elanous 0.2.38 → 0.2.41

package/src/boot/daemon-tools/self-implement.ts

@@ -13,7 +13,9 @@
 //   - onProgress ← ux.progress (각 스테이지 진행을 서피스로).
 //   - 큰 gate log → ux.spillFile (파일 첨부).
 
-import { basename } from 'node:path';
+import { basename, isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { createHash, randomUUID } from 'node:crypto';
+import { existsSync, linkSync, mkdirSync, readFileSync, realpathSync, renameSync, rmSync, writeFileSync } from 'node:fs';
 import type { LLMToolSpec } from '../../llm.js';
 import { childLifetimeSignal } from '../../turn-abort-scope.js';
 import { buildSelfImplementSpec } from '../../self-implement/self-implement-runtime.js';
@@ -25,7 +27,13 @@ import type { SurfaceUx } from '../../agent/surface-ux/types.js';
 import { resolveAutoOpenPrDecision } from '../../self-implement/auto-open-pr.js';
 import { resolveObserveOnlyDecision, _setObserveOnlyConfigReaderForTesting as _setSharedObserveOnlyReaderForTesting } from '../../self-implement/observe-only.js';
 import { debug } from '../../debug/log.js';
+import { globalAgentRegistry, type AgentRegistry } from '../../agent/registry.js';
+import type { TaskNotificationQueue } from '../../agent/task-notification.js';
+import { effectiveInstanceRoot } from '../../instance/resolve.js';
 import { writeAuthoredGoal } from '../../self-implement/goal-author.js';
+import { selfAnswerOrAssumeGoalDocumentClarifications, type GoalClarificationSelfResolver } from '../../self-implement/goal-author-clarification.js';
+import { writeGoalDocumentAtomic } from '../../self-implement/goal-document-write.js';
+import { DecisionLedger } from '../../decisions/decision-ledger.js';
 import { createGoalAuthorDecomposeSteps, readRecentStepCountsFailOpen, readRecentStepCountsFromLogStore, type RecentStepCountReader } from '../../self-implement/goal-author-decompose.js';
 import type { DaemonToolDispatchCtx } from './types.js';
 
@@ -40,7 +48,13 @@ export function resolveDispatchEntry(ctx: DaemonToolDispatchCtx): import('../../
 
 /** 데몬 서피스용 스펙 — 내부 툴과 단일 출처(buildSelfImplementSpec) 공유. */
 export function buildSelfImplementDaemonSpec(): LLMToolSpec {
-  return buildSelfImplementSpec();
+  const spec = buildSelfImplementSpec();
+  const properties = spec.parameters.properties as Record<string, Record<string, unknown>>;
+  properties.goalFile = {
+    type: 'string',
+    description: '기존 SelfImplement 골 문서를 재개할 때만 지정한다. 문서에 결정을 반영한 뒤 같은 골을 다시 실행하며, 저장소 내부 GOAL-* 문서 경로만 허용된다.',
+  };
+  return spec;
 }
 
 // ⭐ 판정은 `../../self-implement/observe-only.js` **한 자리**가 한다 — 이 스위치를 타는 경로가
@@ -82,7 +96,7 @@ const END_STAGES: readonly SelfImplementProgressStage[] = ['pr-opened', 'aborted
 export type SelfImplementLaunchedToolResult = SelfImplementResult & { runId: string; kind: 'launched'; message: string; next: string; missing: string[] };
 export type SelfImplementPendingToolResult = Partial<SelfImplementResult> & { kind: 'pending'; message: string; next: string; missing: string[] };
 export type SelfImplementObservedOnlyToolResult = { kind: 'observed-only'; observed: true; message: string; next: string; missing: ['runId', 'node'] };
-export type SelfImplementFailedToolResult = Partial<SelfImplementResult> & { kind: 'failed'; reason: string; message: string; next: string; missing: string[] };
+export type SelfImplementFailedToolResult = Partial<SelfImplementResult> & { kind: 'failed'; reason: string; message: string; next: string; missing: string[]; goalFile?: string };
 export type SelfImplementToolResult = SelfImplementLaunchedToolResult | SelfImplementPendingToolResult | SelfImplementObservedOnlyToolResult | SelfImplementFailedToolResult;
 
 /** 하니스가 런을 맡았다 — 파일 편집은 하니스 몫이므로 모델의 직접 Write/Edit 을 문면으로 막는다. */
@@ -188,6 +202,7 @@ type RunSelfImplementCliFn = (
   deps: SelfImplementCliDeps,
 ) => Promise<SelfImplementCliOutcome>;
 type SelfImplementSeamsFactory = (opts: import('../../self-implement/seams.js').DefaultSeamsOptions) => SelfImplementSeams | Promise<SelfImplementSeams>;
+type DecisionLedgerFactory = () => DecisionLedger;
 
 async function runSelfImplementViaCli(
   command: RunSelfImplementCliFn,
@@ -211,6 +226,7 @@ const GOAL_ORIGINAL_TEXT_LIMIT = null;
 
 type GoalAuthorSummary = {
   authored: boolean;
+  reused: boolean;
   goalFile: string | null;
   userTextState: 'absent' | 'empty' | 'present';
   originalChars: number | null;
@@ -222,10 +238,23 @@ type GoalAuthorSummary = {
 function emitGoalAuthorSummary(ux: SurfaceUx, summary: GoalAuthorSummary): void {
   const message = summary.authored
     ? `goal-author authored ${basename(summary.goalFile!)} (${summary.userTextState}; ${summary.storedChars} chars; truncated=${summary.truncated})`
-    : `goal-author not authored (${summary.userTextState}; no goal source)`;
+    : summary.reused
+      ? `goal-author resumed ${basename(summary.goalFile!)} (${summary.userTextState})`
+      : `goal-author not authored (${summary.userTextState}; no goal source)`;
   ux.progress(message, { phase: 'delta' });
 }
 
