elanous 0.2.5 → 0.2.7

package/src/oauth/codex-account-store.ts

@@ -13,6 +13,8 @@ import {
 } from './codex-account.js';
 import { authStorePath, defaultCodexHome, listProviders, loadTokens, saveTokens } from './store.js';
 import { readFreshAvailabilityState, quotaSignalDir, readQuotaSignal, readQuotaSignalCredits, readQuotaSignalUsedPercent, readQuotaSignalObservedAt, readQuotaSignalObservedAtRaw } from '../budget/codex-reset-credit-state.js';
+import { creditPaceStatus } from '../budget/codex-credit-pace.js';
+import { loadLlmPolicy } from '../policy/llm-policy.js';
 import { getUserConfig } from '../user-config.js';
 import {
   decideCodexRotation, observeRotation, applyRotation, readCodexAccountRotationConfig, rotatedChildEnv,
@@ -278,6 +280,13 @@ function buildRotationCandidates(path: string, now: number, env: NodeJS.ProcessE
     .filter((c): c is RotationCandidate => c !== null);
 }
 
+function rotationCreditPace(candidates: readonly RotationCandidate[], now: number) {
+  const policy = loadLlmPolicy({ now: new Date(now) }).policy;
+  const balances = Object.fromEntries(candidates.filter((c) => c.creditBalance !== undefined)
+    .map((c) => [c.name, c.creditBalance!]));
+  return creditPaceStatus({ policy, balances, now: new Date(now) });
+}
+
 function formatUsedPercent(value: number | undefined): string {
   return value === undefined ? 'unknown' : `${value}%`;
 }
@@ -517,7 +526,7 @@ export function inspectCodexRotation(
   const rawThreshold = rotationThresholdFromConfig();
   const thresholdPercentByAccount = rotationThresholdsByAccountFromConfig();
   const decision = decideCodexRotation({
-    current, explicit, enabled, disabledProvenance: rotationConfig.state, currentReached, currentUsedPercent, accountOrder: accountOrderFromConfig(), resetCreditAvailability: resetCreditAvailability(currentHome, now), thresholdPercent: rawThreshold, thresholdPercentByAccount, creditsAllowed: codexCreditsAllowedFromConfig(), ...currentCredits, candidates,
+    current, explicit, enabled, disabledProvenance: rotationConfig.state, currentReached, currentUsedPercent, accountOrder: accountOrderFromConfig(), resetCreditAvailability: resetCreditAvailability(currentHome, now), thresholdPercent: rawThreshold, thresholdPercentByAccount, creditsAllowed: codexCreditsAllowedFromConfig(), ...currentCredits, candidates, creditPace: rotationCreditPace(candidates, now),
   });
   // ⛔⭐ 나이는 «만료돼도» 낸다 — 「65분 전」과 「3일 전」은 다른 진단이다(리뷰 must-fix).
   const observedAtByHome: Record<string, number> = {};
@@ -603,6 +612,7 @@ export function resolveCodexAccountForRun(
   const candidates = buildRotationCandidates(path, now, env);
   const currentSignalAttributable = signalAttributableToAccount(currentHomeInfo);
 
+  const creditPace = rotationCreditPace(candidates, now);
   const decision = decideCodexRotation({
     current,
     explicit,
@@ -617,6 +627,13 @@ export function resolveCodexAccountForRun(
     creditsAllowed: codexCreditsAllowedFromConfig(),
     ...currentCreditsInput(currentSignalAttributable ? currentHome : undefined, now),
     candidates,
+    creditPace,
+  });
+  debug.log('codex.rotation', 'credit-pace', {
+    active: creditPace.active,
+    todaySpent: creditPace.todaySpent,
+    target: creditPace.target,
+    to: decision.reason === 'credit-pace' ? decision.to?.name ?? current.name : decision.to?.name,
   });
   observeRotation(decision, current.name);
   const resolved = applyRotation(current, decision);
@@ -726,7 +743,7 @@ export function resolveRunFallback(
   try {
     const snapshot = inspectCodexRotation(env, deps.storePath ? { storePath: deps.storePath } : {});
     let rotation: RotationOutcome;
-    if ((snapshot.reason === 'rotated' || snapshot.reason === 'reset-credit-unknown') && snapshot.to) {
+    if ((snapshot.reason === 'rotated' || snapshot.reason === 'reset-credit-unknown' || snapshot.reason === 'credit-pace') && snapshot.to) {
       // ⛔ 스냅샷은 이름만 준다 — 후보 목록에서 «그 객체»를 되찾는다(홈까지 필요하다).
       const to = snapshot.candidates.find((c) => c.name === snapshot.to);
       rotation = to ? { reason: snapshot.reason, to } : { reason: 'no-candidate' };
@@ -734,6 +751,7 @@ export function resolveRunFallback(
       snapshot.reason === 'explicit'
       || snapshot.reason === 'disabled'
       || snapshot.reason === 'not-reached'
+      || snapshot.reason === 'credit-pace'
       || snapshot.reason === 'reset-credit-available'
       || snapshot.reason === 'no-candidate'
     ) {

