elanous 0.2.38 → 0.2.41

package/src/self-implement/self-implement-cli.ts

@@ -20,9 +20,12 @@ import { resolveObserveOnlyDecision } from './observe-only.js';
 import { getUserConfig } from '../user-config.js';
 import { resolveAutoReview } from './context-capsule.js';
 import { readDecomposeProposals } from '../self-dev/decompose-proposal.js';
+import { tracedPathReferences } from './goal-author.js';
 
 /** self implement CLI 옵션(commander) — `--no-draft` 는 draft:false 로, `--max-wait` 는 문자열로 도착. */
 export interface SelfImplementCliOpts {
+  /** Managed tool dispatch cancellation signal, forwarded through the pipeline to the active implementation child. */
+  signal?: AbortSignal;
   base?: string;
   draft?: boolean;
   openPr?: boolean;
@@ -63,6 +66,12 @@ export interface SelfImplementCliDeps {
   resolveWantAutoReview?: (flag: boolean) => boolean | Promise<boolean>;
   /** reroute 실행(테스트 주입). 기본 executeSelfImplementReroute. */
   executeReroute?: typeof executeSelfImplementReroute;
+  /** Capability seam: false disables reason-repair reruns; omitted means available because this CLI has a production rerouter. */
+  reasonRepairExecutionAvailable?: boolean;
+  /** Supervisor side-effect seams for focused runtime tests. */
+  taskAgentShadow?: false;
+  taskAgentRejudge?: false;
+  sweepPendingMerges?: typeof import('./frozen-merges.js').sweepFrozenMerges;
   /** ⭐ 산출물의 «눈» 심(테스트 주입). 기본은 실제 브라우저 검증(`observeDeliverables`).
    *  ⛔ 심이 «없으면» 이 배선을 시험으로 재현할 수 없고, 그러면 「손으로 돌려 봤다」만 남는다
    *  — 그것은 「그때 됐다」이지 「앞으로도 된다」가 아니다(리뷰 #10556 must-fix). */
@@ -122,11 +131,25 @@ export interface SingleRunSuperviseOptions {
 type SelfImplementResultWithProposalMetadata = SelfImplementResult
   & Pick<SelfDevJobResult, 'decomposeProposal' | 'goalPlanRevision'>;
 
-export function singleRunAsJobResult(feature: string, r: SelfImplementResultWithProposalMetadata): SupervisorJobResult {
+/**
+ * NEEDS-HUMAN-REASON-REPAIR — 실행 범위 가드가 «대상 밖»으로 잰 변경을 감독 판정 재료로 옮긴다.
+ * ⛔ 가드가 잰 이름만 쓴다 — 결과에 없으면 빈 배열이고, 「없다」를 지어내지 않는다.
+ */
+function measuredOutsideTargetFiles(r: SelfImplementResult): string[] {
+  return [...new Set([
+    ...(r.outOfScopeEdits ?? []),
+    ...(r.scopeExpansion?.files.map((file) => file.path) ?? []),
+  ])];
+}
+
+export function singleRunAsJobResult(feature: string, r: SelfImplementResultWithProposalMetadata, includeDeclaredTargets = false): SupervisorJobResult {
+  const outsideTargetFiles = measuredOutsideTargetFiles(r);
+  const targetPaths = includeDeclaredTargets ? tracedPathReferences(feature).map(({ path }) => path) : [];
   return {
     taskId: r.runId,
     runId: r.runId,
     feature,
+    ...(targetPaths.length ? { targetPaths } : {}),
     status: r.ok ? 'done' : 'failed',
     stage: r.stage,
     ...(!r.ok && r.detail ? { error: { message: r.detail } } : {}),
@@ -143,6 +166,7 @@ export function singleRunAsJobResult(feature: string, r: SelfImplementResultWith
     ...(r.abandonedClassification?.classification
       ? { failureClassification: r.abandonedClassification.classification } : {}),
     ...(r.decomposeProposal ? { decomposeProposal: r.decomposeProposal } : {}),
+    ...(outsideTargetFiles.length > 0 ? { outsideTargetFiles } : {}),
     ...(r.rework ? { rework: r.rework } : {}),
     ...(r.review?.reviewed && r.review.mustFix?.length ? { reviewMustFix: r.review.mustFix } : {}),
     ...(r.goalPlanRevision ? { goalPlanRevision: r.goalPlanRevision } : {}),
@@ -228,8 +252,8 @@ export async function runSelfImplementCliCommand(
       entry: opts.entry ?? 'external-verbatim', // CLI = 외부 창구(외부가 프롬프트 엔지니어 → verbatim 존중)
     });
     spec.entrance = opts.naturalLanguageDispatch ? 'nl-self-implement' : 'cli-self-implement';
-    const pipelineDeps = opts.approver || opts.progress
-      ? { ...deps.pipelineDeps, ...(opts.approver ? { approver: opts.approver } : {}), ...(opts.progress ? { progress: opts.progress } : {}) }
+    const pipelineDeps = opts.approver || opts.progress || opts.signal
+      ? { ...deps.pipelineDeps, ...(opts.approver ? { approver: opts.approver } : {}), ...(opts.progress ? { progress: opts.progress } : {}), ...(opts.signal ? { signal: opts.signal } : {}) }
       : deps.pipelineDeps;
     const exec = deps.executeReroute ?? executeSelfImplementReroute;
     let { result, exitCode } = await exec(spec, pipelineDeps ? { pipelineDeps } : undefined);
@@ -266,10 +290,20 @@ export async function runSelfImplementCliCommand(
           }
         : undefined;
 
