elanous 0.2.42 → 0.2.44

package/src/cli/setup-cli.ts

@@ -1,6 +1,6 @@
-import { existsSync, readFileSync } from 'node:fs';
+import { accessSync, constants, existsSync, readFileSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { join } from 'node:path';
+import { delimiter, join } from 'node:path';
 import { createHash } from 'node:crypto';
 import { addSource, listSources } from '../intake-plane/intake-sources.js';
 import { effectiveInstanceRoot } from '../instance/resolve.js';
@@ -11,6 +11,18 @@ import { recommendedSetup } from './setup-recommend.js';
 import { detectSkillCliAuth, type CliAuthStatus } from '../onboarding/cli-auth-status.js';
 import { debug } from '../debug/log.js';
 import { getUserConfig, saveUserConfig, userConfigPath, type UserConfig } from '../user-config.js';
+import { collectServiceKeys, printKeySetupReport } from '../onboarding/key-setup.js';
+import { getSecretAsync, setSecretAsync } from '../nexus/config/secrets/index.js';
+import { probeProvider } from '../llm/provider-probe.js';
+import { createSecretPrompt } from '../onboarding/secret-prompt.js';
+import { realIO } from '../onboarding.js';
+import { parseServiceKeyEnv, readMaskedServiceEnvPaste } from '../setup/service-keys.js';
+import { importServiceKeys, renderServiceKeyStatus, runSetupKeys } from './setup-keys.js';
+import { SERVICE_KEY_CATALOG, type ServiceKeyCatalogEntry } from '../setup/llm-env-detect.js';
+import { serviceKeyStatus } from '../setup/service-keys.js';
+import { detectProviders } from '../llm/provider-detect.js';
+import { DEFAULT_PLUGIN_GROUP, defaultPluginStatuses } from '../plugins/install/plugin-install.js';
+import type { DefaultPluginStatus } from '../plugins/install/plugin-install.js';
 
 const ELANOUS_LOGIN_COMMAND = 'elanous login openai-codex';
 const PROVIDER_COMMAND = 'elanous config set llm.provider openai-codex';
@@ -38,11 +50,18 @@ export interface SetupCliDeps extends DoctorOptions {
   planClaudePluginSetup?: typeof planClaudePluginSetup;
   applyClaudePluginSetup?: typeof applyClaudePluginSetup;
   prompt?: (message: string) => Promise<string | undefined>;
+  promptSecret?: (message: string) => Promise<string | undefined>;
+  getSecretAsync?: typeof getSecretAsync;
+  setSecretAsync?: typeof setSecretAsync;
+  probeKey?: typeof probeProvider;
   isStdinTty?: () => boolean;
   out?: { log: (value: string) => void; error?: (value: string) => void };
   setExitCode?: (code: number) => void;
   /** 런타임이 이 config 로 «실제로» 고르는 provider(`decideProviderForConfig().provider`). 시험 seam. */
   resolveRuntimeProvider?: (config: UserConfig) => string | undefined;
+  detectProviders?: typeof detectProviders;
+  getServiceKeyStatus?: typeof serviceKeyStatus;
+  isCommandAvailable?: (command: string) => boolean;
 }
 
 /** ⛔ 2026-09-23 — provider 단계는 «문자열 비교»가 아니라 ***런타임의 최종 결정***으로 잰다.