+function resolveResumableGoalFile(requestedPath: string, cwd: string): string {
+  const root = realpathSync(cwd);
+  const candidate = realpathSync(isAbsolute(requestedPath) ? requestedPath : resolve(root, requestedPath));
+  const relativePath = relative(root, candidate);
+  if (!relativePath || relativePath === '..' || relativePath.startsWith(`..${sep}`) || isAbsolute(relativePath)
+    || !/^GOAL-[^/\\]+\.(?:md|txt)$/i.test(basename(candidate))) {
+    throw new Error('goalFile must point to an existing GOAL-*.md or GOAL-*.txt document inside the repository');
+  }
+  return candidate;
+}
+
 /** Observability only; tool selection remains model-led. */
 function harnessMentionState(userText: string | undefined): 'absent' | 'matched' | 'not-matched' {
   if (userText === undefined) return 'absent';
@@ -240,9 +269,12 @@ export async function dispatchSelfImplement(
   authorGoal: SelfImplementGoalAuthor = writeAuthoredGoal,
   runCli: RunSelfImplementCliFn = runSelfImplementCliCommand,
   seamsFactory?: SelfImplementSeamsFactory,
+  clarificationResolver?: GoalClarificationSelfResolver,
+  decisionLedgerFactory?: DecisionLedgerFactory,
 ): Promise<SelfImplementToolResult> {
   const feature = typeof args.feature === 'string' ? args.feature.trim() : '';
   if (!feature) return buildFailedToolResult('SelfImplement: `feature` is required');
+  if (ctx.signal?.aborted) throw ctx.signal.reason ?? new Error('SelfImplement aborted');
   try {
   const base = typeof args.base === 'string' && args.base.trim() ? args.base.trim() : undefined;
   const draft = typeof args.draft === 'boolean' ? args.draft : true;
@@ -281,7 +313,18 @@ export async function dispatchSelfImplement(
   }
 
