elanous 0.2.34 → 0.2.35

package/src/task-agent/actions.ts

@@ -64,7 +64,7 @@ export interface ActionDeps {
   releaseLanding?(day: string): void;
   /** 실패 한 번을 잠금 안에서 디스크에 더한다(다른 프로세스의 실패를 덮지 않게) · 더한 뒤의 값을 돌려준다. */
   incrementFailure?(key: string): number;
-  observe(event: 'task-agent.action', data: { taskId: string; kind: NextActionKind; result: string; reason: string }): void;
+  observe(event: 'task-agent.action' | 'task-agent.entrance-denominator', data: ActionObservation): void;
   /** 사다리 R4 — 실제로 할 재발사 수의 허용 목록(`taskAgent.liveMoves` 어휘). 없으면 종전 그대로(재발사에 목록 검사 없음) · 목록에 없는 수는 shadow. */
   liveMoves?: ReadonlySet<string>;
   /** 한 판단 회차의 발사 칸 — 호출부가 회차마다 새로 준다. 없으면 회당 상한 없음(종전). 발사를 시도할 때마다 `count` 가 오른다. */
@@ -76,6 +76,49 @@ export interface ActionDeps {
 /** 재발사는 한 판단 회차에 한 건만 발사한다. */
 export const RETRY_LAUNCHES_PER_CYCLE = 1;
 
+export interface ActionObservation {
+  taskId: string;
+  kind: NextActionKind | 'entrance-tick';
+  result: string;
+  reason: string;
+  reviewed?: number;
+  allowed?: number;
+  refused?: number;
+  reasons?: Record<string, number>;
+}
+
+export interface EntranceCandidateReview {
+  taskId: string;
+  kind: NextActionKind;
+  refusal?: string;
+}
+
+export interface EntranceTickCandidate {
+  action: NextAction;
+  refusal?: string;
+}
+
+export interface EntranceRefusalDenominator {
+  reviewed: number;
+  allowed: number;
+  refused: number;
+  reasons: Record<string, number>;
+}
+
+/** Count a tick's candidate refusals without confusing special object keys with prototypes. */
+export function buildEntranceRefusalDenominator(reviews: readonly EntranceCandidateReview[]): EntranceRefusalDenominator {
+  const reasonCounts = new Map<string, number>();
+  let refused = 0;
+  for (const review of reviews) {
+    const reason = typeof review.refusal === 'string' ? review.refusal.trim() : '';
+    if (!reason) continue;
+    refused += 1;
+    reasonCounts.set(reason, (reasonCounts.get(reason) ?? 0) + 1);
+  }
+  const reasons = Object.fromEntries(reasonCounts) as Record<string, number>;
+  return { reviewed: reviews.length, allowed: reviews.length - refused, refused, reasons };
+}
+
 /** live 인데도 shadow 로 내릴 사유 — 없으면 발사해도 된다(재발사 아닌 수는 늘 없다). 기다림(wait)은 발사가 아니라 부하·회당 상한을 보지 않는다. */
 function retryShadowReason(action: NextAction, deps: ActionDeps): string | undefined {
   if (action.kind !== 'retry') return undefined;
@@ -264,6 +307,31 @@ export async function executeNextAction(action: NextAction, deps: ActionDeps): P
   return record('done', action.rationale);
 }
 
+/** Execute the allowed candidates in a caller-supplied tick and emit one isolated denominator event. */
+export async function executeEntranceTick(candidates: readonly EntranceTickCandidate[], deps: ActionDeps): Promise<string[]> {
+  const denominator = buildEntranceRefusalDenominator(candidates.map(({ action, refusal }) => ({
+    taskId: action.taskId,
+    kind: action.kind,
+    ...(typeof refusal === 'string' ? { refusal } : {}),
+  })));
+  const observeDenominator = (result: string) => {
+    try {
+      deps.observe('task-agent.entrance-denominator', {
+        taskId: candidates[0]?.action.taskId ?? 'entrance-tick',
+        kind: 'entrance-tick', result, reason: 'entrance refusal denominator', ...denominator,
+      });
+    } catch { /* Logging must not change the actions selected for this tick. */ }
+  };
+  const results: string[] = [];
+  for (const { action, refusal } of candidates) {
+    if (typeof refusal === 'string' && refusal.trim()) continue;
+    try { results.push(await executeNextAction(action, deps)); }
+    catch (error) { observeDenominator('failed'); throw error; }
+  }
+  observeDenominator(results.at(-1) ?? 'refused-all');
+  return results;
+}
+
 /** 재발사 문면 — 원문은 고치지 않고 앞에 둔다 · 갈래 문면 · must-fix · 직전 런 순서. */
 export function retryText(action: NextAction): string {
   const sections = [action.original];

