elanous 0.2.23 → 0.2.25

package/src/index.ts

@@ -7,7 +7,9 @@ import type { SelfDevRunParticipant, SelfDevRunState } from './self-dev/run-stor
 import { applyConfigDirFlagFromArgv } from './cli/config-dir-flag.js';
 import { LOGS_SINCE_OPTION, registerLogsCommands } from './cli/logs-cli.js';
 import { registerDocsCommands } from './cli/docs-cli.js';
+import { registerBenchCommands } from './cli/bench-cli.js';
 import { registerRetroCommands } from './cli/retro-cli.js';
+import { registerMemoryCommands } from './cli/memory-cli.js';
 import { registerA2ACommands } from './cli/a2a-cli.js';
 import { registerPluginCommands } from './cli/plugin-cli.js';
 import { registerMakeCommand } from './cli/make-cli.js';
@@ -51,6 +53,7 @@ import { registerPublishCommands } from './cli/publish-cli.js';
 import { registerAutopilotCommands } from './cli/autopilot-cli.js';
 import { registerRoleCommands } from './cli/role-cli.js';
 import { registerMachineCommands } from './cli/machine-cli.js';
+import { recordImagePinFromConfigSet, registerImageCommands } from './cli/image-cli.js';
 import { registerAgentEnvCommands } from './cli/agent-env-cli.js';
 import { registerScheduleCommands } from './cli/schedule-cli.js';
 import { registerGuardianCommands } from './cli/guardian-cli.js';
@@ -91,6 +94,7 @@ import { registerStartCommand } from './cli/start-cli.js';
 import { registerGroundingSourcesCli } from './grounding/sources-cli.js';
 import { registerGraphCommands } from './graph-runner/graph-cli.js';
 import { registerLoopCommands } from './loops/loop-cli.js';
+import { registerResourceCommands } from './cli/resource-cli.js';
 import { registerHqMovePlanCommand } from './hq/hq.js';
 import { registerCardCommand } from './task-cards/card-cli.js';
 import { registerLaunchHeadCommands } from './launch-head/launch-head-cli.js';
@@ -119,6 +123,8 @@ import { runGitCommand } from './git-fs/runner.js';
 import { debug, redactSecretText, redactSecrets } from './debug/log.js';
 import { installHarnessCliCommand, type HarnessAskSayChildLlmOptions, type HarnessAskSayOptions, type HarnessPlanOptions } from './harness/harness-cli-command.js';
 import { CliUserError, formatCliUserError, isCliUserError } from './cli/cli-user-error.js';
+import { classifyFriendlyError, formatFriendlyError } from './cli/friendly-errors.js';
+import { detectLocale } from './expression/locale.js';
 import { dispatchSolveMission } from './skills/tools/solve-mission.js';
 import { performBrowserAction, type BrowserActionDeps, type BrowserActionResult } from './harness/browser-act.js';
 import { decideTypeAction, type TypeActionDecision, type TypeTarget } from './harness/browser-act-type.js';
@@ -199,11 +205,6 @@ import {
 } from './cli/mission-config.js';
 import { DEFAULT_THEME_TOKENS, resolveThemeTokens } from './theme/tokens.js';
 import { conatusPath } from './domains/conatus-data-dir.js';
-import {
-  saveMemory, loadMemory, listMemories, deleteMemory, searchMemories,
-  readIndex, memoryRoot, memoryIndexPath,
-  type MemoryType,
-} from './memory.js';
 
 /** 원본 전용 봇랩 도구 — 공개본엔 없다(release/public-export.yaml · scripts/botlab/**). */
 const BOTLAB_STATE_PATHS_MODULE: string = '../scripts/botlab/botlab-state-paths.js';
@@ -899,9 +900,11 @@ registerPrCommands(program);
 registerRepoCommands(program);
 registerRoleCommands(program);
 registerMachineCommands(program);
+registerImageCommands(program);
 registerAgentEnvCommands(program);
 // CLI entry: where action → resolveCurrentInstance → resolveInstance (instance universe).
 registerWhereCommand(program);
+registerBenchCommands(program);
 registerShadowCommand(program);
 registerLlmDetectCommand(program);
 registerStorageDetectCommand(program);
@@ -1264,6 +1267,7 @@ registerStartCommand(program);
 registerGroundingSourcesCli(program);
 registerGraphCommands(program);
 registerLoopCommands(program);
+registerResourceCommands(program);
 // RFC 실행·착지 루프 §3 — 태스크 컨텍스트 카드(`elanous card list|show` · ⛔ `task`/`tasks` 는 TOX 몫).
 registerCardCommand(program);
 registerLaunchHeadCommands(program);
@@ -1931,174 +1935,7 @@ registerAutopilotCommands(program);
 registerRetroCommands(program);
 
 // ── memory ──
-const memCmd = program.command('memory').description('Persistent memories injected into every chat turn (user / feedback / project / reference)');
-
-memCmd
-  .command('list [type]')
-  .description('List memories (optionally filtered by type)')
-  .option('-n, --limit <n>', 'Max entries to show', '30')
-  .action((type?: string, opts?: { limit: string }) => {
-    const t = type as MemoryType | undefined;
-    const entries = listMemories({ type: t, limit: parseInt(opts?.limit ?? '30', 10) });
-    if (entries.length === 0) {
-      ui.info('No memories yet. Add one with `elanous memory add <type> "<name>" "<description>"`.');
-      return;
-    }
-    ui.header(`memories (${entries.length})`);
-    for (const e of entries) {
-      console.log(`  ${e.id.slice(0, 8)}  [${e.type.padEnd(9)}]  ${e.name}`);
-      if (e.description) console.log(`             ${e.description.slice(0, 100)}`);
-    }
-  });
-
-memCmd
-  .command('add <type> <name> [description...]')
-  .description('Create a memory (type: user|feedback|project|reference). Body piped via stdin if available.')
