elanous 0.2.8 → 0.2.10

package/src/ask-user-question/pending-questions.ts

@@ -3,16 +3,13 @@ import { join } from 'node:path';
 
 import { elanousStateRoot } from '../autopilot/state-paths.js';
 import { ASK_USER_QUESTION_DELIVERY_VALUES } from './types.js';
-import type { AskUserQuestionRequest, AskUserQuestionResult, HitlDelivery, QuestionOption } from './types.js';
+import type { AskUserQuestionRequest, AskUserQuestionResult, HitlDelivery, Question, QuestionOption } from './types.js';
 
-interface PendingQuestion {
+export interface PendingQuestion {
   id: string;
   sessionId?: string;
-  questions: Array<{
-    id: string;
-    question: string;
-    options: QuestionOption[];
-  }>;
+  runId?: string;
+  questions: Array<Pick<Question, 'id' | 'question' | 'options' | 'impact' | 'recommendedIndex'>>;
   startedAt: string;
   expiresAt?: string;
   surface: 'tui' | 'file';
@@ -86,6 +83,7 @@ function isPendingQuestion(value: unknown): value is PendingQuestion {
   const pending = value as Record<string, unknown>;
   return typeof pending.id === 'string'
     && (pending.sessionId === undefined || typeof pending.sessionId === 'string')
+    && (pending.runId === undefined || typeof pending.runId === 'string')
     && Array.isArray(pending.questions)
     && pending.questions.every((question) => {
       if (question === null || typeof question !== 'object' || Array.isArray(question)) return false;
@@ -93,7 +91,10 @@ function isPendingQuestion(value: unknown): value is PendingQuestion {
       return typeof record.id === 'string'
         && typeof record.question === 'string'
         && Array.isArray(record.options)
-        && record.options.every(isQuestionOption);
+        && record.options.every(isQuestionOption)
+        && (record.impact === undefined || record.impact === 'low' || record.impact === 'medium' || record.impact === 'high' || record.impact === 'critical')
+        && (record.recommendedIndex === undefined || (typeof record.recommendedIndex === 'number'
+          && Number.isInteger(record.recommendedIndex)));
     })
     && isIsoTimestamp(pending.startedAt)
     && (pending.surface === 'tui' || pending.surface === 'file')
@@ -111,7 +112,15 @@ function isPendingQuestion(value: unknown): value is PendingQuestion {
 function parsePendingQuestion(contents: string, file: string): PendingQuestion {
   const value: unknown = JSON.parse(contents);
   if (!isPendingQuestion(value)) throw new Error(`Invalid pending question record: ${file}`);
-  return value;
+  return {
+    ...value,
+    questions: value.questions.map((question) => ({
+      ...question,
+      ...(question.recommendedIndex !== undefined
+        && (question.recommendedIndex < 0 || question.recommendedIndex >= question.options.length)
+        ? { recommendedIndex: undefined } : {}),
+    })),
+  };
 }
 
 export function isAskUserQuestionResult(value: unknown): value is AskUserQuestionResult {
@@ -176,7 +185,13 @@ export function createPendingQuestion(
   return {
     id,
     ...(sessionId === undefined ? {} : { sessionId }),
-    questions: request.questions.map(({ id, question, options }) => ({ id, question, options })),
+    ...(request.runId === undefined ? {} : { runId: request.runId }),
+    questions: request.questions.map(({ id, question, options, impact, recommendedIndex }) => ({
+      id, question, options,
+      ...(impact === undefined ? {} : { impact }),
+      ...(recommendedIndex !== undefined && Number.isInteger(recommendedIndex) && recommendedIndex >= 0 && recommendedIndex < options.length
+        ? { recommendedIndex } : {}),
+    })),
     startedAt: (deps.now ?? (() => new Date()))().toISOString(),
     ...(presentation.expiresAt === undefined ? {} : { expiresAt: presentation.expiresAt }),
     surface: presentation.surface,

package/src/ask-user-question/types.ts

@@ -13,6 +13,7 @@
 // behaviour exactly.
 
