elanous 0.2.21 → 0.2.23

package/scripts/tsc-main-safety-net.ts

@@ -0,0 +1,189 @@
+import { spawnSync } from 'node:child_process';
+import { appendFileSync, existsSync, mkdirSync, readFileSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { debug } from '../src/debug/log.js';
+import { effectiveInstanceRoot } from '../src/instance/resolve.js';
+import { GATE_REMOTE_DEFAULTS, isValidGateHost, resolveGateRemoteSettings, runOnRemote, type ExecResult, type RemoteRunOptions, type RemoteRunOutcome } from '../src/self-implement/gate-remote.js';
+import { getUserConfig } from '../src/user-config.js';
+import { parseTypecheckErrors, tscEnv } from '../src/typecheck-ratchet.js';
+import { compareDiagnostics, normalizeDiagnostics, type NormalizedDiagnostic } from './tsc-baseline-comparison.js';
+
+const TSC_ARGV = ['bunx', 'tsc', '--noEmit', '-p', 'tsconfig.gate.json', '--incremental', 'false'];
+const COMMIT = /^[0-9a-f]{40}$/i;
+const UNMEASURABLE = /\berror TS(?:2688|5083|6053):/;
+
+export interface SafetyNetEntry {
+  at: string;
+  commit: string;
+  outcome: 'clean' | 'added' | 'unmeasured' | 'baseline';
+  total: number;
+  added: NormalizedDiagnostic[];
+  removed: number;
+  ms: number;
+  host: string;
+  /** Full measured snapshot: `added` alone cannot serve as the next day's baseline. */
+  diagnostics?: NormalizedDiagnostic[];
+}
+
+export interface SafetyNetDeps {
+  local?: (cmd: string, args: string[], cwd: string, options?: { env?: NodeJS.ProcessEnv }) => ExecResult;
+  remote?: (options: RemoteRunOptions) => RemoteRunOutcome;
+  compare?: typeof compareDiagnostics;
+  exists?: (path: string) => boolean;
+  instanceRoot?: () => string;
+  settings?: () => ReturnType<typeof resolveGateRemoteSettings>;
+  now?: () => number;
+  observed?: (entry: { commit: string; outcome: SafetyNetEntry['outcome']; total: number; added: number; removed: number; ms: number; host: string }) => void;
+}
+
+const realLocal: NonNullable<SafetyNetDeps['local']> = (cmd, args, cwd, options) => {
+  const result = spawnSync(cmd, args, { cwd, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024, ...(options?.env ? { env: options.env } : {}) });
+  return { rc: result.status, stdout: result.stdout ?? '', stderr: result.stderr ?? '', ...(result.error ? { error: String(result.error) } : {}) };
+};
+
+function flags(argv: readonly string[]): { local: boolean; host?: string; ledger?: string; json: boolean } {
+  let local = false;
+  let host: string | undefined;
+  let ledger: string | undefined;
+  let json = false;
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === '--local') local = true;
+    else if (arg === '--json') json = true;
+    else if (arg === '--remote' || arg === '--ledger') {
+      const value = argv[++i];
+      if (!value || value.startsWith('--')) throw new Error(`${arg} requires a value`);
+      if (arg === '--remote') host = value;
+      else ledger = value;
+    } else throw new Error(`unknown argument: ${arg}`);
+  }
+  if (local && host) throw new Error('--local and --remote cannot be combined');
+  if (host && !isValidGateHost(host)) throw new Error(`invalid --remote host: ${host}`);
+  return { local, host, ledger, json };
+}
+
+function measuredSnapshot(path: string): NormalizedDiagnostic[] | undefined {
+  if (!existsSync(path)) return undefined;
+  const rows = readFileSync(path, 'utf8').trim().split('\n').filter(Boolean);
+  for (let i = rows.length - 1; i >= 0; i--) {
+    const entry = JSON.parse(rows[i]!) as SafetyNetEntry;
+    if (entry.outcome === 'unmeasured') continue;
+    if (!Array.isArray(entry.diagnostics) || !entry.diagnostics.every((d) => d && typeof d.file === 'string' && typeof d.code === 'string' && typeof d.message === 'string')) {
+      throw new Error('last measured ledger entry has no valid diagnostic snapshot');
+    }
+    return entry.diagnostics;
+  }
+  return undefined;
+}
+
+function diagnosticsOf(result: { rc: number | null; stdout: string; stderr: string; error?: string }, root: string): NormalizedDiagnostic[] | undefined {
+  const output = `${result.stdout}\n${result.stderr}`;
+  if (result.error || result.rc === null || (result.rc !== 0 && result.rc !== 1 && result.rc !== 2) || UNMEASURABLE.test(output)
+    || /heap out of memory|Ineffective mark-compacts near heap limit/i.test(output)) return undefined;
+  const parsed = parseTypecheckErrors(output);
+  const errorLines = output.split(/\r?\n/).filter((line) => /\berror TS\d+:/.test(line));
+  if (parsed.length !== errorLines.length || (result.rc === 0 && errorLines.length > 0) || (result.rc !== 0 && parsed.length === 0)) return undefined;
+  if (output.split(/\r?\n/).some((line) => line.trim() && !/^.+\(\d+,\d+\):\s+error\s+TS\d+:/.test(line) && !/^\s+/.test(line)
+    && !/^Found \d+ errors?\.?$/.test(line))) return undefined;
+  return normalizeDiagnostics(parsed, root);
+}
+
+export async function runSafetyNet(repo: string, argv: readonly string[] = [], deps: SafetyNetDeps = {}): Promise<{ exitCode: number; entry: SafetyNetEntry; json: boolean }> {
+  const input = flags(argv);
+  const run = deps.local ?? realLocal;
+  const remote = deps.remote ?? runOnRemote;
+  const exists = deps.exists ?? existsSync;
+  const root = deps.instanceRoot?.() ?? effectiveInstanceRoot();
+  const settings = deps.settings?.() ?? (input.local ? GATE_REMOTE_DEFAULTS : resolveGateRemoteSettings(getUserConfig().gateRemote));
+  const host = input.local ? 'local' : (input.host ?? settings.host ?? GATE_REMOTE_DEFAULTS.host);
+  if (host !== 'local' && !isValidGateHost(host)) throw new Error(`invalid gateRemote host: ${host}`);
+  const ledger = resolve(input.ledger ?? join(root, 'tsc-safety-net', 'ledger.jsonl'));
