elanous 0.2.22 → 0.2.24

package/scripts/usage-rollup.ts

@@ -1,47 +1,103 @@
 #!/usr/bin/env bun
 // 실행 칸(Pod 등)이 사라지기 «전»에 자기 llm.usage 를 한 줄로 요약해 stdout 에 — 슈퍼바이저가 호스트로 가져간다.
 // RFC-fleet-supervisor-substrates-benchmark-and-token-accounting §A2·F2 · 2026-09-25.
-//   bun scripts/usage-rollup.ts [--since 6h]
-//   출력: ELANOUS_USAGE_ROLLUP {"substrate","runId","armId","truncated","rows":[{site,provider,model,calls,inputTokens,outputTokens,cacheReadInputTokens,usdKnown,unknownCostCalls}],"total":{…}}
+//   bun scripts/usage-rollup.ts [--since 6h] [--partial [--seq N]]
+//   출력: ELANOUS_USAGE_ROLLUP {"substrate","runId","armId","truncated","rows":[{site,provider,model,calls,inputTokens,outputTokens,cacheReadInputTokens,cacheCreationInputTokens,usdKnown,unknownCostCalls}],"total":{…}}
 // ⛔ 의존성 없음(설치본 `elanous` 만 부른다) — clone 에 node_modules 가 없어도 돈다.
 // ⛔ 비용을 모르는 호출(cost.kind≠known)은 0 으로 합치지 않고 따로 센다.
 // ⛔ `--all --include-test` 로 «그 기계의 모든 우주»를 읽는다 — Pod(자기 스토어뿐)에서는 그것이 곧 그 칸의 사용량이지만,
 //    호스트(맥)에서 돌리면 테스트 우주·워크트리·다른 트랙의 런까지 섞인다(📏 09-25: 운영만 16회 vs 전체 124회). 호스트 집계용이 아니다.
 import { spawnSync } from 'node:child_process';
 
-export interface UsageRow { site: string; provider: string; model: string; calls: number; inputTokens: number; outputTokens: number; cacheReadInputTokens: number; usdKnown: number; unknownCostCalls: number; includedCalls: number; apiEquivalentUsd: number }
+export interface UsageRow { site: string; provider: string; model: string; calls: number; inputTokens: number; outputTokens: number; cacheReadInputTokens: number; cacheCreationInputTokens: number; cacheCreationUnmeasuredCalls: number; usdKnown: number; unknownCostCalls: number; includedCalls: number; apiEquivalentUsd: number;
+  /** OR-BYOK-COST — BYOK 호출 수 ⊕ 그중 상류 청구액 합(알려진 것만) ⊕ 상류를 모르는 호출 수. BYOK 를 본 행에만 있다(종전 행 바이트 불변). */
+  byokCalls?: number; byokUpstreamUsd?: number; byokUpstreamUnknownCalls?: number }
+
+type UsageData = { site?: string; provider?: string; billingProvider?: string; model?: string; inputTokens?: number; outputTokens?: number; cacheReadInputTokens?: number; cacheCreationInputTokens?: number; cost?: { kind?: string; usd?: number }; podRollupKey?: string; partial?: boolean; partialSeq?: number; partialAt?: string };
+
+/** 같은 podRollupKey 두 행 중 어느 쪽이 더 완전한가 — 최종 > 부분 · 부분끼리는 seq 큰 쪽 · 같으면 at 늦은 쪽. 완전히 같으면 앞 행을 둔다. */
+function rollupRowBeats(next: UsageData, kept: UsageData): boolean {
+  const nextFinal = next.partial !== true;
+  const keptFinal = kept.partial !== true;
+  if (nextFinal !== keptFinal) return nextFinal;
+  if (nextFinal) return false;
+  const nextSeq = Number(next.partialSeq ?? 0);
+  const keptSeq = Number(kept.partialSeq ?? 0);
+  if (nextSeq !== keptSeq) return nextSeq > keptSeq;
+  return String(next.partialAt ?? '') > String(kept.partialAt ?? '');
+}
 
