elanous 0.2.0 → 0.2.5

package/src/boot/daemon-multi-llm-runtime.ts

@@ -25,12 +25,14 @@
 //
 // See: 내부 문서 `PLAN-cv-3-daemon-multi-llm-2026-05-08` (RFC v2 · 13 D)
 
+import { AsyncLocalStorage } from 'node:async_hooks';
 import type { LLMMessage } from '../llm.js';
 import { debug } from '../debug/log.js';
 import { notifyDaemonActivity } from '../dispatch/idle-detector.js';
 import {
   composeDaemonSystemPrompt,
   createDaemonRunTurn,
+  createDaemonBootToolCwdResolver,
   type DaemonRuntimeOpts,
   type DaemonSessionHistory,
 } from './daemon-runtime.js';
@@ -41,7 +43,7 @@ import {
   type MultiLlmTarget,
 } from '../acp/multi-llm-bridge.js';
 import { toolSurface } from './daemon-tools/index.js';
-import { createToolCwdResolver } from './tool-cwd.js';
+import { createToolCwdResolver, type ToolCwdResolver } from './tool-cwd.js';
 import type { AcpServerOptions, AcpTurnContext } from '../acp/server.js';
 import { getGlobalPersonaRegistry } from '../persona/global-registry.js';
 import { assemblePersonaPrompt } from '../persona/prompt-assembler.js';
@@ -57,10 +59,7 @@ import { assemblePersonaPrompt } from '../persona/prompt-assembler.js';
 export function createDaemonMultiLlmRunTurn(
   history: DaemonSessionHistory,
   opts: DaemonRuntimeOpts = {},
-  toolCwdResolver = createToolCwdResolver({
-    tools: opts.tools ?? 'none',
-    ...(opts.toolCwd !== undefined ? { toolCwd: opts.toolCwd } : {}),
-  }),
+  toolCwdResolver = createDaemonBootToolCwdResolver(opts, opts.tools ?? 'none'),
 ): NonNullable<AcpServerOptions['runTurn']> {
   // Legacy single-LLM bridge (used when no multiLlm hint). Both paths share
   // one resolver so cwd validation runs once while write worktrees stay lazy.
@@ -70,6 +69,7 @@ export function createDaemonMultiLlmRunTurn(
   // sharing means each target sees the same surface but invokes its
   // own dispatchTool calls; nothing is shared across targets).
   const surface = toolSurface(opts.tools ?? 'none');
+  const turnToolCwd = new AsyncLocalStorage<ToolCwdResolver>();
 
   // Multi-LLM bridge — fans out N runCoreTurn per target.
   const multiBridge = bridgeMultiLlmCoreTurnsToAcp({
@@ -84,9 +84,10 @@ export function createDaemonMultiLlmRunTurn(
     getTools: () => surface.specs,
     dispatchTool: async (name, args, ctx) => {
       const ctrl = new AbortController();
+      const resolver = turnToolCwd.getStore() ?? toolCwdResolver;
       const dispatchCtx: import('./daemon-tools/types.js').DaemonToolDispatchCtx = {
-        cwd: toolCwdResolver.cwd!,
-        resolveWriteCwd: toolCwdResolver.resolveWriteCwd,
+        cwd: resolver.cwd!,
+        resolveWriteCwd: resolver.resolveWriteCwd,
         signal: ctrl.signal,
         // Elanous's own LLM assembles tool arguments from natural language.
         entry: 'elanous-apparatus',
@@ -120,7 +121,12 @@ export function createDaemonMultiLlmRunTurn(
       await legacyRunTurn(turnCtx);
       return;
     }
-    await multiBridge(turnCtx);
+    if (opts.acpSessionCwd) {
+      const resolver = createToolCwdResolver({ tools: opts.tools ?? 'none', toolCwd: turnCtx.cwd });
+      await turnToolCwd.run(resolver, () => multiBridge(turnCtx));
+    } else {
+      await multiBridge(turnCtx);
+    }
   };
 }
 

