elanous 0.2.6 → 0.2.7

package/src/task-orchestrator/surfaces/self-implement-pod.ts

@@ -50,7 +50,7 @@ import { findGitDir } from '../../git-fs/locate.js';
 import { debug } from '../../debug/log.js';
 import { selectLiveDetail } from '../../live/detail-switch.js';
 import { authStorePath } from '../../oauth/store.js';
-import { grokAuthFilePath, resolveGrokCredential } from '../../grok/credential.js';
+import { grokAuthFilePath, isGrokSubscriptionExpiring, refreshGrokSubscriptionToken, resolveGrokCredential } from '../../grok/credential.js';
 import { defaultGrokModel } from '../../grok/models.js';
 import { resolveHostId } from '../../platform/host-id.js';
 import { envLiteral } from '../../platform/env-literal.js';
@@ -171,12 +171,26 @@ export function hostCredentials(account: string, storePath: string = authStorePa
   return { elanousAuth, codexAuth, ghToken: ghToken() };
 }
 
-/** resolveGrokCredential 과 동일한 출처를 읽되 Pod 로는 refresh 없는 access 사본만 보낸다. */
+/** A Pod gets a refresh-less access copy, so the copy must outlive the Job: same rule as the Codex path (3 h). */
+export const POD_GROK_MIN_VALIDITY_MS = 3 * 3600_000;
+
+/** resolveGrokCredential 과 동일한 출처를 읽되 Pod 로는 refresh 없는 access 사본만 보낸다.
+ *  POD4 (10-01): the copy used to ship whatever the host had — an AUTH1 shard copied a token that had expired
+ *  4 minutes earlier and died at `grok-credential-preflight status=expired`. Refresh on the host first. */
 export function hostGrokCredentials(opts: {
   home?: string; env?: NodeJS.ProcessEnv; apiKeyOptIn?: boolean; ghToken?: () => string;
+  /** Test seams — the host refresh (read-only `grok models`) and the expiry probe. */
+  refresh?: () => void; isExpiring?: () => boolean;
 } = {}): { grokAuth?: string; grokApiKey?: string; ghToken: string } {
-  const credential = resolveGrokCredential({ home: opts.home, env: opts.env });
+  let credential = resolveGrokCredential({ home: opts.home, env: opts.env });
   if (credential?.kind === 'subscription') {
+    const expiring = opts.isExpiring ?? (() => isGrokSubscriptionExpiring({ home: opts.home, bufferMs: POD_GROK_MIN_VALIDITY_MS }));
+    if (expiring()) {
+      try { (opts.refresh ?? (() => { refreshGrokSubscriptionToken({ home: opts.home }); }))(); } catch { /* judged below */ }
+      if (expiring()) throw new Error('grok: 구독 access 토큰이 3시간 안에 만료 — 호스트 갱신(grok models)도 못 늘렸다 · 호스트에서 grok login 후 다시');
+      credential = resolveGrokCredential({ home: opts.home, env: opts.env });
+      if (credential?.kind !== 'subscription') throw new Error('grok: 갱신 뒤 구독 자격을 다시 읽지 못했다');
+    }
     const scopes = JSON.parse(readFileSync(grokAuthFilePath(opts.home), 'utf8')) as Record<string, unknown>;
     const redacted: Record<string, { key: string; expires_at?: string; user_id?: string }> = {};
     for (const [name, value] of Object.entries(scopes)) {
@@ -219,6 +233,64 @@ function githubRepositoryFromUrl(repoUrl: string): string | null {
 