+  const worktree = join(root, 'tsc-safety-net', 'worktree');
+  const started = (deps.now ?? Date.now)();
+  let commit = '';
+  let diagnostics: NormalizedDiagnostic[] | undefined;
+  let reason: string | undefined;
+  let dependencyFailed = false;
+  const git = (args: string[], cwd: string): ExecResult => {
+    const env = { ...process.env };
+    delete env.GIT_DIR; delete env.GIT_WORK_TREE; delete env.GIT_COMMON_DIR;
+    return run('git', args, cwd, { env });
+  };
+  const checked = (args: string[], cwd: string): ExecResult => {
+    const result = git(args, cwd);
+    if (result.error || result.rc !== 0) throw new Error(`git ${args.join(' ')}: ${result.error ?? result.stderr ?? `rc=${result.rc}`}`);
+    return result;
+  };
+  try {
+    checked(['fetch', 'origin', '+refs/heads/main:refs/remotes/origin/main'], repo);
+    commit = checked(['rev-parse', '--verify', 'origin/main^{commit}'], repo).stdout.trim();
+    if (!COMMIT.test(commit)) throw new Error('origin/main did not resolve to a commit');
+    if (!exists(worktree)) {
+      mkdirSync(dirname(worktree), { recursive: true });
+      checked(['worktree', 'add', '--detach', worktree, commit], repo);
+    } else {
+      const listed = checked(['worktree', 'list', '--porcelain'], repo).stdout;
+      if (!listed.split('\n').some((line) => line === `worktree ${worktree}`)) throw new Error('worktree path is not a registered git worktree');
+    }
+    const status = checked(['status', '--porcelain'], worktree).stdout;
+    if (status.trim()) checked(['reset', '--hard'], worktree);
+    // Porcelain status omits ignored files, including stale .ts files from a previous measurement.
+    checked(['clean', '-fdx', '-e', 'node_modules'], worktree);
+    checked(['checkout', '--detach', 'origin/main'], worktree);
+    if (checked(['rev-parse', 'HEAD'], worktree).stdout.trim() !== commit || checked(['status', '--porcelain'], worktree).stdout.trim()) throw new Error('worktree is not clean at origin/main');
+    if (input.local) {
+      // The retained node_modules may belong to yesterday's lockfile; frozen install reconciles it to this checkout.
+      dependencyFailed = true;
+      const install = run('bun', ['install', '--frozen-lockfile'], worktree);
+      if (install.rc !== 0 || install.error || !exists(join(worktree, 'node_modules'))) {
+        throw new Error(`local dependencies unavailable: ${install.error ?? install.stderr ?? `rc=${install.rc}`}`);
+      }
+      dependencyFailed = false;
+      const result = run(TSC_ARGV[0]!, TSC_ARGV.slice(1), worktree, { env: tscEnv() });
+      diagnostics = diagnosticsOf(result, worktree);
+      if (!diagnostics) reason = 'local tsc did not produce a complete measurement';
+    } else {
+      const result = remote({ repo: worktree, host, mirror: settings.mirror, hostCap: settings.hostCap, argv: TSC_ARGV });
+      if (result.kind === 'ran') {
+        if (result.commit !== commit) throw new Error('remote measured a different commit');
+        diagnostics = diagnosticsOf({ rc: result.rc, stdout: result.stdout.toString('utf8'), stderr: result.stderr.toString('utf8') }, worktree);
+        if (!diagnostics) reason = 'remote tsc did not produce a complete measurement';
+      } else reason = result.kind === 'busy' ? 'remote busy' : `remote infra: ${result.reason}`;
+    }
+  } catch (error) {
+    reason = error instanceof Error ? error.message : String(error);
+  }
+  let previous: NormalizedDiagnostic[] | undefined;
+  try { previous = measuredSnapshot(ledger); }
+  catch (error) { diagnostics = undefined; reason = `ledger unreadable: ${error instanceof Error ? error.message : String(error)}`; }
+  const comparison = diagnostics && previous ? (deps.compare ?? compareDiagnostics)(diagnostics, previous) : undefined;
+  if (comparison?.kind === 'unavailable') reason = `comparison unavailable: ${comparison.reason}`;
+  const outcome: SafetyNetEntry['outcome'] = !diagnostics || comparison?.kind === 'unavailable'
+    ? 'unmeasured' : !previous ? 'baseline' : comparison?.kind === 'added' ? 'added' : 'clean';
+  const entry: SafetyNetEntry = {
+    at: new Date((deps.now ?? Date.now)()).toISOString(), commit, outcome, total: diagnostics?.length ?? 0,
+    added: comparison && comparison.kind !== 'unavailable' ? comparison.added : [],
+    removed: comparison && comparison.kind !== 'unavailable' ? comparison.removed.length : 0,
+    ms: (deps.now ?? Date.now)() - started, host,
+    ...(outcome !== 'unmeasured' && diagnostics ? { diagnostics } : {}),
+  };
+  if (!dependencyFailed) {
+    mkdirSync(dirname(ledger), { recursive: true });
+    appendFileSync(ledger, `${JSON.stringify(entry)}\n`);
+  }
+  const observation = { commit, outcome, total: entry.total, added: entry.added.length, removed: entry.removed, ms: entry.ms, host };
+  (deps.observed ?? ((data) => debug.log('tsc.safety-net', 'run', data)))(observation);
+  if (reason) console.error(`[tsc.safety-net] ${reason}`);
+  return { exitCode: outcome === 'unmeasured' ? 2 : outcome === 'added' ? 1 : 0, entry, json: input.json };
+}
+
+if (import.meta.main) {
+  try {
+    const result = await runSafetyNet(process.cwd(), process.argv.slice(2));
+    console.log(result.json ? JSON.stringify(result.entry) : `[tsc.safety-net] ${result.entry.outcome} commit=${result.entry.commit} total=${result.entry.total} added=${result.entry.added.length} removed=${result.entry.removed} host=${result.entry.host}`);
+    process.exitCode = result.exitCode;
+  } catch (error) {
+    console.error(`[tsc.safety-net] unmeasured: ${error instanceof Error ? error.message : String(error)}`);
+    process.exitCode = 2;
+  }
+}

