@triflux/remote 10.86.1 → 10.88.0

package/scripts/lib/codex-profile-config.mjs

@@ -9,6 +9,11 @@ import {
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import { writeRotatedBackup } from "./backup-rotation.mjs";
+import {
+  modelEffortFromProfile,
+  normalizeCodexProfileName,
+  resolveCodexModelEffort,
+} from "./model-effort.mjs";
 import {
   CODEX_FAMILY_PROFILES,
   modelFamilyPaths,
@@ -16,46 +21,42 @@ import {
   writeModelFile,
 } from "./model-family-resolver.mjs";
 
-const EFFORT_BY_SUFFIX = {
-  ultra: "ultra",
-  max: "max",
-  xhigh: "xhigh",
-  high: "high",
-  med: "medium",
-  medium: "medium",
-  low: "low",
-};
-
-const LEGACY_CANONICAL_PROFILE_ALIASES = Object.freeze({
-  gpt56_sol_xhigh: "astra_xhigh",
-  gpt56_sol_max: "astra_max",
-  gpt56_sol_ultra: "astra_ultra",
-  gpt56_terra_high: "sol_high",
-  gpt56_terra_med: "sol_med",
-});
+export { normalizeCodexProfileName };
 
-export function normalizeCodexProfileName(profileName) {
-  const normalized = String(profileName ?? "").trim();
-  const legacy = LEGACY_CANONICAL_PROFILE_ALIASES[normalized];
-  if (legacy) return legacy;
-  const familyName = normalized.replace(/^gpt\d+_(sol|astra|luna)_/, "$1_");
-  return Object.hasOwn(CODEX_FAMILY_PROFILES, familyName)
-    ? familyName
-    : normalized;
+export function managedCodexProfileContents(opts = {}) {
+  const { profiles, families } = resolveModelFamilies("codex", opts);
+  const contents = {};
+  for (const [name, { model, effort }] of Object.entries(profiles)) {
+    contents[name] =
+      `model = "${model}"\nmodel_reasoning_effort = "${effort}"\n`;
+  }
+  for (const [family, { model }] of Object.entries(families)) {
+    contents[family] = `model = "${model}"\n`;
+  }
+  return { profiles, contents };
 }
 
 export function ensureManagedCodexProfiles(opts = {}) {
   const { codexHome } = modelFamilyPaths(opts);
-  const { profiles } = resolveModelFamilies("codex", opts);
+  const { profiles, contents } = managedCodexProfileContents(opts);
   let changed = 0;
-  for (const [name, { model, effort }] of Object.entries(profiles)) {
-    if (
-      writeModelFile(
-        join(codexHome, `${name}.config.toml`),
-        `model = "${model}"\nmodel_reasoning_effort = "${effort}"\n`,
-      )
-    )
-      changed++;
+  const families = new Set(
+    Object.values(CODEX_FAMILY_PROFILES).map(({ family }) => family),
+  );
+  for (const [name, content] of Object.entries(contents)) {
+    const path = join(codexHome, `${name}.config.toml`);
+    if (families.has(name) && existsSync(path)) {
+      const existing = readFileSync(path, "utf8");
+      if (existing !== content) {
+        const backup = writeRotatedBackup(path, existing, {
+          label: "bak-model-family",
+          suffix: stamp(),
+          mode: privateFileMode(path),
+        });
+        opts.notice?.(`Codex 가족 프로필 백업: ${backup}`);
+      }
+    }
+    if (writeModelFile(path, content)) changed++;
   }
   return { changed, profiles };
 }
@@ -72,45 +73,25 @@ function readProfileScalar(raw, key) {
   return value || null;
 }
 