@@ -118,6 +137,10 @@ function missingRequiredCommands(doctor: DoctorReport): boolean {
   return doctor.externalCommands.some((command) => command.status === 'missing' && command.tier === 'required');
 }
 
+function missingGitCapability(doctor: DoctorReport): boolean {
+  return doctor.externalCommands.some((command) => command.name === 'git' && command.status !== 'found');
+}
+
 function displayCommand(command: string[]): string {
   return command.map((arg) => /^[A-Za-z0-9_@%+=:,./-]+$/.test(arg)
     ? arg
@@ -128,7 +151,7 @@ export function formatSetupReport(doctor: DoctorReport, steps: SetupStep[], nonI
   const elanousLogin = steps[0]!.complete;
   const provider = steps[1]!.complete;
   const codexLogin = steps[2]!.complete;
-  const externalReady = doctor.ok && !missingRequiredCommands(doctor);
+  const externalReady = doctor.ok && !missingRequiredCommands(doctor) && !missingGitCapability(doctor);
   const capabilities = [
     { name: 'OpenAI Codex-backed elanous sessions', ready: elanousLogin && provider },
     { name: 'Codex app-server integration', ready: codexLogin && externalReady },
@@ -215,13 +238,82 @@ function formatDefaultBundleProposal(): string[] {
   ];
 }
 
+/** Check the default plugin group's required/optional connector declarations against the runtime catalog. */
+export function validateDefaultPluginServiceKeys(
+  group: readonly { id: string; requiredServiceKeys: readonly string[]; optionalServiceKeys: readonly string[] }[] = DEFAULT_PLUGIN_GROUP,
+  catalog: readonly Pick<ServiceKeyCatalogEntry, 'id' | 'kind'>[] = SERVICE_KEY_CATALOG,
+): string[] {
+  const errors: string[] = [];
+  const catalogIds = new Set<string>();
+  for (const item of catalog) {
+    if (catalogIds.has(item.id)) errors.push(`중복 서비스 카탈로그 id: ${item.id}`);
+    catalogIds.add(item.id);
+  }
+  for (const plugin of group) {
+    const required = new Set<string>();
+    const optional = new Set<string>();
+    for (const id of plugin.requiredServiceKeys) {
+      if (required.has(id)) errors.push(`${plugin.id}: 필수 키 중복 ${id}`);
+      required.add(id);
+    }
+    for (const id of plugin.optionalServiceKeys) {
+      if (optional.has(id)) errors.push(`${plugin.id}: 선택 키 중복 ${id}`);
+      optional.add(id);
+      if (required.has(id)) errors.push(`${plugin.id}: required/optional 중복 ${id}`);
+    }
+    for (const id of [...required, ...optional]) {
+      const item = catalog.find(candidate => candidate.id === id);
+      if (!item) errors.push(`${plugin.id}: 서비스 카탈로그에 없는 키 ${id}`);
+      else if (item.kind !== 'api-key') errors.push(`${plugin.id}: API 키가 아닌 서비스 참조 ${id} (${item.kind})`);
+    }
+  }
+  return errors;
+}
+
+function commandAvailable(command: string): boolean {
+  const path = process.env.PATH ?? '';
+  return path.split(delimiter).some(directory => {
+    try { accessSync(join(directory, command), constants.X_OK); return true; } catch { return false; }
+  });
+}
+
+function formatDefaultPluginStatuses(statuses: readonly DefaultPluginStatus[]): string[] {
+  return [
+    'Setup: 기본 플러그인 묶음 상태 (실제 키·선행 조건)',
+    ...statuses.map(plugin => {
+      const missing = [
+        ...(plugin.missingRequiredKeys.length ? [`필수 키 ${plugin.missingRequiredKeys.join(', ')}`] : []),
+        ...(plugin.missingPrerequisites.length ? [`선행 조건 ${plugin.missingPrerequisites.join(', ')}`] : []),
+      ];
+      const optional = plugin.optionalKeysMissing.length
+        ? ` · 선택 키 미설정 ${plugin.optionalKeysMissing.join(', ')}` : '';
+      return `${plugin.status === 'ready' ? '✓' : '○'} ${plugin.label}: ${plugin.status}${missing.length ? ` · ${missing.join(' · ')}` : ''}${optional}`;
+    }),
+  ];
+}
+
+async function readDefaultPluginStatuses(deps: SetupCliDeps): Promise<DefaultPluginStatus[]> {
+  const catalogErrors = validateDefaultPluginServiceKeys();
+  if (catalogErrors.length) throw new Error(`기본 플러그인 서비스 카탈로그 오류: ${catalogErrors.join('; ')}`);
+  const keys = (deps.getServiceKeyStatus ?? serviceKeyStatus)()
+    .filter(item => item.configured).map(item => item.id);
+  const providers = await (deps.detectProviders ?? detectProviders)();
+  const prerequisites = new Set<string>();