   let goalFile: string | undefined;
-  if (goalSourceText !== undefined) {
+  let resumedGoal = false;
+  if (args.goalFile !== undefined) {
+    if (typeof args.goalFile !== 'string' || !args.goalFile.trim()) {
+      return buildFailedToolResult('goalFile must be a non-empty path to an existing authored goal document');
+    }
+    try {
+      goalFile = resolveResumableGoalFile(args.goalFile, ctx.cwd);
+      resumedGoal = true;
+    } catch (error) {
+      return buildFailedToolResult(error instanceof Error ? error.message : String(error));
+    }
+  } else if (goalSourceText !== undefined) {
     const recentStepCounts = readRecentStepCountsFailOpen(recentStepCountReader);
     goalFile = (await authorGoal(goalSourceText, ctx.cwd, {
       goalTitle: feature,
@@ -292,9 +335,81 @@ export async function dispatchSelfImplement(
       }),
       onProgress: (phase, event) => ux.progress(`goal-author ${phase} ${event === 'start' ? 'started' : 'ended'}`, { phase: 'delta' }),
     })).path;
+    if (ctx.signal?.aborted) throw ctx.signal.reason ?? new Error('SelfImplement aborted');
+  }
+  if (goalFile) {
+    let authoredDocument: string;
+    try {
+      authoredDocument = readFileSync(goalFile, 'utf8');
+    } catch (error) {
+      const errorCode = error && typeof error === 'object' && 'code' in error && typeof error.code === 'string'
+        ? error.code
+        : undefined;
+      const reason = errorCode === 'ENOENT'
+        ? 'goal file missing before clarification'
+        : 'goal file unreadable before clarification';
+      debug.log('daemon-tools.self-implement', 'goal-clarification-file-read-failed', {
+        goalFile,
+        errorCode: errorCode ?? null,
+        reason,
+      });
+      return buildFailedToolResult(reason);
+    }
+    const clarification = await selfAnswerOrAssumeGoalDocumentClarifications(authoredDocument, {
+      path: 'say-first',
+      ...(goalSourceText !== undefined ? { ask: goalSourceText } : {}),
+      ...(typeof args.runId === 'string' ? { runId: args.runId } : {}),
+      ...(clarificationResolver !== undefined ? { resolver: clarificationResolver } : {}),
+    });
+    if (clarification.document !== authoredDocument) writeGoalDocumentAtomic(goalFile, clarification.document);
+    if (clarification.decisionRequired.length > 0) {
+      const ledger = decisionLedgerFactory?.() ?? new DecisionLedger();
+      const decisions = clarification.decisionRequired.map((item) => {
+        const ref = `self-implement-clarification:${goalFile}:${item.questionId}`;
+        return ledger.raiseOnce({
+          title: `SelfImplement 확인 필요: ${item.header}`.slice(0, 120),
+          category: item.category,
+          scqa: {
+            s: 'SelfImplement 골 저작 중 자동 답변이 끝나지 않은 확인 질문이 남았다',
+            c: '금전·보안·되돌릴 수 없는 외부 효과는 정책 가정으로 승인하지 않는다',
+            q: item.question.slice(0, 240),
+          },
+          pendingQuestion: item.question,
+          options: [
+            { key: 'a', label: '답을 골 문서에 반영 후 재실행', consequence: '결정 내용을 골 문서에 명시하고 SelfImplement을 다시 호출한다' },
+            { key: 'b', label: '진행하지 않음', consequence: '이 범위는 실행하지 않는다' },
+          ],
+          recommendation: { skipped: true, reason: '금전·보안·되돌릴 수 없는 외부 효과는 자동으로 선택하지 않는다' },
+          crossCheckSkipped: '안전상 대표 판단 필요',
+          raisedBy: { agent: 'OPC', track: 'OP' },
+          refs: [ref],
+        }, ref);
+      });
+      debug.log('daemon-tools.self-implement', 'goal-clarification-no-launch', {
+        goalFile,
+        decisionIds: decisions.map((decision) => decision.id),
+        unanswered: clarification.decisionRequired.length,
+        reason: 'safety-critical-clarification-requires-recorded-decision',
+      });
+      const reason = `goal author clarification requires a recorded decision before launch (${decisions.map((decision) => decision.id).join(', ')})`;
+      const next = `Edit ${goalFile} with the explicit answer, then rerun SelfImplement using the same feature and goalFile=${goalFile}; the decision card alone does not launch or resume work`;
+      return {
+        kind: 'failed', reason, goalFile, next, missing: ['runId', 'node'],
+        message: `SelfImplement did not launch: ${reason}. Record the answer in ${goalFile}, then rerun the same feature with goalFile=${goalFile}. A decision-card choice alone does not resume the run.`,
+      };
+    }
+    if (clarification.unanswered > 0) {
+      debug.log('daemon-tools.self-implement', 'goal-clarification-assumption-incomplete', {
+        goalFile,
+        unanswered: clarification.unanswered,
+        reason: 'no-launch-unanswered-clarification',
+      });
+      return buildFailedToolResult(`goal author clarification remains unanswered; launch withheld to prevent a human popup (${clarification.unanswered})`);
+    }
   }
   const goalAuthorSummary: GoalAuthorSummary = {
-    authored: goalFile !== undefined,
+    authored: goalFile !== undefined && !resumedGoal,
+    reused: resumedGoal,
     goalFile: goalFile ?? null,
     userTextState: originalUserText === undefined ? 'absent' : originalUserText === '' ? 'empty' : 'present',
     originalChars,
@@ -322,6 +437,7 @@ export async function dispatchSelfImplement(
   );
 