-  .action(async (type: string, name: string, descParts: string[]) => {
-    if (!['user', 'feedback', 'project', 'reference'].includes(type)) {
-      ui.error(`invalid type "${type}". Use: user | feedback | project | reference`);
-      process.exit(1);
-    }
-    const description = (descParts || []).join(' ');
-    // Read body from stdin if piped; otherwise use description as body too.
-    let body = description;
-    const pipedBody = await readPipedStdin();   // ★ OBS-T3 — 비-TTY 는 파이프를 뜻하지 않는다(소켓이면 EOF 가 안 온다)
-    if (pipedBody) body = pipedBody;
-    const e = saveMemory({ type: type as MemoryType, name, description, body });
-    ui.info(`saved ${e.id.slice(0, 8)} [${e.type}] "${e.name}"`);
-  });
-
-// 3번째 recall 레버(2026-07-19) — pin(항상주입) / priority(매칭 시 순위 부스트).
-memCmd
-  .command('pin <idPrefix>')
-  .description('Pin a memory so it is ALWAYS injected (bypass keyword gate). Optionally set priority.')
-  .option('-p, --priority <n>', 'priority boost (higher = ranked/kept first)', '5')
-  .action((prefix: string, opts: { priority: string }) => {
-    const e = loadMemory(prefix);
-    if (!e) { ui.error(`no memory matching "${prefix}"`); process.exit(1); }
-    saveMemory({ type: e.type, name: e.name, description: e.description, body: e.body, id: e.id, pinned: true, priority: parseInt(opts.priority, 10) || 0 });
-    ui.info(`📌 pinned ${e.id.slice(0, 8)} "${e.name}" (priority ${opts.priority})`);
-  });
-
-memCmd
-  .command('unpin <idPrefix>')
-  .description('Un-pin a memory (back to keyword-gated recall).')
-  .action((prefix: string) => {
-    const e = loadMemory(prefix);
-    if (!e) { ui.error(`no memory matching "${prefix}"`); process.exit(1); }
-    saveMemory({ type: e.type, name: e.name, description: e.description, body: e.body, id: e.id, pinned: false, priority: e.priority });
-    ui.info(`unpinned ${e.id.slice(0, 8)} "${e.name}"`);
-  });
-
-memCmd
-  .command('priority <idPrefix> <n>')
-  .description('Set a memory\'s injection priority boost (0 = default). Added to match score.')
-  .action((prefix: string, n: string) => {
-    const e = loadMemory(prefix);
-    if (!e) { ui.error(`no memory matching "${prefix}"`); process.exit(1); }
-    saveMemory({ type: e.type, name: e.name, description: e.description, body: e.body, id: e.id, priority: parseInt(n, 10) || 0, pinned: e.pinned });
-    ui.info(`priority ${e.id.slice(0, 8)} "${e.name}" → ${parseInt(n, 10) || 0}`);
-  });
-
-// 통합 관리 뷰(2026-07-19) — 2 시스템(큐레이션 파일메모리 + 에피소드 self-log)을 한 화면에.
-memCmd
-  .command('status')
-  .description('Unified memory overview — ① curated file-memory + ② self-log (surface_events)')
-  .action(async () => {
-    const { memoryRoot } = await import('./memory.js');
-    const mems = listMemories();
-    const byType: Record<string, number> = {};
-    let pinned = 0;
-    for (const e of mems) { byType[e.type] = (byType[e.type] ?? 0) + 1; if (e.pinned) pinned += 1; }
-    ui.header('memory (unified)');
-    console.log(`① 큐레이션 파일메모리: ${mems.length}건  [${Object.entries(byType).map(([k, v]) => `${k}:${v}`).join(' ') || '-'}]  📌pinned ${pinned}`);
-    console.log(`   ${memoryRoot()}  (LLM-judge/luna recall · MEMORY.md 항상주입)`);
-    try {
-      const { surfaceEventsDbPath, openSurfaceEventsDb } = await import('./domains/surface-events.js');
-      const path = surfaceEventsDbPath();
-      // 항상 open — legacy conatus/ → memory/ 자가치유 마이그레이션이 여기서 실행된다(존재 체크 먼저
-      // 하면 신 경로 부재로 마이그레이션이 스킵됨). 없으면 빈 store 생성(무해).