 export function rollup(lines: readonly string[]): { rows: UsageRow[]; truncated: boolean } {
   const by = new Map<string, UsageRow>();
+  // ⭐ MF-3c0d253e — 같은 Pod 사용량의 재방출(부분 ⊕ 최종 · abort ⊕ resume)은 podRollupKey 로 한 번만 센다(이중계상 방지).
+  //   들어온 순서가 아니라 «더 완전한 행»을 남긴다(최종 > 부분 · seq · at — rollupRowBeats).
+  //   키가 없는 행(기존 경로 전부)은 종전과 동작·바이트 그대로다.
   let truncated = false;
+  const entries: UsageData[] = [];
+  const keptIndexByPodRollupKey = new Map<string, number>();
   for (const line of lines) {
     if (/limitReached=true|truncated/.test(line) && !line.startsWith('{')) truncated = true;
     if (!line.startsWith('{')) continue;
     let r: { event?: string; data?: Record<string, unknown> };
     try { r = JSON.parse(line); } catch { continue; }
     if (r.event !== 'llm-usage' || !r.data) continue;
-    const d = r.data as { site?: string; provider?: string; billingProvider?: string; model?: string; inputTokens?: number; outputTokens?: number; cacheReadInputTokens?: number; cost?: { kind?: string; usd?: number } };
+    const d = r.data as UsageData;
+    if (typeof d.podRollupKey === 'string') {
+      const keptIndex = keptIndexByPodRollupKey.get(d.podRollupKey);
+      if (keptIndex !== undefined) {
+        if (rollupRowBeats(d, entries[keptIndex]!)) entries[keptIndex] = d;
+        continue;
+      }
+      keptIndexByPodRollupKey.set(d.podRollupKey, entries.length);
+    }
+    entries.push(d);
+  }
+  for (const d of entries) {
     const provider = d.billingProvider ?? d.provider ?? '?';   // ⭐ 과금 주체 우선(B10)
     const key = `${d.site ?? '?'}|${provider}|${d.model ?? '?'}`;
-    const row = by.get(key) ?? { site: d.site ?? '?', provider, model: d.model ?? '?', calls: 0, inputTokens: 0, outputTokens: 0, cacheReadInputTokens: 0, usdKnown: 0, unknownCostCalls: 0, includedCalls: 0, apiEquivalentUsd: 0 };
+    const row = by.get(key) ?? { site: d.site ?? '?', provider, model: d.model ?? '?', calls: 0, inputTokens: 0, outputTokens: 0, cacheReadInputTokens: 0, cacheCreationInputTokens: 0, cacheCreationUnmeasuredCalls: 0, usdKnown: 0, unknownCostCalls: 0, includedCalls: 0, apiEquivalentUsd: 0 };
     row.calls++;
     row.inputTokens += Number(d.inputTokens ?? 0);
     row.outputTokens += Number(d.outputTokens ?? 0);
     row.cacheReadInputTokens += Number(d.cacheReadInputTokens ?? 0);
+    // ⭐ 캐시 «쓰기»(Anthropic cache_creation_input_tokens) — 빠지면 호스트 원장이 0 으로 보고 재매김 $ 가 쓰기 비용을 잃는다.
+    row.cacheCreationInputTokens += Number(d.cacheCreationInputTokens ?? 0);
+    //   캐시 읽기는 보고했는데 쓰기 칸이 없는 호출은 쓰기량을 «모른다» — 0 으로 접지 않고 따로 센다(호스트 재매김이 이 수를 보고 멈춘다).
+    if (d.cacheReadInputTokens !== undefined && d.cacheCreationInputTokens === undefined) row.cacheCreationUnmeasuredCalls++;
     // ⛔ «모름»을 0 으로 접지 않는다 — partial 의 «알려진 몫»은 더하고, 모르는 호출은 따로 센다(BACKLOG C5).
     // ⭐ 구독·local(`included`)은 청구 0 이고 «모름»이 아니다 — 따로 세고 API 환산가는 별도 합(BACKLOG C6).
     if (d.cost?.kind === 'included') { row.includedCalls++; if (typeof (d.cost as { apiEquivalentUsd?: number }).apiEquivalentUsd === 'number') row.apiEquivalentUsd += (d.cost as { apiEquivalentUsd: number }).apiEquivalentUsd; }
     // ⭐ `actual`(provider 보고 청구액 · C7)은 알려진 비용이다.
     else if ((d.cost?.kind === 'known' || d.cost?.kind === 'actual') && typeof d.cost.usd === 'number') row.usdKnown += d.cost.usd;
     else { row.unknownCostCalls++; if (d.cost?.kind === 'partial' && typeof d.cost.usd === 'number') row.usdKnown += d.cost.usd; }
+    // OR-BYOK-COST — BYOK 비용은 위에서 이미 usdKnown(actual)·unknownCostCalls(partial)로 갈렸다. 여기선 출처만 따로 나른다.
+    const c = d.cost as { byok?: unknown; upstreamUsd?: unknown } | undefined;
+    if (c?.byok === true) {
+      row.byokCalls = (row.byokCalls ?? 0) + 1;
+      if (typeof c.upstreamUsd === 'number' && Number.isFinite(c.upstreamUsd)) row.byokUpstreamUsd = (row.byokUpstreamUsd ?? 0) + c.upstreamUsd;
+      else row.byokUpstreamUnknownCalls = (row.byokUpstreamUnknownCalls ?? 0) + 1;
+    }
     by.set(key, row);
   }
   return { rows: [...by.values()], truncated };
 }
 
+/** METER-POD-ROLLUP-GAP — 인자 해석: `--partial`(⊕ `--seq N`)면 부분 롤업 한 줄로 바꾼다. 전체판(기본)은 불변. */
+export function parseRollupArgs(argv: readonly string[]): { since: string; partial: boolean; seq: number } {
+  const sinceAt = argv.indexOf('--since');
+  const seqAt = argv.indexOf('--seq');
+  const seqRaw = seqAt >= 0 ? Number(argv[seqAt + 1] ?? 1) : 1;
+  return { since: sinceAt >= 0 ? argv[sinceAt + 1] ?? '6h' : '6h', partial: argv.includes('--partial'), seq: Number.isInteger(seqRaw) && seqRaw > 0 ? seqRaw : 1 };
+}
+
+/** 한 줄 표현 — 전체판 줄은 기존 바이트와 동일, 부분판은 partial:true ⊕ seq ⊕ at 만 얹는다. */
+export function renderRollupLine(payload: Record<string, unknown>, opts: { partial: boolean; seq: number }): string {
+  if (opts.partial) return `ELANOUS_USAGE_ROLLUP_PARTIAL ${JSON.stringify({ ...payload, partial: true, seq: opts.seq, at: new Date().toISOString() })}`;
+  return `ELANOUS_USAGE_ROLLUP ${JSON.stringify(payload)}`;
+}
+
 if (import.meta.main) {
-  const i = process.argv.indexOf('--since');
-  const since = i > 0 ? process.argv[i + 1] ?? '6h' : '6h';
+  const { since, partial, seq } = parseRollupArgs(process.argv);
   const r = spawnSync('elanous', ['logs', '--all', '--include-test', '--event', 'llm-usage', '--since', since, '--limit', '50000', '--json', '--json-data'], { encoding: 'utf8', timeout: 120_000, maxBuffer: 256 * 1024 * 1024 });
   const { rows, truncated } = rollup(`${r.stdout ?? ''}\n${r.stderr ?? ''}`.split('\n'));
   const total = rows.reduce((t, x) => ({ calls: t.calls + x.calls, inputTokens: t.inputTokens + x.inputTokens, outputTokens: t.outputTokens + x.outputTokens, usdKnown: t.usdKnown + x.usdKnown, unknownCostCalls: t.unknownCostCalls + x.unknownCostCalls }), { calls: 0, inputTokens: 0, outputTokens: 0, usdKnown: 0, unknownCostCalls: 0 });
@@ -50,5 +106,5 @@ if (import.meta.main) {
   const elanousVersion = v.status === 0 ? (v.stdout ?? '').trim().split('\n').pop() ?? null : null;
   // ⭐ 런 출처 칸(🅣 RFC run-origin 이름 그대로) — 호스트 재방출이 그대로 받는다.
   const origin = { podName: process.env.ELANOUS_POD_NAME ?? null, nodeName: process.env.ELANOUS_NODE_NAME ?? null, hostId: process.env.ELANOUS_HOST_ID ?? null, imageCommit: process.env.ELANOUS_IMAGE_COMMIT ?? null };
-  console.log(`ELANOUS_USAGE_ROLLUP ${JSON.stringify({ substrate: process.env.ELANOUS_SUBSTRATE ?? null, elanousVersion, ...origin, runId: process.env.ELANOUS_RUN_ID ?? null, armId: process.env.ELANOUS_ARM_ID ?? null, measured: r.status === 0, truncated, rows, total })}`);
+  console.log(renderRollupLine({ substrate: process.env.ELANOUS_SUBSTRATE ?? null, elanousVersion, ...origin, runId: process.env.ELANOUS_RUN_ID ?? null, armId: process.env.ELANOUS_ARM_ID ?? null, measured: r.status === 0, truncated, rows, total }, { partial, seq }));
 }