   const cliOpts: SelfImplementCliOpts = {
+    ...(ctx.runId ? { runId: ctx.runId } : {}),
     entry,
     ...(ctx.sessionId ? { parentSessionId: ctx.sessionId } : {}),
     ...(base ? { base } : {}),
@@ -336,10 +452,12 @@ export async function dispatchSelfImplement(
   };
   // 승인 통로는 surface seams.approvePr 하나다. opts/pipelineDeps.approver를 보강하면
   // 중앙 심이 seams를 다시 조립해 fail-closed 승인 게이트를 우회할 수 있다.
-  const pipelineDeps: DevPipelineDeps = { buildSelfImplementSeams: () => seams };
+  const pipelineDeps: DevPipelineDeps = { buildSelfImplementSeams: () => seams, signal: ctx.signal };
   const result = run
     ? await run({
       feature,
+      ...(ctx.runId ? { runId: ctx.runId } : {}),
+    ...(ctx.signal ? { signal: ctx.signal } : {}),
       ...(ctx.sessionId ? { parentSessionId: ctx.sessionId } : {}),
       ...(base ? { base } : {}),
       draft,
@@ -369,3 +487,190 @@ export async function dispatchSelfImplement(
     return buildFailedToolResult(reason);
   }
 }
+
+export type SelfImplementQueuedToolResult = {
+  kind: 'launched'; runId: string; taskId: string; state: 'queued' | 'running' | 'done' | 'error' | 'aborted'; ok: boolean;
+  message: string; next: string; missing: [];
+};
+
+type ManagedAdmissionState = 'queued' | 'running' | 'done' | 'error' | 'aborted';
+export interface ManagedTaskAdmission {
+  version: 1;
+  requestKey: string;
+  runId: string;
+  taskId: string;
+  parentSessionId?: string;
+  feature: string;
+  state: ManagedAdmissionState;
+  createdAt: number;
+  updatedAt: number;
+  result?: string;
+  error?: string;
+}
+
+/** File-backed admission ledger. A hard-link claim makes duplicate tool-call admission atomic. */
+export class ManagedTaskAdmissionStore {
+  constructor(private readonly root = resolveManagedAdmissionRoot()) {}
+
+  claim(input: Omit<ManagedTaskAdmission, 'version' | 'createdAt' | 'updatedAt'>): { record: ManagedTaskAdmission; created: boolean } {
+    mkdirSync(this.root, { recursive: true });
+    const path = this.pathFor(input.requestKey);
+    const now = Date.now();
+    const record: ManagedTaskAdmission = { ...input, version: 1, createdAt: now, updatedAt: now };
+    const temp = join(this.root, `.claim-${randomUUID()}.tmp`);
+    writeFileSync(temp, `${JSON.stringify(record)}\n`, { encoding: 'utf8', flag: 'wx', mode: 0o600 });
+    try {
+      linkSync(temp, path);
+      return { record, created: true };
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== 'EEXIST') throw error;
+      return { record: this.read(path), created: false };
+    } finally { rmSync(temp, { force: true }); }
+  }
+
+  update(requestKey: string, patch: Partial<Pick<ManagedTaskAdmission, 'state' | 'result' | 'error'>>): ManagedTaskAdmission {
+    const path = this.pathFor(requestKey);
+    const record = { ...this.read(path), ...patch, updatedAt: Date.now() };
+    const temp = join(this.root, `.update-${randomUUID()}.tmp`);
+    writeFileSync(temp, `${JSON.stringify(record)}\n`, { encoding: 'utf8', flag: 'wx', mode: 0o600 });
+    renameSync(temp, path);
+    return record;
+  }
+
+  get(requestKey: string): ManagedTaskAdmission | undefined {
+    const path = this.pathFor(requestKey);
+    return existsSync(path) ? this.read(path) : undefined;
+  }
+
+  private pathFor(requestKey: string): string {
+    const digest = createHash('sha256').update(requestKey).digest('hex');
+    return join(this.root, `${digest}.json`);
+  }
+
+  private read(path: string): ManagedTaskAdmission {
+    const value: unknown = JSON.parse(readFileSync(path, 'utf8'));
+    if (!value || typeof value !== 'object' || (value as ManagedTaskAdmission).version !== 1) {
+      throw new Error(`invalid SelfImplement admission record: ${path}`);
+    }
+    return value as ManagedTaskAdmission;
+  }
+}
+
+export function resolveManagedAdmissionRoot(instanceRoot = effectiveInstanceRoot()): string {
+  const dataDir = process.env.ELANOUS_DATA_DIR?.trim() || join(instanceRoot, 'data');
+  return join(dataDir, 'self-implement-admissions');
+}
+
+/** Return a durable-addressable registry identity before doing any goal authoring or child setup. */
+export function dispatchSelfImplementManaged(
+  args: Record<string, unknown>,
+  ctx: DaemonToolDispatchCtx & { autoMerge?: boolean },
+  run?: SelfImplementRunner,
+  authorGoal: SelfImplementGoalAuthor = writeAuthoredGoal,
+  runCli: RunSelfImplementCliFn = runSelfImplementCliCommand,
+  seamsFactory?: SelfImplementSeamsFactory,
+  admissionStore: ManagedTaskAdmissionStore = new ManagedTaskAdmissionStore(),
+  runtime: { taskNotifications?: TaskNotificationQueue; registry?: AgentRegistry } = {},
+): Promise<SelfImplementQueuedToolResult | SelfImplementToolResult> {
+  const feature = typeof args.feature === 'string' ? args.feature.trim() : '';
+  if (!feature) return Promise.resolve(buildFailedToolResult('SelfImplement: `feature` is required'));
+  const runId = randomUUID();
+  const taskId = randomUUID();
+  const requestKey = ctx.sessionId && ctx.toolCallId
+    ? `tool-call:${ctx.sessionId}:${ctx.toolCallId}`
+    : `request:${runId}`;
+  let claim: ReturnType<ManagedTaskAdmissionStore['claim']>;
+  try {