+  if (providers.some(provider => provider.available && provider.auth !== 'agent-cli')) prerequisites.add('llm-provider');
+  if ((deps.isCommandAvailable ?? commandAvailable)('aside')) prerequisites.add('aside');
+  if ((deps.isCommandAvailable ?? commandAvailable)('claude')) prerequisites.add('claude-cli');
+  if ((deps.isCommandAvailable ?? commandAvailable)('gh')) prerequisites.add('github-cli');
+  return defaultPluginStatuses({ readyServiceKeyIds: keys, satisfiedPrerequisites: [...prerequisites] });
+}
+
 export function registerSetupCommand(program: Command, deps: SetupCliDeps = {}): void {
   const out = deps.out ?? { log: (value: string) => console.log(value), error: (value: string) => console.error(value) };
   const setExitCode = deps.setExitCode ?? ((code: number) => { process.exitCode = code; });
   const doctorRunner = deps.runDoctor ?? runDoctor;
   const isFirstRunSetup = (): boolean => deps.firstRunTopics ?? (!deps.getUserConfig && !existsSync(userConfigPath()));
-  const showDefaultBundleProposal = (): void => {
+  const showDefaultBundleProposal = async (): Promise<void> => {
     for (const line of formatDefaultBundleProposal()) out.log(line);
+    for (const line of formatDefaultPluginStatuses(await readDefaultPluginStatuses(deps))) out.log(line);
   };
   const showCliSkills = (apply: boolean) => {
     out.log('Setup: CLI skills (public GitHub repository reads remain available without login)');
@@ -233,6 +325,8 @@ export function registerSetupCommand(program: Command, deps: SetupCliDeps = {}):
     const rl = createInterface({ input: process.stdin, output: process.stdout });
     try { return await rl.question(message); } finally { rl.close(); }
   });
+  // API keys must never fall back to the ordinary (echoing) setup prompt.
+  const askSecret = deps.promptSecret ?? createSecretPrompt();
 
   const setup = program.command('setup')
     .description('Check OpenAI Codex setup and guide each missing credential step')
@@ -243,7 +337,7 @@ export function registerSetupCommand(program: Command, deps: SetupCliDeps = {}):
       if (opts.nonInteractive) {
         out.log(formatSetupReport(doctor, setupSteps(deps), true));
         showCliSkills(false);
-        if (isFirstRunSetup()) showDefaultBundleProposal();
+        if (isFirstRunSetup()) await showDefaultBundleProposal();
         for (const line of recommendedSetup((deps.getUserConfig ?? getUserConfig)())) out.log(line);
         setExitCode(0);
         return;
@@ -268,7 +362,7 @@ export function registerSetupCommand(program: Command, deps: SetupCliDeps = {}):
       }
       out.log(formatSetupReport(doctor, steps, false));
       showCliSkills(false);
-      if (isFirstRun) showDefaultBundleProposal();
+      if (isFirstRun) await showDefaultBundleProposal();
       for (const line of recommendedSetup((deps.getUserConfig ?? getUserConfig)())) out.log(line);
       let configured = (deps.getUserConfig ?? getUserConfig)();
       if (!configured.starter?.topics && configured.watch?.enabled !== false
@@ -314,6 +408,31 @@ export function registerSetupCommand(program: Command, deps: SetupCliDeps = {}):
       setExitCode(0);
     });
 
+  setup.command('service-keys')
+    .description('Import and verify service API keys without rendering their values')
+    .action(async () => {
+      if (!isStdinTty()) {
+        (out.error ?? out.log)('키 설정은 stdin TTY가 있는 자리에서만 실행할 수 있다.');
+        setExitCode(1);
+        return;
+      }
+      try {
+        const results = await collectServiceKeys({
+          config: (deps.getUserConfig ?? getUserConfig)(),
+          promptSecret: askSecret,
+          print: out.log,
+          getSecret: deps.getSecretAsync,
+          setSecret: deps.setSecretAsync,
+          probe: deps.probeKey,
+        });
+        printKeySetupReport(results, out.log);
+        setExitCode(results.some((result) => result.status === 'failed') ? 1 : 0);
+      } catch {
+        (out.error ?? out.log)('키 설정을 완료하지 못했습니다. 민감한 오류 내용은 숨겼습니다.');
+        setExitCode(1);
+      }
+    });
+
   setup.command('claude-code')
     .description('Plan or install the elanous Claude Code plugin')