package/src/acp/codex-plugins.ts

@@ -15,7 +15,7 @@
 // installations don't churn quickly and a BackendPickerChip re-render
 // should not trigger a fresh RPC roundtrip every time.
 
-import type { CodexAppServerClient } from './codex-app-server-client.js';
+import { spawnCodexAppServer, type CodexAppServerClient } from './codex-app-server-client.js';
 
 export interface CodexPlugin {
   /** Plugin slug as reported by codex (e.g. "gmail", "google-calendar"). */
@@ -43,13 +43,55 @@ export interface FetchCodexPluginsOpts {
   noCache?: boolean;
 }
 
+/** Uncached inventory probe: distinguish no session / RPC failure from an empty installed list. */
+export async function readCodexPluginsObservation(client: CodexAppServerClient | null | undefined): Promise<
+  { status: 'ok'; plugins: ReadonlyArray<CodexPlugin> } | { status: 'unknown'; plugins: readonly [] }
+> {
+  if (!client) return { status: 'unknown', plugins: [] };
+  try {
+    const response = await client.request<Record<string, never>, unknown>('plugin/list', {});
+    if (!isWellFormedPluginList(response)) return { status: 'unknown', plugins: [] };
+    return { status: 'ok', plugins: parseCodexPluginsResponse(response) };
+  } catch { return { status: 'unknown', plugins: [] }; }
+}
+
+/** Every marketplace and plugin row must have the shape the projector reads; a damaged or changed
+ *  RPC response is unknown, never a confirmed empty install list. */
+function isWellFormedPluginList(response: unknown): boolean {
+  if (!response || typeof response !== 'object') return false;
+  const marketplaces = (response as { marketplaces?: unknown }).marketplaces;
+  if (!Array.isArray(marketplaces)) return false;
+  return marketplaces.every(market => !!market && typeof market === 'object'
+    && typeof (market as { name?: unknown }).name === 'string' && (market as { name: string }).name.length > 0
+    && Array.isArray((market as { plugins?: unknown }).plugins)
+    && ((market as { plugins: unknown[] }).plugins).every(plugin => !!plugin && typeof plugin === 'object'
+      && typeof (plugin as { name?: unknown }).name === 'string' && (plugin as { name: string }).name.length > 0));
+}
+
+export type CodexPluginObservation = Awaited<ReturnType<typeof readCodexPluginsObservation>>;
+
+/** Isolated read-only RPC probe; always closes its own app-server process. */
+export async function readCodexPluginsFromAppServer(
+  spawn: typeof spawnCodexAppServer = spawnCodexAppServer,
+): Promise<CodexPluginObservation> {
+  let server: ReturnType<typeof spawnCodexAppServer>;
+  try { server = spawn({ requestTimeoutMs: 5000 }); }
+  catch { return { status: 'unknown', plugins: [] }; }
+  try {
+    await server.client.request('initialize', {
+      clientInfo: { name: 'elanous', version: '0.x' }, capabilities: { experimentalApi: true },
+    });
+    return await readCodexPluginsObservation(server.client);
+  } catch { return { status: 'unknown', plugins: [] }; }
+  finally {
+    try { await server.client.close(); }
+    finally { server.child.kill(); }
+  }
+}
+
 /** Query codex `plugin/list` and project the response into the
  *  BackendPickerChip-ready shape. Cached per client for 5 min.
- *
- *  Returns an empty array when:
- *    - `client` is null/undefined (no active codex session)
- *    - the RPC throws (timeout / closed / codex error) — soft-fail
- *      with stale cache if available, otherwise [] */
+ *  Returns [] for no client or RPC failure (stale cache when available). */
 export async function fetchCodexPlugins(
   client: CodexAppServerClient | null | undefined,
   opts: FetchCodexPluginsOpts = {},

package/src/agent/monad-agent-turn.ts

@@ -16,7 +16,7 @@
 
 import { existsSync } from 'node:fs';
 import type { UserConfig } from '../user-config.js';
-import { runTurn } from '../session/chat.js';
+import { runTurn, type RunTurnOpts } from '../session/chat.js';
 import type { SessionSource } from '../session/index.js';
 import { buildContinuationAgentTools } from '../dispatch/continuation-turn-runner.js';
 import { buildTerminalCapableTurn } from './terminal-surface.js';
@@ -56,6 +56,54 @@ function recentSentContext(): string {
   } catch { return ''; }
 }
 
