triflux 10.9.21 → 10.9.22

package/scripts/release/prepare.mjs

@@ -0,0 +1,85 @@
+#!/usr/bin/env node
+import { writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import {
+  assertVersionSync,
+  buildReleaseNotes,
+  ensureGitClean,
+  parseArgs,
+  ROOT,
+  runCommand,
+} from "./lib.mjs";
+
+export async function prepareRelease({
+  version,
+  rootDir = ROOT,
+  allowDirty = false,
+  dryRun = true,
+  execFileSyncFn,
+} = {}) {
+  const sync = assertVersionSync({ rootDir });
+  if (!sync.ok) {
+    throw new Error(
+      "Version sync failed. Run scripts/release/check-sync.mjs first.",
+    );
+  }
+
+  const gitState = ensureGitClean({ rootDir, execFileSyncFn });
+  if (!gitState.clean && !allowDirty) {
+    throw new Error(
+      "Working tree is dirty. Re-run with --allow-dirty only for scaffolding.",
+    );
+  }
+
+  const releaseVersion = version || sync.rootVersion;
+  const commands = [
+    ["npm", ["test"]],
+    ["npm", ["run", "lint"]],
+    ["npm", ["pack", "--dry-run"]],
+  ];
+
+  if (!dryRun) {
+    for (const [command, args] of commands) {
+      runCommand(command, args, { cwd: rootDir, execFileSyncFn });
+    }
+  }
+
+  const notes = buildReleaseNotes({
+    version: releaseVersion,
+    rootDir,
+    execFileSyncFn,
+  });
+  const notesPath = join(
+    rootDir,
+    ".omx",
+    "plans",
+    `release-notes-v${releaseVersion}.md`,
+  );
+  writeFileSync(notesPath, notes, "utf8");
+
+  return {
+    ok: true,
+    version: releaseVersion,
+    clean: gitState.clean,
+    allowDirty,
+    dryRun,
+    commands: commands.map(([command, args]) => [command, ...args].join(" ")),
+    releaseNotesPath: notesPath,
+  };
+}
+
+if (process.argv[1] && fileURLToPath(import.meta.url) === process.argv[1]) {
+  const args = parseArgs(process.argv.slice(2));
+  const result = await prepareRelease({
+    version: args.version,
+    rootDir: args.root,
+    allowDirty: Boolean(args["allow-dirty"]),
+    dryRun: !args.execute,
+  });
+  if (args.json) {
+    console.log(JSON.stringify(result, null, 2));
+  } else {
+    console.log(JSON.stringify(result, null, 2));
+  }
+}

package/scripts/release/publish.mjs

@@ -0,0 +1,87 @@
+#!/usr/bin/env node
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { assertVersionSync, parseArgs, ROOT, runCommand } from "./lib.mjs";
+
+export async function publishRelease({
+  version,
+  rootDir = ROOT,
+  channel = "stable",
+  dryRun = true,
+  createGithubRelease = true,
+  execFileSyncFn,
+} = {}) {
+  const sync = assertVersionSync({ rootDir });
+  if (!sync.ok) {
+    throw new Error("Version sync failed. Refusing to publish.");
+  }
+
+  const releaseVersion = version || sync.rootVersion;
+  const npmTag = channel === "canary" ? "canary" : "latest";
+  const notesPath = join(
+    rootDir,
+    ".omx",
+    "plans",
+    `release-notes-v${releaseVersion}.md`,
+  );
+  const steps = [
+    {
+      label: "npm publish",
+      command: "npm",
+      args: ["publish", "--tag", npmTag],
+    },
+    { label: "git tag", command: "git", args: ["tag", `v${releaseVersion}`] },
+    {
+      label: "git push",
+      command: "git",
+      args: ["push", "origin", "HEAD", "--tags"],
+    },
+  ];
+
+  if (createGithubRelease) {
+    steps.push({
+      label: "gh release create",
+      command: "gh",
+      args: [
+        "release",
+        "create",
+        `v${releaseVersion}`,
+        "--title",
+        `v${releaseVersion}`,
+        "--notes-file",
+        notesPath,
+      ],
+    });
+  }
+
+  if (!dryRun) {
+    for (const step of steps) {
+      runCommand(step.command, step.args, { cwd: rootDir, execFileSyncFn });
+    }
+  }
+
+  return {
+    ok: true,
+    version: releaseVersion,
+    channel,
+    npmTag,
+    dryRun,
+    notesPath,
+    steps: steps.map((step) => ({
+      label: step.label,
+      command: [step.command, ...step.args].join(" "),
+    })),
+  };
+}
+
+if (process.argv[1] && fileURLToPath(import.meta.url) === process.argv[1]) {
+  const args = parseArgs(process.argv.slice(2));
+  const result = await publishRelease({
+    version: args.version,
+    rootDir: args.root,
+    channel: args.channel || "stable",
+    dryRun: !args.execute,
+    createGithubRelease: !args["skip-gh-release"],
+  });
+  console.log(JSON.stringify(result, null, 2));
+}

