elanous 0.2.0 → 0.2.4

package/src/oauth/codex-account-store.ts

@@ -12,14 +12,15 @@ import {
   resolveCodexAccount, effectiveCodexHome, type CodexHomeSource, type CodexAccountResolution,
 } from './codex-account.js';
 import { authStorePath, defaultCodexHome, listProviders, loadTokens, saveTokens } from './store.js';
-import { readFreshAvailabilityState, quotaSignalDir, readQuotaSignal, readQuotaSignalUsedPercent, readQuotaSignalObservedAt, readQuotaSignalObservedAtRaw } from '../budget/codex-reset-credit-state.js';
+import { readFreshAvailabilityState, quotaSignalDir, readQuotaSignal, readQuotaSignalCredits, readQuotaSignalUsedPercent, readQuotaSignalObservedAt, readQuotaSignalObservedAtRaw } from '../budget/codex-reset-credit-state.js';
 import { getUserConfig } from '../user-config.js';
 import {
   decideCodexRotation, observeRotation, applyRotation, readCodexAccountRotationConfig, rotatedChildEnv,
-  codexAccountRotationThresholdOverridePercent,
-  normalizedRotationThresholdPercent,
+  codexAccountThresholdPercent,
   type RotationCandidate,
 } from './codex-account-rotation.js';
+import { codexPolicyAllowsCredits, codexPolicyAllowsFallback, resolveCodexQuotaPolicy, type CodexQuotaPolicy, type ResolvedCodexQuotaPolicy } from './codex-quota-policy.js';
+import { emitDecision } from '../live/detail-switch.js';
 import { debug } from '../debug/log.js';
 import {
   decideFallback, normalizeFallbackChain, grokQuotaFromUsageSnapshot,
@@ -44,7 +45,7 @@ export function _setCodexAccountOutboundSenderForTesting(sender: CodexAccountOut
 /** ⛔⭐ 정적 import 로 읽는다 — 종전 `require()` 는 ESM 에서 «정의되지 않을 수 있고», 그러면
  *  fail-soft 가 삼켜 ***config false 가 영영 무시된다***(리뷰 should-fix: 노브가 no-op 이 된다).
  *  ⚠️ 순환 없음을 확인했다 — user-config 는 oauth 를 안 끌어온다. */
-type RotationConfig = { llm?: { codexAccountRotation?: boolean; codexAccountAlerts?: boolean; codexAccountRotationThresholdPercent?: unknown; codexAccountRotationThresholdPercentByAccount?: Readonly<Record<string, unknown>>; fallbackChain?: unknown } };
+type RotationConfig = { llm?: { codexAccountRotation?: boolean; codexAccountAlerts?: boolean; codexAccountRotationThresholdPercent?: unknown; codexAccountRotationThresholdPercentByAccount?: Readonly<Record<string, unknown>>; codexCreditsAllowed?: boolean; codexQuotaPolicy?: unknown; fallbackChain?: unknown } };
 
 function readUserConfig(): RotationConfig {
   return getUserConfig();
@@ -221,26 +222,57 @@ function pinnedAccountExhausted(home: string, accountName: string): boolean {
   const used = readQuotaSignalUsedPercent(now, home);
   if (typeof used !== 'number' || !Number.isFinite(used)) return false;
   // ⛔ 판정이 쓰는 «같은 자»를 쓴다 — 여기서 임계를 다시 지으면 핀과 판정이 갈린다.
-  const threshold = codexAccountRotationThresholdOverridePercent(
-    rotationThresholdsByAccountFromConfig()?.[accountName],
-    normalizedRotationThresholdPercent(rotationThresholdFromConfig()));
+  const threshold = codexAccountThresholdPercent(accountName, {
+    thresholdPercent: rotationThresholdFromConfig(),
+    thresholdPercentByAccount: rotationThresholdsByAccountFromConfig(),
+  });
   return used >= threshold;
 }
 