package/src/oauth/codex-browser-login.ts

@@ -0,0 +1,173 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { createServer, type Server } from 'node:http';
+import { spawn } from 'node:child_process';
+import { debug } from '../debug/log.js';
+import { CODEX_OAUTH_CLIENT_ID, CODEX_OAUTH_TOKEN_URL } from './codex.js';
+import { expiresAtFromSeconds, saveTokens, type ProviderAuthState } from './store.js';
+
+const AUTHORIZE_URL = 'https://auth.openai.com/oauth/authorize';
+const DEFAULT_PORT = 1455;
+const TIMEOUT_MS = 5 * 60 * 1000;
+
+export interface CodexBrowserLoginOpts {
+  fetchImpl?: typeof fetch;
+  openBrowser?: (url: string) => boolean | Promise<boolean>;
+  timeoutMs?: number;
+  preferredPort?: number;
+  mirrorCodex?: boolean;
+}
+
+export function browserLaunchCommand(url: string, platform: NodeJS.Platform = process.platform): { command: string; args: string[] } {
+  if (platform === 'win32') {
+    // Use the Windows URL handler directly; cmd.exe expands & and % even inside OAuth URLs.
+    return { command: 'rundll32.exe', args: ['url.dll,FileProtocolHandler', url] };
+  }
+  return { command: platform === 'darwin' ? 'open' : 'xdg-open', args: [url] };
+}
+
+/** A launcher that exits non-zero this soon has failed; one still running (or exiting 0) handed the URL off. */
+const LAUNCH_GRACE_MS = 1_000;
+
+function openBrowser(url: string): Promise<boolean> {
+  const { command, args } = browserLaunchCommand(url);
+  return new Promise(resolve => {
+    let settled = false;
+    const settle = (ok: boolean) => { if (!settled) { settled = true; resolve(ok); } };
+    try {
+      const child = spawn(command, args, { stdio: 'ignore', detached: true });
+      child.once('error', () => settle(false));
+      child.once('exit', code => settle(code === 0));
+      child.once('spawn', () => {
+        const grace = setTimeout(() => { child.unref(); settle(true); }, LAUNCH_GRACE_MS);
+        grace.unref?.();
+        child.once('exit', () => clearTimeout(grace));
+      });
+    } catch { settle(false); }
+  });
+}
+
+function listen(server: Server, port: number): Promise<void> {
+  return new Promise((resolve, reject) => {
+    server.once('error', reject);
+    server.listen(port, '127.0.0.1', () => {
+      server.off('error', reject);
+      resolve();
+    });
+  });
+}
+
+/** Local OAuth callback, independent of a bundled or PATH Codex executable. */
+export async function loginWithCodexBrowser(opts: CodexBrowserLoginOpts = {}): Promise<ProviderAuthState> {
+  const verifier = randomBytes(32).toString('base64url');
+  const challenge = createHash('sha256').update(verifier).digest('base64url');
+  const state = randomBytes(32).toString('base64url');
+  let port = opts.preferredPort ?? DEFAULT_PORT;
+  let resolveCallback!: (value: ProviderAuthState) => void;
+  let rejectCallback!: (reason: Error) => void;
+  const callback = new Promise<ProviderAuthState>((resolve, reject) => {
+    resolveCallback = resolve;
+    rejectCallback = reject;
+  });
+  void callback.catch(() => {});
+  let settled = false;
+  let handling = false;
+  const tokenAbort = new AbortController();
+  const server = createServer((req, res) => {
+    const url = new URL(req.url ?? '/', `http://localhost:${port}`);
+    if (req.method !== 'GET' || url.pathname !== '/auth/callback') {
+      res.writeHead(404).end();
+      return;
+    }
+    debug.log('oauth.codex-browser', 'callback', { port });
+    if (handling || settled) { res.writeHead(409).end(); return; }
+    if (url.searchParams.get('state') !== state) {
+      res.writeHead(400).end('Invalid login state.');
+      return;
+    }
+    const code = url.searchParams.get('code');
+    if (!code || url.searchParams.has('error')) {
+      res.writeHead(400).end('Login failed. Return to the terminal.');
+      rejectCallback(new Error('authorization-denied'));
+      return;
+    }
+    handling = true;
+    void (async () => {
+      try {
+        const response = await (opts.fetchImpl ?? fetch)(CODEX_OAUTH_TOKEN_URL, {
+          method: 'POST',
