elanous 0.2.4 → 0.2.5

package/src/autopilot/gh-rest-fallback.ts

@@ -0,0 +1,177 @@
+import { debug } from '../debug/log.js';
+import type { CmdResult, CmdRunner } from './pr-manager.js';
+
+type Pull = Record<string, unknown>;
+
+function flag(args: readonly string[], name: string): string | undefined {
+  const index = args.indexOf(name);
+  return index >= 0 ? args[index + 1] : undefined;
+}
+
+function hasOnlyFlags(args: readonly string[], start: number, valued: readonly string[], bare: readonly string[] = []): boolean {
+  for (let i = start; i < args.length; i++) {
+    if (bare.includes(args[i]!)) continue;
+    if (!valued.includes(args[i]!) || args[++i] === undefined) return false;
+  }
+  return true;
+}
+
+function repoFromOrigin(run: CmdRunner, opts?: { cwd?: string }): { owner: string; repo: string } | null {
+  const remote = run('git', ['remote', 'get-url', 'origin'], opts);
+  if (!remote.ok) return null;
+  const value = remote.out.trim();
+  let path: string;
+  try {
+    const url = new URL(value);
+    if (!['https:', 'ssh:'].includes(url.protocol) || url.hostname.toLowerCase() !== 'github.com') return null;
+    path = url.pathname;
+  } catch {
+    const scp = /^(?:[^@/]+@)?github\.com:([^\s]+)$/.exec(value);
+    if (!scp) return null;
+    path = scp[1]!;
+  }
+  const match = /^\/?([\w.-]+)\/([\w.-]+?)(?:\.git)?\/?$/.exec(path);
+  return match ? { owner: match[1]!, repo: match[2]! } : null;
+}
+
+function prNumber(value: string, owner: string, repo: string): string | null {
+  if (/^[1-9]\d*$/.test(value)) return value;
+  const match = /^https:\/\/github\.com\/([^/]+)\/([^/]+)\/pull\/([1-9]\d*)\/?$/.exec(value);
+  return match && match[1] === owner && match[2] === repo ? match[3]! : null;
+}
+
+function readPull(result: CmdResult): Pull | null {
+  if (!result.ok) return null;
+  try {
+    const value: unknown = JSON.parse(result.out);
+    return value && typeof value === 'object' && !Array.isArray(value) ? value as Pull : null;
+  } catch { return null; }
+}
+
+function pullField(pull: Pull, field: string): unknown {
+  switch (field) {
+    case 'state': return pull.merged_at ? 'MERGED' : pull.state === 'open' ? 'OPEN' : pull.state === 'closed' && pull.merged_at === null ? 'CLOSED' : undefined;
+    case 'isDraft': return pull.draft;
+    case 'baseRefName': return (pull.base as Pull | undefined)?.ref;
+    case 'headRefName': return (pull.head as Pull | undefined)?.ref;
+    case 'headRepository': {
+      const nameWithOwner = ((pull.head as Pull | undefined)?.repo as Pull | undefined)?.full_name;
+      return typeof nameWithOwner === 'string' ? { nameWithOwner } : undefined;
+    }
+    case 'mergeable': return pull.mergeable === true ? 'MERGEABLE' : pull.mergeable === false ? 'CONFLICTING' : pull.mergeable === null ? 'UNKNOWN' : undefined;
+    case 'mergeStateStatus': {
+      const state = pull.mergeable_state;
+      return typeof state === 'string' && ['behind', 'blocked', 'clean', 'dirty', 'draft', 'has_hooks', 'unknown', 'unstable'].includes(state)
+        ? state.toUpperCase() : undefined;
+    }
+    default: return undefined;
+  }
+}
+
+function restCall(run: CmdRunner, args: string[], opts?: { cwd?: string }): CmdResult {
+  return run('gh', ['api', ...args], opts);
+}
+
+/** Retry exactly once via REST after the secondary GraphQL limit; unsupported shapes fail closed. */
+export function withGhRestFallback(run: CmdRunner): CmdRunner {
+  return (cmd, args, opts) => {
+    const original = run(cmd, args, opts);
+    if (cmd !== 'gh' || args[0] !== 'pr' || original.ok ||
+        !/GraphQL/i.test(`${original.out}\n${original.err ?? ''}`) ||
+        !/API rate limit/i.test(`${original.out}\n${original.err ?? ''}`)) return original;
+    const sub = args[1];
+    if (!['list', 'view', 'create', 'edit', 'merge', 'comment'].includes(sub ?? '')) return original;
+    if (sub === 'list' && !args.includes('--json')) return original;
+    const location = repoFromOrigin(run, opts);
+    if (!location) return original;
+    const { owner, repo } = location;
+    const path = `repos/${owner}/${repo}`;
+    let result: CmdResult | null = null;
+
+    if (sub === 'list' && args[2] === '--head' && args[3] && args[4] === '--state' && args[5] === 'open' &&
+        args[6] === '--json' && args[7] === 'url' &&
+        (args.length === 8 || (args.length === 10 && args[8] === '--jq' && args[9] === '.[0].url // ""'))) {
+      const listed = restCall(run, [`${path}/pulls?head=${encodeURIComponent(`${owner}:${args[3]}`)}&state=open`], opts);
+      if (listed.ok) {
+        try {
+          const items: unknown = JSON.parse(listed.out);
+          if (Array.isArray(items) && items.every((item) => item && typeof item.html_url === 'string')) {