 import type { HitlDelivery } from '../hitl/types.js';
+import type { ClarificationImpact } from '../hitl/clarification-policy.js';
 export type { HitlDelivery };
 
 export interface QuestionOption {
@@ -37,6 +38,9 @@ export interface Question {
   question: string;
   /** 2–4 pre-defined choices. */
   options: QuestionOption[];
+  impact?: ClarificationImpact;
+  /** Zero-based position in options; an out-of-range value is ignored. */
+  recommendedIndex?: number;
   /** When true, user can pick more than one option; Space toggles,
    *  Enter submits. Default false. */
   multiSelect?: boolean;
@@ -49,6 +53,7 @@ export interface Question {
 
 export interface AskUserQuestionRequest {
   questions: Question[];   // 1–3
+  runId?: string;
   /** AXON F4 — optional routing hint. When set, callers with HITL
    *  resolvers can fan the prompt out to Telegram/Discord/etc;
    *  omitted (or `'modal'` / `'terminal'`) keeps the existing TUI
@@ -165,6 +170,9 @@ export function parseQuestionRequest(
       header,
       question,
       options,
+      ...(item.impact === 'low' || item.impact === 'medium' || item.impact === 'high' || item.impact === 'critical' ? { impact: item.impact } : {}),
+      ...(typeof item.recommendedIndex === 'number' && Number.isInteger(item.recommendedIndex)
+        && item.recommendedIndex >= 0 && item.recommendedIndex < options.length ? { recommendedIndex: item.recommendedIndex } : {}),
       multiSelect: item.multiSelect === true,
       includeOther: item.includeOther !== false,  // default true
     });
@@ -186,5 +194,6 @@ export function parseQuestionRequest(
 
   const req: AskUserQuestionRequest = { questions: parsed };
   if (delivery !== undefined) req.delivery = delivery;
+  if (typeof raw.runId === 'string') req.runId = raw.runId;
   return { ok: true, req };
 }

package/src/auth/setup-link-tokens.fixture.ts

@@ -0,0 +1,19 @@
+import { openSync } from 'node:fs';
+import { join } from 'node:path';
+import { dlopen, FFIType } from 'bun:ffi';
+import { claimSetupLinkToken } from './setup-link-tokens.js';
+
+const [mode, dir, token, now] = process.argv.slice(2);
+if (mode === 'claim') {
+  process.stdout.write(JSON.stringify(claimSetupLinkToken(token, { dir, now: Number(now) })));
+} else if (mode === 'hold') {
+  const fd = openSync(join(dir, 'setup-link-tokens.json.lock'), 'r+');
+  const libc = dlopen(process.platform === 'darwin' ? '/usr/lib/libSystem.B.dylib' : 'libc.so.6', {
+    flock: { args: [FFIType.i32, FFIType.i32], returns: FFIType.i32 },
+  });
+  if (libc.symbols.flock(fd, 2) !== 0) throw new Error('failed to acquire lock');
+  process.stdout.write('locked\n');
+  await new Promise<void>(() => { setInterval(() => {}, 1000); });
+} else {
+  throw new Error(`unknown fixture mode: ${mode}`);
+}