+    claim = admissionStore.claim({
+      requestKey, runId, taskId, feature,
+      ...(ctx.sessionId ? { parentSessionId: ctx.sessionId } : {}), state: 'queued',
+    });
+  } catch (error) {
+    return Promise.resolve(buildFailedToolResult(`SelfImplement admission could not be persisted: ${error instanceof Error ? error.message : String(error)}`));
+  }
+  const registry = runtime.registry ?? globalAgentRegistry;
+  if (!claim.created) {
+    let record = claim.record;
+    let existingTask = registry.get(record.taskId);
+    if (!existingTask) {
+      existingTask = registry.register(
+        { name: 'self-implement', systemPrompt: 'Managed SelfImplement execution; do not invoke an LLM agent.' },
+        record.feature, { id: record.taskId },
+      );
+      existingTask.runId = record.runId;
+      existingTask.parentSessionId = record.parentSessionId;
+      existingTask.label = `SelfImplement ${record.feature.slice(0, 80)}`;
+      existingTask.background = true;
+      if (record.state === 'queued' || record.state === 'running') {
+        record = admissionStore.update(requestKey, { state: 'error', error: 'SelfImplement worker was interrupted by process restart; submit a new request to retry.' });
+        existingTask.error = record.error;
+        existingTask.result = record.error;
+        existingTask.state = 'error';
+        existingTask.finishedAt = Date.now();
+        registry.notifyTaskDone(existingTask);
+      } else {
+        existingTask.state = record.state;
+        existingTask.result = record.result;
+        existingTask.error = record.error;
+      }
+    }
+    return Promise.resolve({
+      kind: 'launched', runId: record.runId, taskId: record.taskId, state: record.state,
+      ok: record.state !== 'error' && record.state !== 'aborted',
+      message: `SelfImplement prior admission · run ${record.runId} · task ${record.taskId}${record.error ? ` · ${record.error}` : ''}`,
+      next: `AgentOutput(${record.taskId})`, missing: [],
+    });
+  }
+  const task = registry.register(
+    { name: 'self-implement', systemPrompt: 'Managed SelfImplement execution; do not invoke an LLM agent.' },
+    feature, { id: taskId },
+  );
+  task.runId = runId;
+  task.parentSessionId = ctx.sessionId;
+  task.label = `SelfImplement ${feature.slice(0, 80)}`;
+  task.background = true;
+  const parentChildSignal = childLifetimeSignal(ctx.signal);
+  const signal = parentChildSignal
+    ? AbortSignal.any([task.controller.signal, parentChildSignal])
+    : task.controller.signal;
+  let unsubscribeRunStop = (): void => {};
+  const runStopListenerReady = import('../../self-implement/run-stop.js').then(({ onRunStop, readRunStopRecord }) => {
+    unsubscribeRunStop = onRunStop((entry) => {
+      if (entry.runId !== runId) return;
+      const stop = readRunStopRecord(entry);
+      if (!stop) return;
+      void import('../../agent/task-notification.js').then(({ enqueueSelfImplementRunStopNotification, globalTaskNotificationQueue }) => {
+        enqueueSelfImplementRunStopNotification(
+          { runId, taskId: task.id, feature, stop },
+          runtime.taskNotifications ?? globalTaskNotificationQueue,
+        );
+        debug.log('daemon-tools.self-implement', 'run-stop-wake-enqueued', { runId, taskId: task.id, stopClass: stop.class, site: stop.site ?? null });
+      });
+      unsubscribeRunStop();
+    });
+  });
+  // The task registry owns cancellation and terminal notification. All slow setup,
+  // including goal authoring and seam construction, happens after this receipt.
+  queueMicrotask(() => {
+    void runStopListenerReady.then(() => registry.runManaged(task.id, async () => {
+      admissionStore.update(requestKey, { state: 'running' });
+      if (signal.aborted) throw signal.reason ?? new Error('SelfImplement aborted');
+      const result = await dispatchSelfImplement(args, { ...ctx, runId, signal }, run, authorGoal, runCli, seamsFactory);
+      if (signal.aborted) throw signal.reason ?? new Error('SelfImplement aborted');
+      if (result.kind === 'failed') throw new Error(result.reason);
+      admissionStore.update(requestKey, { state: 'done', result: JSON.stringify(result) });
+      return result;
+    }, (result) => JSON.stringify(result)).catch((error) => {
+      try { admissionStore.update(requestKey, { state: task.controller.signal.aborted ? 'aborted' : 'error', error: error instanceof Error ? error.message : String(error) }); } catch { /* registry remains authoritative for this process */ }
+      debug.log('daemon-tools.self-implement', 'managed-task-failed', {
+        runId, taskId: task.id, reason: error instanceof Error ? error.message : String(error),
+      }, { level: 'warn' });
+    })).finally(unsubscribeRunStop);
+  });
+  debug.log('daemon-tools.self-implement', 'managed-admitted', { runId, taskId: task.id, parentSessionId: ctx.sessionId ?? null });
+  return Promise.resolve({
+    kind: 'launched', runId, taskId: task.id, state: claim.record.state, ok: true,
+    message: `SelfImplement accepted · run ${runId} · task ${task.id}`,
+    next: `AgentOutput(${task.id})`, missing: [],
+  });
+}