-      const db = openSurfaceEventsDb(path);
-      const n = (db.prepare('SELECT count(*) c FROM events').get() as { c: number }).c;
-      const recent = (db.prepare('SELECT ts FROM events ORDER BY ts DESC LIMIT 1').get() as { ts: string } | undefined)?.ts;
-      db.close();
-      console.log(`② 에피소드 self-log: ${n.toLocaleString()} events  (최근 ${recent?.slice(0, 16) ?? '-'})`);
-      console.log(`   ${path}  (FTS5 bm25+recency+myelin rerank · ambient 회상)`);
-    } catch (e) { console.log(`② self-log 조회 실패: ${(e as Error).message}`); }
-    try {
-      const { openKnowledgeDb, knowledgeDbPath } = await import('./domains/knowledge.js');
-      const kdb = openKnowledgeDb(); // 기본 경로 → legacy conatus/ 자가치유 이전
-      const kn = (kdb.prepare('SELECT count(*) c FROM docs').get() as { c: number }).c;
-      const dom = (kdb.prepare("SELECT domain, count(*) c FROM docs GROUP BY domain ORDER BY c DESC LIMIT 3").all() as Array<{ domain: string | null; c: number }>);
-      kdb.close();
-      console.log(`③ 시맨틱 knowledge: ${kn.toLocaleString()} docs  [${dom.map(d => `${d.domain ?? 'null'}:${d.c}`).join(' ')}]`);
-      console.log(`   ${knowledgeDbPath()}  (임베딩 벡터+BM25 하이브리드 · 의미 회상)`);
-    } catch (e) { console.log(`③ knowledge 조회 실패: ${(e as Error).message}`); }
-  });
-
-memCmd
-  .command('show <idPrefix>')
-  .description('Print full memory body')
-  .action((prefix: string) => {
-    const entries = listMemories();
-    const hit = entries.find(e => e.id.startsWith(prefix));
-    if (!hit) { ui.error(`no memory matching "${prefix}"`); process.exit(1); }
-    const full = loadMemory(hit.id)!;
-    ui.header(`${full.type}: ${full.name}`);
-    console.log(`  id          ${full.id}`);
-    console.log(`  created     ${full.createdAt}`);
-    console.log(`  updated     ${full.updatedAt}`);
-    console.log(`  description ${full.description}`);
-    console.log('');
-    console.log(full.body);
-  });
-
-memCmd
-  .command('search <query...>')
-  .description('Keyword search across all memories')
-  .option('--type <t>', 'Filter by type')
-  .option('-n, --limit <n>', 'Max results', '10')
-  .action((parts: string[], opts) => {
-    const hits = searchMemories(parts.join(' '), {
-      type: opts.type as MemoryType | undefined,
-      limit: parseInt(opts.limit, 10),
-    });
-    if (hits.length === 0) { ui.info('No matches.'); return; }
-    ui.header(`matches (${hits.length})`);
-    for (const h of hits) {
-      console.log(`  ${h.entry.id.slice(0, 8)}  score ${h.score}  [${h.entry.type}]  ${h.entry.name}`);
-      if (h.entry.description) console.log(`             ${h.entry.description.slice(0, 100)}`);
-    }
-  });
-
-memCmd
-  .command('delete <idPrefix>')
-  .description('Delete a memory')
-  .action((prefix: string) => {
-    const entries = listMemories();
-    const hit = entries.find(e => e.id.startsWith(prefix));
-    if (!hit) { ui.error(`no memory matching "${prefix}"`); process.exit(1); }
-    deleteMemory(hit.id);
-    ui.info(`deleted ${hit.id.slice(0, 8)}`);
-  });
-
-memCmd
-  .command('index')
-  .description('Print MEMORY.md index verbatim')
-  .action(() => {
-    const idx = readIndex();
-    if (!idx) { ui.info('empty (no memories yet)'); return; }
-    console.log(idx);
-  });
-
-memCmd
-  .command('where')
-  .description('Show the memory storage path')
-  .action(() => {
-    console.log(`memory dir   ${memoryRoot()}`);
-    console.log(`index file   ${memoryIndexPath()}`);
-  });
-
+registerMemoryCommands(program);
 // ── self (self-awareness memory — 외부 도구가 elanous 구현 이력을 주입/회상) ──
 // ── decide (Jev · System One — ⛔ 텍스트를 «생성하지 않는다». 확률이 붙은 판정만 받는다) ──
 program
@@ -4713,7 +4550,7 @@ const selfOrchestrateCmd = selfCmd
   .option('--no-pod-rebuild', 'pod: 이미지 판(elanous.commit)이 HEAD 와 달라도 다시 굽지 않는다 — 측정은 «이미지 판»을 잰다')
   .option('--pod-pass-env <keys>', 'pod: 호스트 env 에서 Pod 로 넘길 키(쉼표) — 예 OPENROUTER_API_KEY,ANTHROPIC_API_KEY(벤치마크 과금 경로)')
   .option('--bench-arms <spec>', 'pod 벤치마크: 골 1개를 팔마다 «라벨 한 줄만 다르게» 복제해 동시에 — "id=provider[:model][@KEY+KEY];…" (예 codex=openai-codex;or-kimi=openrouter:openrouter/moonshotai/kimi-k3@OPENROUTER_API_KEY) · --auto-merge 거부 · RFC fleet 슈퍼바이저 §A3')
-  .addOption(new Option('--child-llm-provider <id>', 'pod: 구현 자식 LLM provider(openai-codex|grok|openrouter|anthropic) — 하니스 --child-llm-provider 가 이 자리로 온다(10-05)').hideHelp())
+  .addOption(new Option('--child-llm-provider <id>', 'pod: 구현 자식 LLM provider(openai-codex|grok|openrouter|anthropic|bedrock|glm) — 하니스 --child-llm-provider 가 이 자리로 온다(10-05)').hideHelp())
   .addOption(new Option('--child-llm-model <id>', 'pod: 구현 자식 LLM model(--child-llm-provider 와 함께)').hideHelp())
   .addOption(new Option('--child-llm-effort <level>', 'pod: 구현 자식 추론 노력(--child-llm-provider 와 함께)').hideHelp())
   .option('--help-all', '모든 orchestrate 옵션 표시')
@@ -5000,6 +4837,33 @@ const selfOrchestrateCmd = selfCmd
         let rotationAccounts: readonly string[] | undefined;
         let podProvider: import('./task-orchestrator/surfaces/pod-child-providers.js').PodChildProvider = 'openai-codex';
         let grokApiKeyOptIn = false;
+        {
+          // SUBSCRIPTION-EXHAUST-REROUTE (0.2.24): a Pod launch with no child model gets the configured default
+          // (tools.selfImplement.podChildDefault · default openrouter/z-ai/glm-5.3) instead of falling to codex.
+          // It fills the same flags a named launch carries, so every check below runs unchanged.
