elanous 0.2.28 → 0.2.31

package/src/control-plane/server.ts

@@ -2,13 +2,14 @@ import { createHash, randomBytes } from 'node:crypto';
 import { chmodSync, mkdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { effectiveInstanceRoot } from '../instance/resolve.js';
-import { RESOURCE_KINDS, ResourceLedger, ResourceLedgerError, type ResourceRecord } from './ledger.js';
+import { RESOURCE_KINDS, ResourceLedger, ResourceLedgerError, type PodWorkerKey, type ResourceRecord } from './ledger.js';
 import { leasePort, PORT_BANDS } from './ports.js';
 import { machineForToken } from './member-tokens.js';
 import type { LeaseHolderView } from './lease-holder.js';
 
 export const DEFAULT_CONTROL_PORT = PORT_BANDS.reserved[0];
 export const CONTROL_HOSTNAME = '127.0.0.1';
+const MAX_POD_WORKER_TTL_MS = 24 * 60 * 60 * 1000;
 
 export function allowedControlHostname(hostname: string): boolean {
   if (hostname === '127.0.0.1' || hostname === '::1') return true;
@@ -69,6 +70,20 @@ function recordFromBody(value: unknown, owner: string): ResourceRecord {
   };
 }
 
+function podWorkerKey(value: unknown): PodWorkerKey {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) throw new ResourceLedgerError(400, 'invalid-worker-key');
+  const key = value as Record<string, unknown>;
+  if (!['context', 'imageDigest', 'lockHash', 'architecture'].every(name => typeof key[name] === 'string' && (key[name] as string).trim())) {
+    throw new ResourceLedgerError(400, 'invalid-worker-key');
+  }
+  return key as unknown as PodWorkerKey;
+}
+
+function podWorkerBody(value: unknown): Record<string, unknown> {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) throw new ResourceLedgerError(400, 'invalid-pod-worker-lease');
+  return value as Record<string, unknown>;
+}
+
 export interface ControlServerOptions {
   root?: string;
   port?: number;
@@ -94,6 +109,7 @@ export function startControlServer(opts: ControlServerOptions = {}): {
     port,
     async fetch(req) {
       const lease = await opts.leaseView?.get();
+      let responseLease = lease;
       const respond = async (): Promise<Response> => {
         const url = new URL(req.url);
         const path = url.pathname;
@@ -108,7 +124,10 @@ export function startControlServer(opts: ControlServerOptions = {}): {
         const leaseRequest = path === '/v1/leases/port' && method === 'POST';
         const leaseDeletion = /^\/v1\/leases\/port\/([^/]+)$/.exec(path);
         const leaseRenewal = /^\/v1\/leases\/port\/([^/]+)\/heartbeat$/.exec(path);
-        if (!resourcePath && !registerPath && !leaseRequest && !(leaseDeletion && method === 'DELETE') && !(leaseRenewal && method === 'POST') && !(heartbeat && method === 'POST') && !(deletion && method === 'DELETE')) {
+        const workerRegister = path === '/v1/workers/pod' && method === 'POST';
+        const workerAcquire = path === '/v1/leases/pod-worker' && method === 'POST';
+        const workerTransition = /^\/v1\/leases\/pod-worker\/([^/]+)\/(renew|release|sanitize|quarantine)$/.exec(path);
+        if (!resourcePath && !registerPath && !leaseRequest && !workerRegister && !workerAcquire && !(workerTransition && method === 'POST') && !(leaseDeletion && method === 'DELETE') && !(leaseRenewal && method === 'POST') && !(heartbeat && method === 'POST') && !(deletion && method === 'DELETE')) {
           return json({ error: 'not-found' }, 404);
         }
         const authorization = req.headers.get('authorization');
@@ -118,7 +137,7 @@ export function startControlServer(opts: ControlServerOptions = {}): {
           : undefined;
         const machine = !scope && presented ? machineForToken(presented, root) : undefined;
         if (!scope && !machine) return json({ error: 'unauthorized' }, 401);
-        if (!resourcePath && (scope === 'query' || ((leaseRequest || leaseDeletion || leaseRenewal) && scope !== 'member' && !machine))) return json({ error: 'forbidden' }, 403);
+        if (!resourcePath && (scope === 'query' || ((leaseRequest || leaseDeletion || leaseRenewal || workerRegister || workerAcquire || workerTransition) && scope !== 'member' && !machine))) return json({ error: 'forbidden' }, 403);
         if (!resourcePath && (lease?.known ? !lease.iAmHolder : opts.requireKnownLeaseForWrites)) {
           return json({ error: 'not-primary', holder: lease?.holder ?? null, generation: lease?.generation ?? null }, 409);
         }
@@ -132,7 +151,62 @@ export function startControlServer(opts: ControlServerOptions = {}): {
             if (target) requireMachine(target.machine);
           }
         };
+        const currentWorkerPrimary = async (): Promise<Response | undefined> => {
+          if (!opts.leaseView) return json({ error: 'primary-unmeasured' }, 409);