package/src/auth/setup-link-tokens.ts

@@ -0,0 +1,164 @@
+import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
+import { closeSync, constants, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { dlopen, FFIType } from 'bun:ffi';
+import { getElanousConfigDir } from '../elanous-config-dir.js';
+
+export const SETUP_LINK_TTL_MS = 10 * 60_000;
+const SETUP_BEARER_TTL_MS = 24 * 60 * 60_000;
+const LINK_PREFIX = 'els_';
+const BEARER_PREFIX = 'elsb_';
+const HASH_PATTERN = /^[a-f0-9]{64}$/;
+const LINK_PATTERN = /^els_[A-Za-z0-9_-]{43}$/;
+const BEARER_PATTERN = /^elsb_[A-Za-z0-9_-]{43}$/;
+
+interface SetupLinkEntry {
+  hash: string;
+  expiresAt: string;
+  usedAt?: string;
+  bearerHash?: string;
+  bearerExpiresAt?: string;
+}
+
+type ClaimResult =
+  | { ok: true; bearer: string; expiresAt: string }
+  | { ok: false; reason: 'unknown' | 'used' | 'expired' };
+
+function storePath(dir: string): string { return join(dir, 'setup-link-tokens.json'); }
+function hashOf(token: string): string { return createHash('sha256').update(token).digest('hex'); }
+function mint(prefix: string): string { return `${prefix}${randomBytes(32).toString('base64url')}`; }
+
+function readStore(dir: string): SetupLinkEntry[] {
+  let raw: string;
+  try {
+    const path = storePath(dir);
+    const st = lstatSync(path);
+    if (!st.isFile() || (st.mode & 0o077) !== 0) throw new Error('setup link store must be a private regular file (0600)');
+    raw = readFileSync(path, 'utf8');
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return [];
+    throw error;
+  }
+  const parsed: unknown = JSON.parse(raw);
+  if (!parsed || typeof parsed !== 'object' || !('tokens' in parsed) || !Array.isArray(parsed.tokens)) {
+    throw new Error('setup link store is malformed');
+  }
+  const entries: unknown[] = parsed.tokens;
+  if (!entries.every((entry) => {
+    if (!entry || typeof entry !== 'object') return false;
+    const t = entry as Partial<SetupLinkEntry>;
+    return typeof t.hash === 'string' && HASH_PATTERN.test(t.hash)
+      && typeof t.expiresAt === 'string' && Number.isFinite(Date.parse(t.expiresAt))
+      && (t.usedAt === undefined || (typeof t.usedAt === 'string' && Number.isFinite(Date.parse(t.usedAt))))
+      && (t.bearerHash === undefined || (typeof t.bearerHash === 'string' && HASH_PATTERN.test(t.bearerHash)))
+      && (t.bearerExpiresAt === undefined || (typeof t.bearerExpiresAt === 'string' && Number.isFinite(Date.parse(t.bearerExpiresAt))))
+      && ((t.usedAt === undefined && t.bearerHash === undefined && t.bearerExpiresAt === undefined)
+        || (t.usedAt !== undefined && t.bearerHash !== undefined && t.bearerExpiresAt !== undefined));
+  })) throw new Error('setup link store is malformed');
+  return entries as SetupLinkEntry[];
+}
+
+function writeStore(dir: string, tokens: SetupLinkEntry[]): void {
+  mkdirSync(dir, { recursive: true, mode: 0o700 });
+  const path = storePath(dir);
+  const tmp = `${path}.${process.pid}.${randomBytes(4).toString('hex')}.tmp`;
+  try {
+    writeFileSync(tmp, JSON.stringify({ tokens }, null, 2), { flag: 'wx', mode: 0o600 });
+    renameSync(tmp, path);
+  } finally {
+    try { unlinkSync(tmp); } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error;
+    }
+  }
+}
+
+// A persistent inode and an OS advisory lock avoid stale owner files after an abrupt process exit.
+// Never unlink this file: a replacement inode would let two processes hold different locks.
+// Loaded on first use, not at import: libc.so.6 does not exist on Windows and this module sits on the CLI start path (WIN2 10-02).
+type Flock = (fd: number, op: number) => number;
+let flockFn: Flock | null | undefined;
+function osFlock(): Flock | null {
+  if (flockFn !== undefined) return flockFn;
+  if (process.platform === 'win32') return (flockFn = null);
+  const lib = dlopen(process.platform === 'darwin' ? '/usr/lib/libSystem.B.dylib' : 'libc.so.6', {