+            const urls = items.map((item) => ({ url: item.html_url as string }));
+            result = { ok: true, out: args[8] === '--jq' ? (urls[0]?.url ?? '') : JSON.stringify(urls) };
+          }
+        } catch { /* malformed REST response */ }
+      } else result = listed;
+    } else if (sub === 'view' && args[2] && args[3] === '--json' && args[4] &&
+        hasOnlyFlags(args, 5, ['--jq', '-q'])) {
+      const number = prNumber(args[2], owner, repo);
+      const fields = args[4].split(',');
+      const jq = flag(args, '--jq') ?? flag(args, '-q');
+      if (number && fields.every((field) => ['state', 'isDraft', 'mergeable', 'baseRefName', 'mergeStateStatus', 'headRefName', 'headRepository'].includes(field)) &&
+          (!jq || (fields.length === 1 && jq === `.${fields[0]}`))) {
+        const response = restCall(run, [`${path}/pulls/${number}`], opts);
+        const pull = readPull(response);
+        if (pull) {
+          const mapped = Object.fromEntries(fields.map((field) => [field, pullField(pull, field)]));
+          if (Object.values(mapped).every((value) => value !== undefined)) {
+            const selected = mapped[fields[0]!];
+            result = { ok: true, out: jq
+              ? typeof selected === 'string' ? selected : JSON.stringify(selected)
+              : JSON.stringify(mapped) };
+          }
+        } else if (!response.ok) result = response;
+      }
+    } else if (sub === 'create' && hasOnlyFlags(args, 2, ['--head', '--title', '--body', '--base'], ['--draft']) &&
+        flag(args, '--head') && flag(args, '--title') !== undefined && flag(args, '--body') !== undefined) {
+      let base = flag(args, '--base');
+      if (!base) {
+        const repository = restCall(run, [path], opts);
+        if (!repository.ok) result = repository;
+        else {
+          const defaultBranch = readPull(repository)?.default_branch;
+          if (typeof defaultBranch === 'string' && defaultBranch) base = defaultBranch;
+        }
+      }
+      if (base) {
+        const parameters = ['-f', `head=${flag(args, '--head')}`, '-f', `title=${flag(args, '--title')}`, '-f', `body=${flag(args, '--body')}`, '-f', `base=${base}`];
+        if (args.includes('--draft')) parameters.push('-F', 'draft=true');
+        const response = restCall(run, ['--method', 'POST', `${path}/pulls`, ...parameters], opts);
+        const pull = readPull(response);
+        if (pull && typeof pull.html_url === 'string') result = { ok: true, out: pull.html_url };
+        else if (!response.ok) result = response;
+      }
+    } else if (sub === 'edit' && args[2] && hasOnlyFlags(args, 3, ['--title', '--body', '--base']) &&
+        flag(args, '--title') !== undefined && flag(args, '--body') !== undefined) {
+      const number = prNumber(args[2], owner, repo);
+      if (number) {
+        const parameters = ['-f', `title=${flag(args, '--title')}`, '-f', `body=${flag(args, '--body')}`];
+        if (flag(args, '--base')) parameters.push('-f', `base=${flag(args, '--base')}`);
+        const response = restCall(run, ['--method', 'PATCH', `${path}/pulls/${number}`, ...parameters], opts);
+        if (readPull(response)) result = { ok: true, out: '' };
+        else if (!response.ok) result = response;
+      }
+    } else if (sub === 'merge' && args[2] && args[3] === '--squash' && args.length === 4) {
+      const number = prNumber(args[2], owner, repo);
+      if (number) {
+        const head = restCall(run, [`${path}/pulls/${number}`], opts);
+        const sha = (readPull(head)?.head as Pull | undefined)?.sha;
+        if (typeof sha === 'string' && /^[a-f0-9]{40}$/.test(sha)) {
+          const response = restCall(run, ['--method', 'PUT', `${path}/pulls/${number}/merge`, '-f', 'merge_method=squash', '-f', `sha=${sha}`], opts);
+          const body = readPull(response);
+          if (body?.merged === true) result = { ok: true, out: '' };
+          else if (!response.ok) result = response;
+        } else if (!head.ok) result = head;
+      }
+    } else if (sub === 'comment' && args[2] && args[3] === '--body' && args[4] !== undefined && args.length === 5) {
+      const number = prNumber(args[2], owner, repo);
+      if (number) {
+        const response = restCall(run, ['--method', 'POST', `${path}/issues/${number}/comments`, '-f', `body=${args[4]}`], opts);
+        if (readPull(response)) result = { ok: true, out: '' };
+        else if (!response.ok) result = response;
+      }
+    }
+    if (!result) return original;
+    debug.log('autopilot.pr', 'rest-fallback', { sub, ok: result.ok });
+    process.stderr.write(`[gh] REST 폴백: pr ${sub}\n`);
+    return result;
+  };
+}

