elanous 0.2.24 → 0.2.27

package/src/maturity/cli-maturity.ts

@@ -18,14 +18,24 @@ export function cliRootVisibleFor(name: string, role: Role, { showAll }: { showA
   return grade === 'stable' || (role === 'contributor' && (grade === 'beta' || grade === 'tool'));
 }
 
-/** Only help is filtered: Commander still dispatches explicitly typed commands. */
-export function filterCliRootHelp(commands: readonly Command[], role: Role, showAll: boolean): { shown: number; hidden: number } {
+/** Root --help first screen (SETUP-HELP-SLIM): the three stable onboarding commands. */
+export const FIRST_SCREEN_COMMANDS: readonly string[] = ['start', 'setup', 'ask'];
+
+/**
+ * Only help is filtered: Commander still dispatches explicitly typed commands.
+ * firstScreen narrows the visible set to FIRST_SCREEN_COMMANDS and showAll wins over it;
+ * the caller opts in per role — the wired default (deferred slice) enables it for the
+ * general role only, so owner/contributor keep today's list.
+ */
+export function filterCliRootHelp(commands: readonly Command[], role: Role, showAll: boolean, firstScreen: boolean = false): { shown: number; hidden: number } {
+  const firstScreenActive = firstScreen && !showAll;
   let shown = 0;
   let hidden = 0;
   for (const command of commands) {
     const grade = cliRootMaturity(command.name(), commands);
     if (!grade) throw new Error(`cliRoot 에 등급 없는 명령: ${command.name()}`);
-    const visible = cliRootVisibleFor(command.name(), role, { showAll }, commands);
+    const visible = cliRootVisibleFor(command.name(), role, { showAll }, commands)
+      && (!firstScreenActive || FIRST_SCREEN_COMMANDS.includes(command.name()));
     (command as Command & { _hidden: boolean })._hidden = !visible;
     if (visible) shown++;
     else hidden++;

package/src/maturity/feature-maturity.ts

@@ -64,7 +64,7 @@ export const FEATURE_MATURITY = {
     pod: 'beta', browser: 'beta', questions: 'beta', usage: 'stable', live: 'beta',
     research: 'beta', release: 'beta', know: 'beta', freeze: 'beta', flow: 'beta', seat: 'beta', hq: 'beta', steward: 'beta', coord: 'beta', context: 'beta', 'model-watch': 'beta', doctor: 'stable',
     control: 'beta', resources: 'beta', hooks: 'beta', setup: 'stable', start: 'stable',
-    grounding: 'beta', graph: 'beta', loop: 'stable', card: 'stable', 'launch-head': 'beta',
+    grounding: 'beta', graph: 'beta', loop: 'stable', resource: 'beta', card: 'stable', 'launch-head': 'beta',
     a2a: 'beta', plugin: 'stable', make: 'beta', skills: 'beta', connect: 'beta', import: 'beta',
     persona: 'beta', team: 'beta', 'team-set': 'beta', market: 'beta', directive: 'stable', connector: 'beta', storyboard: 'beta',
     python: 'beta', 'self-update': 'stable', 'measure-fabric-arc-ab': 'beta', mcp: 'beta',

package/src/msg/msg-store.ts

@@ -1,5 +1,5 @@
 import { Database } from 'bun:sqlite';
-import { mkdirSync } from 'node:fs';
+import { existsSync, mkdirSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { elanousStateRoot } from '../autopilot/state-paths.js';
 
@@ -20,7 +20,7 @@ export interface UnreadRecipient {
   count: number;
 }
 
-const SEAT_ALIASES: Readonly<Record<string, string>> = {
+export const SEAT_ALIASES: Readonly<Record<string, string>> = {
   S: 'OP', OP: 'OP', COO: 'OP',
   T: 'MK', MK: 'MK', CMO: 'MK',
   O: 'TC', TC: 'TC', CTO: 'TC',
@@ -41,6 +41,7 @@ export function validateMessageEnvelope(input: unknown): MessageEnvelope {
   const record = input as Record<string, unknown>;
   const from = canonicalSeatId(record.from as string);
   const to = canonicalSeatId(record.to as string);
+  if (from === 'ALL') throw new Error('ALL cannot send messages');
   if (typeof record.body !== 'string' || !record.body.trim()) throw new Error('message body must be nonempty');
   if (record.kind !== undefined && (typeof record.kind !== 'string' || !/^[a-z][a-z0-9_-]{0,63}$/.test(record.kind))) {
     throw new Error('invalid message kind');
@@ -54,6 +55,13 @@ function validCursor(cursor: number): number {
   return cursor;
 }
 
