elanous 0.2.32 → 0.2.34

package/src/task-agent/live-moves.ts

@@ -22,7 +22,9 @@ import { debug } from '../debug/log.js';
 import { findGitDir } from '../git-fs/locate.js';
 import { getUserConfig, userConfigPath } from '../user-config.js';
 import type { DetachedSpawn } from '../cli/tasks-cli.js';
-import { LIVE_MOVE_HISTORY_EVENT, taskAgentStatePath, updateTaskCard, type TaskCard } from './task-hand.js';
+import { LIVE_MOVE_HISTORY_EVENT, shellQuote, taskAgentStatePath, updateTaskCard, type TaskCard } from './task-hand.js';
+import { reconcileHandMergedCard } from './postland-card.js';
+import { resolveParentHosts, type ParentHostConfig } from './parent-host.js';
 import { LIVE_RETRY_MOVES } from './judge.js';
 import { decisionCardGrounds, decisionRaiseArgs, type DecisionCardEvidence, type NextAction } from './actions.js';
 import { pendingReviewResults, reviewResultPath, TA_REVIEW_COMPLETION_CARD_ENV, TA_REVIEW_COMPLETION_RESULT_ENV, TA_REVIEW_COMPLETION_STATE_ENV } from './review-result-capture.js';
@@ -83,6 +85,8 @@ export interface LiveMoveDeps {
   priorDiff?: PriorDiffReader;
   /** Fresh PR head and draft flag for landing; separate from the unchanged review lookup. */
   landPrHead?: (pr: number, cwd: string) => Promise<(PrHeadView & { isDraft: boolean }) | null>;
+  /** TA-CARD-MERGE-RECONCILE — MERGED PR 의 merge SHA·base·mergedAt 관측(시험 주입 · 기본 = `gh pr view`). */
+  handMergePr?: (pr: number, cwd: string) => Promise<HandMergePrView | null>;
   /** One existing pr land operation; inject in tests instead of invoking the CLI. */
   /** TA-REJUDGE-ON-HEAD — `opts.overlapEvidence` 가 있으면 `pr land --overlap-evidence <file>` 로 넘긴다(없으면 종전 인자). */
   land?: (pr: number, head: string, cwd: string, opts?: { overlapEvidence?: string }) => Promise<{ status: number; stdout: string; stderr?: string }>;
@@ -208,25 +212,44 @@ export function liveReviewArgs(entry: string, configDir: string, pr: number, int
   return [resolve(entry), '--config-dir', configDir, 'self', 'review', String(pr), '--json', '--intent', intent];
 }
 