package/src/autopilot/pr-manager.ts

@@ -9,11 +9,14 @@
 // 구현을 교체(누적 아님). 기존 PR 없으면 새로 생성.
 
 import { spawnSync } from 'node:child_process';
+import { githubAutomationToken } from '../auth/github-app-token.js';
 import { debug } from '../debug/log.js';
+import { POD_GITHUB_CREDENTIAL_TOKEN_ENV, POD_GITHUB_CREDENTIAL_URL_ENV } from '../nexus/api/pod-credential-api.js';
 import { runGitWithRetry } from '../git-fs/retry.js';
 import { DEFAULT_BRANCH_WORKTREE_BASE } from '../git-fs/worktree.js';
 import { isElanousRuntimeArtifactPath } from '../self-implement/gate-scope.js';
 import { isTransientExecutionFailure } from '../self-dev/execution-transient.js';
+import { withGhRestFallback } from './gh-rest-fallback.js';
 
 /** ★ stderr 캡처(대표 2026-07-21·관측 갭) — 종전엔 stdout 만 담아 git/gh 실패 사유가 소실됐다
  *  (705308: makePr 실패가 bare null 로 뭉뚱그려져 triage 가 "인증·네트워크"로 환각 오라우팅).
@@ -22,12 +25,55 @@ export interface CmdResult { ok: boolean; out: string; err?: string }
 /** 명령 실행 추상화(주입형·테스트 스텁) — git/gh 를 실제로 돌리지 않고 로직 검증. */
 export type CmdRunner = (cmd: string, args: readonly string[], opts?: { cwd?: string }) => CmdResult;
 
+const GH_TOKEN_REFRESH_WINDOW_MS = 10 * 60_000;
+let cachedRelayToken: { url: string; bearer: string; original: string | undefined; token: string; expiresAt: number } | undefined;
+
+/** The runner is synchronous; ask the host relay synchronously before starting gh. */
+function relayGhToken(env: NodeJS.ProcessEnv): string | null {
+  const url = env[POD_GITHUB_CREDENTIAL_URL_ENV];
+  const bearer = env[POD_GITHUB_CREDENTIAL_TOKEN_ENV];
+  if (!url || !bearer) return null;
+  const now = Date.now();
+  const original = env.GH_TOKEN;
+  if (cachedRelayToken?.url === url && cachedRelayToken.bearer === bearer && cachedRelayToken.original === original
+    && now + GH_TOKEN_REFRESH_WINDOW_MS < cachedRelayToken.expiresAt) return cachedRelayToken.token;
+  try {
+    const response = spawnSync('curl', [
+      '--silent', '--show-error', '--fail', '--noproxy', '*', '--max-time', '10',
+      '--request', 'POST', '--header', '@-', url,
+    ], { input: `Authorization: Bearer ${bearer}\n`, encoding: 'utf8', timeout: 12_000, maxBuffer: 64 * 1024, env });
+    if (response.error || response.status !== 0) throw new Error('request-failed');
+    const body: unknown = JSON.parse(response.stdout);
+    const token = body && typeof body === 'object' ? (body as { token?: unknown }).token : undefined;
+    const expiry = body && typeof body === 'object' ? (body as { expires_at?: unknown }).expires_at : undefined;
+    const expiresAt = typeof expiry === 'string' ? Date.parse(expiry) : NaN;
+    if (typeof token !== 'string' || !token || !Number.isFinite(expiresAt) || expiresAt <= now + GH_TOKEN_REFRESH_WINDOW_MS) throw new Error('invalid-response');
+    cachedRelayToken = { url, bearer, original, token, expiresAt };
+    return token;
+  } catch {
+    debug.log('pr-manager', 'gh-token', { reason: 'refresh-failed' }, { level: 'warn' });
+    return cachedRelayToken?.url === url && cachedRelayToken.bearer === bearer && cachedRelayToken.original === original
+      && now < cachedRelayToken.expiresAt ? cachedRelayToken.token : null;
+  }
+}
+
+/** Environment for a `gh` call made by automation: the Pod relay token, else the GitHub App token when the
+ *  caller set no GH_TOKEN — so PRs, merges and PR comments all act as the App, not the person logged into `gh`. */
+export function ghAutomationEnv(env: NodeJS.ProcessEnv = process.env, appToken: () => string | null = githubAutomationToken): NodeJS.ProcessEnv {
+  const token = relayGhToken(env) ?? (!Object.hasOwn(env, 'GH_TOKEN') ? appToken() : null);
+  return token ? { ...env, GH_TOKEN: token } : env;
+}
+
 /** 기본 러너 — spawnSync(dep-free). 실패/예외는 ok=false. stdout·stderr 모두 캡처. */
 export const defaultCmdRunner: CmdRunner = (cmd, args, opts) => {
   try {
-    // env: process.env — 최소 PATH(cron)에서도 ensure-bin-path 보강 PATH 로 gh 를 찾도록 명시 전달.
-    const r = spawnSync(cmd, [...args], { encoding: 'utf-8', timeout: 120_000, env: process.env, ...(opts?.cwd ? { cwd: opts.cwd } : {}) });
-    return { ok: r.status === 0, out: (r.stdout ?? '').trim(), err: (r.stderr ?? '').trim() };
+    // Relay only applies to gh; without it, retain caller GH_TOKEN and the existing App fallback.
+    const env = cmd === 'gh' ? ghAutomationEnv(process.env) : process.env;
+    // bun ≥1.4 applies Node's 1MB default maxBuffer and silently truncates (`gh pr diff`, file lists) — raise it and
+    // never read an overflow as success.
+    const r = spawnSync(cmd, [...args], { encoding: 'utf-8', timeout: 120_000, maxBuffer: 256 * 1024 * 1024, env, ...(opts?.cwd ? { cwd: opts.cwd } : {}) });
+    const overflow = (r.error as NodeJS.ErrnoException | undefined)?.code === 'ENOBUFS';
+    return { ok: r.status === 0 && !overflow, out: (r.stdout ?? '').trim(), err: [(r.stderr ?? '').trim(), overflow ? 'output exceeded 256MiB (ENOBUFS)' : ''].filter(Boolean).join('\n') };
   } catch (e) { return { ok: false, out: '', err: e instanceof Error ? e.message : String(e) }; }
 };
 
@@ -259,7 +305,8 @@ function isTransientPushFailure(detail: string): boolean {
 }
 
 /** ★ PR 매니저 팩토리(대표 2026-07-12) — CmdRunner 주입(테스트 스텁). 실 배선은 기본 러너. */
-export function makePrManager(run: CmdRunner = defaultCmdRunner): PrManager {
+export function makePrManager(runner: CmdRunner = defaultCmdRunner): PrManager {
+  const run = withGhRestFallback(runner);
   const findPrForBranchOutcome = (branch: string, cwd?: string): FindPrForBranchOutcome => {
     // ⛔ 표식은 base 를 「생략했다」는 뜻이지 브랜치 이름이 아니다. 그대로 `gh --head` 로 넘기면
     //    gh 가 `no pull requests found for branch "elanous:default-branch"` 를 stderr 로 뱉는다.

package/src/boot/acp-server.ts

@@ -24,14 +24,14 @@
 // no dashboard, no tui-client — verified by the expanded guard
 // test.
 
