elanous 0.2.34 → 0.2.36

package/src/agent-substrate/self-review-cli.ts

@@ -14,26 +14,38 @@
 //
 // index.ts 의 액션은 옵션 파싱과 실제 의존 배선만 남는다(얇은 껍데기).
 
-import { mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
 import { homedir, tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { effectiveInstanceRoot } from '../instance/resolve.js';
 import { tierModel } from '../llm/model-defaults.js';
 import { buildReviewObservation, safeLogText } from './review-observation.js';
-import { DEFAULT_REVIEW_BACKEND } from './acp-reviewer.js';
+import { DEFAULT_REVIEW_BACKEND, defaultAcpReviewTimeoutSec } from './acp-reviewer.js';
+import { ZAI_OPENROUTER_FALLBACK_MODEL } from '../llm/zai-coding-plan.js';
+import { debug } from '../debug/log.js';
 import { ACP_BACKENDS, canonicalizeBackendId } from '../acp/backend-registry.js';
 import { buildManualReviewIntent, intentFromPr, prIntentSectionCoverage, reviewIntentTruncationFromPr, reviewIntentTruncationObservation } from './review-intent.js';
 import { budgetReviewerContext, reviewDiffBudgetObservation, splitDiffByFile, type ReviewImage, type ReviewInput, type ReviewerContextItem, type ReviewResult } from './pr-reviewer.js';
 import type { ReferencedFileReader } from '../self-implement/goal-file-reader.js';
-import { getUserConfig, type SubscriptionReviewerSpec } from '../user-config.js';
+import { getUserConfig, type LLMProviderName, type RoleLlmSpec, type SubscriptionReviewerSpec } from '../user-config.js';
 import { listRunLedgers, lookupPrGoalAcceptance, lookupRunLedger, type PrGoalAcceptanceLookup, type RunLedgerEntry, type RunLedgerLookup } from '../self-implement/run-ledger.js';
 
 /** SUBSCRIPTION-EXHAUST-REROUTE — API reviewer when the configured `roleLlm.reviewer` lane is unavailable (off codex). */
 export const ROLE_REVIEWER_FALLBACK_MODEL = 'openrouter/z-ai/glm-5.3';
 
+/** Only an explicit provider+model role setting selects the API review model. */
+export function apiReviewModelFromRoleSpec(spec: RoleLlmSpec | undefined): string | undefined {
+  const model = spec?.model?.trim();
+  if (!spec?.provider || !model) return undefined;
+  return spec.provider === 'openrouter' && !model.startsWith('openrouter/') ? `openrouter/${model}` : model;
+}
+
 export interface SelfReviewCliOpts {
   intent?: string | undefined;
   model?: string | undefined;
+  /** Explicit `roleLlm.review` provider+model, normalized by the CLI entry. */
+  configuredReviewModel?: string | undefined;
+  configuredReviewProvider?: LLMProviderName | undefined;
   acp?: boolean | undefined;
   acpModel?: string | undefined;
   acpBackend?: string | undefined;
@@ -73,7 +85,7 @@ export interface SelfReviewCliDeps {
    * 라우터 폴백(grok 등)으로 조용히 넘어가지 않고 실패를 오류로 낸다.
    * `o.onResolved` — streamLLM 이 «실제로 응답한» provider·model 을 알린다.
    */
-  makeApiLlm(model: string, o?: { pinProvider?: boolean; onResolved?: (provider: string, model: string) => void }): (prompt: string) => Promise<string>;
+  makeApiLlm(model: string, o?: { pinProvider?: boolean; providerName?: LLMProviderName; onResolved?: (provider: string, model: string) => void }): (prompt: string) => Promise<string>;
   /** `--acp` 경로 리뷰어 LLM(독립 프로세스). */
   /**
    * ⭐ `P4b` — 두 번째 인자가 **멀티미디어 통로**다.
@@ -127,27 +139,36 @@ export interface SelfReviewCliOutcome {
 }
 
 /** Saved results are round evidence only when their PR, exact head and reviewed status agree. */
-export function savedReviewHeads(pr: string, root = effectiveInstanceRoot()): string[] {
+function savedReviewRecords(pr: string, root = effectiveInstanceRoot()): Array<{ head: string; reviewedAt: number }> {
   const dir = join(root, 'review-results');
   let names: string[];
   try { names = readdirSync(dir); } catch { return []; }
   // Manual review saves in the operating house also use head10; the JSON's full head is authoritative.
   const matching = new RegExp(`^.+-${pr}-([a-f0-9]{7,40})\\.json$`, 'i');
-  const heads = new Set<string>();
+  const records = new Map<string, { head: string; reviewedAt: number }>();
   for (const name of names) {
     const match = matching.exec(name);
     if (!match) continue;
     try {
-      const raw: unknown = JSON.parse(readFileSync(join(dir, name), 'utf8'));
+      const recordPath = join(dir, name);
+      const raw: unknown = JSON.parse(readFileSync(recordPath, 'utf8'));
       if (!raw || typeof raw !== 'object' || Array.isArray(raw)) continue;
       const result = raw as Record<string, unknown>;
       const head = result.headCommit;
       if (String(result.pr) !== pr || result.reviewed !== true || typeof head !== 'string'
         || !COMMIT_OID.test(head) || !head.toLowerCase().startsWith(match[1]!.toLowerCase())) continue;
-      heads.add(head.toLowerCase());
+      const normalized = head.toLowerCase();
+      const existing = records.get(normalized);
+      const reviewedAt = typeof result.reviewedAt === 'number' && Number.isFinite(result.reviewedAt)
+        ? result.reviewedAt : statSync(recordPath).mtimeMs;
+      if (!existing || reviewedAt > existing.reviewedAt) records.set(normalized, { head: normalized, reviewedAt });
     } catch { /* corrupt or partial result is not a completed round */ }
   }
-  return [...heads];
+  return [...records.values()];
+}
+
+export function savedReviewHeads(pr: string, root = effectiveInstanceRoot()): string[] {
+  return savedReviewRecords(pr, root).map(({ head }) => head);
 }
 
 function normalizeReviewPrArg(input: string, deps: SelfReviewCliDeps): string | null {
@@ -166,14 +187,42 @@ function normalizeReviewPrArg(input: string, deps: SelfReviewCliDeps): string |
   } catch { return null; }
 }
 