+function unreadCountOn(db: Database, to: string): number {
+  return (db.query(`SELECT COUNT(*) AS count FROM msg_messages m
+    WHERE m.id > COALESCE((SELECT last_id FROM msg_cursors WHERE recipient = ?), 0)
+      AND (m.recipient = ? OR (m.recipient = 'ALL' AND m.sender <> ?))`)
+    .get(to, to, to) as { count: number }).count;
+}
+
 interface MessageRow {
   id: number;
   sender: string;
@@ -88,10 +96,37 @@ export class MsgStore {
     CREATE TABLE IF NOT EXISTS msg_cursors (
       recipient TEXT PRIMARY KEY,
       last_id INTEGER NOT NULL DEFAULT 0 CHECK(last_id >= 0)
+    );
+    CREATE TABLE IF NOT EXISTS msg_provenance (
+      provenance_key TEXT PRIMARY KEY,
+      message_id INTEGER NOT NULL REFERENCES msg_messages(id)
     );`);
   }
 
   append(input: MessageEnvelope): Message {
+    return this.insertMessage(input);
+  }
+
+  /** Append once for a provenance key such as coord:<commentId>:<recipient>. */
+  appendWithProvenance(input: MessageEnvelope, provenanceKey: string): Message {
+    if (typeof provenanceKey !== 'string' || !/^coord:[^:]+:[^:]+$/.test(provenanceKey)) {
+      throw new Error('invalid message provenance key');
+    }
+    const msg = validateMessageEnvelope(input);
+    if (provenanceKey.split(':')[2] !== msg.to) throw new Error('provenance recipient does not match message recipient');
+    return this.db.transaction(() => {
+      const existing = this.db.query(`SELECT m.id, m.sender, m.recipient, m.body, m.kind, m.created_at
+        FROM msg_provenance p JOIN msg_messages m ON m.id = p.message_id WHERE p.provenance_key = ?`)
+        .get(provenanceKey) as MessageRow | null;
+      if (existing) return fromRow(existing);
+      const message = this.insertMessage(msg);
+      this.db.query('INSERT INTO msg_provenance(provenance_key, message_id) VALUES (?, ?)')
+        .run(provenanceKey, message.id);
+      return message;
+    }).immediate();
+  }
+
+  private insertMessage(input: MessageEnvelope): Message {
     const msg = validateMessageEnvelope(input);
     const createdAt = new Date().toISOString();
     const result = this.db.query(`INSERT INTO msg_messages(sender, recipient, body, kind, created_at)
@@ -104,10 +139,12 @@ export class MsgStore {
   /** Messages strictly after the supplied cursor, ordered by durable insertion ID. */
   listByRecipient(recipient: string, after: number = 0, limit: number = 100): Message[] {
     const to = canonicalSeatId(recipient);
+    if (to === 'ALL') throw new Error('ALL is a topic, not a recipient');
     validCursor(after);
     if (!Number.isSafeInteger(limit) || limit < 1 || limit > 1000) throw new Error('limit must be between 1 and 1000');
     return (this.db.query(`SELECT id, sender, recipient, body, kind, created_at FROM msg_messages
-      WHERE recipient = ? AND id > ? ORDER BY id ASC LIMIT ?`).all(to, after, limit) as MessageRow[]).map(fromRow);
+      WHERE id > ? AND (recipient = ? OR (recipient = 'ALL' AND sender <> ?))
+      ORDER BY id ASC LIMIT ?`).all(after, to, to, limit) as MessageRow[]).map(fromRow);
   }
 
   list(recipient: string, after: number = 0, limit: number = 100): Message[] {
@@ -116,12 +153,14 @@ export class MsgStore {
 
   getCursor(recipient: string): number {
     const to = canonicalSeatId(recipient);
+    if (to === 'ALL') throw new Error('ALL is a topic, not a recipient');
     return (this.db.query('SELECT last_id FROM msg_cursors WHERE recipient = ?').get(to) as { last_id: number } | null)?.last_id ?? 0;
   }
 
   /** Atomically reject future IDs and keep concurrent or stale acknowledgements from rewinding. */
   advanceCursor(recipient: string, cursor: number): number {
     const to = canonicalSeatId(recipient);
+    if (to === 'ALL') throw new Error('ALL is a topic, not a recipient');
     validCursor(cursor);
     const result = this.db.query(`INSERT INTO msg_cursors(recipient, last_id)
       SELECT ?, ? WHERE ? <= (SELECT COALESCE(MAX(id), 0) FROM msg_messages)
@@ -133,11 +172,24 @@ export class MsgStore {
 
   ack(recipient: string, cursor: number): number { return this.advanceCursor(recipient, cursor); }
 
+  unreadCount(recipient: string): number {
+    const to = canonicalSeatId(recipient);
+    if (to === 'ALL') throw new Error('ALL is a topic, not a recipient');
+    return unreadCountOn(this.db, to);
+  }
+
   unreadRecipients(): UnreadRecipient[] {
-    return this.db.query(`SELECT m.recipient AS recipient, COUNT(*) AS count
-      FROM msg_messages m LEFT JOIN msg_cursors c ON c.recipient = m.recipient
-      WHERE m.id > COALESCE(c.last_id, 0)
-      GROUP BY m.recipient ORDER BY m.recipient ASC`).all() as UnreadRecipient[];
+    return this.db.query(`WITH recipients(recipient) AS (
+        SELECT 'OP' UNION SELECT 'MK' UNION SELECT 'TC' UNION SELECT 'UX'
+        UNION SELECT recipient FROM msg_messages WHERE recipient <> 'ALL'
+        UNION SELECT recipient FROM msg_cursors WHERE recipient <> 'ALL'
+      )
+      SELECT r.recipient AS recipient, COUNT(m.id) AS count
+      FROM recipients r
+      LEFT JOIN msg_cursors c ON c.recipient = r.recipient
+      JOIN msg_messages m ON m.id > COALESCE(c.last_id, 0)
+        AND (m.recipient = r.recipient OR (m.recipient = 'ALL' AND m.sender <> r.recipient))
+      GROUP BY r.recipient ORDER BY r.recipient ASC`).all() as UnreadRecipient[];
   }
 