package/scripts/usage-rollup.ts

@@ -2,14 +2,14 @@
 // 실행 칸(Pod 등)이 사라지기 «전»에 자기 llm.usage 를 한 줄로 요약해 stdout 에 — 슈퍼바이저가 호스트로 가져간다.
 // RFC-fleet-supervisor-substrates-benchmark-and-token-accounting §A2·F2 · 2026-09-25.
 //   bun scripts/usage-rollup.ts [--since 6h]
-//   출력: ELANOUS_USAGE_ROLLUP {"substrate","runId","armId","truncated","rows":[{site,provider,model,calls,inputTokens,outputTokens,cacheReadInputTokens,usdKnown,unknownCostCalls}],"total":{…}}
+//   출력: ELANOUS_USAGE_ROLLUP {"substrate","runId","armId","truncated","rows":[{site,provider,model,calls,inputTokens,outputTokens,cacheReadInputTokens,cacheCreationInputTokens,usdKnown,unknownCostCalls}],"total":{…}}
 // ⛔ 의존성 없음(설치본 `elanous` 만 부른다) — clone 에 node_modules 가 없어도 돈다.
 // ⛔ 비용을 모르는 호출(cost.kind≠known)은 0 으로 합치지 않고 따로 센다.
 // ⛔ `--all --include-test` 로 «그 기계의 모든 우주»를 읽는다 — Pod(자기 스토어뿐)에서는 그것이 곧 그 칸의 사용량이지만,
 //    호스트(맥)에서 돌리면 테스트 우주·워크트리·다른 트랙의 런까지 섞인다(📏 09-25: 운영만 16회 vs 전체 124회). 호스트 집계용이 아니다.
 import { spawnSync } from 'node:child_process';
 
-export interface UsageRow { site: string; provider: string; model: string; calls: number; inputTokens: number; outputTokens: number; cacheReadInputTokens: number; usdKnown: number; unknownCostCalls: number; includedCalls: number; apiEquivalentUsd: number }
+export interface UsageRow { site: string; provider: string; model: string; calls: number; inputTokens: number; outputTokens: number; cacheReadInputTokens: number; cacheCreationInputTokens: number; cacheCreationUnmeasuredCalls: number; usdKnown: number; unknownCostCalls: number; includedCalls: number; apiEquivalentUsd: number }
 
 export function rollup(lines: readonly string[]): { rows: UsageRow[]; truncated: boolean } {
   const by = new Map<string, UsageRow>();
@@ -20,14 +20,18 @@ export function rollup(lines: readonly string[]): { rows: UsageRow[]; truncated:
     let r: { event?: string; data?: Record<string, unknown> };
     try { r = JSON.parse(line); } catch { continue; }
     if (r.event !== 'llm-usage' || !r.data) continue;
-    const d = r.data as { site?: string; provider?: string; billingProvider?: string; model?: string; inputTokens?: number; outputTokens?: number; cacheReadInputTokens?: number; cost?: { kind?: string; usd?: number } };
+    const d = r.data as { site?: string; provider?: string; billingProvider?: string; model?: string; inputTokens?: number; outputTokens?: number; cacheReadInputTokens?: number; cacheCreationInputTokens?: number; cost?: { kind?: string; usd?: number } };
     const provider = d.billingProvider ?? d.provider ?? '?';   // ⭐ 과금 주체 우선(B10)
     const key = `${d.site ?? '?'}|${provider}|${d.model ?? '?'}`;
-    const row = by.get(key) ?? { site: d.site ?? '?', provider, model: d.model ?? '?', calls: 0, inputTokens: 0, outputTokens: 0, cacheReadInputTokens: 0, usdKnown: 0, unknownCostCalls: 0, includedCalls: 0, apiEquivalentUsd: 0 };
+    const row = by.get(key) ?? { site: d.site ?? '?', provider, model: d.model ?? '?', calls: 0, inputTokens: 0, outputTokens: 0, cacheReadInputTokens: 0, cacheCreationInputTokens: 0, cacheCreationUnmeasuredCalls: 0, usdKnown: 0, unknownCostCalls: 0, includedCalls: 0, apiEquivalentUsd: 0 };
     row.calls++;
     row.inputTokens += Number(d.inputTokens ?? 0);
     row.outputTokens += Number(d.outputTokens ?? 0);
     row.cacheReadInputTokens += Number(d.cacheReadInputTokens ?? 0);
+    // ⭐ 캐시 «쓰기»(Anthropic cache_creation_input_tokens) — 빠지면 호스트 원장이 0 으로 보고 재매김 $ 가 쓰기 비용을 잃는다.
+    row.cacheCreationInputTokens += Number(d.cacheCreationInputTokens ?? 0);
+    //   캐시 읽기는 보고했는데 쓰기 칸이 없는 호출은 쓰기량을 «모른다» — 0 으로 접지 않고 따로 센다(호스트 재매김이 이 수를 보고 멈춘다).
+    if (d.cacheReadInputTokens !== undefined && d.cacheCreationInputTokens === undefined) row.cacheCreationUnmeasuredCalls++;
     // ⛔ «모름»을 0 으로 접지 않는다 — partial 의 «알려진 몫»은 더하고, 모르는 호출은 따로 센다(BACKLOG C5).
     // ⭐ 구독·local(`included`)은 청구 0 이고 «모름»이 아니다 — 따로 세고 API 환산가는 별도 합(BACKLOG C6).
     if (d.cost?.kind === 'included') { row.includedCalls++; if (typeof (d.cost as { apiEquivalentUsd?: number }).apiEquivalentUsd === 'number') row.apiEquivalentUsd += (d.cost as { apiEquivalentUsd: number }).apiEquivalentUsd; }