-      const initialJob = singleRunAsJobResult(feature, result);
+      const reasonRepairEnabled = getUserConfig().tools.selfImplement.supervisor?.reasonRepair === true
+        && (deps.reasonRepairExecutionAvailable ?? true);
+      const initialJob = singleRunAsJobResult(feature, result, reasonRepairEnabled);
+      // NEEDS-HUMAN-REASON-REPAIR — 사유별 수복 골을 «실행하는» 경로인가.
+      //   ⛔ 아래 rerun 이 invocation.repairGoals[taskId] 를 spec.input.text 로 그대로 실행하므로 «그렇다».
+      //   ⇒ 그래서 이 감독 경로는 사유별 수복(needs-human 전 1회)을 연다.
+      const repairGoalExecution = true;
       await superviseRun({
         initial: [initialJob],
-        repairGoalExecution: true,
+        ...(deps.taskAgentShadow === false ? { taskAgentShadow: false } : {}),
+        ...(deps.taskAgentRejudge === false ? { taskAgentRejudge: false } : {}),
+        ...(deps.sweepPendingMerges ? { sweepPendingMerges: deps.sweepPendingMerges } : {}),
+        repairGoalExecution,
+        needsHumanReasonRepairExecution: reasonRepairEnabled,
         limits,
         ...(deliverableEye ? { observeDeliverables: deliverableEye } : {}),
         ...(opts.supervise.onDecision ? { onDecision: opts.supervise.onDecision } : {}),
@@ -283,7 +317,7 @@ export async function runSelfImplementCliCommand(
           const next = await exec(repairGoal ? { ...spec, input: { ...spec.input, text: repairGoal } } : spec, pipelineDeps ? { pipelineDeps } : undefined);
           result = attachGoalPlanRevisionObservation(next.result, deps);
           exitCode = next.exitCode;
-          return [{ ...singleRunAsJobResult(feature, result), taskId: initialJob.taskId }];
+          return [{ ...singleRunAsJobResult(feature, result, reasonRepairEnabled), taskId: initialJob.taskId }];
         },
       });
     }

package/src/self-implement/stop-autoheal-operational.ts

@@ -0,0 +1,43 @@
+/** Production STOP-AUTOHEAL actions. A missing prerequisite is a failed action, never a healed run. */
+import { spawnSync } from 'node:child_process';
+import { SPAWN_SYNC_MAX_BUFFER } from '../util/spawn-sync-output.js';
+import { runHostRegate, type HostRegateInput, type HostRegateResult } from './host-regate.js';
+import type { AutohealActions, AutohealContext } from './stop-autoheal.js';
+
+type PrHead = { headRefOid?: string; state?: string; isDraft?: boolean };
+export interface OperationalAutohealDeps {
+  repoRoot: string;
+  readPr?: (number: number, repoRoot: string) => PrHead | null;
+  regate?: (input: HostRegateInput) => Promise<HostRegateResult>;
+}
+
+function prFromEvidence(ctx: AutohealContext): number | null {
+  const match = /^https:\/\/github\.com\/[^/]+\/[^/]+\/pull\/([1-9]\d*)\/?$/.exec(ctx.record.evidenceRef);
+  return match ? Number(match[1]) : null;
+}
+
+function readPr(number: number, repoRoot: string): PrHead | null {
+  const result = spawnSync('gh', ['pr', 'view', String(number), '--json', 'headRefOid,state,isDraft'], {
+    cwd: repoRoot, encoding: 'utf8', timeout: 30_000, maxBuffer: SPAWN_SYNC_MAX_BUFFER,
+  });
+  if (result.status !== 0) return null;
+  try { return JSON.parse(result.stdout) as PrHead; } catch { return null; }
+}
+
+/** Re-gate an existing PR in a clean checkout against current main; never merge from the healer. */
+export function operationalAutohealActions(deps: OperationalAutohealDeps): AutohealActions {
+  return {
+    'clean-workspace-regate': async (ctx) => {
+      const number = prFromEvidence(ctx);
+      if (!number) return { ok: false, detail: 'PR URL absent from stop evidence' };
+      const pr = (deps.readPr ?? readPr)(number, deps.repoRoot);
+      if (!pr?.headRefOid || pr.state !== 'OPEN' || typeof pr.isDraft !== 'boolean')
+        return { ok: false, detail: `PR #${number} is not an open PR with a measured head and draft state` };
+      const result = await (deps.regate ?? runHostRegate)({
+        prNumber: number, headCommit: pr.headRefOid, repoRoot: deps.repoRoot, verifyOnly: true,
+        ...(pr.isDraft ? { allowDraft: true } : {}),
+      });
+      return { ok: result.passed, detail: `PR #${number} head ${pr.headRefOid} clean regate ${result.status ?? (result.passed ? 'passed' : 'failed')}${result.failures.length ? `: ${result.failures.map((failure) => failure.step).join(',')}` : ''}` };
+    },
+  };
+}