+interface ToolRun { id: string; name: string; result?: unknown }
+
+const TOOL_RESULT_CLIP_CHARS = 1500;
+const TOOL_RESULT_MAX_RUNS = 12;
+
+function clipToolResult(result: unknown): string {
+  if (result === undefined) return '(결과 없음)';
+  let text: string;
+  try { text = typeof result === 'string' ? result : JSON.stringify(result) ?? String(result); } catch { text = String(result); }
+  return text.length > TOOL_RESULT_CLIP_CHARS ? `${text.slice(0, TOOL_RESULT_CLIP_CHARS)}…` : text;
+}
+
+/** 툴만 부르고 최종 텍스트가 빈 턴 — 관측을 남기고 툴 결과 요약 재턴을 한 번 돌린다. 재턴도 비면 바닥줄이 아니라
+ *  실패 문구를 돌려준다. 세션 재생은 role:'tool' 기록을 빼므로 재턴 프롬프트가 툴 결과를 직접 싣는다. */
+async function recoverEmptyAnswer(args: {
+  runTurnImpl: typeof runTurn;
+  opts: RunTurnOpts;
+  llmOpts: RunTurnOpts['llmOpts'];
+  systemPrompt: string;
+  toolRuns: ToolRun[];
+  surface: SessionSource;
+}): Promise<string> {
+  const { runTurnImpl, opts, llmOpts, systemPrompt, toolRuns, surface } = args;
+  let message = '';
+  let sawToolCall = false;
+  let retryText = '';
+  try {
+    const summary = toolRuns.slice(-TOOL_RESULT_MAX_RUNS)
+      .map((run) => `- ${run.name}: ${clipToolResult(run.result)}`).join('\n');
+    const retry = await runTurnImpl({
+      ...opts,
+      userText: `[툴 결과 요약 재턴] 아래 툴 실행 결과를 근거로 사용자 질문에 대한 최종 답을 텍스트로 작성하세요. 툴은 더 부르지 마세요.\n\n사용자 질문: ${opts.userText}\n\n툴 결과:\n${summary}`,
+      onDelta: (delta) => { message += delta; },
+      onToolCall: () => { message = ''; sawToolCall = true; },
+      onToolResult: () => {},
+      skipMemoryInjection: true,
+      llmOpts,
+      systemPrompt,
+      tools: [],
+    });
+    retryText = (sawToolCall ? message : retry.text)?.trim() ?? '';
+  } catch { /* 재턴 실패는 아래 실패 문구로 */ }
+  debug.log('agent.turn', 'empty-answer', {
+    surface, sessionId: opts.sessionId, toolCalls: toolRuns.length, recovered: retryText !== '',
+  });
+  return retryText || `⚠️ 답을 만들지 못했다 — 툴 ${toolRuns.length}개 실행`;
+}
+
 /** Build the tool-enabled elanous self runTurn for a messenger surface:
  *  the full agent tool surface (Read/Grep/Glob/ListDir/Edit/Write +
  *  Bash + PtyShell + search), plus — when the finance domain pack is
@@ -229,6 +277,8 @@ export function makeElanousAgentRunTurn(cfg: UserConfig, surface: SessionSource,
     llmOpts = terminal.llmOpts;
     let currentMessage = '';
     let sawToolCall = false;
+    const toolRuns: ToolRun[] = [];
+    const systemPrompt = terminal.systemPromptParts.join('\n\n');
     return runTurnImpl({
       ...opts,
       onDelta: (delta) => {
@@ -238,21 +288,33 @@ export function makeElanousAgentRunTurn(cfg: UserConfig, surface: SessionSource,
       onToolCall: (call) => {
         currentMessage = '';
         sawToolCall = true;
+        toolRuns.push({ id: call.id, name: call.name });
         opts.onToolCall?.(call);
       },
+      onToolResult: (call) => {
+        const run = toolRuns.find((candidate) => candidate.id === call.id);
+        if (run) run.result = call.result;
+        opts.onToolResult?.(call);
+      },
       llmOpts,
-      systemPrompt: terminal.systemPromptParts.join('\n\n'),
+      systemPrompt,
       tools: terminal.specs,
       dispatchTool: terminal.dispatch,
-    }).then((result) => {
+    }).then(async (result) => {
       // /cancel self-awareness — when the turn was aborted mid-run (user hit
       // `/cancel`), the tool loop returns with little/no final text. Substitute
       // a CLEAR cancellation marker so (a) the user gets an ack, and (b) it is
       // the text recorded to cross-surface memory (recordInboundTurn) — so the
       // NEXT turn's memory_recall knows the task was CANCELLED, not silently
       // dropped or still running. Only turnAbort (=/cancel) aborts this signal.
-      const wasAborted = opts.signal?.aborted === true;
-      const answer = sawToolCall ? currentMessage.trim() : result.text;
+      let wasAborted = opts.signal?.aborted === true;
+      let answer = sawToolCall ? currentMessage.trim() : result.text;
+      // Telegram only: other messenger surfaces (Discord …) keep their current final-answer behaviour.
+      if (!wasAborted && sawToolCall && !answer && surface === 'telegram') {
+        answer = await recoverEmptyAnswer({ runTurnImpl, opts, llmOpts, systemPrompt, toolRuns, surface });
+        // A /cancel that lands during the retry turn still wins over the retry answer or the failure sentence.
+        if (opts.signal?.aborted === true) { wasAborted = true; answer = ''; }
+      }
       const responseText = wasAborted
         ? (answer?.trim()
             ? `${answer}\n\n⏹️ 이 작업은 /cancel 로 취소되었습니다 (실행 중이던 Bash/PTY 종료됨).`

package/src/agent/run-context.ts

@@ -9,6 +9,7 @@
 
 import { normalizeChildLlmProvider } from '../self-dev/dev-cli.js';
 import { providerEnvKey } from '../llm/provider-credentials.js';
+import { bedrockChildRelayEnv } from '../llm/bedrock.js';
 
 export type RunContext = 'production' | 'benchmark' | 'simulator' | 'self-build';
 