+          const child = opts as { childLlmProvider?: string; childLlmModel?: string; childLlmEffort?: string };
+          const { resolvePodChildDefault } = await import('./task-orchestrator/surfaces/pod-child-default.js');
+          const { homedir: defaultKeyHome } = await import('node:os');
+          const childDefault = resolvePodChildDefault({
+            flags: { provider: child.childLlmProvider, model: child.childLlmModel, effort: child.childLlmEffort },
+            benchArms: Boolean(benchArms),
+            explicitPodAccount: (opts as { podAccount?: string }).podAccount,
+            config: (launchPolicy.tools?.selfImplement as { podChildDefault?: unknown } | undefined)?.podChildDefault,
+            openrouterKeyPresent: () => {
+              if (process.env.OPENROUTER_API_KEY?.trim()) return true;
+              try { return Boolean(readFileSync(_joinPath(defaultKeyHome(), '.cache', 'openrouter_api_key'), 'utf8').trim()); } catch { return false; }
+            },
+          });
+          if (childDefault.apply) {
+            child.childLlmProvider = childDefault.provider;
+            if (childDefault.model) child.childLlmModel = childDefault.model;
+            debug.log('self-implement.pod', 'child-default-applied', { provider: childDefault.provider, model: childDefault.model ?? null, source: childDefault.source, ...(childDefault.invalidConfig !== undefined ? { invalidConfig: String(JSON.stringify(childDefault.invalidConfig)) } : {}) });
+            if (!opts.json) ui.info(`[pod] child 기본 모델 = ${childDefault.provider}${childDefault.model ? `/${childDefault.model}` : ''} (${childDefault.source === 'config' ? 'tools.selfImplement.podChildDefault' : '기본값'}) — --child-llm-* 로 바꾼다`);
+          } else if (childDefault.reason !== 'flag') {
+            debug.log('self-implement.pod', 'child-default-skipped', { reason: childDefault.reason, provider: childDefault.provider ?? null, model: childDefault.model ?? null, ...(childDefault.invalidConfig !== undefined ? { invalidConfig: String(JSON.stringify(childDefault.invalidConfig)) } : {}) }, { level: childDefault.reason === 'no-openrouter-key' ? 'warn' : 'debug' });
+            if (childDefault.reason === 'no-openrouter-key' && !opts.json) ui.warn('[pod] child 기본 모델(openrouter)을 못 쓴다 — 호스트에 OpenRouter 키 없음 · 종전 codex 경로로 간다');
+          }
+        }
         {
           // 10-05 PODPROVIDER: refuse child choices this Pod launch cannot honour instead of dropping them.
           const child = opts as { childLlmProvider?: string; childLlmModel?: string; childLlmEffort?: string };
@@ -5008,7 +4872,7 @@ const selfOrchestrateCmd = selfCmd
             ? 'pod: --child-llm-model/--child-llm-effort 는 --child-llm-provider 와 함께'
             : named && benchArms
               ? 'pod: --child-llm-provider 는 --bench-arms 와 함께 못 쓴다(팔마다 모델이 하나다)'
-              : (named === 'grok' || named === 'openrouter' || named === 'anthropic') && explicitPodAccount
+              : (named === 'grok' || named === 'openrouter' || named === 'anthropic' || named === 'bedrock' || named === 'glm') && explicitPodAccount
                 ? `pod: --child-llm-provider ${named} 은 --pod-account 와 함께 못 쓴다(그것은 codex 계정을 고정한다)`
                 : undefined;
           if (refuse) { ui.error(refuse); debug.log('self-implement.pod', 'child-provider-refused', { provider: named ?? null, reason: refuse }); process.exit(2); }
@@ -5026,6 +4890,12 @@ const selfOrchestrateCmd = selfCmd
           const { normalizeFallbackChain } = await import('./oauth/fallback-chain.js');
           const fallbackEnabled = codexPolicyAllowsFallback(quotaPolicy)
             && normalizeFallbackChain(launchPolicy.llm?.fallbackChain).chain.includes('grok');
+          // CODEX-CREDITS-STEP — 체인 마지막 칸(크레딧). 켜져 있을 때만 grok 잔량을 잰다(발사 관문과 같은 80% 상한).
+          //   Pod 는 «grok 뒤» 순서(문서화된 배치)만 따른다 — grok 앞에 둔 체인은 Pod 계획에서 크레딧 칸을 쓰지 않는다.
+          const launchChain = normalizeFallbackChain(launchPolicy.llm?.fallbackChain).chain;
+          const codexCreditsStep = codexPolicyAllowsFallback(quotaPolicy)
+            && launchChain.includes('codex-credits')
+            && (!launchChain.includes('grok') || launchChain.indexOf('codex-credits') > launchChain.indexOf('grok'));
           // POL1 — say which policy this launch uses and where it came from; warn when a test universe disagrees with production.
           const { effectiveInstanceRoot, prodInstanceRoot } = await import('./instance/resolve.js');
           const root = effectiveInstanceRoot();
@@ -5074,7 +4944,7 @@ const selfOrchestrateCmd = selfCmd
           if (namedChildDecision.refuse) { ui.error(namedChildDecision.refuse); debug.log('self-implement.pod', 'child-provider-refused', { provider: namedChild, reason: namedChildDecision.refuse }); process.exit(2); }
           // A named codex child must stay codex — the plan may not fall back to grok (post-review must-fix).
           const namedCodex = namedChildDecision.provider === 'openai-codex';
-          const plan: import('./task-orchestrator/surfaces/pod-account-broker.js').PodProviderPlan | null = namedChildDecision.provider === 'openrouter' || namedChildDecision.provider === 'anthropic' ? null : namedChildDecision.provider === 'grok'
+          const plan: import('./task-orchestrator/surfaces/pod-account-broker.js').PodProviderPlan | null = namedChildDecision.provider === 'openrouter' || namedChildDecision.provider === 'anthropic' || namedChildDecision.provider === 'bedrock' || namedChildDecision.provider === 'glm' ? null : namedChildDecision.provider === 'grok'
             ? { provider: 'grok', excluded: [], grokSubscriptionEligible: credential?.kind === 'subscription' }
             : planPodProvider({
             codexCandidates: inspectCodexRotation().candidates,
@@ -5082,18 +4952,28 @@ const selfOrchestrateCmd = selfCmd
             thresholdPercentByAccount: launchPolicy.llm?.codexAccountRotationThresholdPercentByAccount,
             // 대표 한도 정책 한 값(`llm.codexQuotaPolicy`) — 크레딧·폴백을 같이 정한다.
             creditsAllowed: codexPolicyAllowsCredits(quotaPolicy),
+            // SUBSCRIPTION-EXHAUST-REROUTE — 예비분 이하 잔액(«알려진» 값)의 계정은 크레딧으로 쓰지 않는다.
