elanous 0.2.14 → 0.2.16

package/src/agent-mission/supervisor-metrics.ts

@@ -0,0 +1,218 @@
+// X2 — 외부 에이전트 미션 슈퍼바이저 품질 지표. 읽기 전용.
+// 새 기록을 만들지 않는다. 이미 남는 미션 로그(logs.db)만 집계한다.
+// 기록이 없는 지표는 0 이 아니라 «못 잼 · 이유»다. 창 안 미션이 0 이면 «미션 없음».
+
+import { existsSync } from 'node:fs';
+import { LogStore, logsDbPath, type LogStoreRow } from '../mss/logging/log-store.js';
+
+export const SUPERVISOR_METRICS_DEFAULT_SINCE = '7d';
+
+const RESULT_CATEGORY = 'agent-mission';
+const RESULT_EVENT = 'result';
+const DECISION_CATEGORY = 'pty.decision';
+const ANSWER_EVENT = 'answer';
+const CONTROL_CATEGORY = 'autopilot.control';
+const CONTROL_END_EVENT = 'end';
+const STALL_CATEGORY = 'self-implement';
+const STALL_EVENT = 'frame-stall';
+const LADDER_CATEGORY = 'agent-mission.resources';
+
+const LADDER_STEPS = ['needs', 'have', 'official-index', 'backend', 'discover'] as const;
+
+export interface MetricRow {
+  readonly id: 'completion' | 'questionsAnswered' | 'unnecessaryInterventions' | 'stall' | 'ladderHits';
+  readonly label: string;
+  readonly status: 'measured' | 'unmeasured' | 'no-missions';
+  readonly reason?: string;
+  readonly value?: number | string;
+  readonly detail?: Record<string, number | string>;
+}
+
+export interface SupervisorMetricsReport {
+  readonly since: string;
+  readonly sinceMs: number;
+  readonly missions: number;
+  readonly status: 'measured' | 'no-missions';
+  readonly metrics: readonly MetricRow[];
+}
+
+export interface SupervisorLogRow {
+  readonly tsMs: number;
+  readonly category: string;
+  readonly event: string;
+  readonly data: Record<string, unknown> | null;
+}
+
+export interface ReadSupervisorLogs {
+  (sinceMs: number, nowMs: number): readonly SupervisorLogRow[];
+}
+
+function parseData(raw: string | null): Record<string, unknown> | null {
+  if (!raw) return null;
+  try {
+    const parsed: unknown = JSON.parse(raw);
+    return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed as Record<string, unknown> : null;
+  } catch {
+    return null;
+  }
+}
+
+function missionKey(data: Record<string, unknown> | null): string | null {
+  const runId = data?.runId;
+  if (typeof runId === 'string' && runId.trim()) return runId.trim();
+  const missionId = data?.missionId;
+  if (typeof missionId === 'string' && missionId.trim()) return missionId.trim();
+  return null;
+}
+
+function linkedRows(rows: readonly SupervisorLogRow[], missionIds: ReadonlySet<string>): { linked: SupervisorLogRow[]; unlinked: boolean } {
+  const linked: SupervisorLogRow[] = [];
+  let unlinked = false;
+  for (const row of rows) {
+    const key = missionKey(row.data);
+    if (key && missionIds.has(key)) linked.push(row);
+    else unlinked = true;
+  }
+  return { linked, unlinked };
+}
+
+const UNLINKED_REASON = '못 잼 · 미션과 연결 불가';
+
+function unmeasured(id: MetricRow['id'], label: string, reason: string): MetricRow {
+  return { id, label, status: 'unmeasured', reason };
+}
+
+/** 주입된 로그만으로 다섯 지표를 집계한다. 스토어를 열지 않는다. */
+export function aggregateSupervisorMetrics(
+  rows: readonly SupervisorLogRow[],
+  opts: { since?: string; sinceMs: number },
+): SupervisorMetricsReport {
+  const since = opts.since ?? SUPERVISOR_METRICS_DEFAULT_SINCE;
+  const results = rows.filter((row) => row.category === RESULT_CATEGORY && row.event === RESULT_EVENT);
+  const missionIds = new Set(results.map((row) => missionKey(row.data)).filter((key): key is string => key !== null));
+  const missions = results.length;
+  if (missions === 0) {
+    const reason = '미션 없음';
+    return {
+      since,
+      sinceMs: opts.sinceMs,
+      missions: 0,
+      status: 'no-missions',
+      metrics: [
+        { id: 'completion', label: '완주율', status: 'no-missions', reason },
+        { id: 'questionsAnswered', label: '대화형 질문에 답해 넘긴 수', status: 'no-missions', reason },
+        { id: 'unnecessaryInterventions', label: '불필요했던 슈퍼바이저 개입', status: 'no-missions', reason },
+        { id: 'stall', label: '멈춤 감지 · 실제 멈춤', status: 'no-missions', reason },
+        { id: 'ladderHits', label: '사다리 단계별 적중', status: 'no-missions', reason },
+      ],
+    };
+  }
+
+  const completed = results.filter((row) => row.data?.ok === true).length;
+  const completion: MetricRow = {
+    id: 'completion',
+    label: '완주율',
+    status: 'measured',
+    value: `${completed}/${missions}`,
+    detail: { completed, missions, rate: completed / missions },