package/src/boot/daemon-tools/types.ts

@@ -59,6 +59,8 @@ export interface DaemonToolDispatchCtx {
    *  the args. Optional for backward compat with tests / surfaces that
    *  build the ctx by hand without a session in scope. */
   sessionId?: string;
+  /** Caller-minted SelfImplement identity, propagated by managed dispatch. */
+  runId?: string;
   /** Trusted server-side classification of the current turn, never supplied as a tool argument. */
   requestOrigin?: RequestOrigin;
   /** Owner principal verified at the server request boundary, not from input source metadata. */

package/src/budget/llm-cost.ts

@@ -25,16 +25,49 @@ export interface LlmPricingUsd {
 }
 
 /** AWS Bedrock Global Standard prices, USD per million tokens (AWS pricing API, ap-northeast-2).
- *  ⛔ BEDROCK-COST-LEDGER(0.2.26) — mantle-openai 비-Anthropic Bedrock id(`openai.gpt-6-sol`·`zai.glm-5` 등
- *  `src/llm/bedrock.ts` BEDROCK_MODELS 의 `route:'mantle-openai'` 행)는 여기에 행이 «없다»: 단가 수치 근거가
- *  하나도 확보되지 않았다. 근거 없는 id는 `isBedrockPricingModel` 게이트(`claude-` 시작)를 지나지 않아
- *  `unknownCost()` 로 `kind:'unknown'` 에 머문다 — 0원으로 꾸미지 않는다. */
+ *  Anthropic(Claude) 축만 담는다 — 이 표는 `isBedrockPricingModel` 게이트(`claude-` 시작) 뒤에 있다.
+ *  ⛔ BEDROCK-COST-LEDGER(0.2.38) — mantle-openai 비-Anthropic id 는 «다른 표»
+ *  (`BEDROCK_NON_ANTHROPIC_PRICING_USD`)로 분리했다. 이 객체는 Claude 5.5 착지분 그대로다(보존 계약). */
 export const BEDROCK_PRICING_USD: Readonly<Record<string, LlmPricingUsd>> = {
   'claude-haiku-5-5': { inputPerM: 0.1, outputPerM: 0.5, cacheWritePerM: 0.125, cacheReadPerM: 0.01 },
   'claude-sonnet-5-5': { inputPerM: 2, outputPerM: 10, cacheWritePerM: 2.5, cacheReadPerM: 0.1 },
   'claude-opus-5-5': { inputPerM: 4, outputPerM: 20, cacheWritePerM: 5, cacheReadPerM: 0.2 },
 };
 
+/** Bedrock 비-Anthropic(mantle-openai) 단가의 근거 — AWS Price List API(`AmazonBedrock` offer,
+ *  us-east-1 = mantle-openai 고정 리전) 조회 결과. 게시 시각 2026-10-16T21:08:06Z.
+ *  재현: `awscurl`/SDK 로 `GetProducts`(serviceCode=AmazonBedrock, regionCode=USE1) 후
+ *  `USE1-<id>-mantle-{input,output}-tokens-standard` 키의 `pricePerUnit.USD` 를 읽는다(1K 토큰 단가 ×1000 = per-M).
+ *  ⛔ 근거 없는 id 는 표에 «넣지 않는다» — `kind:'unknown'` 에 머문다(0원으로 꾸미지 않는다). */
+export const BEDROCK_NON_ANTHROPIC_PRICING_USD: Readonly<Record<string, LlmPricingUsd>> = {
+  // AWS price list key: USE1-deepseek.v3.2-mantle-{input,output}-tokens-standard
+  'deepseek.v3.2': { inputPerM: 0.62, outputPerM: 1.85 },
+  // AWS price list key: USE1-zai.glm-4.7-flash-mantle-{input,output}-tokens-standard
+  'zai.glm-4.7-flash': { inputPerM: 0.07, outputPerM: 0.4 },
+  // AWS price list key: USE1-moonshotai.kimi-k2.5-mantle-{input,output}-tokens-standard
+  'moonshotai.kimi-k2.5': { inputPerM: 0.6, outputPerM: 3 },
+  // AWS price list key: USE1-qwen.qwen3-coder-next-mantle-{input,output}-tokens-standard
+  'qwen.qwen3-coder-next': { inputPerM: 0.5, outputPerM: 1.2 },
+  // AWS price list key: USE1-minimax.minimax-m2.5-mantle-{input,output}-tokens-standard
+  'minimax.minimax-m2.5': { inputPerM: 0.3, outputPerM: 1.2 },
+  // AWS price list key: USE1-mistral.devstral-2-123b-mantle-{input,output}-tokens-standard
+  'mistral.devstral-2-123b': { inputPerM: 0.4, outputPerM: 2 },
+  // ⛔ 근거 없음(AWS price list 조회 0행 → 표에 없음): openai.gpt-6-sol · openai.gpt-6-luna · zai.glm-5.
+  //    이 셋은 지금 mantle-openai 로 선택 가능하지만 단가 근거가 없으므로 `kind:'unknown'` 이 정직한 답이다.
+};
+
+/** Bedrock 비-Anthropic(mantle-openai) 단가 조회용 id 정규화 — invoke id 모양을 표의 키로 되돌린다.
+ *  - `bedrock/` 접두(레지스트리 별칭) · `us.`/`global.` 같은 리전 스코프 접두
+ *  - `-v1:0` 버전 꼬리 · `-20251001` 날짜 꼬리
+ *  Anthropic id(`anthropic.claude-…`)는 이 축이 아니다 — `bedrockPricingModelId` 가 맡는다. */
+export function bedrockNonAnthropicPricingModelId(model: string): string {
+  return model.trim()
+    .replace(/^bedrock\//, '')
+    .replace(/^(?:us|eu|apac|global)\./, '')
+    .replace(/-v1:\d+$/, '')
+    .replace(/-\d{8}$/, '');
+}
+
 export interface LlmCostUsage {
   model: string;
   inputTokens?: number;
@@ -202,7 +235,7 @@ function resolvePricing(
   model: string,
   opts?: EstimateLlmCostOptions,
 ): { pricing: LlmPricingUsd; source: 'catalog' | 'bedrock-catalog' | 'config' | 'registry' } | undefined {
-  // ⭐ 순서: 손 카탈로그(정확) → 정규화 id → config 오버레이 → Bedrock 표 → 저장소 정본 → 레지스트리. 앞이 이긴다.
+  // ⭐ 순서: 손 카탈로그(정확) → 정규화 id → config 오버레이 → Claude Bedrock 표 → 저장소 정본 → mantle Bedrock 표 → 레지스트리. 앞이 이긴다.
   const normalized = normalizePricingModelId(model);
   for (const id of normalized === model ? [model] : [model, normalized]) {
     const catalog = catalogPricing(id);
@@ -216,8 +249,14 @@ function resolvePricing(
     const bedrock = BEDROCK_PRICING_USD[bedrockPricingModelId(model)];
     if (validPricing(bedrock)) return { pricing: bedrock, source: 'bedrock-catalog' };
   }
+  // 저장소 정본이 mantle 표보다 우선한다. 같은 id 가 생기면 직접 모델 가격을 Bedrock 가격으로 덮지 않는다.
   const builtin = builtinCatalogPricing(normalized);
   if (validPricing(builtin)) return { pricing: builtin, source: 'catalog' };
+  // BEDROCK-COST-LEDGER(0.2.38) — mantle-openai 비-Anthropic 축: 근거 있는 행만 bedrock-catalog 로 값을 낸다.
+  // 표에 없는 id(openai.gpt-6-sol·zai.glm-5 등)는 여기서 결정되지 않아 아래 정본·레지스트리로 내려가고,
+  // 그것도 없으면 `unknownCost()` — 0원으로 꾸미지 않는다.
+  const mantle = BEDROCK_NON_ANTHROPIC_PRICING_USD[bedrockNonAnthropicPricingModelId(model)];
+  if (validPricing(mantle)) return { pricing: mantle, source: 'bedrock-catalog' };
   const registry = registryPricing(model);
   if (validPricing(registry)) return { pricing: registry, source: 'registry' };
   return undefined;