-function buildRotationCandidates(path: string, now: number): RotationCandidate[] {
+/** codex 한도 정책(`llm.codexQuotaPolicy` · 옛 `codexCreditsAllowed`) — 못 읽으면 `fallback`(크레딧은 돈이라 fail-closed). */
+export function codexQuotaPolicyFromConfig(): CodexQuotaPolicy {
+  try { return resolveCodexQuotaPolicy(configReader().llm).policy; } catch { return 'fallback'; }
+}
+
+function inspectedQuotaPolicy(): ResolvedCodexQuotaPolicy {
+  try { return resolveCodexQuotaPolicy(configReader().llm); } catch { return { policy: 'fallback', source: 'default' }; }
+}
+
+/** 지금 계정의 크레딧 신호 — 판정 입력 두 칸. 신호를 이 계정에 귀속할 수 없으면 비운다(모른다). */
+function currentCreditsInput(home: string | undefined, now: number): { currentCreditBalance?: number; currentHasCredits?: boolean } {
+  if (!home) return {};
+  const c = readQuotaSignalCredits(now, home);
+  return {
+    ...(c.balance === undefined ? {} : { currentCreditBalance: c.balance }),
+    ...(c.hasCredits === undefined ? {} : { currentHasCredits: c.hasCredits }),
+  };
+}
+
+function codexCreditsAllowedFromConfig(): boolean {
+  return codexPolicyAllowsCredits(codexQuotaPolicyFromConfig());
+}
+
+function buildRotationCandidates(path: string, now: number, env: NodeJS.ProcessEnv = process.env): RotationCandidate[] {
   return listCodexAccountsInStore(path)
     .map((row) => {
       const stored = loadTokens(row.storeKey, path);
-      // ⛔ 홈을 모르는 계정은 후보가 «아니다» — 모르는 곳으로 넘기지 않는다.
-      const home = stored?.codexHome;
+      // ⛔ 홈을 모르는 «이름» 계정은 후보가 «아니다» — 모르는 곳으로 넘기지 않는다.
+      // ⭐ 기본 계정(`openai-codex`)은 정본에 홈을 안 적는다 — 그 홈은 «기본 위치»(`CODEX_HOME` 또는 `~/.codex`)로
+      //    이미 정해져 있다(`resolveCodexAccount` · `effectiveCodexHome` 과 같은 해석). 종전엔 이 계정이 후보에서
+      //    통째로 빠져, Pod 배분이 default 를 1% 로 두고 «codex 모두 95% 이상 → grok» 으로 갔다(🅢 2026-09-27).
+      const home = stored?.codexHome
+        ?? (row.storeKey === 'openai-codex' ? resolveCodexAccount({ CODEX_HOME: env.CODEX_HOME } as unknown as NodeJS.ProcessEnv).home : undefined); // CODEX_HOME 한 칸만(이름 계정 설정을 안 끼운다 · 🅢 #21079 의도) — unknown 단언: Next 타입은 ProcessEnv 에 NODE_ENV 를 필수로 더해 PWA 빌드가 깨졌다
       if (!home) return null;
       const usedPercent = readQuotaSignalUsedPercent(now, home);
+      const credits = readQuotaSignalCredits(now, home);
       return {
         name: row.name,
         storeKey: row.storeKey,
         home,
         reached: readQuotaSignal(now, home),
         ...(usedPercent === undefined ? {} : { usedPercent }),
+        ...(credits.balance === undefined ? {} : { creditBalance: credits.balance }),
+        ...(credits.hasCredits === undefined ? {} : { hasCredits: credits.hasCredits }),
       };
     })
     .filter((c): c is RotationCandidate => c !== null);
@@ -441,6 +473,9 @@ export function inspectCodexRotation(
   readonly currentHome: string | undefined;
   readonly currentReached: boolean | undefined;
   readonly currentUsedPercent: number | undefined;
+  readonly currentCreditBalance: number | undefined;
+  readonly currentHasCredits: boolean | undefined;
+  readonly policy: ResolvedCodexQuotaPolicy;
   readonly explicit: boolean;
   readonly enabled: boolean;
   /** ⛔ «판정기가 실제로 쓴» 임계다 — raw config 가 아니다(리뷰 must-fix). */
@@ -460,6 +495,7 @@ export function inspectCodexRotation(
   /** Pure rotation authority's account-availability evidence. */
   readonly reason: string;
   readonly candidateCount: number | undefined;
+  readonly accountThresholds: ReturnType<typeof decideCodexRotation>['accountThresholds'];
   readonly to: string | undefined;
 } {
   const path = deps.storePath ?? authStorePath();
@@ -472,14 +508,16 @@ export function inspectCodexRotation(
   const enabled = rotationConfig.enabled;
   const currentHomeInfo = effectiveCodexHome(current, loadTokens(current.storeKey, path), env);
   const currentHome = currentHomeInfo.home;
-  const candidates = buildRotationCandidates(path, now);
+  const candidates = buildRotationCandidates(path, now, env);
   const currentSignalAttributable = signalAttributableToAccount(currentHomeInfo);
   const currentReached = currentSignalAttributable && currentHome ? readQuotaSignal(now, currentHome) : undefined;
   const currentUsedPercent = currentSignalAttributable && currentHome ? readQuotaSignalUsedPercent(now, currentHome) : undefined;
+  const currentCredits = currentCreditsInput(currentSignalAttributable ? currentHome : undefined, now);
+  const policy = inspectedQuotaPolicy();
   const rawThreshold = rotationThresholdFromConfig();
   const thresholdPercentByAccount = rotationThresholdsByAccountFromConfig();
   const decision = decideCodexRotation({
-    current, explicit, enabled, disabledProvenance: rotationConfig.state, currentReached, currentUsedPercent, accountOrder: accountOrderFromConfig(), resetCreditAvailability: resetCreditAvailability(currentHome, now), thresholdPercent: rawThreshold, thresholdPercentByAccount, candidates,
+    current, explicit, enabled, disabledProvenance: rotationConfig.state, currentReached, currentUsedPercent, accountOrder: accountOrderFromConfig(), resetCreditAvailability: resetCreditAvailability(currentHome, now), thresholdPercent: rawThreshold, thresholdPercentByAccount, creditsAllowed: codexCreditsAllowedFromConfig(), ...currentCredits, candidates,
   });
   // ⛔⭐ 나이는 «만료돼도» 낸다 — 「65분 전」과 「3일 전」은 다른 진단이다(리뷰 must-fix).
   const observedAtByHome: Record<string, number> = {};
@@ -490,15 +528,17 @@ export function inspectCodexRotation(
     freshByHome[c.home] = readQuotaSignalObservedAt(now, c.home) !== undefined;
   }
   return {
-    current, currentHome, currentReached, currentUsedPercent,
+    current, currentHome, currentReached, currentUsedPercent, policy,
+    currentCreditBalance: currentSignalAttributable ? currentCredits.currentCreditBalance : candidates.find((c) => c.storeKey === current.storeKey)?.creditBalance,
+    currentHasCredits: currentSignalAttributable ? currentCredits.currentHasCredits : candidates.find((c) => c.storeKey === current.storeKey)?.hasCredits,
     currentObservedAt: currentHome ? readQuotaSignalObservedAtRaw(now, currentHome) : undefined,
     currentSignalFresh: currentHome ? readQuotaSignalObservedAt(now, currentHome) !== undefined : false,
     explicit, enabled,
-    // ⛔ «정규화된» 임계 — 판정기가 실제로 쓴 값이다
-    thresholdPercent: normalizedRotationThresholdPercent(rawThreshold),
+    // ⛔ 계정에 적용한 «실효» 임계 — 판정기가 실제로 쓴 값이다
+    thresholdPercent: codexAccountThresholdPercent(current.name, { thresholdPercent: rawThreshold, thresholdPercentByAccount }),
     candidates, observedAtByHome, freshByHome,
     knownAccountCount: listCodexAccountsInStore(path).length,
-    reason: decision.reason, candidateCount: decision.candidateCount, to: decision.to?.name,
+    reason: decision.reason, candidateCount: decision.candidateCount, accountThresholds: decision.accountThresholds, to: decision.to?.name,
   };
 }
 