+    flock: { args: [FFIType.i32, FFIType.i32], returns: FFIType.i32 },
+  });
+  return (flockFn = lib.symbols.flock as Flock);
+}
+const LOCK_EX = 2;
+const LOCK_NB = 4;
+const LOCK_UN = 8;
+
+function withLock<T>(dir: string, fn: () => T): T {
+  mkdirSync(dir, { recursive: true, mode: 0o700 });
+  const flock = osFlock();
+  // Windows: no advisory flock and no POSIX modes — the store still writes by atomic rename.
+  if (!flock) return fn();
+  const lock = `${storePath(dir)}.lock`;
+  const fd = openSync(lock, constants.O_CREAT | constants.O_RDWR | constants.O_NOFOLLOW, 0o600);
+  try {
+    const stat = fstatSync(fd);
+    const current = lstatSync(lock);
+    if (!stat.isFile() || (stat.mode & 0o077) !== 0 || stat.ino !== current.ino || stat.dev !== current.dev) {
+      throw new Error('setup link lock must be a private regular file (0600)');
+    }
+    const until = Date.now() + 3000;
+    while (flock(fd, LOCK_EX | LOCK_NB) !== 0) {
+      if (Date.now() > until) throw new Error('setup link store is locked — try again');
+      Bun.sleepSync(20);
+    }
+    try {
+      const locked = lstatSync(lock);
+      if (stat.ino !== locked.ino || stat.dev !== locked.dev) throw new Error('setup link lock changed');
+      return fn();
+    } finally {
+      flock(fd, LOCK_UN);
+    }
+  } finally {
+    closeSync(fd);
+  }
+}
+
+/** The plaintext link token is returned once; only its SHA-256 digest is persisted. */
+export function issueSetupLinkToken(opts: { dir?: string; now?: number } = {}): { token: string; expiresAt: string } {
+  const dir = opts.dir ?? getElanousConfigDir();
+  const now = opts.now ?? Date.now();
+  const token = mint(LINK_PREFIX);
+  const expiresAt = new Date(now + SETUP_LINK_TTL_MS).toISOString();
+  withLock(dir, () => writeStore(dir, [...readStore(dir), { hash: hashOf(token), expiresAt }]));
+  return { token, expiresAt };
+}
+
+/** Claim exactly once under the same lock used by issuance. Expired and used links retain their diagnostic status. */
+export function claimSetupLinkToken(token: string, opts: { dir?: string; now?: number } = {}): ClaimResult {
+  if (typeof token !== 'string' || !LINK_PATTERN.test(token)) return { ok: false, reason: 'unknown' };
+  const dir = opts.dir ?? getElanousConfigDir();
+  const now = opts.now ?? Date.now();
+  return withLock(dir, () => {
+    const entries = readStore(dir);
+    const digest = Buffer.from(hashOf(token), 'hex');
+    const hit = entries.find((entry) => timingSafeEqual(digest, Buffer.from(entry.hash, 'hex')));
+    if (!hit) return { ok: false, reason: 'unknown' };
+    if (hit.usedAt) return { ok: false, reason: 'used' };
+    if (Date.parse(hit.expiresAt) <= now) return { ok: false, reason: 'expired' };
+    const bearer = mint(BEARER_PREFIX);
+    const expiresAt = new Date(now + SETUP_BEARER_TTL_MS).toISOString();
+    hit.usedAt = new Date(now).toISOString();
+    hit.bearerHash = hashOf(bearer);
+    hit.bearerExpiresAt = expiresAt;
+    writeStore(dir, entries);
+    return { ok: true, bearer, expiresAt };
+  });
+}
+
+/** A setup bearer is not an owner or temp-owner token; validate it only on setup-allowed routes. */
+export function matchSetupBearer(bearer: string, opts: { dir?: string; now?: number } = {}): { expiresAt: string } | null {
+  if (typeof bearer !== 'string' || !BEARER_PATTERN.test(bearer)) return null;
+  let entries: SetupLinkEntry[];
+  try { entries = readStore(opts.dir ?? getElanousConfigDir()); } catch { return null; }
+  const digest = Buffer.from(hashOf(bearer), 'hex');
+  const now = opts.now ?? Date.now();
+  const hit = entries.find((entry) => entry.bearerHash && entry.bearerExpiresAt
+    && timingSafeEqual(digest, Buffer.from(entry.bearerHash, 'hex')) && Date.parse(entry.bearerExpiresAt) > now);
+  return hit?.bearerExpiresAt ? { expiresAt: hit.bearerExpiresAt } : null;
+}