+          signal: tokenAbort.signal,
+          headers: { 'Content-Type': 'application/x-www-form-urlencoded', Accept: 'application/json' },
+          body: new URLSearchParams({
+            grant_type: 'authorization_code', code, redirect_uri: `http://localhost:${port}/auth/callback`,
+            client_id: CODEX_OAUTH_CLIENT_ID, code_verifier: verifier,
+          }).toString(),
+        });
+        if (!response.ok) throw new Error('token-exchange');
+        const token = await response.json() as {
+          access_token?: string; refresh_token?: string; id_token?: string;
+          expires_in?: number; scope?: string; token_type?: string;
+        };
+        if (!token.access_token || !token.refresh_token) throw new Error('token-exchange');
+        if (settled) { res.writeHead(410).end(); return; }
+        const saved = saveTokens('openai-codex', {
+          accessToken: token.access_token,
+          refreshToken: token.refresh_token,
+          ...(token.id_token ? { idToken: token.id_token } : {}),
+          expiresAt: expiresAtFromSeconds(token.expires_in),
+          scope: token.scope,
+          tokenType: token.token_type ?? 'Bearer',
+        }, { authMode: 'chatgpt', mirrorCodex: opts.mirrorCodex });
+        debug.log('oauth.codex-browser', 'exchanged', { port });
+        res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' })
+          .end('<!doctype html><html lang="ko"><meta charset="utf-8"><body>로그인됨 — 터미널로 돌아가세요</body></html>');
+        resolveCallback(saved);
+      } catch {
+        res.writeHead(400).end('Login failed. Return to the terminal.');
+        rejectCallback(new Error('token-exchange'));
+      }
+    })();
+  });
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  const cancel = () => rejectCallback(new Error('cancelled'));
+  const onExit = () => server.close();
+  const onServerError = () => rejectCallback(new Error('port-unavailable'));
+  let listening = false;
+  try {
+    try { await listen(server, port); }
+    catch (err) {
+      if ((err as NodeJS.ErrnoException).code !== 'EADDRINUSE' || port === 0) throw err;
+      await listen(server, 0);
+    }
+    const address = server.address();
+    if (!address || typeof address === 'string') throw new Error('port-unavailable');
+    listening = true;
+    port = address.port;
+    server.on('error', onServerError);
+    process.once('SIGINT', cancel);
+    process.once('exit', onExit);
+    timer = setTimeout(() => rejectCallback(new Error('timeout')), opts.timeoutMs ?? TIMEOUT_MS);
+    const authorize = new URL(AUTHORIZE_URL);
+    for (const [key, value] of Object.entries({
+      client_id: CODEX_OAUTH_CLIENT_ID, redirect_uri: `http://localhost:${port}/auth/callback`,
+      response_type: 'code', code_challenge: challenge, code_challenge_method: 'S256', state,
+      scope: 'openid profile email offline_access', id_token_add_organizations: 'true',
+      codex_cli_simplified_flow: 'true', originator: 'codex_cli_rs',
+    })) authorize.searchParams.set(key, value);
+    debug.log('oauth.codex-browser', 'started', { port });
+    if (!await (opts.openBrowser ?? openBrowser)(authorize.toString())) throw new Error('browser-unavailable');
+    return await callback;
+  } catch (err) {
+    const reason = err instanceof Error && ['timeout', 'cancelled', 'browser-unavailable', 'authorization-denied', 'token-exchange'].includes(err.message)
+      ? err.message : 'port-unavailable';
+    debug.log('oauth.codex-browser', 'failed', { port, reason });
+    throw new Error(`codex browser login failed: ${reason}`);
+  } finally {
+    settled = true;
+    tokenAbort.abort();
+    if (timer) clearTimeout(timer);
+    process.off('SIGINT', cancel);
+    process.off('exit', onExit);
+    if (listening) server.close();
+    server.off('error', onServerError);
+  }
+}

package/src/oauth/codex.ts

@@ -121,6 +121,8 @@ interface UserCodeResponse {
   device_auth_id: string;
   interval?: number;
   expires_in?: number;
+  verification_uri_complete?: string;
+  verification_uri?: string;
 }
 