+  };
+
+  const answerCandidates = rows.filter((row) => row.category === DECISION_CATEGORY && row.event === ANSWER_EVENT);
+  const answers = linkedRows(answerCandidates, missionIds);
+  const questionsAnswered: MetricRow = answers.unlinked
+    ? unmeasured('questionsAnswered', '대화형 질문에 답해 넘긴 수', UNLINKED_REASON)
+    : answers.linked.length === 0
+    ? unmeasured('questionsAnswered', '대화형 질문에 답해 넘긴 수', '못 잼 · pty.decision answer 기록 없음')
+    : {
+      id: 'questionsAnswered',
+      label: '대화형 질문에 답해 넘긴 수',
+      status: 'measured',
+      value: answers.linked.length,
+      detail: { answered: answers.linked.length },
+    };
+
+  const endCandidates = rows.filter((row) => row.category === CONTROL_CATEGORY && row.event === CONTROL_END_EVENT && row.data?.interventionLevel !== undefined);
+  const ends = linkedRows(endCandidates, missionIds);
+  // 종료 상태와 verdict 는 개입이 불필요했다는 인과 근거가 아니다.
+  const unnecessaryInterventions: MetricRow = unmeasured('unnecessaryInterventions', '불필요했던 슈퍼바이저 개입', ends.unlinked
+    ? UNLINKED_REASON
+    : ends.linked.length === 0
+      ? '못 잼 · autopilot.control end 개입 기록 없음'
+      : '못 잼 · 개입 불필요성 근거 기록 없음');
+
+  const stallCandidates = rows.filter((row) => row.category === STALL_CATEGORY && row.event === STALL_EVENT);
+  const stalls = linkedRows(stallCandidates, missionIds);
+  // frame-stall is a detector stage, not a record that a mission actually stopped.
+  const stall: MetricRow = unmeasured('stall', '멈춤 감지 · 실제 멈춤', stalls.unlinked
+    ? UNLINKED_REASON
+    : stalls.linked.length === 0
+      ? '못 잼 · self-implement frame-stall 기록 없음'
+      : '못 잼 · 실제 멈춤 근거 기록 없음');
+
+  const ladderCandidates = rows.filter((row) => row.category === LADDER_CATEGORY && LADDER_STEPS.includes(row.event as typeof LADDER_STEPS[number]));
+  const ladderRows = linkedRows(ladderCandidates, missionIds);
+  // VERIFY/ROUTE are decisions. No outcome record connects a step to an observed success.
+  const ladderHits: MetricRow = unmeasured('ladderHits', '사다리 단계별 적중', ladderRows.unlinked
+    ? UNLINKED_REASON
+    : ladderRows.linked.length === 0
+      ? '못 잼 · agent-mission.resources 사다리 기록 없음'
+      : '못 잼 · 사다리 적중 근거 기록 없음');
+
+  return {
+    since,
+    sinceMs: opts.sinceMs,
+    missions,
+    status: 'measured',
+    metrics: [completion, questionsAnswered, unnecessaryInterventions, stall, ladderHits],
+  };
+}
+
+export function readSupervisorLogsFromStore(path: string = logsDbPath()): ReadSupervisorLogs {
+  return (sinceMs, nowMs) => {
+    if (!existsSync(path)) return [];
+    const store = LogStore.openReadOnly(path);
+    try {
+      const queried: LogStoreRow[] = store.queryAll({
+        exactCategories: [RESULT_CATEGORY, DECISION_CATEGORY, CONTROL_CATEGORY, STALL_CATEGORY, LADDER_CATEGORY],
+        sinceMs,
+        untilMs: nowMs,
+      });
+      return queried
+        .filter((row) => row.ts_ms >= sinceMs && row.ts_ms <= nowMs)
+        .filter((row) =>
+          (row.category === RESULT_CATEGORY && row.event === RESULT_EVENT)
+          || (row.category === DECISION_CATEGORY && row.event === ANSWER_EVENT)
+          || (row.category === CONTROL_CATEGORY && row.event === CONTROL_END_EVENT)
+          || (row.category === STALL_CATEGORY && row.event === STALL_EVENT)
+          || (row.category === LADDER_CATEGORY && (LADDER_STEPS as readonly string[]).includes(row.event)))
+        .map((row) => ({ tsMs: row.ts_ms, category: row.category, event: row.event, data: parseData(row.data) }));
+    } finally {
+      store.close();
+    }
+  };
+}
+
+export function loadSupervisorMetrics(
+  since: string,
+  sinceMs: number,
+  nowMs: number,
+  read: ReadSupervisorLogs = readSupervisorLogsFromStore(),
+): SupervisorMetricsReport {
+  return aggregateSupervisorMetrics(read(sinceMs, nowMs), { since, sinceMs });
+}
+
+export function formatSupervisorMetrics(report: SupervisorMetricsReport): string {
+  const lines = [`agent-mission metrics · since ${report.since} · 미션 ${report.missions}`];
+  if (report.status === 'no-missions') {
+    lines.push('미션 없음');
+    return lines.join('\n');
+  }
+  for (const metric of report.metrics) {
+    if (metric.status === 'unmeasured') {
+      lines.push(`${metric.label}: ${metric.reason}`);
+      continue;
+    }
+    lines.push(`${metric.label}: ${metric.value}`);
+  }
+  return lines.join('\n');
+}