package/src/task-agent/green-sweep.ts

@@ -28,6 +28,8 @@ export interface GreenSweepDecision {
   source: GreenSweepCandidate['source'];
   verdict: GreenSweepVerdict;
   reason: string;
+  /** Present when traffic hold state could not be read; preserves the decision reason while exposing its cause. */
+  holdDiagnostic?: string;
   evidence: string;
   existingEvidence: string;
   /** Preview only; a later live operation may persist this complete value. */
@@ -107,6 +109,7 @@ export function decideGreenSweep(input: {
   pr: GreenSweepPr | null;
   ancestor: boolean | null;
   hold: boolean | null;
+  holdDiagnostic?: string;
   repositoryMatches?: boolean | null;
   ambiguousAcrossCells?: boolean;
 }): GreenSweepDecision {
@@ -116,6 +119,7 @@ export function decideGreenSweep(input: {
     const landing = pr?.viaTrain ? ` via train #${pr.viaTrain.integrationPr}` : '';
     const evidence = `GREEN-FROM-LEDGER: PR #${candidate.pr}${landing}${mergeSha ? ` merged ${mergeSha}` : ''} · ${verdict} · ${reason}`;
     return { cell: item.id, pr: candidate.pr, mergeSha, source: candidate.source, verdict, reason,
+      ...(reason === 'hold-state-unreadable' && input.holdDiagnostic ? { holdDiagnostic: input.holdDiagnostic } : {}),
       evidence, existingEvidence: item.evidence ?? '', plannedEvidence: appendGreenSweepEvidence(item.evidence, evidence) };
   };
   if (item.status !== 'yellow' && item.status !== 'red') return result('skip', 'cell-not-yellow');

package/src/task-agent/live-moves.ts

@@ -6,6 +6,10 @@
  *   TA-REVIEW-RESULT-CAPTURE — 자식 stdout(`--json`)은 결과 파일로 받고, 자식 완료 뒤 해당 카드만 회수·재판정한다.
  *   회수한 pass 는 그 틱의 판단부·land 관문 입력(`selfReview`)이 될 뿐 land 판정 로직은 그대로다.
  * - `propose-green`: 카드에 green «제안»(`greenProposal`)만 적는다 — 체크리스트는 손대지 않는다.
+ * - `propose-close`: TA-PROPOSE-CLOSE-MOVE — draft 정리(0.2.36 · 대표 10-21 · 열린 draft 301)의 닫기를 판단한다.
+ *   close-a(착지/대체)·close-b(같은 칸 새 draft)·close-c(48h+ 무커밋 ⊕ 주인 확인)의 근거 조건이
+ *   «모두 참»일 때만 그 draft 의 닫기 명령을 만든다. 보호 라벨·running·못 읽음은 근거가 참이어도 닫지 않는다(보류).
+ *   `propose` 모드는 닫기 명령 원문만 만들고, `live` 모드만 실제로 닫는다(실패는 ok:false 로 드러난다).
  * - `propose-land`: 카드·현재 머리의 self review 통과(pass «또는» warn ⊕ must-fix 0 · TA-LAND-WARN-MUSTFIX0)·non-draft 를 확인한다. 큐 설정이 있으면 원격 changed gate 뒤 착지 줄에 등록하고, 없으면 기존 `pr land` 를 머리 고정으로 한 번 부른다.
  * - 사다리 R4: `narrow-relaunch` · `wait-retry` · `salvage-relaunch` · `alternative` 도 허용 목록 어휘다 — 실제 발사는 실행부
  *   `executeNextAction`(`actions.ts`)이 «목록 ⊕ 같은 수 2회 상한 ⊕ 회당 1건 ⊕ 부하 관문»을 모두 넘을 때만 한다.
@@ -32,7 +36,7 @@ import { buildPriorFixContext, PRIOR_FIX_SCOPE_LINE, priorFixBlock, priorFixObse
 import { createLandWorktree, localBranch, localHead, observeLandWorktree, type LandWorktree, type LandWorktreeFailure, type LandWorktreeInput, type LandWorktreeRemoval } from './land-worktree.js';
 import { runQueuedLanding, type QueueLandingInput } from './land-queue.js';
 
-export const TASK_AGENT_LIVE_MOVES = ['review', 'propose-green', 'propose-land', 'decision-card', ...LIVE_RETRY_MOVES] as const;
+export const TASK_AGENT_LIVE_MOVES = ['review', 'propose-green', 'propose-land', 'propose-close', 'decision-card', ...LIVE_RETRY_MOVES] as const;
 export type TaskAgentLiveMove = typeof TASK_AGENT_LIVE_MOVES[number];
 export const TASK_AGENT_LIVE_MOVES_ENV = 'ELANOUS_TASK_AGENT_LIVE_MOVES';
 