   unread(): UnreadRecipient[] { return this.unreadRecipients(); }
@@ -147,3 +199,13 @@ export class MsgStore {
 
 export function defaultMsgStorePath(): string { return join(elanousStateRoot(), 'msg', 'messages.db'); }
 export function openMsgStore(path?: string): MsgStore { return new MsgStore(path); }
+
+/** Observe one recipient without creating a store or advancing its acknowledgement. */
+export function readUnreadCount(recipient: string, path: string = defaultMsgStorePath()): number | null {
+  const to = canonicalSeatId(recipient);
+  if (to === 'ALL') throw new Error('ALL is a topic, not a recipient');
+  if (!existsSync(path)) return null;
+  const db = new Database(path, { readonly: true });
+  try { return unreadCountOn(db, to); }
+  finally { db.close(); }
+}

package/src/nexus/api/http-server.ts

@@ -505,6 +505,8 @@ export interface NexusHttpServerOpts {
   draftMetrics?: DraftMetricsSource;
   decisions?: Pick<DecisionsRouteDeps, 'ledger'>;
   opsBoard?: Pick<OpsBoardDeps, 'openStore'>;
+  /** `GET /api/task-agent/board` 의 원장 경로 — 생략하면 인스턴스의 task-agent-actions.json. */
+  taskAgentStatePath?: string;
   cardFollowup?: CardFollowupJobs;
   skillExec?: SkillExecJobs;
   execRequests?: ExecRequestRunner;
@@ -943,6 +945,8 @@ function defaultCardFollowupJobs(): CardFollowupJobs {
   return cardFollowupJobs ??= createCardFollowupJobs();
 }
 
+const TASK_AGENT_BOARD_PATH = '/api/task-agent/board';
+
 let skillExecJobs: SkillExecJobs | undefined;
 function defaultSkillExecJobs(): SkillExecJobs {
   return skillExecJobs ??= createSkillExecJobs();
@@ -1521,6 +1525,24 @@ export async function routeRequest(
       ...opts.opsBoard,
     });
   }
+  // TASKS-ON-TA-LEDGER — 읽기 전용 · 이 경로는 `/v1/` 밖이라 default-deny 관문이 못 덮는다 → 여기서 owner 인증을 직접 건다.
+  if (pathname === TASK_AGENT_BOARD_PATH) {
+    if (!opts.metaApi) return jsonResponse({ error: 'meta-api-runtime-not-wired' }, 503);
+    if (!checkAuth(req, opts.metaApi)) return jsonResponse({ error: 'unauthorized' }, 401);
+    if (method !== 'GET') return jsonResponse({ error: 'method-not-allowed', method }, 405);
+    // 동적 import — 다른 무거운 라우트(skill-exec · card-followup)와 같은 꼴: task-agent 모듈 트리를 데몬 기동 경로에 싣지 않는다.
+    const [{ taskAgentBoard }, { taskAgentStatePath }] = await Promise.all([import('../../task-agent/board.js'), import('../../task-agent/task-hand.js')]);
+    try {
+      // progress 관측은 동기 수 초라 요청이 명시할 때만(`?progress=1`) — 기본 응답은 progress=null(UX 수확 리뷰 should-fix).
+      const withProgress = new URL(req.url, 'http://local').searchParams.get('progress') === '1';
+      const response = taskAgentBoard(opts.taskAgentStatePath ?? taskAgentStatePath(), { withProgress });
+      debug.log('task-agent', 'board-served', { projects: response.board.length });
+      return jsonResponse(response);
+    } catch (error) {
+      debug.log('task-agent', 'board-read-failed', { error: error instanceof Error ? error.message : String(error) });
+      return jsonResponse({ error: 'task-agent-ledger-unreadable' }, 503);
+    }
+  }
   if (method === 'GET' && pathname === DECISIONS_PATH) {
     return handleDecisions(req, {
       authorize: request => !!opts.metaApi && checkAuth(request, opts.metaApi),

package/src/oauth/codex-account-rotation.ts

@@ -74,6 +74,9 @@ interface RotationDecision {
   readonly resetCreditAccount?: string;
   /** SUBSCRIPTION-EXHAUST-REROUTE — 크레딧 예비분에 닿아 `no-candidate` 로 넘겼을 때만 있다(잔액은 «알려진» 값). */
   readonly creditReserveHit?: { readonly balance: number; readonly reserve: number };
+  /** CREDIT-SPEND-ORDER — 구독·리셋권이 다 없어 «다른 계정의 선불 크레딧»으로 옮긴 `rotated` 일 때만 true.
+   *  이 이동도 크레딧 진입이다 — 호출부가 💳 알림 ⊕ `credit-spend-start` 를 낸다(10-12 S2: 이 갈래만 알림 0). */
+  readonly creditEntry?: true;
 }
 