package/src/agent-substrate/pr-reviewer.ts

@@ -825,6 +825,8 @@ export async function reviewPullRequest(
 
 /** 리뷰 결과를 PR 코멘트/알림/CLI 용 markdown 으로 렌더. */
 export function renderReview(r: ReviewResult): string {
+  // A review that never ran must not read as PASS anywhere it is rendered (PR body, comments, CLI) — 10-05 #23942·#24151.
+  if (r.reviewed === false) return `⚠️ 자율 PR 리뷰: 리뷰 안 돎 — 사유 ${r.failureReason?.trim() || '미상'} (통과 판정 아님)`;
   const icon = r.verdict === 'pass' ? '✅' : r.verdict === 'warn' ? '⚠️' : '⛔';
   const head = `${icon} 자율 PR 리뷰: ${r.verdict.toUpperCase()}`;
   const parts = [head];

package/src/ask-user-question/pending-questions.ts

@@ -9,6 +9,8 @@ export interface PendingQuestion {
   id: string;
   sessionId?: string;
   runId?: string;
+  /** Explicit provenance for isolated test questions; a temporary goal path alone is not proof. */
+  testOrigin?: true;
   questions: Array<Pick<Question, 'id' | 'question' | 'options' | 'impact' | 'recommendedIndex'>>;
   startedAt: string;
   expiresAt?: string;
@@ -84,6 +86,7 @@ function isPendingQuestion(value: unknown): value is PendingQuestion {
   return typeof pending.id === 'string'
     && (pending.sessionId === undefined || typeof pending.sessionId === 'string')
     && (pending.runId === undefined || typeof pending.runId === 'string')
+    && (pending.testOrigin === undefined || pending.testOrigin === true)
     && Array.isArray(pending.questions)
     && pending.questions.every((question) => {
       if (question === null || typeof question !== 'object' || Array.isArray(question)) return false;
@@ -175,6 +178,7 @@ export function createPendingQuestion(
   sessionId?: string,
   deps: Pick<PendingQuestionStoreDeps, 'now'> = {},
   presentation: PendingQuestionPresentation = { surface: 'tui', delivery: request.delivery ?? 'modal' },
+  provenance: { testOrigin?: true } = {},
 ): PendingQuestion {
   // File-surface waits must carry a concrete deadline so the CLI answer path can
   // reject an expired record (see isPendingQuestion). Fail loudly at creation
@@ -186,6 +190,7 @@ export function createPendingQuestion(
     id,
     ...(sessionId === undefined ? {} : { sessionId }),
     ...(request.runId === undefined ? {} : { runId: request.runId }),
+    ...(provenance.testOrigin ? { testOrigin: true as const } : {}),
     questions: request.questions.map(({ id, question, options, impact, recommendedIndex }) => ({
       id, question, options,
       ...(impact === undefined ? {} : { impact }),