package/scripts/verify-coo-admin-evidence.ts

@@ -0,0 +1,83 @@
+import { readFile } from 'node:fs/promises';
+import { fetchLinearProjectIssues, type LinearProjectIssue } from '../src/connectors/linear.js';
+
+type RecordedIssue = {
+  identifier: string; title: string; url: string; createdAt: string; updatedAt: string;
+  existingDueDate: string | null; priority: number;
+};
+type Evidence = {
+  project: string;
+  verifiedIssues: RecordedIssue[];
+  cohort: { excludedCurrentIssues: Array<{identifier: string; url: string; dueDate: string | null; priority: number; createdAt: string}> };
+};
+type LiveIssue = LinearProjectIssue & { createdAt: string };
+
+export function compareCooEvidence(record: Evidence, live: LiveIssue[], truncated: boolean): string[] {
+  const errors: string[] = [];
+  if (truncated) errors.push('Linear result truncated');
+  if (live.length !== 33) errors.push(`current open count: ${live.length} != 33`);
+  if (record.verifiedIssues.length !== 29) errors.push(`recorded count: ${record.verifiedIssues.length} != 29`);
+  const sorted = [...live].sort((a, b) => a.createdAt.localeCompare(b.createdAt));
+  const selected = sorted.slice(0, 29);
+  const excluded = sorted.slice(29);
+  const actual = new Map(live.map(issue => [issue.identifier, issue]));
+  if (actual.size !== live.length) errors.push('duplicate Linear identifier');
+  const seen = new Set<string>();
+  for (const row of record.verifiedIssues) {
+    if (seen.has(row.identifier)) errors.push(`duplicate recorded identifier: ${row.identifier}`);
+    seen.add(row.identifier);
+    const issue = actual.get(row.identifier);
+    if (!issue) { errors.push(`not in Linear: ${row.identifier}`); continue; }
+    for (const [field, expected, value] of [
+      ['title', row.title, issue.title], ['url', row.url, issue.url],
+      ['createdAt', row.createdAt, issue.createdAt], ['updatedAt', row.updatedAt, issue.updatedAt],
+      ['dueDate', row.existingDueDate, issue.dueDate], ['priority', row.priority, issue.priority],
+    ] as const) if (expected !== value) errors.push(`${row.identifier} ${field}: recorded=${String(expected)} Linear=${String(value)}`);
+  }
+  const selectedIds = selected.map(issue => issue.identifier).sort().join(',');
+  if ([...seen].sort().join(',') !== selectedIds) errors.push('recorded identifiers differ from oldest 29 currently open by createdAt');
+  if (selected.filter(issue => issue.dueDate !== null).length !== 4) errors.push('Linear selected dueDate count != 4');
+  if (selected.filter(issue => issue.priority !== 0).length !== 7) errors.push('Linear selected priority count != 7');
+  const excludedRecorded = record.cohort.excludedCurrentIssues;
+  if (excludedRecorded.map(issue => issue.identifier).sort().join(',') !== excluded.map(issue => issue.identifier).sort().join(',')) errors.push('excluded identifiers differ from Linear');
+  for (const row of excludedRecorded) {
+    const issue = actual.get(row.identifier);
+    if (!issue) continue;
+    if (row.url !== issue.url || row.createdAt !== issue.createdAt || row.dueDate !== issue.dueDate || row.priority !== issue.priority) errors.push(`excluded ${row.identifier} differs from Linear`);
+  }
+  return errors;
+}
+
+// Linear GraphQL read-only fetchLinearProjectIssues resolves the project and paginates the open issues.
+// createdAt is queried separately because the shared COO tool's projection does not include it.
+export async function readLiveCooIssues(apiKey: string, project: string): Promise<{ issues: LiveIssue[]; truncated: boolean }> {
+  const issues = await fetchLinearProjectIssues({apiKey, project});
+  const identifiers = issues.map(issue => issue.identifier);
+  if (new Set(identifiers).size !== identifiers.length) throw new Error('duplicate Linear identifier');
+  const query = 'query CooIssueCreation($id: String!) { issue(id: $id) { identifier createdAt } }';
+  const creations = await Promise.all(identifiers.map(async identifier => {
+    const response = await fetch('https://api.linear.app/graphql', {
+      method: 'POST', headers: {Authorization: apiKey, 'Content-Type': 'application/json'},
+      body: JSON.stringify({query, variables: {id: identifier}}),
+    });
+    if (!response.ok) throw new Error(`Linear creation read HTTP ${response.status}`);
+    const body = await response.json() as { errors?: unknown[]; data?: {issue?: {identifier: string; createdAt: string}} };
+    if (body.errors?.length || body.data?.issue?.identifier !== identifier || !body.data.issue.createdAt) throw new Error(`Linear creation read failed: ${identifier}`);
+    return body.data.issue.createdAt;
+  }));
+  return {issues: issues.map((issue, index) => ({...issue, createdAt: creations[index]!})), truncated: issues.truncated};
+}
+
+if (import.meta.main) {
+  const apiKey = process.env.LINEAR_API_KEY?.trim();
+  if (!apiKey) throw new Error('LINEAR_API_KEY absent; cannot compare recorded evidence to live Linear');
+  const record = JSON.parse(await readFile(new URL('../src/domains/coo-admin-dates.evidence.json', import.meta.url), 'utf8')) as Evidence;
+  const {issues, truncated} = await readLiveCooIssues(apiKey, record.project);
+  const errors = compareCooEvidence(record, issues, truncated);
+  if (errors.length) {
+    for (const error of errors) console.error(error);
+    process.exitCode = 1;
+  } else {
+    console.log(`PASS Linear live comparison: open=${issues.length} selected=${record.verifiedIssues.length} dueDates=${record.verifiedIssues.filter(issue => issue.existingDueDate !== null).length} priorities=${record.verifiedIssues.filter(issue => issue.priority !== 0).length} excluded=${record.cohort.excludedCurrentIssues.length}`);
+  }
+}