 /** Job 스크립트의 salvage 단계 — 자식 rc 가 0 이 아닐 때만, 변경·미푸시 커밋이 있는 격리 워크트리를 `salvage/<job>/<worktree>` 로 push.
  *  main·self-impl/ 로는 절대 안 민다. 실패해도 제어 흐름을 바꾸지 않는다(호출자는 이 뒤에 `exit $rc`). */
+/**
+ * App installation tokens live one hour and only the host process renews them (at 10 minutes left).
+ * If that process dies (host reboot), nothing renews the Pod's token. hosts.yml unchanged for this long
+ * means the host is gone. Push a snapshot while the token still works.
+ */
+export const POD_GH_STALE_SECONDS = 53 * 60;
+
+/** Snapshot every worktree to salvage/<job>/<wt>-early without touching the child's index, worktree or HEAD. */
+export function podEarlySalvageScript(): string {
+  return [
+    'job_name="${ELANOUS_POD_NAME:-unknown-job}"',
+    'while IFS= read -r wt; do',
+    '  [ -n "$wt" ] || continue',
+    '  case "$wt" in /*) ;; *) continue ;; esac',
+    '  wt_name=$(basename -- "$wt")',
+    "  case \"$wt_name\" in ''|.*|*/*|*'..'*) continue ;; esac",
+    '  branch="salvage/${job_name}/${wt_name}-early"',
+    '  (',
+    '    set +e',
+    '    cd -- "$wt" || exit 0',
+    '    head=$(git rev-parse --verify -q HEAD) || { printf \'ELANOUS_POD_SALVAGE_NONE early-no-head\\n\'; exit 0; }',
+    '    idx=$(mktemp) || exit 0',
+    '    cp -- "$(git rev-parse --git-path index)" "$idx" 2>/dev/null || :',
+    '    GIT_INDEX_FILE="$idx" git add -A -- . >/dev/null 2>&1',
+    '    tree=$(GIT_INDEX_FILE="$idx" git write-tree 2>/dev/null)',
+    '    rm -f -- "$idx"',
+    '    [ -n "$tree" ] || { printf \'ELANOUS_POD_SALVAGE_NONE early-write-tree-failed\\n\'; exit 0; }',
+    '    base=$(git rev-parse --verify -q origin/HEAD || git rev-parse --verify -q origin/main || true)',
+    '    if [ "$tree" = "$(git rev-parse "${head}^{tree}")" ]; then',
+    '      if [ -z "$base" ] || [ "$(git rev-list --count "${base}..${head}" 2>/dev/null || echo 1)" = 0 ]; then printf \'ELANOUS_POD_SALVAGE_NONE clean\\n\'; exit 0; fi',
+    '      commit=$head',
+    '    else',
+    '      commit=$(git commit-tree "$tree" -p "$head" -m "salvage(early): ${job_name} host token refresh stopped") || { printf \'ELANOUS_POD_SALVAGE_NONE commit-failed\\n\'; exit 0; }',
+    '    fi',
+    '    git push --force origin "${commit}:refs/heads/${branch}" || { printf \'ELANOUS_POD_SALVAGE_NONE push-failed\\n\'; exit 0; }',
+    "    printf 'ELANOUS_POD_SALVAGE %s %s\\n' \"$branch\" \"$commit\"",
+    '  )',
+    "done < <(git worktree list --porcelain 2>/dev/null | awk '/^worktree / { sub(/^worktree /, \"\"); print }')",
+  ].join('\n');
+}
+
+/** Background watchdog: fires the early snapshot once when hosts.yml has not been rewritten for staleSeconds. */
+export function podGithubWatchdogScript(staleSeconds: number, intervalSeconds = 30): string {
+  return [
+    '(',
+    `  while sleep ${intervalSeconds}; do`,
+    '    f="$GH_CONFIG_DIR/hosts.yml"',
+    '    m=$(stat -c %Y "$f" 2>/dev/null || stat -f %m "$f" 2>/dev/null) || continue',
+    '    age=$(( $(date +%s) - m ))',
+    `    [ "$age" -ge ${staleSeconds} ] || continue`,
+    "    printf 'ELANOUS_POD_GH_STALE %s\\n' \"$age\"",
+    `    ${podEarlySalvageScript().split('\n').join('\n    ')}`,
+    '    break',
+    '  done',
+    ') & gh_watch_pid=$!',
+  ].join('\n');
+}
+
 export function podSalvageScript(): string {
   return [
     'if [ "${rc:-0}" -ne 0 ]; then',
@@ -368,7 +440,7 @@ export function podMemoryLimitFor(feature: string, env: NodeJS.ProcessEnv | Read
   return { limit: a !== null && b !== null && a > b ? base : high, tier, source };
 }
 