 interface PollSuccessResponse {
@@ -278,7 +280,8 @@ export async function loginWithCodex(opts: CodexLoginOpts = {}): Promise<Provide
   const userCode = await requestDeviceCode({ fetchImpl });
   const serverInterval = typeof userCode.interval === 'number' ? userCode.interval * 1000 : 0;
   const pollInterval = Math.max(reportedInterval, serverInterval || 0);
-  onProgress({ type: 'user_code', userCode: userCode.user_code, loginUrl: CODEX_DEVICE_LOGIN_URL });
+  onProgress({ type: 'user_code', userCode: userCode.user_code,
+    loginUrl: userCode.verification_uri_complete || userCode.verification_uri || CODEX_DEVICE_LOGIN_URL });
 
   // 2) Poll until ready or timeout.
   const startedAt = Date.now();

package/src/oauth/fallback-chain.ts

@@ -69,8 +69,8 @@ export function normalizeFallbackChain(
 /** 회전 판정이 낸 이유 — `codex-account-rotation.ts` 의 `RotationReason` 과 같은 어휘.
  *  ⛔ 그쪽 타입이 비공개라 구조적으로 받는다(그 파일의 리뷰 규율: dead export 금지). */
 export type RotationOutcome =
-  | { readonly reason: 'rotated' | 'reset-credit-unknown'; readonly to: RotationCandidate }
-  | { readonly reason: 'explicit' | 'disabled' | 'not-reached' | 'reset-credit-available' | 'no-candidate' };
+  | { readonly reason: 'rotated' | 'reset-credit-unknown' | 'credit-pace'; readonly to: RotationCandidate }
+  | { readonly reason: 'explicit' | 'disabled' | 'not-reached' | 'credit-pace' | 'reset-credit-available' | 'no-candidate' };
 
 export type FallbackDecision =
   /** codex 계정을 갈아탄다(종전 동작). */
@@ -156,14 +156,14 @@ export function decideFallback(input: FallbackInput): FallbackDecision {
     return stepAfter(chain, currentStep, grokAvailable, grokQuota, 'chain-exhausted');
   }
   if (rotation.reason === 'explicit') return { action: 'stay', why: 'explicit' };
-  if (rotation.reason === 'not-reached') {
+  if (rotation.reason === 'not-reached' || (rotation.reason === 'credit-pace' && !('to' in rotation))) {
     return { action: 'stay', why: 'not-reached' };
   }
   if (rotation.reason === 'reset-credit-available' && stayOnResetCreditAvailable) {
     return { action: 'stay', why: 'reset-credit-available' };
   }
 
-  if (rotation.reason === 'rotated' || rotation.reason === 'reset-credit-unknown') {
+  if (rotation.reason === 'rotated' || rotation.reason === 'reset-credit-unknown' || (rotation.reason === 'credit-pace' && 'to' in rotation)) {
     // 회전이 답을 냈는데 체인이 codex-rotate 를 «빼» 놨다면 그 뜻을 존중하고
     // 다음 칸으로 간다(회전을 원치 않는 구성).
     if (chain.includes('codex-rotate')) return { action: 'codex-rotate', to: rotation.to };
@@ -172,7 +172,7 @@ export function decideFallback(input: FallbackInput): FallbackDecision {
 
   // no-candidate | disabled | reset-credit-available(기본) — codex 축이 끝났다. 다음 칸을 본다.
   // ⛔ 다음 칸이 «없을 때»의 이름만 고른다. 진행(stepAfterCodex)은 그대로다.
-  const fallbackWhy = stayReasonWhenCodexAxisEnds(rotation.reason);
+  const fallbackWhy = stayReasonWhenCodexAxisEnds(rotation.reason === 'credit-pace' ? 'no-candidate' : rotation.reason);
   return stepAfterCodex(chain, grokAvailable, grokQuota, fallbackWhy);
 }
 

package/src/oauth/store.ts

@@ -51,7 +51,9 @@ export interface OAuthTokens {
   tokenType?: string;
 }
 
-export type CodexMirrorResult = 'written' | 'not-created-missing-cli-fields' | 'write-failed';
+export type CodexMirrorResult = 'written' | 'not-created-missing-cli-fields' | 'write-failed'
+  // AUTH1 — ~/.codex is the Codex CLI's file: never mix another account's tokens into it.
+  | 'skipped-different-account' | 'skipped-unknown-account';
 