package/src/boot/daemon-prompt-turn.ts

@@ -209,6 +209,8 @@ export async function runDaemonPromptTurn(opts: {
             resolveWriteCwd: toolCwdResolver.resolveWriteCwd,
             signal: dispatchCtrl.signal,
             sessionId: request.sessionId,
+            ...(request.source?.kind === 'daemon-api' && request.source.route === '/a2a'
+              ? { requestOrigin: 'external-agent' as const } : {}),
             ...(request.userText ? { userText: request.userText } : {}),
             ...(opts.surface !== undefined || sourceResolution.surface !== 'unknown' ? { surface } : {}),
             ...(opts.surfaceHitlChannels ? { surfaceHitlChannels: opts.surfaceHitlChannels } : {}),

package/src/boot/daemon-runtime.ts

@@ -25,6 +25,7 @@ import {
   unlinkSync,
 } from 'node:fs';
 import { join as joinPath } from 'node:path';
+import { AsyncLocalStorage } from 'node:async_hooks';
 
 import {
   bridgeCoreTurnToAcp,
@@ -51,7 +52,7 @@ import {
 } from '../agent/terminal-surface.js';
 import type { CoreTurnDispatchTool } from '../core-turn/index.js';
 import { elanousSelfAccessPrompt } from '../agent/self-ambient.js';
-import { createToolCwdResolver } from './tool-cwd.js';
+import { createToolCwdResolver, type ToolCwdResolver } from './tool-cwd.js';
 import { debug } from '../debug/log.js';
 
 /** C4 (2026-07-12) — arm the non-detached-PTY kill ONCE per turn signal.
@@ -108,9 +109,12 @@ export interface DaemonRuntimeOpts {
    *  to override per-invocation (CLI `--tools <kind>`). */
   tools?: import('./daemon-tools/index.js').DaemonToolSurfaceKind;
   /** M1.5 A.2 — working directory for fs-bound tools (Read · Grep).
-   *  Defaults to the daemon process's `cwd()` at boot. Honoured
-   *  only when `tools !== 'none'`. */
+   *  Non-ACP defaults to the daemon process's `cwd()` at boot; ACP uses
+   *  this only as a fallback when its session supplies no cwd.
+   *  Honoured only when `tools !== 'none'`. */
   toolCwd?: string;
+  /** ACP entry only: the client supplies cwd per session, not at daemon boot. */
+  acpSessionCwd?: boolean;
   /** C4 cancel seam — injected by the boot composition layer when a
    *  runtime exposes PtyShell. Keeps this headless module free of a
    *  direct pty-shell registry import while preserving cancel→PTY kill. */
@@ -519,6 +523,23 @@ export class DaemonSessionHistory {
   }
 }
 