 /** ⛔ 비공개 — 호출자는 객체 리터럴로 준다(구조적 타이핑). */
@@ -261,7 +264,7 @@ export function decideCodexRotation(input: RotationInput): RotationDecision {
       const curHas = input.currentHasCredits ?? self?.hasCredits;
       const currentDry = curHas === false || (typeof cur === 'number' && cur <= floor);
       if (richest && (currentDry || (typeof cur === 'number' && richest.creditBalance! > cur * 1.2))) {
-        return { reason: 'rotated', candidateCount, accountThresholds, to: richest };
+        return { reason: 'rotated', candidateCount, accountThresholds, to: richest, creditEntry: true };
       }
       // 🩸 10-11: 크레딧이 0 이 돼도 여기 머물러 codex 로 계속 쐈다. 잔액이 «알려져 있고» 예비분 이하이며
       //   예비분을 넘는 다른 계정도 없으면 «갈 곳 없음» — 폴백 체인이 다음 칸을 정한다. 모르면 종전대로 머문다.

package/src/oauth/codex-account-store.ts

@@ -24,7 +24,7 @@ import {
   codexAccountThresholdPercent,
   type RotationCandidate,
 } from './codex-account-rotation.js';
-import { codexPolicyAllowsCredits, codexPolicyAllowsFallback, resolveCodexQuotaPolicy, type CodexQuotaPolicy, type ResolvedCodexQuotaPolicy } from './codex-quota-policy.js';
+import { codexPolicyAllowsCredits, codexPolicyAllowsFallback, resolveCodexQuotaPolicy, type CodexQuotaPolicy, type CodexQuotaPolicyFileValue, type ResolvedCodexQuotaPolicy } from './codex-quota-policy.js';
 import { emitDecision } from '../live/detail-switch.js';
 import { debug } from '../debug/log.js';
 import {
@@ -238,11 +238,21 @@ function pinnedAccountExhausted(home: string, accountName: string): boolean {
 
 /** codex 한도 정책(`llm.codexQuotaPolicy` · 옛 `codexCreditsAllowed`) — 못 읽으면 `fallback`(크레딧은 돈이라 fail-closed). */
 export function codexQuotaPolicyFromConfig(): CodexQuotaPolicy {
-  try { return resolveCodexQuotaPolicy(configReader().llm).policy; } catch { return 'fallback'; }
+  try { return resolveCodexQuotaPolicy(configReader().llm, codexQuotaPolicyFileValue()).policy; } catch { return 'fallback'; }
+}
+
+/** `policy/llm.yaml` 의 `credits.codex` — 파일 출처일 때만 값을 낸다(없거나 다른 출처면 undefined). 파일이 깨졌거나 못 읽으면 `unreadable`. */
+function codexQuotaPolicyFileValue(): CodexQuotaPolicyFileValue | undefined {
+  try {
+    const loaded = loadLlmPolicy({ legacyConfig: {} });
+    if (!loaded.filePresent) return undefined;
+    if (!loaded.valid) return 'unreadable';
+    return loaded.sources['credits.codex'] === 'file' ? loaded.policy.credits.codex : undefined;
+  } catch { return 'unreadable'; }
 }
 
 function inspectedQuotaPolicy(): ResolvedCodexQuotaPolicy {
-  try { return resolveCodexQuotaPolicy(configReader().llm); } catch { return { policy: 'fallback', source: 'default' }; }
+  try { return resolveCodexQuotaPolicy(configReader().llm, codexQuotaPolicyFileValue()); } catch { return { policy: 'fallback', source: 'default' }; }
 }
 
 /** 지금 계정의 크레딧 신호 — 판정 입력 두 칸. 신호를 이 계정에 귀속할 수 없으면 비운다(모른다). */
@@ -491,7 +501,7 @@ function acquireCreditSpendAlertLock(path: string, account: string): boolean {
 /** UTC 일자별 성공한 계정 알림만 기록한다. 잠근 채 발송하여 동시 런도 중복 발송하지 않는다. */
 function notifyCreditSpendStart(
   account: string,
-  reason: 'credits-allowed' | 'credit-pace',
+  reason: 'credits-allowed' | 'credit-pace' | 'credits-rotated',
   usage: readonly RotationCandidate[],
   now: number,
   counterPath: string,
@@ -793,11 +803,14 @@ export function resolveCodexAccountForRun(
   });
   observeRotation(decision, current.name);
   // 발송 의무는 이 실행 경로에서 잠금 해제까지 기다린 뒤 하루 카운터에 기록한다.
-  if ((decision.reason === 'credits-allowed' || decision.reason === 'credit-pace') && !deps.counterPath && isUnderTestRunner(process.env)) {
+  // CREDIT-SPEND-ORDER(10-12) — «다른 계정의 선불 크레딧으로 옮김»(`rotated` ⊕ creditEntry)도 크레딧 진입이다.
+  const creditSpendReason = decision.reason === 'credits-allowed' || decision.reason === 'credit-pace' ? decision.reason
+    : decision.reason === 'rotated' && decision.creditEntry ? 'credits-rotated' as const : undefined;
+  if (creditSpendReason && !deps.counterPath && isUnderTestRunner(process.env)) {
     // 시험 러너 가드(autoConsume 의 test-runtime-guard 와 같은 관용구) — 카운터를 주입 안 한 시험이 실제 카운터·송신기에 닿지 않는다.
     debug.log('oauth.codex-account', 'credit-spend-alert-skipped', { account: decision.to?.name ?? current.name, reason: 'test-runtime-guard' });
-  } else if (decision.reason === 'credits-allowed' || decision.reason === 'credit-pace') {
-    notifyCreditSpendStart(decision.to?.name ?? current.name, decision.reason, candidates, now,
+  } else if (creditSpendReason) {
+    notifyCreditSpendStart(decision.to?.name ?? current.name, creditSpendReason, candidates, now,
       deps.counterPath ?? join(codexCredentialRoot(), 'budget', 'codex-credit-spend-alert.json'));
   }
   // 순서 ② — 구독 남은 계정이 없고 리셋권이 있으면 «스스로 1개» 쓴다(일일 상한 · 비동기 · 이번 호출은 종전대로 머문다).