package/src/self-implement/stop-autoheal.ts

@@ -13,11 +13,12 @@
  *   main-sync          → rebase-regate            리베이스(MERGE-INTENT-RESOLVE 의도 해석) 뒤 재게이트
  *   pod-died           → resume-from-salvage      `salvage/run-<6hex>/<leaf>` 가지에서 resume(DRAFT-NOT-ARCHIVE)
  *   evidence-uncovered → derive-evidence-rejudge  런 출력·시험·배선에서 증거를 끌어내 1회 재판정
+ *   review-budget-exhausted → needs-owner (code fallback; reauthor is an optional graph exit)
  *   review-repeat · review-out-of-scope · scope-escape · fabric · launch-failed · gate-failed · unclassified → needs-owner(새 라운드 없음)
  *
  * 사다리의 «출처»: `graphs/overlays/stop-heal-ladder.yaml` 이 갈래마다 처방 노드(id = 처방 이름)를 선언한다.
  *    그 갈래에 얹힌 오버레이가 더한 노드 id 가 처방이다(source='graph'). 선언이 없거나 못 읽으면
- *    위 표(`AUTOHEAL_ACTION_BY_CLASS`)로 간다(source='code-default'). 둘이 같은 답을 내는지는 시험이 문다.
+ *    위 표(`AUTOHEAL_ACTION_BY_CLASS`)로 간다(source='code-default'). 선택된 노드가 실제 실행 가능한지는 별도 경계다.
  *
  * 모드 `tools.selfImplement.autoheal.mode` = `shadow`(기본: 할 일을 원장에만 적고 손대지 않는다) | `live`.
  * ⛔ live 에서도 행동은 주입 seam 으로만 한다 — seam 이 없는 행동은 `needs-owner`(action-unwired)로 떨어진다.
@@ -44,6 +45,7 @@ export type AutohealAction =
   | 'rebase-regate'
   | 'resume-from-salvage'
   | 'derive-evidence-rejudge'
+  | 'review-round-reauthor'
   | 'needs-owner';
 
 /** 닫힌 목록 전체를 덮는다 — 새 class 가 생기면 여기서 타입 오류가 난다. */
@@ -55,6 +57,8 @@ export const AUTOHEAL_ACTION_BY_CLASS: Readonly<Record<RunStopClass, AutohealAct
   'evidence-uncovered': 'derive-evidence-rejudge',
   'review-repeat': 'needs-owner',
   'review-out-of-scope': 'needs-owner',
+  // Reauthoring is an optional graph exit, not a code-level guarantee.
+  'review-budget-exhausted': 'needs-owner',
   'scope-escape': 'needs-owner',
   fabric: 'needs-owner',
   'launch-failed': 'needs-owner',
@@ -64,7 +68,7 @@ export const AUTOHEAL_ACTION_BY_CLASS: Readonly<Record<RunStopClass, AutohealAct
 
 /** 처방 노드 id 로 인정하는 이름 — 오버레이가 더한 노드 중 이 넷만 처방으로 읽는다. */
 const HEAL_ACTION_NODE_IDS: ReadonlySet<string> = new Set<Exclude<AutohealAction, 'needs-owner'>>([
-  'clean-workspace-regate', 'rebase-regate', 'resume-from-salvage', 'derive-evidence-rejudge',
+  'clean-workspace-regate', 'rebase-regate', 'resume-from-salvage', 'derive-evidence-rejudge', 'review-round-reauthor',
 ]);
 
 /** 처방이 «어디서» 왔나 — `graph` = 그 갈래에 얹힌 오버레이가 더한 노드 · `code-default` = 위 표. */
@@ -75,6 +79,8 @@ export interface AutohealPick {
   source: AutohealActionSource;
   /** source='graph' 일 때 그 처방 노드를 더한 오버레이. */
   overlayId?: string;
+  /** Code fallback when an optional graph exit is not declared. */
+  fallbackReason?: string;
 }
 
 /** 사다리를 읽어 오는 자리 — 활성 템플릿 선언 ⊕ 오버레이 목록. 시험이 갈아 끼운다. */
@@ -93,7 +99,10 @@ function loadDefaultLadder(): AutohealLadder {
  *    «조용히» 코드 표로 간다 — 그 사실은 `source` 가 말한다. 던지지 않는다.
  */
 export function pickAutohealAction(cls: RunStopClass, loadLadder: () => AutohealLadder = loadDefaultLadder): AutohealPick {
-  const codeDefault: AutohealPick = { action: AUTOHEAL_ACTION_BY_CLASS[cls] ?? 'needs-owner', source: 'code-default' };
+  const codeDefault: AutohealPick = {
+    action: AUTOHEAL_ACTION_BY_CLASS[cls] ?? 'needs-owner', source: 'code-default',
+    ...(cls === 'review-budget-exhausted' ? { fallbackReason: 'declared-node-unavailable: review-round-reauthor' } : {}),
+  };
   try {
     const { template, overlays } = loadLadder();
     if (!template) return codeDefault;
@@ -297,8 +306,8 @@ export async function autohealFromStop(ctx: AutohealContext, deps: AutohealDeps
   }
   const mode = deps.mode ?? DEFAULT_AUTOHEAL_MODE;
   const cls = ctx.record.class;
-  const { action, source, overlayId } = pickAutohealAction(cls, deps.loadLadder);
-  const base = { runId: ctx.runId, class: cls, action, source, ...(overlayId ? { overlayId } : {}), mode };
+  const { action, source, overlayId, fallbackReason } = pickAutohealAction(cls, deps.loadLadder);
+  const base = { runId: ctx.runId, class: cls, action, source, ...(overlayId ? { overlayId } : {}), ...(fallbackReason ? { fallbackReason } : {}), mode };
 
