triflux 10.43.0 → 10.44.0

package/scripts/lib/cli-codex.mjs

@@ -4,169 +4,23 @@
 // 산출한다. 실제 spawn 은 Phase 1 에서 이관된다 (현재는 tfx-route.sh 가 수행).
 //
 // 진입점: tfx-route.mjs → selectAdapter("codex") → plan({...}).
-// 출처: scripts/tfx-route.sh route_agent() L1001-L1079 case 문 미러.
+// 출처: agent-route-policy.mjs 의 canonical Codex role policy.
 // timeoutSec은 lane 예상 소요 시간(advisory)이다. hard ceiling 집행은 Bash route가 소유한다.
 
 export const id = "codex";
 export const cliType = "codex";
 export const command = "codex";
 
-const AGENT_PROFILES = {
-  executor: {
-    profile: "gpt56_terra_high",
-    timeoutSec: 1080,
-    runMode: "fg",
-    opusOversight: false,
-    mcpHint: "implement",
-  },
-  codex: {
-    profile: "gpt56_terra_high",
-    timeoutSec: 1080,
-    runMode: "fg",
-    opusOversight: false,
-    mcpHint: "implement",
-  },
-  "build-fixer": {
-    profile: "gpt56_luna_low",
-    timeoutSec: 540,
-    runMode: "fg",
-    opusOversight: false,
-    mcpHint: "implement",
-  },
-  cleanup: {
-    profile: "gpt56_terra_med",
-    timeoutSec: 540,
-    runMode: "fg",
-    opusOversight: false,
-    mcpHint: "implement",
-  },
-  deslop: {
-    profile: "gpt56_terra_med",
-    timeoutSec: 540,
-    runMode: "fg",
-    opusOversight: false,
-    mcpHint: "implement",
-  },
-  debugger: {
-    profile: "gpt56_sol_xhigh",
-    timeoutSec: 900,
-    runMode: "bg",
-    opusOversight: false,
-    mcpHint: "implement",
-  },
-  "deep-executor": {
-    profile: "gpt56_sol_xhigh",
-    timeoutSec: 3600,
-    runMode: "bg",
-    opusOversight: true,
-    mcpHint: "implement",
-  },
-  architect: {
-    profile: "gpt56_sol_xhigh",
-    timeoutSec: 3600,
-    runMode: "bg",
-    opusOversight: true,
-    mcpHint: "analyze",
-  },
-  critic: {
-    profile: "gpt56_sol_xhigh",
-    timeoutSec: 3600,
-    runMode: "bg",
-    opusOversight: true,
-    mcpHint: "analyze",
-  },
-  planner: {
-    profile: "gpt56_sol_xhigh",
-    timeoutSec: 3600,
-    runMode: "fg",
-    opusOversight: true,
-    mcpHint: "analyze",
-  },
-  analyst: {
-    profile: "gpt56_sol_xhigh",
-    timeoutSec: 3600,
-    runMode: "fg",
-    opusOversight: true,
-    mcpHint: "analyze",
-  },
-  "code-reviewer": {
-    profile: "gpt56_terra_high",
-    timeoutSec: 1800,
-    runMode: "bg",
-    opusOversight: false,
-    mcpHint: "review",
-    subcommand: "review",
-  },
-  "quality-reviewer": {
-    profile: "gpt56_terra_high",
-    timeoutSec: 1800,
-    runMode: "bg",
-    opusOversight: false,
-    mcpHint: "review",
-    subcommand: "review",
-  },
-  "security-reviewer": {
-    profile: "gpt56_sol_xhigh",
-    timeoutSec: 1800,
-    runMode: "bg",
-    opusOversight: true,
-    mcpHint: "review",
-    subcommand: "review",
-  },
-  scientist: {
-    profile: "gpt56_terra_high",
-    timeoutSec: 1440,
-    runMode: "bg",
-    opusOversight: false,
-    mcpHint: "analyze",
-  },
-  "document-specialist": {
-    profile: "gpt56_terra_high",
-    timeoutSec: 1440,
-    runMode: "bg",
-    opusOversight: false,
-    mcpHint: "analyze",
-  },
-  "scientist-deep": {
-    profile: "gpt56_sol_xhigh",
-    timeoutSec: 3600,
-    runMode: "bg",
-    opusOversight: false,
-    mcpHint: "analyze",
-  },
-  verifier: {
-    profile: "gpt56_terra_high",
-    timeoutSec: 1200,
-    runMode: "fg",
-    opusOversight: false,
-    mcpHint: "review",
-    subcommand: "review",
-  },
-  "test-engineer": {
-    profile: "gpt56_terra_high",
-    timeoutSec: 1200,
-    runMode: "bg",
-    opusOversight: false,
-    mcpHint: "implement",
-  },
-  "qa-tester": {
-    profile: "gpt56_terra_high",
-    timeoutSec: 1200,
-    runMode: "bg",
-    opusOversight: false,
-    mcpHint: "review",
-    subcommand: "review",
-  },
-  spark: {
-    profile: "gpt56_luna_low",
-    timeoutSec: 180,
-    runMode: "fg",
-    opusOversight: false,
-    mcpHint: "implement",
-  },
-};
+import {
+  CODEX_AGENT_POLICY,
+  resolveCodexAgentPolicy,
+  resolveCodexAgentProfile,
+  resolveNestedCodexAgentProfile,
+} from "./agent-route-policy.mjs";
 