     .option('--apply', 'Install missing steps and verify the MCP connection')
@@ -365,4 +484,45 @@ export function registerSetupCommand(program: Command, deps: SetupCliDeps = {}):
         setExitCode(1);
       }
     });
+
+  setup.command('keys')
+    .description('Set up service credentials without printing secret values')
+    .option('--status', 'Show credential presence only')
+    .option('--import-env-file <path>', 'Import catalogued keys from a dotenv file')
+    .option('--paste-env', 'Paste a dotenv block into a hidden terminal prompt')
+    .option('--all', 'Include optional service keys during interactive setup; --status always shows all services')
+    .action(async (opts: { status?: boolean; importEnvFile?: string; pasteEnv?: boolean; all?: boolean }) => {
+      const keyConfig = (deps.getUserConfig ?? getUserConfig)();
+      const keyOptions = { config: keyConfig, includeOptional: opts.all === true };
+      try {
+        if (opts.status) {
+          if (opts.all) throw new Error('--status already shows the full catalog; omit --all');
+          for (const line of renderServiceKeyStatus()) out.log(line);
+          for (const line of formatDefaultPluginStatuses(await readDefaultPluginStatuses(deps))) out.log(line);
+          setExitCode(0);
+          return;
+        }
+        let text: string | undefined;
+        if (opts.importEnvFile) text = readFileSync(opts.importEnvFile, 'utf8');
+        else if (opts.pasteEnv) {
+          if (!isStdinTty()) throw new Error('hidden paste import requires a terminal');
+          text = await readMaskedServiceEnvPaste();
+        }
+        if (text !== undefined) {
+          const parsed = parseServiceKeyEnv(text);
+          const result = await importServiceKeys(parsed, { print: (line) => out.log(line) }, keyOptions);
+          setExitCode(result.rejected.length ? 1 : 0);
+          return;
+        }
+        if (!isStdinTty()) throw new Error('secret input requires a terminal; use --import-env-file for a protected dotenv file');
+        const io = realIO();
+        try { await runSetupKeys(io, keyOptions); }
+        finally { io.close(); }
+        setExitCode(0);
+      } catch (error) {
+        const message = error instanceof Error ? error.message : 'setup keys failed';
+        (out.error ?? out.log)(message.replace(/\r?\n/g, ' '));
+        setExitCode(1);
+      }
+    });
 }

package/src/cli/setup-keys.ts

@@ -0,0 +1,199 @@
+import { SERVICE_KEY_CATALOG } from '../setup/llm-env-detect.js';
+import { serviceKeyStatus, storeServiceKeys, verifyServiceKey, type ParsedServiceKeyEnv } from '../setup/service-keys.js';
+import { detectProviders } from '../llm/provider-detect.js';
+import { loginWithCodex } from '../oauth/codex.js';
+import type { FirstRunProviderSetupResult } from '../onboarding/first-run.js';
+import { MODEL_ROLES, resolveRoleLlm, type LLMProviderName, type UserConfig } from '../user-config.js';
+import { parseMenuAnswer } from '../onboarding/menu-answer.js';
+
+export interface SetupKeysIO {
+  ask(prompt: string): Promise<string>;
+  askSecret?(prompt: string): Promise<string>;
+  print(message: string): void;
+}
+
+export type SetupKeyProvider = Extract<(typeof SERVICE_KEY_CATALOG)[number], { kind: 'api-key' }>['id'];
+export type SetupKeyValidationResult =
+  | { success: true; verification: 'verified' | 'unsupported' }
+  | { success: false; reason: 'invalid' | 'rate-limited' | 'unavailable'; httpStatus?: number };
+export type SetupKeyVerifier = (input: { provider: SetupKeyProvider; apiKey: string }) => Promise<SetupKeyValidationResult>;
+
+export interface SetupKeysOptions {
+  config: UserConfig;
+  env?: NodeJS.ProcessEnv;
+  cacheDir?: string;
+  includeOptional?: boolean;
+  /** Existing OAuth fetch injection used by deterministic login simulation. */
+  loginWithCodex?: typeof loginWithCodex;
+  /** Verification seam for deterministic setup simulations; the production default remains verifyServiceKey. */
+  verifier?: SetupKeyVerifier;
+}
+
+function providerForService(id: string): string | undefined {
+  switch (id) {
+    case 'openai-api': return 'openai';
+    case 'anthropic-api': return 'anthropic';