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { mkdirSync } from 'node:fs';
 import { getElanousConfigDir } from '../elanous-config-dir.js';
 import { dirname, join as joinPath } from 'node:path';
+import { ensureAuthToken } from '../auth/acp-token.js';
 
 import {
   listenUnixSocket,
   listenWebSocket,
-  generateAuthToken,
   createAuthVerifier,
 } from '../acp/transport/index.js';
 import { runAcpServer, type AcpServerOptions } from '../acp/server.js';
@@ -110,20 +110,6 @@ export function parseAcpBootArgs(argv: readonly string[]): AcpBootOptions {
   return opts;
 }
 
-/** Load or mint a persistent auth token for websocket boot. Stored
- *  at `~/.elanous/acp-token` with 0600 perms so the socket-holding
- *  user can bind-mount it into a parent client config. */
-function ensureAuthToken(): { token: string; path: string } {
-  const tokenPath = joinPath(getElanousConfigDir(), 'acp-token');
-  mkdirSync(dirname(tokenPath), { recursive: true });
-  if (existsSync(tokenPath)) {
-    return { token: readFileSync(tokenPath, 'utf-8').trim(), path: tokenPath };
-  }
-  const token = generateAuthToken();
-  writeFileSync(tokenPath, token, { mode: 0o600 });
-  return { token, path: tokenPath };
-}
-
 /** Resolved daemon-runtime status surfaced in the startup banner.
  *  Matches the shape returned by `createDaemonRuntime()` so callers
  *  can spread it directly. Lets every transport (stdio / unix-socket

package/src/boot/daemon-tools/web-search.ts

@@ -39,7 +39,8 @@ export function buildWebSearchTool(): LLMToolSpec {
     name: 'WebSearch',
     description:
       'Search the public web via the daemon\'s configured provider (Grok / ' +
-      'Firecrawl / etc.). Returns a ranked list of URLs + titles + snippets. ' +
+      'Firecrawl / etc.). When no key is available, falls back to keyless DuckDuckGo. ' +
+      'Returns a ranked list of URLs + titles + snippets. ' +
       'Pair with a follow-up Read or external WebFetch when the model needs ' +
       'the full article body.',
     parameters: {

package/src/boot/ws-bridge.ts

@@ -26,6 +26,7 @@ import type {
   PwaVoiceSession,
 } from '../voice/channel-adapters/pwa-voice-adapter.js';
 import { PWA_VOICE_FRAME_KIND } from '../voice/channel-adapters/pwa-voice-adapter.js';
+import { isSameOriginRequest } from './check-same-origin.js';
 import {
   buildDevProxyWsUrl,
   closeDevProxyUpstream,
@@ -47,6 +48,8 @@ export type WsLike = {
 
 export type BunServerLike = {
   upgrade: (req: Request, opts?: { data?: unknown; headers?: HeadersInit }) => boolean;
+  /** Bun's transport peer — used only for the same-origin exemption (HTTP 과 같은 규칙). */
+  requestIP?: (req: Request) => { address: string } | null;
 };
 
 export type WsHandlers = {
@@ -246,6 +249,14 @@ export function createWsBridge(opts: WsBridgeOpts): WsBridge {
             });
           }
           authed = true;
+        } else if (isSameOriginRequest(req, server.requestIP?.(req)?.address)) {
+          // ⭐ HTTP 의 same-origin 면제(`meta-api.ts` decideAuth)와 «같은» 규칙 — 루프백 직결 ⊕ 프록시 표지 없음 ⊕
+          //   Sec-Fetch-Site/Origin 이 같은 출처. 이 데몬이 내준 PWA 페이지가 토큰 없이 연 소켓이다.
+          // 🩸 2026-09-30 0.2.5 회귀: #21937 이 토큰을 «늘» 만들게 되면서 WS 검증기가 늘 켜졌고, 토큰을
+          //   저장하지 않은 PWA(새 설치 · 격리 넥서스)의 ACP 가 첫 `initialize` 에서 1008 auth_failed 로 닫혔다
+          //   — HTTP 는 이 면제로 살아 있어 «목록은 뜨는데 채팅·터미널만 죽는» 모양이 됐다.
+          authed = true;
+          trace('acp.ws.same-origin', { path: url.pathname });
         }
       }
       const acpState: AcpPerSocketState = {

package/src/chat/index.ts

@@ -107,9 +107,27 @@ import {
 import { resolveTextInputControlAction } from './input-control-key.js';
 import { resolveTextInputEditAction } from './input-edit-key.js';
 import { resolveTextInputTextAction } from './input-text-key.js';
+import { classifyLeftoverInput, summarizeSubmitText } from './submit-trace.js';
 
 import { perf } from '../perf-counters.js';
 