   if (repeatedStop(deps.priorStops, ctx.record)) {
     // ⛔ 같은 골에서 같은 갈래의 멈춤이 반복되면 자동 재시도를 하지 않는다 — 사유를 골 되먹임 대상으로 넘긴다.
@@ -329,7 +338,7 @@ export async function autohealFromStop(ctx: AutohealContext, deps: AutohealDeps
   let detail: string | undefined;
   if (action === 'needs-owner') {
     outcome = 'needs-owner';
-    reason = `stop ${cls}: ${ctx.record.cause}`;
+    reason = `${fallbackReason ? `${fallbackReason}; ` : ''}stop ${cls}: ${ctx.record.cause}`;
   } else if (mode === 'shadow') {
     outcome = 'would-act';
   } else {

package/src/session/chat.ts

@@ -17,6 +17,7 @@ import {
   type SessionMeta, type SerializedMessage, type CreateSessionOpts,
 } from './index.js';
 import { debug } from '../debug/log.js';
+import { createRequestSizeGuard, formatRequestSizeStatus, type RequestSizeGuard } from './request-size-guard.js';
 import type { InputSourceKind } from '../input/input-source-kind.js';
 import {
   getProviderForConfig, streamLLMWithTools, type LLMMessage, type LLMOpts, type LLMProvider,
@@ -285,7 +286,8 @@ const childContextComposedSessions = new Set<string>();
 export async function runTurn(opts: RunTurnOpts): Promise<RunTurnResult> {
   const loaded = loadSession(opts.sessionId);
   if (!loaded) throw new Error(`session not found: ${opts.sessionId}`);
-  const { meta, messages } = loaded;
+  const { meta } = loaded;
+  let messages = loaded.messages;
 
   // Memory injection: build the block once per turn, folded into the
   // system prompt. Never fails loud — if the store isn't set up, we
@@ -368,6 +370,19 @@ export async function runTurn(opts: RunTurnOpts): Promise<RunTurnResult> {
   };
   appendMessage(opts.sessionId, userMsg);
 
+  const explicitTier = opts.llmOpts?.model ? undefined : explicitTurnTier(opts.userConfig, opts.sessionId);
+  const llmOpts = explicitTier ? {
+    ...(opts.llmOpts ?? {}), model: explicitTier.model,
+    ...(explicitTier.reasoningEffort && !opts.llmOpts?.reasoningEffort ? { reasoningEffort: explicitTier.reasoningEffort } : {}),
+  } : opts.llmOpts;
+  if (explicitTier) {
+    debug.log('llm.tier', 'turn-tier-applied', {
+      sessionId: opts.sessionId, tier: explicitTier.tier, source: explicitTier.source, model: explicitTier.model,
+      reasoningEffort: llmOpts?.reasoningEffort ?? null,
+    });
+  }
+  const provider = opts.provider ?? getProviderForConfig(opts.userConfig, llmOpts?.model);
+
   // 2) Assemble, trim, call. When images are attached for THIS turn,
   //    swap the string content of the latest user message for
   //    ContentBlock[] so the provider adapter sends them multimodally.
@@ -386,18 +401,43 @@ export async function runTurn(opts: RunTurnOpts): Promise<RunTurnResult> {
     return trimToBudget(wire, opts.maxTokens ?? DEFAULT_TOKEN_BUDGET);
   };
 