-export function podJobManifest(o: { name: string; namespace: string; image: string; /** 레지스트리 이미지면 IfNotPresent(노드가 pull) · 반입 이미지면 Never. */ imagePullPolicy?: 'Never' | 'IfNotPresent'; repoUrl: string; source?: PodSource; hostMirror?: string; args: readonly string[]; passEnv: readonly string[]; deadlineSeconds: number; runId?: string; parentRunId?: string; armEnv?: Readonly<Record<string, string>>; hostId?: string; imageCommit?: string | null; skillEnvs?: readonly string[]; memoryLimit?: string; goalDoc?: string; grokCredential?: 'subscription' | 'api_key'; codexAccounts?: readonly string[]; appCredential?: boolean }): Record<string, unknown> {
+export function podJobManifest(o: { name: string; namespace: string; image: string; /** 레지스트리 이미지면 IfNotPresent(노드가 pull) · 반입 이미지면 Never. */ imagePullPolicy?: 'Never' | 'IfNotPresent'; repoUrl: string; source?: PodSource; hostMirror?: string; args: readonly string[]; passEnv: readonly string[]; deadlineSeconds: number; runId?: string; parentRunId?: string; armEnv?: Readonly<Record<string, string>>; hostId?: string; imageCommit?: string | null; skillEnvs?: readonly string[]; memoryLimit?: string; goalDoc?: string; grokCredential?: 'subscription' | 'api_key'; codexAccounts?: readonly string[]; appCredential?: boolean; /** Test seam — default POD_GH_STALE_SECONDS. */ githubStaleSeconds?: number }): Record<string, unknown> {
   const quoted = o.args.map((a) => `'${a.replace(/'/g, `'\\''`)}'`).join(' ');
   const goalPath = o.goalDoc ? `'${(o.goalDoc.startsWith('-') ? `./${o.goalDoc}` : o.goalDoc).replace(/'/g, `'\\''`)}'` : undefined;
   const askBaseIndex = o.goalDoc ? o.args.indexOf('--base') : -1;
@@ -394,6 +466,7 @@ export function podJobManifest(o: { name: string; namespace: string; image: stri
     ] : []),
     // Only fixed command shapes leave the Pod; arbitrary argv (including shell -c text) is never emitted.
     `(while :; do { mem=$(if [ -r /sys/fs/cgroup/memory.current ]; then cat /sys/fs/cgroup/memory.current; elif [ -r /sys/fs/cgroup/memory/memory.usage_in_bytes ]; then cat /sys/fs/cgroup/memory/memory.usage_in_bytes; else printf -- -; fi); top=$(ps -eo rss=,comm=,args= --sort=-rss | head -5 | awk 'function encode(s) { gsub(/%/, "%25", s); gsub(/:/, "%3A", s); gsub(/ /, "%20", s); gsub(/\\t/, "%09", s); return s } { rss=$1; name=$2; sub(/^[[:space:]]*[0-9]+[[:space:]]+[^[:space:]]+[[:space:]]*/, ""); n=split($0, a, /[[:space:]]+/); cmd="<redacted>"; if (name=="sleep" && a[2]=="30") cmd="sleep 30" (n>2 ? " <redacted>" : ""); else if (name=="bun") { cmd="bun <redacted>"; if (a[2]=="test") cmd="bun test <redacted>"; else if (a[2]=="run") cmd="bun run <redacted>"; else if ((a[2]=="x" || a[2]=="exec") && a[3]=="tsc") cmd="bun x tsc <redacted>" } else if (name=="tsc") cmd="tsc <redacted>"; else if (name=="elanous") { cmd="elanous <redacted>"; if (a[2]=="self") cmd="elanous self <redacted>"; else if (a[2]=="harness") cmd="elanous harness <redacted>" } else if (name=="node") cmd="node <redacted>"; if (name=="sleep" && cmd=="<redacted>") cmd="sleep <redacted>"; else if (cmd=="<redacted>" && name!="bash" && name!="sh") name="other"; printf " %s:%s:%s", rss, encode(name), encode(substr(cmd,1,120)) }'); printf "ELANOUS_MEM %s %s%s\\n" "$(date +%s)" "$mem" "$top"; } || true; sleep 15 || break; done) & mem_sampler_pid=$!`,
+    ...(o.appCredential ? [podGithubWatchdogScript(o.githubStaleSeconds ?? POD_GH_STALE_SECONDS)] : []),
     // 마지막 줄 JSON 이 «맨 끝»이어야 한다(parseSelfImplementJson) — rollup 은 그 앞에.
     goalPath
       ? `elanous harness ask ${goalPath} --json${quotedAsk} > /tmp/si.out 2>&1; rc=$?; bun -e 'const fs=require("fs");const p="/tmp/si.out";const s=fs.readFileSync(p,"utf8");const line=s.trimEnd().split("\\n").at(-1);try{const o=JSON.parse(line);if(o.kind==="self"&&o.result&&typeof o.result==="object")fs.appendFileSync(p,"\\n"+JSON.stringify({...o.result,...(typeof o.ok==="boolean"?{ok:o.ok}:{})})+"\\n")}catch{}'`
@@ -454,6 +527,7 @@ for ledger in "\${ELANOUS_STATE_DIR:-$HOME/.elanous}"/run-ledger/*.jsonl; do
 done
 if [ "$found" -eq 0 ]; then echo ELANOUS_RUN_LEDGER_NONE; fi`,
     'kill "$mem_sampler_pid" 2>/dev/null || true',
+    ...(o.appCredential ? ['kill "$gh_watch_pid" 2>/dev/null || true'] : []),
     'wait "$mem_sampler_pid" 2>/dev/null || true',
     'tail -n 1 /tmp/si.out',
     podSalvageScript(),