@@ -207,9 +211,9 @@ export async function defaultPrHead(pr: number, cwd?: string, gh: GhRun = runGh)
   } catch { return null; }
 }
 
-/** 리뷰 요청 argv — 진입점 · 같은 우주(`--config-dir`) · `self review <PR> --json --intent`. */
+/** TA live reviews use the independent Claude ACP reviewer; self review owns same-head GLM fallback. */
 export function liveReviewArgs(entry: string, configDir: string, pr: number, intent: string): string[] {
-  return [resolve(entry), '--config-dir', configDir, 'self', 'review', String(pr), '--json', '--intent', intent];
+  return [resolve(entry), '--config-dir', configDir, 'self', 'review', String(pr), '--json', '--intent', intent, '--acp', '--acp-backend', 'claude'];
 }
 
 /** Use the configured node-b checkout for heavy TA workers; absence of parentHost preserves the legacy local path. */
@@ -246,7 +250,7 @@ export async function defaultRequestReview(pr: number, intent: string, cwd?: str
     [TA_REVIEW_COMPLETION_STATE_ENV]: opts.statePath,
     [TA_REVIEW_COMPLETION_RESULT_ENV]: opts.resultPath,
   } : undefined;
-  const workerCommand = remote ? remoteTaWorkerCommand(remote, ['self', 'review', String(pr), '--json', '--model', 'gpt-6-sol', '--intent', intent]) : null;
+  const workerCommand = remote ? remoteTaWorkerCommand(remote, ['self', 'review', String(pr), '--json', '--intent', intent, '--acp', '--acp-backend', 'claude']) : null;
   const command = remote ? 'ssh' : process.execPath;
   const workerArgs = remote ? ['-T', '-o', 'BatchMode=yes', '-o', 'ConnectTimeout=5', remote.host, workerCommand!] : args;
   if (!opts.resultPath) { await spawnDetachedConfirmed(base, command, workerArgs, undefined, cwd); return; }
@@ -876,6 +880,158 @@ export function executeLiveGreenProposal(card: TaskCard | undefined, evidence: R
   return observe(deps, { kind, executed: true, card: card.id, ok: true, detail: `green proposed (${Object.values(refs).join(', ')}) · checklist untouched` });
 }
 