+/** Use the configured node-b checkout for heavy TA workers; absence of parentHost preserves the legacy local path. */
+export function configuredMsb1Worker(): ParentHostConfig | null {
+  const setting = getUserConfig().taskAgent?.parentHost;
+  if (setting === undefined) return null;
+  const target = resolveParentHosts(setting, {} as NodeJS.ProcessEnv).find((entry) => entry.host === 'node-b');
+  if (!target) throw new Error('taskAgent.parentHost configured without a valid node-b worker');
+  return target;
+}
+
+export function remoteTaWorkerCommand(target: ParentHostConfig, args: readonly string[]): string {
+  const entry = target.elanous ? shellQuote(target.elanous) : '$HOME/.local/share/elanous/bin/elanous';
+  const configDir = target.configDir ? shellQuote(target.configDir) : '$HOME/.elanous';
+  return `cd ${shellQuote(target.cwd)} && ${entry} --config-dir ${configDir} ${args.map(shellQuote).join(' ')}`;
+}
+
 /**
  * 지금 도는 진입점으로 같은 우주의 리뷰를 떼어 띄운다 — 기다리지 않는다(결과는 self review 자기 관측에 남는다).
  * TA-REVIEW-RESULT-CAPTURE — `resultPath` 가 있으면 자식 stdout(`--json` 결과)만 그 파일로 받는다(stdin·stderr 는 종전대로 버린다 ·
  * 파이프가 아니라 파일 — 부모가 먼저 끝나도 자식이 EPIPE 로 죽지 않는다). 없으면 종전과 같다(stdio ignore).
  * `opts` 는 시험 몫(spawn·진입점·우주) — 기본은 실물.
  */
-export async function defaultRequestReview(pr: number, intent: string, cwd?: string, opts: { spawn?: DetachedSpawn; entry?: string; configDir?: string; resultPath?: string; cardId?: string; statePath?: string } = {}): Promise<void> {
+export async function defaultRequestReview(pr: number, intent: string, cwd?: string, opts: { spawn?: DetachedSpawn; entry?: string; configDir?: string; resultPath?: string; cardId?: string; statePath?: string; remote?: ParentHostConfig | null } = {}): Promise<void> {
   const { spawnDetachedConfirmed, ELANOUS_CLI_ENTRY } = await import('../cli/tasks-cli.js');
   const { getElanousConfigDirOverride } = await import('../elanous-config-dir.js');
   const { effectiveInstanceRoot } = await import('../instance/resolve.js');
   const configDir = opts.configDir ?? getElanousConfigDirOverride() ?? effectiveInstanceRoot();
   const base = opts.spawn ?? (spawn as unknown as DetachedSpawn);
+  const remote = opts.remote === undefined ? (opts.spawn ? null : configuredMsb1Worker()) : opts.remote;
   const args = liveReviewArgs(opts.entry ?? ELANOUS_CLI_ENTRY, configDir, pr, intent);
   const completionEnv = opts.resultPath && opts.cardId && opts.statePath ? {
     [TA_REVIEW_COMPLETION_CARD_ENV]: opts.cardId,
     [TA_REVIEW_COMPLETION_STATE_ENV]: opts.statePath,
     [TA_REVIEW_COMPLETION_RESULT_ENV]: opts.resultPath,
   } : undefined;
-  if (!opts.resultPath) { await spawnDetachedConfirmed(base, process.execPath, args, undefined, cwd); return; }
+  const workerCommand = remote ? remoteTaWorkerCommand(remote, ['self', 'review', String(pr), '--json', '--model', 'gpt-6-sol', '--intent', intent]) : null;
+  const command = remote ? 'ssh' : process.execPath;
+  const workerArgs = remote ? ['-T', '-o', 'BatchMode=yes', '-o', 'ConnectTimeout=5', remote.host, workerCommand!] : args;
+  if (!opts.resultPath) { await spawnDetachedConfirmed(base, command, workerArgs, undefined, cwd); return; }
   let fd: number;
   try {
     mkdirSync(dirname(opts.resultPath), { recursive: true });