-const DEFAULT_PROFILE = AGENT_PROFILES.executor;
+// Compatibility re-exports for launchers which historically imported these
+// helpers from this adapter. The policy module owns the semantics.
+export { resolveCodexAgentProfile, resolveNestedCodexAgentProfile };
 
 export function plan({
   agent,
@@ -174,18 +28,26 @@ export function plan({
   mcpProfile = "auto",
   timeoutSec,
   contextFile,
+  profileOverride = "auto",
+  retryProfile = null,
+  nested = false,
 } = {}) {
   if (!agent) {
     throw new Error("[cli-codex] agent required");
   }
-  const cfg = AGENT_PROFILES[agent] ?? DEFAULT_PROFILE;
+  const cfg = resolveCodexAgentPolicy(agent);
+  const profile = resolveCodexAgentProfile(agent, {
+    profileOverride,
+    retryProfile,
+    nested,
+  });
   const effectiveTimeoutSec =
     Number.isFinite(timeoutSec) && timeoutSec > 0 ? timeoutSec : cfg.timeoutSec;
   return {
     command,
     subcommand: cfg.subcommand ?? "exec",
-    profile: cfg.profile,
-    effort: cfg.profile,
+    profile,
+    effort: profile,
     timeoutMs: effectiveTimeoutSec * 1000,
     runMode: cfg.runMode,
     opusOversight: cfg.opusOversight,
@@ -196,5 +58,5 @@ export function plan({
 }
 
 export function describe() {
-  return { id, cliType, command, agents: Object.keys(AGENT_PROFILES) };
+  return { id, cliType, command, agents: Object.keys(CODEX_AGENT_POLICY) };
 }

package/scripts/lib/codex-profile-config.mjs

@@ -9,6 +9,8 @@ import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 
 const EFFORT_BY_SUFFIX = {
+  ultra: "ultra",
+  max: "max",
   xhigh: "xhigh",
   high: "high",
   med: "medium",
@@ -16,6 +18,15 @@ const EFFORT_BY_SUFFIX = {
   low: "low",
 };
 