+function readCapOverride(pr: string): { head: string; reason: string } | undefined {
+  try {
+    const value = JSON.parse(readFileSync(join(effectiveInstanceRoot(), 'review-results', `cap-override-${pr}.json`), 'utf8')) as Record<string, unknown>;
+    if (String(value.pr) !== pr || typeof value.head !== 'string' || !COMMIT_OID.test(value.head)
+      || typeof value.reason !== 'string' || !value.reason.trim()) return undefined;
+    return { head: value.head.toLowerCase(), reason: value.reason };
+  } catch { return undefined; }
+}
+
 function claimCapOverride(pr: string, head: string, reason: string, now: number): boolean {
   const dir = join(effectiveInstanceRoot(), 'review-results');
   try {
     mkdirSync(dir, { recursive: true });
-    // wx is atomic across concurrent CLI processes; a PR receives one recorded exception.
-    writeFileSync(join(dir, `cap-override-${pr}.json`), JSON.stringify({ pr, head, reason, claimedAt: now }) + '\n', { flag: 'wx' });
+    const normalizedHead = head.toLowerCase();
+    const authorizationPath = join(dir, `cap-override-${pr}.json`);
+    // The first over-cap review creates the durable, PR-scoped authorization record atomically.
+    writeFileSync(authorizationPath, JSON.stringify({ pr, head: normalizedHead, reason, claimedAt: now, use: 'initial-authorization' }) + '\n', { flag: 'wx' });
     return true;
-  } catch { return false; }
+  } catch {
+    // An OP authorization applies to later heads of this PR while the allowlist remains active.
+    // Keep the initial claim immutable, and atomically record each additional head separately so
+    // retries of the same head cannot spend the grant twice.
+    try {
+      const authorization = JSON.parse(readFileSync(join(dir, `cap-override-${pr}.json`), 'utf8')) as Record<string, unknown>;
+      const authorizedHead = authorization.head;
+      if (String(authorization.pr) !== pr || typeof authorization.reason !== 'string' || !authorization.reason.trim()
+        || authorization.reason !== reason
+        || typeof authorizedHead !== 'string' || !COMMIT_OID.test(authorizedHead)
+        || authorizedHead.toLowerCase() === head.toLowerCase()) return false;
+      const normalizedHead = head.toLowerCase();
+      writeFileSync(join(dir, `cap-override-${pr}-head-${normalizedHead}.json`), JSON.stringify({
+        pr, head: normalizedHead, reason, claimedAt: now, use: 'subsequent-head', authorizationHead: authorizedHead.toLowerCase(),
+      }) + '\n', { flag: 'wx' });
+      return true;
+    } catch { return false; }
+  }
 }
 
 /** OP owns this list. Missing, unreadable, or malformed traffic never grants a review exception. */
@@ -1331,6 +1380,34 @@ export function selfReviewJsonLine(results: readonly unknown[]): string {
   return JSON.stringify(results.length === 1 ? results[0] : results) + '\n';
 }
 
+// Normalize only whole-item forms whose complete text is an explicit no-finding
+// sentinel. Any extra clause stays in mustFix (fail-closed).
+const NO_FINDING_REVIEW_NOTE_ALLOWLIST: readonly RegExp[] = [
+  /^(?:없음|해당\s*없음|none|nothing|n\/a)[.!。]?$/i,
+  /^\((?:없음|해당\s*없음|none|nothing|n\/a)\)[.!。]?$/i,
+  /^\(이 조각에서 확인된 코어 결함 없음\s*[—–-]\s*명시 intent 기준 mustFix 는 비움\)$/i,
+  /^\(이 조각에서 검증된 (?:차단 )?결함은 발견되지 않음(?:\s*\(mustFix \[\]\))?\)$/i,
+];
+
+function isNoFindingReviewNote(finding: string): boolean {
+  const wholeItem = finding.trim();
+  return NO_FINDING_REVIEW_NOTE_ALLOWLIST.some((form) => form.test(wholeItem));
+}
+
+function normalizeSavedReviewMustFix(result: Record<string, unknown>): { result: Record<string, unknown>; count: number } {
+  if (!Array.isArray(result.mustFix)) return { result, count: 0 };
+  const noFindingNotes = result.mustFix.filter((finding): finding is string =>
+    typeof finding === 'string' && isNoFindingReviewNote(finding));
+  if (noFindingNotes.length === 0) return { result, count: 0 };
+  const retained = result.mustFix.filter((finding) =>
+    typeof finding !== 'string' || !isNoFindingReviewNote(finding));
+  const existingNotes = Array.isArray(result.noFindingNotes) ? result.noFindingNotes : [];
+  return {
+    result: { ...result, mustFix: retained, noFindingNotes: [...existingNotes, ...noFindingNotes] },
+    count: noFindingNotes.length,
+  };
+}
+
 export async function runSelfReviewCliCommand(
   prArgs: string[],
   opts: SelfReviewCliOpts,
@@ -1371,7 +1448,9 @@ async function runSelfReviewCliCommandPinned(
     return { results: [], failed: 1 };
   }
 