package/src/acp/client.ts

@@ -371,6 +371,8 @@ export function readClientInfo(
 export interface AcpAgentOpts {
   /** Backend id from ACP_BACKENDS. */
   backendId: string;
+  /** Review-owned ACP executable override; never changes the shared backend registry. */
+  backendSpec?: AcpBackendSpec;
   /** Working directory the agent runs in (cwd argument to spawn).
    *  Affects file-tool resolution. Default: getSessionCwd() so a
    *  Ctrl+W / /wd in the dashboard retargets new ACP agents. */
@@ -443,7 +445,7 @@ export class AcpAgent {
   private authMethods: string[] = [];
 
   constructor(opts: AcpAgentOpts) {
-    this.spec = getAcpBackend(opts.backendId);
+    this.spec = opts.backendSpec ?? getAcpBackend(opts.backendId);
     // WD7 — default to the session working directory; ACP agents
     // inherit the "active project" concept.
     this.cwd = opts.cwd ?? getSessionCwd();
@@ -456,7 +458,7 @@ export class AcpAgent {
     // proactively. Mirrors zed's env-strip pattern for provider
     // tokens (acp.rs:232-243), generalized here for any env that
     // breaks nested agents.
-    const cleanEnv: NodeJS.ProcessEnv = { ...process.env, ...opts.env };
+    const cleanEnv: NodeJS.ProcessEnv = opts.backendSpec && opts.env ? { ...opts.env, NODE_ENV: process.env.NODE_ENV } : { ...process.env, ...opts.env };
     for (const key of Object.keys(cleanEnv)) {
       if (NESTED_AGENT_ENV_BLOCKLIST.has(key) || /^CLAUDE_CODE_/.test(key)) {
         delete cleanEnv[key];

package/src/acp/codex-plugins.ts

@@ -15,7 +15,7 @@
 // installations don't churn quickly and a BackendPickerChip re-render
 // should not trigger a fresh RPC roundtrip every time.
 
-import type { CodexAppServerClient } from './codex-app-server-client.js';
+import { spawnCodexAppServer, type CodexAppServerClient } from './codex-app-server-client.js';
 
 export interface CodexPlugin {
   /** Plugin slug as reported by codex (e.g. "gmail", "google-calendar"). */
@@ -43,13 +43,55 @@ export interface FetchCodexPluginsOpts {
   noCache?: boolean;
 }
 
+/** Uncached inventory probe: distinguish no session / RPC failure from an empty installed list. */
+export async function readCodexPluginsObservation(client: CodexAppServerClient | null | undefined): Promise<
+  { status: 'ok'; plugins: ReadonlyArray<CodexPlugin> } | { status: 'unknown'; plugins: readonly [] }
+> {
+  if (!client) return { status: 'unknown', plugins: [] };
+  try {
+    const response = await client.request<Record<string, never>, unknown>('plugin/list', {});
+    if (!isWellFormedPluginList(response)) return { status: 'unknown', plugins: [] };
+    return { status: 'ok', plugins: parseCodexPluginsResponse(response) };
+  } catch { return { status: 'unknown', plugins: [] }; }
+}
+
+/** Every marketplace and plugin row must have the shape the projector reads; a damaged or changed
+ *  RPC response is unknown, never a confirmed empty install list. */
+function isWellFormedPluginList(response: unknown): boolean {
+  if (!response || typeof response !== 'object') return false;
+  const marketplaces = (response as { marketplaces?: unknown }).marketplaces;
+  if (!Array.isArray(marketplaces)) return false;
+  return marketplaces.every(market => !!market && typeof market === 'object'
+    && typeof (market as { name?: unknown }).name === 'string' && (market as { name: string }).name.length > 0
+    && Array.isArray((market as { plugins?: unknown }).plugins)
+    && ((market as { plugins: unknown[] }).plugins).every(plugin => !!plugin && typeof plugin === 'object'
+      && typeof (plugin as { name?: unknown }).name === 'string' && (plugin as { name: string }).name.length > 0));
+}
+
+export type CodexPluginObservation = Awaited<ReturnType<typeof readCodexPluginsObservation>>;
+
+/** Isolated read-only RPC probe; always closes its own app-server process. */
+export async function readCodexPluginsFromAppServer(
+  spawn: typeof spawnCodexAppServer = spawnCodexAppServer,
+): Promise<CodexPluginObservation> {
+  let server: ReturnType<typeof spawnCodexAppServer>;
+  try { server = spawn({ requestTimeoutMs: 5000 }); }
+  catch { return { status: 'unknown', plugins: [] }; }
+  try {
+    await server.client.request('initialize', {
+      clientInfo: { name: 'elanous', version: '0.x' }, capabilities: { experimentalApi: true },
+    });
+    return await readCodexPluginsObservation(server.client);
+  } catch { return { status: 'unknown', plugins: [] }; }
+  finally {
+    try { await server.client.close(); }
+    finally { server.child.kill(); }
+  }
+}
+
 /** Query codex `plugin/list` and project the response into the
  *  BackendPickerChip-ready shape. Cached per client for 5 min.
- *
- *  Returns an empty array when:
- *    - `client` is null/undefined (no active codex session)
- *    - the RPC throws (timeout / closed / codex error) — soft-fail
- *      with stale cache if available, otherwise [] */
+ *  Returns [] for no client or RPC failure (stale cache when available). */
 export async function fetchCodexPlugins(
   client: CodexAppServerClient | null | undefined,
   opts: FetchCodexPluginsOpts = {},