+const CANONICAL_PROFILE_VALUES = Object.freeze({
+  gpt56_luna_low: { model: "gpt-5.6-luna", effort: "low" },
+  gpt56_terra_med: { model: "gpt-5.6-terra", effort: "medium" },
+  gpt56_terra_high: { model: "gpt-5.6-terra", effort: "high" },
+  gpt56_sol_xhigh: { model: "gpt-5.6-sol", effort: "xhigh" },
+  gpt56_sol_max: { model: "gpt-5.6-sol", effort: "max" },
+  gpt56_sol_ultra: { model: "gpt-5.6-sol", effort: "ultra" },
+});
+
 function readProfileScalar(raw, key) {
   const match = String(raw).match(
     new RegExp(
@@ -49,8 +60,10 @@ function readProfileScalar(raw, key) {
  * @param {{ codexHome?: string }} [opts]
  * @returns {string[]} e.g. ['model="gpt-5.6-terra"', 'model_reasoning_effort="high"']
  */
-export function codexProfileConfigOverrides(profileName, opts = {}) {
-  if (typeof profileName !== "string" || !profileName) return [];
+export function resolveCodexProfileConfigValues(profileName, opts = {}) {
+  if (typeof profileName !== "string" || !profileName) {
+    return { model: null, effort: null };
+  }
   const codexHome =
     opts.codexHome || process.env.CODEX_HOME || join(homedir(), ".codex");
   let model = null;
@@ -63,9 +76,22 @@ export function codexProfileConfigOverrides(profileName, opts = {}) {
     model = readProfileScalar(raw, "model");
     effort = readProfileScalar(raw, "model_reasoning_effort");
   } catch {
-    const suffix = /_(xhigh|high|med|medium|low)$/.exec(profileName);
+    const suffix = /_(ultra|max|xhigh|high|med|medium|low)$/.exec(profileName);
     if (suffix) effort = EFFORT_BY_SUFFIX[suffix[1]] || null;
   }
+  return { model, effort };
+}
+
+export function codexProfileConfigOverrides(profileName, opts = {}) {
+  let { model, effort } = resolveCodexProfileConfigValues(profileName, opts);
+  if (opts.enforceCanonicalProfile === true) {
+    const canonical = CANONICAL_PROFILE_VALUES[profileName];
+    if (canonical) ({ model, effort } = canonical);
+  }
+  if (opts.disallowUltra === true && effort?.toLowerCase() === "ultra") {
+    model = "gpt-5.6-sol";
+    effort = "max";
+  }
   const overrides = [];
   if (model) overrides.push(`model="${model}"`);
   if (effort) overrides.push(`model_reasoning_effort="${effort}"`);

package/scripts/lib/keyword-rules.mjs

@@ -26,6 +26,7 @@ function normalizeState(state) {
 
 function normalizeRule(rule) {
   if (!rule || typeof rule !== "object") return null;
+  if (rule.disabled === true) return null;
   if (typeof rule.id !== "string" || !rule.id.trim()) return null;
   if (!Array.isArray(rule.patterns) || rule.patterns.length === 0) return null;
   if (typeof rule.priority !== "number" || !Number.isFinite(rule.priority))
@@ -61,6 +62,13 @@ function normalizeRule(rule) {
   const state = normalizeState(rule.state);
   if (rule.state != null && state == null) return null;
 
+  // repo_scope: path segment 화이트리스트 (빈 배열 = 전역). explicit: 종결 라우팅 마커.
+  const repoScope = Array.isArray(rule.repo_scope)
+    ? rule.repo_scope
+        .filter((s) => typeof s === "string" && s.trim())
+        .map((s) => s.trim())
+    : [];
+
   return {
     id: rule.id.trim(),
     patterns,
@@ -72,6 +80,8 @@ function normalizeRule(rule) {
     exclusive: rule.exclusive === true,
     state,
     mcp_route: mcpRoute,
+    repo_scope: repoScope,
+    explicit: rule.explicit === true,
   };
 }
 
@@ -149,6 +159,8 @@ export function matchRules(compiledRules, cleanText) {
       exclusive: rule.exclusive === true,
       state: rule.state || null,
       mcp_route: rule.mcp_route || null,
+      repo_scope: rule.repo_scope || [],
+      explicit: rule.explicit === true,
     });
   }
 

package/scripts/lint-skills.mjs

@@ -121,6 +121,66 @@ function lintBodyModelNames({ file, body, startLine }) {
   return problems;
 }
 