+    case 'gemini-api': return 'gemini';
+    case 'openrouter': return 'openrouter';
+    case 'xai': return 'grok';
+    case 'opengateway': return 'opengateway';
+    default: return undefined;
+  }
+}
+
+function providerBaseUrl(config: UserConfig, serviceId: string): string | undefined {
+  const provider = providerForService(serviceId);
+  if (!provider) return undefined;
+  return config.llm.rotation?.find(item => item.provider === provider)?.baseUrl;
+}
+
+function renderProviderProposal(config: UserConfig, providers: Awaited<ReturnType<typeof detectProviders>>): string[] {
+  const available = providers.filter(provider => provider.available).sort((a, b) => a.rank - b.rank);
+  const ordered = [...new Set(available.map(provider => provider.provider))];
+  const defaultProvider = ordered.includes(config.llm.provider) ? config.llm.provider : ordered[0];
+  const fallback = config.llm.fallbackChain ?? [];
+  const suggestion = defaultProvider ? [defaultProvider, ...ordered.filter(name => name !== defaultProvider)] : [];
+  return [
+    `LLM 감지: ${available.length ? available.map(provider => `${provider.provider}(${provider.auth})`).join(' · ') : '사용 가능한 인증 없음'}`,
+    `기본 제안: ${defaultProvider ?? '설정 후 선택'} · 현재 기본: ${config.llm.provider}`,
+    `폴백 제안: ${suggestion.length ? suggestion.join(' → ') : '현재 설정 유지'} · 현재 llm.fallbackChain: ${fallback.length ? fallback.join(' → ') : '미설정'}`,
+    `역할별 현재 해석: ${MODEL_ROLES.map(role => {
+      try {
+        const resolved = resolveRoleLlm(role, { config });
+        return `${role}=${resolved.provider}/${resolved.model}`;
+      } catch {
+        return `${role}=미설정`;
+      }
+    }).join(' · ')}`,
+    '위 내용은 제안만 표시하며 roleLlm·llm.fallbackChain을 변경하지 않습니다.',
+  ];
+}
+
+export function renderServiceKeyStatus(options: { env?: NodeJS.ProcessEnv; cacheDir?: string } = {}): string[] {
+  const status = serviceKeyStatus(options);
+  return SERVICE_KEY_CATALOG.map(item => {
+    const row = status.find(candidate => candidate.id === item.id);
+    if (!row) return `${item.label}: 상태 확인 불가`;
+    if (item.kind === 'api-key') return `${item.label}: ${row.configured ? '키 있음' : '키 필요'} (${item.envNames.join(', ')})`;
+    return `${item.label}: ${item.kind === 'subscription' || item.kind === 'oauth' || item.kind === 'cli' ? '로그인/설치 상태는 별도 감지' : '로컬 도구 확인 필요'}`;
+  });
+}
+
+export async function importServiceKeys(values: ParsedServiceKeyEnv, io: Pick<SetupKeysIO, 'print'>, options: SetupKeysOptions): Promise<{ stored: string[]; rejected: string[]; unverified: string[] }> {
+  const accepted = new Map<string, string>();
+  const rejected: string[] = [];
+  const unverified: string[] = [];
+  const env = options.env ?? process.env;
+  for (const [name, value] of values) {
+    const item = SERVICE_KEY_CATALOG.find(candidate => candidate.kind === 'api-key' && candidate.envNames.includes(name));
+    if (!item) { rejected.push(name); continue; }
+    if (env[name]?.trim() === value) io.print(`${name}: 환경에서 이미 제공됨 · 캐시에도 저장합니다 · 값 출력 0`);
+    const verification = options.verifier
+      ? await options.verifier({ provider: item.id as SetupKeyProvider, apiKey: value })
+      : await verifyServiceKey(item.id, value, {
+        env,
+        cacheDir: options.cacheDir,
+        baseUrl: providerBaseUrl(options.config, item.id),
+      }).then(({ result, httpStatus }): SetupKeyValidationResult => result === 'verified' || result === 'unsupported'
+        ? { success: true, verification: result }
+        : { success: false, reason: result, ...(httpStatus === undefined ? {} : { httpStatus }) });
+    if (verification.success && verification.verification === 'verified') accepted.set(name, value);
+    else if (verification.success && verification.verification === 'unsupported') {
+      accepted.set(name, value);
+      unverified.push(name);
+      io.print(`${item.label}: 최소 확인을 지원하지 않아 검증 없이 저장합니다 · 값 출력 0`);
+    }
+    else {
+      rejected.push(name);
+      io.print(`${item.label}: 검증 ${verification.reason}${verification.httpStatus ? ` (HTTP ${verification.httpStatus})` : ''} · 저장 안 함`);
+    }
+  }