package/src/oauth/codex-quota-policy.ts

@@ -9,15 +9,20 @@
 //   credits      — 한도 안 ⊕ 크레딧(찬 계정을 선불 크레딧으로 계속). 크레딧도 떨어져 요청이 한도 오류를 내면 폴백 체인.
 //
 // ⛔ 옛 키 `llm.codexCreditsAllowed: true` 는 `credits` 로 읽는다(새 키가 있으면 새 키가 이긴다).
+// ⭐ 새 자리 = `policy/llm.yaml` 의 `credits.codex`(use→credits · fallback→fallback · never→within-quota).
+//   풀이 순서: env → 정책 파일(파일 출처일 때만) → 옛 `llm.codexQuotaPolicy` → 옛 `llm.codexCreditsAllowed` → fallback.
+//   옛 키는 지우지 않고 읽기만 한다(적용·가려짐은 `codex.policy` 관측으로 남는다).
 // ⛔ 못 읽거나 모르는 값이면 `fallback` — 크레딧은 돈이라 fail-closed(종전 기본과 같다).
 
+import { debug } from '../debug/log.js';
+
 export const CODEX_QUOTA_POLICIES = ['within-quota', 'fallback', 'credits'] as const;
 export type CodexQuotaPolicy = (typeof CODEX_QUOTA_POLICIES)[number];
 
 export interface ResolvedCodexQuotaPolicy {
   readonly policy: CodexQuotaPolicy;
-  /** 어디서 정해졌나 — `config`(새 키) · `legacy-credits`(옛 `codexCreditsAllowed`) · `default` · `invalid`(모르는 값 → 기본). */
-  readonly source: 'env' | 'config' | 'legacy-credits' | 'default' | 'invalid';
+  /** 어디서 정해졌나 — `policy-file`(policy/llm.yaml credits.codex) · `config`(옛 `codexQuotaPolicy`) · `legacy-credits`(옛 `codexCreditsAllowed`) · `default` · `invalid`(모르는 값 → 기본). */
+  readonly source: 'env' | 'policy-file' | 'config' | 'legacy-credits' | 'default' | 'invalid';
 }
 
 export const CODEX_QUOTA_POLICY_LABEL: Readonly<Record<CodexQuotaPolicy, string>> = {
@@ -30,16 +35,40 @@ export function isCodexQuotaPolicy(value: unknown): value is CodexQuotaPolicy {
   return typeof value === 'string' && (CODEX_QUOTA_POLICIES as readonly string[]).includes(value);
 }
 
+/** `policy/llm.yaml` 의 `credits.codex` 값. `unreadable` = 파일이 있는데 깨졌거나 못 읽음(fail-closed 로 fallback). */
+export type CodexQuotaPolicyFileValue = 'use' | 'fallback' | 'never' | 'unreadable';
+
+const FILE_VALUE_TO_POLICY: Readonly<Record<Exclude<CodexQuotaPolicyFileValue, 'unreadable'>, CodexQuotaPolicy>> = {
+  use: 'credits',
+  fallback: 'fallback',
+  never: 'within-quota',
+};
+
 export function resolveCodexQuotaPolicy(
   llm: { readonly codexQuotaPolicy?: unknown; readonly codexCreditsAllowed?: unknown } | undefined,
+  file?: CodexQuotaPolicyFileValue,
 ): ResolvedCodexQuotaPolicy {
   // A Pod has no copy of the host config; the launcher hands the host's policy down in this variable
   // (09-29: without it every Pod child fell back to grok while all three accounts still had credits).
   const fromEnv = process.env.ELANOUS_CODEX_QUOTA_POLICY?.trim();
   if (fromEnv && isCodexQuotaPolicy(fromEnv)) return { policy: fromEnv, source: 'env' };
+  // 정책 파일이 깨졌으면 옛 키가 credits 라 해도 따르지 않는다 — 크레딧은 돈이라 닫는다.
+  if (file === 'unreadable') return { policy: 'fallback', source: 'invalid' };
   const raw = llm?.codexQuotaPolicy;
-  if (isCodexQuotaPolicy(raw)) return { policy: raw, source: 'config' };
-  if (llm?.codexCreditsAllowed === true) return { policy: 'credits', source: 'legacy-credits' };
+  const legacy: { key: string; value: unknown; policy: CodexQuotaPolicy } | undefined = isCodexQuotaPolicy(raw)
+    ? { key: 'llm.codexQuotaPolicy', value: raw, policy: raw }
+    : llm?.codexCreditsAllowed === true ? { key: 'llm.codexCreditsAllowed', value: true, policy: 'credits' } : undefined;
+  if (file !== undefined) {
+    const policy = FILE_VALUE_TO_POLICY[file];
+    if (legacy && legacy.policy !== policy) debug.log('codex.policy', 'legacy-key-shadowed', { key: legacy.key, legacy: legacy.value, file });
+    return { policy, source: 'policy-file' };
+  }
+  if (legacy) {
+    debug.log('codex.policy', 'legacy-key-applied', { key: legacy.key, value: legacy.value });
+    return legacy.key === 'llm.codexQuotaPolicy'
+      ? { policy: legacy.policy, source: 'config' }
+      : { policy: 'credits', source: 'legacy-credits' };
+  }
   if (raw !== undefined) return { policy: 'fallback', source: 'invalid' };
   return { policy: 'fallback', source: 'default' };
 }