+function lintAgentModels({ file, body, startLine }) {
+  const problems = [];
+  const agentStartRe = /\bAgent\s*\(/g;
+  let match;
+  while ((match = agentStartRe.exec(body)) !== null) {
+    const openParenIndex = match.index + match[0].lastIndexOf("(");
+    let quote = null;
+    let depth = 1;
+    let closeParenIndex = -1;
+
+    for (let index = openParenIndex + 1; index < body.length; index += 1) {
+      const character = body[index];
+
+      if (quote) {
+        if (character === "\\") {
+          index += 1;
+        } else if (character === quote) {
+          quote = null;
+        }
+        continue;
+      }
+
+      if (character === '"' || character === "'" || character === "`") {
+        quote = character;
+      } else if (character === "(") {
+        depth += 1;
+      } else if (character === ")") {
+        depth -= 1;
+        if (depth === 0) {
+          closeParenIndex = index;
+          break;
+        }
+      }
+    }
+
+    if (closeParenIndex === -1) continue;
+
+    const call = body.slice(openParenIndex + 1, closeParenIndex);
+    agentStartRe.lastIndex = closeParenIndex + 1;
+    if (!/\bsubagent_type\s*=/.test(call) || !/\bprompt\s*=/.test(call)) {
+      continue;
+    }
+    if (/\bmodel\s*=/.test(call)) continue;
+    const line =
+      startLine + body.slice(0, match.index).split(/\r?\n/).length - 1;
+    problems.push(
+      createProblem({
+        file,
+        line,
+        code: "agent-model-required",
+        problem: "executable Agent call is missing model=",
+        cause:
+          "실행형 Agent 호출은 모델 선택을 명시해야 라우팅 drift를 막을 수 있습니다.",
+        fix: "Add model=<resolved-native-model> to the Agent call.",
+      }),
+    );
+  }
+  return problems;
+}
+
 function lintSkillFile({ file, rootDir }) {
   const content = readFileSync(file, "utf8");
   const { data, body } = parseFrontmatter(content);
@@ -133,6 +193,11 @@ function lintSkillFile({ file, rootDir }) {
       body,
       startLine: bodyStartLine(content),
     }),
+    ...lintAgentModels({
+      file: relativeFile,
+      body,
+      startLine: bodyStartLine(content),
+    }),
   ];
 }
 

package/scripts/pack.mjs

@@ -34,6 +34,8 @@ const CORE_FILES = [
   "hub/intent.mjs",
   "hub/token-mode.mjs",
   "hub/router.mjs",
+  "hub/role-contract.mjs",
+  "hub/role-control-events.mjs",
   "hub/hitl.mjs",
   "hub/assign-callbacks.mjs",
   "hub/fullcycle.mjs",
@@ -51,6 +53,8 @@ const CORE_FILES = [
   // Phase 1 dynamic routing (#251 + #263 + #264 + wire-ups)
   "hub/dynamic-routing-engine.mjs",
   "hub/routing-snapshot.mjs",
+  "hub/role-contract.mjs",
+  "hub/role-control-events.mjs",
 ];
 
 const CORE_DIRS = [
@@ -60,6 +64,7 @@ const CORE_DIRS = [
   "hub/delegator",
   "hub/lib",
   "hub/middleware",
+  "hub/team/intervention.mjs",
   "hub/team/retry-state-machine.mjs",
   "hub/team/claude-agent-session-normalizer.mjs",
   "hub/team/claude-daemon-control.mjs",
@@ -88,6 +93,7 @@ const REMOTE_FILES = [
   "cto/brief.mjs",
   "cto/collect.mjs",
   "cto/events.mjs",
+  "cto/hygiene-actions.mjs",
   "cto/hygiene-notify.mjs",
   "cto/hygiene.mjs",
   "cto/lake-root.mjs",
@@ -96,6 +102,7 @@ const REMOTE_FILES = [
 ];
 
 const REMOTE_DIRS = ["hub/team", "hub/workers", "hub/public"];
+const REMOTE_CORE_PROXIES = ["hub/lib/cto-env.mjs"];
 
 const TRIFLUX_DIRS = [
   "bin",
@@ -301,6 +308,12 @@ function packRemote() {
   cleanDist(dest);
   for (const f of REMOTE_FILES) copyItem(f, dest);
   for (const d of REMOTE_DIRS) copyItem(d, dest);
+  for (const proxy of REMOTE_CORE_PROXIES) {
+    const target = join(dest, proxy);
+    mkdirSync(dirname(target), { recursive: true });
+    writeFileSync(target, `export * from "@triflux/core/${proxy}";\n`);
+    console.log(`  WRITE ${proxy}`);
+  }
   // shared scripts/lib needed by delegator-mcp.mjs (dynamic resolve)
   copyItem("scripts/lib", dest);
   writeIndex(dest, REMOTE_INDEX);