+            creditReserve: typeof launchPolicy.llm?.codexCreditReserve === 'number' && Number.isFinite(launchPolicy.llm.codexCreditReserve) && launchPolicy.llm.codexCreditReserve >= 0
+              ? launchPolicy.llm.codexCreditReserve : (await import('./oauth/codex-account-store.js')).DEFAULT_CODEX_CREDIT_RESERVE,
             ...podFallbackCredentials(namedChildDecision.provider, {
               grokSubscription: fallbackEnabled && grokSubscriptionUsable,
               grokApiKey: fallbackEnabled && credential?.kind === 'api_key',
             }),
             grokApiKeyOptIn,
+            ...(codexCreditsStep ? { codexCreditsStep: true, grokQuota: await (async () => {
+              const { readLiveGrokUsedPercent } = await import('./self-implement/budget-gate.js');
+              const { LAUNCH_GROK_USED_PERCENT_CAP } = await import('./user-config.js');
+              const used = await readLiveGrokUsedPercent();
+              return used === undefined ? 'unknown' as const : used >= LAUNCH_GROK_USED_PERCENT_CAP ? 'exhausted' as const : 'usable' as const;
+            })() } : {}),
           });
           if (plan?.provider === null) { ui.error(`pod: 쓸 codex 계정이 없다 — ${plan.reasons.join(' · ')}${namedCodex ? ' · child provider 를 openai-codex 로 지정해 grok 으로 넘기지 않는다' : ''} · 계정을 명시하려면 --pod-account <이름>`); process.exit(2); }
-          podProvider = namedChildDecision.provider === 'openrouter' || namedChildDecision.provider === 'anthropic' ? namedChildDecision.provider : plan!.provider!;
+          podProvider = namedChildDecision.provider === 'openrouter' || namedChildDecision.provider === 'anthropic' || namedChildDecision.provider === 'bedrock' || namedChildDecision.provider === 'glm' ? namedChildDecision.provider : plan!.provider!;
           if (plan?.provider === 'openai-codex') {
             accountBroker = makePodAccountBroker({ usable: plan.accounts, excluded: plan.excluded });
             rotationAccounts = plan.accounts;
             debug.log('self-implement.pod', 'account-plan', { usable: plan.accounts, excluded: plan.excluded });
+            if (plan.codexCreditsStep) debug.log('self-implement.pod', 'codex-credits-step', { outcome: 'credits', accounts: plan.accounts, skipped: plan.skipped ?? [] }, { level: 'warn' });
             { const { emitDecision } = await import('./live/detail-switch.js');
               emitDecision({ kind: 'ROUTE', what: `Pod 계정 배분 ${plan.accounts.join(' → ')}`, reason: plan.excluded.length ? `뺌 ${plan.excluded.map((x) => `${x.name}(${x.why})`).join(', ')}` : '모든 계정 여유', purpose: plan.creditAccounts ? '구독 잔량 0 — 정책상 크레딧으로 병렬 조각을 돌린다' : '병렬 조각이 한 계정에 몰리지 않게 잔량 순으로 돌려 준다', phase: 'dispatch', target: `Pod ${plan.accounts.length}계정`, paths: plan.accounts.length + plan.excluded.length }); }
             if (!opts.json) ui.info(`[pod] 계정 배분(잔량 순 · 돌려 가며): ${plan.accounts.join(' → ')}${plan.creditAccounts ? ' · 💳 크레딧(구독 잔량 0 · 허가됨)' : ''}${plan.excluded.length ? ` · 뺌 ${plan.excluded.map((x) => `${x.name}(${x.why})`).join(', ')}` : ''}`);
@@ -5106,6 +4986,17 @@ const selfOrchestrateCmd = selfCmd
             // ⓔ 과금 관측 — anthropic 은 API 키 과금(구독 아님). 새 예산 체계는 없다 · 관측 한 줄만.
             debug.log('self-implement.pod', 'provider-named', { provider: 'anthropic', model, anthropicKeyPresent: true, billing: 'api-key' });
             if (!opts.json) ui.info(`[pod] child provider = anthropic(모델 ${model ?? '기본'}) — 발사 인자로 지정됨 · 💳 API 키 과금(구독 아님)`);
+          } else if (namedChildDecision.provider === 'bedrock') {
+            const model = (opts as { childLlmModel?: string }).childLlmModel?.trim() || null;
+            // BEDROCK-PROVIDER ② — 자격은 클러스터의 이름 있는 AWS Secret(발사 전 판정 · 없으면 apply 0 으로 거부). 과금 = AWS 계정.
+            debug.log('self-implement.pod', 'provider-named', { provider: 'bedrock', model, billing: 'aws-account' });
+            if (!opts.json) ui.info(`[pod] child provider = bedrock(모델 ${model ?? '기본'}) — 발사 인자로 지정됨 · 💳 AWS 계정 과금(구독 아님)`);
+          } else if (namedChildDecision.provider === 'glm') {
+            const model = (opts as { childLlmModel?: string }).childLlmModel?.trim() || null;
+            // ZAI-POD-CHILD — 자격은 클러스터의 이름 있는 ZAI Secret(발사 전 판정 · 없으면 apply 0 으로 거부) · 과금 = GLM Coding Plan 정액.
+            //   동시 상한(llm.zaiCodingPlan.maxConcurrent)을 넘는 Pod 는 정책(overage)대로 — openrouter·balance 면 OpenRouter GLM · stop 이면 거부.