+export function createDaemonBootToolCwdResolver(opts: DaemonRuntimeOpts, tools: string): ToolCwdResolver {
+  if (opts.acpSessionCwd && tools !== 'none') {
+    const defaultCwd = opts.toolCwd?.trim() || process.env.ELANOUS_TOOL_CWD?.trim();
+    if (!defaultCwd) {
+      return {
+        cwd: undefined,
+        resolveWriteCwd: () => { throw new Error('Tool surface has no working directory.'); },
+      };
+    }
+    return createToolCwdResolver({ tools, toolCwd: defaultCwd });
+  }
+  return createToolCwdResolver({
+    tools,
+    ...(opts.toolCwd !== undefined ? { toolCwd: opts.toolCwd } : {}),
+  });
+}
+
 /** Build a `runTurn` handler suitable for `bootAcpServer`'s
  *  `runTurn` option. Uses the supplied history store and the tool
  *  surface chosen via `opts.tools` (default 'none' = current
@@ -526,11 +547,9 @@ export class DaemonSessionHistory {
 export function createDaemonRunTurn(
   history: DaemonSessionHistory,
   opts: DaemonRuntimeOpts = {},
-  toolCwdResolver = createToolCwdResolver({
-    tools: opts.tools ?? 'none',
-    ...(opts.toolCwd !== undefined ? { toolCwd: opts.toolCwd } : {}),
-  }),
+  toolCwdResolver = createDaemonBootToolCwdResolver(opts, opts.tools ?? 'none'),
 ): NonNullable<AcpServerOptions['runTurn']> {
+  const turnToolCwd = new AsyncLocalStorage<ToolCwdResolver>();
   // Resolve tool surface synchronously so getTools is fast on the
   // hot path. M1.5 A.2 — when 'none', behavior matches pre-A.2
   // (`getTools` returns [], dispatchTool throws); when 'readonly',
@@ -605,9 +624,10 @@ export function createDaemonRunTurn(
       // current ACP scope when the LLM omits sessionId from args.
       const turnSignal = ctx?.signal;
       if (surfaceHasPtyShell && turnSignal) wirePtyKillOnAbort(turnSignal, killNonDetachedPty!);
+      const resolver = turnToolCwd.getStore() ?? toolCwdResolver;
       const dispatchCtx: import('./daemon-tools/types.js').DaemonToolDispatchCtx = {
-        cwd: toolCwdResolver.cwd!,
-        resolveWriteCwd: toolCwdResolver.resolveWriteCwd,
+        cwd: resolver.cwd!,
+        resolveWriteCwd: resolver.resolveWriteCwd,
         signal: turnSignal ?? new AbortController().signal,
         // Elanous's own LLM assembles tool arguments from natural language.
         entry: 'elanous-apparatus',
@@ -700,7 +720,12 @@ export function createDaemonRunTurn(
         });
         debugBridge.activate();
       }
-      await inner(turnCtx);
+      if (opts.acpSessionCwd) {
+        const resolver = createToolCwdResolver({ tools: opts.tools ?? 'none', toolCwd: turnCtx.cwd });
+        await turnToolCwd.run(resolver, () => inner(turnCtx));
+      } else {
+        await inner(turnCtx);
+      }
     } finally {
       debugBridge?.dispose();
     }
@@ -774,10 +799,7 @@ export function createDaemonRuntime(
           // permissive default — the sticky-webterm workflow stays
           // intact rather than silently disabling every tool.
           : 'webterm';
-  const toolCwdResolver = createToolCwdResolver({
-    tools: validTools,
-    ...(opts.toolCwd !== undefined ? { toolCwd: opts.toolCwd } : {}),
-  });
+  const toolCwdResolver = createDaemonBootToolCwdResolver(opts, validTools);
   // S4 (2026-07-12) — 크로스서피스 파리티: nexus 부트만 갖던 R5
   // read-through(on-disk SessionStore lazy 로드)를 standalone `elanous
   // serve` 런타임에도 기본 장착 — 어느 데몬으로 열든 텔레그램/디스코드/

package/src/boot/daemon-tools/index.ts

@@ -17,6 +17,8 @@ import {
 } from '../../tool-runtime/browser-runtime.js';
 import { askUserQuestionRuntime } from '../../tool-runtime/ask-user-question-runtime.js';
 import { dispatchToolByName, listToolRuntimes } from '../../tool-runtime/registry.js';
+import { ACP_SESSION_RUNTIMES } from '../../tool-runtime/acp-session-runtime.js';
+import { ClaudeSubscriptionNotAllowedError } from '../../policy/claude-subscription-guard.js';
 import { toWireToolName } from '../../tool-runtime/mcp-wire-name.js';
 import type { ToolRuntime } from '../../tool-runtime/types.js';
 
@@ -230,6 +232,7 @@ function dispatchDaemonMcpRuntime(
   return dispatchToolByName(name, args, {
     surface: 'tui',
     signal: ctx.signal,
+    ...(ctx.requestOrigin ? { requestOrigin: ctx.requestOrigin } : {}),
     ...(ctx.sessionId ? { sessionId: ctx.sessionId } : {}),
     ...(ctx.toolCallId ? { toolCallId: ctx.toolCallId } : {}),
     ...(ctx.emitFeedback ? { emitFeedback: ctx.emitFeedback } : {}),
@@ -335,6 +338,7 @@ export function toolSurface(kind: DaemonToolSurfaceKind, cfg?: import('../../use
     //   ⭐ 재발명하지 않는다: `askUserQuestionRuntime` 이 spec ⊕ dispatch 를 한 묶음으로 «이미» 갖고 있고,
     //      ACP 브릿지 → SSE 채널 순의 사다리도 그 안에서 이미 돈다(`#16031`).
     askUserQuestionRuntime.spec,
+    ...ACP_SESSION_RUNTIMES.map((runtime) => runtime.spec),
     ...shared.specs, // L2 core + L3 finance(gated) — buildSharedAppTools 단일 출처(전 서피스 공용)
   ];
 