+let lastSubmitAt: number | null = null;
+
+function traceAfterSubmitKey(key: Key): void {
+  if (lastSubmitAt === null) return;
+  const withinMs = Date.now() - lastSubmitAt;
+  if (withinMs > 1000) {
+    lastSubmitAt = null;
+    return;
+  }
+  if (key.ctrl || key.alt) return;
+  const input = key.name === 'paste' ? key.paste ?? '' : key.name;
+  if (!input || (key.name !== 'paste' && [...input].length !== 1)) return;
+  lastSubmitAt = null;
+  const kind = classifyLeftoverInput(input, withinMs);
+  if (kind) debug.log('chat.input.leftover', 'after-submit', { withinMs, kind });
+}
+
 /** Row where the input prompt starts — set by the textInput paint
  *  loop so writeTerminal knows which rows to invalidate in the
  *  frame cache. Falls back to "invalidate everything" when unknown
@@ -419,14 +437,14 @@ export const SLASH_COMMANDS: SlashCommand[] = [
   // B4 — craft rulebook verdict, same resolution as `elanous repo design-check`
   //   and the PWA `/design-check` panel. Listed (not baselined as hidden) on
   //   purpose: a surface nobody can discover is not a surface.
-  { name: 'design',    aliases: ['design-check'], description: 'Craft rulebooks — 이 저장소 DESIGN.md 가 선언한 규칙집 · 못 찾은 것 · elanous 가 주는데 선언 안 된 것. /design [--declared] · /design pick [번호|id] 디자인 방향 선택', subcommands: ['--declared', 'pick'] },
+  { name: 'design',    aliases: ['design-check'], description: 'Design rulebooks this repository declares · /design [--declared] · /design pick [number|id] to choose a design direction', subcommands: ['--declared', 'pick'] },
   { name: 'provider',  aliases: ['p'],          description: 'LLM providers — /provider (list) · next (cycle, also Alt+M / pill click) · use <name> · pick (visual picker) · reset', subcommands: ['next', 'use', 'pick', 'picker', 'menu', 'reset', 'list'] },
   { name: 'reasoning', aliases: ['r', 'think'],  description: 'Reasoning level (codex effort + summary, anthropic extended-thinking budget) — /reasoning [off|low|medium|high|xhigh] (cycle when no arg · xhigh 는 모델 상한이 xhigh 이상일 때만 wire 에 실린다, 아니면 high 로 깎인다)', subcommands: ['off', 'low', 'medium', 'high', 'xhigh'] },
   { name: 'model',     aliases: ['m'],           description: 'Switch active model — /model <codex|terra|sol|luna|opus|sonnet|grok> (list + current when no arg). OpenAI 는 Codex(Responses API)만. effort 는 /reasoning.', subcommands: ['codex', 'terra', 'sol', 'luna', 'opus', 'sonnet', 'grok'] },
   { name: 'local',     aliases: ['ll'],         description: 'Local OpenAI-compatible LLM — ping / models / test / use', subcommands: ['ping', 'models', 'test', 'use', 'status'] },
   { name: 'session',   aliases: ['sess'],       description: 'Session resume — list / load / sync / new (handoff from mobile)', subcommands: ['list', 'load', 'sync', 'new'] },
-  { name: 'resume',    aliases: [],             description: 'Resume session — 픽커에서 선택 · /resume <id-prefix> 즉시 로드 (TUI 부활 S-a)' },
-  { name: 'fork',      aliases: [],             description: 'Fork — 현 시점 전체 복사로 새 세션 분기 (codex /fork 동형)' },
+  { name: 'resume',    aliases: [],             description: 'Pick a past session, or load one by id prefix · /resume <id-prefix>' },
+  { name: 'fork',      aliases: [],             description: 'Copy this session into a new one' },
   { name: 'rewind',    aliases: [],             description: 'Rewind — 과거 user 턴 픽커로 되감기 (원본 보존 · 새 세션 분기 · /rewind <n> 숏컷)' },
   // TUI 부활 C-a (2026-07-12): autopilot 미션 TUI 표면 — CLI 동등 단일 창구 소비.
   { name: 'mission',   aliases: [],             description: 'Autopilot 미션 — list(+헬스) · trace <id> 계보 · arm <id> 승인 (구체화/종료는 CLI)', subcommands: ['list', 'trace', 'arm'] },
@@ -468,7 +486,7 @@ export const SLASH_COMMANDS: SlashCommand[] = [
   { name: 'acp',    aliases: [], description: 'ACP chat — stream claude-code / codex / gemini replies into the chat pane (not a VW spawn). /acp codex points at the canonical codex app-server path; /acp cas is a synonym.', subcommands: ['claude', 'codex', 'gemini', 'cas', 'cancel', 'status', 'drop'] },
   { name: 'conv', aliases: [], description: 'Conversation widget/popup host — /conv list · /conv open <session-id> · /conv layout <cascade|tile|stack> · /conv focus <next|prev>.', subcommands: ['list', 'ls', 'open', 'layout', 'focus'] },
   { name: 'handoff', aliases: [], description: 'H5 P3 cross-agent context handoff: /handoff <from_session_id> <to_brand> [--channels r,p,m] [--prompt "prefix"]. Takes source session snapshot (filtered by channels if observer present) and launches target via adapter registry. Brands: codex · claude · claude-code · gemini · elanous.' },
-  { name: 'remaining', aliases: [], description: '계정마다 행으로 「지금 쓸 수 있는 것이 얼마나 남았나」를 본다 — 크레딧 축과 구독 축을 갈라 낸다. 화면은 명령 산출을 그대로 읽는다.' },
+  { name: 'remaining', aliases: [], description: 'What each account has left' },
   { name: 'agent-room', aliases: [], description: 'H6 P4 VW agent-room — /agent-room <N> <brands...> · /agent-room list · /agent-room close <id> · N ∈ {2,3,4} · brands: codex/claude/gemini/elanous/auto/lll:<m>', subcommands: ['list', 'close', 'preset', 'help'] },
   { name: 'showroom', aliases: ['sr'], description: 'Showroom v2 multi-LLM lane composer — /showroom (default 2-pane) · /showroom <lane1> <lane2> [<lane3> [<lane4>]] · lane = role:provider[:transport] · roles plan/build/exec/review/reflect · pair with /lane and /relay for cross-lane handoffs.', subcommands: ['help'] },
   { name: 'reply',   aliases: [], description: 'H6 P5 AgentReply — /reply <target-session-id> <message...> · send message to a live session, capture the response · flags: --from · --channels r,m · --idle-ms · --timeout-ms', subcommands: ['help'] },
@@ -701,6 +719,8 @@ export async function textInput(opts: {
    *  typing. The host is expected to mutate its own state; the input
    *  redraws the bar + picker on top afterward. */
   onMouse?: (mouse: { row: number; col: number; type: 'click' | 'double-click' | 'right-click' | 'scroll-up' | 'scroll-down' | 'drag' | 'release'; shift?: boolean }) => void | boolean | Promise<void | boolean>;
+  /** Scroll the host's chat log from the input without editing its buffer. */
+  onScrollKey?: (name: 'pageup' | 'pagedown') => boolean | void;
   /** MX11b — key interceptor called BEFORE textInput's own key
    *  handling. Host returns 'consumed' to short-circuit the event
    *  (no further input processing), 'passthrough' to let the default
@@ -1331,13 +1351,15 @@ export async function textInput(opts: {
     writeTerminal(endTextInputCursor(opts.cursorSink));
     return result;
   };
-  const submitBufferResult = (text: string): InputResult => (
-    finalizeInput({
+  const submitBufferResult = (text: string): InputResult => {
+    debug.log('chat.input.submit', 'summary', summarizeSubmitText(text.trim()));
+    lastSubmitAt = Date.now();
+    return finalizeInput({
       text: text.trim(),
       submitted: true,
       ...(pendingExternalSubmitSource ? { externalSubmitSource: pendingExternalSubmitSource } : {}),
-    })
-  );
+    });
+  };
   const currentBufferText = (): string => lines.join('\n').trim();
 