@@ -234,13 +257,13 @@ export async function defaultRequestReview(pr: number, intent: string, cwd?: str
   } catch (error) {
     // 결과 파일을 못 열어도 리뷰는 막지 않는다(종전처럼 stdio ignore) — 회수는 상한 뒤 «no result» 줄로 드러난다.
     try { debug.log('task-agent', 'review-result-file-open-failed', { pr, resultPath: opts.resultPath, reason: (error instanceof Error ? error.message : String(error)).slice(-300) }, { level: 'warn' }); } catch { /* fail-soft */ }
-    await spawnDetachedConfirmed(base, process.execPath, args, undefined, cwd);
+    await spawnDetachedConfirmed(base, command, workerArgs, undefined, cwd);
     return;
   }
   const toFile: DetachedSpawn = (command, spawnArgs, options) =>
     (base as unknown as (c: string, a: string[], o: unknown) => ReturnType<DetachedSpawn>)(command, spawnArgs, { ...options, stdio: ['ignore', fd, 'ignore'] });
   try {
-    await spawnDetachedConfirmed(toFile, process.execPath, args, undefined, cwd, completionEnv);
+    await spawnDetachedConfirmed(toFile, command, workerArgs, undefined, cwd, remote ? undefined : completionEnv);
   } finally {
     try { closeSync(fd); } catch { /* the child keeps its own copy */ }
   }
@@ -296,6 +319,35 @@ export async function defaultLandPrHead(pr: number, cwd: string): Promise<(PrHea
   } catch { return null; }
 }
 
+/** TA-CARD-MERGE-RECONCILE — 손수 병합된 PR 의 정산 관측값(merge SHA 가 main 조상 검증의 재료). */
+export interface HandMergePrView {
+  state: string;
+  url?: string;
+  baseRefName?: string;
+  mergedAt?: string;
+  mergeCommit?: string;
+}
+
+export async function defaultHandMergePr(pr: number, cwd: string): Promise<HandMergePrView | null> {
+  const view = (env: NodeJS.ProcessEnv) => runGh(['pr', 'view', String(pr), '--json', 'state,url,baseRefName,mergedAt,mergeCommit'], { env, cwd });
+  let out = view(process.env);
+  if (out.status !== 0) {
+    const noProxy = { ...process.env };
+    for (const key of ['HTTPS_PROXY', 'https_proxy', 'HTTP_PROXY', 'http_proxy']) delete noProxy[key];
+    out = view(noProxy);
+  }
+  if (out.status !== 0) return null;
+  try {
+    const value = JSON.parse(out.stdout) as { state?: unknown; url?: unknown; baseRefName?: unknown; mergedAt?: unknown; mergeCommit?: { oid?: unknown } | null };
+    if (typeof value.state !== 'string') return null;
+    return { state: value.state,
+      ...(typeof value.url === 'string' && value.url ? { url: value.url } : {}),
+      ...(typeof value.baseRefName === 'string' && value.baseRefName ? { baseRefName: value.baseRefName } : {}),
+      ...(typeof value.mergedAt === 'string' && value.mergedAt ? { mergedAt: value.mergedAt } : {}),
+      ...(typeof value.mergeCommit?.oid === 'string' && /^[a-f0-9]{40}$/i.test(value.mergeCommit.oid) ? { mergeCommit: value.mergeCommit.oid } : {}) };
+  } catch { return null; }
+}
+
 /**
  * REVIEW-CONVERGE-PRIOR-FIX — `prior` 는 같은 PR 의 두 번째 이후 리뷰에만 온다: «직전 반영분»에 직전 머리 범위·diff·must-fix 를,
  * 범위 경계에 «바뀌지 않은 줄의 새 must-fix 는 근거 줄» 한 줄을 붙인다. 없으면(첫 리뷰) 종전 문면 바이트 그대로.
@@ -402,7 +454,7 @@ export async function executeLiveReview(
  *   (`executeLiveLand` ctx `gateAt` = 그 재게이트 요청 시각)에만 이 시도는 «소비됨»으로 빠진다. judgement·infra 와 섞이지 않는다.
  */
 export const LAND_ATTEMPTS_PER_HEAD_ON_INFRA = 2;
-export type LandFailureClass = 'infra' | 'judgement' | 'base-stale';
+export type LandFailureClass = 'infra' | 'judgement' | 'base-stale' | 'recovery';
 
