elanous 0.2.37 → 0.2.40

package/src/boot/daemon-tools/self-implement.ts

@@ -13,7 +13,9 @@
 //   - onProgress ← ux.progress (각 스테이지 진행을 서피스로).
 //   - 큰 gate log → ux.spillFile (파일 첨부).
 
-import { basename } from 'node:path';
+import { basename, join } from 'node:path';
+import { createHash, randomUUID } from 'node:crypto';
+import { existsSync, linkSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
 import type { LLMToolSpec } from '../../llm.js';
 import { childLifetimeSignal } from '../../turn-abort-scope.js';
 import { buildSelfImplementSpec } from '../../self-implement/self-implement-runtime.js';
@@ -25,7 +27,13 @@ import type { SurfaceUx } from '../../agent/surface-ux/types.js';
 import { resolveAutoOpenPrDecision } from '../../self-implement/auto-open-pr.js';
 import { resolveObserveOnlyDecision, _setObserveOnlyConfigReaderForTesting as _setSharedObserveOnlyReaderForTesting } from '../../self-implement/observe-only.js';
 import { debug } from '../../debug/log.js';
+import { globalAgentRegistry, type AgentRegistry } from '../../agent/registry.js';
+import type { TaskNotificationQueue } from '../../agent/task-notification.js';
+import { effectiveInstanceRoot } from '../../instance/resolve.js';
 import { writeAuthoredGoal } from '../../self-implement/goal-author.js';
+import { selfAnswerOrAssumeGoalDocumentClarifications, type GoalClarificationSelfResolver } from '../../self-implement/goal-author-clarification.js';
+import { writeGoalDocumentAtomic } from '../../self-implement/goal-document-write.js';
+import { DecisionLedger } from '../../decisions/decision-ledger.js';
 import { createGoalAuthorDecomposeSteps, readRecentStepCountsFailOpen, readRecentStepCountsFromLogStore, type RecentStepCountReader } from '../../self-implement/goal-author-decompose.js';
 import type { DaemonToolDispatchCtx } from './types.js';
 
@@ -188,6 +196,7 @@ type RunSelfImplementCliFn = (
   deps: SelfImplementCliDeps,
 ) => Promise<SelfImplementCliOutcome>;
 type SelfImplementSeamsFactory = (opts: import('../../self-implement/seams.js').DefaultSeamsOptions) => SelfImplementSeams | Promise<SelfImplementSeams>;
+type DecisionLedgerFactory = () => DecisionLedger;
 
 async function runSelfImplementViaCli(
   command: RunSelfImplementCliFn,
@@ -240,9 +249,12 @@ export async function dispatchSelfImplement(
   authorGoal: SelfImplementGoalAuthor = writeAuthoredGoal,
   runCli: RunSelfImplementCliFn = runSelfImplementCliCommand,
   seamsFactory?: SelfImplementSeamsFactory,
+  clarificationResolver?: GoalClarificationSelfResolver,
+  decisionLedgerFactory?: DecisionLedgerFactory,
 ): Promise<SelfImplementToolResult> {
   const feature = typeof args.feature === 'string' ? args.feature.trim() : '';
   if (!feature) return buildFailedToolResult('SelfImplement: `feature` is required');
+  if (ctx.signal?.aborted) throw ctx.signal.reason ?? new Error('SelfImplement aborted');
   try {
   const base = typeof args.base === 'string' && args.base.trim() ? args.base.trim() : undefined;
   const draft = typeof args.draft === 'boolean' ? args.draft : true;
@@ -292,6 +304,72 @@ export async function dispatchSelfImplement(
       }),
       onProgress: (phase, event) => ux.progress(`goal-author ${phase} ${event === 'start' ? 'started' : 'ended'}`, { phase: 'delta' }),
     })).path;
+    if (ctx.signal?.aborted) throw ctx.signal.reason ?? new Error('SelfImplement aborted');
+  }
+  if (goalFile) {
+    let authoredDocument: string;
+    try {
+      authoredDocument = readFileSync(goalFile, 'utf8');
+    } catch (error) {
+      const errorCode = error && typeof error === 'object' && 'code' in error && typeof error.code === 'string'
+        ? error.code
+        : undefined;
+      const reason = errorCode === 'ENOENT'
+        ? 'goal file missing before clarification'
+        : 'goal file unreadable before clarification';
+      debug.log('daemon-tools.self-implement', 'goal-clarification-file-read-failed', {
+        goalFile,
+        errorCode: errorCode ?? null,
+        reason,
+      });
+      return buildFailedToolResult(reason);
+    }
+    const clarification = await selfAnswerOrAssumeGoalDocumentClarifications(authoredDocument, {
+      path: 'say-first',
+      ...(goalSourceText !== undefined ? { ask: goalSourceText } : {}),
+      ...(typeof args.runId === 'string' ? { runId: args.runId } : {}),
+      ...(clarificationResolver !== undefined ? { resolver: clarificationResolver } : {}),
+    });
+    if (clarification.document !== authoredDocument) writeGoalDocumentAtomic(goalFile, clarification.document);
+    if (clarification.decisionRequired.length > 0) {
+      const ledger = decisionLedgerFactory?.() ?? new DecisionLedger();
+      const decisions = clarification.decisionRequired.map((item) => {
+        const ref = `self-implement-clarification:${args.runId ?? goalFile}:${item.questionId}`;
+        return ledger.raiseOnce({
+          title: `SelfImplement 확인 필요: ${item.header}`.slice(0, 120),
+          category: item.category,
+          scqa: {
+            s: 'SelfImplement 골 저작 중 자동 답변이 끝나지 않은 확인 질문이 남았다',
+            c: '금전·보안·되돌릴 수 없는 외부 효과는 정책 가정으로 승인하지 않는다',
+            q: item.question.slice(0, 240),
+          },
+          pendingQuestion: item.question,
+          options: [
+            { key: 'a', label: '답을 골 문서에 반영 후 재실행', consequence: '결정 내용을 골 문서에 명시하고 SelfImplement을 다시 호출한다' },
+            { key: 'b', label: '진행하지 않음', consequence: '이 범위는 실행하지 않는다' },
+          ],
+          recommendation: { skipped: true, reason: '금전·보안·되돌릴 수 없는 외부 효과는 자동으로 선택하지 않는다' },
+          crossCheckSkipped: '안전상 대표 판단 필요',
+          raisedBy: { agent: 'OPC', track: 'OP' },
+          refs: [ref],
+        }, ref);
+      });
+      debug.log('daemon-tools.self-implement', 'goal-clarification-no-launch', {
+        goalFile,
+        decisionIds: decisions.map((decision) => decision.id),
+        unanswered: clarification.decisionRequired.length,
+        reason: 'safety-critical-clarification-requires-recorded-decision',
+      });
+      return buildFailedToolResult(`goal author clarification requires a recorded decision before launch; record the answer in the goal document and rerun SelfImplement (${decisions.map((decision) => decision.id).join(', ')})`);
+    }
+    if (clarification.unanswered > 0) {
+      debug.log('daemon-tools.self-implement', 'goal-clarification-assumption-incomplete', {
+        goalFile,
+        unanswered: clarification.unanswered,
+        reason: 'no-launch-unanswered-clarification',
+      });
+      return buildFailedToolResult(`goal author clarification remains unanswered; launch withheld to prevent a human popup (${clarification.unanswered})`);
+    }
   }
   const goalAuthorSummary: GoalAuthorSummary = {
     authored: goalFile !== undefined,
@@ -322,6 +400,7 @@ export async function dispatchSelfImplement(
   );
 