@@ -78,6 +79,20 @@ function childLocalEndpointEnv(provider: string): Record<string, string> {
   return url ? { LOCAL_LLM_URL: url } : {};
 }
 
+/** BEDROCK-PROVIDER — Bedrock 자격은 «파일»(~/.aws · HOME 으로 자식이 그대로 읽는다)과 «env»(AWS_*) 둘 다에 산다.
+ *  env 쪽은 replace env 라 상속이 없으므로 이름 목록대로 릴레이한다(값은 싣기만 하고 어디에도 찍지 않는다). */
+function childBedrockEnv(provider: string): Record<string, string> {
+  return provider === 'bedrock' ? bedrockChildRelayEnv() : {};
+}
+
+/** ZAI-POD-CHILD — glm(Z.ai GLM Coding Plan) 자격은 «env»(`ZAI_API_KEY` · Pod 에선 secretKeyRef)에 산다 — 키 캐시 파일이 없는 Pod 에선
+ *  replace env 라 릴레이가 없으면 자식이 직결을 못 탄다. 카탈로그 envKey(`ZHIPU_API_KEY`)와 다른 이름이라 따로 넘긴다(값은 싣기만 · 어디에도 안 찍는다). */
+function childZaiEnv(provider: string): Record<string, string> {
+  if (provider !== 'glm') return {};
+  const key = process.env.ZAI_API_KEY?.trim();
+  return key ? { ZAI_API_KEY: key } : {};
+}
+
 /** The family classifier is model-id based, so preserve local-provider identity
  * across the replace-env child boundary without changing non-local model IDs. */
 function childRelayModel(provider: string, model: string): string {
@@ -102,6 +117,8 @@ export function childLlmSelectionEnv(selection?: ChildLlmSelection): Record<stri
       ...(selection.effort ? { ELANOUS_ESCALATE_EFFORT: selection.effort } : {}),
       ...childProviderKeyEnv(provider),
       ...childLocalEndpointEnv(provider),
+      ...childBedrockEnv(provider),
+      ...childZaiEnv(provider),
     };
   }
   // ⛔⭐ 상속 갈래도 local 이면 «주소»를 같이 넘긴다(BACKLOG B12 · 2026-09-25).
@@ -112,5 +129,8 @@ export function childLlmSelectionEnv(selection?: ChildLlmSelection): Record<stri
     ...(process.env.ELANOUS_LLM_PROVIDER !== undefined ? { ELANOUS_LLM_PROVIDER: process.env.ELANOUS_LLM_PROVIDER } : {}),
     ...(process.env.ELANOUS_LLM_MODEL !== undefined ? { ELANOUS_LLM_MODEL: process.env.ELANOUS_LLM_MODEL } : {}),
     ...(inheritedProvider ? childLocalEndpointEnv(inheritedProvider) : {}),
+    // 상속 갈래도 bedrock 이면 AWS_* 를 같이 넘긴다(명시 갈래와 같은 규칙 — replace env 라 자동 상속이 없다).
+    ...(inheritedProvider ? childBedrockEnv(inheritedProvider) : {}),
+    ...(inheritedProvider ? childZaiEnv(inheritedProvider) : {}),
   };
 }

package/src/agent/tool-profile.ts

@@ -15,11 +15,27 @@
 //   ELANOUS_CHILD_TOOL_PROFILE=full            전부
 //   ELANOUS_CHILD_TOOL_PROFILE=finance,ops     기본 ⊕ 고른 묶음
 //   (없음)                                   coding(기본)
+//
+// 🩸 CHILD-TOOL-PROFILE-TRIM(10-10 실측 · base 0317d73034 · Plan 켬): `coding` 이 33개 중 27개(스키마 26,742자)를
+//    남겼다 — 판·자리 운영·회수·스킬·서브에이전트 도구가 «어느 묶음에도 안 들어서» 기본으로 갔을 뿐이다.
+//    ⇒ 화이트리스트를 따로 두지 않고(09-25 설계 유지) 그것들을 새 묶음 넷(admin · recall · skills · subagent)으로 옮긴다.
+//    ⇒ `coding` 의 기대 집합 = Read · Grep · Glob · ListDir · Edit · Write · Bash · Plan · MarkStepDone(9개).
+//    빠진 묶음은 상황 신호(골 문면)와 ToolSearch(전체 목록에서 찾는다)로 계속 닿는다.
+
+import { debug } from '../debug/log.js';
 