-/**
- * Resolve a Codex effort profile name (e.g. "sol_high") to the `-c key=value`
- * config overrides that `codex exec` accepts, so the headless CLI lanes can
- * select a profile WITHOUT `codex exec --profile <name>`. codex 0.134+ rejects
- * `--profile X` whenever config.toml still contains an inline `[profiles.X]`
- * table (which codex itself re-injects when it rewrites config.toml), so the
- * `-c` form is immune and needs no config mutation / sanitize race.
- *
- * SSOT = the per-profile file `~/.codex/<name>.config.toml` written by
- * `tfx setup`; falls back to deriving the effort from the `<...>_<effort>`
- * naming convention when the file is absent. Returns the keys that resolve, in
- * `key="value"` TOML-scalar form ready to be shell-quoted by the caller.
- *
- * @param {string} profileName
- * @param {{ codexHome?: string }} [opts]
- * @returns {string[]} e.g. ['model="gpt-6.1-sol"', 'model_reasoning_effort="high"']
- */
+// 관리 이름의 effort는 변환 표가 정한다. custom 파일은 ultra 제한 판정에 사용한다.
 export function resolveCodexProfileConfigValues(profileName, opts = {}) {
   if (typeof profileName !== "string" || !profileName) {
     return { model: null, effort: null };
   }
   const normalizedProfileName = normalizeCodexProfileName(profileName);
+  const managed = modelEffortFromProfile("codex", normalizedProfileName);
   const codexHome =
     opts.codexHome || process.env.CODEX_HOME || join(homedir(), ".codex");
   let model = null;
-  let effort = null;
+  let effort = managed ? resolveCodexModelEffort(managed, opts).effort : null;
   try {
     const raw = readFileSync(
       join(codexHome, `${normalizedProfileName}.config.toml`),
       "utf8",
     );
     model = readProfileScalar(raw, "model");
-    effort = readProfileScalar(raw, "model_reasoning_effort");
-  } catch {
-    const suffix = /_(ultra|max|xhigh|high|med|medium|low)$/.exec(
-      normalizedProfileName,
-    );
-    if (suffix) effort = EFFORT_BY_SUFFIX[suffix[1]] || null;
-  }
+    if (!managed) effort = readProfileScalar(raw, "model_reasoning_effort");
+  } catch {}
   return { model, effort };
 }
 