package/src/telegram.ts

@@ -66,9 +66,11 @@ import { observeDevRequestRouteFailSoft } from './skills/dev-request-router.js';
 import { runUrlRoute } from './skills/url-route-exec.js';
 import { recordRoutedLinkAbsorbed } from './intake-plane/link-ledger.js';
 import { classifyFrontInput } from './intake-plane/front-classifier.js';
+import { handleTelegramSeatWork, type TelegramSeatWorkDeps } from './intake-plane/telegram-seat-work.js';
 import { effectiveInstanceRoot } from './instance/resolve.js';
 import { getElanousConfigDir } from './elanous-config-dir.js';
 import { defaultFieldEvent, FieldUploadError, parseFieldCaption, resolveFieldMime, saveFieldMedia } from './field/field-media.js';
+import { scheduleFieldReel, type FieldReelOptions } from './field/field-reel.js';
 
 export type TgAttachmentKind = 'photo' | 'voice' | 'audio' | 'document';
 
@@ -206,10 +208,14 @@ export interface TelegramBotOpts {
    *  independently of the LLM chat path. Best-effort: errors are
    *  swallowed by the caller — never blocks chat reply. */
   onTriggerTap?: (event: TgTriggerEvent) => void | Promise<void>;
+  /** Test seam for addressed seat intake; defaults to the real intake door. */
+  seatWorkDeps?: TelegramSeatWorkDeps;
   /** `#현장` 기본 행사 — 없으면 `slashContext.userConfig.telegram.fieldDefaultEvent` · 그것도 없으면 `field-<로컬 날짜>`. */
   fieldDefaultEvent?: string;
   /** 시험 seam — 현장 폴더 뿌리(기본 `getElanousConfigDir()`). */
   fieldRootDir?: () => string;
+  /** 시험에서는 실제 렌더 대신 가짜 실행기를 주입한다. */
+  fieldReel?: FieldReelOptions;
 }
 