package/src/autopilot/build/integrity-gate.ts

@@ -255,6 +255,7 @@ const STEP_CMDS: Record<GateStepName, { cmd: string; args: string[]; timeoutMs:
   'cli-smoke': { cmd: 'bun', args: ['bin/elanous.mjs', '--help'], timeoutMs: 60_000 },
 };
 
+const DEPENDENCY_INSTALL_TIMEOUT_MS = 300_000;
 const MAX_LOGGED_TEST_FILTERS = 6;
 
 /** Platform runners own Kotlin/Swift execution; Bun must never receive their paths as test filters. */
@@ -289,6 +290,17 @@ export async function runIntegrityGate(
   const runCmd = opts.runCmd ?? createRunCmd();
   const results: GateStep[] = [];
   const logs: string[] = [];
+  // A Pod worktree has no node_modules unless the child happened to install them (the Pod clone has none to link), and Bun
+  // then auto-installs at import time — «Unexpected while resolving package 'commander'» failed cli-smoke as an
+  // «environment deficiency» three times on 10-02 (#22849 · #22919). Install from the lockfile before measuring instead.
+  if (steps.length > 0 && existsSync(join(cwd, 'bin', 'elanous.mjs')) && existsSync(join(cwd, 'bun.lock'))
+      && !existsSync(join(cwd, 'node_modules', 'commander', 'package.json'))) {
+    const install = await runCmd('bun', ['install', '--frozen-lockfile'], cwd, DEPENDENCY_INSTALL_TIMEOUT_MS);
+    const installed = install.code === 0 && !install.timedOut;
+    debug.log('gate.deps', 'install', { installed, code: install.code, timedOut: install.timedOut });
+    const tail = (install.stderr || install.stdout).split('\n').filter(Boolean).slice(-2).join(' | ').slice(0, 200);
+    logs.push(`[deps] ${installed ? 'INSTALLED' : 'FAIL'} bun install --frozen-lockfile — node_modules/commander was missing${installed ? '' : `: ${tail}`}`);
+  }
   let passed = true;
   let testPassCount: number | undefined;
   let sawPassCountRegression = false;

package/src/boot/daemon-prompt-turn.ts

@@ -107,6 +107,8 @@ export async function runDaemonPromptTurn(opts: {
   surfaceResolutionReason?: SurfaceKindResolutionReason;
   /** Optional confirm channels for the triggering chat surface. */
   surfaceHitlChannels?: ConfirmChannel[];
+  /** Server-authenticated human owner for this request; absent for delegated or unverified callers. */
+  verifiedOwner?: { id: string };
   /** Optional structured-question channels for the triggering chat surface. */
   surfaceQuestionChannels?: QuestionChannel[];
   /** CWD for fs-bound tool dispatch (Read / Grep). Defaults to
@@ -226,6 +228,7 @@ export async function runDaemonPromptTurn(opts: {
             ...(request.source?.kind === 'daemon-api' && request.source.route === '/a2a'
               ? { requestOrigin: 'external-agent' as const } : {}),
             ...(request.userText ? { userText: request.userText } : {}),
+            ...(opts.verifiedOwner ? { verifiedOwner: opts.verifiedOwner } : {}),
             ...(opts.surface !== undefined || sourceResolution.surface !== 'unknown' ? { surface } : {}),
             ...(opts.surfaceHitlChannels ? { surfaceHitlChannels: opts.surfaceHitlChannels } : {}),
             ...(opts.surfaceQuestionChannels ? { surfaceQuestionChannels: opts.surfaceQuestionChannels } : {}),

package/src/boot/daemon-tools/index.ts

@@ -16,6 +16,8 @@ import {
   dispatchBrowserRead,
 } from '../../tool-runtime/browser-runtime.js';
 import { askUserQuestionRuntime } from '../../tool-runtime/ask-user-question-runtime.js';
+import { buildElanousHoldTool, buildPtyControlTool, dispatchElanousHold, dispatchPtyControl } from '../../tool-runtime/elanous-control-runtimes.js';
+import { ptyAvailable } from '../../pty-shell/registry.js';
 import { dispatchToolByName, listToolRuntimes } from '../../tool-runtime/registry.js';
 import { ACP_SESSION_RUNTIMES } from '../../tool-runtime/acp-session-runtime.js';
 import { ClaudeSubscriptionNotAllowedError } from '../../policy/claude-subscription-guard.js';
@@ -340,6 +342,7 @@ export function toolSurface(kind: DaemonToolSurfaceKind, cfg?: import('../../use
     askUserQuestionRuntime.spec,
     ...ACP_SESSION_RUNTIMES.map((runtime) => runtime.spec),
     ...shared.specs, // L2 core + L3 finance(gated) — buildSharedAppTools 단일 출처(전 서피스 공용)
+    ...(ptyAvailable() ? [buildElanousHoldTool(), buildPtyControlTool()] : []),
   ];
 