package/src/auth/github-app-token.ts

@@ -1,6 +1,6 @@
 import { createHash, createSign } from 'node:crypto';
 import { spawnSync } from 'node:child_process';
-import { existsSync, readFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs';
 import { dirname, isAbsolute, join } from 'node:path';
 import { getElanousConfigDir, getElanousConfigDirOverride } from '../elanous-config-dir.js';
 import { prodInstanceRoot } from '../instance/resolve.js';
@@ -45,21 +45,23 @@ export function githubAutomationToken(deps: GithubAutomationTokenDeps = {}): str
   return githubInstallationCredential(deps)?.token ?? null;
 }
 
+/** The App credential is machine-level (like `gh auth` in ~/.config/gh), not per universe: a tree-derived test
+ *  universe resolves its config dir to `<tree>/.elanous-test`, where the file never is — 09-29 #21879 was inert there.
+ *  Order: explicit path → this universe's config dir → the prod root `~/.elanous`.
+ *  An explicit config-dir override (tests · `--config-dir`) is a deliberate boundary — never reach past it.
+ *  ELANOUS_GITHUB_APP_CONFIG_PATH pins the machine-level fallback (the bun test preload points it at nothing,
+ *  so tests never mint); an explicit config-dir override still wins. */
+function appConfigPath(explicit?: string): string {
+  const rel = join('secrets', 'github-app', 'app.json');
+  const own = join(getElanousConfigDir(), rel);
+  const pinned = process.env.ELANOUS_GITHUB_APP_CONFIG_PATH?.trim();
+  return explicit ?? (getElanousConfigDirOverride() ? own : pinned || (existsSync(own) ? own : join(prodInstanceRoot(), rel)));
+}
+
 /** Scoped requests always mint anew; the returned expiry comes from GitHub's response. */
 export function githubInstallationCredential(deps: GithubAutomationTokenDeps = {}): { token: string; expires_at: string } | null {
   let path: string;
-  // The App credential is machine-level (like `gh auth` in ~/.config/gh), not per universe: a tree-derived test
-  // universe resolves its config dir to `<tree>/.elanous-test`, where the file never is — 09-29 #21879 was inert there.
-  // Order: explicit path → this universe's config dir → the prod root `~/.elanous`.
-  try {
-    const rel = join('secrets', 'github-app', 'app.json');
-    const own = join(getElanousConfigDir(), rel);
-    // An explicit config-dir override (tests · `--config-dir`) is a deliberate boundary — never reach past it.
-    // ELANOUS_GITHUB_APP_CONFIG_PATH pins the machine-level fallback (the bun test preload points it at nothing,
-    // so tests never mint); an explicit config-dir override still wins.
-    const pinned = process.env.ELANOUS_GITHUB_APP_CONFIG_PATH?.trim();
-    path = deps.configPath ?? (getElanousConfigDirOverride() ? own : pinned || (existsSync(own) ? own : join(prodInstanceRoot(), rel)));
-  }
+  try { path = appConfigPath(deps.configPath); }
   catch {
     try { debug.log('auth.github-app', 'token-failed', { reason: 'config-path-failed' }); } catch { /* fail open */ }
     return null;
@@ -113,3 +115,100 @@ export function githubInstallationCredential(deps: GithubAutomationTokenDeps = {
     return null;
   }
 }
+
+/** PODCRED1 (10-05): simultaneous launches each minted a scoped token in the same second and the Pods' logins died
+ *  together (12:49Z · 5 in 2 s). Concurrent issuers for one repository — across processes — share one mint: the first
+ *  takes a lock and mints, the others wait and reuse that result while it is recent and long-lived. */
+export interface CoalescedInstallationOptions {
+  cacheDir?: string;
+  /** Reuse a token minted at most this long ago. */
+  windowMs?: number;
+  /** …and only while it still has this much life left. */
+  minRemainingMs?: number;
+  /** Skip reuse (still mint under the lock and publish the result) — for a retry after the shared token failed. */
+  fresh?: boolean;
+  lockWaitMs?: number;
+  staleLockMs?: number;
+  now?: () => number;
+  sleepSync?: (ms: number) => void;
+  mint?: (scope: GithubInstallationTokenScope) => { token: string; expires_at: string } | null;
+}
+
+const COALESCE_WINDOW_MS = 120_000;