 /** Surface-unification v2 (FU-2) — Telegram trigger event passed to
@@ -326,6 +332,8 @@ export class TelegramBot {
   private readonly globalWindow: number[] = [];
   private readonly fieldDefaultEventOpt?: string;
   private readonly fieldRootDir: () => string;
+  private readonly fieldReel?: FieldReelOptions;
+  private readonly seatWorkDeps: TelegramSeatWorkDeps;
   /** 앨범 id → `#현장` 행사 · 답장 디바운스. 태그된 앨범만 들어온다. */
   private readonly fieldGroups = new Map<string, {
     event: string; at: number; chatId: number; threadId?: number; replyTo: number; count: number;
@@ -359,6 +367,8 @@ export class TelegramBot {
     this.voiceAdapter = opts.voiceAdapter;
     this.fieldDefaultEventOpt = opts.fieldDefaultEvent;
     this.fieldRootDir = opts.fieldRootDir ?? getElanousConfigDir;
+    this.fieldReel = opts.fieldReel;
+    this.seatWorkDeps = opts.seatWorkDeps ?? {};
     if (opts.onTriggerTap) {
       // Assign through `as unknown` to bypass `readonly` + private —
       // the tap is set once at construction and never reassigned.
@@ -796,6 +806,7 @@ export class TelegramBot {
     replyTo?: number;
     threadId?: number;
     caption?: string;
+    mimeType?: string;
   } = {}): Promise<{ messageId: number } | undefined> {
     // Per-chat gap mirror — keep telegram happy on rapid document spills.
     const last = this.chatLastSentAt.get(chatId) ?? 0;
@@ -816,7 +827,7 @@ export class TelegramBot {
     new Uint8Array(blobBytes).set(bytes);
     form.set(
       'document',
-      new Blob([blobBytes], { type: 'text/plain' }),
+      new Blob([blobBytes], { type: opts.mimeType ?? 'text/plain' }),
       filename,
     );
 
@@ -1402,7 +1413,23 @@ export class TelegramBot {
         }
       }
       // 글(자막)은 캡션이 달린 항목에만 있다 — 앨범이면 첫 장에만 붙는다(MK 2026-09-30).
-      count = saveFieldMedia(inputs, { rootDir: this.fieldRootDir(), event, device: 'telegram', ...(tag?.text ? { caption: tag.text } : {}) }).count;
+      const saved = saveFieldMedia(inputs, { rootDir: this.fieldRootDir(), event, device: 'telegram', ...(tag?.text ? { caption: tag.text } : {}) });
+      count = saved.count;
+      scheduleFieldReel(saved.dir, {
+        ...this.fieldReel,
+        notificationKey: `telegram:${this.botId}:${ctx.chatId}:${ctx.threadId ?? ''}:${ctx.mediaGroupId ?? ctx.messageId}`,
+        onDone: async (result) => {
+          const reply = { replyTo: ctx.messageId, threadId: ctx.threadId };
+          if (result.ok && result.file) {
+            const sent = await this.sendDocument(ctx.chatId, readFileSync(result.file), 'reel-9x16.mp4', {
+              ...reply, mimeType: 'video/mp4', caption: `현장 영상 · ${event} · ${result.seconds}초`,
+            });
+            if (!sent) throw new Error('sendDocument failed');
+          } else {
+            await this.sendMessage(ctx.chatId, `현장 영상 실패 · ${event} · ${result.error ?? 'render failed'}`, reply);
+          }
+        },
+      });
       debug.log('field.upload', 'saved', { surface: 'telegram', files: inputs.length, count, album: !!ctx.mediaGroupId });
     } catch (err) {
       failure = err instanceof FieldUploadError ? err.code : 'download-failed';
@@ -1440,6 +1467,15 @@ export class TelegramBot {
     }
     // 현장 업로드 — `#현장` 캡션(또는 태그된 앨범의 나머지)의 사진·영상은 LLM 대신 현장 폴더로.
     if (await this.tryHandleFieldUpload(ctx)) return;
+    if (ctx.text.startsWith('@')) {
+      const reply = await handleTelegramSeatWork(ctx.text, {
+        chatId: ctx.chatId, messageId: ctx.messageId, threadId: ctx.threadId, botId: ctx.botId,
+      }, this.seatWorkDeps);
+      if (reply !== null) {
+        await this.sendMessage(ctx.chatId, reply, { replyTo: ctx.messageId, threadId: ctx.threadId });
+        return;
+      }
+    }
     // 영상은 `#현장` 저장 전용으로만 파싱한다 — 그 밖의 영상은 종전처럼 무시한다.
     if (ctx.video && ctx.attachments.length === 0) return;
     // Cascade-zyu U2 — capture utterance intent at update ingress.