package/src/agent/monad-agent-turn.ts

@@ -16,7 +16,7 @@
 
 import { existsSync } from 'node:fs';
 import type { UserConfig } from '../user-config.js';
-import { runTurn } from '../session/chat.js';
+import { runTurn, type RunTurnOpts } from '../session/chat.js';
 import type { SessionSource } from '../session/index.js';
 import { buildContinuationAgentTools } from '../dispatch/continuation-turn-runner.js';
 import { buildTerminalCapableTurn } from './terminal-surface.js';
@@ -56,6 +56,54 @@ function recentSentContext(): string {
   } catch { return ''; }
 }
 
+interface ToolRun { id: string; name: string; result?: unknown }
+
+const TOOL_RESULT_CLIP_CHARS = 1500;
+const TOOL_RESULT_MAX_RUNS = 12;
+
+function clipToolResult(result: unknown): string {
+  if (result === undefined) return '(결과 없음)';
+  let text: string;
+  try { text = typeof result === 'string' ? result : JSON.stringify(result) ?? String(result); } catch { text = String(result); }
+  return text.length > TOOL_RESULT_CLIP_CHARS ? `${text.slice(0, TOOL_RESULT_CLIP_CHARS)}…` : text;
+}
+
+/** 툴만 부르고 최종 텍스트가 빈 턴 — 관측을 남기고 툴 결과 요약 재턴을 한 번 돌린다. 재턴도 비면 바닥줄이 아니라
+ *  실패 문구를 돌려준다. 세션 재생은 role:'tool' 기록을 빼므로 재턴 프롬프트가 툴 결과를 직접 싣는다. */
+async function recoverEmptyAnswer(args: {
+  runTurnImpl: typeof runTurn;
+  opts: RunTurnOpts;
+  llmOpts: RunTurnOpts['llmOpts'];
+  systemPrompt: string;
+  toolRuns: ToolRun[];
+  surface: SessionSource;
+}): Promise<string> {
+  const { runTurnImpl, opts, llmOpts, systemPrompt, toolRuns, surface } = args;
+  let message = '';
+  let sawToolCall = false;
+  let retryText = '';
+  try {
+    const summary = toolRuns.slice(-TOOL_RESULT_MAX_RUNS)
+      .map((run) => `- ${run.name}: ${clipToolResult(run.result)}`).join('\n');
+    const retry = await runTurnImpl({
+      ...opts,
+      userText: `[툴 결과 요약 재턴] 아래 툴 실행 결과를 근거로 사용자 질문에 대한 최종 답을 텍스트로 작성하세요. 툴은 더 부르지 마세요.\n\n사용자 질문: ${opts.userText}\n\n툴 결과:\n${summary}`,
+      onDelta: (delta) => { message += delta; },
+      onToolCall: () => { message = ''; sawToolCall = true; },
+      onToolResult: () => {},
+      skipMemoryInjection: true,
+      llmOpts,
+      systemPrompt,
+      tools: [],
+    });
+    retryText = (sawToolCall ? message : retry.text)?.trim() ?? '';
+  } catch { /* 재턴 실패는 아래 실패 문구로 */ }
+  debug.log('agent.turn', 'empty-answer', {
+    surface, sessionId: opts.sessionId, toolCalls: toolRuns.length, recovered: retryText !== '',
+  });
+  return retryText || `⚠️ 답을 만들지 못했다 — 툴 ${toolRuns.length}개 실행`;
+}
+
 /** Build the tool-enabled elanous self runTurn for a messenger surface:
  *  the full agent tool surface (Read/Grep/Glob/ListDir/Edit/Write +
  *  Bash + PtyShell + search), plus — when the finance domain pack is
@@ -229,6 +277,8 @@ export function makeElanousAgentRunTurn(cfg: UserConfig, surface: SessionSource,
     llmOpts = terminal.llmOpts;
     let currentMessage = '';
     let sawToolCall = false;
+    const toolRuns: ToolRun[] = [];
+    const systemPrompt = terminal.systemPromptParts.join('\n\n');
     return runTurnImpl({
       ...opts,
       onDelta: (delta) => {
@@ -238,21 +288,33 @@ export function makeElanousAgentRunTurn(cfg: UserConfig, surface: SessionSource,
       onToolCall: (call) => {
         currentMessage = '';
         sawToolCall = true;
+        toolRuns.push({ id: call.id, name: call.name });
         opts.onToolCall?.(call);
       },
+      onToolResult: (call) => {
+        const run = toolRuns.find((candidate) => candidate.id === call.id);
+        if (run) run.result = call.result;
+        opts.onToolResult?.(call);
+      },
       llmOpts,
-      systemPrompt: terminal.systemPromptParts.join('\n\n'),
+      systemPrompt,
       tools: terminal.specs,
       dispatchTool: terminal.dispatch,
-    }).then((result) => {
+    }).then(async (result) => {
       // /cancel self-awareness — when the turn was aborted mid-run (user hit
       // `/cancel`), the tool loop returns with little/no final text. Substitute
       // a CLEAR cancellation marker so (a) the user gets an ack, and (b) it is
       // the text recorded to cross-surface memory (recordInboundTurn) — so the
       // NEXT turn's memory_recall knows the task was CANCELLED, not silently
       // dropped or still running. Only turnAbort (=/cancel) aborts this signal.
-      const wasAborted = opts.signal?.aborted === true;
-      const answer = sawToolCall ? currentMessage.trim() : result.text;
+      let wasAborted = opts.signal?.aborted === true;
+      let answer = sawToolCall ? currentMessage.trim() : result.text;
+      // Telegram only: other messenger surfaces (Discord …) keep their current final-answer behaviour.
+      if (!wasAborted && sawToolCall && !answer && surface === 'telegram') {
+        answer = await recoverEmptyAnswer({ runTurnImpl, opts, llmOpts, systemPrompt, toolRuns, surface });
+        // A /cancel that lands during the retry turn still wins over the retry answer or the failure sentence.
+        if (opts.signal?.aborted === true) { wasAborted = true; answer = ''; }
+      }
       const responseText = wasAborted
         ? (answer?.trim()
             ? `${answer}\n\n⏹️ 이 작업은 /cancel 로 취소되었습니다 (실행 중이던 Bash/PTY 종료됨).`