-  const useAcp = opts.acp === true;
+  // An explicit API model is the caller's reviewer choice even when a default ACP lane supplied both flags.
+  const requestedModel = opts.model?.trim() || undefined;
+  const useAcp = opts.acp === true && !requestedModel;
   const acpModel = opts.acpModel?.trim() || undefined;
   const acpBackendResolution = opts.acpBackend
     ? { backend: opts.acpBackend, source: 'cli' as const }
@@ -1379,7 +1458,6 @@ async function runSelfReviewCliCommandPinned(
       ? { backend: opts.configuredAcpBackend, source: 'config' as const }
       : { backend: DEFAULT_REVIEW_BACKEND, source: 'default' as const };
   const acpBackend = acpBackendResolution.backend;
-  const requestedModel = opts.model?.trim() || undefined;
   const rawReviewDenyBackends = (getUserConfig().raw?.acp as { reviewDenyBackends?: unknown } | undefined)?.reviewDenyBackends;
   const denyCheckedAt = Date.now();
   const configuredReviewDenyBackends = validateReviewDenyBackends(rawReviewDenyBackends, denyCheckedAt);
@@ -1396,11 +1474,15 @@ async function runSelfReviewCliCommandPinned(
     ? [canonicalizeBackendId(opts.acpBackend)]
     : automaticFallbacks.backends;
   const skippedAcpFallbackBackends = opts.acpBackend ? [] : automaticFallbacks.skipped;
-  const acpTimeoutSec = Number.isFinite(Number(opts.acpTimeout)) && Number(opts.acpTimeout) > 0
-    ? Number(opts.acpTimeout) : 300;
+  // ACP-REVIEW-VIA-TEAMCLAUDE: no `--acp-timeout` = the backend's default (claude 600s · others 300s).
+  const explicitAcpTimeoutSec = Number.isFinite(Number(opts.acpTimeout)) && Number(opts.acpTimeout) > 0
+    ? Number(opts.acpTimeout) : undefined;
+  const acpTimeoutSecFor = (backend: string): number => explicitAcpTimeoutSec ?? defaultAcpReviewTimeoutSec(backend);
+  const acpTimeoutSec = explicitAcpTimeoutSec ?? 300;
+  const primaryAcpTimeoutSec = acpTimeoutSecFor(acpBackend);
   let acpReviewLLM: ((prompt: string, images?: readonly ReviewImage[]) => Promise<string>) | null = null;
   if (useAcp) {
-    acpReviewLLM = deps.makeAcpLlm({ backend: acpBackend, ...(acpModel ? { model: acpModel } : {}), timeoutMs: acpTimeoutSec * 1000 });
+    acpReviewLLM = deps.makeAcpLlm({ backend: acpBackend, ...(acpModel ? { model: acpModel } : {}), timeoutMs: primaryAcpTimeoutSec * 1000 });
   }
   // ⭐ Reviewer selection source. An explicit flag always wins byte-for-byte; only without one does
   //    `roleLlm.reviewer` (the harness's reviewer row) pick the ACP lane. Worst case = today's API review.
@@ -1422,7 +1504,11 @@ async function runSelfReviewCliCommandPinned(
     deps.error(message);
     return { results: opts.json ? [{ error: message, requestedModel }] : [], failed: 1 };
   }
-  const model = useAcp ? `acp:${acpBackend}${acpModel ? `/${acpModel}` : ''}` : (opts.model || envModel || roleFallbackModel || tierModel('better'));
+  const configuredReviewModel = opts.configuredReviewModel?.trim() || undefined;
+  // REVIEW-MODEL-ALIAS-PROVIDER: provider pinning needs GLM's OpenRouter model id, not the bare alias.
+  const explicitApiModel = requestedModel?.toLowerCase() === 'glm' ? ROLE_REVIEWER_FALLBACK_MODEL : opts.model;
+  const model = useAcp ? `acp:${acpBackend}${acpModel ? `/${acpModel}` : ''}` : (explicitApiModel || envModel || configuredReviewModel || roleFallbackModel || tierModel('better'));
+  const configuredReviewSelected = !opts.model?.trim() && !envModel && Boolean(configuredReviewModel);
   let roleReviewer: { llm: (prompt: string, images?: readonly ReviewImage[]) => Promise<string>; model: string } | undefined;
   let roleReviewerUnavailableReason: string | undefined;
   let roleReviewerAvailabilityMs: number | undefined;
@@ -1444,7 +1530,7 @@ async function runSelfReviewCliCommandPinned(
       deps.log('role-reviewer-fallback', {
         reviewerSource, roleReviewerProvider: opts.roleReviewer.provider, roleReviewerAvailabilityMs,
         stage: 'availability', reason: roleReviewerUnavailableReason, fallbackModel: safeLogText(model),
-        fallbackModelSource: roleFallbackModel ? 'role-fallback' : 'default',
+        fallbackModelSource: configuredReviewSelected ? 'role-review-config' : roleFallbackModel ? 'role-fallback' : 'default',
       }, { level: 'warn' });
     }
   }
@@ -1463,16 +1549,17 @@ async function runSelfReviewCliCommandPinned(
     const previousHeads = savedReviewHeads(pr);
     const previousRoundCount = previousHeads.length;
     const reason = opts.overCapReason?.trim();
+    const authorization = previousRoundCount >= 5 ? readCapOverride(pr) : undefined;
     deps.observeDoctorReview?.('round-counted', { pr, previousRoundCount, round: previousRoundCount + 1 });
