPHAN_BUDGET) * 1000
+  const cands = scanClaudeCandidates({ projectDir, currentSid, opts })
+  let count = 0
+  for (const fp of cands) {
+    if (Date.now() >= deadline) break
+    const sid = sessionIdFromPath(fp, 'claude'); if (!sid || deferBlocked(sid, opts)) continue
+    if (isSelfRefTranscript(fp)) continue
+    const messages = parseClaudeMessages(fp); if (!messages.length) continue
+    const repoPath = claudeCwd(fp) || undefined
+    // B6-4 (spec 2026-07-11 §B6): cwd 불명·디렉토리 소실(codex R1 P1-2)은 보류 — 로컬 config 를
+    // 못 찾는다고 전역 계정으로 폴백 flush 하지 않는다. marker 미부착이라 다음 기회 재시도.
+    // 타 config 소속(로컬 .rookie/ binding 하위)은 그 config 의 sweep 몫으로 skip.
+    if (!repoPath || !fs.existsSync(repoPath)) continue
+    if (opts.activeConfigPath && configPathForCwd(repoPath) !== opts.activeConfigPath) continue
+    // B6-3 (codex R1 P1-1): 다른 계정 세션의 orphan 은 현재 토큰으로 재전송하지 않는다.
+    if (identityPinMismatch(sid, token, opts)) continue
+    const repoUrl = gitOriginOf(repoPath)
+    if (await recoverOne({ endpoint, token, userId, fp, sid, messages, hostname, repoUrl, repoPath, opts })) count++
+  }
+  return count
+}
+
+export async function recoverCodex({ endpoint, token, userId, sessionsDir, hostname = os.hostname(), opts = {} }) {
+  if (!endpoint || !token) return 0
+  const codexOpts = { ...opts, codex: true }
+  const deadline = Date.now() + num('ROOKIE_SWEEP_TIME_BUDGET', SWEEP_BUDGET) * 1000
+  const cands = scanCodexCandidates({ sessionsDir, opts: codexOpts })
+  let count = 0
+  for (const fp of cands) {
+    if (Date.now() >= deadline) break
+    const sid = sessionIdFromPath(fp, 'codex'); if (!sid || deferBlocked(sid, codexOpts)) continue
+    const messages = parseCodexMessages(fp); if (!messages.length) continue
+    const repoPath = codexCwd(fp) || undefined
+    // B6-4: Claude 경로(recoverProject)와 대칭 — cwd 불명·디렉토리 소실 보류 + 타 config 소속 skip.
+    if (!repoPath || !fs.existsSync(repoPath)) continue
+    if (opts.activeConfigPath && configPathForCwd(repoPath) !== opts.activeConfigPath) continue
+    // B6-3: identity pin 불일치 보류 (recoverProject 와 대칭).
+    if (identityPinMismatch(sid, token, opts)) continue
+    if (await recoverOne({ endpoint, token, userId, fp, sid, messages, hostname, repoPath, opts: codexOpts })) count++
+  }
+  return count
+}
+
+export async function sweepAll({ endpoint, token, userId, hostname = os.hostname(),
+  claudeProjectsDir = path.join(os.homedir(), '.claude', 'projects'),
+  codexSessionsDir = path.join(os.homedir(), '.codex', 'sessions'), opts = {} }) {
+  let claude = 0, codex = 0
+  if (endpoint && token) {
+    if (fs.existsSync(claudeProjectsDir)) {
+      for (const name of fs.readdirSync(claudeProjectsDir)) {
+        const projectDir = path.join(claudeProjectsDir, name)
+        try { if (!fs.statSync(projectDir).isDirectory()) continue } catch { continue }
+        claude += await recoverProject({ endpoint, token, userId, projectDir, hostname, opts })
+      }
+    }
+    codex = await recoverCodex({ endpoint, token, userId, sessionsDir: codexSessionsDir, hostname, opts })
+  }
+  return { total: claude + codex, claude, codex }
+}