-  const explicitTier = opts.llmOpts?.model ? undefined : explicitTurnTier(opts.userConfig, opts.sessionId);
-  const llmOpts = explicitTier ? {
-    ...(opts.llmOpts ?? {}), model: explicitTier.model,
-    ...(explicitTier.reasoningEffort && !opts.llmOpts?.reasoningEffort ? { reasoningEffort: explicitTier.reasoningEffort } : {}),
-  } : opts.llmOpts;
-  if (explicitTier) {
-    debug.log('llm.tier', 'turn-tier-applied', {
-      sessionId: opts.sessionId, tier: explicitTier.tier, source: explicitTier.source, model: explicitTier.model,
-      reasoningEffort: llmOpts?.reasoningEffort ?? null,
-    });
-  }
-  const provider = opts.provider ?? getProviderForConfig(opts.userConfig, llmOpts?.model);
+  const requestSizeGuard: RequestSizeGuard | undefined =
+    meta.source === 'tui' && provider.name === 'openai-codex'
+      ? createRequestSizeGuard({
+          compactOptions: () => ({
+            sessionId: opts.sessionId,
+            activeModelId: llmOpts?.model ?? provider.defaultModel,
+            preserveLastN: opts.userConfig.chat.autoCompact.preserveLastN,
+            archiveEnabled: opts.userConfig.chat.compact.archiveEnabled,
+          }),
+          // The first request has only the persisted transcript plus this
+          // user turn, so use the shared session compactor and rebuild from
+          // the rewritten history. Later tool rounds compact their live
+          // message list (shared guard) so no just-produced tool context is lost.
+          compactFirstRequest: async () => {
+            const { compactSessionHistory } = await import('./compact-session.js');
+            const result = await compactSessionHistory(opts.sessionId, {
+              config: opts.userConfig.chat.autoCompact,
+              force: true,
+              modelId: llmOpts?.model ?? provider.defaultModel,
+            });
+            if (!result.fired) return null;
+            const refreshed = loadSession(opts.sessionId);
+            if (!refreshed) return null;
+            // The persisted compacted session includes this turn's
+            // user message. Drop that final persisted row here, then
+            // assembleTurnMessages re-adds the canonical userMsg and
+            // any image blocks from opts.userImages exactly once.
+            messages = refreshed.messages.slice(0, -1);
+            const rebuilt = assembleTurnMessages(effectiveSystemPrompt).kept;
+            return { messages: rebuilt, reason: `session-${result.reason}` };
+          },
+          onMeasured: (measurement) => {
+            opts.onStatusLine?.(formatRequestSizeStatus(measurement));
+          },
+        })
+      : undefined;
+
   let kept: LLMMessage[] = [];
   let dropped = 0;
   let used = 0;
@@ -432,6 +472,9 @@ export async function runTurn(opts: RunTurnOpts): Promise<RunTurnResult> {
       effectiveSystemPrompt = terminal.systemPromptParts.join('\n\n');
     }
     const turnLlmOpts = terminal ? terminal.llmOpts : llmOpts;
+    const guardedTurnLlmOpts = requestSizeGuard
+      ? { ...(turnLlmOpts ?? {}), requestSizeGuard: turnLlmOpts?.requestSizeGuard ?? requestSizeGuard }
+      : turnLlmOpts;
     ({ kept, dropped, used } = assembleTurnMessages(effectiveSystemPrompt));
     // Durable tool telemetry (추적성) — pair each call's args (onToolCall) with its
     // result (onToolResult) and persist a role:'tool' message so later "어떤 도구
@@ -471,6 +514,8 @@ export async function runTurn(opts: RunTurnOpts): Promise<RunTurnResult> {
         userText: opts.userText,
         messages: kept,
         tools: turnTools,
+        ...(guardedTurnLlmOpts?.requestSizeGuard
+          ? { requestSizeGuard: guardedTurnLlmOpts.requestSizeGuard } : {}),
         dispatchTool: async (name, args, ctx) => dispatchTool(name, args, ctx),
         signal: opts.signal ?? new AbortController().signal,
         callbacks: {
@@ -491,6 +536,8 @@ export async function runTurn(opts: RunTurnOpts): Promise<RunTurnResult> {
         },
         ...(turnLlmOpts?.model ? { modelOverride: turnLlmOpts.model } : {}),
         ...(turnLlmOpts?.budgetGrant ? { budgetGrant: turnLlmOpts.budgetGrant } : {}),
+        ...(guardedTurnLlmOpts?.requestSizeGuard
+          ? { requestSizeGuard: guardedTurnLlmOpts.requestSizeGuard } : {}),
       };
       const maxIterations = opts.goalLoopMaxIterations ?? goalLoopCfg?.maxIterations;
       const gl = await runGoalLoop(coreCtx, maxIterations !== undefined ? { maxIterations } : {});
@@ -513,7 +560,7 @@ export async function runTurn(opts: RunTurnOpts): Promise<RunTurnResult> {
         },
       },
       {
-        ...(turnLlmOpts ?? {}),
+        ...(guardedTurnLlmOpts ?? {}),
         tools: turnTools,
         provider,
         // ★ /cancel 범용화(대표 2026-07-12) — per-turn abort signal 을 tool 루프·llm 호출에 전파.
@@ -527,7 +574,11 @@ export async function runTurn(opts: RunTurnOpts): Promise<RunTurnResult> {
     }
   } else {
     ({ kept, dropped, used } = assembleTurnMessages(effectiveSystemPrompt));
-    const plainOpts = opts.signal ? { ...(llmOpts ?? {}), signal: opts.signal } : (llmOpts ?? {});
+    const plainOpts = {
+      ...(llmOpts ?? {}),
+      ...(requestSizeGuard ? { requestSizeGuard: llmOpts?.requestSizeGuard ?? requestSizeGuard } : {}),
+      ...(opts.signal ? { signal: opts.signal } : {}),
+    };
     const stream = provider.streamChat
       ? provider.streamChat(kept, plainOpts)
       : wrapTextOnly(provider.chat(kept, plainOpts));