     const opAllowed = previousRoundCount >= 5 && opAllowsReviewOverCap(pr);
     if (previousRoundCount >= 5) {
       deps.observeDoctorReview?.('cap-attempt', { pr, previousRoundCount, round: previousRoundCount + 1, reasonProvided: Boolean(reason), opAllowed }, { level: 'warn' });
     }
-    if (previousRoundCount >= 5 && (!reason || !opAllowed)) {
+    if (previousRoundCount >= 5 && (!opAllowed || (!authorization && !reason))) {
       const refusalHead = prHeadCommit(pr, deps).value;
       const message = !opAllowed
         ? `PR ${pr}: r5 상한 초과 리뷰는 OP traffic.json reviewOverCapAllow 허용 목록에 있어야 합니다.`
-        : `PR ${pr}: 저장된 서로 다른 head 리뷰 ${previousRoundCount}개로 r5 상한에 도달했습니다. 새 리뷰는 --over-cap-reason <사유>로 PR당 한 번만 허용됩니다.`;
+        : `PR ${pr}: 저장된 서로 다른 head 리뷰 ${previousRoundCount}개로 r5 상한에 도달했습니다. OP 허용 상태와 --over-cap-reason <사유>가 필요합니다.`;
       deps.observeDoctorReview?.('cap-refused', { pr, head: refusalHead, previousRoundCount, round: previousRoundCount + 1, reason: opAllowed ? 'missing-reason' : 'not-op-allowlisted' }, { level: 'warn' });
       deps.error(message);
       if (opts.json || opts.save !== undefined) results.push({ pr, error: message, reviewed: false, refusal: 'cap-refused', previousRoundCount, headCommit: refusalHead });
@@ -1480,9 +1567,69 @@ async function runSelfReviewCliCommandPinned(
       continue;
     }
     const diffRead = readDiffAtHead(pr, deps);
-    if (previousRoundCount >= 5 && reason) {
-      // Claim only the exact SHA-pinned diff that the reviewer will see; never spend the sole
-      // exception on a separately read head that may move before readDiffAtHead.
+    if (previousRoundCount >= 5 && authorization && diffRead.headCommit.toLowerCase() === authorization.head) {
+      const message = `PR ${pr}: 동일 head는 이미 승인 소모 기록이 있습니다.`;
+      deps.observeDoctorReview?.('cap-refused', { pr, head: diffRead.headCommit, previousRoundCount, round: previousRoundCount + 1, reason: 'same-head-already-used' }, { level: 'warn' });
+      deps.error(message);
+      if (opts.json || opts.save !== undefined) results.push({ pr, error: message, reviewed: false, refusal: 'cap-refused', previousRoundCount, headCommit: diffRead.headCommit });
+      failed += 1;
+      continue;
+    }
+    if (previousRoundCount >= 5 && authorization && reason && reason !== authorization.reason) {
+      const message = `PR ${pr}: 기존 PR 승인의 사유와 일치하지 않습니다.`;
+      deps.observeDoctorReview?.('cap-refused', { pr, head: diffRead.headCommit, previousRoundCount, round: previousRoundCount + 1, reason: 'authorization-reason-mismatch' }, { level: 'warn' });
+      deps.error(message);
+      if (opts.json || opts.save !== undefined) results.push({ pr, error: message, reviewed: false, refusal: 'cap-refused', previousRoundCount, headCommit: diffRead.headCommit });
+      failed += 1;
+      continue;
+    }
+    let mergeOnlyDeltaRange: { base: string; head: string } | undefined;
+    if (previousRoundCount >= 5 && authorization) {
+      const git = deps.git;
+      if (!git || diffRead.source !== 'sha-pinned' || diffRead.headCommitState !== 'known'
+        || diffRead.currentHeadCommitState !== 'known' || diffRead.stale || diffRead.diff.status !== 0) {
+        const message = `PR ${pr}: 후속 head의 merge-only 여부를 확인할 수 없어 상한 예외 리뷰를 거부합니다.`;
+        deps.error(message);
+        if (opts.json || opts.save !== undefined) results.push({ pr, error: message, reviewed: false, refusal: 'cap-refused', previousRoundCount, headCommit: diffRead.headCommit });
+        failed += 1;
+        continue;
+      }
+      const savedRecords = savedReviewRecords(pr);
+      const latestReviewed = savedRecords.reduce<(typeof savedRecords)[number] | undefined>(
+        (latest, record) => !latest || record.reviewedAt > latest.reviewedAt ? record : latest, undefined,
+      );
+      const classificationBase = latestReviewed?.head ?? authorization.head;
+      const ancestry = git(['merge-base', '--is-ancestor', classificationBase, diffRead.headCommit], 10_000);
+      const parents = git(['rev-list', '--parents', '-n', '1', diffRead.headCommit], 10_000);
+      const parentFields = parents.stdout.trim().split(/\s+/);
+      const headIsMerge = parentFields.length > 2;
+      const deltaHead = headIsMerge ? parentFields[1] : diffRead.headCommit;
+      if ((ancestry.status !== 0 && ancestry.status !== 1) || parents.status !== 0 || parentFields[0]?.toLowerCase() !== diffRead.headCommit.toLowerCase()
+        || !COMMIT_OID.test(deltaHead) || classificationBase === diffRead.headCommit.toLowerCase()) {