package/scripts/release/verify.mjs

@@ -0,0 +1,81 @@
+#!/usr/bin/env node
+import { execFileSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import { assertVersionSync, parseArgs, ROOT } from "./lib.mjs";
+
+export async function verifyRelease({
+  version,
+  rootDir = ROOT,
+  dryRun = true,
+  execFileSyncFn = execFileSync,
+} = {}) {
+  const sync = assertVersionSync({ rootDir });
+  if (!sync.ok) {
+    throw new Error("Version sync failed. Fix metadata before verify.");
+  }
+  const releaseVersion = version || sync.rootVersion;
+  const checks = [
+    {
+      name: "version-sync",
+      ok: true,
+      detail: `repo metadata matches ${releaseVersion}`,
+    },
+  ];
+
+  if (!dryRun) {
+    const npmVersion = execFileSyncFn("npm", ["view", "triflux", "version"], {
+      cwd: rootDir,
+      encoding: "utf8",
+    }).trim();
+    checks.push({
+      name: "npm-view",
+      ok: npmVersion === releaseVersion,
+      detail: npmVersion,
+    });
+
+    const ghRelease = execFileSyncFn(
+      "gh",
+      ["release", "view", `v${releaseVersion}`, "--json", "tagName"],
+      {
+        cwd: rootDir,
+        encoding: "utf8",
+      },
+    ).trim();
+    checks.push({
+      name: "github-release",
+      ok: ghRelease.length > 0,
+      detail: ghRelease,
+    });
+  } else {
+    checks.push(
+      {
+        name: "npm-view",
+        ok: null,
+        detail: `would run: npm view triflux version`,
+      },
+      {
+        name: "github-release",
+        ok: null,
+        detail: `would run: gh release view v${releaseVersion} --json tagName`,
+      },
+    );
+  }
+
+  return {
+    ok: checks.every((check) => check.ok !== false),
+    version: releaseVersion,
+    dryRun,
+    checks,
+  };
+}
+
+if (process.argv[1] && fileURLToPath(import.meta.url) === process.argv[1]) {
+  const args = parseArgs(process.argv.slice(2));
+  const result = await verifyRelease({
+    version: args.version,
+    rootDir: args.root,
+    dryRun: !args.execute,
+  });
+  console.log(JSON.stringify(result, null, 2));
+  process.exitCode = result.ok ? 0 : 1;
+}

package/scripts/release/version-manifest.json

@@ -0,0 +1,26 @@
+{
+  "canonicalFile": "package.json",
+  "canonicalPath": ["version"],
+  "targets": [
+    {
+      "file": "package.json",
+      "paths": [["version"]]
+    },
+    {
+      "file": "packages/triflux/package.json",
+      "paths": [["version"]]
+    },
+    {
+      "file": ".claude-plugin/plugin.json",
+      "paths": [["version"]]
+    },
+    {
+      "file": ".claude-plugin/marketplace.json",
+      "paths": [["version"], ["plugins", 0, "version"]]
+    },
+    {
+      "file": "package-lock.json",
+      "paths": [["version"], ["packages", "", "version"]]
+    }
+  ]
+}

package/scripts/remote-spawn.mjs

@@ -591,7 +591,7 @@ function rewritePromptPaths(prompt, stagedFiles) {
   return rewritten;
 }
 
-function spawnLocalFallback(args, claudePath, prompt) {
+async function spawnLocalFallback(args, claudePath, prompt) {
   const dir = args.dir ? resolve(args.dir) : process.cwd();
 
   if (!IS_WINDOWS_LOCAL) {
@@ -626,7 +626,7 @@ function spawnLocalFallback(args, claudePath, prompt) {
   }
 }
 
-function spawnRemoteFallback(args, promptContext) {
+async function spawnRemoteFallback(args, promptContext) {
   const { host } = args;
   if (!host) {
     console.error("--host required for remote spawn");
@@ -999,7 +999,7 @@ function listSpawnSessions() {
   }
 }
 