@@ -560,7 +600,7 @@ export function resolveCodexAccountForRun(
   const now = Date.now();
   const currentHomeInfo = effectiveCodexHome(current, loadTokens(current.storeKey, path), env);
   const currentHome = currentHomeInfo.home;
-  const candidates = buildRotationCandidates(path, now);
+  const candidates = buildRotationCandidates(path, now, env);
   const currentSignalAttributable = signalAttributableToAccount(currentHomeInfo);
 
   const decision = decideCodexRotation({
@@ -574,6 +614,8 @@ export function resolveCodexAccountForRun(
     resetCreditAvailability: resetCreditAvailability(currentHome, now),
     thresholdPercent: rotationThresholdFromConfig(),
     thresholdPercentByAccount: rotationThresholdsByAccountFromConfig(),
+    creditsAllowed: codexCreditsAllowedFromConfig(),
+    ...currentCreditsInput(currentSignalAttributable ? currentHome : undefined, now),
     candidates,
   });
   observeRotation(decision, current.name);
@@ -696,11 +738,20 @@ export function resolveRunFallback(
       || snapshot.reason === 'no-candidate'
     ) {
       rotation = { reason: snapshot.reason };
+    } else if (snapshot.reason === 'credits-allowed') {
+      // 크레딧으로 머문다 — 폴백 판정엔 «한도 안»과 같다(체인을 타지 않는다).
+      rotation = { reason: 'not-reached' };
     } else {
       rotation = { reason: 'no-candidate' };
     }
 
-    const { chain, dropped, usedDefault } = normalizeFallbackChain(configReader().llm?.fallbackChain);
+    const normalized = normalizeFallbackChain(configReader().llm?.fallbackChain);
+    const { dropped, usedDefault } = normalized;
+    // 대표 정책 `within-quota` — codex 밖으로 폴백하지 않는다(회전만). 전부 차면 멈춘다.
+    const quotaPolicy = codexQuotaPolicyFromConfig();
+    const chain = codexPolicyAllowsFallback(quotaPolicy)
+      ? normalized.chain
+      : normalized.chain.filter((step) => step === 'codex-rotate');
     // ⛔ grok 가용성은 «호출자가 확정»해서 줄 수 있다(테스트 격리). 안 주면 여기서 잰다.
     // ⛔ «가용성 판정»이라 갱신을 유도하지 않는다 — 「자격이 있나」만 묻지 「지금 쓸 수 있나」를 묻지 않는다.
     //   (쓸 수 있는지는 실제 요청 경로가 접힌 해석으로 확인한다.)
@@ -716,7 +767,7 @@ export function resolveRunFallback(
 