+        const message = `PR ${pr}: 후속 head ancestry 또는 parent 정보를 확인할 수 없어 상한 예외 리뷰를 거부합니다.`;
+        deps.error(message);
+        if (opts.json || opts.save !== undefined) results.push({ pr, error: message, reviewed: false, refusal: 'cap-refused', previousRoundCount, headCommit: diffRead.headCommit });
+        failed += 1;
+        continue;
+      }
+      // A non-ancestor head can be a force-push rewind or rebase. It is still
+      // reviewed from the pinned full PR diff; only a proven descendant can
+      // qualify for the merge-only delta path.
+      if (ancestry.status === 0) {
+        // Non-merge commits brought in from main are reachable but are not on
+        // this first-parent line. A merge-only head ends at its first parent;
+        // a later PR commit remains in the candidate range.
+        const commits = git(['rev-list', '--first-parent', '--no-merges', `${classificationBase}..${deltaHead}`], 10_000);
+        if (commits.status !== 0) {
+          const message = `PR ${pr}: 후속 head의 PR 변경 여부를 확인할 수 없어 상한 예외 리뷰를 거부합니다.`;
+          deps.error(message);
+          if (opts.json || opts.save !== undefined) results.push({ pr, error: message, reviewed: false, refusal: 'cap-refused', previousRoundCount, headCommit: diffRead.headCommit });
+          failed += 1;
+          continue;
+        }
+        if (commits.stdout.trim() === '') mergeOnlyDeltaRange = { base: classificationBase, head: diffRead.headCommit.toLowerCase() };
+      }
+    } else if (previousRoundCount >= 5 && reason) {
       const claimable = diffRead.source === 'sha-pinned' && diffRead.headCommitState === 'known'
         && diffRead.currentHeadCommitState === 'known' && !diffRead.stale && diffRead.diff.status === 0;
       if (!claimable || !claimCapOverride(pr, diffRead.headCommit, reason, deps.now())) {
@@ -1495,6 +1642,25 @@ async function runSelfReviewCliCommandPinned(
       }
       deps.observeDoctorReview?.('cap-override', { pr, head: diffRead.headCommit, previousRoundCount, round: previousRoundCount + 1, reason }, { level: 'warn' });
     }
+    if (mergeOnlyDeltaRange) {
+      const delta = deps.git?.(['diff', '--no-ext-diff', `${mergeOnlyDeltaRange.base}...${mergeOnlyDeltaRange.head}`], 25_000);
+      if (!delta || delta.status !== 0) {
+        const message = `PR ${pr}: merge-only 후속 head의 delta diff를 고정할 수 없습니다.`;
+        deps.error(message);
+        if (opts.json || opts.save !== undefined) results.push({ pr, error: message, reviewed: false, refusal: 'cap-refused', previousRoundCount, headCommit: diffRead.headCommit });
+        failed += 1;
+        continue;
+      }
+      diffRead.diff = delta;
+      diffRead.baseCommit = mergeOnlyDeltaRange.base;
+    }
+    if (previousRoundCount >= 5 && authorization && !claimCapOverride(pr, diffRead.headCommit, authorization.reason, deps.now())) {
+      const message = `PR ${pr}: 후속 head 승인 사용 기록을 남기지 못했습니다.`;
+      deps.error(message);
+      if (opts.json || opts.save !== undefined) results.push({ pr, error: message, reviewed: false, refusal: 'cap-refused', previousRoundCount, headCommit: diffRead.headCommit });
+      failed += 1;
+      continue;
+    }
     const localHeadComparison = compareLocalHead(pr, { value: diffRead.headCommit, state: diffRead.headCommitState }, deps);
     const { diff } = diffRead;
     const baseReviewerContext = hasProvidedReviewerContext
@@ -1668,7 +1834,7 @@ async function runSelfReviewCliCommandPinned(
     } else if (mergeState.kind === 'unpinnable') reviewCwdPinFallbackReason = mergeState.reason;
     const reviewCwd = reviewPin?.cwd;
     const prAcpReviewLLM = reviewCwd && useAcp
-      ? deps.makeAcpLlm({ backend: acpBackend, ...(acpModel ? { model: acpModel } : {}), timeoutMs: acpTimeoutSec * 1000, cwd: reviewCwd })
+      ? deps.makeAcpLlm({ backend: acpBackend, ...(acpModel ? { model: acpModel } : {}), timeoutMs: primaryAcpTimeoutSec * 1000, cwd: reviewCwd })
       : acpReviewLLM;
     let prRoleReviewer = roleReviewer;
     if (reviewCwd && roleReviewer && opts.roleReviewer && deps.makeRoleReviewerLlm) {
@@ -1684,7 +1850,8 @@ async function runSelfReviewCliCommandPinned(
     // Role-config lane builds the API reviewer only when it falls back (`made().api` stays 0 on ACP success).
     const responded: { provider?: string; model?: string } = {};
     const makeApi = () => deps.makeApiLlm(model, {
-      pinProvider: Boolean(opts.model?.trim()),
+      pinProvider: Boolean(opts.model?.trim() || configuredReviewSelected),
+      ...(configuredReviewSelected && opts.configuredReviewProvider ? { providerName: opts.configuredReviewProvider } : {}),