@@ -372,6 +376,18 @@ export function toolSurface(kind: DaemonToolSurfaceKind, cfg?: import('../../use
       }
       return dispatchDelegateAgent(args, ctx);
     }
+    const acpRuntime = ACP_SESSION_RUNTIMES.find((runtime) => runtime.spec.name === name);
+    if (acpRuntime) {
+      try {
+        return await acpRuntime.run(args, {
+          surface: 'tui',
+          ...(ctx.requestOrigin ? { requestOrigin: ctx.requestOrigin } : {}),
+        });
+      } catch (error) {
+        if (error instanceof ClaudeSubscriptionNotAllowedError) return { error: error.message };
+        throw error;
+      }
+    }
     if (shared.names.has(name)) {
       return shared.dispatch(name, args); // L2 core + L3 finance(gated) — buildSharedAppTools 단일 dispatch
     }

package/src/boot/daemon-tools/self-implement.ts

@@ -189,6 +189,7 @@ export async function dispatchSelfImplement(
   const ground = typeof args.ground === 'boolean' ? args.ground : undefined;
   const adversarialReview = typeof args.adversarialReview === 'boolean' ? args.adversarialReview : undefined;
   const autoMerge = ctx.autoMerge;
+  const autoReview = autoMerge === true ? true : undefined;
 
   // 막 — ctx 의 서피스 필드(surfaceHitlChannels/surfaceFileSink/emitFeedback)를 SurfaceUx 로.
   const ux = surfaceUxFromDispatchCtx(ctx);
@@ -204,6 +205,7 @@ export async function dispatchSelfImplement(
     entry,
     ground,
     adversarialReview,
+    autoReview,
   });
   const originalUserText = ctx.userText;
   const goalSourceText = originalUserText;
@@ -268,6 +270,7 @@ export async function dispatchSelfImplement(
     progress: ux.progress,
     ...(goalFile ? { goalFile } : {}),
     ...(autoMerge !== undefined ? { autoMerge } : {}),
+    ...(autoReview ? { autoReview } : {}),
   };
   // 승인 통로는 surface seams.approvePr 하나다. opts/pipelineDeps.approver를 보강하면
   // 중앙 심이 seams를 다시 조립해 fail-closed 승인 게이트를 우회할 수 있다.
@@ -283,6 +286,7 @@ export async function dispatchSelfImplement(
       ...(goalFile ? { goalFile } : {}),
       ...(ground !== undefined ? { ground } : {}),
       ...(autoMerge !== undefined ? { autoMerge } : {}),
+      ...(autoReview ? { autoReview } : {}),
       seams,
     })
     : await runSelfImplementViaCli(runCli, feature, cliOpts, { pipelineDeps });

package/src/boot/daemon-tools/types.ts

@@ -9,6 +9,7 @@ import type { LLMToolSpec } from '../../llm.js';
 import type { FeedbackEnvelope } from '../../feedback/envelope.js';
 import type { IngestionEntry } from '../../agent-substrate/execution/ingestion-policy.js';
 import type { SurfaceKind } from '../../agent/surface-ux/types.js';
+import type { RequestOrigin } from '../../policy/claude-subscription-guard.js';
 
 /** Activation level requested by the operator.
  *
@@ -58,6 +59,8 @@ export interface DaemonToolDispatchCtx {
    *  the args. Optional for backward compat with tests / surfaces that
    *  build the ctx by hand without a session in scope. */
   sessionId?: string;
+  /** Trusted server-side classification of the current turn, never supplied as a tool argument. */
+  requestOrigin?: RequestOrigin;
   /** Ingestion entry class. Omit for conservative external-verbatim fallback. */
   entry?: IngestionEntry;
   /** M5 PR 2 (PLAN-rich-dev-feedback-multi-surface · 2026-05-13) —

package/src/boot/daemon-tools/web-search.ts

@@ -39,7 +39,8 @@ export function buildWebSearchTool(): LLMToolSpec {
     name: 'WebSearch',
     description:
       'Search the public web via the daemon\'s configured provider (Grok / ' +
-      'Firecrawl / etc.). Returns a ranked list of URLs + titles + snippets. ' +
+      'Firecrawl / etc.). When no key is available, falls back to keyless DuckDuckGo. ' +
+      'Returns a ranked list of URLs + titles + snippets. ' +
       'Pair with a follow-up Read or external WebFetch when the model needs ' +
       'the full article body.',
     parameters: {