 /** 추가 묶음 — 코딩 기본에서 빠지고 «고르면 더해지는» 도구들. 접두 ⊕ 정확한 이름. */
 export const TOOL_EXTRA_GROUPS = {
   finance: { prefixes: ['finance_', 'conatus_'], names: [] as string[] },
   ops: { prefixes: [] as string[], names: ['schedule_manage', 'session_manage', 'autopilot_missions', 'ops_status', 'se_build', 'mission_decide'] },
+  /** 판·자리·결정 운영 — 코딩 일에는 안 쓴다. */
+  admin: { prefixes: ['release_'], names: ['coo_admin', 'ops_seats', 'decisions_pending', 'proact_meter'] },
+  /** 기억·회수·관측 조회. */
+  recall: { prefixes: [] as string[], names: ['memory_recall', 'fact_check', 'self_recall', 'context_now', 'logs_query'] },
+  /** 스킬 목록·실행. */
+  skills: { prefixes: [] as string[], names: ['elanous_skills_list', 'skill_exec'] },
+  /** 서브에이전트 — ⚠️ 기본에서 빼도 완주율이 안 떨어지는지는 아직 안 쟀다(SMALL-MODEL-BENCH 가 잰다). 신호·ToolSearch 로 되살린다. */
+  subagent: { prefixes: [] as string[], names: ['Agent', 'AgentOutput', 'AgentReply', 'AgentStop', 'AgentList'] },
 } as const;
 export type ToolExtraGroup = keyof typeof TOOL_EXTRA_GROUPS;
 const ALL_GROUPS = Object.keys(TOOL_EXTRA_GROUPS) as ToolExtraGroup[];
@@ -45,6 +61,10 @@ export function activeToolProfile(env: NodeJS.ProcessEnv = process.env): ToolPro
 export const SITUATIONAL_GROUP_SIGNALS: Record<ToolExtraGroup, RegExp> = {
   finance: /금융|주식|종목|주가|시세|매매|포트폴리오|포지션|투자|백테스트|13F|재무|finance_|conatus|stock|ticker|portfolio|backtest|trading/i,
   ops: /스케줄|크론|예약 실행|오토파일럿|미션 결정|운영 상태|schedule_manage|autopilot|ops_status|mission_decide|cron/i,
+  admin: /release_(status|change)|coo_admin|ops_seats|decisions_pending|proact_meter|판 칸|칸 근거|칸 상태|체크리스트 칸|checklist (set|status)|결정 대기|자리 현황/i,
+  recall: /memory_recall|fact_check|self_recall|context_now|logs_query|기억 조회|기억을 (찾|조회|회수)|자기 이력|사실 확인|팩트 ?체크/i,
+  skills: /elanous_skills_list|skill_exec|스킬(을)? 실행|스킬 목록|run (a|the) skill/i,
+  subagent: /서브\s?에이전트|하위\s?에이전트|sub-?agents?|에이전트를 (띄|병렬)|병렬 에이전트|Agent(Output|Reply|Stop|List)\b|Agent 도구/i,
 };
 
 export function situationalToolGroups(goalText: string | undefined): ToolExtraGroup[] {
@@ -58,9 +78,15 @@ export function situationalToolGroups(goalText: string | undefined): ToolExtraGr
  *  ③ 둘 다 없으면 `coding`(다이어트) */
 export function childToolProfile(env: NodeJS.ProcessEnv = process.env, goalText?: string): string {
   const explicit = env.ELANOUS_CHILD_TOOL_PROFILE?.trim();
-  if (explicit) return explicit;
+  if (explicit) {
+    const parsed = parseToolProfile(explicit);
+    debug.log('agent.tool-profile', 'child-profile-chosen', { source: 'env', raw: explicit, profile: parsed?.name ?? 'coding', groups: parsed ? [...parsed.groups] : [] });
+    return explicit;
+  }
   const groups = situationalToolGroups(goalText);
-  return groups.length ? groups.join(',') : 'coding';
+  const profile = groups.length ? groups.join(',') : 'coding';
+  debug.log('agent.tool-profile', 'child-profile-chosen', { source: groups.length ? 'situational' : 'default', profile, groups, goalChars: goalText?.length ?? 0 });
+  return profile;
 }
 
 /** 기본 모드에서 뺀 묶음을 자식에게 «한 줄»로 알린다 — 필요하면 ToolSearch 로 불러 쓴다(스키마는 안 싣는다). */

package/src/agent-mission/acp-judge.ts

@@ -17,7 +17,12 @@ type AcpAgentManagerPort = {
 };
 
 export type JudgeVerdict = 'merge' | 'rework' | 'reject' | 'ambiguous';
-export interface AcpJudgeResult { verdict: JudgeVerdict; asks: string[]; reason: string; raw: string; }
+export interface AcpJudgeResult {
+  verdict: JudgeVerdict; asks: string[]; reason: string; raw: string;
+  /** TA-LAND-MUSTFIX-ZERO — 심판 JSON 의 asks 가 없거나 배열이 아니거나 문자열 아닌 원소가 섞였다(`asks` 는 소비처 호환으로 `[]`·걸러진 값).
+   *  ⛔ 이때 `asks: []` 는 «남은 지적 0» 이 아니라 «모름» — 자동 병합 관문이 `review-must-fix-unknown` 으로 막는다. */
+  asksUnreadable?: true;
+}
 
 /** ACP 최종심판에 전달하는 PR diff의 기본 문자 상한. */
 export const DEFAULT_JUDGE_DIFF_CHAR_LIMIT = 24_000;
@@ -94,7 +99,8 @@ export function parseJudge(raw: string): AcpJudgeResult {
     const d = JSON.parse(json) as { verdict?: string; asks?: unknown; reason?: string };
     const verdict = (['merge', 'rework', 'reject', 'ambiguous'] as const).includes(d.verdict as JudgeVerdict) ? (d.verdict as JudgeVerdict) : 'ambiguous';
     const asks = Array.isArray(d.asks) ? d.asks.filter((x): x is string => typeof x === 'string') : [];
-    return { verdict, asks, reason: typeof d.reason === 'string' ? d.reason : '', raw };
+    const asksUnreadable = !Array.isArray(d.asks) || asks.length !== d.asks.length;
+    return { verdict, asks, reason: typeof d.reason === 'string' ? d.reason : '', raw, ...(asksUnreadable ? { asksUnreadable: true as const } : {}) };
   } catch { return { verdict: 'ambiguous', asks: [], reason: 'json-parse-fail', raw }; }
 }
 

package/src/agent-mission/capabilities-cli.ts

@@ -2,10 +2,12 @@ import type { Command } from 'commander';
 import { buildCapabilityMatrix, pickBackend } from './capability-matrix.js';
 import { createCapabilityReaders, type CapabilityRun } from './capability-readers.js';
 import { normalizeServiceName, type CapabilityEntry } from './capability-types.js';
+import { buildCapabilityIndex, type CapabilityIndexReaders } from '../smart-wizard/capability-index.js';
 
 export interface CapabilitiesCliDeps {
   run?: CapabilityRun;
   write?: (text: string) => void;
+  indexReaders?: CapabilityIndexReaders;
 }
 