 export interface ProviderAuthState {
   tokens: OAuthTokens;
@@ -245,6 +247,9 @@ export interface WriteTokensOpts {
   /** Default true for 'openai-codex'. Set false to skip the ~/.codex
    *  mirror (e.g. in tests that shouldn't touch the user's home). */
   mirrorCodex?: boolean;
+  /** AUTH1 — when the Codex CLI file belongs to a different account, replace it wholly with this
+   *  login (id_token · account_id · tokens) instead of leaving it. Only on explicit user consent. */
+  replaceDifferentCodexAccount?: boolean;
   /** Explicit ChatGPT claims override. Normally left undefined — for
    *  'openai-codex' with OAuth tokens, saveTokens auto-decodes the
    *  access-token JWT so every refresh site picks up fresh claims
@@ -296,7 +301,10 @@ export function saveTokens(
       ?? (provider === 'openai-codex' ? defaultCodexHome(process.env) : undefined);
     if (home) {
       // loginWithCodex → saveTokens reaches the Codex CLI mirror on each token save.
-      state.codexMirrorResult = mirrorCodexAuth(tokens, state.lastRefresh, join(home, 'auth.json'));
+      state.codexMirrorResult = mirrorCodexAuth(tokens, state.lastRefresh, join(home, 'auth.json'), {
+        knownAccountId: state.chatGPT?.accountId,
+        replaceDifferentAccount: opts.replaceDifferentCodexAccount === true,
+      });
     }
     // ⛔ 이름 계정인데 홈을 모르면 «미러하지 않는다» — 모르는 곳에 토큰을 쓰지 않는다
   }
@@ -377,7 +385,12 @@ export function assertMirrorTargetIsSafeUnderTest(mirrorPath: string): void {
  *  under `oauth.codex-mirror`. ⛔ The 2026-08-05 incident had to be traced by
  *  guessing from the file's `last_refresh` FORMAT, which is deduction, not
  *  observation. Token values are never logged — path + error kind only. */
-function mirrorCodexAuth(tokens: OAuthTokens, lastRefresh: string, mirrorPath: string = codexAuthPath()): CodexMirrorResult {
+function mirrorCodexAuth(
+  tokens: OAuthTokens,
+  lastRefresh: string,
+  mirrorPath: string = codexAuthPath(),
+  account: { knownAccountId?: string; replaceDifferentAccount?: boolean } = {},
+): CodexMirrorResult {
   assertMirrorTargetIsSafeUnderTest(mirrorPath);
   try {
     const path = mirrorPath;
@@ -400,21 +413,45 @@ function mirrorCodexAuth(tokens: OAuthTokens, lastRefresh: string, mirrorPath: s
       && tokens.idToken.length > 0
       && typeof accountId === 'string'
       && accountId.length > 0;
+    // AUTH1 — the file is the Codex CLI's. Same account: rotate tokens as before. Different account
+    // (or ours unknown): leave it untouched unless the user asked to replace it — the old «hasBase»
+    // path kept the file's id_token/account_id and wrote our tokens next to them (two accounts mixed).
+    // Our account: id_token claim → stored claim → the access token's own claim. Refresh responses
+    // carry no id_token, and named rotation accounts keep their CLI homes in sync through this path —
+    // so an unknown account keeps the old rotation behaviour; only «both known and different» is refused.
+    const ourAccount = (typeof accountId === 'string' && accountId) || account.knownAccountId
+      || extractChatGPTClaims(tokens.accessToken)?.accountId || undefined;
+    const baseTokens = (existing.tokens && typeof existing.tokens === 'object') ? existing.tokens as Record<string, unknown> : {};
+    const baseAccount = typeof baseTokens.account_id === 'string' && baseTokens.account_id ? baseTokens.account_id : undefined;
+    let replaceWholly = false;
+    if (hasBase && baseAccount && !ourAccount) debug.log('oauth.codex-mirror', 'account-unknown', { path });
+    if (hasBase && baseAccount && ourAccount) {
+      if (ourAccount !== baseAccount) {
+        if (!account.replaceDifferentAccount || !canCreateUsableMirror) {
+          debug.log('oauth.codex-mirror', 'skipped-different-account', { path, replaceRequested: account.replaceDifferentAccount === true });
+          return 'skipped-different-account';
+        }
+        replaceWholly = true;
+      }
+    }
+
     if (!hasBase && !canCreateUsableMirror) {
       debug.log('oauth.codex-mirror', 'not-created-missing-cli-fields', { path });
       return 'not-created-missing-cli-fields';
     }
 