 /** `pr land` 출력 줄 → 인프라 사유. ⛔ 줄 «전체»가 맞아야 한다 — 비슷한 문면을 넓게 받지 않는다. */
 export const LAND_INFRA_OUTPUT_REASONS: ReadonlyArray<{ reason: string; line: RegExp }> = [
@@ -422,6 +474,8 @@ const LAND_INFRA_CONSEQUENCE_LINES: ReadonlyArray<{ of: string; line: RegExp }>
 ];
 /** REJUDGE base-stale — 겹침 증거의 게이트 base 가 낡았고 그 사이 착지가 PR 파일을 건드렸다(`pr land` · #26060 문면). */
 const LAND_BASE_STALE_LINE = /^✗ overlap-evidence: (base-stale-overlap: .*)$/;
+const LAND_RECOVER_REVIEW = /^✗ (?:ancestor-auto|overlap-evidence): (?:review-missing|review-not-reviewed|review-error|review-no-result|review-unreadable|review-pr-mismatch|review-head-mismatch|review-path-not-for-this-pr-head|review-verdict-null|review-must-fix-unknown)(?:\b|$)/;
+const LAND_RECOVER_BUSY = /^✗ heavy-remote: (?:원격|병합 직전 원격|node-b) 게이트 gate-host-busy(?:\b|\s|$)/;
 /** base-stale 에 «딸려 나오는» 줄 — 증거가 거절되면 `pr land` 가 이어서 낸다(그 줄만 있으면 판정 거절로 세지 않는다). */
 const LAND_BASE_STALE_CONSEQUENCE_LINES: readonly RegExp[] = [/^✗ expected-head: overlap merge approval unavailable for the reviewed head$/];
 /** 실패가 아닌 ✗ 줄 — `pr land` 가 «계속합니다»로 넘어간다(판정에 쓰지 않는다). */
@@ -464,6 +518,10 @@ export function classifyLandFailure(outcome: { status: number; stdout?: string;
     if (hit) infra.add(hit.reason); else unlisted.push(line);
   }
   const judged = unlisted.filter((line) => !LAND_INFRA_CONSEQUENCE_LINES.some((entry) => infra.has(entry.of) && entry.line.test(line)));
+  if (judged.length === 1 && !infra.size) {
+    if (LAND_RECOVER_REVIEW.test(judged[0]!)) return { class: 'recovery', reason: 'review-missing' };
+    if (LAND_RECOVER_BUSY.test(judged[0]!)) return { class: 'recovery', reason: 'gate-host-busy' };
+  }
   // REJUDGE base-stale — 거절 줄이 base-stale-overlap(⊕ 딸린 줄) «뿐»이고 인프라 사유가 없을 때만. 하나라도 다른 ✗ 줄이 섞이면 judgement(fail-closed).
   const stale = judged.map((line) => LAND_BASE_STALE_LINE.exec(line)?.[1]).find((reason): reason is string => !!reason);
   if (stale && !infra.size && judged.every((line) => LAND_BASE_STALE_LINE.test(line) || LAND_BASE_STALE_CONSEQUENCE_LINES.some((re) => re.test(line)))) {
@@ -520,7 +578,20 @@ function observeLandWorktreeCreateCapped(deps: LiveMoveDeps, data: { card: strin
 /** 같은 머리에 한 번 더 시도해도 되나 — 앞 시도가 «전부» 끝났고(ok:false) «전부» infra 이고 상한 밑일 때만. */
 function landRetryAllowed(prior: readonly LandAttempt[]): boolean {
   return prior.length > 0 && prior.length < LAND_ATTEMPTS_PER_HEAD_ON_INFRA
-    && prior.every((entry) => entry.ok === false && (entry.class === 'infra' || legacyMissingTscRuntime(entry)));
+    && prior.every((entry) => entry.ok === false && (entry.class === 'infra' || entry.class === 'recovery' || legacyMissingTscRuntime(entry)));
+}
+
+function recoveryAdmissionReady(card: TaskCard, prior: readonly LandAttempt[], pr: number, head: string, nowMs = Date.now()): boolean {
+  const last = prior.at(-1);
+  if (last?.class !== 'recovery') return true;
+  if (last.reason === 'gate-host-busy') return nowMs >= Date.parse(last.at) + 30_000
+    && (card.history ?? []).some((event) => event.event === 'rejudge-on-head' && event.kind === 'land'
+      && event.effect === 'recover-wait-retry' && event.pr === pr && event.head?.toLowerCase() === head.toLowerCase()
+      && Date.parse(event.at) >= Date.parse(last.at));
+  if (last.reason === 'review-missing') return (card.reviewRequests ?? []).some((request) => request.pr === pr
+    && request.head.toLowerCase() === head.toLowerCase() && Date.parse(request.at) >= Date.parse(last.at) && !request.error)
+    && !pendingReviewResults(card).some((request) => request.pr === pr && request.head.toLowerCase() === head.toLowerCase());
+  return false;
 }
 