package/src/boot/ws-bridge.ts

@@ -26,6 +26,7 @@ import type {
   PwaVoiceSession,
 } from '../voice/channel-adapters/pwa-voice-adapter.js';
 import { PWA_VOICE_FRAME_KIND } from '../voice/channel-adapters/pwa-voice-adapter.js';
+import { isSameOriginRequest } from './check-same-origin.js';
 import {
   buildDevProxyWsUrl,
   closeDevProxyUpstream,
@@ -47,6 +48,8 @@ export type WsLike = {
 
 export type BunServerLike = {
   upgrade: (req: Request, opts?: { data?: unknown; headers?: HeadersInit }) => boolean;
+  /** Bun's transport peer — used only for the same-origin exemption (HTTP 과 같은 규칙). */
+  requestIP?: (req: Request) => { address: string } | null;
 };
 
 export type WsHandlers = {
@@ -246,6 +249,14 @@ export function createWsBridge(opts: WsBridgeOpts): WsBridge {
             });
           }
           authed = true;
+        } else if (isSameOriginRequest(req, server.requestIP?.(req)?.address)) {
+          // ⭐ HTTP 의 same-origin 면제(`meta-api.ts` decideAuth)와 «같은» 규칙 — 루프백 직결 ⊕ 프록시 표지 없음 ⊕
+          //   Sec-Fetch-Site/Origin 이 같은 출처. 이 데몬이 내준 PWA 페이지가 토큰 없이 연 소켓이다.
+          // 🩸 2026-09-30 0.2.5 회귀: #21937 이 토큰을 «늘» 만들게 되면서 WS 검증기가 늘 켜졌고, 토큰을
+          //   저장하지 않은 PWA(새 설치 · 격리 넥서스)의 ACP 가 첫 `initialize` 에서 1008 auth_failed 로 닫혔다
+          //   — HTTP 는 이 면제로 살아 있어 «목록은 뜨는데 채팅·터미널만 죽는» 모양이 됐다.
+          authed = true;
+          trace('acp.ws.same-origin', { path: url.pathname });
         }
       }
       const acpState: AcpPerSocketState = {

package/src/browser-cdp/chrome-flags.ts

@@ -0,0 +1,7 @@
+// A Chrome launched with a fresh --user-data-dir tries to create «Chrome Safe Storage» in the macOS
+// keychain. Headless or temporary profiles cannot, so Chrome pops «Keychain Not Found» on the human's
+// screen (09-28: dozens of popups from headless recorders and CDP clients). These two official flags
+// keep secrets in a per-profile mock store instead. Every launch that sets --user-data-dir must pass
+// them — including the visible sign-in window for a persistent profile, so later headless launches
+// can still decrypt the same profile's cookies (the key must not change between launches).
+export const CHROME_NO_KEYCHAIN_FLAGS = ['--use-mock-keychain', '--password-store=basic'] as const;

package/src/browser-cdp/client.ts

@@ -13,6 +13,7 @@
 // describes. Full Puppeteer feature parity is explicitly out of
 // scope.
 
+import { CHROME_NO_KEYCHAIN_FLAGS } from './chrome-flags.js';
 import { spawn, type ChildProcess } from 'node:child_process';
 import { existsSync, mkdtempSync, readFileSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
@@ -382,6 +383,7 @@ export async function createCdpClient(
     `--user-data-dir=${profileDir}`,
     '--no-first-run',
     '--no-default-browser-check',
+    ...CHROME_NO_KEYCHAIN_FLAGS,
     '--disable-gpu-vsync',
     // Security: lock the remote-debugging endpoint to loopback only.
     '--remote-debugging-address=127.0.0.1',

package/src/browser-pane/mount.ts

@@ -1,9 +1,4 @@
-import { dirname } from 'path';
-
 import type { DisplayCoordinator } from '../display/coordinator.js';
-import { PaneContent, type PaneBroadcast, type PaneUnsubscribe } from '../virtual-windows/pane-content.js';
-import { mintPaneId } from '../virtual-windows/addressing.js';
-import type { Action, DisplayMouseEvent, KeyEvent } from '../display/types.js';
 import {
   showLivePaneMultiModal,
   showPaneMultiModal,
@@ -20,32 +15,13 @@ import {
 import type { ThemeTokens } from '../theme/tokens.js';
 import type { WidgetHost } from '../widgets/host.js';
 import type { BrowserPaneRegistry } from './registry.js';
-import {
-  focusedBrowserEntry,
-  refreshBrowserPane,
-  toggleBrowserSelection,
-  type FsEntry,
-  type BrowserPaneModel,
-} from './model.js';
-import { C, pad, truncate, visibleWidth } from '../tui.js';
-import { dirColor, fileColor, fileIcon, sizeStr } from '../panes/file-icons.js';
+import type { FsEntry } from './model.js';
 import {
   navigateBrowserPreviewModalDirectory,
   projectBrowserPreviewModalBrowserState,
   syncBrowserPreviewModalCursorFromWidgetState,
 } from '../dashboard/modals/browser-preview-modal-seams.js';
 