     debug.log('oauth.fallback-chain', 'decide', {
       rotationReason: rotation.reason,
-      chain, usedDefault,
+      chain, usedDefault, quotaPolicy,
       rotationResult: rotation.reason,
       // ⛔⭐ 「안 줬다」를 «false 로 접지 않는다»(무인 리뷰 must-fix · UNKNOWN-DEFAULT).
       //   호출자가 이 값을 생략하면 그것은 「한도가 아니었다」가 «아니라» ***「안 쟀다」***다.
@@ -733,6 +784,24 @@ export function resolveRunFallback(
       ...(decision.action === 'stay' ? { why: decision.why } : {}),
       ...(decision.action === 'codex-rotate' ? { to: decision.to.name } : {}),
     });
+    if (decision.action === 'switch-backend') {
+      emitDecision({
+        kind: 'ROUTE',
+        what: `공급자 전환 codex → ${decision.backend}`,
+        reason: `회전 ${rotation.reason} · 정책 ${quotaPolicy}${fallbackInput.currentCredentialRateLimited ? ' · 한도 오류' : ''}`,
+        purpose: '작업을 멈추지 않고 이어 간다',
+        target: decision.backend,
+        paths: chain.length,
+      });
+    } else if (decision.action === 'stay' && rotation.reason === 'no-candidate' && !codexPolicyAllowsFallback(quotaPolicy)) {
+      emitDecision({
+        kind: 'ESCALATE',
+        what: 'codex 계정 전부 한도 — 멈춤',
+        reason: '정책 within-quota(한도 안에서만)',
+        purpose: '크레딧·다른 공급자로 비용을 쓰지 않는다',
+        target: '사람(리셋 대기)',
+      });
+    }
     return decision;
   } catch (err) {
     debug.log('oauth.fallback-chain', 'decide-failed', {

package/src/oauth/codex-quota-policy.ts

@@ -0,0 +1,55 @@
+// codex 한도 정책 — 「구독 한도가 차면 무엇을 하나」를 config 한 값(`llm.codexQuotaPolicy`)으로 정한다.
+//
+// 대표 2026-09-28: 크레딧 허가(09~10월 출시 특별기간) 뒤에도 매시 한도 알림이 «폴백이 grok 으로 갑니다»를 냈다 —
+//   회전·Pod 브로커·폴백·알림이 각자 다른 스위치를 읽었기 때문이다. ⇒ 정책을 «한 자리»에서 해석하고 넷이 같이 읽는다.
+//
+// 정책 셋(모든 정책에서 «한도가 남은 다른 계정으로 회전»은 먼저 한다 — 회전은 무료다):
+//   within-quota — 구독 한도 안에서만. 크레딧 ✗ · 다른 provider 폴백 ✗ ⇒ 전부 차면 «멈춘다».
+//   fallback     — 한도 안 ⊕ 폴백 체인(`llm.fallbackChain` · 예: grok). 크레딧 ✗. (기본)
+//   credits      — 한도 안 ⊕ 크레딧(찬 계정을 선불 크레딧으로 계속). 크레딧도 떨어져 요청이 한도 오류를 내면 폴백 체인.
+//
+// ⛔ 옛 키 `llm.codexCreditsAllowed: true` 는 `credits` 로 읽는다(새 키가 있으면 새 키가 이긴다).
+// ⛔ 못 읽거나 모르는 값이면 `fallback` — 크레딧은 돈이라 fail-closed(종전 기본과 같다).
+
+export const CODEX_QUOTA_POLICIES = ['within-quota', 'fallback', 'credits'] as const;
+export type CodexQuotaPolicy = (typeof CODEX_QUOTA_POLICIES)[number];
+
+export interface ResolvedCodexQuotaPolicy {
+  readonly policy: CodexQuotaPolicy;
+  /** 어디서 정해졌나 — `config`(새 키) · `legacy-credits`(옛 `codexCreditsAllowed`) · `default` · `invalid`(모르는 값 → 기본). */
+  readonly source: 'env' | 'config' | 'legacy-credits' | 'default' | 'invalid';
+}
+
+export const CODEX_QUOTA_POLICY_LABEL: Readonly<Record<CodexQuotaPolicy, string>> = {
+  'within-quota': '한도 안에서만',
+  fallback: '한도 안 ⊕ 자동 폴백',
+  credits: '크레딧까지',
+};
+
+export function isCodexQuotaPolicy(value: unknown): value is CodexQuotaPolicy {
+  return typeof value === 'string' && (CODEX_QUOTA_POLICIES as readonly string[]).includes(value);
+}
+
+export function resolveCodexQuotaPolicy(
+  llm: { readonly codexQuotaPolicy?: unknown; readonly codexCreditsAllowed?: unknown } | undefined,
+): ResolvedCodexQuotaPolicy {
+  // A Pod has no copy of the host config; the launcher hands the host's policy down in this variable
+  // (09-29: without it every Pod child fell back to grok while all three accounts still had credits).
+  const fromEnv = process.env.ELANOUS_CODEX_QUOTA_POLICY?.trim();
+  if (fromEnv && isCodexQuotaPolicy(fromEnv)) return { policy: fromEnv, source: 'env' };
+  const raw = llm?.codexQuotaPolicy;
+  if (isCodexQuotaPolicy(raw)) return { policy: raw, source: 'config' };
+  if (llm?.codexCreditsAllowed === true) return { policy: 'credits', source: 'legacy-credits' };
+  if (raw !== undefined) return { policy: 'fallback', source: 'invalid' };
+  return { policy: 'fallback', source: 'default' };
+}
+
+/** 찬 계정을 선불 크레딧으로 계속 쓰나. */
+export function codexPolicyAllowsCredits(policy: CodexQuotaPolicy): boolean {
+  return policy === 'credits';
+}
+
+/** codex 밖(grok 등)으로 폴백하나. */
+export function codexPolicyAllowsFallback(policy: CodexQuotaPolicy): boolean {
+  return policy !== 'within-quota';
+}