 /** A previous release classified a missing node interpreter as judgement; only that exact recorded shape may be reopened. */
@@ -541,8 +612,9 @@ export function openLandAttempts<T extends Pick<LandAttempt, 'at' | 'class'>>(pr
 }
 
 /** 카드의 이 PR·머리에 인프라 재시도가 남았나(재판정 틱이 «머리 그대로»여도 land 단계까지 가게). */
-export function landRetryPending(card: Pick<TaskCard, 'landAttempts'>, pr: number, head: string): boolean {
-  return landRetryAllowed((card.landAttempts ?? []).filter(sameHeadOf(pr, head)));
+export function landRetryPending(card: TaskCard, pr: number, head: string): boolean {
+  const attempts = (card.landAttempts ?? []).filter(sameHeadOf(pr, head));
+  return landRetryAllowed(attempts) && recoveryAdmissionReady(card, attempts, pr, head);
 }
 
 export const LAND_RETRY_ON_INFRA_EVENT = 'land-retry-on-infra';
@@ -575,7 +647,21 @@ export async function executeLiveLand(
   let view: (PrHeadView & { isDraft: boolean }) | null;
   try { view = await (deps.landPrHead ?? defaultLandPrHead)(pr, cwd); } catch { view = null; }
   if (!view || !/^[0-9a-f]{40}$/i.test(view.head)) return reject(card.id, `PR #${pr} head unknown`, reviewRepo);
-  if (view.state !== 'OPEN') return reject(card.id, `PR #${pr} is ${view.state}`, reviewRepo);
+  if (view.state !== 'OPEN') {
+    // TA-CARD-MERGE-RECONCILE — 실패 카드에 묶인 PR을 사람이 손수 병합한 경우만 이 자리에서 정산한다; 정산이 아니면 종전 거절 그대로.
+    if (view.state === 'MERGED') {
+      let hand: HandMergePrView | null = null;
+      try { hand = await (deps.handMergePr ?? defaultHandMergePr)(pr, cwd); } catch { hand = null; }
+      if (hand?.mergeCommit) {
+        const settled = reconcileHandMergedCard({ number: pr, url: hand.url ?? view.url ?? '', headRefOid: view.head, state: 'MERGED',
+          baseRefName: hand.baseRefName ?? 'main', mergedAt: hand.mergedAt ?? '', mergeCommit: hand.mergeCommit },
+          cwd, deps.statePath ? { statePath: deps.statePath } : {});
+        if (settled.outcome === 'reconciled')
+          return withRepo(observe(deps, { kind, card: card.id, ok: true, executed: true, detail: `PR #${pr} 손 병합 정산 — card ${settled.status} (merge ${settled.mergeSha.slice(0, 12)})` }));
+      }
+    }
+    return reject(card.id, `PR #${pr} is ${view.state}`, reviewRepo);
+  }
   if (view.isDraft !== false) return reject(card.id, `PR #${pr} is draft or draft status unknown`, reviewRepo);
   if (ctx.produced?.prUrl && (!view.url || view.url.trim().replace(/\/+$/, '').toLowerCase() !== ctx.produced.prUrl.trim().replace(/\/+$/, '').toLowerCase())) {
     return reject(card.id, `PR #${pr} URL mismatches run evidence`, reviewRepo);
@@ -622,7 +708,7 @@ export async function executeLiveLand(
         }
       }
       prior = openLandAttempts((current.landAttempts ?? []).filter(sameHeadOf(pr, view!.head)), ctx.gateAt);
-      if (prior.length && !landRetryAllowed(prior)) return undefined;
+      if (prior.length && (!landRetryAllowed(prior) || !recoveryAdmissionReady(current, prior, pr, view!.head, (deps.now ?? (() => new Date()))().getTime()))) return undefined;
       claimed = true;
       return { ...current, landAttempts: [...(current.landAttempts ?? []), { pr, head: view!.head, at }] };
     });
@@ -721,7 +807,7 @@ export async function executeLiveLand(
     detail = (error instanceof Error ? error.message : String(error)).slice(-300);
     failure = classifyLandFailure({ thrown: detail });
   }
-  const retryAllowed = failure?.class === 'infra' && attempt < LAND_ATTEMPTS_PER_HEAD_ON_INFRA;
+  const retryAllowed = (failure?.class === 'infra' || failure?.class === 'recovery') && attempt < LAND_ATTEMPTS_PER_HEAD_ON_INFRA;
   // 인프라 실패로 재시도가 남으면 주기 표시도 푼다 — 같은 주기 id(재판정 틱의 `rejudge:<card>:<head>`)가 그 한 번을 막지 않게.
   if (retryAllowed && cycle) landedCycles.delete(cycle);
   if (worktree && queueConfig && ok) {