package/src/ops/overview-collect.ts

@@ -16,6 +16,7 @@ import {
   type OverviewSnapshot, type OwnerTaskRow, type ParentsInfo, type PodMemberRow, type ReleaseRunInfo, type ScheduleInfo,
 } from './overview.js';
 import { SEAT_ERA_SOURCE, readDispatcherBeats, readDispatcherCapacity, readSeatEraHanded, seatEraFeederDir } from './overview-seat-era.js';
+import { matchesOverviewOwner, normalizeOverviewOwner } from './overview-owner.js';
 
 const GB = 1024 ** 3;
 /** 하트비트 주기 30 s × 2 (RFC §A2 «낡음»). */
@@ -77,8 +78,8 @@ export function ownerRows(cards: readonly TaskCard[], sinceIso: string, ownerFil
   const rows: Record<string, OwnerTaskRow> = {};
   for (const card of cards) {
     if (!card || typeof card.createdAt !== 'string' || card.createdAt < sinceIso) continue;
-    const owner = card.seat ? `seat:${card.seat}` : 'unassigned';
-    if (ownerFilter && ownerFilter !== 'all' && owner !== ownerFilter && owner !== `seat:${ownerFilter}`) continue;
+    const owner = normalizeOverviewOwner(card.seat);
+    if (ownerFilter !== undefined && !matchesOverviewOwner(owner, ownerFilter)) continue;
     const row = rows[owner] ??= { handed: 0, launched: 0, prBound: 0, failed: 0, launchFailed: 0 };
     if (card.status === 'handed') row.handed++;
     else if (card.status === 'launched') row.launched++;

package/src/ops/overview-owner.ts

@@ -0,0 +1,29 @@
+/** Owner labels used by ops overview task rows and the --owner filter. */
+type OverviewOwnerKind = 'seat' | 'steward' | 'orchestrator' | 'external';
+type OverviewOwner = `${OverviewOwnerKind}:${string}` | 'unassigned';
+
+const OWNER_KINDS = new Set<OverviewOwnerKind>(['seat', 'steward', 'orchestrator', 'external']);
+
+/** Normalize a task-card owner into a stable kind-prefixed overview key. */
+export function normalizeOverviewOwner(value: unknown): OverviewOwner {
+  if (typeof value !== 'string' || value.trim() === '') return 'unassigned';
+  const normalized = value.trim();
+  const separator = normalized.indexOf(':');
+  if (separator >= 0) {
+    const kind = normalized.slice(0, separator).toLowerCase() as OverviewOwnerKind;
+    const name = normalized.slice(separator + 1).trim();
+    if (OWNER_KINDS.has(kind) && name) return `${kind}:${name}`;
+  }
+  const kind = normalized.toLowerCase();
+  if (kind === 'steward' || kind === 'orchestrator' || kind === 'external') return `${kind}:default`;
+  return `seat:${normalized}`;
+}
+
+/** Whether a normalized owner key matches a CLI filter, accepting either the full key or its kind. */
+export function matchesOverviewOwner(owner: OverviewOwner, filter?: string): boolean {
+  if (!filter || filter === 'all') return true;
+  const normalizedFilter = filter.trim();
+  if (!normalizedFilter) return true;
+  if (normalizedFilter.toLowerCase() === 'unassigned') return owner === 'unassigned';
+  return owner === normalizeOverviewOwner(normalizedFilter) || owner.startsWith(`${normalizedFilter.toLowerCase()}:`);
+}

package/src/plugin-hooks/shell-hook.ts

@@ -118,6 +118,7 @@ function runShell(opts: RunShellOpts): Promise<RunShellResult> {
     let stdout = '';
     let stderrBuffer = '';
     let killed = false;
+    let stdinError: string | undefined;
     const onAbort = () => {
       if (!killed) {
         killed = true;
@@ -132,6 +133,14 @@ function runShell(opts: RunShellOpts): Promise<RunShellResult> {
     opts.abortSignal.addEventListener('abort', onAbort, { once: true });
 