   /** Shared dispatcher for chat-surface tools. Reused by 'chat' AND
@@ -392,11 +395,16 @@ export function toolSurface(kind: DaemonToolSurfaceKind, cfg?: import('../../use
       // L2 core + L3 finance(gated) — buildSharedAppTools 단일 dispatch · B5: 진행 한 줄(emitFeedback)·세션·호출 id 를 넘긴다.
       return shared.dispatch(name, args, {
         surface: 'tui',
+        ...(ctx.requestOrigin ? { requestOrigin: ctx.requestOrigin } : {}),
+        ...(ctx.verifiedOwner ? { verifiedOwner: ctx.verifiedOwner } : {}),
         ...(ctx.sessionId ? { sessionId: ctx.sessionId } : {}),
+        ...(ctx.surfaceHitlChannels ? { confirmChannels: ctx.surfaceHitlChannels } : {}),
         ...(ctx.toolCallId ? { toolCallId: ctx.toolCallId } : {}),
         ...(ctx.emitFeedback ? { emitFeedback: ctx.emitFeedback } : {}),
       });
     }
+    if (ptyAvailable() && name === 'ElanousHold') return dispatchElanousHold(args);
+    if (ptyAvailable() && name === 'PtyControl') return dispatchPtyControl(args);
     if (name === 'Bash') {
       // PLAN-ios-rich-dev-feedback-hydrate M3 (2026-05-13) — pass
       // sessionId + emitFeedback so dispatchBash emits tool.progress

package/src/boot/daemon-tools/types.ts

@@ -61,6 +61,8 @@ export interface DaemonToolDispatchCtx {
   sessionId?: string;
   /** Trusted server-side classification of the current turn, never supplied as a tool argument. */
   requestOrigin?: RequestOrigin;
+  /** Owner principal verified at the server request boundary, not from input source metadata. */
+  verifiedOwner?: { id: string };
   /** Ingestion entry class. Omit for conservative external-verbatim fallback. */
   entry?: IngestionEntry;
   /** M5 PR 2 (PLAN-rich-dev-feedback-multi-surface · 2026-05-13) —

package/src/boot/daemon-tools/web-search.ts

@@ -41,6 +41,7 @@ export function buildWebSearchTool(): LLMToolSpec {
       'Search the public web via the daemon\'s configured provider (Grok / ' +
       'Firecrawl / etc.). When no key is available, falls back to keyless DuckDuckGo. ' +
       'Returns a ranked list of URLs + titles + snippets. ' +
+      'For fact questions, answer directly from the snippets and URLs; read the full body only when insufficient. ' +
       'Pair with a follow-up Read or external WebFetch when the model needs ' +
       'the full article body.',
     parameters: {

package/src/budget/unified-usage.ts

@@ -18,6 +18,7 @@ import { listCodexAccountsInStore } from '../oauth/codex-account-store.js';
 import { loadTokens } from '../oauth/store.js';
 import { envLiteral } from '../platform/env-literal.js';
 import { describeResetCreditExpiry } from './codex-reset-credit-state.js';
+import { visibleWidth } from '../tui.js';
 import { listCodexResetCredits, type CodexResetCreditsResult } from './codex-reset-credits.js';
 import type {
   AccountUsageRow,
@@ -268,6 +269,80 @@ async function collectOpenRouterRows(deps: UnifiedUsageDeps): Promise<AccountUsa
   }
 }
 