   const cliOpts: SelfImplementCliOpts = {
+    ...(ctx.runId ? { runId: ctx.runId } : {}),
     entry,
     ...(ctx.sessionId ? { parentSessionId: ctx.sessionId } : {}),
     ...(base ? { base } : {}),
@@ -336,10 +415,12 @@ export async function dispatchSelfImplement(
   };
   // 승인 통로는 surface seams.approvePr 하나다. opts/pipelineDeps.approver를 보강하면
   // 중앙 심이 seams를 다시 조립해 fail-closed 승인 게이트를 우회할 수 있다.
-  const pipelineDeps: DevPipelineDeps = { buildSelfImplementSeams: () => seams };
+  const pipelineDeps: DevPipelineDeps = { buildSelfImplementSeams: () => seams, signal: ctx.signal };
   const result = run
     ? await run({
       feature,
+      ...(ctx.runId ? { runId: ctx.runId } : {}),
+    ...(ctx.signal ? { signal: ctx.signal } : {}),
       ...(ctx.sessionId ? { parentSessionId: ctx.sessionId } : {}),
       ...(base ? { base } : {}),
       draft,
@@ -369,3 +450,190 @@ export async function dispatchSelfImplement(
     return buildFailedToolResult(reason);
   }
 }
+
+export type SelfImplementQueuedToolResult = {
+  kind: 'launched'; runId: string; taskId: string; state: 'queued' | 'running' | 'done' | 'error' | 'aborted'; ok: boolean;
+  message: string; next: string; missing: [];
+};
+
+type ManagedAdmissionState = 'queued' | 'running' | 'done' | 'error' | 'aborted';
+export interface ManagedTaskAdmission {
+  version: 1;
+  requestKey: string;
+  runId: string;
+  taskId: string;
+  parentSessionId?: string;
+  feature: string;
+  state: ManagedAdmissionState;
+  createdAt: number;
+  updatedAt: number;
+  result?: string;
+  error?: string;
+}
+
+/** File-backed admission ledger. A hard-link claim makes duplicate tool-call admission atomic. */
+export class ManagedTaskAdmissionStore {
+  constructor(private readonly root = resolveManagedAdmissionRoot()) {}
+
+  claim(input: Omit<ManagedTaskAdmission, 'version' | 'createdAt' | 'updatedAt'>): { record: ManagedTaskAdmission; created: boolean } {
+    mkdirSync(this.root, { recursive: true });
+    const path = this.pathFor(input.requestKey);
+    const now = Date.now();
+    const record: ManagedTaskAdmission = { ...input, version: 1, createdAt: now, updatedAt: now };
+    const temp = join(this.root, `.claim-${randomUUID()}.tmp`);
+    writeFileSync(temp, `${JSON.stringify(record)}\n`, { encoding: 'utf8', flag: 'wx', mode: 0o600 });
+    try {
+      linkSync(temp, path);
+      return { record, created: true };
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== 'EEXIST') throw error;
+      return { record: this.read(path), created: false };
+    } finally { rmSync(temp, { force: true }); }
+  }
+
+  update(requestKey: string, patch: Partial<Pick<ManagedTaskAdmission, 'state' | 'result' | 'error'>>): ManagedTaskAdmission {
+    const path = this.pathFor(requestKey);
+    const record = { ...this.read(path), ...patch, updatedAt: Date.now() };
+    const temp = join(this.root, `.update-${randomUUID()}.tmp`);
+    writeFileSync(temp, `${JSON.stringify(record)}\n`, { encoding: 'utf8', flag: 'wx', mode: 0o600 });
+    renameSync(temp, path);
+    return record;
+  }
+
+  get(requestKey: string): ManagedTaskAdmission | undefined {
+    const path = this.pathFor(requestKey);
+    return existsSync(path) ? this.read(path) : undefined;
+  }
+
+  private pathFor(requestKey: string): string {
+    const digest = createHash('sha256').update(requestKey).digest('hex');
+    return join(this.root, `${digest}.json`);
+  }
+
+  private read(path: string): ManagedTaskAdmission {
+    const value: unknown = JSON.parse(readFileSync(path, 'utf8'));
+    if (!value || typeof value !== 'object' || (value as ManagedTaskAdmission).version !== 1) {
+      throw new Error(`invalid SelfImplement admission record: ${path}`);
+    }
+    return value as ManagedTaskAdmission;
+  }
+}
+
+export function resolveManagedAdmissionRoot(instanceRoot = effectiveInstanceRoot()): string {
+  const dataDir = process.env.ELANOUS_DATA_DIR?.trim() || join(instanceRoot, 'data');
+  return join(dataDir, 'self-implement-admissions');
+}
+
+/** Return a durable-addressable registry identity before doing any goal authoring or child setup. */
+export function dispatchSelfImplementManaged(
+  args: Record<string, unknown>,
+  ctx: DaemonToolDispatchCtx & { autoMerge?: boolean },
+  run?: SelfImplementRunner,
+  authorGoal: SelfImplementGoalAuthor = writeAuthoredGoal,
+  runCli: RunSelfImplementCliFn = runSelfImplementCliCommand,
+  seamsFactory?: SelfImplementSeamsFactory,
+  admissionStore: ManagedTaskAdmissionStore = new ManagedTaskAdmissionStore(),
+  runtime: { taskNotifications?: TaskNotificationQueue; registry?: AgentRegistry } = {},
+): Promise<SelfImplementQueuedToolResult | SelfImplementToolResult> {
+  const feature = typeof args.feature === 'string' ? args.feature.trim() : '';
+  if (!feature) return Promise.resolve(buildFailedToolResult('SelfImplement: `feature` is required'));
+  const runId = randomUUID();
+  const taskId = randomUUID();
+  const requestKey = ctx.sessionId && ctx.toolCallId
+    ? `tool-call:${ctx.sessionId}:${ctx.toolCallId}`
+    : `request:${runId}`;
+  let claim: ReturnType<ManagedTaskAdmissionStore['claim']>;
+  try {