   // Expose drawAll so the host can ping us to re-paint after an
@@ -1401,6 +1423,7 @@ export async function textInput(opts: {
     }
 
     const key = await (opts.readKey ?? (() => readKey('input')))();
+    traceAfterSubmitKey(key);
 
     // Raw-key trace — diagnoses "modifier bit dropped before global-action
     // matcher saw the chord" cases (e.g. tablet terminal apps that
@@ -1627,6 +1650,11 @@ export async function textInput(opts: {
       }
     }
 
+    if (!key.ctrl && (key.name === 'pageup' || key.name === 'pagedown') && opts.onScrollKey) {
+      if (opts.onScrollKey(key.name) !== false) drawAll();
+      continue;
+    }
+
     const controlAction = resolveTextInputControlAction(key, {
       currentLine: lines[lineIdx] ?? '',
       cursor: colIdx,
@@ -1897,6 +1925,7 @@ export function attachStreamingKeys(
   };
   function deliver(keys: readonly Key[]): void {
     for (const key of keys) {
+      traceAfterSubmitKey(key);
       traceKey(key, 'stream');
       try {
         const r = handler(key);

package/src/chat/log-scroll-key.ts

@@ -0,0 +1,12 @@
+export function nextChatScrollOffset(
+  current: number,
+  key: 'pageup' | 'pagedown',
+  pageSize: number,
+  maxOffset: number,
+): number {
+  if (maxOffset <= 0) return -1;
+  const offset = current < 0 ? maxOffset : Math.max(0, Math.min(current, maxOffset));
+  if (key === 'pageup') return Math.max(0, offset - pageSize);
+  const next = offset + pageSize;
+  return next >= maxOffset ? -1 : next;
+}

package/src/chat/submit-trace.ts

@@ -0,0 +1,30 @@
+const LONE_JAMO = /[\u3131-\u318e\u1100-\u11ff]/u;
+const HANGUL_SYLLABLE = /[\uac00-\ud7a3]/u;
+
+export function summarizeSubmitText(text: string): {
+  chars: number;
+  lines: number;
+  lastIsLoneJamo: boolean;
+  loneJamoCount: number;
+  hasHangul: boolean;
+} {
+  const characters = [...text];
+  const loneJamoCount = characters.filter(char => LONE_JAMO.test(char)).length;
+  return {
+    chars: characters.length,
+    lines: text.split('\n').length,
+    lastIsLoneJamo: LONE_JAMO.test(characters.at(-1) ?? ''),
+    loneJamoCount,
+    hasHangul: loneJamoCount > 0 || HANGUL_SYLLABLE.test(text),
+  };
+}
+
+export function classifyLeftoverInput(
+  input: string,
+  msSinceSubmit: number,
+): 'syllable' | 'jamo' | null {
+  if (msSinceSubmit < 0 || msSinceSubmit > 1000 || [...input].length !== 1) return null;
+  if (HANGUL_SYLLABLE.test(input)) return 'syllable';
+  if (LONE_JAMO.test(input)) return 'jamo';
+  return null;
+}