+            debug.log('self-implement.pod', 'provider-named', { provider: 'glm', model, billing: 'zai-coding-plan' });
+            if (!opts.json) ui.info(`[pod] child provider = glm(모델 ${model ?? '기본'}) — 발사 인자로 지정됨 · GLM Coding Plan(정액) · 동시 상한을 넘는 Pod 는 llm.zaiCodingPlan.overage 대로`);
           } else if (namedChildDecision.provider === 'grok') {
             const model = (opts as { childLlmModel?: string }).childLlmModel?.trim() || defaultGrokModel().id;
             debug.log('self-implement.pod', 'provider-named', { provider: 'grok', model, credential: credential?.kind ?? null });
@@ -5140,7 +5031,9 @@ const selfOrchestrateCmd = selfCmd
         const childFlags = opts as { childLlmProvider?: string; childLlmModel?: string; childLlmEffort?: string };
         const podChildLlm = childFlags.childLlmProvider?.trim() ? { childProviderExplicit: true, ...(childFlags.childLlmModel?.trim() ? { childModel: childFlags.childLlmModel.trim() } : {}), ...(childFlags.childLlmEffort?.trim() ? { childEffort: childFlags.childLlmEffort.trim() } : {}) } : {};
         if (childFlags.childLlmProvider?.trim()) debug.log('self-implement.pod', 'child-provider-named', { provider: childFlags.childLlmProvider.trim(), model: childFlags.childLlmModel ?? null, podProvider });
-        const podBase = { hostSupervised: opts.supervise === true, ...podChildLlm, ...(remoteOnlyPool ? { imageCommit: image.imageCommit } : {}), account: podProvider === 'grok' ? 'grok' : podProvider === 'openrouter' ? 'openrouter' : podProvider === 'anthropic' ? 'anthropic' : explicitPodAccount ?? 'team', ...(accountBroker ? { accountBroker, rotationAccounts } : {}), ...(podProvider === 'grok' ? { provider: 'grok' as const, grokApiKeyOptIn } : podProvider === 'openrouter' ? { provider: 'openrouter' as const } : podProvider === 'anthropic' ? { provider: 'anthropic' as const } : {}), passEnv, ...(pool ? { pool } : {}), ...((opts as { podSkillEnv?: boolean }).podSkillEnv ? { skillEnv: true } : {}), ...(podSource ? { source: podSource } : {}) };
+        // BEDROCK-POD-PROVIDER-DROP — provider·account 는 한 곳(podLaunchProviderOptions)에서 — 손 나열이 bedrock 을 떨궈 codex(team)로 돌았다(10-11).
+        const podProviderOptions = (await import('./task-orchestrator/surfaces/pod-child-providers.js')).podLaunchProviderOptions(podProvider, { explicitPodAccount, grokApiKeyOptIn });
+        const podBase = { hostSupervised: opts.supervise === true, ...podChildLlm, ...(remoteOnlyPool ? { imageCommit: image.imageCommit } : {}), ...podProviderOptions, ...(accountBroker ? { accountBroker, rotationAccounts } : {}), passEnv, ...(pool ? { pool } : {}), ...((opts as { podSkillEnv?: boolean }).podSkillEnv ? { skillEnv: true } : {}), ...(podSource ? { source: podSource } : {}) };
         if (benchArms) {
           const { benchPodSpawn } = await import('./task-orchestrator/surfaces/self-implement-pod.js');
           podSpawn = benchPodSpawn(benchArms, podBase);
@@ -5151,7 +5044,7 @@ const selfOrchestrateCmd = selfCmd
           ? poolMembers.map(({ context }) => ({ context, namespace: 'elanous-test' }))
           : [{ context: defaultKubectl(['config', 'current-context']).stdout.trim(), namespace: 'elanous-test' }];
         // ⭐ 팔 선언은 «runId 가 붙는» 이 줄에 싣는다 — 위의 `bench-arms` 줄은 runId 해석 «전»이라 비어 있다(09-25 실측) · 보고서(scripts/bench-report.ts)가 이 줄로 잇는다.
-        debug.log('self-dev.orchestrate', 'substrate', { substrate, account: podProvider === 'grok' ? 'grok' : podProvider === 'openrouter' ? 'openrouter' : (opts as { podAccount?: string }).podAccount ?? 'team', passEnv, context: ready.reason, imageCommit: image.imageCommit, imageFresh: image.fresh, ...(benchArms ? { benchArms: benchArms.map((a) => ({ id: a.id, provider: a.provider, model: a.model ?? null, modelSource: a.modelSource ?? null, passEnv: a.passEnv })) } : {}) });
+        debug.log('self-dev.orchestrate', 'substrate', { substrate, account: podProviderOptions.account, passEnv, context: ready.reason, imageCommit: image.imageCommit, imageFresh: image.fresh, ...(benchArms ? { benchArms: benchArms.map((a) => ({ id: a.id, provider: a.provider, model: a.model ?? null, modelSource: a.modelSource ?? null, passEnv: a.passEnv })) } : {}) });
       } else if (substrate !== 'local') {
         ui.error(`--substrate: local | pod (받은 값: ${substrate})`); process.exit(2);
       }
@@ -5763,19 +5656,21 @@ selfCmd
     const { spawnSync } = await import('node:child_process');
     const { reviewPullRequest, renderReview } = await import('./agent-substrate/pr-reviewer.js');
     const { createRepositoryReferencedFileReader } = await import('./self-implement/goal-file-reader.js');
-    const { streamLLM } = await import('./llm.js');
+    const { streamLLM, getProvider } = await import('./llm.js');
     const { registerStandaloneLogSink } = await import('./domains/standalone-log-sink.js');
     const { debug } = await import('./debug/log.js');
     const { runSelfReviewCliCommand, reviewerContextArgs, selfReviewJsonLine } = await import('./agent-substrate/self-review-cli.js');
     const { subscriptionReviewerAvailability } = await import('./self-dev/review-provider-fallback.js');
     const { makeLazyAcpReviewLLM: makeRoleAcpReviewLLM } = await import('./agent-substrate/acp-reviewer.js');
+    const { getOpenRouterApiKey: getOpenRouterApiKeyForReview } = await import('./config.js');
+    const { ROLE_REVIEWER_FALLBACK_MODEL } = await import('./agent-substrate/self-review-cli.js');
     const contextOrder = reviewerContextArgs(process.argv.slice(2));
     const configuredAcpBackend = getUserConfig().acp.reviewBackend;
     // ⭐ Same reviewer row the harness reads (`dev-pipeline` → `resolveSubscriptionReviewer`).