+  const saved = accepted.size ? storeServiceKeys(accepted, { env, cacheDir: options.cacheDir }) : { stored: [] };
+  if (saved.stored.length) io.print(`저장 완료: ${saved.stored.join(', ')} · 값 출력 0`);
+  return { stored: saved.stored, rejected: rejected.sort(), unverified: unverified.sort() };
+}
+
+export async function runSetupKeys(io: SetupKeysIO, options: SetupKeysOptions): Promise<{ stored: string[]; skipped: string[] }> {
+  const providers = await detectProviders({ env: options.env });
+  for (const line of renderProviderProposal(options.config, providers)) io.print(line);
+  const { listCodexAccountsInStore } = await import('../oauth/codex-account-store.js');
+  const codexAccounts = listCodexAccountsInStore().map(account => account.name);
+  io.print(`Codex 계정: ${codexAccounts.length ? codexAccounts.join(', ') : '없음'} · 추가: 별도 CODEX_HOME에서 codex login 후 elanous provider codex account import <이름> --home <홈>`);
+  const statuses = serviceKeyStatus({ env: options.env, cacheDir: options.cacheDir });
+  const entries = SERVICE_KEY_CATALOG.filter(item => item.kind === 'api-key' && (item.demoRequired || options.includeOptional));
+  const stored: string[] = [];
+  const skipped: string[] = [];
+  for (const item of entries) {
+    const status = statuses.find(candidate => candidate.id === item.id);
+    if (!status) { io.print(`${item.label}: 상태 확인 불가 · 건너뜀`); skipped.push(item.id); continue; }
+    if (status.configured) { io.print(`${item.label}: 이미 설정됨`); continue; }
+    const envName = item.envNames[0];
+    if (!envName) continue;
+    io.print(`${item.label} · ${item.setupUrl} · ${item.demoRequired ? '데모 필요' : '선택'}`);
+    if (!io.askSecret) {
+      io.print(`${item.label}: 이 입력 화면은 비밀 입력을 지원하지 않습니다 · eln setup keys --paste-env 사용`);
+      skipped.push(item.id);
+      continue;
+    }
+    const value = (await io.askSecret(`${envName} (Enter=건너뜀): `)).trim();
+    if (!value) { skipped.push(item.id); continue; }
+    const result = await importServiceKeys(new Map([[envName, value]]), io, options);
+    if (result.stored.includes(envName)) stored.push(envName);
+    else skipped.push(item.id);
+  }
+  for (const line of renderServiceKeyStatus({ env: options.env, cacheDir: options.cacheDir })) io.print(line);
+  return { stored, skipped };
+}
+
+export const FIRST_RUN_PROVIDER_SETUP_MENU_HEADING = '처음 실행 LLM 설정';
+export const FIRST_RUN_PROVIDER_SETUP_MENU_CHOICES = '1 Codex 구독 로그인 · 2 API 키 입력 · Enter 건너뛰기';
+export const FIRST_RUN_PROVIDER_SETUP_MENU_MAX_MISSES = 3;
+
+/** First-run entry: offer the existing Codex device login or the same verified-key flow as `setup keys`. */
+export async function runFirstRunProviderSetup(io: SetupKeysIO, options: SetupKeysOptions): Promise<FirstRunProviderSetupResult> {
+  const choices = ['codex-login', 'api-key'] as const;
+  let misses = 0;
+  let choice: typeof choices[number];
+  for (;;) {
+    io.print(FIRST_RUN_PROVIDER_SETUP_MENU_HEADING);
+    io.print(FIRST_RUN_PROVIDER_SETUP_MENU_CHOICES);
+    const parsed = parseMenuAnswer(await io.ask('선택: '), choices);
+    if (parsed.kind === 'cancel') return null;
+    if (parsed.kind === 'miss') {
+      misses += 1;
+      if (misses >= FIRST_RUN_PROVIDER_SETUP_MENU_MAX_MISSES) return { kind: 'needs-llm' };
+      continue;
+    }
+    choice = parsed.provider;
+    break;
+  }
+
+  if (choice === 'codex-login') {
+    try {
+      await (options.loginWithCodex ?? loginWithCodex)({ onProgress: (event) => {
+        if (event.type === 'user_code') io.print(`Codex 로그인: ${event.loginUrl} · 코드 ${event.userCode}`);
+        else if (event.type === 'polling') io.print('Codex 로그인을 기다리는 중…');
+        else if (event.type === 'exchanging') io.print('Codex 로그인을 확인하는 중…');
+      } });
+      io.print('Codex 로그인 완료');
+      return 'openai-codex';
+    } catch {
+      io.print('Codex 로그인을 완료하지 못했습니다. 다시 시도하거나 Enter로 건너뛰세요.');
+      return null;
+    }
+  }
+  // Keep the exact environment object through storage and rediscovery: storeServiceKeys
+  // writes accepted values into it as well as the protected cache, so a newly entered
+  // key is immediately visible to detectProviders and resolveProviderCredential.