package/src/session/request-size-guard.ts

@@ -0,0 +1,123 @@
+// TUI-TOKEN-GUARD-WIRE — shared request-size guard (#32254 cap).
+//
+// The 400k-char cap used to be built only inside `session/chat.ts runTurn`.
+// The production TUI does not run that function: it goes
+// DashboardSession → bridgeCoreTurnToAcp → runCoreTurn/runGoalLoop, so the
+// guard never reached `llm.ts` and no `request-size-compact` event fired
+// (root cause: seat-state/OP/tmp/TUI-TOKEN-BURN-ROOT-CAUSE-1028.md).
+//
+// This module owns the guard construction so both paths share one policy:
+//   - `createRequestSizeGuard` — the `LLMOpts.requestSizeGuard` object.
+//     The first measured request may use a caller hook (`compactFirstRequest`)
+//     that compacts the caller's *persisted* history; every other request
+//     (and a first request whose hook declines) compacts the live message list.
+//   - `compactLiveMessages` — the live compaction (Layer 1/2 + optional
+//     Layer 3 summarize) shared by the guard and by hosts that compact their
+//     own history store.
+//   - `estimateRequestChars` — cheap pre-send estimate (JSON chars of the
+//     messages plus tool specs) used by the ACP bridge preflight.
+//
+// ⚠️ `llm.ts` applies the compacted list with `messages.splice(...)`, but the
+// array it receives is a per-request copy (`mapProviderToolNamesInMessages`),
+// not `streamLLMWithTools`'s `history`. Compaction therefore does not survive
+// into the next tool round by itself — the guard re-measures each request —
+// and only a host write-back (chat.ts session rewrite / dashboard history
+// replace) makes it survive into the next prompt.
+
+import type { LLMMessage, LLMOpts, LLMToolSpec } from '../llm.js';
+import type { CompactProvider } from '../compact/provider.js';
+
+/** #32254 — the wire cap for Codex TUI requests (serialized body chars). */
+export const REQUEST_SIZE_MAX_CHARS = 400_000;
+
+export type RequestSizeGuard = NonNullable<LLMOpts['requestSizeGuard']>;
+export type RequestSizeMeasurement = Parameters<NonNullable<RequestSizeGuard['onMeasured']>>[0];
+export type RequestSizeCompactInfo = Parameters<RequestSizeGuard['compactMessages']>[1];
+export type RequestSizeCompactResult = Awaited<ReturnType<RequestSizeGuard['compactMessages']>>;
+
+type RunCompactPipeline = typeof import('../compact/pipeline.js').runCompactPipeline;
+
+export interface CompactLiveMessagesOptions {
+  sessionId?: string;
+  activeModelId?: string;
+  preserveLastN?: number;
+  archiveEnabled?: boolean;
+  /** Test seam — defaults to the real `runCompactPipeline` with the default compact provider. */
+  runCompactPipeline?: RunCompactPipeline;
+}
+
+/** Compact a live message list. Returns `null` when no layer changed anything. */
+export async function compactLiveMessages(
+  messages: LLMMessage[],
+  opts: CompactLiveMessagesOptions,
+): Promise<{ messages: LLMMessage[]; reason: string } | null> {
+  let run = opts.runCompactPipeline;
+  let provider: CompactProvider | undefined;
+  if (!run) {
+    run = (await import('../compact/pipeline.js')).runCompactPipeline;
+    provider = (await import('../compact/provider.js')).getDefaultCompactProvider();
+  }
+  const compacted = await run(messages, {
+    ...(opts.sessionId !== undefined ? { sessionId: opts.sessionId } : {}),
+    ...(provider !== undefined ? { provider } : {}),
+    ...(opts.activeModelId !== undefined ? { activeModelId: opts.activeModelId } : {}),
+    policy: {
+      ...(opts.preserveLastN !== undefined ? { preserveLastN: opts.preserveLastN } : {}),
+      ...(opts.archiveEnabled !== undefined ? { archiveEnabled: opts.archiveEnabled } : {}),
+    },
+  });
+  const diagnostics = compacted.diagnostics;
+  const changed = diagnostics.layer1ResponsesTrimmed > 0
+    || diagnostics.layer2MicrocompactCleared > 0
+    || diagnostics.layer3SummaryApplied === 1
+    || diagnostics.layer5FallbackTruncated === 1;
+  return changed ? { messages: compacted.messages, reason: 'live-request-compact' } : null;
+}
+
+export interface CreateRequestSizeGuardOptions {
+  maxChars?: number;
+  /** Live-compaction options, resolved lazily at compaction time (config is
+   *  read only when a request is actually over the cap). */
+  compactOptions: () => CompactLiveMessagesOptions;
+  /** First measured request only: compact the caller's persisted history and
+   *  return the rebuilt request. `null` falls through to live compaction. */
+  compactFirstRequest?: (
+    currentMessages: LLMMessage[],
+    info: RequestSizeCompactInfo,
+  ) => Promise<RequestSizeCompactResult>;
+  onMeasured?: (measurement: RequestSizeMeasurement) => void;
+}
+
+export function createRequestSizeGuard(opts: CreateRequestSizeGuardOptions): RequestSizeGuard {
+  let measuredProviderRequests = 0;
+  return {
+    maxChars: opts.maxChars ?? REQUEST_SIZE_MAX_CHARS,
+    compactMessages: async (currentMessages, info) => {
+      if (measuredProviderRequests === 0 && opts.compactFirstRequest) {
+        const first = await opts.compactFirstRequest(currentMessages, info);
+        if (first) return first;
+      }
+      return compactLiveMessages(currentMessages, opts.compactOptions());
+    },
+    onMeasured: (measurement) => {
+      measuredProviderRequests += 1;
+      opts.onMeasured?.(measurement);
+    },
+  };
+}
+
+/** Cheap pre-send size estimate: JSON chars of the messages plus tool specs.
+ *  It tracks the Codex wire body closely (the wire also serializes both). */
+export function estimateRequestChars(messages: readonly LLMMessage[], tools: readonly LLMToolSpec[] = []): number {
+  try {
+    return JSON.stringify(messages).length + (tools.length > 0 ? JSON.stringify(tools).length : 0);
+  } catch {
+    return 0;
+  }
+}
+
+/** One-line status text shared by chat.ts and the ACP bridge. */
+export function formatRequestSizeStatus(measurement: RequestSizeMeasurement): string {
+  return `ctx ${measurement.requestChars.toLocaleString()} chars / ${measurement.maxChars.toLocaleString()}`
+    + (measurement.compacted ? ` · compact ${measurement.reason}` : '');
+}