     child.stdout?.on('data', (chunk) => { stdout += String(chunk); });
+    // A short-lived command can close its read end before end() finishes.
+    // EPIPE says only that stdin was unread; stdout and exit status still
+    // determine the hook result. Other pipe errors are real I/O failures.
+    child.stdin?.on('error', (err: NodeJS.ErrnoException) => {
+      if (err.code === 'EPIPE') return;
+      stdinError = `stdin error: ${err.message}`;
+      opts.onStderr(stdinError);
+    });
     child.stderr?.on('data', (chunk) => {
       stderrBuffer += String(chunk);
       let idx;
@@ -145,13 +154,19 @@ function runShell(opts: RunShellOpts): Promise<RunShellResult> {
       clearTimeout(timer);
       if (stderrBuffer.trim()) opts.onStderr(stderrBuffer.trim());
       // killed => treat as a non-zero exit so dispatcher abort.
-      resolve({ stdout, exitCode: killed ? 124 : (code ?? 1) });
+      resolve({ stdout, exitCode: killed ? 124 : stdinError ? 127 : (code ?? 1), error: stdinError });
     });
     child.on('error', (err) => {
       clearTimeout(timer);
       opts.onStderr(`spawn error: ${err.message}`);
       resolve({ stdout, exitCode: 127 });
     });
-    try { child.stdin?.end(opts.stdin); } catch { /* pipe may have closed */ }
+    try { child.stdin?.end(opts.stdin); }
+    catch (err) {
+      if ((err as NodeJS.ErrnoException).code !== 'EPIPE') {
+        stdinError = `stdin error: ${(err as Error).message}`;
+        opts.onStderr(stdinError);
+      }
+    }
   });
 }

package/src/plugin-missions/evaluator-runner.ts

@@ -137,6 +137,7 @@ function runShell(opts: RunShellOpts): Promise<RunShellResult> {
     let stderrBuf = '';
     let killed = false;
     let timedOut = false;
+    let stdinError: string | undefined;
     const kill = (timeout: boolean) => {
       if (killed) return;
       killed = true;
@@ -150,6 +151,14 @@ function runShell(opts: RunShellOpts): Promise<RunShellResult> {
     opts.abortSignal.addEventListener('abort', () => kill(false), { once: true });
 
     child.stdout?.on('data', (chunk) => { stdout += String(chunk); });
+    // Early exit may close stdin before end() finishes. A broken pipe must
+    // not replace the child's stdout/exit result; other write errors must
+    // surface as evaluator errors.
+    child.stdin?.on('error', (err: NodeJS.ErrnoException) => {
+      if (err.code === 'EPIPE') return;
+      stdinError = `stdin error: ${err.message}`;
+      opts.onStderr(stdinError);
+    });
     child.stderr?.on('data', (chunk) => {
       stderrBuf += String(chunk);
       let idx;
@@ -164,8 +173,9 @@ function runShell(opts: RunShellOpts): Promise<RunShellResult> {
       if (stderrBuf.trim()) opts.onStderr(stderrBuf.trim());
       resolve({
         stdout,
-        exitCode: timedOut ? 124 : (code ?? 1),
+        exitCode: timedOut ? 124 : stdinError ? 127 : (code ?? 1),
         timedOut,
+        error: stdinError,
       });
     });
     child.on('error', (err) => {
@@ -173,6 +183,12 @@ function runShell(opts: RunShellOpts): Promise<RunShellResult> {
       opts.onStderr(`spawn error: ${err.message}`);
       resolve({ stdout, exitCode: 127, timedOut: false });
     });
-    try { child.stdin?.end(opts.stdin); } catch { /* pipe may have closed */ }
+    try { child.stdin?.end(opts.stdin); }
+    catch (err) {
+      if ((err as NodeJS.ErrnoException).code !== 'EPIPE') {
+        stdinError = `stdin error: ${(err as Error).message}`;
+        opts.onStderr(stdinError);
+      }
+    }
   });
 }

package/src/plugins/install/plugin-install.ts

@@ -438,6 +438,13 @@ function declaresMain(packageRoot: string): boolean {
   return !existsSync(join(packageRoot, 'plugin.json')) && !existsSync(join(packageRoot, '.codex-plugin', 'plugin.json'));
 }
 