     mkdirSync(dirname(path), { recursive: true });
+    if (replaceWholly) existing = {};
+    const fresh = !hasBase || replaceWholly;
     const priorTokens = (existing.tokens && typeof existing.tokens === 'object')
       ? existing.tokens as Record<string, unknown> : {};
     existing.tokens = {
       ...priorTokens,
-      ...(hasBase ? {} : { id_token: tokens.idToken, account_id: accountId }),
+      ...(fresh ? { id_token: tokens.idToken, account_id: accountId } : {}),
       access_token: tokens.accessToken,
       refresh_token: tokens.refreshToken,
     };
-    if (!hasBase) {
+    if (fresh) {
       existing.OPENAI_API_KEY = null;
       existing.auth_mode = 'chatgpt';
     }

package/src/onboarding/continue-here.ts

@@ -0,0 +1,29 @@
+export interface ContinueHereOptions {
+  daemonRunning: boolean;
+  /** Resolved PWA URL for the running daemon, if available. */
+  pwaUrl?: string;
+  /** Already-issued short-lived phone connection link; never pass its token separately. */
+  phoneLink?: string;
+  telegramEnabled: boolean;
+  /** Non-interactive output must not include links (or QR payloads). */
+  interactive: boolean;
+}
+
+/** Render post-setup directions without inspecting the daemon, issuing credentials, or performing IO. */
+export function continueHereLines(opts: ContinueHereOptions): string[] {
+  const lines = ['  Continue here:'];
+  if (!opts.daemonRunning) lines.push('  Start the daemon: `elanous nexus run`');
+  if (opts.interactive && opts.daemonRunning && opts.pwaUrl) {
+    lines.push(`  Browser: ${opts.pwaUrl}`);
+  } else {
+    lines.push('  Browser: `elanous nexus show`');
+  }
+  if (opts.interactive && opts.daemonRunning && opts.phoneLink) {
+    lines.push(`  Phone: ${opts.phoneLink}`);
+    lines.push('  ⚠ This link contains a connection token — do not share it or include it in a public screenshot.');
+  } else {
+    lines.push('  Phone: `elanous phone link --temp --ttl 24h`');
+  }
+  if (opts.telegramEnabled) lines.push('  Telegram: `elanous telegram`');
+  return lines;
+}

package/src/onboarding/entry-hints.ts

@@ -0,0 +1,8 @@
+export const UNATTENDED_SETUP_COMMAND = 'elanous onboarding --non-interactive --config <answers.json>';
+export const SKILLS_STEP_COMMAND = 'elanous onboarding skills';
+
+export function unattendedSetupHint(): string {
+  return `unattended: \`${UNATTENDED_SETUP_COMMAND}\``;
+}
+
+export const SKILLS_LIST_DESCRIPTION = 'List elanous skills from configured skill directories (skills.activeSet / skills.dirs and packaged skills): subdirectories and the first non-heading line of each SKILL.md. Read-only.';

package/src/onboarding/full-screen-io.ts

@@ -147,6 +147,28 @@ export function fullScreenIO(opts: FullScreenIOOpts = {}): WizardIO {
     out.write(composeFullPaint(spec));
   };
 
+  // OB4(2026-10-01 · 0.2.6 실물): print() 는 «다음 질문 화면»에 묻어 그린다 — 그런데 기기 코드 로그인처럼
+  //   질문 없이 오래 기다리는 구간에선 다음 화면이 오지 않아 코드·URL 이 끝내 안 보이고, 원시 모드라 Ctrl-C 도
+  //   신호가 안 돼 «멈춤»이 됐다. 질문이 없을 때 print 는 곧바로 메시지 화면을 그리고 Ctrl-C 감시를 붙인다.
+  let questionDepth = 0;
+  let idleWatcher: ((chunk: string | Buffer) => void) | null = null;
+  const detachIdleWatcher = (): void => {
+    if (idleWatcher) { inp.off('data', idleWatcher); idleWatcher = null; }
+  };
+  const attachIdleWatcher = (): void => {
+    if (idleWatcher || !inp.isTTY) return;
+    idleWatcher = (chunk) => {
+      const s = typeof chunk === 'string' ? chunk : chunk.toString('utf8');
+      if (s.includes('\x03')) handleSigInt();
+    };
+    inp.on('data', idleWatcher);
+  };
+  const inQuestion = async <R>(fn: () => Promise<R>): Promise<R> => {
+    detachIdleWatcher();
+    questionDepth++;
+    try { return await fn(); } finally { questionDepth--; }
+  };
+
   // ── Raw key reader ──────────────────────────────────────────────
   const readKey = (): Promise<MiniKey> =>
     new Promise((resolve) => {
@@ -159,7 +181,12 @@ export function fullScreenIO(opts: FullScreenIOOpts = {}): WizardIO {
     });
 