package/scripts/lib/doctor-env-checks.mjs

@@ -1,4 +1,381 @@
 import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import {
+  chmodSync,
+  copyFileSync,
+  existsSync,
+  readFileSync,
+  realpathSync,
+  renameSync,
+  unlinkSync,
+  writeFileSync,
+} from "node:fs";
+
+const defaultFs = {
+  chmodSync,
+  copyFileSync,
+  existsSync,
+  readFileSync,
+  realpathSync,
+  renameSync,
+  unlinkSync,
+  writeFileSync,
+};
+
+// ARM64 Mach-O agy 바이너리의 time.After 함수와 유휴 대기 호출부 시그니처 (#1022 peer-wake 패치)
+export const AGY_TIME_AFTER_SIG = Buffer.from(
+  "900b40f9ff6330eb29010054fe0f1ef8fd831ff8fd2300d16affff97000040f9fd835ff8fe0742f8c0035fd6",
+  "hex",
+);
+export const AGY_PEER_WAKE_ORIG_CALL = Buffer.from(
+  "e13740f9220041a9423040f9210c40a9e40302aae20303aa80003fd6",
+  "hex",
+);
+export const AGY_PEER_WAKE_PATCH_PREFIX = Buffer.from(
+  "1f2003d51f2003d51f2003d51f2003d5004099524073a772",
+  "hex",
+);
+export const AGY_PEER_WAKE_ORIG_STP = Buffer.from("e08708a9", "hex");
+export const AGY_PEER_WAKE_PATCH_STP = Buffer.from("e0ff08a9", "hex");
+const AGY_PEER_WAKE_STP_DELTA = 0x38;
+
+export function encodeArm64Bl(pcOffset, targetOffset) {
+  const delta = targetOffset - pcOffset;
+  if (delta % 4 !== 0 || delta < -0x8000000 || delta > 0x7fffffc) {
+    return null;
+  }
+  const imm26 = (delta >> 2) & 0x03ffffff;
+  const out = Buffer.alloc(4);
+  out.writeUInt32LE((0x94000000 | imm26) >>> 0, 0);
+  return out;
+}
+
+function findUniqueOffset(buf, pattern) {
+  const first = buf.indexOf(pattern);
+  if (first === -1) return -1;
+  if (buf.indexOf(pattern, first + 1) !== -1) return -2;
+  return first;
+}
+
+export function inspectAgyPeerWakePatch({
+  agyPath,
+  platform = process.platform,
+  arch = process.arch,
+  fs = defaultFs,
+} = {}) {
+  if (platform !== "darwin" || arch !== "arm64") {
+    return { ok: true, status: "skipped", platform, arch };
+  }
+  if (!agyPath) {
+    return { ok: true, status: "skipped", reason: "agy-not-installed" };
+  }
+  let resolvedPath = agyPath;
+  try {
+    resolvedPath = fs.realpathSync(agyPath);
+  } catch {
+    return { ok: true, status: "skipped", reason: "agy-not-found" };
+  }
+  if (!fs.existsSync(resolvedPath)) {
+    return { ok: true, status: "skipped", reason: "agy-not-found" };
+  }
+
+  const patchJsonPath = `${resolvedPath}.patch.json`;
+  let buf;
+  try {
+    buf = fs.readFileSync(resolvedPath);
+  } catch (error) {
+    return {
+      ok: false,
+      status: "error",
+      patchable: false,
+      path: resolvedPath,
+      patchJsonPath,
+      reason: "read-failed",
+      message: error?.message || String(error),
+    };
+  }
+  const sha256 = createHash("sha256").update(buf).digest("hex");
+  const timeAfterOffset = findUniqueOffset(buf, AGY_TIME_AFTER_SIG);
+  if (timeAfterOffset < 0) {
+    return {
+      ok: false,
+      status: "unsupported",
+      patchable: false,
+      path: resolvedPath,
+      patchJsonPath,
+      sha256,
+      reason:
+        timeAfterOffset === -2
+          ? "ambiguous-time-after-signature"
+          : "time-after-signature-not-found",
+    };
+  }
+
+  const patchedOffset = findUniqueOffset(buf, AGY_PEER_WAKE_PATCH_PREFIX);
+  if (
+    patchedOffset >= 0 &&
+    patchedOffset + AGY_PEER_WAKE_STP_DELTA + 4 <= buf.length
+  ) {
+    const expectedBl = encodeArm64Bl(
+      patchedOffset + AGY_PEER_WAKE_PATCH_PREFIX.length,
+      timeAfterOffset,
+    );
+    const actualBl = buf.subarray(
+      patchedOffset + AGY_PEER_WAKE_PATCH_PREFIX.length,
+      patchedOffset + AGY_PEER_WAKE_PATCH_PREFIX.length + 4,
+    );
+    const actualStp = buf.subarray(