+export function formatUsageCompact(report: UnifiedUsageReport, options: { width: number; nowMs: number }): string[] {
+  return report.rows.map((row) => {
+    const credits = row.credits;
+    const subscription = row.subscription;
+    const remaining = subscription.status === 'available' && Number.isFinite(subscription.remainingPercent)
+      ? subscription.remainingPercent
+      : credits.status === 'ok' && credits.usedPercent !== null && Number.isFinite(credits.usedPercent)
+        ? Math.round((100 - credits.usedPercent) * 10) / 10
+        : null;
+    const period = subscription.status === 'available'
+      ? subscription.windowKind
+      : credits.status === 'ok' ? credits.periodType : null;
+    const reset = subscription.status === 'available' ? subscription.resetsAt
+      : credits.status === 'ok' && credits.periodEnd ? Date.parse(credits.periodEnd) : Number.NaN;
+    const periodLabel = period ? `${formatCompactPeriod(period)} ` : '';
+    const when = period === 'prepaid-usd' ? '' : !isValidEpochMs(reset)
+      ? ` · ${periodLabel}시각 모름`
+      : reset <= options.nowMs
+        ? ` · ${periodLabel}재조회 필요`
+        : ` · ${periodLabel}${formatCompactReset(reset, options.nowMs)}에 다시 참`;
+    const balance = credits.status === 'ok' && credits.balance !== null && Number.isFinite(credits.balance)
+      ? ` · 크레딧 ${new Intl.NumberFormat('en-US', { maximumFractionDigits: credits.balance >= 1_000 ? 0 : 1 }).format(credits.balance)}` : '';
+    const prefix = `${row.provider} `;
+    const name = row.accountName.replace(/[\r\n\t\x00-\x1f\x7f]/g, ' ');
+    const remainingLabel = `남은 ${remaining === null ? '잔량 모름' : `${remaining}%`}`;
+    const width = Number.isFinite(options.width) ? Math.max(0, Math.floor(options.width)) : 120;
+    const suffix = ` · ${remainingLabel}${when}${balance}`;
+    const available = width - visibleWidth(prefix) - visibleWidth(suffix);
+    if (available >= 1) {
+      const account = visibleWidth(name) <= available ? name
+        : available === 1 ? '…' : `${compactSlice(name, available - 1)}…`;
+      return `${prefix}${account}${suffix}`;
+    }
+    // The fixed labels can exceed very narrow widths even with no account name.
+    // Keep the measured value when possible rather than slicing its digits.
+    const essential = `${row.provider} · ${remainingLabel}`;
+    if (visibleWidth(essential) <= width) return essential;
+    if (visibleWidth(remainingLabel) <= width) return remainingLabel;
+    const value = remaining === null ? '잔량 모름' : `${remaining}%`;
+    if (visibleWidth(value) <= width) return value;
+    return width > 0 ? '…' : '';
+  });
+}
+
+function formatCompactPeriod(value: string): string {
+  const period = value.replace(/^USAGE_PERIOD_TYPE_/, '').toLowerCase();
+  switch (period) {
+    case 'weekly': return '주간';
+    case 'monthly': return '월간';
+    case 'daily': return '일간';
+    default: return period;
+  }
+}
+
+function formatCompactReset(reset: number, nowMs: number): string {
+  const remaining = reset - nowMs;
+  if (remaining < 86_400_000) {
+    if (remaining < 3_600_000) return `${Math.ceil(remaining / 60_000)}분 뒤`;
+    return `${Math.ceil(remaining / 3_600_000)}시간 뒤`;
+  }
+  const date = new Date(reset);
+  const weekdays = ['일', '월', '화', '수', '목', '금', '토'];
+  return `${date.getMonth() + 1}/${date.getDate()} (${weekdays[date.getDay()]}) ${String(date.getHours()).padStart(2, '0')}:${String(date.getMinutes()).padStart(2, '0')}`;
+}
+
+function compactSlice(text: string, width: number): string {
+  let result = '';
+  for (const { segment } of new Intl.Segmenter(undefined, { granularity: 'grapheme' }).segment(text)) {
+    if (visibleWidth(result + segment) > width) break;
+    result += segment;
+  }
+  return result;
+}
+
 export function formatUnifiedUsage(report: UnifiedUsageReport): string {
   const lines: string[] = [
     'usage — 계정마다 한 행 · 크레딧 축과 구독 축은 각각 칸',

package/src/channel-bot-token.ts

@@ -1,35 +1,62 @@
 import { existsSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
 import { randomUUID } from 'node:crypto';
 import { debug } from './debug/log.js';
-import { getSecret, setSecretAsync } from './nexus/config/secrets/index.js';
-import { userConfigPath } from './nexus/config/paths.js';
+import { getSecret, setSecretAsync, currentBackendId } from './nexus/config/secrets/index.js';
+import { userConfigPath, secretsPath } from './nexus/config/paths.js';
 import { isSecretRef, makeSecretRef, secretIdFromRef } from './nexus/config/types.js';
 import { acquireLockAsync } from './storage/file-lock.js';
 import type { UserConfig } from './user-config.js';
 