   // ── choose ─────────────────────────────────────────────────────
-  const choose = async <T>(
+  const choose = <T>(
+    prompt: string,
+    options: ChoiceOption<T>[],
+    opts: ChooseOpts = {},
+  ): Promise<T> => inQuestion(() => chooseInner(prompt, options, opts));
+  const chooseInner = async <T>(
     prompt: string,
     options: ChoiceOption<T>[],
     opts: ChooseOpts = {},
@@ -343,11 +370,11 @@ export function fullScreenIO(opts: FullScreenIOOpts = {}): WizardIO {
 
   // ── ask ────────────────────────────────────────────────────────
   const ask = async (prompt: string): Promise<string> => {
-    return askInternal(prompt, false);
+    return inQuestion(() => askInternal(prompt, false));
   };
 
   const askSecret = async (prompt: string): Promise<string> => {
-    return askInternal(prompt, true);
+    return inQuestion(() => askInternal(prompt, true));
   };
 
   const askInternal = async (prompt: string, mask: boolean): Promise<string> => {
@@ -407,6 +434,10 @@ export function fullScreenIO(opts: FullScreenIOOpts = {}): WizardIO {
     // box — the wizard frame already contains the same info.
     if (isBannerLine(text)) return;
     messages.push({ text, kind: 'plain' });
+    if (questionDepth === 0) {
+      paint(buildScreenSpec({ kind: 'message', lines: [] }, 'Ctrl-C cancel'));
+      attachIdleWatcher();
+    }
   };
 
   return {
@@ -414,6 +445,7 @@ export function fullScreenIO(opts: FullScreenIOOpts = {}): WizardIO {
     askSecret,
     print,
     close: () => {
+      detachIdleWatcher();
       exitRaw();
       // Final clear so any leftover screen does not interfere with
       // the post-wizard CLI banner / dashboard.

package/src/onboarding/help/skills.md

@@ -16,4 +16,4 @@ per line, blank line to finish. Paths that don't exist yet are
 kept anyway so you can create them later.
 
 You can change the active preset any time via:
-    elanous setup skills
+    elanous onboarding skills

package/src/onboarding/non-interactive.ts

@@ -128,6 +128,7 @@ export function nonInteractiveIO(opts: NonInteractiveOptions = {}): WizardIO {
       section = STEP_SECTIONS[spec.index];
     },
     print,
+    nonInteractive: true,
     complete: reportUnusedAnswers,
     close: () => { /* no resources to release */ },
   };

package/src/onboarding/subscription-hint.ts

@@ -0,0 +1,27 @@
+// Onboarding step 1 — turn detected subscription logins into «Found» lines and a default provider (OB1 · 10-01).
+// A fresh user with a ChatGPT/Codex or Grok login was shown «Auto-detect (env vars)» preselected and nothing found.
+import type { DetectedProvider } from '../llm/provider-detect.js';
+
+export interface SubscriptionHint {
+  found: Array<{ provider: 'openai-codex' | 'grok'; line: string }>;
+  /** Provider to preselect when the user has not chosen one yet. */
+  preferred: 'openai-codex' | 'grok';
+}
+
+const SOURCE_LABEL: Record<string, string> = {
+  'codex-auth': '~/.codex/auth.json',
+  'elanous-auth': 'elanous login',
+  'grok-auth': '~/.grok/auth.json',
+};
+
+/** Subscriptions first: codex, then grok. With none found, codex is still the default (most users have ChatGPT). */
+export function subscriptionHint(detected: readonly DetectedProvider[]): SubscriptionHint {
+  const found: SubscriptionHint['found'] = [];
+  for (const provider of ['openai-codex', 'grok'] as const) {
+    const hit = detected.find(d => d.provider === provider && d.auth === 'oauth');
+    if (!hit) continue;
+    const name = provider === 'openai-codex' ? 'ChatGPT / Codex subscription' : 'Grok subscription';
+    found.push({ provider, line: `  Found ${name} (${SOURCE_LABEL[hit.source] ?? hit.source})` });
+  }
+  return { found, preferred: found[0]?.provider ?? 'openai-codex' };
+}