+      patchedOffset + AGY_PEER_WAKE_STP_DELTA,
+      patchedOffset + AGY_PEER_WAKE_STP_DELTA + 4,
+    );
+    if (
+      expectedBl &&
+      actualBl.equals(expectedBl) &&
+      actualStp.equals(AGY_PEER_WAKE_PATCH_STP)
+    ) {
+      let metadataOk = false;
+      if (fs.existsSync(patchJsonPath)) {
+        try {
+          const meta = JSON.parse(fs.readFileSync(patchJsonPath, "utf8"));
+          metadataOk =
+            meta?.sha256 === sha256 &&
+            Array.isArray(meta?.patches) &&
+            meta.patches.includes("peer-wake");
+        } catch {
+          metadataOk = false;
+        }
+      }
+      if (metadataOk) {
+        return {
+          ok: true,
+          status: "patched",
+          patchable: false,
+          binaryPatched: true,
+          path: resolvedPath,
+          patchJsonPath,
+          sha256,
+          callOffset: patchedOffset,
+          timeAfterOffset,
+        };
+      }
+      return {
+        ok: false,
+        status: "metadata-outdated",
+        patchable: true,
+        binaryPatched: true,
+        path: resolvedPath,
+        patchJsonPath,
+        sha256,
+        callOffset: patchedOffset,
+        timeAfterOffset,
+        fix: "tfx doctor --fix",
+      };
+    }
+  }
+
+  const origOffset = findUniqueOffset(buf, AGY_PEER_WAKE_ORIG_CALL);
+  if (
+    origOffset >= 0 &&
+    origOffset + AGY_PEER_WAKE_STP_DELTA + 4 <= buf.length
+  ) {
+    const expectedBl = encodeArm64Bl(
+      origOffset + AGY_PEER_WAKE_PATCH_PREFIX.length,
+      timeAfterOffset,
+    );
+    const actualStp = buf.subarray(
+      origOffset + AGY_PEER_WAKE_STP_DELTA,
+      origOffset + AGY_PEER_WAKE_STP_DELTA + 4,
+    );
+    if (expectedBl && actualStp.equals(AGY_PEER_WAKE_ORIG_STP)) {
+      return {
+        ok: false,
+        status: "unpatched",
+        patchable: true,
+        binaryPatched: false,
+        path: resolvedPath,
+        patchJsonPath,
+        sha256,
+        callOffset: origOffset,
+        timeAfterOffset,
+        fix: "tfx doctor --fix",
+      };
+    }
+  }
+
+  return {
+    ok: false,
+    status: "unsupported",
+    patchable: false,
+    path: resolvedPath,
+    patchJsonPath,
+    sha256,
+    reason:
+      origOffset === -2
+        ? "ambiguous-call-site-signature"
+        : "call-site-signature-not-found",
+  };
+}
+
+export function applyAgyPeerWakePatch({
+  agyPath,
+  version,
+  platform = process.platform,
+  arch = process.arch,
+  fs = defaultFs,
+  execFileSyncFn = execFileSync,
+} = {}) {
+  const state = inspectAgyPeerWakePatch({ agyPath, platform, arch, fs });
+  if (state.status === "patched" || state.status === "skipped") {
+    return { ...state, changed: false };
+  }
+  if (!state.patchable) {
+    return { ...state, ok: false, changed: false };
+  }
+
+  let resolvedVersion = version || "";
+  if (!resolvedVersion) {
+    try {
+      const out = String(
+        execFileSyncFn(state.path, ["--version"], {
+          encoding: "utf8",
+          timeout: 5000,
+          stdio: ["ignore", "pipe", "ignore"],
+        }) || "",
+      );
+      resolvedVersion = out.match(/\b(\d+\.\d+\.\d+)\b/)?.[1] || "unknown";
+    } catch {
+      resolvedVersion = "unknown";
+    }
+  }
+
+  let finalSha256 = state.sha256;
+  let backupEntry = null;
+  if (state.status === "unpatched") {
+    const rawBuf = fs.readFileSync(state.path);
+    const currentSha256 = createHash("sha256").update(rawBuf).digest("hex");
+    if (currentSha256 !== state.sha256) {
+      throw new Error("agy binary changed during patch preparation");
+    }
+
+    let backupKey = `${resolvedVersion}-orig`;