+    claim = admissionStore.claim({
+      requestKey, runId, taskId, feature,
+      ...(ctx.sessionId ? { parentSessionId: ctx.sessionId } : {}), state: 'queued',
+    });
+  } catch (error) {
+    return Promise.resolve(buildFailedToolResult(`SelfImplement admission could not be persisted: ${error instanceof Error ? error.message : String(error)}`));
+  }
+  const registry = runtime.registry ?? globalAgentRegistry;
+  if (!claim.created) {
+    let record = claim.record;
+    let existingTask = registry.get(record.taskId);
+    if (!existingTask) {
+      existingTask = registry.register(
+        { name: 'self-implement', systemPrompt: 'Managed SelfImplement execution; do not invoke an LLM agent.' },
+        record.feature, { id: record.taskId },
+      );
+      existingTask.runId = record.runId;
+      existingTask.parentSessionId = record.parentSessionId;
+      existingTask.label = `SelfImplement ${record.feature.slice(0, 80)}`;
+      existingTask.background = true;
+      if (record.state === 'queued' || record.state === 'running') {
+        record = admissionStore.update(requestKey, { state: 'error', error: 'SelfImplement worker was interrupted by process restart; submit a new request to retry.' });
+        existingTask.error = record.error;
+        existingTask.result = record.error;
+        existingTask.state = 'error';
+        existingTask.finishedAt = Date.now();
+        registry.notifyTaskDone(existingTask);
+      } else {
+        existingTask.state = record.state;
+        existingTask.result = record.result;
+        existingTask.error = record.error;
+      }
+    }
+    return Promise.resolve({
+      kind: 'launched', runId: record.runId, taskId: record.taskId, state: record.state,
+      ok: record.state !== 'error' && record.state !== 'aborted',
+      message: `SelfImplement prior admission · run ${record.runId} · task ${record.taskId}${record.error ? ` · ${record.error}` : ''}`,
+      next: `AgentOutput(${record.taskId})`, missing: [],
+    });
+  }
+  const task = registry.register(
+    { name: 'self-implement', systemPrompt: 'Managed SelfImplement execution; do not invoke an LLM agent.' },
+    feature, { id: taskId },
+  );
+  task.runId = runId;
+  task.parentSessionId = ctx.sessionId;
+  task.label = `SelfImplement ${feature.slice(0, 80)}`;
+  task.background = true;
+  const parentChildSignal = childLifetimeSignal(ctx.signal);
+  const signal = parentChildSignal
+    ? AbortSignal.any([task.controller.signal, parentChildSignal])
+    : task.controller.signal;
+  let unsubscribeRunStop = (): void => {};
+  const runStopListenerReady = import('../../self-implement/run-stop.js').then(({ onRunStop, readRunStopRecord }) => {
+    unsubscribeRunStop = onRunStop((entry) => {
+      if (entry.runId !== runId) return;
+      const stop = readRunStopRecord(entry);
+      if (!stop) return;
+      void import('../../agent/task-notification.js').then(({ enqueueSelfImplementRunStopNotification, globalTaskNotificationQueue }) => {
+        enqueueSelfImplementRunStopNotification(
+          { runId, taskId: task.id, feature, stop },
+          runtime.taskNotifications ?? globalTaskNotificationQueue,
+        );
+        debug.log('daemon-tools.self-implement', 'run-stop-wake-enqueued', { runId, taskId: task.id, stopClass: stop.class, site: stop.site ?? null });
+      });
+      unsubscribeRunStop();
+    });
+  });
+  // The task registry owns cancellation and terminal notification. All slow setup,
+  // including goal authoring and seam construction, happens after this receipt.
+  queueMicrotask(() => {
+    void runStopListenerReady.then(() => registry.runManaged(task.id, async () => {
+      admissionStore.update(requestKey, { state: 'running' });
+      if (signal.aborted) throw signal.reason ?? new Error('SelfImplement aborted');
+      const result = await dispatchSelfImplement(args, { ...ctx, runId, signal }, run, authorGoal, runCli, seamsFactory);
+      if (signal.aborted) throw signal.reason ?? new Error('SelfImplement aborted');
+      if (result.kind === 'failed') throw new Error(result.reason);
+      admissionStore.update(requestKey, { state: 'done', result: JSON.stringify(result) });
+      return result;
+    }, (result) => JSON.stringify(result)).catch((error) => {
+      try { admissionStore.update(requestKey, { state: task.controller.signal.aborted ? 'aborted' : 'error', error: error instanceof Error ? error.message : String(error) }); } catch { /* registry remains authoritative for this process */ }
+      debug.log('daemon-tools.self-implement', 'managed-task-failed', {
+        runId, taskId: task.id, reason: error instanceof Error ? error.message : String(error),
+      }, { level: 'warn' });
+    })).finally(unsubscribeRunStop);
+  });
+  debug.log('daemon-tools.self-implement', 'managed-admitted', { runId, taskId: task.id, parentSessionId: ctx.sessionId ?? null });
+  return Promise.resolve({
+    kind: 'launched', runId, taskId: task.id, state: claim.record.state, ok: true,
+    message: `SelfImplement accepted · run ${runId} · task ${task.id}`,
+    next: `AgentOutput(${task.id})`, missing: [],
+  });
+}