 /** Register the read-only capability inventory under agent-mission (and its codex alias). */
@@ -14,7 +16,20 @@ export function registerCapabilitiesCommand(parent: Command, deps: CapabilitiesC
     .description('List codex, claude and grok service capabilities (read only)')
     .option('--service <name>', 'Show observations and selected backend for a service')
     .option('--json', 'Output JSON')
-    .action((opts: { service?: string; json?: boolean }) => {
+    .option('--index', 'Show provenance and authentication index (read only)')
+    .action(async (opts: { service?: string; json?: boolean; index?: boolean }) => {
+      if (opts.index) {
+        const index = await buildCapabilityIndex(deps.indexReaders);
+        const write = deps.write ?? (text => { process.stdout.write(text); });
+        if (opts.json) write(JSON.stringify(index) + '\n');
+        else {
+          write('SOURCE\tSTATUS\n');
+          for (const [source, status] of Object.entries(index.sources)) write(`${source}\t${status}\n`);
+          write('SOURCE\tID\tKIND\tSTATE\tAUTH\tPROVENANCE\n');
+          for (const entry of index.entries) write(`${entry.source}\t${entry.id}\t${entry.kind}\t${entry.state}\t${entry.auth}\t${entry.provenance}\n`);
+        }
+        return;
+      }
       const readers = createCapabilityReaders(deps.run);
       const matrix = buildCapabilityMatrix(readers);
       const entries: CapabilityEntry[] = opts.service

package/src/agent-mission/driver.ts

@@ -174,6 +174,8 @@ export interface AgentBackend {
   args: string[];
   /** 구독 모드 위해 스크럽할 env 키(API 과금 회피). */
   scrubEnv?: string[];
+  /** 이 실행에만 덧씌울 env(스크럽 뒤 · 바깥 값을 «덮는다»). CODEX-CREDITS-STEP 재시도가 크레딧 계정의 `CODEX_HOME` 을 싣는다. */
+  env?: Readonly<Record<string, string>>;
   /** 초기 신뢰/권한 프롬프트 처리 — 스크린 보고 필요 시 키 입력. 처리했으면 true. */
   handleTrust?(screen: string, write: (s: string) => void): boolean;
 }
@@ -341,6 +343,7 @@ export function resolveBackendSpawn(
       forcedEnv.push(key);
     }
   }
+  for (const [key, value] of Object.entries(backend.env ?? {})) env[key] = value;
   let nestedEnvRemovedCount = 0;
   for (const key of NESTED_AGENT_ENV_BLOCKLIST) {
     if (key in env) {
@@ -352,7 +355,7 @@ export function resolveBackendSpawn(
   //   ⚠️ 과금 스크럽 키만 — 중첩 표지는 정체성 allowlist 가 다시 싣는 키가 있어 이 PR 의 범위 밖이다.
   const unsetEnv = [...new Set(backend.scrubEnv ?? [])].filter((k) => !(k in env));
   // Codex drops parent env under shell_environment_policy inherit=core, so the nested-depth
-  // marker rides on argv (`-c shell_environment_policy.set.ELANOUS_NESTED_DEPTH=<child>`).
+  // marker rides on argv (`-c shell_environment_policy.set.ELANOUS_NESTED_DEPTH="<child>"` — TOML 문자열).
   // Backends that cannot carry it are refused only when a nested elanous launch was requested.
   const args = [...backend.args, ...nestedDepthCodexArgs(backend.name, getNestDepth() + 1)];
   return { cmd: backend.cmd, args, env, unsetEnv, nestedEnvRemovedCount, forcedEnv };
@@ -464,6 +467,10 @@ export function resolveDefaultBackend(
       debug.log('agent-mission.backend', 'fallback-switch', { from: 'codex', to: decision.backend, reason: 'codex-exhausted' });
       return decision.backend === 'claude' ? claudeBackend : grokBackend;
     }
+    if (decision.action === 'codex-credits') {
+      // CODEX-CREDITS-STEP — 체인 마지막 칸: codex 로 «돌아와» 선불 크레딧으로 계속(판정 쪽이 이미 관측을 남겼다).
+      debug.log('agent-mission.backend', 'fallback-codex-credits', { from: 'codex', to: 'codex', reason: 'chain-last-step' });
+    }
   } catch (err) {
     debug.log('agent-mission.backend', 'fallback-failed', { message: (err as Error)?.message }, { level: 'warn' });
   }
@@ -522,10 +529,17 @@ export function decideRuntimeFallback(
   failure: unknown,
   currentStep: FallbackStep,
   state: RuntimeFallbackState,
-  decide: (input: { currentStep: FallbackStep; currentCredentialRateLimited: true }) => { action: string; backend?: string },
+  decide: (input: { currentStep: FallbackStep; currentCredentialRateLimited: true }) => { action: string; backend?: string; to?: { readonly name: string; readonly home: string } },
 ): AgentBackend | null {
   if (classifyAuthError(failure).errorKind !== 'rate-limited' || state.descents >= state.maxDescents) return null;
   const decision = decide({ currentStep, currentCredentialRateLimited: true });
+  // CODEX-CREDITS-STEP — grok 등이 한도로 죽고 체인의 다음 칸이 `codex-credits` 면 codex 로 돌아온다(크레딧 · 한 번만).
+  if (decision.action === 'codex-credits') {
+    if (state.attemptedSteps.has('codex-credits')) return null;
+    // 판정이 고른 크레딧 계정(잔액 많은 순)의 홈으로 자식 codex 를 띄운다 — 없으면 호스트 CODEX_HOME 그대로.
+    const home = decision.to?.home?.trim();
+    return home ? { ...codexBackend, env: { CODEX_HOME: home } } : codexBackend;
+  }
   if (decision.action !== 'switch-backend') return null;
   const nextStep = decision.backend === 'grok' ? 'grok' : decision.backend === 'claude' ? 'claude-pty' : null;
   if (!nextStep || state.attemptedSteps.has(nextStep)) return null;
@@ -642,7 +656,7 @@ export interface AgentMissionDeps {
   /** Inject controller responses while keeping the production control loop. */
   controlStream?: StreamLLMFn;
   resolvePtyWebAddress?: typeof resolvePtyWebAddress;
-  resolveRunFallback?: (input: { currentStep: FallbackStep; currentCredentialRateLimited: true }) => { action: string; backend?: string };
+  resolveRunFallback?: (input: { currentStep: FallbackStep; currentCredentialRateLimited: true }) => { action: string; backend?: string; to?: { readonly name: string; readonly home: string } };
   /** 재귀 재시도 사이에만 전달되는 런 로컬 폴백 진행 상태. */
   runtimeFallback?: RuntimeFallbackContext;
   reemitPtyUsage?: typeof reemitPtyUsage;
@@ -2310,7 +2324,8 @@ async function runAgentMissionBody(spec: AgentMissionSpec, deps: AgentMissionDep
     });
     if (nextBackend && !deps.isMissionAborted?.()) {
       decisionEvent({ step: 'recover', text: `Switching ${backend.name} to ${nextBackend.name}`, detail: { blocked: control.termination.message, action: `Retry with ${nextBackend.name}` } });
-      const nextStep: FallbackStep = nextBackend.name === 'grok' ? 'grok' : nextBackend.name === 'claude' ? 'claude-pty' : 'codex-rotate';
+      // runtime 이 codex 로 «돌아오는» 길은 `codex-credits` 칸뿐이다(decideRuntimeFallback) — 그 칸을 시도한 것으로 적는다.
+      const nextStep: FallbackStep = nextBackend.name === 'grok' ? 'grok' : nextBackend.name === 'claude' ? 'claude-pty' : 'codex-credits';
       stopLive();
       if (h.pid) await (deps.terminateProcessTree ?? terminateMissionProcessTree)(h.pid);
       try { h.kill(); } catch { /* noop */ }