+    let backupPath = `${state.path}.bak-${backupKey}`;
+    if (fs.existsSync(backupPath)) {
+      const existingBackupSha = createHash("sha256")
+        .update(fs.readFileSync(backupPath))
+        .digest("hex");
+      if (existingBackupSha !== state.sha256) {
+        backupKey = `${resolvedVersion}-orig-${state.sha256.slice(0, 8)}`;
+        backupPath = `${state.path}.bak-${backupKey}`;
+        if (fs.existsSync(backupPath)) {
+          const suffixBackupSha = createHash("sha256")
+            .update(fs.readFileSync(backupPath))
+            .digest("hex");
+          if (suffixBackupSha !== state.sha256) {
+            throw new Error(`agy backup conflict: ${backupPath}`);
+          }
+        } else {
+          fs.copyFileSync(state.path, backupPath);
+        }
+      }
+    } else {
+      fs.copyFileSync(state.path, backupPath);
+    }
+    backupEntry = { key: backupKey, path: backupPath, sha256: state.sha256 };
+
+    const buf = Buffer.from(rawBuf);
+    const expectedBl = encodeArm64Bl(
+      state.callOffset + AGY_PEER_WAKE_PATCH_PREFIX.length,
+      state.timeAfterOffset,
+    );
+    AGY_PEER_WAKE_PATCH_PREFIX.copy(buf, state.callOffset);
+    expectedBl.copy(buf, state.callOffset + AGY_PEER_WAKE_PATCH_PREFIX.length);
+    AGY_PEER_WAKE_PATCH_STP.copy(
+      buf,
+      state.callOffset + AGY_PEER_WAKE_STP_DELTA,
+    );
+
+    const tmpPath = `${state.path}.tmp-${process.pid}`;
+    fs.writeFileSync(tmpPath, buf, { mode: 0o755 });
+    try {
+      fs.chmodSync(tmpPath, 0o755);
+      execFileSyncFn("codesign", ["-f", "-s", "-", tmpPath], {
+        stdio: "ignore",
+        timeout: 30000,
+      });
+      const preRenameSha256 = createHash("sha256")
+        .update(fs.readFileSync(state.path))
+        .digest("hex");
+      if (preRenameSha256 !== state.sha256) {
+        throw new Error("agy binary changed before atomic replace");
+      }
+      fs.renameSync(tmpPath, state.path);
+    } catch (error) {
+      try {
+        fs.unlinkSync(tmpPath);
+      } catch {}
+      throw error;
+    }
+    finalSha256 = createHash("sha256")
+      .update(fs.readFileSync(state.path))
+      .digest("hex");
+  }
+
+  let existingMeta = {};
+  if (fs.existsSync(state.patchJsonPath)) {
+    try {
+      const parsed = JSON.parse(fs.readFileSync(state.patchJsonPath, "utf8"));
+      existingMeta =
+        parsed && typeof parsed === "object" && !Array.isArray(parsed)
+          ? parsed
+          : {};
+    } catch {
+      existingMeta = {};
+    }
+  }
+  const patches = Array.isArray(existingMeta.patches)
+    ? [...new Set([...existingMeta.patches, "peer-wake"])]
+    : ["peer-wake"];
+  const backups = {
+    ...(backupEntry
+      ? {
+          [backupEntry.key]: {
+            path: backupEntry.path,
+            sha256: backupEntry.sha256,
+          },
+        }
+      : {}),
+    ...(existingMeta.backups && typeof existingMeta.backups === "object"
+      ? existingMeta.backups
+      : {}),
+  };
+  const nextMeta = {
+    ...existingMeta,
+    version:
+      resolvedVersion !== "unknown"
+        ? resolvedVersion
+        : existingMeta.version || "unknown",
+    sha256: finalSha256,
+    patches,
+    appliedAt: new Date().toISOString(),
+    backups,
+  };
+  fs.writeFileSync(
+    state.patchJsonPath,
+    `${JSON.stringify(nextMeta, null, 2)}\n`,
+    "utf8",
+  );
+
+  return {
+    ok: true,
+    status: "patched",
+    changed: true,
+    binaryPatched: true,
+    previousStatus: state.status,
+    path: state.path,
+    patchJsonPath: state.patchJsonPath,
+    sha256: finalSha256,
+  };
+}
 