package/src/budget/shadow-arms.ts

@@ -75,3 +75,55 @@ export function planShadowArms(input: PlanShadowArmsInput): ShadowArmsPlan {
 
   return { fire, skipped, remainingUsd };
 }
+
+// ── SHADOW-MODEL-ARMS · 그림자 «1팔» probe(명시 실행 · 관측만) ─────────────────────
+/**
+ * ⭐ 그림자 1팔 probe — `planShadowArms` 를 일일 상한 안에서 «실제 호출»해
+ *   난이도·모델·예상/실제 비용·결과를 기록한다.
+ *   ⛔ 관측만 한다 — 라이브 LLM 호출 0 · 파일 원장 쓰기 0. 팔은 «계획»이고 실행은 후속 조각이다.
+ *   ⛔ 후보가 여러 개여도 첫 후보 «1팔»만 계획한다(저작 단계 팔은 단일 팔이다).
+ */
+export interface ShadowArmProbeRecord {
+  stage: ShadowStage;
+  difficulty: ShadowDifficulty;
+  model: string;
+  result: 'fire' | 'skipped';
+  skipReason: 'over-daily-cap' | 'unknown-price' | null;
+  expectedUsd: number | null;
+  actualUsd: number;
+  remainingUsd: number;
+}
+
+/** 그림자 1팔을 실제 호출해 기록을 낸다 — 실제 지출은 없다(계획만, actualUsd=0). */
+export function probeShadowArm(input: PlanShadowArmsInput): ShadowArmProbeRecord {
+  const model = input.candidates[0] ?? '';
+  const plan = planShadowArms({ ...input, candidates: [model] });
+  const fired = plan.fire[0];
+  const skipped = plan.skipped[0];
+  return {
+    stage: input.stage,
+    difficulty: input.difficulty,
+    model,
+    result: fired ? 'fire' : 'skipped',
+    skipReason: skipped?.reason ?? null,
+    expectedUsd: fired?.estUsd ?? null,
+    actualUsd: 0,
+    remainingUsd: plan.remainingUsd,
+  };
+}
+
+/** 한 줄 원장 형식 — 예상 비용이 없으면 `expectedUsd=unknown`, fire 사유는 `under-daily-cap` 이다. */
+export function formatShadowArmProbeRecord(record: ShadowArmProbeRecord): string {
+  const reason = record.skipReason ?? 'under-daily-cap';
+  const expectedUsd = record.expectedUsd === null ? 'unknown' : `${record.expectedUsd}`;
+  return [
+    `shadow-arm stage=${record.stage}`,
+    `difficulty=${record.difficulty}`,
+    `model=${record.model}`,
+    `result=${record.result}`,
+    `reason=${reason}`,
+    `expectedUsd=${expectedUsd}`,
+    `actualUsd=${record.actualUsd}`,
+    `remainingUsd=${record.remainingUsd}`,
+  ].join(' ');
+}