+const COALESCE_MIN_REMAINING_MS = 50 * 60_000;
+
+function blockingSleep(ms: number): void {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+
+export function coalescedInstallationCredential(scope: GithubInstallationTokenScope, opts: CoalescedInstallationOptions = {}): { token: string; expires_at: string } | null {
+  const now = opts.now ?? Date.now;
+  const mint = opts.mint ?? ((s: GithubInstallationTokenScope) => githubInstallationCredential({ scope: s }));
+  const windowMs = opts.windowMs ?? COALESCE_WINDOW_MS;
+  const minRemainingMs = opts.minRemainingMs ?? COALESCE_MIN_REMAINING_MS;
+  const sleepSync = opts.sleepSync ?? blockingSleep;
+  // Same boundary as the App config: a test process (or config-dir override) never writes the operational root.
+  if (!opts.cacheDir && (process.env.NODE_ENV === 'test' || process.env.ELANOUS_TEST_HOME)) return mint(scope);
+  let dir: string;
+  let identity: string;
+  try {
+    const configPath = appConfigPath();
+    const config = JSON.parse(readFileSync(configPath, 'utf8')) as Partial<AppConfig>;
+    identity = JSON.stringify([configPath, config.id, config.installation_id]);
+    dir = opts.cacheDir ?? join(getElanousConfigDirOverride() ? getElanousConfigDir() : prodInstanceRoot(), 'cache', 'github-app-scoped');
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+  } catch {
+    if (!opts.cacheDir) return mint(scope);
+    dir = opts.cacheDir;
+    identity = 'injected';
+  }
+  // Keyed by App installation and repository, so another App (another universe or owner) never reuses this token.
+  const key = createHash('sha256').update(`${identity}\0${scope.repository}`).digest('hex').slice(0, 32);
+  const file = join(dir, `${key}.json`);
+  const lock = join(dir, `${key}.lock`);
+  let waitStart: number | undefined;
+  const reuse = (): { token: string; expires_at: string } | null => {
+    try {
+      const entry = JSON.parse(readFileSync(file, 'utf8')) as { token?: unknown; expiresAt?: unknown; mintedAt?: unknown };
+      const t = now();
+      if (typeof entry.token === 'string' && entry.token && typeof entry.expiresAt === 'number' && typeof entry.mintedAt === 'number'
+        && t - entry.mintedAt <= windowMs && entry.expiresAt - t >= minRemainingMs) {
+        try { debug.log('auth.github-app', 'token-coalesced', { ageMs: t - entry.mintedAt, expiresAt: new Date(entry.expiresAt).toISOString(), ...(waitStart === undefined ? {} : { waitedMs: t - waitStart }) }); } catch { /* fail open */ }
+        return { token: entry.token, expires_at: new Date(entry.expiresAt).toISOString() };
+      }
+    } catch { /* no usable entry */ }
+    return null;
+  };
+  const hit = opts.fresh ? null : reuse();
+  if (hit) return hit;
+  waitStart = now();
+  const deadline = waitStart + (opts.lockWaitMs ?? 15_000);
+  let locked = false;
+  for (;;) {
+    try { mkdirSync(lock); locked = true; break; }
+    catch {
+      try { if (now() - statSync(lock).mtimeMs > (opts.staleLockMs ?? 30_000)) { rmSync(lock, { recursive: true, force: true }); continue; } } catch { continue; }
+      if (now() >= deadline) break;
+      sleepSync(200);
+      const waited = opts.fresh ? null : reuse();
+      if (waited) return waited;
+    }
+  }
+  if (!locked) { try { debug.log('auth.github-app', 'token-coalesce-lock-timeout', { waitedMs: now() - (waitStart ?? now()) }); } catch { /* fail open */ } }
+  try {
+    const again = opts.fresh ? null : reuse();
+    if (again) return again;
+    const minted = mint(scope);
+    const expiresAt = minted ? Date.parse(minted.expires_at) : NaN;
+    if (minted && Number.isFinite(expiresAt)) {
+      const temp = `${file}.${process.pid}.tmp`;
+      try {
+        writeFileSync(temp, JSON.stringify({ token: minted.token, expiresAt, mintedAt: now() }), { mode: 0o600 });
+        renameSync(temp, file);
+      } catch { try { rmSync(temp, { force: true }); } catch { /* best effort */ } }
+    }
+    return minted;
+  } finally {
+    if (locked) { try { rmSync(lock, { recursive: true, force: true }); } catch { /* stale-lock rule recovers */ } }
+  }
+}