 export function commandExists(name) {
   try {

package/scripts/lib/gemini-profiles.mjs

@@ -1,5 +1,6 @@
 import { copyFileSync, existsSync, readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
+import { normalizeGeminiProfileName } from "./model-effort.mjs";
 import {
   AGY_FAMILY_PROFILES,
   modelFamilyPaths,
@@ -17,11 +18,7 @@ const DEFAULT_GEMINI_PROFILES = {
   ),
 };
 
-export function normalizeGeminiProfileName(name) {
-  const raw = String(name ?? "").trim();
-  // Flash 가족은 뺐다. 옛 Flash 이름은 effort 와 상관없이 더 빠른 Argon Low 로 보낸다.
-  return raw.replace(/^flash\d*(?:_(?:low|high))?$/, "argon_low");
-}
+export { normalizeGeminiProfileName };
 
 // ── 용도별 effort (SSOT) ──
 // Argon 가족 안에서 역할에 따라 effort 를 나눈다. 키는 tfx 에이전트/역할 이름

package/scripts/lib/mcp-filter.mjs

@@ -5,6 +5,7 @@
 import { readFileSync } from "node:fs";
 import process from "node:process";
 import { fileURLToPath } from "node:url";
+import { isJevEnabled, judgeMcpSelection } from "@triflux/core/hub/lib/jev-addon.mjs";
 import { CORE_SERVERS, readManifest } from "./mcp-manifest.mjs";
 import {
   DOMAIN_TAG_KEYWORDS,
@@ -639,7 +640,11 @@ export function getCodexMcpConfig(options = {}) {
   if (registeredServers.length === 0) {
     return { mcp_servers: {} };
   }
-  const allowedServers = new Set(resolveAllowedServers(options));
+  const allowedServers = new Set(
+    Array.isArray(options.allowedServers)
+      ? parseAvailableServers(options.allowedServers)
+      : resolveAllowedServers(options),
+  );
   const resolvedProfile = resolveMcpProfile(
     options.agentType,
     options.requestedProfile,
@@ -731,9 +736,17 @@ export function buildMcpPolicy(options = {}) {
   const hint = buildPromptHint(resolvedOptions);
 
   // 플러그인 서버는 transport 설정이 없어 CLI override를 받으면 부팅이 실패한다.
+  const configServers = codexServersFromConfig(options.codexConfig);
+  const registeredServers =
+    configServers.length > 0
+      ? configServers
+      : options.registeredServers !== undefined
+        ? parseAvailableServers(options.registeredServers)
+        : [];
   const codexOptions = {
     ...resolvedOptions,
-    availableServers: codexServersFromConfig(options.codexConfig),
+    availableServers: registeredServers,
+    allowedServers,
   };
 
   return {
@@ -749,6 +762,74 @@ export function buildMcpPolicy(options = {}) {
   };
 }
 
+export async function buildMcpPolicyWithJev(options = {}, jevOptions = {}) {
+  const basePolicy = buildMcpPolicy(options);
+  if (!isJevEnabled(jevOptions)) return basePolicy;
+  const taskText = String(options.taskText || "").trim();
+  if (!taskText) return basePolicy;
+
+  const isAutoProfile =
+    !options.requestedProfile || options.requestedProfile === "auto";
+  if (!isAutoProfile && options.requestedProfile === "none") {
+    return basePolicy;
+  }
+
+  const candidateServers = basePolicy.allowedServers;
+  if (candidateServers.length === 0) return basePolicy;
+
+  const selection = await judgeMcpSelection(
+    {
+      taskText,
+      agentType: options.agentType || basePolicy.resolvedProfile,
+      availableServers: candidateServers,
+    },
+    jevOptions,
+  );
+  if (!selection || !Array.isArray(selection.neededMcpServers))
+    return basePolicy;
+
+  const narrowedAvailable = selection.neededMcpServers.filter((server) =>
+    basePolicy.allowedServers.includes(server),
+  );
+  if (narrowedAvailable.length === 0) {
+    return {
+      ...buildMcpPolicy({
+        ...options,
+        requestedProfile: "none",
+        registeredServers:
+          options.registeredServers ??
+          (options.codexConfig === undefined
+            ? options.availableServers
+            : undefined),
+      }),
+      requestedProfile: options.requestedProfile || "auto",
+    };
+  }
+
+  const nextProfile =
+    isAutoProfile &&
+    selection.mcpProfile &&
+    selection.mcpProfile in PROFILE_DEFINITIONS
+      ? selection.mcpProfile
+      : options.requestedProfile;
+
+  const resolved = buildMcpPolicy({
+    ...options,
+    requestedProfile: nextProfile,
+    availableServers: narrowedAvailable,
+    registeredServers:
+      options.registeredServers ??
+      (options.codexConfig === undefined
+        ? options.availableServers
+        : undefined),
+  });
+  return {
+    ...resolved,
+    enabledServers: resolved.allowedServers,
+    requestedProfile: options.requestedProfile || "auto",
+  };
+}
+
 function shellEscape(value) {
   return `'${String(value).replace(/'/g, `'"'"'`)}'`;
 }
@@ -863,7 +944,9 @@ async function runCli(argv = process.argv.slice(2)) {
 
   let policy;
   try {
-    policy = buildMcpPolicy(args);
+    policy = isJevEnabled()
+      ? await buildMcpPolicyWithJev(args)
+      : buildMcpPolicy(args);
   } catch (error) {
     console.error(
       `[mcp-filter] ${error instanceof Error ? error.message : String(error)}`,