+  const env = options.env ?? process.env;
+  await runSetupKeys(io, { ...options, env });
+  // runSetupKeys handles an absent askSecret capability per item (skip + safe guidance);
+  // it does not throw or turn the first-run entry into a crash.
+  const providers = (await detectProviders({ env }))
+    .filter(provider => provider.available && provider.auth === 'apikey');
+  const available = [...new Set(providers.map(provider => provider.provider as LLMProviderName))];
+  if (!available.length) return null;
+  io.print(`기본 공급자 선택: ${available.map((provider, index) => `${index + 1} ${provider}`).join(' · ')}`);
+  const answer = (await io.ask('기본 공급자 번호 (Enter=건너뜀): ')).trim();
+  return available[Number(answer) - 1] ?? null;
+}

package/src/cli/task-plugin-wizard-host.ts

@@ -0,0 +1,114 @@
+import { isAbsolute, relative, resolve, sep } from 'node:path';
+import { realpath } from 'node:fs/promises';
+import { startClassicMissionCli } from '../dashboard/mission-cli-consumer.js';
+import type { MissionCliConsumerDeps } from '../dashboard/mission-cli-consumer.js';
+import { requestQuestion, getDefaultQuestionChannels } from '../hitl/question.js';
+import type { QuestionChannel } from '../hitl/question.js';
+import { sendOutbound } from '../domains/outbound-alert.js';
+import type { AskUserQuestionRequest, AskUserQuestionResult } from '../ask-user-question/types.js';
+import { PLUGIN_WIZARD_MARKET_QUESTION } from '../graph-wizard/mission-compose.js';
+import type { PluginMaker, PluginWizardDeps } from '../graph-wizard/mission-compose.js';
+
+export interface TaskPluginWizardHostResult {
+  ok: boolean;
+  content?: string;
+  error?: string;
+}
+
+export interface TaskPluginWizardHostPorts {
+  questionChannels?: () => QuestionChannel[];
+  sendReport?: (report: string, kind: 'report') => Promise<unknown> | unknown;
+  searchMarket?: PluginWizardDeps['searchMarket'];
+  missionConsumerDeps?: MissionCliConsumerDeps;
+  runMission?: (request: { maker: PluginMaker; prompt: string }) => Promise<TaskPluginWizardHostResult>;
+  runMissionPair?: (request: { makers: readonly PluginMaker[]; prompt: string }) => Promise<Partial<Record<PluginMaker, TaskPluginWizardHostResult>>>;
+  onEvent?: PluginWizardDeps['onEvent'];
+}
+
+async function runClassicMission(maker: PluginMaker, prompt: string, deps?: MissionCliConsumerDeps): Promise<TaskPluginWizardHostResult> {
+  const started = await startClassicMissionCli({ agent: maker, prompt }, deps);
+  const result = 'completion' in started ? await started.completion : started;
+  return { ok: result.ok, ...(result.content ? { content: result.content } : {}), ...(result.error ? { error: result.error } : {}) };
+}
+
+function questionRequest(questions: readonly string[]): AskUserQuestionRequest {
+  return {
+    questions: questions.map((question, index) => ({
+      id: `plugin_wizard_${index + 1}`,
+      header: '플러그인',
+      question,
+      options: question.trim() === PLUGIN_WIZARD_MARKET_QUESTION
+        ? [
+          { label: '마켓', description: '신뢰된 마켓 후보를 먼저 찾아 시험합니다.' },
+          { label: '사이드탭', description: 'Claude와 Codex에 같은 작업을 맡겨 비교합니다.' },
+        ]
+        : [
+          { label: '기본안', description: '마법사가 미션과 도구 이름에서 기본 구현을 정합니다.' },
+          { label: '직접 입력', description: '원하는 기능을 직접 적습니다.' },
+        ],
+      includeOther: true,
+    })),
+  };
+}
+
+function answerMap(result: AskUserQuestionResult): Record<string, string> | undefined {