package/src/boot/daemon-tools/types.ts

@@ -59,6 +59,8 @@ export interface DaemonToolDispatchCtx {
    *  the args. Optional for backward compat with tests / surfaces that
    *  build the ctx by hand without a session in scope. */
   sessionId?: string;
+  /** Caller-minted SelfImplement identity, propagated by managed dispatch. */
+  runId?: string;
   /** Trusted server-side classification of the current turn, never supplied as a tool argument. */
   requestOrigin?: RequestOrigin;
   /** Owner principal verified at the server request boundary, not from input source metadata. */

package/src/bots/screen-probe.ts

@@ -343,7 +343,7 @@ export function interpretCrontab(out: { readonly code: number; readonly said: st
   //    ⇒ 이제 «화이트리스트»다: 이 문면이 아니면 rc≠0 은 전부 「못 물었다」.
   // ⛔⭐ ***부분문자열로 보지 않는다***(3차 리뷰) — ssh 배너·MOTD 에 그 낱말이 섞이면
   //    rc≠0 «실패»가 「빈 크론탭」으로 둔갑한다. ⇒ 다듬은 산출이 ***그 한 줄 «전체»***여야 한다.
-  //    📏 실측(2026-09-01 · gcpvm): 정확히 `no crontab for user\n` ⊕ rc=1.
+  //    📏 실측(2026-09-01 · 원격 노드): 정확히 `no crontab for <user>\n` ⊕ rc=1.
   //       (macOS 는 `crontab: ` 접두를 붙이는 판이 있어 그것만 허용한다)
   if (/^(crontab: )?no crontab for \S+$/i.test(out.said.trim())) return '';
   return null;