package/src/onboarding/web-first.ts

@@ -0,0 +1,83 @@
+import { spawnSync } from 'node:child_process';
+import { isHeadlessEnv } from '../acp/codex-auth.js';
+import { runNexusShow, type NexusShowResult } from '../cli/nexus-show.js';
+import { debug } from '../debug/log.js';
+import type { UserConfig } from '../user-config.js';
+
+export interface WebFirstSetupDeps {
+  config: Pick<UserConfig, 'onboarding'>;
+  isTty?: boolean;
+  terminal?: boolean;
+  showNexus?: () => Promise<NexusShowResult>;
+  issueSetupLinkToken?: () => Promise<string | { token: string }>;
+  renderQr?: (link: string) => string | undefined;
+  openBrowser?: (link: string) => boolean;
+  isHeadless?: () => boolean;
+  print?: (line: string) => void;
+}
+
+function setupUrl(pwa: string, token: string): string {
+  return `${pwa.replace(/\/app\/?$/, '').replace(/\/$/, '')}/setup#t=${encodeURIComponent(token)}`;
+}
+
+export async function runWebFirstSetup(deps: WebFirstSetupDeps): Promise<'link-shown' | 'fallback'> {
+  const observe = (event: 'link-shown' | 'fallback', reason?: string, qr = false, browserOpened = false, remote: 'loopback' | 'tailnet' = 'loopback') => {
+    try { debug.log('onboarding.web-first', event, { ...(reason ? { reason } : {}), qr, browserOpened, remote }); }
+    catch { /* Observability must not block onboarding. */ }
+  };
+  if (deps.config.onboarding.webFirst !== true) { observe('fallback', 'disabled'); return 'fallback'; }
+  if ((deps.isTty ?? (process.stdin.isTTY === true)) !== true) { observe('fallback', 'non-tty'); return 'fallback'; }
+  if (deps.terminal) { observe('fallback', 'terminal'); return 'fallback'; }
+
+  let shown: NexusShowResult;
+  try {
+    shown = await (deps.showNexus ?? (() => runNexusShow({ format: 'json', out: { log: () => {}, error: () => {} } })))();
+  } catch { observe('fallback', 'daemon-unavailable'); return 'fallback'; }
+  const running = shown.status === 'unregistered' || (shown.status === 'registered' && shown.instance?.alive === true);
+  if (!running || !shown.urls?.pwa.loopback) { observe('fallback', 'daemon-unavailable'); return 'fallback'; }
+
+  let token: string;
+  try {
+    const issue = deps.issueSetupLinkToken ?? (async () => {
+      const modulePath = '../auth/setup-link-token.js';
+      const mod = await import(modulePath) as { issueSetupLinkToken?: (options: Record<string, never>) => Promise<string | { token: string }> };
+      if (typeof mod.issueSetupLinkToken !== 'function') throw new Error('issuer-missing');
+      return mod.issueSetupLinkToken({});
+    });
+    const issued = await issue();
+    token = typeof issued === 'string' ? issued : issued?.token;
+    if (!token) throw new Error('issuer-missing');
+  } catch { observe('fallback', 'issuer-missing'); return 'fallback'; }
+
+  const print = deps.print ?? console.log;
+  const link = setupUrl(shown.urls.pwa.loopback, token);
+  const phoneLink = shown.urls.pwa.tailnet ? setupUrl(shown.urls.pwa.tailnet, token) : undefined;
+  print('브라우저에서 셋업을 이어가세요');
+  print(link);
+  let qr = false;
+  if (phoneLink) {
+    try {
+      const rendered = (deps.renderQr ?? ((url: string) => {
+        const result = spawnSync('qrencode', ['-t', 'ANSIUTF8', url], { encoding: 'utf8' });
+        return result.status === 0 ? result.stdout : undefined;
+      }))(phoneLink);
+      if (rendered) {
+        print(rendered);
+        print('같은 와이파이·tailnet 의 폰 카메라로 스캔하세요');
+        qr = true;
+      }
+    } catch { /* QR is optional. */ }
+  }
+  print('터미널에서 하려면: `elanous setup --terminal`');
+  let browserOpened = false;
+  if (!(deps.isHeadless ?? (() => isHeadlessEnv(process.env)))()) {
+    try {
+      browserOpened = (deps.openBrowser ?? ((url: string) => {
+        const command = process.platform === 'darwin' ? 'open' : process.platform === 'linux' || process.platform === 'freebsd' || process.platform === 'openbsd' ? 'xdg-open' : undefined;
+        return command ? spawnSync(command, [url], { stdio: 'ignore' }).status === 0 : false;
+      }))(link);
+    } catch { /* The displayed link remains usable. */ }
+  }
+  observe('link-shown', undefined, qr, browserOpened, phoneLink ? 'tailnet' : 'loopback');
+  return 'link-shown';
+}