package/src/budget/unified-usage.ts

@@ -459,6 +459,16 @@ function subscriptionFromCodexSnapshot(snap: UsageSnapshot): SubscriptionAxis {
  *  📏 응답 모양(실측 2026-09-23): `{data:{total_credits, total_usage}}` (USD). */
 export const OPENROUTER_CREDITS_ENDPOINT = 'https://openrouter.ai/api/v1/credits';
 export const OPENROUTER_KEY_ENDPOINT = 'https://openrouter.ai/api/v1/key';
+
+/** 📏 CREDIT-READOUT 관측 — /key readout 이 «키 한도 note» 를 못 만든 이유를 남긴다.
+ *  note 없는 openrouter 행만 보면 «/key 를 안 불렀나 · 404 인가 · 한도가 null(무제한) 인가» 가
+ *  안 갈리므로 판단 근거를 로그에 남긴다(행·문면·원장 형식은 불변 — 진단 전용). */
+const OPENROUTER_KEY_UNAVAILABLE_EVENT = 'openrouter-key-unavailable';
+type OpenRouterKeyUnavailableReason = 'http-error' | 'limit-not-finite' | 'throw';
+function logOpenRouterKeyUnavailable(reason: OpenRouterKeyUnavailableReason, detail?: string): void {
+  debug.log('usage', OPENROUTER_KEY_UNAVAILABLE_EVENT, detail === undefined ? { reason } : { reason, detail });
+}
+
 async function collectOpenRouterRows(deps: UnifiedUsageDeps): Promise<AccountUsageRow[]> {
   // ⛔ 시험 런타임은 seam 이 없으면 «키 없음»으로 본다 — 키 캐시는 «파일»이라 env 스크럽을 통과해
   //   기존 시험들이 실제 네트워크를 치게 된다(seam 을 모르는 옛 시험이 다수).
@@ -497,10 +507,16 @@ async function collectOpenRouterRows(deps: UnifiedUsageDeps): Promise<AccountUsa
         if (typeof limit === 'number' && Number.isFinite(limit)
           && typeof limitRemaining === 'number' && Number.isFinite(limitRemaining)) {
           note = `키 한도 남은 금액 $${limitRemaining.toFixed(2)}`;
+        } else {
+          logOpenRouterKeyUnavailable('limit-not-finite',
+            `limit=${JSON.stringify(limit) ?? 'absent'} limit_remaining=${JSON.stringify(limitRemaining) ?? 'absent'}`);
         }
+      } else {
+        logOpenRouterKeyUnavailable('http-error', `http-${keyRes.status}`);
       }
-    } catch {
+    } catch (err) {
       // Key metadata is optional; preserve the successful credits row when unavailable.
+      logOpenRouterKeyUnavailable('throw', err instanceof Error ? err.message : String(err));
     }
     return [{
       ...base,

package/src/capture/tui-self-report.ts

@@ -125,6 +125,8 @@ export interface TuiControlTargetDeps {
   dims?: () => { readonly cols: number; readonly rows: number } | undefined;
   /** 외부 주입 라우터 — 글 한 줄을 사용자 버퍼에 섞지 않고 별도 대기열로 돌린다(`input/external-input-queue`). */
   routeExternal?: (chars: string) => ExternalInputRoute;
+  /** Active TUI turn cancellation hook; absent means there is no force-stop capability. */
+  stopTurn?: () => boolean;
 }
 
 function stdoutDims(): { cols: number; rows: number } | undefined {
@@ -136,6 +138,16 @@ export interface TuiControlTarget extends PtyControlTarget {
   deactivate(): void;
 }
 
+let activeTuiForceStop: (() => boolean) | null = null;
+
+/** Dashboard turn owner hook used by the foreground TUI's control target. */
+export function registerTuiForceStopHandler(handler: () => boolean): () => void {
+  activeTuiForceStop = handler;
+  return () => {
+    if (activeTuiForceStop === handler) activeTuiForceStop = null;
+  };
+}
+
 /** Adapt the foreground TUI's own terminal to the existing PTY control
  * protocol without pretending it is a spawned child process. */
 export function createTuiControlTarget(surfaceId: string, deps: TuiControlTargetDeps = {}): TuiControlTarget {
@@ -143,6 +155,7 @@ export function createTuiControlTarget(surfaceId: string, deps: TuiControlTarget
   const parse = deps.splitKeys ?? splitKeys;
   const dims = deps.dims ?? stdoutDims;
   const routeExternal = deps.routeExternal ?? routeExternalInput;
+  const stopTurn = deps.stopTurn ?? (() => activeTuiForceStop?.() ?? false);
   let alive = true;
   let accessMode: PtyAccessMode = 'write';
   let transitionPolicy: PtyTransitionPolicy = 'open';
@@ -160,6 +173,7 @@ export function createTuiControlTarget(surfaceId: string, deps: TuiControlTarget
       return true;
     },
     isAlive: () => alive,
+    stopTurn: (force: true) => force && stopTurn(),
     canWrite: (actor: PtyWriteActor = 'human') => resolveWriteDecision(accessMode, actor).allow,
     write(chars: string): void {
       // ⭐ 이 write 는 «바깥»(제어 IPC)에서만 온다 — 키보드와 섞이기 전에 라우터가 먼저 가른다.