package/scripts/release/check-packages-mirror.mjs

@@ -22,6 +22,7 @@ import { fileURLToPath } from "node:url";
 const SCRIPT_DIR = dirname(fileURLToPath(import.meta.url));
 const DEFAULT_REPO_ROOT = join(SCRIPT_DIR, "..", "..");
 const MIRROR_TOPS = [
+  "adapters",
   "bin",
   "config",
   "cto",
@@ -38,6 +39,10 @@ const CORE_FILE_MIRRORS = [
     source: "hub/bridge.mjs",
     target: "packages/core/hub/bridge.mjs",
   },
+  {
+    source: "hub/router.mjs",
+    target: "packages/core/hub/router.mjs",
+  },
   {
     source: "hub/team/retry-state-machine.mjs",
     target: "packages/core/hub/team/retry-state-machine.mjs",

package/scripts/setup.mjs

@@ -14,6 +14,7 @@ import {
   mkdirSync,
   readdirSync,
   readFileSync,
+  renameSync,
   rmSync,
   unlinkSync,
   writeFileSync,
@@ -73,7 +74,15 @@ const HUD_PATH = join(CLAUDE_DIR, "hud", "hud-qos-status.mjs");
 const WINDOWS_HUB_AUTOSTART_TASK = "TrifluxHubEnsure";
 
 const REQUIRED_CODEX_PROFILES = [
-  // GPT-5.6 family — 기존 xhigh/high/med/low 의미를 모델별 lane으로 유지.
+  // GPT-5.6 family — max/ultra are explicit exception lanes, not role defaults.
+  {
+    name: "gpt56_sol_ultra",
+    lines: ['model = "gpt-5.6-sol"', 'model_reasoning_effort = "ultra"'],
+  },
+  {
+    name: "gpt56_sol_max",
+    lines: ['model = "gpt-5.6-sol"', 'model_reasoning_effort = "max"'],
+  },
   {
     name: "gpt56_sol_xhigh",
     lines: ['model = "gpt-5.6-sol"', 'model_reasoning_effort = "xhigh"'],
@@ -498,6 +507,7 @@ const SKILL_ALIASES = [
 
 const DEPRECATED_SKILLS = ["tfx-codex-route", "tfx-gemini-route"];
 const LOCAL_DEV_SKILL_MARKER = ".triflux-local-skill";
+const MANAGED_CODEX_SKILL_MARKER = ".triflux-managed-skill";
 
 // ── 구형 Codex 모델 (마이그레이션 안내 대상) ──
 
@@ -579,6 +589,76 @@ function isLocalDevSkillDir(skillPath) {
   return existsSync(join(skillPath, LOCAL_DEV_SKILL_MARKER));
 }
 