package/src/autopilot/build/llm-conflict-merge.ts

@@ -67,6 +67,9 @@ export interface LlmMergeOutcome {
   testDeclarationUnmeasured?: string[];
   /** 해결기 응답이 LLM 공급자 오류 문구였다 — 파일 내용이 아니다(🅢 2026-09-27 #21086: 세 파일이 통째로 그 문구가 됐다). */
   providerFailure?: string[];
+  /** LLM 입력 상한 초과: 사람 수확으로 넘긴다. 원래 브랜치는 abort 후 보존된다. */
+  reason?: 'conflict-input-too-large' | 'conflict-resolver-interrupted';
+  inputChars?: number;
   /** 병합 결과가 양쪽 판 중 작은 쪽의 절반 아래로 줄었다 — 통째로 날린 것으로 보고 해결 실패로 친다. */
   sizeCollapse?: Array<{ file: string; ours: number; theirs: number; merged: number }>;
   /** `status: 'error'` 일 때 어느 단계인지. 선택 — 옛 호출자는 이 칸 없이 돌아도 된다. */
@@ -79,6 +82,13 @@ export interface LlmMergeOutcome {
 export const PROVIDER_FAILURE_TEXT = /^\s*\[LLM PROVIDER (?:BLOCKED|STOPPED)\]/;
 /** 이 줄 수 미만 파일은 크기 붕괴 판정에서 뺀다(작은 파일은 정당하게 크게 줄 수 있다). */
 export const SIZE_COLLAPSE_MIN_LINES = 50;
+export const DEFAULT_MERGE_CONFLICT_INPUT_MAX_CHARS = 60_000;
+
+export class MergeConflictInputTooLarge extends Error {
+  constructor(readonly inputChars: number) {
+    super(`충돌 큼 — 사람 수확 (LLM 입력 ${inputChars}자)`);
+  }
+}
 