     //    The seam decides whether it applies (only without an explicit reviewer flag).
     const { loadLlmPolicy, resolveSubscriptionReviewer } = await import('./policy/llm-policy.js');
     const roleReviewerSelection = resolveSubscriptionReviewer(loadLlmPolicy(), getUserConfig().roleLlm);
-    const { results } = await runSelfReviewCliCommand(prArgs, {
+    const { results, failed } = await runSelfReviewCliCommand(prArgs, {
       ...opts,
       ...(configuredAcpBackend ? { configuredAcpBackend } : {}),
       ...(roleReviewerSelection ? { roleReviewer: roleReviewerSelection.spec } : {}),
@@ -5797,10 +5692,18 @@ selfCmd
       renderReview,
       // ⛔⭐ 하드코딩 금지(🩸 2026-09-23 실측: 여기 'medium' 이 박혀 있었다) — 무인 리뷰와 «같은» 규칙.
       //   대표 결정: 리뷰는 high. 역할 티어의 effort 를 쓰고, 티어가 없으면 high.
-      makeApiLlm: (model) => {
+      //   명시 `--model` 이면 provider 를 그 모델의 것으로 «고정»한다 — 라우터 폴백(grok 등)으로 조용히 넘어가지 않고 오류로 낸다.
+      makeApiLlm: (model, o) => {
         const effort = reviewReasoningEffort(resolveRoleLlm('review'));
         return (prompt: string) =>
-          streamLLM([{ role: 'user', content: prompt }], () => {}, { model, ...(effort ? { reasoningEffort: effort } : {}) });
+          streamLLM([{ role: 'user', content: prompt }], () => {}, {
+            model,
+            // ⛔ 어댑터 기본 2048 은 리뷰 응답을 자른다(VERDICT/MUST-FIX 줄이 잘리면 reviewed=false 로 접힌다).
+            maxTokens: 16_000,
+            ...(o?.pinProvider ? { provider: getProvider(model) } : {}),
+            ...(o?.onResolved ? { onResolvedProvider: o.onResolved } : {}),
+            ...(effort ? { reasoningEffort: effort } : {}),
+          });
       },
       makeAcpLlm: (o) => {
         // ⚠️ 동기 팩토리라 여기서 동적 import 를 쓸 수 없다 — 지연 로드해 첫 호출에 붙인다.
@@ -5810,7 +5713,7 @@ selfCmd
         return async (prompt: string, images?: readonly ReviewImage[]) => {
           if (!made) {
             const { makeLazyAcpReviewLLM } = await import('./agent-substrate/acp-reviewer.js');
-            made = makeLazyAcpReviewLLM({ cwd: process.cwd(), backend: o.backend, model: o.model, timeoutMs: o.timeoutMs });
+            made = makeLazyAcpReviewLLM({ cwd: o.cwd ?? process.cwd(), backend: o.backend, model: o.model, timeoutMs: o.timeoutMs });
           }
           return made(prompt, images);
         };
@@ -5826,9 +5729,12 @@ selfCmd
         // handshakeTimeoutMs left to the adapter default (min(timeoutMs, 60s)) — the harness lane passes none either.
         return {
           backend: 'claude',
-          llm: makeRoleAcpReviewLLM({ cwd: process.cwd(), backend: 'claude', backendSpec: spawn.backendSpec, env: spawn.env, timeoutMs: o.timeoutMs }),
+          llm: makeRoleAcpReviewLLM({ cwd: o.cwd ?? process.cwd(), backend: 'claude', backendSpec: spawn.backendSpec, env: spawn.env, timeoutMs: o.timeoutMs }),
         };
       },
+      // SUBSCRIPTION-EXHAUST-REROUTE — role reviewer unavailable ⇒ GLM on OpenRouter (the review policy's first
+      //   fallback · same pin as POD_OPENROUTER_REVIEWER_PINS.glm), not the codex ladder. No key ⇒ today's default.
+      roleFallbackModel: () => (getOpenRouterApiKeyForReview()?.trim() ? ROLE_REVIEWER_FALLBACK_MODEL : undefined),
       registerSink: async (surface) => { await registerStandaloneLogSink(surface); },
       log: (event, data, o) => debug.log('self-review', event, data, o ?? {}),
       info: (t) => ui.info(t),
@@ -5838,6 +5744,7 @@ selfCmd
       envModel: () => process.env.ELANOUS_PR_REVIEW_MODEL,
     });
     if (opts.json) await writeStdoutJson(selfReviewJsonLine(results));
+    if (failed >= 1) process.exitCode = 1;
   });
 
 selfCmd
@@ -7868,6 +7775,8 @@ configCmd
     } else if (credential?.source === 'none' && !isKeylessProvider(nextProvider)) {
       ui.warn(`provider credential unavailable: ${parsed}; keeping existing llm.apiKey (subscription or OAuth may be normal)`);
     }
+    // IMAGE-LEDGER-TAGS: the baseline pin (the rail sets it through this command) goes into the image ledger.