package/src/budget/llm-cost.ts

@@ -25,16 +25,49 @@ export interface LlmPricingUsd {
 }
 
 /** AWS Bedrock Global Standard prices, USD per million tokens (AWS pricing API, ap-northeast-2).
- *  ⛔ BEDROCK-COST-LEDGER(0.2.26) — mantle-openai 비-Anthropic Bedrock id(`openai.gpt-6-sol`·`zai.glm-5` 등
- *  `src/llm/bedrock.ts` BEDROCK_MODELS 의 `route:'mantle-openai'` 행)는 여기에 행이 «없다»: 단가 수치 근거가
- *  하나도 확보되지 않았다. 근거 없는 id는 `isBedrockPricingModel` 게이트(`claude-` 시작)를 지나지 않아
- *  `unknownCost()` 로 `kind:'unknown'` 에 머문다 — 0원으로 꾸미지 않는다. */
+ *  Anthropic(Claude) 축만 담는다 — 이 표는 `isBedrockPricingModel` 게이트(`claude-` 시작) 뒤에 있다.
+ *  ⛔ BEDROCK-COST-LEDGER(0.2.38) — mantle-openai 비-Anthropic id 는 «다른 표»
+ *  (`BEDROCK_NON_ANTHROPIC_PRICING_USD`)로 분리했다. 이 객체는 Claude 5.5 착지분 그대로다(보존 계약). */
 export const BEDROCK_PRICING_USD: Readonly<Record<string, LlmPricingUsd>> = {
   'claude-haiku-5-5': { inputPerM: 0.1, outputPerM: 0.5, cacheWritePerM: 0.125, cacheReadPerM: 0.01 },
   'claude-sonnet-5-5': { inputPerM: 2, outputPerM: 10, cacheWritePerM: 2.5, cacheReadPerM: 0.1 },
   'claude-opus-5-5': { inputPerM: 4, outputPerM: 20, cacheWritePerM: 5, cacheReadPerM: 0.2 },
 };
 
+/** Bedrock 비-Anthropic(mantle-openai) 단가의 근거 — AWS Price List API(`AmazonBedrock` offer,
+ *  us-east-1 = mantle-openai 고정 리전) 조회 결과. 게시 시각 2026-10-16T21:08:06Z.
+ *  재현: `awscurl`/SDK 로 `GetProducts`(serviceCode=AmazonBedrock, regionCode=USE1) 후
+ *  `USE1-<id>-mantle-{input,output}-tokens-standard` 키의 `pricePerUnit.USD` 를 읽는다(1K 토큰 단가 ×1000 = per-M).
+ *  ⛔ 근거 없는 id 는 표에 «넣지 않는다» — `kind:'unknown'` 에 머문다(0원으로 꾸미지 않는다). */
+export const BEDROCK_NON_ANTHROPIC_PRICING_USD: Readonly<Record<string, LlmPricingUsd>> = {
+  // AWS price list key: USE1-deepseek.v3.2-mantle-{input,output}-tokens-standard
+  'deepseek.v3.2': { inputPerM: 0.62, outputPerM: 1.85 },
+  // AWS price list key: USE1-zai.glm-4.7-flash-mantle-{input,output}-tokens-standard
+  'zai.glm-4.7-flash': { inputPerM: 0.07, outputPerM: 0.4 },
+  // AWS price list key: USE1-moonshotai.kimi-k2.5-mantle-{input,output}-tokens-standard
+  'moonshotai.kimi-k2.5': { inputPerM: 0.6, outputPerM: 3 },
+  // AWS price list key: USE1-qwen.qwen3-coder-next-mantle-{input,output}-tokens-standard
+  'qwen.qwen3-coder-next': { inputPerM: 0.5, outputPerM: 1.2 },
+  // AWS price list key: USE1-minimax.minimax-m2.5-mantle-{input,output}-tokens-standard
+  'minimax.minimax-m2.5': { inputPerM: 0.3, outputPerM: 1.2 },
+  // AWS price list key: USE1-mistral.devstral-2-123b-mantle-{input,output}-tokens-standard
+  'mistral.devstral-2-123b': { inputPerM: 0.4, outputPerM: 2 },
+  // ⛔ 근거 없음(AWS price list 조회 0행 → 표에 없음): openai.gpt-6-sol · openai.gpt-6-luna · zai.glm-5.
+  //    이 셋은 지금 mantle-openai 로 선택 가능하지만 단가 근거가 없으므로 `kind:'unknown'` 이 정직한 답이다.
+};
+
+/** Bedrock 비-Anthropic(mantle-openai) 단가 조회용 id 정규화 — invoke id 모양을 표의 키로 되돌린다.
+ *  - `bedrock/` 접두(레지스트리 별칭) · `us.`/`global.` 같은 리전 스코프 접두
+ *  - `-v1:0` 버전 꼬리 · `-20251001` 날짜 꼬리
+ *  Anthropic id(`anthropic.claude-…`)는 이 축이 아니다 — `bedrockPricingModelId` 가 맡는다. */
+export function bedrockNonAnthropicPricingModelId(model: string): string {
+  return model.trim()
+    .replace(/^bedrock\//, '')
+    .replace(/^(?:us|eu|apac|global)\./, '')
+    .replace(/-v1:\d+$/, '')
+    .replace(/-\d{8}$/, '');
+}
+
 export interface LlmCostUsage {
   model: string;
   inputTokens?: number;
@@ -202,7 +235,7 @@ function resolvePricing(
   model: string,
   opts?: EstimateLlmCostOptions,
 ): { pricing: LlmPricingUsd; source: 'catalog' | 'bedrock-catalog' | 'config' | 'registry' } | undefined {
-  // ⭐ 순서: 손 카탈로그(정확) → 정규화 id → config 오버레이 → Bedrock 표 → 저장소 정본 → 레지스트리. 앞이 이긴다.
+  // ⭐ 순서: 손 카탈로그(정확) → 정규화 id → config 오버레이 → Claude Bedrock 표 → 저장소 정본 → mantle Bedrock 표 → 레지스트리. 앞이 이긴다.
   const normalized = normalizePricingModelId(model);
   for (const id of normalized === model ? [model] : [model, normalized]) {
     const catalog = catalogPricing(id);
@@ -216,8 +249,14 @@ function resolvePricing(
     const bedrock = BEDROCK_PRICING_USD[bedrockPricingModelId(model)];
     if (validPricing(bedrock)) return { pricing: bedrock, source: 'bedrock-catalog' };
   }
+  // 저장소 정본이 mantle 표보다 우선한다. 같은 id 가 생기면 직접 모델 가격을 Bedrock 가격으로 덮지 않는다.
   const builtin = builtinCatalogPricing(normalized);
   if (validPricing(builtin)) return { pricing: builtin, source: 'catalog' };
+  // BEDROCK-COST-LEDGER(0.2.38) — mantle-openai 비-Anthropic 축: 근거 있는 행만 bedrock-catalog 로 값을 낸다.
+  // 표에 없는 id(openai.gpt-6-sol·zai.glm-5 등)는 여기서 결정되지 않아 아래 정본·레지스트리로 내려가고,
+  // 그것도 없으면 `unknownCost()` — 0원으로 꾸미지 않는다.
+  const mantle = BEDROCK_NON_ANTHROPIC_PRICING_USD[bedrockNonAnthropicPricingModelId(model)];
+  if (validPricing(mantle)) return { pricing: mantle, source: 'bedrock-catalog' };
   const registry = registryPricing(model);
   if (validPricing(registry)) return { pricing: registry, source: 'registry' };
   return undefined;