-export interface BrowserPaneContentSpec {
-  kind: 'vw-browser';
-  browserId: string;
-  title?: string;
-}
-
-export interface BrowserPaneMountDeps {
-  browserPaneRegistry: BrowserPaneRegistry;
-  refreshRemoteBrowserPane?: (state: BrowserPaneModel) => Promise<void>;
-}
-
 export interface OpenBrowserPaneModalDeps {
   browserWidgetInstanceId: string;
   liveMode: boolean;
@@ -63,110 +39,6 @@ export interface OpenBrowserPaneModalDeps {
   onCancel?(): void;
 }
 
-function createObserver(): {
-  emit: () => void;
-  on: (event: 'update' | 'output' | 'exit', cb: () => void) => PaneUnsubscribe;
-} {
-  const subs = new Map<'update' | 'output' | 'exit', Set<() => void>>();
-  return {
-    emit() {
-      for (const cb of subs.get('update') ?? []) {
-        try { cb(); } catch { /* ignore */ }
-      }
-    },
-    on(event, cb) {
-      const set = subs.get(event) ?? new Set<() => void>();
-      set.add(cb);
-      subs.set(event, set);
-      return () => { set.delete(cb); };
-    },
-  };
-}
-
-function clampBrowserOffset(state: BrowserPaneModel, rows: number): void {
-  const bodyRows = Math.max(1, rows);
-  if (state.cursor < state.offset) {
-    state.offset = state.cursor;
-    return;
-  }
-  if (state.cursor >= state.offset + bodyRows) {
-    state.offset = Math.max(0, state.cursor - bodyRows + 1);
-  }
-}
-
-function formatBrowserLine(
-  state: BrowserPaneModel,
-  entry: BrowserPaneModel['entries'][number],
-  focused: boolean,
-  width: number,
-): string {
-  const cursor = focused ? C.bold('›') : ' ';
-  const selected = !entry.isDir && state.selected.has(entry.absPath) ? C.success('●') : ' ';
-  if (entry.name === '..') {
-    const raw = `${cursor} ${selected} ${C.muted('↩')} ${C.muted('..')}`;
-    return visibleWidth(raw) > width ? truncate(raw, width) : pad(raw, width);
-  }
-  if (entry.isDir) {
-    const raw = `${cursor} ${selected} ${C.accent('')} ${dirColor(entry.name)}`;
-    return visibleWidth(raw) > width ? truncate(raw, width) : pad(raw, width);
-  }
-  const icon = fileColor(entry.name)(fileIcon(entry.name));
-  const name = fileColor(entry.name)(entry.name);
-  const size = C.muted(sizeStr(entry.size));
-  const raw = `${cursor} ${selected} ${icon} ${name} ${size}`;
-  return visibleWidth(raw) > width ? truncate(raw, width) : pad(raw, width);
-}
-
-async function refreshBrowserContentState(
-  state: BrowserPaneModel,
-  deps: BrowserPaneMountDeps,
-): Promise<void> {
-  if (!state.remote) {
-    refreshBrowserPane(state);
-    return;
-  }
-  await deps.refreshRemoteBrowserPane?.(state);
-}
-
-async function navigateBrowserContent(
-  state: BrowserPaneModel,
-  deps: BrowserPaneMountDeps,
-  direction: 'parent' | 'into',
-): Promise<boolean> {
-  if (!state.remote) {
-    if (direction === 'parent') {
-      const parent = dirname(state.cwd);
-      if (parent === state.cwd) return false;
-      state.cwd = parent;
-    } else {
-      const entry = focusedBrowserEntry(state);
-      if (!entry || !entry.isDir || entry.name === '..') return false;
-      state.cwd = entry.absPath;
-    }
-    state.cursor = 0;
-    state.offset = 0;
-    state.selected.clear();
-    refreshBrowserPane(state);
-    return true;
-  }
-
-  const nextCwd = direction === 'parent'
-    ? dirname(state.remote.cwd)
-    : (() => {
-        const entry = focusedBrowserEntry(state);
-        if (!entry || !entry.isDir || entry.name === '..') return null;
-        return entry.absPath;
-      })();
-  if (!nextCwd || nextCwd === state.remote.cwd) return false;
-  state.remote = { host: state.remote.host, cwd: nextCwd };
-  state.cwd = nextCwd;
-  state.cursor = 0;
-  state.offset = 0;
-  state.selected.clear();
-  await refreshBrowserContentState(state, deps);
-  return true;
-}
-
 export function createBrowserPaneModalChrome(
   theme: ThemeTokens,
   liveMode: boolean,
@@ -368,120 +240,3 @@ export function openBrowserPaneModal(
   handle = showPaneMultiModal(params);
   return handle;
 }
-
-export function createBrowserPaneContent(