package/src/tool-runtime/elanous-skills-list-runtime.ts

@@ -2,7 +2,7 @@
 // `elanous_skills_list` MCP tool. Mirrors the daemon-side ACP method
 // `elanous/skills/list` (src/acp/server.ts:2241) but session-agnostic so
 // the codex app-server can call it through the elanous-tools MCP server
-// without first opening an ACP session. Enumerates `~/.elanous/skills/*`
+// without first opening an ACP session. Enumerates configured skill roots
 // and surfaces the first non-heading line of each SKILL.md as the
 // description.
 //
@@ -14,6 +14,7 @@
 import { join } from 'node:path';
 import { readdir, readFile } from 'node:fs/promises';
 import { defaultSkillDirs } from '../user-config.js';
+import { SKILLS_LIST_DESCRIPTION } from '../onboarding/entry-hints.js';
 import type { LLMToolSpec } from '../llm.js';
 import type { ToolRuntime } from './types.js';
 
@@ -41,8 +42,7 @@ export interface ElanousSkillsListResult extends Record<string, unknown> {
 export function buildElanousSkillsListTool(): LLMToolSpec {
   return {
     name: 'elanous_skills_list',
-    description:
-      'List installed elanous skills (sub-directories of ~/.elanous/skills with optional SKILL.md). Codex app-server callback via the elanous-tools MCP server. Read-only.',
+    description: SKILLS_LIST_DESCRIPTION,
     parameters: {
       type: 'object',
       properties: {

package/src/tool-runtime/self-cognition-runtimes.ts

@@ -1,7 +1,9 @@
 import { createRequire } from 'node:module';
+import { isMainThread, parentPort, Worker } from 'node:worker_threads';
+import { debug } from '../debug/log.js';
 import type { LLMToolSpec } from '../llm.js';
 import type { NativeToolCatalogEntry } from '../native-tool-catalog.js';
-import type { ToolRunResult, ToolRuntime } from './types.js';
+import type { ToolRunResult, ToolRuntime, ToolRuntimeContext } from './types.js';
 
 /** Canonical names for the read-only self-cognition surface. */
 export const SELF_COGNITION_TOOL_NAMES = [
@@ -12,6 +14,7 @@ export const SELF_COGNITION_TOOL_NAMES = [
 ] as const;
 
 type SelfCognitionToolName = (typeof SELF_COGNITION_TOOL_NAMES)[number];
+type RecallToolName = 'memory_recall' | 'self_recall';
 type CoreToolsModule = typeof import('../domains/core-tools.js');
 
 const require = createRequire(import.meta.url);
@@ -32,12 +35,167 @@ function toToolRunResult(result: unknown): ToolRunResult {
     : { output: String(result) };
 }
 