+          const current = await opts.leaseView.get({ fresh: true });
+          responseLease = current;
+          if (!current.known || !current.iAmHolder || current.generation !== lease?.generation) {
+            return json({ error: 'not-primary', holder: current.holder, generation: current.generation }, 409);
+          }
+          return undefined;
+        };
         try {
+          if (workerRegister) {
+            if (!machine) throw new ResourceLedgerError(403, 'worker-host-required');
+            const body = podWorkerBody(await req.json());
+            const { workerId, machine: workerMachine, key, ttlMs } = body;
+            if (typeof workerId !== 'string' || !/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,95}$/.test(workerId)
+              || typeof workerMachine !== 'string' || !workerMachine.trim()
+              || typeof ttlMs !== 'number' || !Number.isSafeInteger(ttlMs) || ttlMs <= 0 || ttlMs > MAX_POD_WORKER_TTL_MS) throw new ResourceLedgerError(400, 'invalid-pod-worker-lease');
+            requireMachine(workerMachine);
+            const stale = await currentWorkerPrimary();
+            if (stale) return stale;
+            return json(await ledger.withGuardedWorkerMutation(async () => !(await currentWorkerPrimary()),
+              () => ledger.registerPodWorker({ workerId, machine: workerMachine, key: podWorkerKey(key), ttlMs, owner })));
+          }
+          if (workerAcquire) {
+            if (scope !== 'member') throw new ResourceLedgerError(403, 'worker-consumer-required');
+            const body = podWorkerBody(await req.json());
+            const { machine: workerMachine, key, runId, attemptId, ttlMs } = body;
+            if (workerMachine !== undefined && (typeof workerMachine !== 'string' || !workerMachine.trim())) throw new ResourceLedgerError(400, 'invalid-pod-worker-lease');
+            if (typeof runId !== 'string' || !runId.trim() || typeof attemptId !== 'string' || !attemptId.trim()
+              || typeof ttlMs !== 'number' || !Number.isSafeInteger(ttlMs) || ttlMs <= 0 || ttlMs > MAX_POD_WORKER_TTL_MS) throw new ResourceLedgerError(400, 'invalid-pod-worker-lease');
+            const stale = await currentWorkerPrimary();
+            if (stale) return stale;
+            return json(await ledger.withGuardedWorkerMutation(async () => !(await currentWorkerPrimary()),
+              () => ledger.acquirePodWorker({ ...(workerMachine ? { machine: workerMachine } : {}), key: podWorkerKey(key),
+                runId, attemptId, ttlMs, owner })));
+          }
+          if (workerTransition) {
+            const workerId = decodeURIComponent(workerTransition[1]!);
+            if (!/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,95}$/.test(workerId)) throw new ResourceLedgerError(400, 'invalid-worker-id');
+            const action = workerTransition[2] as 'renew' | 'release' | 'sanitize' | 'quarantine';
+            if (action === 'sanitize' ? !machine : (action === 'renew' || action === 'release') && scope !== 'member') {
+              throw new ResourceLedgerError(403, 'worker-scope');
+            }
+            const body = podWorkerBody(await req.json());
+            const { leaseId, generation, ttlMs, reason } = body;
+            if (typeof leaseId !== 'string' || !leaseId || !Number.isSafeInteger(generation) || (generation as number) < 1
+              || (ttlMs !== undefined && (typeof ttlMs !== 'number' || !Number.isSafeInteger(ttlMs) || ttlMs <= 0 || ttlMs > MAX_POD_WORKER_TTL_MS))
+              || (reason !== undefined && (typeof reason !== 'string' || !reason.trim()))) throw new ResourceLedgerError(400, 'invalid-pod-worker-lease');
+            const id = `pod-worker-lease:${workerId}`;
+            requireTarget(id);
+            const stale = await currentWorkerPrimary();
+            if (stale) return stale;
+            return json(await ledger.withGuardedWorkerMutation(async () => !(await currentWorkerPrimary()),
+              () => ledger.transitionPodWorker(id, { owner, leaseId, generation: generation as number, action,
+                ...(ttlMs ? { ttlMs: ttlMs as number } : {}), ...(reason ? { reason: reason as string } : {}) })));
+          }
           if (leaseRequest) {
             const body: unknown = await req.json();
             if (!body || typeof body !== 'object' || Array.isArray(body)) throw new ResourceLedgerError(400, 'invalid-port-lease');
@@ -144,7 +218,8 @@ export function startControlServer(opts: ControlServerOptions = {}): {
               throw new ResourceLedgerError(400, 'invalid-port-lease');
             }
             requireMachine(machine);
-            const lease = leasePort({ machine, purpose, ttlMs, owner, excluded: excluded as number[] | undefined }, ledger);