package/src/budget/unified-usage.ts

@@ -459,6 +459,16 @@ function subscriptionFromCodexSnapshot(snap: UsageSnapshot): SubscriptionAxis {
  *  📏 응답 모양(실측 2026-09-23): `{data:{total_credits, total_usage}}` (USD). */
 export const OPENROUTER_CREDITS_ENDPOINT = 'https://openrouter.ai/api/v1/credits';
 export const OPENROUTER_KEY_ENDPOINT = 'https://openrouter.ai/api/v1/key';
+
+/** 📏 CREDIT-READOUT 관측 — /key readout 이 «키 한도 note» 를 못 만든 이유를 남긴다.
+ *  note 없는 openrouter 행만 보면 «/key 를 안 불렀나 · 404 인가 · 한도가 null(무제한) 인가» 가
+ *  안 갈리므로 판단 근거를 로그에 남긴다(행·문면·원장 형식은 불변 — 진단 전용). */
+const OPENROUTER_KEY_UNAVAILABLE_EVENT = 'openrouter-key-unavailable';
+type OpenRouterKeyUnavailableReason = 'http-error' | 'limit-not-finite' | 'throw';
+function logOpenRouterKeyUnavailable(reason: OpenRouterKeyUnavailableReason, detail?: string): void {
+  debug.log('usage', OPENROUTER_KEY_UNAVAILABLE_EVENT, detail === undefined ? { reason } : { reason, detail });
+}
+
 async function collectOpenRouterRows(deps: UnifiedUsageDeps): Promise<AccountUsageRow[]> {
   // ⛔ 시험 런타임은 seam 이 없으면 «키 없음»으로 본다 — 키 캐시는 «파일»이라 env 스크럽을 통과해
   //   기존 시험들이 실제 네트워크를 치게 된다(seam 을 모르는 옛 시험이 다수).
@@ -497,10 +507,16 @@ async function collectOpenRouterRows(deps: UnifiedUsageDeps): Promise<AccountUsa
         if (typeof limit === 'number' && Number.isFinite(limit)
           && typeof limitRemaining === 'number' && Number.isFinite(limitRemaining)) {
           note = `키 한도 남은 금액 $${limitRemaining.toFixed(2)}`;
+        } else {
+          logOpenRouterKeyUnavailable('limit-not-finite',
+            `limit=${JSON.stringify(limit) ?? 'absent'} limit_remaining=${JSON.stringify(limitRemaining) ?? 'absent'}`);
         }
+      } else {
+        logOpenRouterKeyUnavailable('http-error', `http-${keyRes.status}`);
       }
-    } catch {
+    } catch (err) {
       // Key metadata is optional; preserve the successful credits row when unavailable.
+      logOpenRouterKeyUnavailable('throw', err instanceof Error ? err.message : String(err));
     }
     return [{
       ...base,

package/src/capture/tui-self-report.ts

@@ -39,7 +39,7 @@ import { createTuiScreenMirror } from './tui-screen-mirror.js';
 import { getChannelBus } from '../terminal-matrix/index.js';
 import { publishSelfReportFrame } from './self-report-frame.js';
 import {
-  upsertPtyManifest, updatePtyManifestFrame, touchLivePtyManifest, markPtyManifestClosed, removePtyManifest, getPtyManifest,
+  upsertPtyManifest, updatePtyManifestFrame, updatePtyManifestSession, touchLivePtyManifest, markPtyManifestClosed, removePtyManifest, getPtyManifest,
   updatePtyManifestBuild,
 } from '../pty-shell/pty-manifest.js';
 import { writeHarnessScreen } from '../harness/harness-screen.js';
@@ -125,6 +125,8 @@ export interface TuiControlTargetDeps {
   dims?: () => { readonly cols: number; readonly rows: number } | undefined;
   /** 외부 주입 라우터 — 글 한 줄을 사용자 버퍼에 섞지 않고 별도 대기열로 돌린다(`input/external-input-queue`). */
   routeExternal?: (chars: string) => ExternalInputRoute;
+  /** Active TUI turn cancellation hook; absent means there is no force-stop capability. */
+  stopTurn?: () => boolean;
 }
 
 function stdoutDims(): { cols: number; rows: number } | undefined {
@@ -136,6 +138,16 @@ export interface TuiControlTarget extends PtyControlTarget {
   deactivate(): void;
 }
 