+    if (recordImagePinFromConfigSet(path, parsed) === 'recorded') ui.info(`image ledger: baseline ${String(parsed).slice(0, 12)} · keep=pin`);
     ui.info(`set ${path} = ${JSON.stringify(parsed)}`);
   });
 
@@ -11768,7 +11677,7 @@ async function main(): Promise<void> {
   if (needsFirstRun(cfg)) {
     if (cfg.onboarding.webFirst !== false) {
       const { runWebFirstSetup } = await import('./onboarding/web-first.js');
-      if (await runWebFirstSetup({ config: cfg, startedAt: firstRunStartedAt }) === 'link-shown') return;
+      if (await runWebFirstSetup({ config: cfg, startedAt: firstRunStartedAt, startIfMissing: false }) === 'link-shown') return;
     }
     const { runFirstRun } = await import('./onboarding/first-run.js');
     if ((await runFirstRun({ config: cfg })).outcome !== 'ready') return;
@@ -11778,6 +11687,14 @@ async function main(): Promise<void> {
   // answer their first prompt. Printed above the dashboard altscreen
   // so it stays visible on quit (scrolls back into the terminal).
   console.log(`[elanous] ${oneLineProvider()}`);
+  const noticeConfig = getUserConfig();
+  // Only a run that will draw the dashboard (stdin TTY) counts as a person having seen the notice;
+  // a piped/CI run that stops at the TTY gate must not mark it shown.
+  const noticeSeen = (await import('./dashboard/tty-required.js')).dashboardCanUseTty();
+  if (noticeSeen && noticeConfig.errorReports?.enabled !== false && noticeConfig.errorReports?.noticeShown !== true) {
+    console.log((await import('./error-report/report.js')).errorReportNoticeLine(noticeConfig.errorReports));
+    saveUserConfig({ ...noticeConfig, errorReports: { ...noticeConfig.errorReports, noticeShown: true } }, userConfigPath());
+  }
   if (remote) {
     const authNote = remote.token ? 'token' : 'no-auth';
     console.log(`[elanous] remote daemon: ${remote.url} (${authNote})`);
@@ -11859,6 +11776,13 @@ export function runCli(): void {
       console.error(formatCliUserError(err));
       process.exit(1);
     }
+    const friendlyCode = classifyFriendlyError(err);
+    if (friendlyCode) {
+      const locale = detectLocale();
+      console.error(formatFriendlyError(friendlyCode, locale));
+      debug.log('cli.friendly-error', 'shown', { code: friendlyCode, locale });
+      process.exit(1);
+    }
     // ER1 — a real crash is reported once (consented · scrubbed · never blocks more than the send timeout).
     try {
       const { reportError } = await import('./error-report/report.js');

package/src/instance/child-scope.ts

@@ -2,7 +2,7 @@ import { debug } from '../debug/log.js';
 import { getUserConfig, type SelfImplementChildInstanceMode } from '../user-config.js';
 import { readFileSync } from 'node:fs';
 import { join, resolve } from 'node:path';
-import { effectiveInstanceRoot, prodInstanceRoot, treeDerivedRootFor } from './resolve.js';
+import { effectiveInstanceRoot, prodInstanceRoot, measureUniverse, treeDerivedRootFor, universeMismatch, type UniverseMeasure } from './resolve.js';
 
 interface ChildInstanceScope {
   configDir?: string;
@@ -69,6 +69,33 @@ function instanceScopeLog(event: string, data: Record<string, unknown>, warn = f
   debug.log('instance.identity', event, data, warn ? { level: 'warn' } : undefined);
 }
 
+/**
+ * 부모가 도장(`ELANOUS_STATE_DIR`)으로 물려준 우주와 이 프로세스가 실제로 쓰는 우주를 대조한다.
+ * 다르면 `instance.identity universe-mismatch` 경고 한 줄을 남긴다 — 막지 않고 적기만 한다.
+ * 도장이 없으면(사람이 직접 띄운 입구) 비교할 부모가 없으므로 조용하다.
+ */
+export function observeUniverseMismatch(
+  deps: { stamp?: string | undefined; effectiveRoot?: () => string; log?: ChildInstanceScopeDeps['log'] } = {},
+): { parentRoot: string; childRoot: string } | null {
+  const stamp = 'stamp' in deps ? deps.stamp : process.env.ELANOUS_STATE_DIR;
+  const mismatch = universeMismatch(stamp, (deps.effectiveRoot ?? effectiveInstanceRoot)());
+  if (mismatch) (deps.log ?? instanceScopeLog)('universe-mismatch', { ...mismatch, why: 'child resolved a different universe than the one its parent stamped' }, true);
+  return mismatch;
+}
+
+/**
+ * 읽을 우주가 비어 있으면 «0» 이 아니라 «측정 불가(빈 우주)» 라고 `instance.identity universe-unmeasurable` 로 적는다.
+ * 새 test 우주는 늘 비어 있으므로 경고(warn)가 아니라 정보 한 줄이다 — 막지 않고 적기만 한다.
+ */
+export function observeEmptyUniverse(
+  root: string,
+  deps: { entries?: (dir: string) => string[]; log?: ChildInstanceScopeDeps['log'] } = {},
+): UniverseMeasure {
+  const measure = measureUniverse(root, deps.entries);
+  if (!measure.measurable) (deps.log ?? instanceScopeLog)('universe-unmeasurable', { root, reason: measure.reason, why: '읽을 우주가 비어 있어 0 이 아니라 측정 불가로 취급한다' });
+  return measure;
+}
+
 /** Resolve the current universe once; operational parents derive an isolated child universe by default. */
 export function childInstanceScope(deps: ChildInstanceScopeDeps = {}): ChildInstanceScope {
   const elanousBinRoot = resolve(import.meta.dir, '../..');
@@ -77,6 +104,10 @@ export function childInstanceScope(deps: ChildInstanceScopeDeps = {}): ChildInst
   const parentIsProduction = root === prodRoot;
   const mode = (deps.childInstanceMode ?? configuredChildInstanceMode)();
   const log = deps.log ?? instanceScopeLog;
+  if (!deps.effectiveRoot) {
+    observeUniverseMismatch({ effectiveRoot: () => root, log });
+    observeEmptyUniverse(root, { log });
+  }
 
   const readProvider = deps.rawProviderAt ?? rawLlmProviderAt;
   /** 자식이 갈 우주의 provider 가 운영과 어긋나는지 «한 칸»으로 남긴다. 판정하지 않고 적기만 한다. */