+/**
+ * TA-PROPOSE-CLOSE-MOVE — draft 정리(0.2.36 · 대표 10-21)의 닫기 근거와 보류 조건.
+ * - close-a: draft 내용이 다른 곳에 착지되거나 대체됐다.
+ * - close-b: 같은 칸에 새 draft 가 열렸다(이 draft 는 대체됐다).
+ * - close-c: 48h+ 커밋 없음 ⊕ 칸 주인 확인 — 두 조건이 «모두» 참이어야 한다.
+ * - 보류: 보호 라벨·running·못 읽음(gh pr view 실패)·draft 아님·근거 없음 — 근거가 참이어도 닫지 않는다.
+ */
+export const CLOSE_IDLE_HOURS = 48;
+export const CLOSE_PROTECTED_LABELS = ['protected', 'do-not-close', 'keep-open'] as const;
+
+/** 가짜·실제 gh 우주가 돌려주는 draft 한 건의 닫기 판단 재료. */
+export interface DraftCloseView {
+  pr: number;
+  /** gh 로 draft 를 읽었는가 — 못 읽으면 닫지 않는다(fail-closed). */
+  readable: boolean;
+  isDraft: boolean;
+  labels?: readonly string[];
+  /** 진행 중 런에 붙은 draft — 닫지 않는다. */
+  running?: boolean;
+  /** close-a — 착지/대체. */
+  landedElsewhere?: boolean;
+  /** close-b — 같은 칸에 새 draft. */
+  newerDraftInSameCell?: boolean;
+  /** close-c — 마지막 커밋 이후 경과 시간(시). */
+  idleHours?: number;
+  /** close-c — 칸 주인 확인. */
+  ownerConfirmed?: boolean;
+}
+
+export interface DraftCloseGrounds { closeA: boolean; closeB: boolean; closeC: boolean; idle48h: boolean; ownerConfirmed: boolean }
+
+export type DraftCloseHeldBy = 'unreadable' | 'not-a-draft' | 'protected-label' | 'running' | 'no-grounds';
+
+export interface DraftCloseDecision {
+  pr: number;
+  /** 닫기 명령을 만들어도 되는가 — 근거가 참이고 보류 조건이 하나도 없을 때만. */
+  close: boolean;
+  /** 조건별 참/거짓 — 코멘트·관측의 재료. */
+  grounds: DraftCloseGrounds;
+  /** 근거 코멘트 — 조건별 참/거짓을 그대로 적는다. */
+  comment: string;
+  /** 닫기 명령 원문(보류면 null). */
+  command: string | null;
+  heldBy?: DraftCloseHeldBy;
+}
+
+/** 근거 코멘트 — 조건별 참/거짓을 전부 적는다(못 읽은 draft 도 같은 문면). */
+export function draftCloseGroundsComment(grounds: DraftCloseGrounds): string {
+  return `close-a(착지/대체)=${grounds.closeA} · close-b(같은 칸 새 draft)=${grounds.closeB}`
+    + ` · close-c(48h+ 무커밋=${grounds.idle48h}, 주인 확인=${grounds.ownerConfirmed})`;
+}
+
+/** draft 한 건의 닫기 판단 — 근거 조건이 모두 참이어야 그 근거가 성립하고, 보류 조건이 하나라도 있으면 닫지 않는다. */
+export function evaluateDraftClose(draft: DraftCloseView): DraftCloseDecision {
+  const grounds: DraftCloseGrounds = {
+    closeA: draft.landedElsewhere === true,
+    closeB: draft.newerDraftInSameCell === true,
+    closeC: false,
+    idle48h: typeof draft.idleHours === 'number' && Number.isFinite(draft.idleHours) && draft.idleHours >= CLOSE_IDLE_HOURS,
+    ownerConfirmed: draft.ownerConfirmed === true,
+  };
+  grounds.closeC = grounds.idle48h && grounds.ownerConfirmed;
+  const protectedLabel = (draft.labels ?? []).some((label) => (CLOSE_PROTECTED_LABELS as readonly string[]).includes(label));
+  const heldBy: DraftCloseHeldBy | undefined = !draft.readable ? 'unreadable'
+    : protectedLabel ? 'protected-label'
+    : draft.running === true ? 'running'
+    : draft.isDraft !== true ? 'not-a-draft'
+    : !(grounds.closeA || grounds.closeB || grounds.closeC) ? 'no-grounds'
+    : undefined;
+  const close = heldBy === undefined;
+  const comment = close
+    ? `draft 정리 — ${draftCloseGroundsComment(grounds)}`
+    : `draft 정리 보류(${heldBy}) — ${draftCloseGroundsComment(grounds)}`;
+  const command = close ? `gh pr close ${draft.pr} --comment ${shellQuote(comment)}` : null;
+  return { pr: draft.pr, close, grounds, comment, command, ...(close ? {} : { heldBy }) };
+}
+
+/** `gh pr close <pr> --comment <comment>` 인자 — 그대로 gh 로 간다. */
+export function liveCloseArgs(pr: number, comment: string): string[] {
+  return ['pr', 'close', String(pr), '--comment', comment];
+}
+
+/** 실물 닫기 — 같은 우주의 `gh pr close` 한 번(시험은 `closeDraft` 를 주입한다). */