+  const answers: Record<string, string> = {};
+  for (const [id, raw] of Object.entries(result.answers)) {
+    const typed = result.otherText?.[id]?.trim();
+    const value = typed || (Array.isArray(raw) ? raw.join(', ') : raw);
+    if (typeof value === 'string' && value.trim()) answers[id] = value.trim();
+  }
+  return Object.keys(answers).length ? answers : undefined;
+}
+
+async function pluginSpec(content: string | undefined, workspace: string): Promise<string> {
+  const spec = content?.match(/(?:^|\r?\n)PLUGIN_SPEC=([^\r\n]+)\s*$/m)?.[1]?.trim();
+  if (!spec || !isAbsolute(spec)) throw new Error('Claude/Codex 결과에 절대경로 PLUGIN_SPEC이 없습니다');
+  const [workspacePath, pluginPath] = await Promise.all([realpath(resolve(workspace)), realpath(resolve(spec))]);
+  const fromWorkspace = relative(workspacePath, pluginPath);
+  if (!fromWorkspace || fromWorkspace === '..' || fromWorkspace.startsWith(`..${sep}`) || isAbsolute(fromWorkspace)) {
+    throw new Error('Claude/Codex PLUGIN_SPEC은 세션 작업실 안의 경로여야 합니다');
+  }
+  return pluginPath;
+}
+
+/** Wire the plugin wizard onto existing question, outbound, and classic side-tab host abstractions. */
+export function createTaskPluginWizardHostDeps(ports: TaskPluginWizardHostPorts = {}): PluginWizardDeps {
+  const ask = async (request: AskUserQuestionRequest): Promise<AskUserQuestionResult> => {
+    const response = await requestQuestion({ request, channels: ports.questionChannels?.() ?? getDefaultQuestionChannels() });
+    return response.result;
+  };
+  const sendReport = ports.sendReport ?? ((report: string, kind: 'report') => sendOutbound(report, kind));
+  const runMission = ports.runMission ?? ((request: { maker: PluginMaker; prompt: string }) =>
+    runClassicMission(request.maker, request.prompt, ports.missionConsumerDeps));
+
+  return {
+    ask: async (questions) => answerMap(await ask(questionRequest(questions))),
+    // When omitted, composePluginMission uses its built-in trusted-market search.
+    ...(ports.searchMarket ? { searchMarket: ports.searchMarket } : {}),
+    develop: async ({ maker, goal, workspace }) => {
+      const prompt = [goal, '', `세션 작업실: ${workspace}`,
+        '플러그인을 작업실 안에 만들고, 끝에 PLUGIN_SPEC=<absolute plugin directory> 한 줄을 정확히 출력해 주세요.'].join('\n');
+      const result = await runMission({ maker, prompt });
+      if (!result.ok) throw new Error(result.error ?? `${maker} side-tab mission failed`);
+      return { spec: await pluginSpec(result.content, workspace) };
+    },
+    ...(ports.runMissionPair ? {
+      developPair: async ({ makers, goal, workspace }: { makers: readonly PluginMaker[]; goal: string; workspace: string }) => {
+        const prompt = [goal, '', `세션 작업실: ${workspace}`,
+          '플러그인을 작업실 안에 만들고, 끝에 PLUGIN_SPEC=<absolute plugin directory> 한 줄을 정확히 출력해 주세요.'].join('\n');
+        const results = await ports.runMissionPair!({ makers, prompt });
+        const specs: Partial<Record<PluginMaker, { spec: string }>> = {};
+        for (const maker of makers) {
+          const result = results[maker];
+          if (!result?.ok) continue;
+          try { specs[maker] = { spec: await pluginSpec(result.content, workspace) }; }
+          catch { /* one malformed maker result must not discard the other maker's candidate */ }
+        }
+        return specs;
+      },
+    } : {}),
+    notify: async (report) => { await sendReport(report, 'report'); },
+    ...(ports.onEvent ? { onEvent: ports.onEvent } : {}),
+  };
+}