package/src/agent-mission/pr-review-watch.ts

@@ -25,10 +25,14 @@ import { AUTO_REVIEW_LABEL } from '../self-implement/context-capsule.js';
 import { resolveReworkBackendChoice, runReviewLoop, type ReviewLoopOpts, type ReviewLoopResult, type ReviewVerdict } from './review-loop.js';
 import type { ReviewResult } from '../agent-substrate/pr-reviewer.js';
 
-/** 1차 리뷰 결과(ReviewResult) → review-loop injectedReview. fail→reinforce(mustFix)·pass/warn→ok(clean). 순수. */
+/** 1차 리뷰 결과(ReviewResult) → review-loop injectedReview. fail→reinforce(mustFix)·pass/warn→ok. 순수.
+ *  TA-LAND-MUSTFIX-ZERO — pass/warn 의 must-fix 를 «지우지 않고» asks 로 싣는다: 지우면 review-loop 의
+ *  자동 병합 관문이 «must-fix 0» 으로 읽는다. must-fix 0 이면 종전과 같은 `asks: []`. */
 export function mapReviewToInjected(r: ReviewResult): { verdict: ReviewVerdict; asks: string[] } {
   if (r.verdict === 'fail') return { verdict: 'reinforce', asks: r.mustFix };
-  return { verdict: 'ok', asks: [] };
+  // must-fix 목록을 못 읽으면 «0» 이 아니라 «모름» — ok 로 보내지 않는다(ambiguous = 명확화 요청 · 병합 없음).
+  if (!Array.isArray(r.mustFix)) return { verdict: 'ambiguous', asks: [] };
+  return { verdict: 'ok', asks: [...r.mustFix] };
 }
 
 /** [ISO] ELANOUS_STATE_DIR 존중(lazy) — 테스트격리 시 .elanous-test 로 스코프. */

package/src/agent-mission/resource-ladder.ts

@@ -2,7 +2,8 @@ import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { elanousStateRoot } from '../autopilot/state-paths.js';
 import { debug } from '../debug/log.js';
-import { streamLLM } from '../llm.js';
+import * as llm from '../llm.js';
+import { resolveRoleLlm } from '../user-config.js';
 import { emitDecision, type DecisionEvent } from '../live/detail-switch.js';
 import { OFFICIAL_INDEX_KEYS } from '../market/official-keys.js';
 import { verifyIndex, type MarketplaceIndex } from '../market/signed-index.js';
@@ -80,10 +81,14 @@ function parseNeeds(raw: string, vocabulary: readonly string[]): string[] {
 }
 
 async function inferNeeds(mission: string, vocabulary: readonly string[]): Promise<string> {
-  return streamLLM([
+  const resolved = resolveRoleLlm('classify');
+  const provider = llm.PROVIDERS[resolved.provider];
+  if (!provider) throw new Error(`Unknown classify provider: ${resolved.provider}`);
+  debug.log('llm.role-pin', 'resolved', { site: 'resource-ladder', role: 'classify', model: resolved.model, provider: resolved.provider, source: resolved.source });
+  return llm.streamLLM([
     { role: 'system', content: `Identify at most five concrete tool/service/skill capabilities required for this mission. Reply ONLY with JSON {"needs":["capability"]}. No credentials, tokens, URLs, or mission text in the output. If a relevant label appears in this verified official marketplace vocabulary, use that exact label; otherwise use a concrete capability. If uncertain, return an empty list.\nVerified labels: ${JSON.stringify(vocabulary)}` },
     { role: 'user', content: mission },
-  ], () => {}, { maxTokens: 200, temperature: 0 });
+  ], () => {}, { model: resolved.model, provider, usageRole: 'classify', maxTokens: 200, temperature: 0 });
 }
 
 async function readOfficialIndex(): Promise<{ marketplaceBytes: Uint8Array; signatureText: string }> {