+export async function defaultCloseDraft(pr: number, comment: string): Promise<void> {
+  const out = runGh(liveCloseArgs(pr, comment), { env: process.env });
+  if (out.status !== 0) throw new Error(`gh pr close ${pr} 실패: ${out.stdout.slice(-200)}`);
+}
+
+export interface LiveCloseDeps extends LiveMoveDeps {
+  /** `propose`(기본)는 명령 원문만 만들고, `live` 만 실제로 닫는다. */
+  mode?: 'propose' | 'live';
+  closeDraft?: (pr: number, comment: string) => Promise<void> | void;
+}
+
+export interface LiveCloseResult extends LiveMoveResult { proposals: DraftCloseDecision[] }
+
+function observeClose(deps: LiveMoveDeps, result: LiveCloseResult): LiveCloseResult {
+  try { (deps.log ?? ((c, e, d) => debug.log(c, e, d)))('task-agent', 'live-move', { ...result, live: true }); } catch { /* fail-soft */ }
+  return result;
+}
+
+/**
+ * `propose-close` — 카드에 묶인 draft 들의 닫기를 판단한다.
+ * propose 모드는 닫기 명령 원문(근거 코멘트 포함)만 만들고, live 모드만 `gh pr close`(또는 주입한 `closeDraft`)를 부른다.
+ * 보류(보호 라벨·running·못 읽음)는 어느 모드에서도 닫지 않는다.
+ */
+export async function executeLiveCloseProposal(
+  card: TaskCard | undefined,
+  drafts: readonly DraftCloseView[],
+  deps: LiveCloseDeps = {},
+): Promise<LiveCloseResult> {
+  const kind = 'propose-close' as const;
+  const proposals = drafts.map(evaluateDraftClose);
+  if (!card) return observeClose(deps, { kind, executed: false, card: null, ok: false, detail: 'no task card — stays shadow', proposals });
+  const detail = proposals.map((proposal) => proposal.close ? `#${proposal.pr} close — ${proposal.command}` : `#${proposal.pr} hold — ${proposal.heldBy}`).join(' · ') || 'no drafts';
+  if (deps.mode !== 'live') return observeClose(deps, { kind, executed: false, card: card.id, ok: true, detail, proposals });
+  const path = deps.statePath ?? taskAgentStatePath();
+  const at = (deps.now ?? (() => new Date()))().toISOString();
+  const closable = proposals.filter((proposal) => proposal.close);
+  const failures: string[] = [];
+  for (const proposal of closable) {
+    try {
+      await (deps.closeDraft ?? defaultCloseDraft)(proposal.pr, proposal.comment);
+    } catch (error) {
+      const reason = error instanceof Error ? error.message : String(error);
+      failures.push(`#${proposal.pr}: ${reason.slice(-200)}`);
+      try { (deps.log ?? ((c, e, d) => debug.log(c, e, d)))('task-agent', 'live-close-failed', { card: card.id, pr: proposal.pr, reason }); } catch { /* fail-soft */ }
+    }
+  }
+  const executed = closable.length > 0;
+  const ok = failures.length === 0;
+  try {
+    updateTaskCard(path, card.id, (current) => current ? {
+      ...current,
+      history: [...(current.history ?? []), ...closable.map((proposal) => ({
+        at,
+        event: LIVE_MOVE_HISTORY_EVENT,
+        kind,
+        executed,
+        executorResult: 'live' as const,
+        pr: proposal.pr,
+        ok: !failures.some((failure) => failure.startsWith(`#${proposal.pr}:`)),
+        detail: `close #${proposal.pr} — ${proposal.comment}`,
+        effect: `draft #${proposal.pr} close 명령 실행 · 근거 ${draftCloseGroundsComment(proposal.grounds)}`,
+      }))],
+    } : undefined);
+  } catch (error) {
+    return observeClose(deps, { kind, executed, card: card.id, ok: false, detail: `${detail} · card update failed: ${String(error).slice(-200)}`, proposals });
+  }
+  return observeClose(deps, { kind, executed, card: card.id, ok, detail: ok ? detail : `close 실패 — ${failures.join(' · ')}`, proposals });
+}
+
 export interface LiveDecisionCardContext {
   runId: string | null; stopReason: string; reason: string; pr?: number;
   risk?: NextAction['risk'];