 export type ChannelBotPlatform = 'telegram' | 'discord';
-export type ChannelBotTokenSource = 'tokenRef' | 'env' | 'plaintext';
+export type ChannelBotTokenSource = 'tokenRef' | 'env' | 'botToken' | 'channels.main';
+export type ChannelBotTokenResolution = { token: string; source: ChannelBotTokenSource; reason?: never }
+  | { token: ''; source?: never; reason: string };
 
 /** The tab reference is read from the same persistent config as the NEXUS switch. */
 export function resolveChannelBotToken(
   platform: ChannelBotPlatform,
   cfg: Pick<UserConfig, 'telegram' | 'discord'> & { tabs?: Record<string, { tokenRef?: unknown }> },
-): { token: string; source: ChannelBotTokenSource } | undefined {
+): ChannelBotTokenResolution {
+  let reason: string | undefined;
   const ref = cfg.tabs?.[`${platform}:1`]?.tokenRef;
   if (isSecretRef(ref)) {
     const id = secretIdFromRef(ref);
-    const token = id ? getSecret(id) : undefined;
-    if (token) return { token, source: 'tokenRef' };
+    if (id) {
+      const backend = currentBackendId();
+      if (backend !== 'file') {
+        reason = `backend ${backend} not sync-readable`;
+      } else {
+        const token = getSecret(id);
+        if (token) {
+          debug.log('channel-bot.token', 'resolved', { kind: platform, source: 'tokenRef' });
+          return { token, source: 'tokenRef' };
+        }
+        reason = `ref-id-missing ${id} in ${secretsPath()}`;
+      }
+    }
   }
   const envName = platform === 'telegram' ? 'ELANOUS_TELEGRAM_BOT_TOKEN' : 'ELANOUS_DISCORD_BOT_TOKEN';
   const envToken = process.env[envName];
-  if (envToken) return { token: envToken, source: 'env' };
+  if (envToken) {
+    debug.log('channel-bot.token', 'resolved', { kind: platform, source: 'env' });
+    return { token: envToken, source: 'env' };
+  }
   const token = cfg[platform]?.botToken;
   if (token) {
-    debug.log('channel-bot.token', 'plaintext-fallback', { platform });
-    return { token, source: 'plaintext' };
+    debug.log('channel-bot.token', 'resolved', { kind: platform, source: 'botToken' });
+    return { token, source: 'botToken' };
+  }
+  if (platform === 'telegram') {
+    const channels = cfg.telegram?.channels;
+    const channelToken = (channels?.find(c => c.name === 'main') ?? channels?.[0])?.botToken;
+    if (channelToken) {
+      debug.log('channel-bot.token', 'resolved', { kind: platform, source: 'channels.main' });
+      return { token: channelToken, source: 'channels.main' };
+    }
   }
-  return undefined;
+  reason ??= 'no-source';
+  debug.log('channel-bot.token', 'unresolved', { kind: platform, reason });
+  return { token: '', reason };
 }
 
 /** Publish the secret before its reference, under the config lock. Other config keys survive unchanged. */

package/src/chat/ctrl-c-in-input.ts

@@ -0,0 +1,14 @@
+/** U1a — how long an empty-input Ctrl+C stays armed (and its hint stays on screen). */
+export const CTRL_C_ARM_MS = 2_000;
+
+export function resolveCtrlCInInput({ text, now, armedAt }: {
+  text: string;
+  now: number;
+  armedAt: number | null;
+}): { action: 'clear-input' | 'arm-exit' | 'exit'; armedAt: number | null; hint: string | null } {
+  if (text.length > 0) return { action: 'clear-input', armedAt: null, hint: null };
+  if (armedAt !== null && now >= armedAt && now - armedAt <= CTRL_C_ARM_MS) {
+    return { action: 'exit', armedAt: null, hint: null };
+  }
+  return { action: 'arm-exit', armedAt: now, hint: '한 번 더 누르면 나갑니다 · /quit' };
+}