+let activeTuiForceStop: (() => boolean) | null = null;
+
+/** Dashboard turn owner hook used by the foreground TUI's control target. */
+export function registerTuiForceStopHandler(handler: () => boolean): () => void {
+  activeTuiForceStop = handler;
+  return () => {
+    if (activeTuiForceStop === handler) activeTuiForceStop = null;
+  };
+}
+
 /** Adapt the foreground TUI's own terminal to the existing PTY control
  * protocol without pretending it is a spawned child process. */
 export function createTuiControlTarget(surfaceId: string, deps: TuiControlTargetDeps = {}): TuiControlTarget {
@@ -143,6 +155,7 @@ export function createTuiControlTarget(surfaceId: string, deps: TuiControlTarget
   const parse = deps.splitKeys ?? splitKeys;
   const dims = deps.dims ?? stdoutDims;
   const routeExternal = deps.routeExternal ?? routeExternalInput;
+  const stopTurn = deps.stopTurn ?? (() => activeTuiForceStop?.() ?? false);
   let alive = true;
   let accessMode: PtyAccessMode = 'write';
   let transitionPolicy: PtyTransitionPolicy = 'open';
@@ -160,6 +173,7 @@ export function createTuiControlTarget(surfaceId: string, deps: TuiControlTarget
       return true;
     },
     isAlive: () => alive,
+    stopTurn: (force: true) => force && stopTurn(),
     canWrite: (actor: PtyWriteActor = 'human') => resolveWriteDecision(accessMode, actor).allow,
     write(chars: string): void {
       // ⭐ 이 write 는 «바깥»(제어 IPC)에서만 온다 — 키보드와 섞이기 전에 라우터가 먼저 가른다.
@@ -468,7 +482,15 @@ export function startTuiSelfReport(deps: TuiSelfReportDeps = {}): () => void {
     lastEmittedText = text;
     // TUI-H9 — 이 프레임이 «지금 이 TUI 가 보여 주는 대화» 의 소유 기록이다. 재기동은 이 id 로만 잇는다
     // (읽기 실패 → 소유 없음 → 재기동 막힘 · 다른 세션으로 대체하지 않는다).
-    try { claimTuiOwnedSession(readActiveSessionId(), at); } catch { claimTuiOwnedSession(null, at); }
+    let sessionId: string | null = null;
+    try {
+      sessionId = readActiveSessionId();
+      claimTuiOwnedSession(sessionId, at);
+    } catch {
+      sessionId = null;
+      claimTuiOwnedSession(null, at);
+    }
+    try { updatePtyManifestSession(surfaceId, sessionId ?? '', at); } catch { /* fail-soft */ }
     const frame: SelfReportFrame = { surfaceId, instance, kind: 'tui', mode: 'self-report', text, cols, rows, at, ...(runId ? { runId } : {}) };
     try { publishFrame(frame); } catch { /* fail-soft */ }
     // `at` is shared with the manifest write → its internal throttle keys

package/src/chat/index.ts

@@ -452,12 +452,21 @@ export interface SlashCommand {
   name: string;        // e.g. 'quit'
   aliases?: string[];  // e.g. ['q', 'exit']
   description: string; // shown in picker
+  /** Keep a command executable, but omit it from slash discovery surfaces. */
+  hidden?: boolean;
   /** First-positional-arg suggestions (static). E.g. /plugin → [list, activate, ...]. */
   subcommands?: string[];
 }
 