package/src/task-agent/parent-host.ts

@@ -16,6 +16,7 @@ import { createHash } from 'node:crypto';
 import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
 import { join, resolve } from 'node:path';
 import { debug } from '../debug/log.js';
+import { resolveFreshGrokCredential } from '../grok/credential.js';
 import { memoryQuantityBytes } from '../task-orchestrator/surfaces/pod-lease.js';
 import { parsePodPool } from '../task-orchestrator/surfaces/pod-pool.js';
 import { shellQuote } from './task-hand.js';
@@ -210,7 +211,9 @@ export function remoteLaunchScript(target: ParentHostConfig, args: readonly stri
   const elanous = target.elanous ?? DEFAULT_REMOTE_ELANOUS;
   const configDir = target.configDir ?? DEFAULT_REMOTE_CONFIG_DIR;
   const log = remoteParentLogPath(target, env.ELANOUS_RUN_ID ?? 'unknown');
-  const envPart = [...Object.entries(env).filter(([key]) => key !== 'ELANOUS_STATE_DIR' && /^[A-Z_][A-Z0-9_]*$/.test(key)).map(([key, value]) => `${key}=${shellQuote(value)}`), `ELANOUS_STATE_DIR=${remotePath(configDir)}`].join(' ');
+  // --config-dir keeps the parent's operational config/state; authStorePath()
+  // reads XDG_CONFIG_HOME/elanous/auth.json first, as the entrypoint test proves.
+  const envPart = [...Object.entries(env).filter(([key]) => key !== 'ELANOUS_STATE_DIR' && /^[A-Z_][A-Z0-9_]*$/.test(key)).map(([key, value]) => `${key}=${key === 'XDG_CONFIG_HOME' || key === 'CODEX_HOME' || key === 'GH_CONFIG_DIR' ? remotePath(value) : shellQuote(value)}`), `ELANOUS_STATE_DIR=${remotePath(configDir)}`].join(' ');
   const argv = [remotePath(elanous), '--config-dir', remotePath(configDir), ...remoteParentArgs(args, target.podPool).map(shellQuote)].join(' ');
   // 준비가 실패하면 «확실히 안 띄웠다»(not-launched=…)를 찍고 끝낸다 — 그때만 호출부가 로컬로 돌아간다.
   // 띄운 뒤에는 짧게 살아 있는지 보고 pid 를 찍는다(조기 종료면 early-exit — 역시 «안 돈다»가 확실).
@@ -342,8 +345,27 @@ export class RemoteParentNotLaunchedError extends Error {
  * 그 밖(ssh 끊김·시간 초과·알 수 없는 답)은 «떴는지 모른다» — 일반 Error 로 던져 카드가 launch-failed 로 남게 한다
  * (⛔ 로컬로 또 띄우면 원격에 이미 뜬 부모와 중복이 될 수 있다).
  */
-export function launchRemoteParent(target: ParentHostConfig, args: readonly string[], env: Record<string, string>, ssh: SshRunner = defaultSshRunner): { pid: number; log: string } {
-  const result = ssh(target.host, remoteLaunchScript(target, args, env), 30_000);
+export function launchRemoteParent(
+  target: ParentHostConfig,
+  args: readonly string[],
+  env: Record<string, string>,
+  ssh: SshRunner = defaultSshRunner,
+  grokMirrorResolver: () => OwnerGrokAccessMirror = resolveOwnerGrokAccessMirror,
+  effectiveChildProvider?: string,
+  now: () => number = Date.now,
+): { pid: number; log: string } {
+  const argvProvider = childProviderFromArgs(args);
+  if (effectiveChildProvider && argvProvider && argvProvider !== effectiveChildProvider) {
+    throw new Error(`effective child provider mismatch (context=${effectiveChildProvider}, argv=${argvProvider})`);
+  }
+  const launchArgs = effectiveChildProvider && !argvProvider
+    ? [...args.slice(0, 2), '--child-llm-provider', effectiveChildProvider, ...args.slice(2)]
+    : args;
+  if ((effectiveChildProvider ?? argvProvider) === 'grok') {
+    const mirror = grokMirrorResolver();
+    installRemoteGrokAccess(target, mirror, ssh, now);
+  }
+  const result = ssh(target.host, remoteLaunchScript(target, launchArgs, env), 30_000);
   const log = remoteParentLogPath(target, env.ELANOUS_RUN_ID ?? 'unknown');
   const pid = Number(/^pid=(\d+)$/m.exec(result.stdout)?.[1]);
   if (result.status === 0 && Number.isSafeInteger(pid) && pid > 0) return { pid, log };
@@ -355,6 +377,65 @@ export function launchRemoteParent(target: ParentHostConfig, args: readonly stri
   throw new Error(`원격 부모 발사 결과 불확실(${target.host} · rc=${result.status}) — 중복을 피해 로컬로 다시 띄우지 않는다 · 원격에서 ELANOUS_RUN_ID=${env.ELANOUS_RUN_ID ?? '?'} 를 확인: ${(result.stderr.trim().split('\n').pop() || '').slice(0, 160)}`);
 }
 