       onResolved: (provider, respondedModel) => { responded.provider = provider; responded.model = respondedModel; },
     });
     const llmReview = prRoleReviewer ? undefined : (prAcpReviewLLM ?? makeApi());
@@ -1748,7 +1915,7 @@ async function runSelfReviewCliCommandPinned(
         try {
           const fallbackReview = await deps.reviewPullRequest(
             reviewInput,
-            deps.makeAcpLlm({ backend, timeoutMs: acpTimeoutSec * 1000, ...(reviewCwd ? { cwd: reviewCwd } : {}) }),
+            deps.makeAcpLlm({ backend, timeoutMs: acpTimeoutSecFor(backend) * 1000, ...(reviewCwd ? { cwd: reviewCwd } : {}) }),
           );
           if (fallbackReview.reviewed === true) {
             review = fallbackReview;
@@ -1764,6 +1931,34 @@ async function runSelfReviewCliCommandPinned(
         }
       }
     }
+    // OP #25981: an explicit ACP claude review that ends without a verdict («Autocompact is thrashing …» ·
+    //   reviewed:false · no JSON) goes once to GLM on the same head — never a claude retry (subscription quota).
+    //   An explicit `--acp-model` is the operator's model choice: it is not silently swapped for GLM.
+    //   GLM that throws or also ends without a verdict keeps the claude result, and says so (`glmReviewed`).
+    let claudeFallbackGlm: { reason: string; model: string; glmReviewed: boolean; glmFailureReason?: string } | undefined;
+    if (useAcp && !roleReview && !acpModel && canonicalizeBackendId(acpBackend) === 'claude' && review.reviewed !== true) {
+      const reason = safeLogText(review.failureReason || 'reviewed=false', 400);
+      debug.log('review.acp', 'claude-fallback-glm', { reason }, { level: 'warn' });
+      fallbackAttempted = true;
+      fallbackTriggerReason = reason;
+      let glmFailureReason: string | undefined;
+      try {
+        const glmReview = await deps.reviewPullRequest(reviewInput, deps.makeApiLlm(ZAI_OPENROUTER_FALLBACK_MODEL, {
+          pinProvider: true,
+          onResolved: (provider, respondedModel) => { responded.provider = provider; responded.model = respondedModel; },
+        }));
+        if (glmReview.reviewed === true) {
+          review = glmReview;
+          selectedModel = ZAI_OPENROUTER_FALLBACK_MODEL;
+          reviewRoute = 'api';
+        } else glmFailureReason = safeLogText(glmReview.failureReason || 'reviewed=false', 400);
+      } catch (error) {
+        glmFailureReason = safeLogText(error instanceof Error ? error.message : String(error), 400);
+      }
+      if (glmFailureReason !== undefined) fallbackFailures.push({ backend: ZAI_OPENROUTER_FALLBACK_MODEL, reason: glmFailureReason });
+      claudeFallbackGlm = { reason, model: ZAI_OPENROUTER_FALLBACK_MODEL, glmReviewed: glmFailureReason === undefined,
+        ...(glmFailureReason !== undefined ? { glmFailureReason } : {}) };
+    }
     reviewPin?.remove();
     // reviewCwdCommit 은 «최종 판정을 낸 LLM 이 실제로 그 cwd 를 받았을 때만» 싣는다(role 실패 → API 폴백이면 안 싣는다).
     const reviewedOnPin = Boolean(reviewPin) && (roleReview ? rolePinned : reviewRoute === 'acp-fallback' ? true : reviewRoute === 'acp' && useAcp);
@@ -1783,6 +1978,7 @@ async function runSelfReviewCliCommandPinned(
       ...(fallbackBackend ? { requestedModel: primaryModel, actualBackend: `acp:${fallbackBackend}` } : {}),
       ...(fallbackNotAttemptedReason ? { fallbackNotAttemptedReason } : {}),
       ...(fallbackTriggerReason ? { fallbackTriggerReason } : {}),
+      ...(claudeFallbackGlm ? { claudeFallbackGlm } : {}),
       ...(fallbackFailures.length ? { fallbackFailures } : {}),
       ...(skippedAcpFallbackBackends.length ? { skippedAcpFallbackBackends } : {}),
     };
@@ -1838,10 +2034,15 @@ async function runSelfReviewCliCommandPinned(
         if (review.reviewed === true) failed += 1;
       } else {
         const path = join(effectiveInstanceRoot(), 'review-results', `${opts.save}-${pr}-${diffRead.headCommit.slice(0, 12)}.json`);
-        const result = results.at(-1);
+        const rawResult = results.at(-1);
+        const normalized = rawResult && typeof rawResult === 'object'
+          ? normalizeSavedReviewMustFix(rawResult)
+          : { result: rawResult, count: 0 };
+        const result = normalized.result;
         try {
           mkdirSync(dirname(path), { recursive: true });
           writeFileSync(path, selfReviewJsonLine([result]));
+          if (normalized.count > 0) deps.log('mustfix-normalized', { pr, head: diffRead.headCommit, count: normalized.count });
         } catch (error) {
           failed += 1;
           deps.error(`PR ${pr}: --save 실패: ${error instanceof Error ? error.message : String(error)}`);