+            const lease = await ledger.withSerializedMutation(() =>
+              leasePort({ machine, purpose, ttlMs, owner, excluded: excluded as number[] | undefined }, ledger));
             return json({ port: lease.attrs.port, lease });
           }
           if (leaseRenewal || leaseDeletion) {
@@ -156,10 +231,10 @@ export function startControlServer(opts: ControlServerOptions = {}): {
             const leaseId = req.headers.get('x-port-lease-id');
             if (!leaseId) throw new ResourceLedgerError(400, 'missing-lease-id');
             if (leaseRenewal) {
-              const renewed = ledger.renewTestPort(port, owner, leaseId);
+              const renewed = await ledger.withSerializedMutation(() => ledger.renewTestPort(port, owner, leaseId));
               return json({ ...renewed, attrs: { ...renewed.attrs, leaseId: undefined } });
             }
-            ledger.deleteTestPort(port, owner, leaseId);
+            await ledger.withSerializedMutation(() => ledger.deleteTestPort(port, owner, leaseId));
             return new Response(null, { status: 204 });
           }
           if (resourcePath) {
@@ -168,19 +243,23 @@ export function startControlServer(opts: ControlServerOptions = {}): {
               machine: url.searchParams.get('machine') || undefined,
               name: url.searchParams.get('name') || undefined,
             });
-            return json({ resources: rows.map(row => row.kind === 'port-lease'
+            return json({ resources: rows.map(row => row.kind === 'pod-worker-lease'
+              ? { ...row, attrs: { key: row.attrs.key, state: row.attrs.state, generation: row.attrs.generation } }
+              : row.kind === 'port-lease'
               ? { ...row, attrs: { ...row.attrs, leaseId: undefined } }
               : row) });
           }
           if (registerPath) {
             const row = recordFromBody(await req.json(), owner);
             if (row.kind === 'port-lease' || row.id.startsWith('port-lease:')) throw new ResourceLedgerError(403, 'port-lease-requires-allocator');
+            if (row.kind === 'pod-worker-lease' || row.id.startsWith('pod-worker-lease:')) throw new ResourceLedgerError(403, 'pod-worker-requires-allocator');
             requireMachine(row.machine);
             requireTarget(row.id);
-            return json(ledger.register(row, owner));
+            return json(await ledger.withSerializedMutation(() => ledger.register(row, owner)));
           }
           if (heartbeat && method === 'POST') {
             if (decodeURIComponent(heartbeat[1]!).startsWith('port-lease:')) throw new ResourceLedgerError(403, 'port-lease-requires-allocator');
+            if (decodeURIComponent(heartbeat[1]!).startsWith('pod-worker-lease:')) throw new ResourceLedgerError(403, 'pod-worker-requires-allocator');
             const body: unknown = await req.json();
             if (!body || typeof body !== 'object' || Array.isArray(body)) throw new ResourceLedgerError(400, 'invalid-heartbeat');
             if (machine && 'machine' in body) requireMachine((body as Record<string, unknown>).machine as string);
@@ -190,12 +269,13 @@ export function startControlServer(opts: ControlServerOptions = {}): {
             }
             const id = decodeURIComponent(heartbeat[1]!);
             requireTarget(id);
-            return json(ledger.heartbeat(id, owner, attrs as Record<string, unknown> | undefined));
+            return json(await ledger.withSerializedMutation(() => ledger.heartbeat(id, owner, attrs as Record<string, unknown> | undefined)));
           }
           if (decodeURIComponent(deletion![1]!).startsWith('port-lease:')) throw new ResourceLedgerError(403, 'port-lease-requires-allocator');
+          if (decodeURIComponent(deletion![1]!).startsWith('pod-worker-lease:')) throw new ResourceLedgerError(403, 'pod-worker-requires-allocator');
           const id = decodeURIComponent(deletion![1]!);
           requireTarget(id);
-          ledger.delete(id, owner);
+          await ledger.withSerializedMutation(() => ledger.delete(id, owner));
           return new Response(null, { status: 204 });
         } catch (err) {
           if (err instanceof ResourceLedgerError) return json({ error: err.message }, err.status);
@@ -204,7 +284,7 @@ export function startControlServer(opts: ControlServerOptions = {}): {
         }
       };
       const response = await respond();
-      if (lease?.known && lease.generation !== null) response.headers.set('x-primary-generation', String(lease.generation));
+      if (responseLease?.known && responseLease.generation !== null) response.headers.set('x-primary-generation', String(responseLease.generation));
       return response;
     },
   });