+/** The provider selection travels as an argv pair or assignment; absent remains the existing Codex default. */
+function childProviderFromArgs(args: readonly string[]): string | undefined {
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i]!;
+    if (arg === '--child-llm-provider') return args[i + 1];
+    if (arg.startsWith('--child-llm-provider=')) return arg.slice('--child-llm-provider='.length);
+  }
+  return undefined;
+}
+
+export interface OwnerGrokAccessMirror { key: string; expiresAt: string }
+
+/** Resolve/refresh on HQ and return only a still-usable subscription access token. */
+export function resolveOwnerGrokAccessMirror(opts: {
+  home?: string;
+  env?: NodeJS.ProcessEnv;
+  now?: () => number;
+  execImpl?: (cmd: string, args: string[], timeoutMs: number) => void;
+} = {}): OwnerGrokAccessMirror {
+  const credential = resolveFreshGrokCredential({
+    ...(opts.home ? { home: opts.home } : {}),
+    ...(opts.env ? { env: opts.env } : {}),
+    ...(opts.now ? { now: opts.now } : {}),
+    ...(opts.execImpl ? { execImpl: opts.execImpl } : {}),
+  });
+  if (!credential || credential.kind !== 'subscription') throw new Error('Grok subscription mirror unavailable: no-usable-subscription');
+  // Expiry travels with the selected credential so a second auth-file read cannot pair another scope's
+  // expiry with this access token if the file changes between reads.
+  if (!credential.expiresAt) throw new Error('Grok subscription mirror unavailable: access-state-incomplete');
+  const expiresAt = Date.parse(credential.expiresAt);
+  // Keep the same two-minute safety margin that triggers HQ refresh before remote installation.
+  if (!Number.isFinite(expiresAt) || expiresAt <= (opts.now ?? Date.now)() + 120_000) {
+    throw new Error('Grok subscription mirror unavailable: expired-or-refresh-did-not-produce-fresh-access');
+  }
+  return { key: credential.token, expiresAt: credential.expiresAt };
+}
+
+/** Install one HQ-selected Grok access token over SSH stdin; never copy refresh or other scopes. */
+export function installRemoteGrokAccess(
+  target: ParentHostConfig,
+  mirror: OwnerGrokAccessMirror,
+  ssh: SshRunner = defaultSshRunner,
+  now: () => number = Date.now,
+): void {
+  if (!mirror || typeof mirror.key !== 'string' || !mirror.key || typeof mirror.expiresAt !== 'string'
+    || !Number.isFinite(Date.parse(mirror.expiresAt)) || Date.parse(mirror.expiresAt) <= now() + 120_000) {
+    throw new Error('invalid Grok access mirror');
+  }
+  const payload = JSON.stringify({ key: mirror.key, expires_at: mirror.expiresAt });
+  const code = [
+    'const fs=require("node:fs"),path=require("node:path"),os=require("node:os");',
+    'const p=JSON.parse(fs.readFileSync(0,"utf8"));if(!p||typeof p.key!=="string"||!p.key||typeof p.expires_at!=="string"||!Number.isFinite(Date.parse(p.expires_at))||Date.parse(p.expires_at)<=Date.now()+120000||Object.keys(p).some(k=>!new Set(["key","expires_at"]).has(k)))process.exit(2);',
+    'const dir=path.join(os.homedir(),".grok"),file=path.join(dir,"auth.json"),temp=file+"."+process.pid+".tmp";fs.mkdirSync(dir,{recursive:true,mode:0o700});fs.chmodSync(dir,0o700);',
+    'try{let auth={};try{const prior=JSON.parse(fs.readFileSync(file,"utf8"));if(!prior||typeof prior!=="object"||Array.isArray(prior))process.exit(3);auth=prior}catch(e){if(e.code!=="ENOENT")throw e}auth["https://auth.x.ai::hq-mirror"]={key:p.key,expires_at:p.expires_at};fs.writeFileSync(temp,JSON.stringify(auth),{mode:0o600});fs.chmodSync(temp,0o600);fs.renameSync(temp,file)}catch(e){try{fs.unlinkSync(temp)}catch{};throw e}',
+  ].join('');
+  const result = ssh(target.host, `umask 077; bun -e ${shellQuote(code)}`, 20_000, payload);
+  if (result.status !== 0) throw new Error(`remote Grok access mirror failed (ssh rc=${result.status ?? 'unknown'})`);
+}
+
 /** Install access-only Codex copies over SSH stdin; credentials never enter argv, shell text, or logs. */
 export function installRemoteCodexAccess(target: ParentHostConfig, mirror: { elanousAuth: string; codexAuth: string; account?: string }, ssh: SshRunner = defaultSshRunner): void {
   let elanous: { version?: number; providers?: Record<string, Record<string, unknown>> };
@@ -392,6 +473,45 @@ export function installRemoteCodexAccess(target: ParentHostConfig, mirror: { ela
   if (result.status !== 0) throw new Error(`remote Codex access mirror failed (ssh rc=${result.status ?? 'unknown'})`);
 }
 