+const PROGRESS_MS = 10_000;
+const DEFAULT_BUDGET_MS = 60_000;
+const MAX_TIMER_MS = 2_147_483_647;
+
+function hitCount(result: ToolRunResult): number {
+  const data: Record<string, unknown> = result;
+  return Array.isArray(data.hits) ? data.hits.length
+    : Array.isArray(data.events) ? data.events.length
+      : data.restored ? 1 : 0;
+}
+
+function partialResult(name: RecallToolName, result: ToolRunResult | undefined, budgetMs: number): ToolRunResult {
+  const fallback = name === 'memory_recall' ? { hits: [], count: 0 } : { events: [], count: 0, docs: null };
+  const snapshot: Record<string, unknown> = result ?? fallback;
+  const budgetSeconds = budgetMs / 1000;
+  return {
+    ...snapshot,
+    partial: true,
+    note: `${typeof snapshot.note === 'string' ? `${snapshot.note}\n` : ''}(찾던 중 ${budgetSeconds}초에서 멈췄습니다 — 더 찾을까요?)`,
+  };
+}
+
+/** A deadline returns the latest completed search stage; late results cannot replace it. */
+export async function runBudgetedRecall(
+  name: RecallToolName,
+  args: Record<string, unknown>,
+  ctx: ToolRuntimeContext,
+  search: (onPartial: (result: ToolRunResult) => void) => Promise<ToolRunResult>,
+  stop: () => void = () => {},
+  progressAfterMs = PROGRESS_MS,
+): Promise<ToolRunResult> {
+  const started = Date.now();
+  const budgetMs = typeof args.timeBudgetMs === 'number' && Number.isFinite(args.timeBudgetMs) && args.timeBudgetMs > 0
+    ? Math.min(args.timeBudgetMs, MAX_TIMER_MS) : DEFAULT_BUDGET_MS;
+  let latest: ToolRunResult | undefined;
+  let settled = false;
+  const query = typeof args.query === 'string' && args.query.trim()
+    ? args.query.trim().replace(/\s+/g, ' ').slice(0, 80)
+    : name === 'self_recall' ? '자기 구현·자율행동 이력' : '최근 발송·대화';
+  const log = (event: 'progress' | 'budget-hit' | 'done', result?: ToolRunResult) => {
+    debug.log('tool.memory-recall', event, { elapsedMs: Date.now() - started, hits: hitCount(result ?? latest ?? {}) });
+  };
+  let progressTimer: ReturnType<typeof setTimeout> | undefined;
+  let budgetTimer: ReturnType<typeof setTimeout> | undefined;
+  return new Promise<ToolRunResult>((resolve, reject) => {
+    const finish = (result: ToolRunResult, budgetHit: boolean) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(progressTimer);
+      clearTimeout(budgetTimer);
+      log(budgetHit ? 'budget-hit' : 'done', result);
+      if (budgetHit) stop();
+      resolve(result);
+    };
+    progressTimer = setTimeout(() => {
+      if (settled) return;
+      const line = `기억을 찾는 중 — ${query}`;
+      ctx.emitFeedback?.({
+        envelopeVersion: 1,
+        sessionId: ctx.sessionId ?? '',
+        blockId: `${ctx.sessionId ?? 'recall'}:tool:${ctx.toolCallId ?? name}:progress`,
+        parentToolCallId: ctx.toolCallId,
+        kind: 'tool.progress', phase: 'delta', emittedAt: Date.now(), seq: 1,
+        payload: { stream: 'generic', lines: [line] }, asciiFallback: [line],
+      });
+      log('progress');
+    }, progressAfterMs);
+    budgetTimer = setTimeout(() => finish(partialResult(name, latest, budgetMs), true), budgetMs);
+    try {
+      void search(result => { if (!settled) latest = result; }).then(
+        result => finish(result, false),
+        error => {
+          if (settled) return;
+          settled = true;
+          clearTimeout(progressTimer);
+          clearTimeout(budgetTimer);
+          stop();
+          reject(error);
+        },
+      );
+    } catch (error) {
+      settled = true;
+      clearTimeout(progressTimer);
+      clearTimeout(budgetTimer);
+      stop();
+      reject(error);
+    }
+  });
+}
+
+// Separate thread: synchronous SQLite and S3 restore must not block progress/deadline timers.
+if (!isMainThread && parentPort) {