package/src/task-agent/parent-host.ts

@@ -16,6 +16,8 @@ import { createHash } from 'node:crypto';
 import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
 import { join, resolve } from 'node:path';
 import { debug } from '../debug/log.js';
+import { memoryQuantityBytes } from '../task-orchestrator/surfaces/pod-lease.js';
+import { parsePodPool } from '../task-orchestrator/surfaces/pod-pool.js';
 import { shellQuote } from './task-hand.js';
 
 /** `taskAgent.parentHost` 설정 칸. */
@@ -42,6 +44,11 @@ const DEFAULT_REMOTE_ELANOUS = '$HOME/.local/share/elanous/bin/elanous';
 const DEFAULT_REMOTE_CONFIG_DIR = '$HOME/.elanous';
 const HOST_RE = /^[A-Za-z0-9][A-Za-z0-9._@-]{0,127}$/;
 
+/** Missing child-provider metadata keeps the established Pod default: the HQ Codex mirror is needed. */
+export function shouldInstallRemoteCodexAccess(effectiveChildProvider: string | undefined): boolean {
+  return effectiveChildProvider === undefined || effectiveChildProvider === 'openai-codex';
+}
+
 /**
  * 켜졌나 — env 가 이긴다(`off`·`0`·빈 값이면 끔). env 가 호스트를 주면 나머지 칸(cwd 등)은 설정에서 받는다.
  * cwd 가 없으면 켜지지 않는다(어디서 띄울지 모르는 원격 발사는 하지 않는다).
@@ -74,6 +81,50 @@ export function resolveParentHosts(config: ParentHostSetting | undefined, env: N
 
 /** Capacity sample is read on the host before launch. Unknown or saturated capacity is not a positive weight. */
 export interface ParentHostCapacity { approvalHeadroom: number; load: number }
+
+export interface ParentHostPodFit {
+  state: 'fits' | 'never-fits' | 'unmeasured';
+  memoryLimit: string;
+  requiredBytes: number | null;
+  allocatableBytes: number | null;
+  reason: string;
+}
+
+/** Read node allocatable memory only. This preflight never creates a probe Pod. */
+export function readParentHostPodFit(target: ParentHostConfig, memoryLimit: string, ssh: SshRunner = defaultSshRunner): ParentHostPodFit {
+  const requiredBytes = memoryQuantityBytes(memoryLimit);
+  const unknown = (reason: string, allocatableBytes: number | null = null): ParentHostPodFit =>
+    ({ state: 'unmeasured', memoryLimit, requiredBytes, allocatableBytes, reason });
+  if (requiredBytes === null || requiredBytes <= 0) return unknown('memory-limit-unreadable');
+  // Without an explicit pool, the remote current kubectl context may be unrelated to the launched Job.
+  if (!target.podPool) return unknown('pod-pool-unset');
+  let members: ReturnType<typeof parsePodPool>;
+  try { members = parsePodPool(target.podPool); }
+  catch { return unknown('pod-pool-unreadable'); }
+  if (!members.length) return unknown('pod-pool-empty');
+  let maximum = 0;
+  let unreadable = false;
+  for (const member of members) {
+    let result: ReturnType<SshRunner>;
+    try { result = ssh(target.host, `kubectl --context ${shellQuote(member.context)} get nodes -o json`, 15_000); }
+    catch { unreadable = true; continue; }
+    if (result.status !== 0) { unreadable = true; continue; }
+    try {
+      const parsed = JSON.parse(result.stdout) as { items?: Array<{ status?: { allocatable?: { memory?: unknown } } }> };
+      if (!Array.isArray(parsed.items) || parsed.items.length === 0) { unreadable = true; continue; }
+      for (const node of parsed.items) {
+        const raw = node?.status?.allocatable?.memory;
+        const bytes = typeof raw === 'string' ? memoryQuantityBytes(raw) : null;
+        if (bytes === null || bytes <= 0) { unreadable = true; continue; }
+        maximum = Math.max(maximum, bytes);
+      }
+    } catch { unreadable = true; }
+  }
+  if (maximum >= requiredBytes) return { state: 'fits', memoryLimit, requiredBytes, allocatableBytes: maximum, reason: 'node-allocatable-fits' };
+  if (unreadable || maximum === 0) return unknown('node-allocatable-unmeasured', maximum || null);
+  return { state: 'never-fits', memoryLimit, requiredBytes, allocatableBytes: maximum, reason: 'memory-never-fits' };
+}
+
 const CAPACITY_MARKER = '__ELANOUS_PARENT_CAPACITY__';
 const APPROVAL_MARKER = '__ELANOUS_PARENT_APPROVALS__';
 const LOAD_MARKER = '__ELANOUS_PARENT_LOAD__';
@@ -170,10 +221,12 @@ export function remoteLaunchScript(target: ParentHostConfig, args: readonly stri
 }
 