package/src/cli/agent-cli.ts

@@ -1,7 +1,7 @@
 import type { Command } from 'commander';
 import { resolve } from 'node:path';
 import { getUserConfig, reloadUserConfig } from '../user-config.js';
-import { needsOnboarding, runOnboarding } from '../onboarding.js';
+import { handleOnboardingRefusal, needsOnboarding, runOnboarding } from '../onboarding.js';
 import { runTurn, ensureCliSession, sessionBudget } from '../session/chat.js';
 import { NoLlmProviderAvailableError, noProviderAvailableMessage } from '../llm.js';
 import { resolveSessionId, getActiveSessionId, setActiveSessionId } from '../session/index.js';
@@ -93,7 +93,12 @@ export function registerAgentCommands(program: Command): void {
     const cfg = getUserConfig();
     if (needsOnboarding(cfg)) {
       ui.info('No config yet — launching setup wizard first.');
-      await runOnboarding();
+      try {
+        await runOnboarding();
+      } catch (error) {
+        if (handleOnboardingRefusal(error, 'agent')) return;
+        throw error;
+      }
     }
     const refreshed = reloadUserConfig();
     await runChatTurnCli({

package/src/cli/decisions-cli.ts

@@ -0,0 +1,94 @@
+import type { Command } from 'commander';
+import { DecisionLedger, importDecisionMarkdown, type DecisionCategory, type DecisionLedgerOptions, type DecisionOption, type DecisionTrack, type DecisionEntry } from '../decisions/decision-ledger.js';
+
+const repeat = (value: string, values: string[]) => [...values, value];
+function date(raw?: string): string | undefined {
+  if (!raw) return undefined;
+  const days = /^(\d+)d$/.exec(raw);
+  const parsed = days ? new Date(Date.now() - Number(days[1]) * 86400000) : new Date(raw);
+  if (!Number.isFinite(parsed.getTime())) throw new Error(`invalid since: ${raw}`);
+  return parsed.toISOString();
+}
+const kst = (at: string) => new Intl.DateTimeFormat('sv-SE', { timeZone: 'Asia/Seoul', dateStyle: 'short', timeStyle: 'medium' }).format(new Date(at)) + ' KST';
+const version = (e: DecisionEntry['version']) => e ? `released=${e.released ?? '-'} · dev=${e.dev ?? '-'}${e.codename ? ` «${e.codename}»` : ''}` : '판 미상';
+function agent(o?: string): string {
+  const value = o?.trim() || process.env.AI_AGENT?.trim();
+  if (!value) throw new Error('agent unknown: provide --agent or AI_AGENT');
+  return value;
+}
+function parseOption(raw: string): DecisionOption {
+  const m = /^([a-z])=(.+?):(.+)$/.exec(raw);
+  if (!m) throw new Error(`invalid --option: ${raw} (expected a=label:consequence)`);
+  return { key: m[1]!, label: m[2]!, consequence: m[3]! };
+}
+export function formatDecisionRow(e: DecisionEntry): string {
+  const recommendation = 'skipped' in e.recommendation ? '권고 생략' : `${e.recommendation.option} (${e.recommendation.why})`;
+  return `${e.id} · ${e.category} · ${e.title} · ${recommendation} · ${e.raisedAt ? kst(e.raisedAt) : '올린 시각 미상'} · ${version(e.version)}`;
+}
+export function formatDecisionDetail(e: DecisionEntry): string {
+  return [formatDecisionRow(e), `상태: ${e.status}`, `S: ${e.scqa.s}`, `C: ${e.scqa.c}`, `Q: ${e.scqa.q ?? '(비움)'}`, `A: ${e.scqa.a ?? '(비움)'}`,
+    '선택지 | 결과', ...(e.options.length ? e.options.map(o => `${o.key}: ${o.label} | ${o.consequence}`) : ['원문에 선택지 없음 · 확인 필요']),
+    'skipped' in e.recommendation ? `권고 생략: ${e.recommendation.reason}` : `권고: ${e.recommendation.option} — ${e.recommendation.why}`,
+    `올림: ${e.raisedAt ? kst(e.raisedAt) : '시각 미상'} · ${e.raisedBy.agent} · ${version(e.version)}`,
+    ...(e.importedAt ? [`가져옴: ${kst(e.importedAt)}`] : []),
+    ...(e.status === 'decided' ? [`결정: ${e.decidedAt ? kst(e.decidedAt) : '시각 미상'} · ${e.decidedBy?.kind === 'auto' ? `AUTO ${e.decidedBy.agent} (${e.decidedBy.delegation})` : e.decidedBy?.kind === 'human' ? 'human' : '주체 미상'} · ${e.choice ?? '선택 키 미상'} · ${e.versionAtDecision ? version(e.versionAtDecision) : '결정 당시 판 미상'}`,
+      ...(e.note ? [`메모: ${e.note}`] : [])] : []),
+    ...(e.withdrawnAt ? [`철회: ${kst(e.withdrawnAt)} · ${e.withdrawReason}`] : []),
+    '이력:', ...e.history.map(h => `  ${h.type} · ${h.at ? kst(h.at) : '시각 미상'} · ${h.by}${h.choice ? ` · ${h.choice}` : ''}${h.reason ? ` · ${h.reason}` : ''} · ${h.version ? version(h.version) : '판 미상'}`),
+    ...(e.refs?.length ? [`참조: ${e.refs.join(' · ')}`] : [])].join('\n');
+}
+
+export function registerDecisionsCommands(program: Command, config: DecisionLedgerOptions = {}, out: Pick<Console, 'log'> = console): void {
+  const root = program.command('decisions').description('대표 결정 원장 · 로컬 전용');
+  const emit = (value: unknown, json?: boolean, text?: string) => out.log(json ? JSON.stringify(value) : text ?? JSON.stringify(value));
+  const fail = (action: () => void) => { try { action(); } catch (e) { throw new Error(`decisions: ${e instanceof Error ? e.message : String(e)}`); } };
+  root.command('raise').description('SCQA·선택지와 권고로 결정 항목을 올린다')
+    .requiredOption('--title <text>').requiredOption('--category <category>')