+/** Replace the remote Codex account set with one HQ-owned, refresh-free snapshot. */
+export function installRemoteCodexAccessBatch(target: ParentHostConfig, mirrors: readonly { elanousAuth: string; codexAuth: string; account: string }[], ssh: SshRunner = defaultSshRunner): void {
+  if (!mirrors.length) throw new Error('Codex access mirror batch is empty');
+  const seen = new Set<string>();
+  const accounts = mirrors.map((mirror) => {
+    if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(mirror.account) || seen.has(mirror.account)) throw new Error('invalid or duplicate Codex mirror account name');
+    seen.add(mirror.account);
+    let elanous: { version?: number; providers?: Record<string, Record<string, unknown>> };
+    let codex: { auth_mode?: string; tokens?: Record<string, unknown> };
+    try { elanous = JSON.parse(mirror.elanousAuth); codex = JSON.parse(mirror.codexAuth); }
+    catch { throw new Error('invalid local Codex access mirror'); }
+    const provider = elanous.providers?.['openai-codex'];
+    const token = provider?.tokens as Record<string, unknown> | undefined;
+    if (!Number.isSafeInteger(elanous.version) || Number(elanous.version) < 1
+      || typeof token?.accessToken !== 'string' || !token.accessToken || token.refreshToken !== '' || token.refresh_token !== ''
+      || codex.auth_mode !== 'chatgpt' || typeof codex.tokens?.access_token !== 'string' || !codex.tokens.access_token
+      || codex.tokens.refresh_token !== '' || codex.tokens.refreshToken !== '')
+      throw new Error('Codex access mirror batch requires access tokens and empty refresh tokens');
+    return { account: mirror.account, provider, codexAuth: codex, version: elanous.version };
+  });
+  const configDir = remotePath(target.configDir ?? DEFAULT_REMOTE_CONFIG_DIR);
+  const code = [
+    'const fs=require("node:fs"),path=require("node:path"),os=require("node:os");',
+    'const items=JSON.parse(fs.readFileSync(0,"utf8"));const dir=process.argv[1],file=path.join(dir,"auth.json"),defaultHome=path.join(dir,"codex-default"),managed=path.join(dir,"codex-accounts");',
+    'const read=(p)=>{try{return JSON.parse(fs.readFileSync(p,"utf8"))}catch{return {}}};',
+    'const write=(p,v)=>{fs.mkdirSync(path.dirname(p),{recursive:true,mode:0o700});const tmp=p+"."+process.pid+".tmp";try{fs.writeFileSync(tmp,JSON.stringify(v),{mode:0o600});fs.chmodSync(tmp,0o600);fs.renameSync(tmp,p)}catch(e){try{fs.unlinkSync(tmp)}catch{};throw e}};',
+    // A remote parent can launch concurrently with another parent. Serialize the
+    // entire auth-store + named-home transition, including stale-home pruning.
+    'const lock=path.join(dir,"remote-codex-mirror.lock"),deadline=Date.now()+15000,sleep=new Int32Array(new SharedArrayBuffer(4));fs.mkdirSync(dir,{recursive:true,mode:0o700});while(true){try{fs.writeFileSync(lock,String(process.pid),{flag:"wx",mode:0o600});break}catch(e){if(e.code!=="EEXIST")throw e;try{if(Date.now()-fs.statSync(lock).mtimeMs>60000)fs.rmSync(lock,{force:true})}catch{}if(Date.now()>=deadline)throw new Error("remote Codex mirror lock timeout");Atomics.wait(sleep,0,0,25)}}try{',
+    'const store=read(file);store.version=typeof store.version==="number"?store.version:items[0].version;store.providers={...(store.providers||{})};for(const key of Object.keys(store.providers)){if(key==="openai-codex"||key.startsWith("openai-codex:"))delete store.providers[key]}',
+    'for(const item of items){const home=item.account==="default"?defaultHome:path.join(managed,item.account),key=item.account==="default"?"openai-codex":"openai-codex:"+item.account;const current=read(path.join(home,"auth.json")),auth={...current,...item.codexAuth,auth_mode:"chatgpt",tokens:{...(item.codexAuth.tokens||{}),refresh_token:"",refreshToken:""}};write(path.join(home,"auth.json"),auth);store.providers[key]={...item.provider,codexHome:home,tokens:{...(item.provider.tokens||{}),refreshToken:"",refresh_token:""}}}',
+    'if(!store.providers["openai-codex"]){const first=items[0],home=path.join(managed,first.account);write(path.join(defaultHome,"auth.json"),{...first.codexAuth,auth_mode:"chatgpt",tokens:{...(first.codexAuth.tokens||{}),refresh_token:"",refreshToken:""}});store.providers["openai-codex"]={...store.providers["openai-codex:"+first.account],codexHome:defaultHome}}',
+    'write(file,store);const keep=new Set(items.filter(x=>x.account!=="default").map(x=>x.account));try{for(const name of fs.readdirSync(managed)){if(!keep.has(name))fs.rmSync(path.join(managed,name),{recursive:true,force:true})}}catch(e){if(e.code!=="ENOENT")throw e}fs.rmSync(path.join(dir,"remote-codex-mirror.json"),{force:true});',
+    '}finally{fs.rmSync(lock,{force:true})}',
+  ].join('');
+  const result = ssh(target.host, `umask 077; mkdir -p ${configDir} "$HOME/.codex" && bun -e ${shellQuote(code)} ${configDir}`, 20_000, JSON.stringify(accounts));
+  if (result.status !== 0) throw new Error(`remote Codex access mirror batch failed (ssh rc=${result.status ?? 'unknown'})`);
+}
+
 // ── 관측: 원격 런 원장 거울 ─────────────────────────────────────────────────────────────
 
 const RUN_ID_RE = /^run-[A-Za-z0-9_-]{4,64}$/;

package/src/task-agent/shadow.ts

@@ -337,7 +337,13 @@ export async function recordTaskAgentShadowMove(input: TaskAgentShadowInput, dep
     executorResult = await executeNextAction(action, {
       mode: delivery ? (deps.mode ?? 'shadow') : liveRetry ? 'live' : 'shadow',
       command: deps.command ?? (async () => { throw new Error('task-agent shadow path must not run commands'); }),
-      observe: (_event, data) => { wouldDo = data.reason; },
+      observe: (event, data) => {
+        wouldDo = data.reason;
+        // Keep new denominator rows out of the legacy task-agent/action aggregate.
+        if (event !== 'task-agent.entrance-denominator') return;
+        try { (deps.log ?? ((category, name, row) => debug.log(category, name, row)))('task-agent', 'entrance-denominator', { ...data }); }
+        catch { /* Observation must not alter the selected move. */ }
+      },
       ...(liveRetry ? { liveMoves, retryLaunches, loadGate: deps.loadGate } : {}),
     });
     if (liveRetry && executorResult === 'done' && route) {