-  spec: BrowserPaneContentSpec,
-  deps: BrowserPaneMountDeps,
-): PaneContent {
-  const state = deps.browserPaneRegistry.get(spec.browserId);
-  if (!state) {
-    throw new Error(`createBrowserPaneContent: unknown browser id "${spec.browserId}"`);
-  }
-  const obs = createObserver();
-  let lastRows = 12;
-
-  return {
-    id: mintPaneId(),
-    kind: spec.kind,
-    title: spec.title ?? 'browser',
-    focusPolicy: 'interactive',
-    start() {},
-    stop() {},
-    render(ctx) {
-      lastRows = Math.max(1, ctx.rows);
-      clampBrowserOffset(state, ctx.rows);
-      const bodyRows = Math.max(1, ctx.rows);
-      const lines: string[] = [];
-      for (let i = 0; i < bodyRows; i++) {
-        const entry = state.entries[state.offset + i];
-        if (!entry) {
-          lines.push(' '.repeat(Math.max(0, ctx.cols)));
-          continue;
-        }
-        lines.push(formatBrowserLine(state, entry, state.offset + i === state.cursor, ctx.cols));
-      }
-      return lines.join('\n');
-    },
-    onKey(ev) {
-      const rows = lastRows;
-      if (ev.name === 'up' || ev.name === 'k') {
-        state.cursor = Math.max(0, state.cursor - 1);
-        clampBrowserOffset(state, rows);
-        obs.emit();
-        return { type: 'refresh' };
-      }
-      if (ev.name === 'down' || ev.name === 'j') {
-        state.cursor = Math.min(Math.max(0, state.entries.length - 1), state.cursor + 1);
-        clampBrowserOffset(state, rows);
-        obs.emit();
-        return { type: 'refresh' };
-      }
-      if (ev.name === 'pageup') {
-        state.cursor = Math.max(0, state.cursor - rows);
-        clampBrowserOffset(state, rows);
-        obs.emit();
-        return { type: 'refresh' };
-      }
-      if (ev.name === 'pagedown') {
-        state.cursor = Math.min(Math.max(0, state.entries.length - 1), state.cursor + rows);
-        clampBrowserOffset(state, rows);
-        obs.emit();
-        return { type: 'refresh' };
-      }
-      if (ev.name === 'home' || ev.name === 'g') {
-        state.cursor = 0;
-        state.offset = 0;
-        obs.emit();
-        return { type: 'refresh' };
-      }
-      if (ev.name === 'end' || (ev.name === 'G' && ev.shift)) {
-        state.cursor = Math.max(0, state.entries.length - 1);
-        clampBrowserOffset(state, rows);
-        obs.emit();
-        return { type: 'refresh' };
-      }
-      if (ev.name === ' ') {
-        toggleBrowserSelection(state);
-        obs.emit();
-        return { type: 'refresh' };
-      }
-      if (ev.name === 'left' || ev.name === 'h') {
-        void navigateBrowserContent(state, deps, 'parent').then(() => obs.emit());
-        return { type: 'refresh' };
-      }
-      if (ev.name === 'right' || ev.name === 'l' || ev.name === 'enter') {
-        const entry = focusedBrowserEntry(state);
-        if (!entry?.isDir) return { type: 'none' };
-        void navigateBrowserContent(state, deps, 'into').then(() => obs.emit());
-        return { type: 'refresh' };
-      }
-      return { type: 'none' };
-    },
-    onMouse(ev: DisplayMouseEvent): Action {
-      const delta = Math.max(1, Math.floor(lastRows / 3));
-      if (ev.type === 'scroll-up') {
-        state.cursor = Math.max(0, state.cursor - delta);
-        clampBrowserOffset(state, lastRows);
-        obs.emit();
-        return { type: 'refresh' };
-      }
-      if (ev.type === 'scroll-down') {
-        state.cursor = Math.min(Math.max(0, state.entries.length - 1), state.cursor + delta);
-        clampBrowserOffset(state, lastRows);
-        obs.emit();
-        return { type: 'refresh' };
-      }
-      return { type: 'none' };
-    },
-    write(_bytes: string) {},
-    acceptBroadcast(_input: PaneBroadcast) {},
-    capture() {
-      return state.entries.map((entry, index) =>
-        formatBrowserLine(state, entry, index === state.cursor, 120),
-      ).join('\n');
-    },
-    get isAlive() { return true; },
-    on: obs.on,
-    dispose() {},
-  };
-}