 /** ssh 실행기(시험 주입). */
-export type SshRunner = (host: string, script: string, timeoutMs: number) => { status: number | null; stdout: string; stderr: string };
+export type SshRunner = (host: string, script: string, timeoutMs: number, stdin?: string) => { status: number | null; stdout: string; stderr: string };
 
-export const defaultSshRunner: SshRunner = (host, script, timeoutMs) => {
-  const result = spawnSync('ssh', ['-o', 'BatchMode=yes', '-o', 'ConnectTimeout=8', '-o', 'ControlPath=none', host, script], { encoding: 'utf8', timeout: timeoutMs, maxBuffer: 32 * 1024 * 1024 });
+export const defaultSshRunner: SshRunner = (host, script, timeoutMs, stdin) => {
+  const result = spawnSync('ssh', ['-o', 'BatchMode=yes', '-o', 'ConnectTimeout=8', '-o', 'ControlPath=none', host, script], {
+    encoding: 'utf8', timeout: timeoutMs, maxBuffer: 32 * 1024 * 1024, ...(stdin !== undefined ? { input: stdin } : {}),
+  });
   return { status: result.status, stdout: result.stdout ?? '', stderr: result.stderr ?? (result.error ? String(result.error) : '') };
 };
 
@@ -302,6 +355,43 @@ export function launchRemoteParent(target: ParentHostConfig, args: readonly stri
   throw new Error(`원격 부모 발사 결과 불확실(${target.host} · rc=${result.status}) — 중복을 피해 로컬로 다시 띄우지 않는다 · 원격에서 ELANOUS_RUN_ID=${env.ELANOUS_RUN_ID ?? '?'} 를 확인: ${(result.stderr.trim().split('\n').pop() || '').slice(0, 160)}`);
 }
 
+/** Install access-only Codex copies over SSH stdin; credentials never enter argv, shell text, or logs. */
+export function installRemoteCodexAccess(target: ParentHostConfig, mirror: { elanousAuth: string; codexAuth: string; account?: string }, ssh: SshRunner = defaultSshRunner): void {
+  let elanous: { version?: number; providers?: Record<string, Record<string, unknown>> };
+  let codex: { auth_mode?: string; tokens?: Record<string, unknown> };
+  try {
+    elanous = JSON.parse(mirror.elanousAuth) as typeof elanous;
+    codex = JSON.parse(mirror.codexAuth) as typeof codex;
+  } catch { throw new Error('invalid local Codex access mirror'); }
+  const provider = elanous.providers?.['openai-codex'];
+  const elanousTokens = provider?.tokens as Record<string, unknown> | undefined;
+  const codexTokens = codex.tokens;
+  if (!Number.isSafeInteger(elanous.version) || Number(elanous.version) < 1
+    || typeof elanousTokens?.accessToken !== 'string' || !elanousTokens.accessToken || elanousTokens.refreshToken !== '' || elanousTokens.refresh_token !== ''
+    || codex.auth_mode !== 'chatgpt'
+    || typeof codexTokens?.access_token !== 'string' || !codexTokens.access_token || codexTokens.refresh_token !== '' || codexTokens.refreshToken !== '')
+    throw new Error('Codex access mirror must contain a versioned store, auth mode, access tokens, and empty refresh tokens');
+
+  const account = mirror.account ?? 'default';
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(account)) throw new Error('invalid Codex mirror account name');
+
+  const payload = JSON.stringify({ elanousVersion: elanous.version, provider, codexAuth: codex, account, storeKey: account === 'default' ? 'openai-codex' : `openai-codex:${account}` });
+  const configDir = remotePath(target.configDir ?? DEFAULT_REMOTE_CONFIG_DIR);
+  // HQ owns token metadata; the remote keeps only the selected named Codex credential in managed account homes.
+  const code = [
+    'const fs=require("node:fs"),path=require("node:path"),os=require("node:os");',
+    'const payload=JSON.parse(fs.readFileSync(0,"utf8"));',
+    'const read=(file)=>{try{return JSON.parse(fs.readFileSync(file,"utf8"))}catch{return {}}};',
+    'const write=(file,value)=>{const temp=file+"."+process.pid+".tmp";try{fs.writeFileSync(temp,JSON.stringify(value),{mode:0o600});fs.chmodSync(temp,0o600);fs.renameSync(temp,file)}catch(error){try{fs.unlinkSync(temp)}catch{};throw error}};',
+    'const elanousFile=path.join(process.argv[1],"auth.json"),configDir=path.dirname(elanousFile);fs.mkdirSync(configDir,{recursive:true,mode:0o700});',
+    'const elanous=read(elanousFile);if(typeof elanous.version!=="number")elanous.version=payload.elanousVersion;elanous.providers={...(elanous.providers||{})};const defaultHome=path.join(os.homedir(),".codex"),managedAccounts=path.join(configDir,"codex-accounts");for(const key of Object.keys(elanous.providers)){if(key.startsWith("openai-codex:"))delete elanous.providers[key]}fs.rmSync(managedAccounts,{recursive:true,force:true});fs.rmSync(path.join(configDir,"remote-codex-mirror.json"),{force:true});',
+    'const accountHome=payload.account==="default"?defaultHome:path.join(configDir,"codex-accounts",payload.account),tokens={...(payload.provider.tokens||{}),refreshToken:"",refresh_token:""};const upsert=(key,codexHome)=>{const current=elanous.providers[key]||{};elanous.providers[key]={...current,...payload.provider,codexHome,chatGPT:{...(current.chatGPT||{}),...(payload.provider.chatGPT||{})},tokens}};upsert("openai-codex",defaultHome);if(payload.storeKey!=="openai-codex")upsert(payload.storeKey,accountHome);write(elanousFile,elanous);',
+    'const incoming=payload.codexAuth;const installCodex=(home)=>{const file=path.join(home,"auth.json");fs.mkdirSync(home,{recursive:true,mode:0o700});const current=read(file),merged={...current,...incoming};merged.auth_mode=incoming.auth_mode;if(Object.prototype.hasOwnProperty.call(incoming,"last_refresh"))merged.last_refresh=incoming.last_refresh;else delete merged.last_refresh;merged.tokens={...(incoming.tokens||{}),refresh_token:"",refreshToken:""};write(file,merged)};installCodex(defaultHome);if(accountHome!==defaultHome)installCodex(accountHome);',
+  ].join('');
+  const result = ssh(target.host, `umask 077; mkdir -p ${configDir} "$HOME/.codex" && bun -e ${shellQuote(code)} ${configDir}`, 20_000, payload);
+  if (result.status !== 0) throw new Error(`remote Codex access mirror failed (ssh rc=${result.status ?? 'unknown'})`);
+}
+
 // ── 관측: 원격 런 원장 거울 ─────────────────────────────────────────────────────────────
 