package/src/oauth/store.ts

@@ -66,6 +66,8 @@ export interface ProviderAuthState {
   accountEmail?: string;
   accountUuid?: string;
   organizationUuid?: string;
+  /** MCP 동적 등록 때 쓴 redirect_uri. 선택 칸 — 없으면 옛 등록이다. */
+  redirectUri?: string;
   /** ⭐⭐ 이 계정의 공식 CLI 홈(= 미러 대상). ⛔ 이것이 «토큰과 함께» 저장되는 이유:
    *  미러 대상을 «주변 env/config»로 정하면, 저장하는 키와 미러 가는 홈이 «갈릴 수 있다»
    *  (2026-08-05 1R must-fix — `saveTokens('openai-codex:team')` 이 기본 홈을 오염시켰다).
@@ -167,13 +169,25 @@ function jwtExpMs(token: string): number | null {
  * expired 2026-05-13) while ~/.codex held a valid token refreshed
  * 2026-06-04 → `codex refresh failed: status=401` on every iPad chat turn.
  *
- * This compares the two access tokens' JWT `exp` and, when the mirror is
- * STRICTLY fresher (or elanous has no usable token), adopts the mirror's
- * access+refresh pair and persists it back to elanous's store (saveTokens
- * re-decodes ChatGPT claims + re-mirrors). Idempotent: when elanous's own
- * copy is fresher (the normal case right after a elanous-driven refresh) the
- * input state is returned unchanged, so the two never ping-pong.
+ * Selection shares this read-only parser with reconciliation, without
+ * persisting a credential or contacting an auth server.
  */
+export function readCodexMirrorTokens(mirrorPath: string = codexAuthPath()): OAuthTokens | null {
+  try {
+    const mirror = JSON.parse(readFileSync(mirrorPath, 'utf-8')) as { tokens?: Record<string, unknown> };
+    const access = mirror?.tokens?.access_token;
+    const refresh = mirror?.tokens?.refresh_token;
+    if (typeof access !== 'string' || !access || typeof refresh !== 'string' || !refresh) return null;
+    const expiresAt = jwtExpMs(access);
+    if (expiresAt === null) return null;
+    return { accessToken: access, refreshToken: refresh, expiresAt };
+  } catch {
+    return null;
+  }
+}
+
+/** Reconcile elanous's Codex tokens with the CLI mirror, adopting only a
+ * strictly fresher access token and persisting its rotated refresh token. */
 export function reconcileCodexTokensFromMirror(
   state: ProviderAuthState | null,
   elanousPath: string = authStorePath(),
@@ -185,23 +199,9 @@ export function reconcileCodexTokensFromMirror(
    *  기본값은 종전 키 — 기본 계정 호출자의 동작을 한 바이트도 안 바꾼다. */
   storeKey: string = 'openai-codex',
 ): ProviderAuthState | null {
-  let mirror: Record<string, unknown>;
-  try {
-    if (!existsSync(mirrorPath)) return state;
-    const parsed = JSON.parse(readFileSync(mirrorPath, 'utf-8'));
-    if (!parsed || typeof parsed !== 'object') return state;
-    mirror = parsed as Record<string, unknown>;
-  } catch {
-    return state;
-  }
-  const mt = (mirror.tokens && typeof mirror.tokens === 'object')
-    ? mirror.tokens as Record<string, unknown> : null;
-  const mirrorAccess = typeof mt?.access_token === 'string' ? mt.access_token : null;
-  const mirrorRefresh = typeof mt?.refresh_token === 'string' ? mt.refresh_token : null;
-  if (!mirrorAccess || !mirrorRefresh) return state;
-
-  const mirrorExp = jwtExpMs(mirrorAccess);
-  if (mirrorExp == null) return state;
+  const mirror = readCodexMirrorTokens(mirrorPath);
+  if (!mirror || mirror.expiresAt === null) return state;
+  const mirrorExp = mirror.expiresAt;
   // elanous's freshness = its access-token exp (fall back to stored
   // expiresAt, then -∞ when there is no usable token at all).
   const elanousExp = state
@@ -212,8 +212,8 @@ export function reconcileCodexTokensFromMirror(
   if (mirrorExp <= elanousExp) return state;
 
   const tokens: OAuthTokens = {
-    accessToken: mirrorAccess,
-    refreshToken: mirrorRefresh,
+    accessToken: mirror.accessToken,
+    refreshToken: mirror.refreshToken,
     expiresAt: mirrorExp,
     ...(state?.tokens.scope ? { scope: state.tokens.scope } : {}),
     tokenType: state?.tokens.tokenType ?? 'Bearer',
@@ -235,6 +235,8 @@ export interface WriteTokensOpts {
   accountEmail?: string;
   accountUuid?: string;
   organizationUuid?: string;
+  /** MCP 동적 등록 때 쓴 redirect_uri. 생략하면 기존 값을 유지한다. */
+  redirectUri?: string;
   /** ⭐⭐ 이 계정의 공식 CLI 홈(= 미러 대상). ⛔ 이것이 «토큰과 함께» 저장되는 이유:
    *  미러 대상을 «주변 env/config»로 정하면, 저장하는 키와 미러 가는 홈이 «갈릴 수 있다»
    *  (2026-08-05 1R must-fix — `saveTokens('openai-codex:team')` 이 기본 홈을 오염시켰다).
@@ -278,6 +280,7 @@ export function saveTokens(
     accountEmail: opts.accountEmail ?? existing?.accountEmail,
     accountUuid: opts.accountUuid ?? existing?.accountUuid,
     organizationUuid: opts.organizationUuid ?? existing?.organizationUuid,
+    redirectUri: opts.redirectUri ?? existing?.redirectUri,
     codexHome: opts.codexHome ?? existing?.codexHome,
     ...(chatGPT ? { chatGPT } : {}),
   };