package/src/agent/run-context.ts

@@ -9,6 +9,7 @@
 
 import { normalizeChildLlmProvider } from '../self-dev/dev-cli.js';
 import { providerEnvKey } from '../llm/provider-credentials.js';
+import { bedrockChildRelayEnv } from '../llm/bedrock.js';
 
 export type RunContext = 'production' | 'benchmark' | 'simulator' | 'self-build';
 
@@ -54,6 +55,8 @@ export interface ChildLlmSelection {
   effort?: ChildLlmEffort;
   /** 선택이 CLI 플래그에서 왔나, self-dev 설정에서 왔나. 같은 모델이라도 다른 사실이다. */
   source: 'flag' | 'config';
+  /** Grok weekly cap rerouted this run to Codex: allow prepaid credits even when subscription quota is exhausted. */
+  codexQuotaPolicy?: 'credits';
 }
 
 /** ⭐⭐ **가르는 축은 「키냐 주소냐」가 «아니라» 「그 자격이 «파일»에 사나 «env»에 사나」다**
@@ -76,6 +79,12 @@ function childLocalEndpointEnv(provider: string): Record<string, string> {
   return url ? { LOCAL_LLM_URL: url } : {};
 }
 
+/** BEDROCK-PROVIDER — Bedrock 자격은 «파일»(~/.aws · HOME 으로 자식이 그대로 읽는다)과 «env»(AWS_*) 둘 다에 산다.
+ *  env 쪽은 replace env 라 상속이 없으므로 이름 목록대로 릴레이한다(값은 싣기만 하고 어디에도 찍지 않는다). */
+function childBedrockEnv(provider: string): Record<string, string> {
+  return provider === 'bedrock' ? bedrockChildRelayEnv() : {};
+}
+
 /** The family classifier is model-id based, so preserve local-provider identity
  * across the replace-env child boundary without changing non-local model IDs. */
 function childRelayModel(provider: string, model: string): string {
@@ -91,6 +100,8 @@ export function childLlmSelectionEnv(selection?: ChildLlmSelection): Record<stri
     return {
       ELANOUS_LLM_PROVIDER: provider,
       ELANOUS_LLM_MODEL: childRelayModel(provider, selection.model),
+      ...(selection.codexQuotaPolicy === 'credits' && provider === 'openai-codex'
+        ? { ELANOUS_CODEX_QUOTA_POLICY: 'credits' } : {}),
       // ⛔⭐ 새 env 이름을 «짓지 않는다» — `ELANOUS_ESCALATE_EFFORT` 가 «이미» 있고
       //    `user-config.ts` 가 그것으로 `reasoningLevel`(anthropic)과
       //    `codexReasoning.effort`(openai-codex/sol) 를 ***둘 다*** 덮는다.
@@ -98,6 +109,7 @@ export function childLlmSelectionEnv(selection?: ChildLlmSelection): Record<stri
       ...(selection.effort ? { ELANOUS_ESCALATE_EFFORT: selection.effort } : {}),
       ...childProviderKeyEnv(provider),
       ...childLocalEndpointEnv(provider),
+      ...childBedrockEnv(provider),
     };
   }
   // ⛔⭐ 상속 갈래도 local 이면 «주소»를 같이 넘긴다(BACKLOG B12 · 2026-09-25).
@@ -108,5 +120,7 @@ export function childLlmSelectionEnv(selection?: ChildLlmSelection): Record<stri
     ...(process.env.ELANOUS_LLM_PROVIDER !== undefined ? { ELANOUS_LLM_PROVIDER: process.env.ELANOUS_LLM_PROVIDER } : {}),
     ...(process.env.ELANOUS_LLM_MODEL !== undefined ? { ELANOUS_LLM_MODEL: process.env.ELANOUS_LLM_MODEL } : {}),
     ...(inheritedProvider ? childLocalEndpointEnv(inheritedProvider) : {}),
+    // 상속 갈래도 bedrock 이면 AWS_* 를 같이 넘긴다(명시 갈래와 같은 규칙 — replace env 라 자동 상속이 없다).
+    ...(inheritedProvider ? childBedrockEnv(inheritedProvider) : {}),
   };
 }