package/src/core-turn/auth-rejected-notice.ts

@@ -0,0 +1,41 @@
+// 인증 거절(401)로 끝난 턴을 «조용한 완료»가 아니라 처방 한 줄로 드러낸다(TUI 결함 #22 · 10-14).
+//
+// `runCoreTurn` 은 인증 거절을 `stopReason: 'auth_rejected'` 로 «돌려준다»(던지지 않는다) —
+// 재인증과 버그를 가르려는 설계다. 그런데 ACP 브리지가 그 값을 안 읽어서 TUI 엔 «✔ 완료»만 떴다.
+// 브리지는 이 오류를 던져 서버의 실패 경로(`prompt-failed`)와 TUI 의 오류 줄로 보낸다.
+//
+// ⚠️ 문면은 #27498(실패 지문 사전 · `src/self-health/signatures.ts`)의 «⚠ 원인 → 처방 · 원문» 형식을
+//   따른 «임시 상수»다 — 그 PR 이 착지하면 사전 항목(`auth-rejected`)으로 옮기고 이 상수는 지운다.
+
+import { redactSecretText } from '../debug/log.js';
+
+export const AUTH_REJECTED_NOTICE = '⚠ 모델 공급자가 인증을 거절(401) → 다시 로그인하거나 계정 확인(eln usage)';
+
+const RAW_PREVIEW_MAX = 120;
+
+/** 원문 첫 줄을 비밀값 가림 ⊕ 제어 문자 제거 ⊕ 길이 상한으로 줄인다(화면 한 줄을 넘기지 않게). */
+export function authRejectedRawPreview(raw: string | undefined): string {
+  const firstLine = (redactSecretText(raw ?? '').split(/\r\n|\r|\n/, 1)[0] ?? '')
+    // 단독 CR·ESC 같은 터미널 제어 문자가 오류 줄을 덮어쓰지 않게 공백으로(리뷰 r2 should-fix).
+    .replace(/[\u0000-\u001f\u007f-\u009f]/g, ' ')
+    .trim();
+  return firstLine.length > RAW_PREVIEW_MAX ? `${firstLine.slice(0, RAW_PREVIEW_MAX)}…` : firstLine;
+}
+
+/** 처방 한 줄 — 원문이 있으면 꼬리에 붙인다. 줄바꿈은 넣지 않는다(오류 줄이 넘치지 않게). */
+export function formatAuthRejectedNotice(raw: string | undefined): string {
+  const preview = authRejectedRawPreview(raw);
+  return preview ? `${AUTH_REJECTED_NOTICE} · 원문: ${preview}` : AUTH_REJECTED_NOTICE;
+}
+
+/** 브리지가 던지는 오류. `status` 를 401 로 둬 상위의 인증 판정(`isAuthRejectionError`)과도 맞는다. */
+export class CoreTurnAuthRejectedError extends Error {
+  readonly status = 401;
+  readonly rawMessage: string;
+
+  constructor(raw: string | undefined) {
+    super(formatAuthRejectedNotice(raw));
+    this.name = 'CoreTurnAuthRejectedError';
+    this.rawMessage = redactSecretText(raw ?? '');
+  }
+}