package/src/obsidian/default-vault.ts

@@ -0,0 +1,17 @@
+// The one place that decides the Obsidian vault a fresh install starts with.
+// A configured `obsidian.vault` always wins over this; the default only matters when
+// nothing is configured (first install, onboarding's pre-filled answer).
+// ⛔ Keep it generic — it used to name the owner's personal vault, in three places that disagreed.
+import { join } from 'path';
+
+export type VaultEnv = Readonly<Record<string, string | undefined>>;
+
+/** `<home>/Documents/Obsidian` — the default when neither config nor env names a vault. */
+export function fallbackObsidianVault(home: string): string {
+  return join(home, 'Documents', 'Obsidian');
+}
+
+/** `$OBSIDIAN_VAULT` when set (trimmed, non-empty), else `fallbackObsidianVault(home)`. */
+export function defaultObsidianVault({ env, home }: { env: VaultEnv; home: string }): string {
+  return env.OBSIDIAN_VAULT?.trim() || fallbackObsidianVault(home);
+}

package/src/obsidian/vault-write-guard.ts

@@ -0,0 +1,46 @@
+/** ⛔ 격리(test) 우주는 운영 Obsidian 볼트에 «쓰지» 않는다 — 읽기는 그대로(볼트는 단일 지식 창구 · 대표 2026-09-26).
+ *
+ *  🩸 2026-09-26(🅕 실측): 격리 config 물질화가 운영 `obsidian.vault` 를 그대로 가져오고, 격리 데몬의 PWA 저장이
+ *    실제 볼트에 사본을 만들었다 → Obsidian Sync 가 모든 기기로 퍼뜨린다(되돌리기 어렵다).
+ *  규칙: 우주가 `test` 이면, 쓰려는 경로가 «그 격리 우주 폴더 안» 또는 «OS 임시 폴더 안»(시험이 임시 볼트를 명시한 경우)일 때만 허용.
+ *  ⊕ 설정 `obsidian.testVault`(시험 볼트 · 예 `elantest`)가 있으면 그 안도 허용한다 — 운영 볼트(`obsidian.vault`)는 여전히 막는다.
+ *  모든 볼트 쓰기 창구(노트 저장 · 자동 조사 · 이미지 첨부 · 쓰기 문 `PUT /v1/vault/file`)가 쓰기 «직전»에 부른다. */
+import { tmpdir } from 'node:os';
+import { resolve, sep } from 'node:path';
+import { debug } from '../debug/log.js';
+import { resolveCurrentInstance } from '../instance/current.js';
+import { getUserConfig } from '../user-config.js';
+
+export class VaultWriteBlockedError extends Error {
+  readonly code = 'vault-write-blocked-test-universe';
+  constructor(readonly target: string) {
+    super(`격리(test) 우주에서는 운영 Obsidian 볼트에 쓰지 않는다 — ${target}. 쓰기를 시험하려면 임시 볼트를 먼저 정하라(설정 obsidian.testVault · 격리 폴더 · OS 임시 폴더 안).`);
+    this.name = 'VaultWriteBlockedError';
+  }
+}
+
+export interface VaultWriteGuardDeps {
+  readonly instance?: () => { kind: string; root: string };
+  readonly tmp?: () => string;
+  readonly testVault?: () => string | undefined;
+}
+
+function configuredTestVault(): string | undefined {
+  try { return getUserConfig().obsidian?.testVault?.trim() || undefined; } catch { return undefined; }
+}
+
+function within(child: string, parent: string): boolean {
+  const c = resolve(child); const p = resolve(parent);
+  return c === p || c.startsWith(p.endsWith(sep) ? p : p + sep);
+}
+
+/** 쓰기 직전에 부른다 — 막히면 `VaultWriteBlockedError` 를 던진다. */
+export function assertVaultWriteAllowed(absPath: string, deps: VaultWriteGuardDeps = {}): void {
+  const inst = (deps.instance ?? (() => resolveCurrentInstance()))();
+  if (inst.kind !== 'test') return;
+  if (within(absPath, inst.root) || within(absPath, (deps.tmp ?? tmpdir)())) return;
+  const testVault = (deps.testVault ?? configuredTestVault)();
+  if (testVault && within(absPath, testVault)) return;
+  debug.log('vault.write', 'blocked-test-universe', { target: absPath, universeRoot: inst.root });
+  throw new VaultWriteBlockedError(absPath);
+}

package/src/onboarding/help/llm.md

@@ -4,8 +4,8 @@ Pick the LLM elanous uses for chat / agent loops. Each provider needs
 something different:
 