package/src/agent/tool-profile.ts

@@ -15,11 +15,27 @@
 //   ELANOUS_CHILD_TOOL_PROFILE=full            전부
 //   ELANOUS_CHILD_TOOL_PROFILE=finance,ops     기본 ⊕ 고른 묶음
 //   (없음)                                   coding(기본)
+//
+// 🩸 CHILD-TOOL-PROFILE-TRIM(10-10 실측 · base 0317d73034 · Plan 켬): `coding` 이 33개 중 27개(스키마 26,742자)를
+//    남겼다 — 판·자리 운영·회수·스킬·서브에이전트 도구가 «어느 묶음에도 안 들어서» 기본으로 갔을 뿐이다.
+//    ⇒ 화이트리스트를 따로 두지 않고(09-25 설계 유지) 그것들을 새 묶음 넷(admin · recall · skills · subagent)으로 옮긴다.
+//    ⇒ `coding` 의 기대 집합 = Read · Grep · Glob · ListDir · Edit · Write · Bash · Plan · MarkStepDone(9개).
+//    빠진 묶음은 상황 신호(골 문면)와 ToolSearch(전체 목록에서 찾는다)로 계속 닿는다.
+
+import { debug } from '../debug/log.js';
 
 /** 추가 묶음 — 코딩 기본에서 빠지고 «고르면 더해지는» 도구들. 접두 ⊕ 정확한 이름. */
 export const TOOL_EXTRA_GROUPS = {
   finance: { prefixes: ['finance_', 'conatus_'], names: [] as string[] },
   ops: { prefixes: [] as string[], names: ['schedule_manage', 'session_manage', 'autopilot_missions', 'ops_status', 'se_build', 'mission_decide'] },
+  /** 판·자리·결정 운영 — 코딩 일에는 안 쓴다. */
+  admin: { prefixes: ['release_'], names: ['coo_admin', 'ops_seats', 'decisions_pending', 'proact_meter'] },
+  /** 기억·회수·관측 조회. */
+  recall: { prefixes: [] as string[], names: ['memory_recall', 'fact_check', 'self_recall', 'context_now', 'logs_query'] },
+  /** 스킬 목록·실행. */
+  skills: { prefixes: [] as string[], names: ['elanous_skills_list', 'skill_exec'] },
+  /** 서브에이전트 — ⚠️ 기본에서 빼도 완주율이 안 떨어지는지는 아직 안 쟀다(SMALL-MODEL-BENCH 가 잰다). 신호·ToolSearch 로 되살린다. */
+  subagent: { prefixes: [] as string[], names: ['Agent', 'AgentOutput', 'AgentReply', 'AgentStop', 'AgentList'] },
 } as const;
 export type ToolExtraGroup = keyof typeof TOOL_EXTRA_GROUPS;
 const ALL_GROUPS = Object.keys(TOOL_EXTRA_GROUPS) as ToolExtraGroup[];
@@ -45,6 +61,10 @@ export function activeToolProfile(env: NodeJS.ProcessEnv = process.env): ToolPro
 export const SITUATIONAL_GROUP_SIGNALS: Record<ToolExtraGroup, RegExp> = {
   finance: /금융|주식|종목|주가|시세|매매|포트폴리오|포지션|투자|백테스트|13F|재무|finance_|conatus|stock|ticker|portfolio|backtest|trading/i,
   ops: /스케줄|크론|예약 실행|오토파일럿|미션 결정|운영 상태|schedule_manage|autopilot|ops_status|mission_decide|cron/i,
+  admin: /release_(status|change)|coo_admin|ops_seats|decisions_pending|proact_meter|판 칸|칸 근거|칸 상태|체크리스트 칸|checklist (set|status)|결정 대기|자리 현황/i,
+  recall: /memory_recall|fact_check|self_recall|context_now|logs_query|기억 조회|기억을 (찾|조회|회수)|자기 이력|사실 확인|팩트 ?체크/i,
+  skills: /elanous_skills_list|skill_exec|스킬(을)? 실행|스킬 목록|run (a|the) skill/i,
+  subagent: /서브\s?에이전트|하위\s?에이전트|sub-?agents?|에이전트를 (띄|병렬)|병렬 에이전트|Agent(Output|Reply|Stop|List)\b|Agent 도구/i,
 };
 
 export function situationalToolGroups(goalText: string | undefined): ToolExtraGroup[] {
@@ -58,9 +78,15 @@ export function situationalToolGroups(goalText: string | undefined): ToolExtraGr
  *  ③ 둘 다 없으면 `coding`(다이어트) */
 export function childToolProfile(env: NodeJS.ProcessEnv = process.env, goalText?: string): string {
   const explicit = env.ELANOUS_CHILD_TOOL_PROFILE?.trim();
-  if (explicit) return explicit;
+  if (explicit) {
+    const parsed = parseToolProfile(explicit);
+    debug.log('agent.tool-profile', 'child-profile-chosen', { source: 'env', raw: explicit, profile: parsed?.name ?? 'coding', groups: parsed ? [...parsed.groups] : [] });
+    return explicit;
+  }
   const groups = situationalToolGroups(goalText);
-  return groups.length ? groups.join(',') : 'coding';
+  const profile = groups.length ? groups.join(',') : 'coding';
+  debug.log('agent.tool-profile', 'child-profile-chosen', { source: groups.length ? 'situational' : 'default', profile, groups, goalChars: goalText?.length ?? 0 });
+  return profile;
 }
 
 /** 기본 모드에서 뺀 묶음을 자식에게 «한 줄»로 알린다 — 필요하면 ToolSearch 로 불러 쓴다(스키마는 안 싣는다). */