-function openAttachTab(sessionName, title = null) {
+async function openAttachTab(sessionName, title = null) {
   if (IS_WINDOWS_LOCAL) {
     const wtArgs = title
     try {

package/scripts/setup.mjs

@@ -64,6 +64,23 @@ const REQUIRED_CODEX_PROFILES = [
 
 const HUD_SYNC_EXCLUDES = new Set(["omc-hud.mjs", "omc-hud.mjs.bak"]);
 
+/**
+ * scripts/lib/*.mjs 자동 스캔.
+ * 수동 리스트 대신 glob으로 탐색하여 lib 파일 추가 시 sync 누락 방지.
+ */
+function scanLibFiles(pluginRoot, claudeDir) {
+  const libDir = join(pluginRoot, "scripts", "lib");
+  if (!existsSync(libDir)) return [];
+  return readdirSync(libDir)
+    .sort()
+    .filter((f) => f.endsWith(".mjs"))
+    .map((f) => ({
+      src: join(libDir, f),
+      dst: join(claudeDir, "scripts", "lib", f),
+      label: `lib/${f}`,
+    }));
+}
+
 /**
  * hub/workers/*.mjs + hub/ 루트의 worker 의존성 파일을 자동 스캔.
  * 수동 리스트 대신 glob으로 탐색하여 파일 추가 시 sync 누락 방지.
@@ -173,21 +190,7 @@ const SYNC_MAP = [
     dst: join(CLAUDE_DIR, "scripts", "tfx-batch-stats.mjs"),
     label: "tfx-batch-stats.mjs",
   },
-  {
-    src: join(PLUGIN_ROOT, "scripts", "lib", "mcp-filter.mjs"),
-    dst: join(CLAUDE_DIR, "scripts", "lib", "mcp-filter.mjs"),
-    label: "lib/mcp-filter.mjs",
-  },
-  {
-    src: join(PLUGIN_ROOT, "scripts", "lib", "mcp-server-catalog.mjs"),
-    dst: join(CLAUDE_DIR, "scripts", "lib", "mcp-server-catalog.mjs"),
-    label: "lib/mcp-server-catalog.mjs",
-  },
-  {
-    src: join(PLUGIN_ROOT, "scripts", "lib", "keyword-rules.mjs"),
-    dst: join(CLAUDE_DIR, "scripts", "lib", "keyword-rules.mjs"),
-    label: "lib/keyword-rules.mjs",
-  },
+  ...scanLibFiles(PLUGIN_ROOT, CLAUDE_DIR),
   {
     src: join(PLUGIN_ROOT, "hub", "team", "agent-map.json"),
     dst: join(CLAUDE_DIR, "hub", "team", "agent-map.json"),

package/scripts/tfx-route.sh

@@ -1193,12 +1193,14 @@ resolve_mcp_policy() {
   fi
 
   available_servers=$(get_cached_servers "$CLI_TYPE")
-  if [[ "$CLI_TYPE" == "codex" && "${TFX_CODEX_TRANSPORT:-auto}" != "mcp" ]]; then
-    available_servers=""
+  # Codex exec 모드에서도 config.toml의 MCP 서버를 전부 시작하므로,
+  # transport 모드와 관계없이 registered servers를 전달하여 불필요한 서버를
+  # enabled=false로 비활성화해야 한다.
+  # 캐시가 비어있으면 config.toml에서 직접 서버 목록을 추출한다.
+  if [[ -z "$available_servers" && "$CLI_TYPE" == "codex" && -f "$_CODEX_CONFIG" ]]; then
+    available_servers=$(sed -n 's/^\[mcp_servers\.\([^].]*\)\]$/\1/p' "$_CODEX_CONFIG" 2>/dev/null \
+      | sort -u | tr '\n' ',' | sed 's/,$//')
   fi
-  # Codex 0.115+: 미등록 서버에 config override(enabled=true/false 모두)를 보내면
-  # "invalid transport" 에러 발생. 캐시 비어있으면 빈 문자열이 유지되어
-  # mcp-filter가 override를 생성하지 않는다.
 
   local -a cmd=(
     "$NODE_BIN" "$filter_script" shell
@@ -1398,6 +1400,53 @@ resolve_codex_mcp_script() {
     "$sd/hub/workers/codex-mcp.mjs" "$sd/../hub/workers/codex-mcp.mjs"
 }
 