   · OpenAI Codex — sign in via ChatGPT OAuth (browser device-code
-                   flow) OR paste an OpenAI API key. Includes
-                   GPT-5.4 / codex-mini.
+                   flow) OR paste an OpenAI API key. The model
+                   list in the next step is the current one.
   · Local        — Ollama / LM Studio / MLX / Docker on this
                    machine or another Tailscale node. We auto-probe
                    and let you pick.

package/src/onboarding.ts

@@ -385,7 +385,7 @@ interface ProviderChoice {
 }
 
 const PROVIDER_CHOICES: ProviderChoice[] = [
-  { key: 'openai-codex', label: 'OpenAI Codex (GPT-5.4 / codex-mini via ChatGPT OAuth)', defaultModel: CODEX_DEFAULT_MODEL, needsBaseUrl: false, needsApiKey: true },
+  { key: 'openai-codex', label: 'OpenAI Codex (ChatGPT subscription · OAuth)', defaultModel: CODEX_DEFAULT_MODEL, needsBaseUrl: false, needsApiKey: true },
   { key: 'local',        label: 'Local (LM Studio · MLX · Ollama — Apple Silicon preferred)', defaultModel: LOCAL_LLM_MODEL, needsBaseUrl: true, needsApiKey: false },
   { key: 'grok',         label: 'Grok (xAI)', defaultModel: GROK_MODEL, needsBaseUrl: false, needsApiKey: true },
   { key: 'openai',       label: 'OpenAI (ChatGPT)', defaultModel: OPENAI_MODEL, needsBaseUrl: false, needsApiKey: true },
@@ -670,7 +670,7 @@ export async function askAnswerPriority(
 /** Built-in presets, in the order shown to the user. Sprint 10
  *  (2026-04-28) — claudecode promoted to default · new priority based
  *  on user feedback (claudecode → codex → openclaw → hermes → opencode). */
-const SKILL_PRESETS: { key: SkillSetName; label: string; dir: string | null }[] =
+export const SKILL_PRESETS: { key: SkillSetName; label: string; dir: string | null }[] =
   (['claudecode', 'codex', 'openclaw', 'hermes', 'opencode'] as SkillSetName[])
     .map(k => ({ key: k, label: k, dir: skillSetDir(k) }));
 

package/src/panes/alt-skip-predicate.ts

@@ -5,7 +5,7 @@
 // the PaneVisualStateStore (Bundle A · A3).
 //
 // Compose (don't replace) with the existing
-// `!w.hasInteractableFocus()` default in dashboard-virtual-windows.ts:
+// `!w.hasInteractableFocus()` dashboard default:
 // a window is skipped if EITHER predicate says so. Explicit selection
 // (`^B <digit>`, Alt+<digit>, picker, switchTo(id)) bypasses both.
 //
@@ -15,12 +15,13 @@
 // cycle so the user can still reach a usable pane inside.
 
 import { isAltSkipEligible, type PaneVisualStateStore } from './visual-state.js';
-import type { VirtualWindow } from '../virtual-windows/virtual-window.js';
 import { debug } from '../debug/log.js';
 
+type WindowWithPanes = { readonly id: number; listPanes(): Array<{ id: string }> };
+
 export function skipWindowWhenStorePredicate(
   store: PaneVisualStateStore,
-): (w: VirtualWindow) => boolean {
+): (w: WindowWithPanes) => boolean {
   return (window) => {
     const panes = window.listPanes();
     if (panes.length === 0) return false;

package/src/panes/external-terminal-pane.ts

@@ -2,10 +2,9 @@
 //
 // Wraps a Shell Runner ShellHandle (mode='vw' · runner-label-bound
 // PreviewTerminal) as a Pane. Phase 1 scope is a thin structural
-// wrapper; the actual external-terminal rendering already lives in
-// src/shell-runner/external-terminal-pane.ts (the NT-C1b component).
-// This class merely exposes the Pane contract over that existing
-// runtime — describe() exposes the runner label, snapshot() calls
+// wrapper over the ShellHandle. The retired VW PaneContent adapter is
+// not used by this Pane contract — describe() exposes the runner label,
+// snapshot() calls
 // into the Shell Runner's bookmark/renderForLLM, and addTap('raw')
 // subscribes to the engine chunk stream.
 //

package/src/panes/factory.ts

@@ -4,12 +4,7 @@
 // for a given PaneRef. Maintains a cache keyed by (windowId, paneId)
 // so repeated describe/snapshot/addTap calls don't churn wrappers.
 //
-// The factory provides three resolve paths:
-//   1. resolveFromContent(ref, content) — wrap a legacy PaneContent
-//   2. resolveFromTerminal(ref, term)   — wrap a matrix TerminalInstance
-//   3. resolveFromHandle(ref, handle)   — wrap a Shell Runner ShellHandle
-//   4. resolveFromWidget(ref, inst, def) — wrap a WidgetInstance + Widget
-//   5. resolvePlaceholder(ref, reason)   — empty / error / loading slot
+// The factory wraps terminals, shell handles and widgets, or supplies placeholders.
 //
 // Dashboard integration (per LESSONS L5 risk discipline): this module
 // only provides the resolve API. VW composer / capture engine call
@@ -19,11 +14,9 @@
 //
 // See: 내부 문서 `PLAN-session-vw-term-infra-wiring` §6 (W1 · C7)
 