package/src/budget/codex-reset-credit-state.ts

@@ -124,6 +124,9 @@ interface QuotaSignalState {
   observedAt?: string;
   /** ⭐ 이 관측이 «어느 홈»을 잰 것인가. 파일 이름은 해시라 사람이 못 읽는다. */
   measuredHome?: string;
+  /** 선불 크레딧 잔액·보유(대표 09-28 크레딧 정책 — 한도가 찬 뒤 «어느 계정 크레딧으로» 갈지 고르는 재료). */
+  creditsBalance?: number;
+  hasCredits?: boolean;
 }
 
 /**
@@ -212,6 +215,7 @@ export function writeQuotaSignal(
   usedPercentOrHome?: number | string,
   homePath?: string,
   storage?: QuotaSignalStorageOpts,
+  credits?: { readonly balance?: number; readonly hasCredits?: boolean },
 ): void {
   try {
     const usedPercent = typeof usedPercentOrHome === 'number' && Number.isFinite(usedPercentOrHome)
@@ -225,6 +229,8 @@ export function writeQuotaSignal(
       ...(usedPercent === undefined ? {} : { usedPercent }),
       observedAt: new Date().toISOString(),
       measuredHome: normalizeHome(home?.trim() || process.env.CODEX_HOME?.trim() || join(homedir(), '.codex')),
+      ...(typeof credits?.balance === 'number' && Number.isFinite(credits.balance) ? { creditsBalance: credits.balance } : {}),
+      ...(typeof credits?.hasCredits === 'boolean' ? { hasCredits: credits.hasCredits } : {}),
     };
     writeFileSync(path, `${JSON.stringify(next, null, 2)}\n`, 'utf8');
   } catch { /* fail-soft */ }
@@ -284,6 +290,15 @@ export function readQuotaSignalObservedAt(nowMs: number = Date.now(), homePath?:
   return Number.isFinite(parsed) ? parsed : undefined;
 }
 
+/** 최근의 크레딧 잔액·보유. 옛 파일·낡은 신호·다른 홈은 모두 모른다(빈 객체). */
+export function readQuotaSignalCredits(nowMs: number = Date.now(), homePath?: string, storage?: QuotaSignalStorageOpts): { balance?: number; hasCredits?: boolean } {
+  const s = readFreshQuotaSignal(nowMs, homePath, storage);
+  return {
+    ...(typeof s?.creditsBalance === 'number' && Number.isFinite(s.creditsBalance) ? { balance: s.creditsBalance } : {}),
+    ...(typeof s?.hasCredits === 'boolean' ? { hasCredits: s.hasCredits } : {}),
+  };
+}
+
 /** 최근의 브랜드 총량 사용률. 옛 파일·낡은 신호·다른 홈은 모두 모른다. */
 export function readQuotaSignalUsedPercent(nowMs: number = Date.now(), homePath?: string, storage?: QuotaSignalStorageOpts): number | undefined {
   const usedPercent = readFreshQuotaSignal(nowMs, homePath, storage)?.usedPercent;