package/src/autopilot/mission-codebase-gate.ts

@@ -28,6 +28,116 @@ import { llmUsageCostFields } from '../budget/llm-cost.js';
 
 const execFileAsync = promisify(execFile);
 
+/** git 서브프로세스 대역 — term grep 동시성 계약을 실제 git 없이 재기 위한 교체점. */
+export type ExecFileLike = (
+  file: string,
+  args: readonly string[],
+  options: { cwd?: string; encoding: 'utf-8'; maxBuffer: number },
+) => Promise<{ stdout: string; stderr?: string }>;
+
+const defaultExecFile: ExecFileLike = execFileAsync as unknown as ExecFileLike;
+let execFileImpl: ExecFileLike = defaultExecFile;
+
+/** 테스트 seam — null/미지정이면 실제 git 서브프로세스로 되돌린다. */
+export function setExecFileForTest(fn?: ExecFileLike | null): void {
+  execFileImpl = fn ?? defaultExecFile;
+}
+
+/** term 별 git grep 동시 실행 상한(기본 3 · OP 06:3x 실측 13개 동시 부하 101 을 막는다). */
+export const TERM_GREP_CONCURRENCY = 3;
+let termGrepConcurrency: number = TERM_GREP_CONCURRENCY;
+
+/** 테스트 seam — 상한 없음(Infinity)과 결과 불변을 비교하기 위해 올린다. */
+export function setTermGrepConcurrencyForTest(value?: number | null): void {
+  termGrepConcurrency = value ?? TERM_GREP_CONCURRENCY;
+}
+
+/** 상한 클램프 — 풀 크기와 관측값이 같은 규칙을 쓰게 한 곳에 둔다. */
+function effectiveConcurrency(concurrency: number, width: number): number {
+  const limit = Number.isFinite(concurrency) ? Math.max(1, Math.floor(concurrency)) : width;
+  return Math.max(1, Math.min(limit, width));
+}
+
+/** 동시 실행 상한 풀 — 결과 순서는 입력 순서 그대로(순위 계산이 순서에 의존하지 않게). */
+async function mapWithConcurrency<T, R>(
+  items: readonly T[],
+  concurrency: number,
+  worker: (item: T) => Promise<R>,
+): Promise<R[]> {
+  const results = new Array<R>(items.length);
+  const size = effectiveConcurrency(concurrency, items.length);
+  let cursor = 0;
+  await Promise.all(
+    Array.from({ length: size }, async () => {
+      for (let index = cursor++; index < items.length; index = cursor++) {
+        results[index] = await worker(items[index]!);
+      }
+    }),
+  );
+  return results;
+}
+
+/** cwd seam 복원의 **단일 소유** — `process.chdir` 로 되돌리는 곳은 이 묶음(acquire/release) 하나뿐이다.
+ *
+ *  ⛔ 왜 «생산» 이 소유하나: 한 번의 grounding 런은 persistent 코드 채널·skill 도구처럼 **임의 코드**를
+ *  지나고(`dispatchTool` → shell·pty), 그 코드가 cwd 를 옮긴 채 끝날 수 있다. 되돌리기를 «각 의존성» 에
+ *  맡기면 런이 마감(타임아웃)·예외로 끝나는 순간 그 되돌리기가 통째로 빠지고, 다음 런의 seam
+ *  (`deps.cwd ?? process.cwd()`)이 **엉뚱한 트리를 저장소 루트로 읽어** 조용히 0건 grounding 을 낸다
+ *  (#29343 r3 지적: 타임아웃 뒤 cwd seam 오염).
+ *
+ *  ⛔ 소유는 «런마다» 가 아니라 «겹친 런 묶음» 하나다 — cwd 는 프로세스 전역이므로 런별 스냅샷은 겹침에서
+ *  깨진다(A 가 임시 트리로 옮긴 사이 B 가 시작하면 B 가 그 임시 트리를 «시작 자리» 로 저장하고, A 가 되돌린
+ *  뒤 B 가 다시 임시 트리로 되돌린다). ⇒ 첫 런이 시작 자리를 한 번 스냅샷하고, 겹쳐 들어온 런은 그 값을
+ *  seam 으로 «물려받으며», 마지막으로 나가는 런만 되돌린다. 마감으로 «버려진» 런도 본문이 끝날 때까지
+ *  holder 로 남으므로, 마감 뒤에 재개된 본문이 cwd 를 옮겨도 그 뒤의 런은 오염된 자리를 seam 으로 읽지 않고
+ *  본문이 끝나는 순간 되돌려진다.
+ *  ⛔ 복원 보장의 «경계»: 복원은 런의 수명 안에서만 소유한다. 호출자가 마감으로 버렸는데 본문이 «끝나지
+ *  않으면» 전역 cwd 는 그 본문이 끝날 때까지 옮겨진 채 남는다 — 이 함수에는 호출자의 마감 신호가 들어오지
+ *  않고, 진행 중인 본문 밑의 cwd 를 남이 바꾸면 그 본문을 깨뜨린다. 그 사이 보장되는 것은 «겹쳐 들어온
+ *  grounding 런의 seam 이 오염된 자리를 읽지 않는다» 이고, 본문이 끝나는 순간 마지막 holder 가 되돌린다
+ *  (mission-codebase-gate.test.ts «마감 뒤 재개» 시험이 이 경계를 그대로 잰다).
+ *  ⛔ 되돌리기 실패는 grounding 결과를 바꾸지 않되 «조용히 삼키지» 않는다 — `mission.grounding`
+ *  `cwd-restore-failed` 로 남긴다(기존 이벤트 형식은 그대로). */
+interface CwdSeamOwner { root: string; holders: number }
+let cwdSeamOwner: CwdSeamOwner | null = null;
+
+/** 소유 토큰 — `owned=false` 면 이 런은 묶음에 들지 않았다(시작 자리를 못 읽었다) ⇒ 되돌릴 것도 없다.
+ *  ⛔ 절대 throw 하지 않는다: 지워진 cwd 에서도 `deps.cwd` 를 받은 호출은 예전처럼 진행해야 한다. */
+interface CwdSeamLease { root: string | null; owned: boolean }
+
+function acquireCwdSeam(): CwdSeamLease {
+  if (!cwdSeamOwner) {
+    let root: string;
+    try { root = process.cwd(); } catch { return { root: null, owned: false }; }
+    cwdSeamOwner = { root, holders: 0 };
+  }
+  cwdSeamOwner.holders += 1;
+  return { root: cwdSeamOwner.root, owned: true };
+}
+
+function releaseCwdSeam(lease: CwdSeamLease): void {
+  if (!lease.owned) return;
+  const owner = cwdSeamOwner;
+  if (!owner) return;
+  owner.holders -= 1;
+  if (owner.holders > 0) return;
+  cwdSeamOwner = null;
+  let current: string | null = null;
+  try { current = process.cwd(); } catch { /* 지워진 자리 — 아래에서 되돌린다 */ }
+  if (current === owner.root) return;
+  try {
+    process.chdir(owner.root);
+  } catch (e) {
+    try {
+      debug.log('mission.grounding', 'cwd-restore-failed', {
+        root: owner.root,
+        current,
+        error: e instanceof Error ? e.message.slice(0, 200) : String(e).slice(0, 200),
+      }, { level: 'warn' });
+    } catch { /* 관측 실패가 grounding 을 바꾸지 않는다 */ }
+  }
+}
+
 function logLlmUsage(site: 'codebase-gate-injected' | 'codebase-gate-dynamic', model: string, usage: LLMUsage): void {
   try {
     debug.log('llm.usage', 'llm-usage', {
@@ -215,28 +325,37 @@ export function commonTermCoverageWeight(matchLines: number): number {
 }
 