+  parentPort.on('message', async ({ name, args }: { name: RecallToolName; args: Record<string, unknown> }) => {
+    try {
+      if (name === 'self_recall') {
+        const { existsSync } = await import('node:fs');
+        const { surfaceEventsDbPath, openSurfaceEventsDb, recallEvents } = await import('../domains/surface-events.js');
+        if (existsSync(surfaceEventsDbPath())) {
+          const db = openSurfaceEventsDb();
+          try {
+            const query = typeof args.query === 'string' ? args.query : '';
+            const hits = recallEvents(db, {
+              domain: 'elanous',
+              sinceHours: typeof args.sinceHours === 'number' ? args.sinceHours : 720,
+              limit: typeof args.limit === 'number' ? args.limit : 8,
+              ...(query ? { query } : {}),
+            });
+            const events = hits.map(h => ({
+              when: h.ts, tool: h.surface, kind: h.kind ?? 'impl',
+              summary: (h.summary ?? h.text).slice(0, 300), score: Math.round(h.score * 1000) / 1000,
+            }));
+            parentPort?.postMessage({ stage: 'partial', result: { events, count: events.length, docs: null } });
+          } catch { /* self_recall's episode stage is fail-soft */ } finally { db.close(); }
+        }
+      }
+      const result = await coreTools().dispatchRecallUnbudgeted(name, args, partial => {
+        parentPort?.postMessage({ stage: 'partial', result: partial });
+      });
+      parentPort?.postMessage({ stage: 'done', result });
+    } catch (error) {
+      parentPort?.postMessage({ stage: 'error', error: error instanceof Error ? error.message : String(error) });
+    }
+  });
+}
+
+export type RecallSearch = (name: RecallToolName, args: Record<string, unknown>, onPartial: (result: ToolRunResult) => void) => Promise<ToolRunResult>;
+
+export function runRecall(name: RecallToolName, args: Record<string, unknown>, ctx: ToolRuntimeContext, injectedSearch?: RecallSearch, onPartial?: (result: ToolRunResult) => void): Promise<ToolRunResult> {
+  const worker = injectedSearch ? undefined : new Worker(new URL(import.meta.url));
+  let active = true;
+  const search = (capture: (result: ToolRunResult) => void) => {
+    const report = (result: ToolRunResult) => {
+      if (!active) return;
+      capture(result);
+      onPartial?.(result);
+    };
+    return injectedSearch
+      ? injectedSearch(name, args, report)
+      : new Promise<ToolRunResult>((resolve, reject) => {
+        worker!.on('message', (message: { stage: string; result?: unknown; error?: string }) => {
+          if (message.stage === 'partial') report(toToolRunResult(message.result));
+          else if (message.stage === 'done') resolve(toToolRunResult(message.result));
+          else if (message.stage === 'error') reject(new Error(message.error));
+        });
+        worker!.on('error', reject);
+        worker!.on('exit', code => { if (code !== 0) reject(new Error(`Recall worker exited: ${code}`)); });
+        worker!.postMessage({ name, args });
+      });
+  };
+  return runBudgetedRecall(name, args, ctx, search, () => { active = false; if (worker) void worker.terminate(); })
+    .finally(() => { active = false; if (worker) void worker.terminate(); });
+}
+
 export const SELF_COGNITION_RUNTIMES: readonly ToolRuntime[] = SELF_COGNITION_TOOL_NAMES.map(name => ({
   id: name,
   get spec() {
     return coreSpec(name);
   },
-  run: async (args) => toToolRunResult(await coreTools().buildCoreTools().dispatch(name, args)),
+  run: async (args, ctx) => name === 'memory_recall' || name === 'self_recall'
+    ? runRecall(name, args, ctx)
+    : toToolRunResult(await coreTools().buildCoreTools().dispatch(name, args)),
 }));
 
 /** MCP catalog metadata derived from the same name ledger as the runtimes. */