+/** [wiring] Caller: installPlugin. The PluginManifest normalized by
+ * loadPluginManifestFromDir is handed into the install path here — the install
+ * destination follows the manifest identity, never the source spec/dir name. */
+export function pluginInstallPath(root: string, market: string, manifest: PluginManifest): string {
+  return join(root, 'plugins', market, manifest.id, manifest.version);
+}
+
 export async function installPlugin(spec: string, opts: InstallOptions = {}): Promise<InstalledPlugin> {
   const root = resolve(opts.root ?? elanousStateRoot());
   const stageRoot = join(root, 'plugins', '.staging');
@@ -466,6 +473,10 @@ export async function installPlugin(spec: string, opts: InstallOptions = {}): Pr
     const manifest: PluginManifest = loadPluginManifestFromDir(join(stage, 'package'), { id: source.expectedName ?? basename(spec) }).manifest;
     if (!NAME.test(manifest.id) || !VERSION.test(manifest.version)) fail('io', 'invalid plugin name or version');
     if (source.expectedName && (manifest.id !== source.expectedName || manifest.version !== source.expectedVersion)) fail('conflict', 'market name or version differs from manifest');
+    // [wiring] installPlugin is the caller: the PluginManifest normalized above by
+    // loadPluginManifestFromDir (present manifest or the loader's manifest-absent
+    // fallback) is handed into the install path here, past the NAME/VERSION gates.
+    const destination = pluginInstallPath(root, source.market, manifest);
     const packageRoot = join(stage, 'package');
     const mainPath = inside(packageRoot, manifest.main);
     // A skills/graphs-only pack (official `elanous-basics`) declares no `main` — the default `./plugin.ts` is not a promise.
@@ -480,7 +491,6 @@ export async function installPlugin(spec: string, opts: InstallOptions = {}): Pr
       const path = inside(packageRoot, asset);
       if (!existsSync(path) || !realpathSync(path).startsWith(`${realpathSync(packageRoot)}${sep}`)) fail('io', `plugin asset not found or unsafe: ${asset}`);
     }
-    const destination = join(root, 'plugins', source.market, name, version);
     const emit = (event: InstallEvent) => opts.onEvent?.(event);
     emit({ event: 'resolve', plugin: name, version, sha256: source.sha256 });
     let security: ReturnType<typeof inspectPluginSecurity>;

package/src/preview/terminal.ts

@@ -19,7 +19,6 @@
 // just its mental model (active vs alternate buffer, viewport,
 // cursor, cell attrs).
 
-import type { IPty } from 'node-pty';
 import * as fs from 'node:fs';
 import { StringDecoder } from 'node:string_decoder';
 import { Terminal } from '@xterm/headless';
@@ -104,6 +103,17 @@ export interface PreviewTerminalOpts {
   onRawOutput?: (chunk: string) => void;
 }
 
+// ⛔ `import type { IPty } from 'node-pty'` 도 두지 않는다 — PWA `next build` 가 이 파일까지 타입 검사하는데,
+//   node-pty 는 optionalDependency 라 리눅스(WSL)·게이트 Pod 설치에서 빠지면 «Cannot find module 'node-pty'»
+//   로 빌드가 죽고 self-update 가 매번 실패한다(LINUX-SELF-UPDATE-NODEPTY · 10-11). 이 파일이 실제로 쓰는 면만 둔다.
+/** node-pty `IPty` 중 이 파일이 부르는 면(pid · resize · kill · onExit). master fd 는 resolveMasterFd 가 비공개 칸에서 읽는다. */
+export interface NodePtyHandle {
+  readonly pid: number;
+  resize(cols: number, rows: number): void;
+  kill(signal?: string): void;
+  onExit(listener: (e: { exitCode: number | null; signal?: number }) => void): unknown;
+}
+
 /** Shared so tests can override (fake pty) — the default is node-pty. */
 export type SpawnFn = (shell: string, args: string[], opts: {
   name: string;
@@ -111,7 +121,7 @@ export type SpawnFn = (shell: string, args: string[], opts: {
   rows: number;
   cwd: string;
   env: Record<string, string>;
-}) => IPty;
+}) => NodePtyHandle;
 
 // ⛔⭐ `node-pty` 를 «최상위»에서 싣지 않는다 — 이 모듈은 dashboard·shell-runner 등 다섯 곳이
 //   정적으로 끌어오므로, 최상위 import 면 ***PTY 를 안 쓰는 명령(`--version`)까지*** 네이티브 바인딩을
@@ -124,7 +134,7 @@ export type SpawnFn = (shell: string, args: string[], opts: {
 const defaultSpawn: SpawnFn = (shell, args, o) => {
   // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-explicit-any
   const pty: any = require('node-pty');
-  return pty.spawn(shell, args, o as any) as IPty;
+  return pty.spawn(shell, args, o as any) as NodePtyHandle;
 };
 
 /** node-pty 네이티브 `resize(fd, cols, rows)` 를 임의의 master fd(우리 dup)에 부른다. 'ok' 또는 실패 사유. */
@@ -163,7 +173,7 @@ export interface PreviewRegistryDeps {
 }
 
 export class PreviewTerminal {
-  private pty: IPty | null = null;
+  private pty: NodePtyHandle | null = null;
   private dupFd: number = -1;
   /** ★ P0b-2 — useRegistry 모드일 때 공유 버스 핸들(dup-fd 대신). null=dup-fd 경로(기본). */
   private registryHandle: PtyHandle | null = null;
@@ -470,7 +480,7 @@ export class PreviewTerminal {
   /** node-pty doesn't publish its master fd as a stable field; dig
    *  through the plausible private slots in order of most-to-least
    *  likely so a minor library revision doesn't bite us. */
-  private resolveMasterFd(p: IPty): number | null {
+  private resolveMasterFd(p: NodePtyHandle): number | null {
     const any = p as any;
     const fd = any._fd
       ?? any._socket?._handle?.fd