 const RUN_ID_RE = /^run-[A-Za-z0-9_-]{4,64}$/;

package/src/task-agent/postland-card.ts

@@ -1,7 +1,8 @@
+import { spawnSync } from 'node:child_process';
 import { debug } from '../debug/log.js';
 import { listChecklist, setItemIfSnapshot, type Checklist } from '../release-loop/checklist.js';
 import { judgeLandedCell, parseJudgeSignals, type GreenVerdict } from '../release-loop/landed-to-green.js';
-import { cardPrNumber, readTaskAgentState, taskAgentStatePath, updateTaskCard, type TaskCard } from './task-hand.js';
+import { HAND_MOVE_HISTORY_EVENT, LIVE_MOVE_HISTORY_EVENT, LIVE_MOVE_RESULT_EVENT, cardPrNumber, readTaskAgentState, taskAgentStatePath, updateTaskCard, type TaskCard } from './task-hand.js';
 import { isGoalOnlyPr } from './judge.js';
 
 export interface LandedTaskPr { number: number; url: string; headRefOid: string; state: string; baseRefName: string; mergedAt: string; files?: Array<{ path: string }> }
@@ -142,3 +143,81 @@ export function closeMergedTaskCard(pr: LandedTaskPr, cwd: string, deps: Postlan
   log('task-agent', 'postland-card-closed', { pr: pr.number, card: card.id, version, id: item.id, outcome: complete ? 'complete' : 'partial', verdict });
   return item.id;
 }
+
+const defaultGit = (cwd: string, args: string[]): { status: number; stdout: string; stderr: string } => {
+  const run = spawnSync('git', args, { cwd, encoding: 'utf8' });
+  return { status: run.status ?? 1, stdout: run.stdout ?? '', stderr: run.stderr ?? '' };
+};
+
+export type HandMergeReconcileOutcome =
+  | { outcome: 'reconciled'; card: string; status: 'landed-by-hand' | 'landed'; pr: number; head: string; mergeSha: string; mergedAt: string }
+  | { outcome: 'not-reconciled'; reason: 'pr-not-merged' | 'no-merge-sha' | 'no-bound-card' | 'ambiguous-card' | 'card-not-failed' | 'not-ancestor-of-main' | 'card-binding-changed-before-write' };
+
+export interface HandMergeReconcileDeps {
+  statePath?: string;
+  mainRef?: string;
+  updateCard?: typeof updateTaskCard;
+  git?: (cwd: string, args: string[]) => { status: number; stdout: string; stderr: string };
+  log?: typeof debug.log;
+}
+
+/**
+ * TA-CARD-MERGE-RECONCILE — 실패 카드에 묶인 PR을 사람이 손수 병합했을 때만 카드를 정산한다.
+ * MERGED + merge SHA가 `${mainRef}`(기본 `origin/main`) 조상일 때 status=landed-by-hand(또는 merge 커밋이
+ * land attempt head와 일치하면 landed)로 `updateTaskCard` 파일-락 트랜잭션 하나로 갱신하고,
+ * 이전 status·사유는 history `hand-move` 줄에 보존한다. OPEN·비조상·묶임 없음은 카드를 그대로 둔다.
+ */
+export function reconcileHandMergedCard(pr: LandedTaskPr & { mergeCommit?: string }, cwd: string, deps: HandMergeReconcileDeps = {}): HandMergeReconcileOutcome {
+  const log = deps.log ?? debug.log.bind(debug);
+  if (pr.state !== 'MERGED' || !pr.url) return { outcome: 'not-reconciled', reason: 'pr-not-merged' };
+  const mergeSha = pr.mergeCommit ?? '';
+  if (!/^[a-f0-9]{40}$/i.test(mergeSha)) return { outcome: 'not-reconciled', reason: 'no-merge-sha' };
+  const path = deps.statePath ?? taskAgentStatePath();
+  const tasks = readTaskAgentState<{ tasks?: Record<string, TaskCard> }>(path).tasks ?? {};
+  const cards = Object.values(tasks).filter((card) => card.taLand && cardPrNumber(card) === pr.number
+    && typeof card.pr === 'object' && card.pr.url?.replace(/\/+$/, '') === pr.url.replace(/\/+$/, ''));
+  if (cards.length !== 1) {
+    log('task-agent', 'postland-card-hand-skipped', { pr: pr.number, reason: cards.length ? 'ambiguous-card' : 'no-bound-card' });
+    return { outcome: 'not-reconciled', reason: cards.length ? 'ambiguous-card' : 'no-bound-card' };
+  }
+  const card = cards[0]!;
+  if (card.status !== 'failed') {
+    log('task-agent', 'postland-card-hand-skipped', { pr: pr.number, card: card.id, reason: 'card-not-failed', status: card.status });
+    return { outcome: 'not-reconciled', reason: 'card-not-failed' };
+  }
+  const mainRef = deps.mainRef ?? 'origin/main';
+  if ((deps.git ?? defaultGit)(cwd, ['merge-base', '--is-ancestor', mergeSha, mainRef]).status !== 0) {
+    log('task-agent', 'postland-card-hand-skipped', { pr: pr.number, card: card.id, reason: 'not-ancestor-of-main', mainRef });
+    return { outcome: 'not-reconciled', reason: 'not-ancestor-of-main' };
+  }
+  const at = new Date().toISOString();
+  let reconciled: { status: 'landed-by-hand' | 'landed' } | undefined;
+  // The card lock keeps the settlement atomic with its binding checks: a card that flipped off
+  // `failed` mid-flight is left untouched for its owning path to finish.
+  (deps.updateCard ?? updateTaskCard)(path, card.id, (current, currentTasks) => {
+    const matching = Object.values(currentTasks).filter((candidate) => candidate.taLand && cardPrNumber(candidate) === pr.number
+      && typeof candidate.pr === 'object' && candidate.pr.url?.replace(/\/+$/, '') === pr.url.replace(/\/+$/, ''));
+    if (matching.length !== 1 || matching[0]?.id !== card.id) return undefined;
+    if (!current || current.status !== 'failed' || cardPrNumber(current) !== pr.number || typeof current.pr !== 'object'
+      || current.pr.url?.replace(/\/+$/, '') !== pr.url.replace(/\/+$/, '')) return undefined;
+    const status = (current.landAttempts ?? []).some((attempt) => attempt.pr === pr.number
+      && attempt.head.toLowerCase() === mergeSha.toLowerCase()) ? 'landed' : 'landed-by-hand';
+    const priorReason = [...current.history].reverse().find((event) => event.event !== LIVE_MOVE_HISTORY_EVENT
+      && event.event !== LIVE_MOVE_RESULT_EVENT && event.event !== HAND_MOVE_HISTORY_EVENT)?.detail ?? '사유 기록 없음';
+    const detail = status === 'landed'
+      ? `PR #${pr.number} 병합 정산: merge ${mergeSha}가 land attempt head와 일치 — status landed; 이전 status: failed; 이전 사유: ${priorReason}`
+      : `PR #${pr.number} 손 병합 정산: merge ${mergeSha}가 ${mainRef} 조상 — status landed-by-hand; 이전 status: failed; 이전 사유: ${priorReason}`;
+    reconciled = { status };
+    return { ...current,
+      status,
+      prTerminal: { pr: pr.number, url: pr.url, head: mergeSha, state: 'MERGED' as const, at },
+      history: [...current.history, { at, event: HAND_MOVE_HISTORY_EVENT, pr: pr.number, head: mergeSha, detail }],
+    };
+  });
+  if (!reconciled) {
+    log('task-agent', 'postland-card-hand-pending', { pr: pr.number, card: card.id, reason: 'card-binding-changed-before-write' });
+    return { outcome: 'not-reconciled', reason: 'card-binding-changed-before-write' };
+  }
+  log('task-agent', 'postland-card-hand-reconciled', { pr: pr.number, card: card.id, status: reconciled.status, mergeSha, mainRef });
+  return { outcome: 'reconciled', card: card.id, status: reconciled.status, pr: pr.number, head: pr.headRefOid, mergeSha, mergedAt: pr.mergedAt };
+}