package/src/core-turn/run-core-turn.ts

@@ -23,7 +23,7 @@
 import { isAuthRejectionError, streamLLMWithTools } from '../llm.js';
 import { drainPendingUserInput } from '../session/pending-input.js';
 import type { StreamWithToolsHandlers } from '../llm.js';
-import { debug, withAmbientSessionScope } from '../debug/log.js';
+import { debug, redactSecretText, withAmbientSessionScope } from '../debug/log.js';
 import { applyDeferredTools } from '../session-runtime/tier-flip.js';
 import { resolveSessionSurfaceProfile } from '../session-runtime/index.js';
 import type {
@@ -133,6 +133,9 @@ export async function runCoreTurn(
       accumulatedText = full;
       ctx.callbacks?.onText?.(delta, full);
     },
+    ...(ctx.callbacks?.onFinalAnswerSupplement
+      ? { onFinalAnswerSupplement: (info: { answer: string; supplement: string; finalText: string }) => ctx.callbacks?.onFinalAnswerSupplement?.(info) }
+      : {}),
     // This async boundary deliberately returns the dispatcher's fulfilled value
     // or rejection, not its Promise object identity, so completion is recorded.
     dispatchTool: async (name, args, c) => {
@@ -283,7 +286,9 @@ export async function runCoreTurn(
         ...(ctx.sessionId !== undefined ? { sessionId: ctx.sessionId } : {}),
         ...(ctx.maxToolTurns !== undefined ? { maxTurns: ctx.maxToolTurns } : {}),
         ...(ctx.modelOverride !== undefined ? { model: ctx.modelOverride } : {}),
+        ...(ctx.callbacks?.onResolvedProvider !== undefined ? { onResolvedProvider: ctx.callbacks.onResolvedProvider } : {}),
         ...(ctx.budgetGrant !== undefined ? { budgetGrant: ctx.budgetGrant } : {}),
+        ...(ctx.terminalToolNames !== undefined ? { terminalToolNames: ctx.terminalToolNames } : {}),
         // ⭐⭐⭐ `B3`(2026-08-19 · 대표 지시 ②) — 도는 턴 «안»으로 들어오는 사용자 발화의 배수구.
         //   ⛔ 종전엔 스트리밍 중 친 발화가 ***턴이 끝난 뒤***에야 나갔다.
         //   ⭐ 이제 «다음 모델 요청을 만들기 직전»(루프 경계)에 이력으로 들어가고,
@@ -307,9 +312,16 @@ export async function runCoreTurn(
     };
     } catch (err) {
       const stopReason = classifyStopReason(err, ctx.signal);
-      if (stopReason === 'aborted' || stopReason === 'auth_rejected') {
+      if (stopReason === 'aborted') {
         return { stopReason, finalText: accumulatedText };
       }
+      if (stopReason === 'auth_rejected') {
+        return {
+          stopReason,
+          finalText: accumulatedText,
+          errorMessage: redactSecretText(err instanceof Error ? err.message : String(err)),
+        };
+      }
       throw err;
     }
   });