 function lineCount(s: string): number {
   if (s.length === 0) return 0;
@@ -207,12 +217,21 @@ export async function mergeMainWithLlmResolve(
     let merged: string;
     try {
       conflicted = git.readFile(abs);
+    } catch {
+      git.abort(worktreePath);
+      return measuredOutcome({ status: 'conflict-unresolved', resolvedFiles });
+    }
+    try {
       // release/next.md: concurrent landings each append a line — keep both without asking the LLM (REL7c).
       const deterministic = f === NEXT_MD_PATH ? deterministicNextMd(git, worktreePath, f) : null;
       merged = deterministic ?? await resolve(f, conflicted);
-    } catch {
+    } catch (error) {
       git.abort(worktreePath); // LLM 예외 → base 유지
-      return measuredOutcome({ status: 'conflict-unresolved', resolvedFiles });
+      return measuredOutcome({ status: 'conflict-unresolved', resolvedFiles,
+        ...(error instanceof MergeConflictInputTooLarge
+          ? { reason: 'conflict-input-too-large' as const, inputChars: error.inputChars }
+          : { reason: 'conflict-resolver-interrupted' as const }),
+      });
     }
     if (PROVIDER_FAILURE_TEXT.test(merged)) {
       git.abort(worktreePath); // 해결기가 공급자 오류 문구를 «내용»으로 돌려줬다 → base 유지
@@ -335,15 +354,22 @@ export async function defaultLlmResolve(
   filePath: string, conflicted: string, mergeTarget: string,
   options: { worktreePath?: string; mode?: 'off' | 'shadow' | 'on'; git?: IntentGit; stream?: typeof import('../../llm.js')['streamLLM'] } = {},
 ): Promise<string> {
+  let rawConfig: { mergeConflictInputMaxChars?: unknown; mergeIntent?: unknown } | undefined;
+  try { rawConfig = getUserConfig().raw.selfImplement as typeof rawConfig; }
+  catch { /* unreadable config keeps the old resolver and default input limit */ }
+  const configuredMax = rawConfig?.mergeConflictInputMaxChars;
+  const maxChars = typeof configuredMax === 'number' && Number.isSafeInteger(configuredMax) && configuredMax > 0
+    ? configuredMax : DEFAULT_MERGE_CONFLICT_INPUT_MAX_CHARS;
   let rawMode: unknown = options.mode;
   if (rawMode === undefined) {
-    try { rawMode = (getUserConfig().raw.selfImplement as { mergeIntent?: unknown } | undefined)?.mergeIntent; }
-    catch { /* unreadable config keeps the old resolver */ }
+    rawMode = rawConfig?.mergeIntent;
   }
   const mode = rawMode === 'shadow' || rawMode === 'on' ? rawMode : 'off';
-  const streamLLM = options.stream ?? (await import('../../llm.js')).streamLLM;
   const resolve = async (intent?: { ours: string | null; theirs: string[] }): Promise<string> => {
-    const out = await streamLLM([{ role: 'user', content: conflictResolvePrompt(filePath, conflicted, mergeTarget, intent) }], () => {}, { model: process.env.ELANOUS_CONFLICT_MODEL || tierModel('better'), reasoningEffort: 'medium' });
+    const prompt = conflictResolvePrompt(filePath, conflicted, mergeTarget, intent);
+    if (prompt.length > maxChars) throw new MergeConflictInputTooLarge(prompt.length);
+    const streamLLM = options.stream ?? (await import('../../llm.js')).streamLLM;
+    const out = await streamLLM([{ role: 'user', content: prompt }], () => {}, { model: process.env.ELANOUS_CONFLICT_MODEL || tierModel('better'), reasoningEffort: 'medium' });
     // ⛔ 라우터는 공급자가 전부 막히면 던지지 않고 오류 문구를 돌려준다 — 그것은 파일 내용이 아니다.
     if (PROVIDER_FAILURE_TEXT.test(out)) throw new Error(`conflict resolve: LLM provider failure for ${filePath}`);
     return `${out.replace(/^```[\w.-]*\n?/, '').replace(/\n?```\s*$/, '').trimEnd()}\n`;

package/src/autopilot/track-agent-shadow.ts

@@ -3,6 +3,7 @@ import { appendFileSync, mkdirSync, readFileSync, rmdirSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { promisify } from 'node:util';
 import { stateDirSourceForChild } from '../agent/identity-env.js';
+import { oldDoorInternalEnv } from '../self-dev/old-door.js';
 import { effectiveInstanceRoot } from '../instance/resolve.js';
 import type { TrackAgentDecision, TrackAgentInput, TrackAgentResult } from './track-agent.js';
 
@@ -128,7 +129,7 @@ export async function launchTrackAgentShadow(input: TrackAgentInput, options: Sh
       const instanceRoot = effectiveInstanceRoot();
       const { stdout } = await exec('bun', ['bin/elanous.mjs', '--config-dir', instanceRoot, ...values], {
         cwd: process.env.ELANOUS_TOOL_CWD?.trim() || resolve(import.meta.dir, '../..'),
-        env: { ...process.env, ELANOUS_STATE_DIR: instanceRoot, ELANOUS_STATE_DIR_SOURCE: stateDirSourceForChild(instanceRoot) },
+        env: { ...process.env, ELANOUS_STATE_DIR: instanceRoot, ELANOUS_STATE_DIR_SOURCE: stateDirSourceForChild(instanceRoot), ...oldDoorInternalEnv('self-orchestrate') },
         encoding: 'utf8', maxBuffer: 1024 * 1024,
       });
       return { stdout };