package/src/session-runtime/provider-circuit.ts

@@ -0,0 +1,140 @@
+/**
+ * ⚡ SURVIVAL-PROVIDER-CIRCUIT — 공급자별 회로 차단기 (S2)
+ * 정본: 내부 문서 `RFC-tui-never-stop-survival-ladder-2026-10-27` §3 S2 · §6 B
+ *
+ * 턴 «안»의 공급자 전환(src/llm.ts decideProviderFallback → provider-fallback)은
+ * 이미 있지만, 턴이 끝나면 «방금 누가 고장 났나»를 잊는다. 다음 턴은 다시
+ * 1순위부터 열어 매번 무응답 대기를 먼저 치른다. 이 모듈은 프로세스 안에
+ * 공급자별 회로 상태를 남겨 턴을 넘어 건강을 기억한다.
+ *
+ * ⭐ 사람 의도가 이긴다(src/oauth/fallback-chain.ts 규율 ②) — 회로는 어디까지나
+ * 폴백 판정 보조다. opts.provider 로 명시·고정된 턴은 회로를 보지 않는다.
+ *
+ * 상태기계:
+ *   closed  —(10분 창 안 «전환 사유» 연속 2회 실패)→ open (냉각 5분)
+ *   open    —(냉각 경과)→ half-open
+ *   half-open —(다음 시도 1회)→ 성공: closed / 실패: open (냉각 2배, 상한 30분)
+ *
+ * 전환 사유 범주는 `isProviderFallbackEligible` 이 참인 범주
+ * (network-transient · rate-limit · overloaded · malformed) ⊕
+ * `StreamIdleTimeoutError`(stream-idle-timeout) · `OverloadFailoverError`
+ * (overload-failover) 로 한정한다. 그 외 범주(context-window · safety-blocked
+ * 등 사용자 탓)는 회로에 기록하지 않는다 — 사용자가 문면을 고치기 전까지
+ * 다른 공급자로 도망갈 이유가 없다.
+ */
+import { debug } from '../debug/log.js';
+import { isProviderFallbackEligible, type RetryCategory } from './retry-policy.js';
+
+export type ProviderCircuitState = 'closed' | 'open' | 'half-open';
+
+/** 회로 실패로 세는 «전환 사유» 범주에 추가로 들어가는 두 에러의 범주명. */
+export const CIRCUIT_EXTRA_CATEGORIES = ['stream-idle-timeout', 'overload-failover'] as const;
+
+/** 10분 창 — 같은 공급자의 «전환 사유» 실패 2회가 이 창 안에 있어야 열린다. */
+export const CIRCUIT_FAILURE_WINDOW_MS = 10 * 60_000;
+/** 첫 냉각 5분 — 다시 열릴 때마다 2배. */
+export const CIRCUIT_COOLDOWN_BASE_MS = 5 * 60_000;
+export const CIRCUIT_COOLDOWN_MAX_MS = 30 * 60_000;
+export const CIRCUIT_FAILURE_THRESHOLD = 2;
+
+interface CircuitEntry {
+  /** «전환 사유» 실패 시각(에포크 ms) — 10분 창 밖은 다듬는다. */
+  eligibleFailures: number[];
+  state: 'closed' | 'open';
+  cooldownMs: number;
+  openedAt: number;
+}
+
+/** 프로세스 안 상태 — 턴을 넘어 살아 있어야 하니 모듈 스코프에 둔다. */
+const circuits = new Map<string, CircuitEntry>();
+
+/** 실패 범주가 회로 실패(«전환 사유»)로 세는가 — 순수 판정. */
+export function isCircuitFailureCategory(category: string): boolean {
+  if ((CIRCUIT_EXTRA_CATEGORIES as readonly string[]).includes(category)) return true;
+  return isProviderFallbackEligible(
+    new Error(`circuit:${category}`),
+    category as RetryCategory,
+  );
+}
+
+function entry(name: string): CircuitEntry {
+  let entry = circuits.get(name);
+  if (!entry) {
+    entry = { eligibleFailures: [], state: 'closed', cooldownMs: CIRCUIT_COOLDOWN_BASE_MS, openedAt: 0 };
+    circuits.set(name, entry);
+  }
+  return entry;
+}
+
+function logState(
+  event: 'circuit-open' | 'circuit-half-open' | 'circuit-closed',
+  provider: string,
+  failures: number,
+  cooldownMs: number,
+): void {
+  debug.log('tui.survival', event, { provider, failures, cooldownMs });
+}
+
+/** 회로 차단기에 실패를 기록한다. «전환 사유» 범주만 세며, half-open 시험
+ * 실패는 냉각을 2배(상한 30분)로 갈아 open 을 다시 연다. */
+export function recordProviderFailure(name: string, category: string, now: number): void {
+  if (!isCircuitFailureCategory(category)) return;
+  const e = entry(name);