+/** The 15 slash commands exposed on the first-use menu and in /help. */
+export const SLASH_MENU_POLICY = {
+  required: ['help', 'status', 'model', 'clear', 'resume', 'quit', 'now', 'harness', 'memory', 'side'],
+  reserve: ['context', 'remaining', 'session', 'setup', 'decide'],
+} as const;
+const FIRST_USE_SLASH_COMMANDS: ReadonlySet<string> = new Set([...SLASH_MENU_POLICY.required, ...SLASH_MENU_POLICY.reserve]);
+
 // Default commands available in the input
-export const SLASH_COMMANDS: SlashCommand[] = [
+export const SLASH_COMMANDS: SlashCommand[] = ([
   { name: 'help',  aliases: ['?'],         description: '명령과 키 보기' },
   { name: 'resume',    aliases: [],             description: '지난 대화 이어 가기 · /resume <id 앞자리>' },
   { name: 'model',     aliases: ['m'],           description: '모델 바꾸기 — /model 빠름|보통|깊음 (코드명도 됨)', subcommands: ['빠름', '보통', '깊음', 'codex', 'terra', 'sol', 'luna', 'opus', 'sonnet', 'grok'] },
@@ -514,6 +523,7 @@ export const SLASH_COMMANDS: SlashCommand[] = [
   { name: 'tablet',    aliases: [],        description: 'Tablet mode — collapse layout to log + input', subcommands: ['on', 'off', 'toggle', 'auto', 'status', 'browser-preview', 'bp'] },
   { name: 'surface',   aliases: [], description: 'Surface control — open a pane/catalog launcher (/surface catalog · browser · preview · log · scratch · obsidian · skill) OR set a preferred LLM surface (/surface coding-agent · research-agent · control-agent · ops-agent · … · clear · status)', subcommands: ['catalog', 'browser', 'preview', 'browser-preview', 'log', 'scratch', 'obsidian', 'skill', 'skill-file', 'agents', 'coding-agent', 'coding-chat', 'research-agent', 'research-chat', 'control-agent', 'ops-ui-agent', 'ops-fleet-agent', 'ops-agent', 'clear', 'status'] },
   { name: 'term',  aliases: ['terminal'], description: 'Interactive terminal modal — new / list / attach / detach / switch / kill / snapshot / resume', subcommands: ['new', 'list', 'attach', 'detach', 'switch', 'kill', 'snapshot', 'resume'] },
+  { name: 'side', aliases: [], description: '사이드탭 기초 — 목록 · 셸 생성 · 번호로 PTY 보기/attach', subcommands: ['list', 'new', 'attach'] },
   { name: 'claude', aliases: [], description: 'Spawn claude-code CLI in a terminal modal' },
   { name: 'codex',  aliases: [], description: 'Spawn codex CLI in a terminal modal' },
   { name: 'gemini', aliases: [], description: 'Spawn gemini CLI in a terminal modal' },
@@ -537,11 +547,12 @@ export const SLASH_COMMANDS: SlashCommand[] = [
   { name: 'voice-chat', aliases: ['vc'], description: 'Continuous voice chat mode — speak, elanous replies in voice (Phase 4-5). Subcommands: start / stop / cancel / status. Chord: Alt+R toggles enter/exit anywhere.', subcommands: ['start', 'stop', 'cancel', 'status'] },
   { name: 'auto-tts', aliases: ['tts', 'autotts'], description: 'Auto-TTS for chat responses (Phase 2) — speaks LLM replies sentence-by-sentence. Subcommands: on / off / toggle / status.', subcommands: ['on', 'off', 'toggle', 'status'] },
   { name: 'directive', aliases: [], description: '(운영) 지시를 Linear 이슈로 기록' },
-];
+]).map((command) => ({ ...command, hidden: !FIRST_USE_SLASH_COMMANDS.has(command.name) }));
 
 /** Every user-visible slash spelling, normalized for runtime-catalog comparison. */
 export function displayedSlashCommandNames(commands: readonly SlashCommand[] = SLASH_COMMANDS): string[] {
-  return commands.flatMap((command) => [command.name, ...(command.aliases ?? [])]);
+  return commands.filter((command) => !command.hidden)
+    .flatMap((command) => [command.name, ...(command.aliases ?? [])]);
 }
 
 /** Score and rank slash commands against the user's typed text (sans leading `/`).
@@ -552,15 +563,16 @@ export function displayedSlashCommandNames(commands: readonly SlashCommand[] = S
  *    prefix-on-alias         80
  *    substring-on-name       50
  *    word-start in desc      10  (regex \b<text>)
- *  Sort by score desc, then name asc. Empty text returns the input list
- *  unchanged. */
+ *  Sort by score desc, then name asc. Hidden commands are omitted from discovery,
+ *  while the dispatch registry continues to accept direct input. */
 export function filterSlashCommands(text: string, commands: SlashCommand[]): SlashCommand[] {
+  const discoverable = commands.filter((command) => !command.hidden);
   const q = text.toLowerCase();
-  if (!q) return commands;
+  if (!q) return discoverable;
   const escaped = q.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
   const descRe = new RegExp(`\\b${escaped}`, 'i');
   const scored: { cmd: SlashCommand; score: number }[] = [];
-  for (const cmd of commands) {
+  for (const cmd of discoverable) {
     const name = cmd.name.toLowerCase();
     const aliases = (cmd.aliases ?? []).map(a => a.toLowerCase());
     let score = 0;
@@ -800,6 +812,11 @@ export async function textInput(opts: {
   onKey?: (key: import('../tui.js').Key) =>
     | 'consumed' | 'passthrough'
     | Promise<'consumed' | 'passthrough'>;
+  /** Host escape-chord override. Runs before textInput's unconditional
+   *  quit path so a host can turn a chord into an in-app action. */
+  onQuitChord?: (key: import('../tui.js').Key) =>
+    | 'consumed' | 'passthrough'
+    | Promise<'consumed' | 'passthrough'>;
   /** Provide candidate file/directory entries for the `@`-mention
    *  picker. Called with whatever the user has typed after `@` (may
    *  include subpath fragments like `foo/ba`). Host decides what
@@ -1595,6 +1612,16 @@ export async function textInput(opts: {
       });
     }
 
+    // A host may claim a quit chord as an in-app action (classic
+    // dashboard Ctrl+\\ shows side-tab guidance and keeps the TUI alive).
+    if (isTextInputQuitChord(key) && opts.onQuitChord) {
+      const quitRoute = await Promise.resolve(opts.onQuitChord(key));
+      if (quitRoute === 'consumed') {
+        drawAll();
+        continue;
+      }
+    }
+
     // Hard exit must win over modal/VW pre-routing. When a foreground
     // virtual window is open, onPreKey may hand keys to the modal
     // surface before textInput's own quit branch runs. Claim the quit