+    .requiredOption('--s <text>').requiredOption('--c <text>').option('--q <text>').option('--a <text>')
+    .requiredOption('--option <key=label:consequence>', '선택지 (두 번 이상)', repeat, [] as string[])
+    .option('--recommend <key>').option('--why <text>').option('--skip-recommend <reason>')
+    .option('--track <track>').option('--agent <agent>').option('--session <id>')
+    .option('--ref <url>', '참조 (반복)', repeat, [] as string[]).option('--json')
+    .action((o: { title: string; category: DecisionCategory; s: string; c: string; q?: string; a?: string; option: string[]; recommend?: string; why?: string; skipRecommend?: string; track?: DecisionTrack; agent?: string; session?: string; ref: string[]; json?: boolean }) => fail(() => {
+      if (o.skipRecommend !== undefined && (o.recommend !== undefined || o.why !== undefined)) throw new Error('choose recommendation or skip, not both');
+      if (o.skipRecommend === undefined && (!o.recommend || !o.why)) throw new Error('--recommend and --why required, or --skip-recommend <reason>');
+      const options: DecisionOption[] = o.option.map(parseOption);
+      const entry = new DecisionLedger(config).raise({ title: o.title, category: o.category, scqa: { s: o.s, c: o.c, ...(o.q ? { q: o.q } : {}), ...(o.a ? { a: o.a } : {}) }, options,
+        recommendation: o.skipRecommend !== undefined ? { skipped: true, reason: o.skipRecommend } : { option: o.recommend!, why: o.why! },
+        raisedBy: { agent: agent(o.agent), ...(o.track ? { track: o.track } : {}), ...(o.session ? { session: o.session } : {}) }, ...(o.ref.length ? { refs: o.ref } : {}) });
+      emit(entry, o.json, `올림: ${formatDecisionRow(entry)}`);
+    }));
+  root.command('list').description('결정 목록 (기본 열린 것)')
+    .option('--status <open|decided|all>', '기본 open', 'open').option('--since <date>').option('--version <version>')
+    .option('--decided-by <human|auto>').option('--category <category>').option('--json')
+    .action((o: { status: 'open' | 'decided' | 'all'; since?: string; version?: string; decidedBy?: 'human' | 'auto'; category?: DecisionCategory; json?: boolean }) => fail(() => {
+      const rows = new DecisionLedger(config).list({ status: o.status, since: date(o.since), version: o.version, decidedBy: o.decidedBy, category: o.category });
+      emit(rows, o.json, rows.length ? rows.map(formatDecisionRow).join('\n') : '결정 0건');
+    }));
+  root.command('show <id>').description('SCQA · 선택지 · 권고 · 이력 · 판').option('--json')
+    .action((id: string, o: { json?: boolean }) => fail(() => { const entry = new DecisionLedger(config).show(id); emit(entry, o.json, formatDecisionDetail(entry)); }));
+  root.command('decide <id> <option>').description('사람 또는 AUTO 위임 결정 기록')
+    .option('--note <text>').option('--auto').option('--delegation <reason>').option('--track <track>').option('--agent <agent>').option('--json')
+    .action((id: string, choice: string, o: { note?: string; auto?: boolean; delegation?: string; track?: DecisionTrack; agent?: string; json?: boolean }) => fail(() => {
+      if (o.auto && !o.delegation?.trim()) throw new Error('--auto requires --delegation');
+      if (!o.auto && (o.delegation || o.track || o.agent)) throw new Error('delegation/track/agent require --auto');
+      const by = o.auto ? { kind: 'auto' as const, agent: agent(o.agent), delegation: o.delegation!, ...(o.track ? { track: o.track } : {}) } : { kind: 'human' as const };
+      const entry = new DecisionLedger(config).decide(id, choice, by, o.note);
+      emit(entry, o.json, `결정: ${formatDecisionDetail(entry)}`);
+    }));
+  root.command('add-options <id>').description('선택지가 미기재된 과거 항목에 확인된 선택지를 추가')
+    .requiredOption('--option <key=label:consequence>', '선택지 (두 번 이상)', repeat, [] as string[])
+    .option('--agent <agent>').option('--json')
+    .action((id: string, o: { option: string[]; agent?: string; json?: boolean }) => fail(() => {
+      const entry = new DecisionLedger(config).addOptions(id, o.option.map(parseOption), agent(o.agent));
+      emit(entry, o.json, formatDecisionDetail(entry));
+    }));
+  root.command('withdraw <id>').description('결정 철회도 원장에 남긴다').requiredOption('--reason <reason>').option('--json')
+    .action((id: string, o: { reason: string; json?: boolean }) => fail(() => { const entry = new DecisionLedger(config).withdraw(id, o.reason); emit(entry, o.json, `철회: ${formatDecisionDetail(entry)}`); }));
+  root.command('import-markdown <file>').description('기존 대표 결정 문서 씨앗을 가져온다 (재실행 안전)').option('--json')
+    .action((file: string, o: { json?: boolean }) => fail(() => {
+      const result = importDecisionMarkdown(new DecisionLedger(config), file);
+      emit(result, o.json, `가져옴 ${result.imported.length} · 기존 ${result.existing.length} · 불완전 ${result.incomplete.length} · 못 읽음 ${result.unread.length}${result.incomplete.length ? `\n${result.incomplete.join('\n')}` : ''}${result.unread.length ? `\n${result.unread.join('\n')}` : ''}`);
+      if (result.unread.length) process.exitCode = 1;
+    }));
+}