+  if (e.state === 'open' && now >= e.openedAt + e.cooldownMs) {
+    // half-open 시험 실패 — 다시 열리고 냉각은 2배(상한 30분).
+    e.cooldownMs = Math.min(e.cooldownMs * 2, CIRCUIT_COOLDOWN_MAX_MS);
+    e.openedAt = now;
+    e.eligibleFailures.push(now);
+    logState('circuit-open', name, e.eligibleFailures.length, e.cooldownMs);
+    return;
+  }
+  e.eligibleFailures = e.eligibleFailures.filter((t) => now - t <= CIRCUIT_FAILURE_WINDOW_MS);
+  e.eligibleFailures.push(now);
+  if (e.state === 'closed' && e.eligibleFailures.length >= CIRCUIT_FAILURE_THRESHOLD) {
+    e.state = 'open';
+    e.openedAt = now;
+    e.cooldownMs = CIRCUIT_COOLDOWN_BASE_MS;
+    logState('circuit-open', name, e.eligibleFailures.length, e.cooldownMs);
+  }
+}
+
+/** 성공 — half-open 이면 closed 로 회복하고, closed 의 실패 이력 창을 정리한다. */
+export function recordProviderSuccess(name: string, now: number): void {
+  const e = circuits.get(name);
+  if (!e) return;
+  if (e.state === 'open' && now >= e.openedAt + e.cooldownMs) {
+    e.state = 'closed';
+    e.cooldownMs = CIRCUIT_COOLDOWN_BASE_MS;
+    e.eligibleFailures = [];
+    logState('circuit-closed', name, 0, e.cooldownMs);
+    return;
+  }
+  if (e.eligibleFailures.length > 0) e.eligibleFailures = [];
+}
+
+/** 현재 회로 상태 — 주입 시계로만 판정한다. */
+export function circuitState(name: string, now: number): ProviderCircuitState {
+  const e = circuits.get(name);
+  if (!e || e.state === 'closed') return 'closed';
+  return now < e.openedAt + e.cooldownMs ? 'open' : 'half-open';
+}
+
+/** 턴의 첫 공급자 후보 — 체인 순서 그대로 첫 `closed`, 없으면 첫 `half-open`,
+ * 모두 `open` 이면 `undefined`(호출부가 원래 1순위로 열며 `circuit-all-open` 을 남긴다). */
+export function pickInitialProvider(
+  chainNames: readonly string[],
+  now: number,
+): string | undefined {
+  let firstHalfOpen: string | undefined;
+  for (const name of chainNames) {
+    const state = circuitState(name, now);
+    if (state === 'closed') return name;
+    if (state === 'half-open' && firstHalfOpen === undefined) firstHalfOpen = name;
+  }
+  return firstHalfOpen;
+}
+
+/** 테스트 전용 — 프로세스 안 회로 상태를 리셋한다. */
+export function resetProviderCircuitForTest(): void {
+  circuits.clear();
+}

package/src/shell-runner/file-engine.ts

@@ -368,6 +368,7 @@ function buildResult(
   const aggCapped = capString(agg, meta.maxOutputBytes);
   const r: ShellResult = {
     ...(meta.exitCode !== undefined ? { exitCode: meta.exitCode } : {}),
+    ...(meta.spawnError !== undefined ? { failureReason: meta.spawnError } : {}),
     stdout: stdout.toStream(meta.maxOutputBytes),
     stderr: stderr.toStream(meta.maxOutputBytes),
     aggregated: aggCapped,

package/src/shell-runner/types.ts

@@ -213,6 +213,10 @@ export interface StreamOutput {
 
 export interface ShellResult {
   exitCode?: number;
+  /** Failure detail captured at the execution boundary (for example,
+   *  the original spawn error). Kept separate from outcome so callers
+   *  can explain why no process exit status exists. */
+  failureReason?: string;
   stdout: StreamOutput;
   stderr: StreamOutput;
   /** Merged (interleaved) stream in spawn order. For File engine