+function skillTreeMatches(srcDir, dstDir) {
+  if (!existsSync(srcDir) || !existsSync(dstDir)) return false;
+  for (const entry of readdirSync(srcDir, { withFileTypes: true })) {
+    const srcPath = join(srcDir, entry.name);
+    const dstPath = join(dstDir, entry.name);
+    if (entry.isDirectory()) {
+      if (!skillTreeMatches(srcPath, dstPath)) return false;
+      continue;
+    }
+    if (!existsSync(dstPath)) return false;
+    if (!readFileSync(srcPath).equals(readFileSync(dstPath))) return false;
+  }
+  return true;
+}
+
+/**
+ * Sync the tracked Codex tfx-harness adapter without taking ownership of a
+ * pre-existing user skill. A missing source is a hard failure; a conflicting
+ * destination is backed up and deliberately left untouched.
+ */
+function syncCodexHarnessAdapter({
+  sourceDir = join(PLUGIN_ROOT, "adapters", "codex", "skills", "tfx-harness"),
+  destinationDir = join(CODEX_DIR, "skills", "tfx-harness"),
+} = {}) {
+  const sourceSkill = join(sourceDir, "SKILL.md");
+  if (!existsSync(sourceSkill)) {
+    return {
+      ok: false,
+      action: "blocked",
+      reason: "codex_harness_adapter_source_missing",
+      sourceDir,
+      destinationDir,
+    };
+  }
+
+  const managed = existsSync(join(destinationDir, MANAGED_CODEX_SKILL_MARKER));
+  const current = skillTreeMatches(sourceDir, destinationDir);
+  if (current && managed) {
+    return { ok: true, action: "noop", sourceDir, destinationDir };
+  }
+
+  if (existsSync(destinationDir) && !managed) {
+    const backupDir = `${destinationDir}.triflux-backup-${Date.now()}`;
+    cpSync(destinationDir, backupDir, { recursive: true });
+    return {
+      ok: true,
+      action: "skipped",
+      reason: "user_owned_codex_skill",
+      sourceDir,
+      destinationDir,
+      backupDir,
+    };
+  }
+
+  const tempDir = `${destinationDir}.triflux-tmp-${process.pid}-${Date.now()}`;
+  mkdirSync(dirname(destinationDir), { recursive: true });
+  cpSync(sourceDir, tempDir, { recursive: true });
+  writeFileSync(
+    join(tempDir, MANAGED_CODEX_SKILL_MARKER),
+    "managed by triflux\n",
+  );
+
+  if (existsSync(destinationDir)) {
+    const previousDir = `${destinationDir}.triflux-previous-${Date.now()}`;
+    renameSync(destinationDir, previousDir);
+  }
+  renameSync(tempDir, destinationDir);
+  return { ok: true, action: "synced", sourceDir, destinationDir };
+}
+
 /**
  * 훅 커맨드 문자열에서 스크립트 파일명을 추출한다.
  * 예: 'node "/path/to/safety-guard.mjs"' → "safety-guard.mjs"
@@ -1526,6 +1606,7 @@ export {
   SYNC_MAP,
   scanHudFiles,
   syncAliasedSkillDir,
+  syncCodexHarnessAdapter,
   syncWorkerPackages,
   validateSchtasksTrLength,
   WINDOWS_HUB_AUTOSTART_TASK,
@@ -1581,6 +1662,16 @@ export async function runDeferred(stdinData) {
       result.action === "updated" ||
       result.action === "removed",
   ).length;
+  const codexHarnessSync = syncCodexHarnessAdapter();
+  if (!codexHarnessSync.ok) {
+    io.log(`  \x1b[31m✗\x1b[0m Codex tfx-harness: ${codexHarnessSync.reason}`);
+    return io.result(1);
+  }
+  if (codexHarnessSync.action === "skipped") {
+    io.log(
+      `  \x1b[33m⚠\x1b[0m Codex tfx-harness: user skill preserved; backup ${codexHarnessSync.backupDir}`,
+    );
+  }
   const cloakBrowserResult = ensureCloakBrowser({
     warn: (message) => io.log(`  \x1b[33m⚠\x1b[0m ${message}`),
   });
@@ -1601,7 +1692,8 @@ export async function runDeferred(stdinData) {
     return io.result(0);
   }
 
-  let synced = claudeRoutingChangedCount;
+  let synced =
+    claudeRoutingChangedCount + (codexHarnessSync.action === "synced" ? 1 : 0);
 
   // ── Memory Doctor (P0 자동 수정) ──
   const isCIEnv = process.env.CI === "true" || process.env.DOCKER === "true";

package/scripts/tfx-route.mjs

@@ -165,6 +165,8 @@ export function buildRoutePlan(request, agentMap) {
     mcpProfile: request.mcpProfile ?? "auto",
     timeoutSec: request.timeoutSec,
     contextFile: request.contextFile,
+    profileOverride: request.profileOverride,
+    nested: request.nested,
   });
   return {
     agent: request.agent,
@@ -272,7 +274,18 @@ async function main(argv) {
   }
 
   const agentMap = loadAgentMap();
-  const plan = buildRoutePlan(request, agentMap);
+  const plan = buildRoutePlan(
+    {
+      ...request,
+      profileOverride: process.env.TFX_CODEX_PROFILE,
+      nested: Boolean(
+        process.env.TFX_TEAM_NAME ||
+          process.env.TFX_WORKER_INDEX ||
+          process.env.TFX_WORKER_SANDBOX_SCOPE,
+      ),
+    },
+    agentMap,
+  );
 
   if (request.mode === "route-print") {
     process.stdout.write(`${JSON.stringify(plan, null, 2)}\n`);