-import type { PaneContent } from '../virtual-windows/pane-content.js';
 import type { ShellHandle } from '../shell-runner/types.js';
 import type { TerminalInstance } from '../terminal-matrix/types.js';
 import type { Widget, WidgetInstance } from '../widgets/types.js';
-import { PaneContentAdapter } from './content-adapter.js';
 import { ExternalTerminalPane } from './external-terminal-pane.js';
 import { PlaceholderPane, type PlaceholderReason } from './placeholder-pane.js';
 import { TerminalPane } from './terminal-pane.js';
@@ -35,16 +28,6 @@ import type { Pane, PaneRef } from './types.js';
 export class PaneFactory {
   private readonly cache = new Map<string, Pane>();
 
-  /** Wrap an existing PaneContent (legacy VW pane content) as a Pane. */
-  resolveFromContent(ref: PaneRef, content: PaneContent): Pane {
-    const key = cacheKey(ref);
-    const cached = this.cache.get(key);
-    if (cached && cached.kind.kind !== 'placeholder') return cached;
-    const pane = new PaneContentAdapter(ref, content);
-    this.cache.set(key, pane);
-    return pane;
-  }
-
   /** Wrap a TerminalMatrix TerminalInstance as a Pane. */
   resolveFromTerminal(ref: PaneRef, term: TerminalInstance): Pane {
     const key = cacheKey(ref);

package/src/panes/index.ts

@@ -22,11 +22,7 @@ export type { PlaceholderReason } from './placeholder-pane.js';
 export { TerminalPane } from './terminal-pane.js';
 export { WidgetPane } from './widget-pane.js';
 
-// W1 — factory + content adapter
-export {
-  PaneContentAdapter,
-  inferKindFromContent,
-} from './content-adapter.js';
+// W1 — factory
 export {
   PaneFactory,
   getDefaultPaneFactory,

package/src/panes/pane-cycle.ts

@@ -13,7 +13,7 @@
 //
 // PLAN: 내부 문서 `PLAN-vw-term-bundle-b7-delta-alt-o-pane-cycle`
 
-import type { PaneId } from '../virtual-windows/addressing.js';
+type PaneId = string;
 
 export type PaneCycleDirection = 'forward' | 'backward';
 

package/src/panes/types.ts

@@ -11,7 +11,7 @@
 // This file defines the types and interfaces; concrete implementations
 // land in `terminal-pane.ts`, `external-terminal-pane.ts`, `widget-pane.ts`,
 // `placeholder-pane.ts`. Dashboard-side polymorphic dispatch (replacing
-// the case-kind switch in `dashboard-virtual-windows.ts`) arrives in a
+// the dashboard case-kind switch) arrives in a
 // later commit — this module is additive, behavior-preserving, and
 // compiles alone.
 //

package/src/platform/env-literal.ts

@@ -0,0 +1,4 @@
+/** 부분 환경을 일부러 넘긴다. 런타임은 받은 객체 그대로이며, Next 의 NODE_ENV 필수 선언 때문에 단언이 필요하다. */
+export function envLiteral(values: Record<string, string | undefined>): NodeJS.ProcessEnv {
+  return values as unknown as NodeJS.ProcessEnv;
+}

package/src/plugin-hooks/dispatcher.ts

@@ -19,6 +19,7 @@
 
 import { appendFileSync, existsSync, mkdirSync } from 'node:fs';
 import { elanousStateRoot } from '../autopilot/state-paths.js';
+import { debug } from '../debug/log.js';
 import { join } from 'node:path';
 import {
   ALL_HOOK_EVENTS,
@@ -106,10 +107,15 @@ export class HookDispatcher {
     if (handler.priority <= RESERVED_PRIORITY_MAX) {
       // Advisory only — built-in Andon/Budget/Termination own this
       // range. User plugins must stay ≥10.
-      this.warn(
-        `hook '${handler.id}' registered with reserved priority ${handler.priority} ` +
-        `(range 0-${RESERVED_PRIORITY_MAX} is reserved for built-ins)`,
-      );
+      const message = `hook '${handler.id}' registered with reserved priority ${handler.priority} ` +
+        `(range 0-${RESERVED_PRIORITY_MAX} is reserved for built-ins)`;
+      // 내장 훅(`core:*`)은 이 구간의 «주인»이다 — 경고 대상이 아니다. 종전엔 `core:andon` 만 뺐고
+      // `core:route-banner`·`core:missions` 경고가 TUI 입력줄 위로 새어 화면을 깼다(🅢 2026-09-27 실측 · /research status).
+      if (handler.id.startsWith('core:')) {
+        debug.log('plugin-hooks', 'reserved-priority', { message });
+      } else {
+        this.warn(message);
+      }
     }
     list.push(handler);
     this.handlers.set(handler.event, list);