+## ── Config Swap: 프로필별 MCP 서버 필터링 ──
+# codex exec는 -c flag로 MCP enabled/disabled를 제어할 수 없다.
+# config.toml을 원자적으로 교체하여 불필요한 서버 시작을 방지한다.
+_codex_config_swap() {
+  local action="$1"  # "filter" or "restore"
+  local config="$_CODEX_CONFIG"
+  local backup="${config}.pre-exec"
+
+  if [[ "$action" == "filter" && -f "$config" ]]; then
+    # MCP 프로필에서 허용된 서버 목록 추출
+    local allowed_pat=""
+    for flag in "${CODEX_CONFIG_FLAGS[@]}"; do
+      if [[ "$flag" =~ mcp_servers\.([^.]+)\.enabled=true ]]; then
+        [[ -n "$allowed_pat" ]] && allowed_pat="${allowed_pat}|"
+        allowed_pat="${allowed_pat}${BASH_REMATCH[1]}"
+      fi
+    done
+
+    # 백업 생성 (이미 있으면 다른 워커가 swap 중 — 건드리지 않음)
+    if [[ -f "$backup" ]]; then
+      echo "[tfx-route] config.toml swap 스킵: 다른 워커가 사용 중" >&2
+      return 0
+    fi
+    cp "$config" "$backup"
+
+    # awk로 필터링: 비허용 MCP 서버 섹션 제거, 나머지 그대로 유지
+    awk -v keep="$allowed_pat" '
+      BEGIN { skip=0 }
+      /^\[mcp_servers\./ {
+        name=$0; gsub(/^\[mcp_servers\./, "", name); gsub(/[\].].*/, "", name)
+        if (keep == "" || name !~ "^(" keep ")$") { skip=1; next }
+        else { skip=0 }
+      }
+      /^\[/ && !/^\[mcp_servers\./ { skip=0 }
+      !skip { print }
+    ' "$backup" > "$config"
+
+    local kept=0
+    [[ -n "$allowed_pat" ]] && kept=$(echo "$allowed_pat" | tr '|' '\n' | wc -l | tr -d ' ')
+    echo "[tfx-route] config.toml swap: ${kept}개 MCP 서버만 활성" >&2
+
+  elif [[ "$action" == "restore" && -f "$backup" ]]; then
+    mv "$backup" "$config" 2>/dev/null
+    echo "[tfx-route] config.toml 복원 완료" >&2
+  fi
+}
+
 run_codex_exec() {
   local prompt="$1"
   local use_tee_flag="$2"
@@ -1405,9 +1454,8 @@ run_codex_exec() {
   local worker_pid
   local -a codex_args=()
   read -r -a codex_args <<< "$CLI_ARGS"
-  if [[ ${#CODEX_CONFIG_FLAGS[@]} -gt 0 ]]; then
-    codex_args+=("${CODEX_CONFIG_FLAGS[@]}")
-  fi
+  # -c flags는 codex exec에서 MCP enabled 제어 불가 — config swap으로 대체
+  # config swap은 codex 블록 최상단(_codex_config_swap "filter")에서 실행됨
 
   if [[ "$use_tee_flag" == "true" ]]; then
     "$TIMEOUT_BIN" "$TIMEOUT_SEC" "$CLI_CMD" "${codex_args[@]}" "$prompt" < /dev/null 2>"$STDERR_LOG" | tee "$STDOUT_LOG" &
@@ -1656,6 +1704,12 @@ FALLBACK_EOF
   fi
 
   if [[ "$CLI_TYPE" == "codex" ]]; then
+    # Config swap: 프로필에 맞는 MCP 서버만 남긴 임시 config 적용
+    # run_codex_mcp / run_codex_exec 어느 경로든 적용되도록 최상단에서 실행
+    _codex_config_swap "filter"
+    # swap 후 config override 플래그 클리어 — 제거된 서버에 override 보내면 "invalid transport" 에러
+    CODEX_CONFIG_FLAGS=()
+    CODEX_CONFIG_JSON="{}"
     codex_transport_effective="exec"
     if [[ "$TFX_CODEX_TRANSPORT" != "exec" ]]; then
       run_codex_mcp "$FULL_PROMPT" "$use_tee" || exit_code=$?
@@ -1676,6 +1730,8 @@ FALLBACK_EOF
       codex_transport_effective="exec"
     fi
     echo "[tfx-route] codex_transport_effective=$codex_transport_effective" >&2
+    # Config swap 복원 (성공/실패 관계없이)
+    _codex_config_swap "restore"
 
   elif [[ "$CLI_TYPE" == "gemini" ]]; then
     local gemini_model