 async function searchRepository(terms: string[], limit: number, cwd: string | undefined, paths: string[], commonPaths = paths): Promise<string[]> {
-  if (!terms.length) return [];
+  // 같은 키워드는 한 번만 실행한다 — 실행·랭킹이 같은 목록을 쓰므로 결과는 결정적이다.
+  const uniqueTerms = [...new Set(terms)];
+  if (!uniqueTerms.length) return [];
   const fileTerms = new Map<string, Set<string>>(); // file → 매칭된 서로 다른 term
   const fileLines = new Map<string, number>();       // file → 총 매칭 라인 수
   const fileTermLines = new Map<string, Map<string, number>>(); // file → term별 매칭 라인 수
   const tooCommon = new Set<string>();               // 200+ 파일 매칭 = 밀도 감쇠 대상
-  const trackedPaths = await execFileAsync('git', ['ls-files', '--', ...paths], { ...(cwd ? { cwd } : {}), encoding: 'utf-8', maxBuffer: 8_000_000 })
+  const trackedPaths = await execFileImpl('git', ['ls-files', '--', ...paths], { ...(cwd ? { cwd } : {}), encoding: 'utf-8', maxBuffer: 8_000_000 })
     .then(({ stdout }) => stdout.split('\n').filter(Boolean))
     .catch(() => [] as string[]);
-  const pathMatches = new Map(terms.map((term) => [term, trackedPaths.filter((file) => file.toLowerCase().includes(term)).length]));
-  // term별 git grep 을 병렬 실행(순차 spawnSync ~16초 → 병렬 ~2초). git grep=현재 워킹트리
-  // 파일 검색(history 아님)·gitignore/바이너리 자동 제외. 호출자가 코드와 문서를 분리한다.
-  const perTerm = await Promise.all(terms.map(async (t) => {
+  const pathMatches = new Map(uniqueTerms.map((term) => [term, trackedPaths.filter((file) => file.toLowerCase().includes(term)).length]));
+  // term별 git grep 을 동시 실행 상한 풀(기본 3)로 돌린다 — 무제한 병렬은 mbp 1분 부하 101·git grep
+  // 13개 동시(OP 06:3x 실측)를 만들었다. git grep=현재 워킹트리 파일 검색(history 아님)·
+  // gitignore/바이너리 자동 제외. 호출자가 코드와 문서를 분리한다.
+  const termGrepStartedAt = Date.now();
+  const perTerm = await mapWithConcurrency(uniqueTerms, termGrepConcurrency, async (t) => {
     try {
       // -c: file:count. -i 무시·-I 바이너리제외. term 하나씩(어느 term 이 걸렸는지 추적).
-      const { stdout } = await execFileAsync('git', ['grep', '-c', '-i', '-I', '-e', t, '--', ...paths], { ...(cwd ? { cwd } : {}), encoding: 'utf-8', maxBuffer: 8_000_000 });
+      const { stdout } = await execFileImpl('git', ['grep', '-c', '-i', '-I', '-e', t, '--', ...paths], { ...(cwd ? { cwd } : {}), encoding: 'utf-8', maxBuffer: 8_000_000 });
       const rows = stdout.split('\n').filter(Boolean);
-      const commonRows = commonPaths === paths ? rows : await execFileAsync('git', ['grep', '-c', '-i', '-I', '-e', t, '--', ...commonPaths], { ...(cwd ? { cwd } : {}), encoding: 'utf-8', maxBuffer: 8_000_000 })
+      const commonRows = commonPaths === paths ? rows : await execFileImpl('git', ['grep', '-c', '-i', '-I', '-e', t, '--', ...commonPaths], { ...(cwd ? { cwd } : {}), encoding: 'utf-8', maxBuffer: 8_000_000 })
         .then(({ stdout }) => stdout.split('\n').filter(Boolean))
         .catch(() => [] as string[]);
       return { t, rows, commonCount: commonRows.length };
     } catch { return { t, rows: [] as string[], commonCount: 0 }; } // git grep no-match = exit 1(throw) → 빈 결과
-  }));
+  });
+  debug.log('grounding.search', 'term-grep-batch', {
+    terms: uniqueTerms.length,
+    concurrency: effectiveConcurrency(termGrepConcurrency, uniqueTerms.length),
+    ms: Date.now() - termGrepStartedAt,
+  });
   for (const { t, rows, commonCount } of perTerm) {
     if (commonCount > 200) {
       tooCommon.add(t);
@@ -260,7 +379,7 @@ async function searchRepository(terms: string[], limit: number, cwd: string | un
     const cover = [...ts].reduce((total, term) => total + (tooCommon.has(term)
       ? commonTermCoverageWeight(termLines?.get(term) ?? 0)
       : 1), 0);
-    const nameTerms = terms.filter((t) => f.toLowerCase().includes(t));
+    const nameTerms = uniqueTerms.filter((t) => f.toLowerCase().includes(t));
     const nameWeight = nameTerms.reduce((total, term) => {
       const matches = pathMatches.get(term) ?? 0;
       // 경로상 유일한 식별자는 강한 +25를 유지하고, 공유 조각은 매칭 경로 수에 반비례해 감쇠한다.
@@ -531,8 +650,12 @@ export async function groundMissionInCodebase(
   goal: string, deps: { cwd?: string; seedPaths?: readonly string[]; searchTerms?: SearchTermFn; skillIndex?: SkillIndexFn; pickSkills?: SkillPickFn; recallMemory?: RecallMemoryFn; recallSelf?: RecallSelfFn; refDigest?: RefDigestFn; persistent?: PersistentGroundingDeps | false } & CapsuleGroundingDeps = {},
 ): Promise<CodebaseGrounding> {
   // 호출자가 준 root를 모든 저장소 채널과 corpus 관측에 공유한다. 미지정 호출은 기존처럼 프로세스 cwd를 쓴다.
+  // ⛔ seam 은 «읽기» 만 하지 않는다 — 시작 자리를 소유자(acquireCwdSeam)에게서 받고 finally 에서 돌려준다.
+  //    겹친 런은 첫 런의 스냅샷을 물려받으므로, 다른 런이 옮겨 놓은 cwd 를 시작 자리로 읽지 않는다.
+  const cwdLease = acquireCwdSeam();
   const cwdSource = deps.cwd === undefined ? 'process' : 'caller';
-  const searchRoot = deps.cwd ?? process.cwd();
+  // 시작 자리를 못 읽었으면(지워진 cwd) 소유하지 않는다 — caller root 는 그대로 쓰고, 미지정이면 예전처럼 process.cwd() 가 판정한다.
+  const searchRoot = deps.cwd ?? cwdLease.root ?? process.cwd();
   const startedAt = performance.now();
   let searchTermsElapsedMs = 0;
   let persistentElapsedMs = 0;
@@ -695,7 +818,13 @@ export async function groundMissionInCodebase(
     debug.log('mission.grounding', 'corpus', { grounded: false, reason: 'error', cwd: searchRoot, cwdSource, error: e instanceof Error ? e.message.slice(0, 200) : String(e).slice(0, 200), persistentEvidence: null, persistentStopReason: null, codeChannel: 'failed' }, { level: 'warn' });
     return { grounded: false, context: '', files: [], persistentEvidence: [], skillFacts: [], codeFacts: [], memoryFacts: [], documentFacts: [], refFacts: [], ptyFacts: [] };
   } finally {
-    observeTiming();
+    // 정상·예외·타임아웃 어느 경로로 끝났든 소유를 돌려준다 — 마지막 holder 가 시작 자리로 되돌린다.
+    //    되돌리기를 관측보다 «먼저» 둔다: 관측이 무엇을 하든 복원이 빠지지 않는다.
+    try {
+      releaseCwdSeam(cwdLease);
+    } finally {
+      observeTiming();
+    }
   }
 }