triflux 9.8.5 → 9.8.7

package/bin/triflux.mjs

@@ -29,7 +29,13 @@ import {
   extractManagedHookFilename, getManagedRegistryHooks, ensureHooksInSettings,
   ensureCodexHubServerConfig,
 } from "../scripts/setup.mjs";
+import {
+  ensureGlobalClaudeRoutingSection,
+  ensureTfxSection,
+  getLatestRoutingTable,
+} from "../scripts/claudemd-sync.mjs";
 import { cleanupTmpFiles } from "../scripts/tmp-cleanup.mjs";
+import { checkNetworkAvailability, validateRuntimeCachePaths } from "../hub/lib/cache-guard.mjs";
 
 const PKG_ROOT = dirname(dirname(fileURLToPath(import.meta.url)));
 const CLAUDE_DIR = join(homedir(), ".claude");
@@ -534,6 +540,26 @@ function describeSyncAction(src, dst, label) {
   };
 }
 
+function syncClaudeRoutingSectionsForCli() {
+  try {
+    const routingTable = getLatestRoutingTable();
+    return [
+      ensureTfxSection(join(PKG_ROOT, "CLAUDE.md"), routingTable),
+      ensureGlobalClaudeRoutingSection(CLAUDE_DIR),
+    ];
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : "routing_sync_failed";
+    return [{ action: "unchanged", path: join(PKG_ROOT, "CLAUDE.md"), skipped: true, reason }];
+  }
+}
+
+function getClaudeRoutingSyncSummary(results) {
+  return results.reduce((summary, result) => ({
+    changed: summary.changed + (result.action === "created" || result.action === "updated" ? 1 : 0),
+    skipped: summary.skipped + (result.skipped ? 1 : 0),
+  }), { changed: 0, skipped: 0 });
+}
+
 // ── 크로스 셸 진단 ──
 
 function checkCliCrossShell(cmd, installHint) {
@@ -703,7 +729,7 @@ function buildSetupDryRunPlan() {
 }
 
 function cmdSetup(options = {}) {
-  const { dryRun = false, overrideVersion } = options;
+  const { dryRun = false, overrideVersion, skipClaudeMdSync = false } = options;
   if (dryRun) {
     printJson(buildSetupDryRunPlan());
     return;
@@ -793,6 +819,21 @@ function cmdSetup(options = {}) {
   // ── 결과 추적 ──
   const summary = [];
 
+  if (!skipClaudeMdSync) {
+    const claudeRoutingResults = syncClaudeRoutingSectionsForCli();
+    const claudeRoutingSummary = getClaudeRoutingSyncSummary(claudeRoutingResults);
+    if (claudeRoutingSummary.changed > 0) {
+      ok(`CLAUDE.md 라우팅: ${claudeRoutingSummary.changed}개 파일 반영`);
+      summary.push({ item: "CLAUDE.md 라우팅", status: "✅", detail: `${claudeRoutingSummary.changed}개 파일 반영` });
+    } else if (claudeRoutingSummary.skipped > 0) {
+      ok("CLAUDE.md 라우팅: 대상 파일 없음 (건너뜀)");
+      summary.push({ item: "CLAUDE.md 라우팅", status: "⏭️", detail: "대상 파일 없음" });
+    } else {
+      ok("CLAUDE.md 라우팅: 최신 상태");
+      summary.push({ item: "CLAUDE.md 라우팅", status: "✅", detail: "최신 상태" });
+    }
+  }
+
   const codexProfileResult = ensureCodexProfiles();
   if (!codexProfileResult.ok) {
     warn(`Codex profiles 설정 실패: ${codexProfileResult.message}`);
@@ -2446,7 +2487,56 @@ async function cmdDoctor(options = {}) {
   });
 }
 
-function cmdUpdate() {
+function normalizeRemoteReachabilityUrl(remoteUrl) {
+  if (!remoteUrl) return null;
+  if (/^https?:\/\//iu.test(remoteUrl)) {
+    try {
+      return new URL(remoteUrl).origin;
+    } catch {
+      return null;
+    }
+  }
+  const scpMatch = /^git@([^:]+):/iu.exec(remoteUrl);
+  if (scpMatch) return `https://${scpMatch[1]}`;
+  if (/^ssh:\/\//iu.test(remoteUrl)) {
+    try {
+      return `https://${new URL(remoteUrl).hostname}`;
+    } catch {
+      return null;
+    }
+  }
+  return null;
+}
+
+function resolveGitUpdateUrl(repoDir) {
+  try {
+    const remoteUrl = execSync("git remote get-url origin", {
+      encoding: "utf8",
+      timeout: 10_000,
+      cwd: repoDir,
+      stdio: ["pipe", "pipe", "ignore"],
+      windowsHide: true,
+    }).trim();
+    return normalizeRemoteReachabilityUrl(remoteUrl);
+  } catch {
+    return null;
+  }
+}
+
+function resolveUpdateTargets({ installMode, pluginPath }) {
+  const repoDir = installMode === "plugin" ? (pluginPath || PKG_ROOT) : PKG_ROOT;
+  const gitUrl = resolveGitUpdateUrl(repoDir);
+
+  if (installMode === "npm-global" || installMode === "npm-local") {
+    return ["https://registry.npmjs.org/triflux"];
+  }
+  if (installMode === "plugin" || installMode === "git-local") {
+    return gitUrl ? [gitUrl] : ["https://github.com"];
+  }
+  return [];
+}
+
+async function cmdUpdate() {
   const isDev = isDevUpdateRequested(NORMALIZED_ARGS);
   const tagLabel = isDev ? ` ${YELLOW}--dev${RESET}` : "";
   console.log(`\n${BOLD}triflux update${RESET}${tagLabel}\n`);
@@ -2502,6 +2592,27 @@ function cmdUpdate() {
 
   info(`검색: ${installMode === "plugin" ? "플러그인" : installMode === "npm-global" ? "npm global" : installMode === "npm-local" ? "npm local" : installMode === "git-local" ? "git 로컬 저장소" : "알 수 없음"} 설치 감지`);
 
+  const networkTargets = resolveUpdateTargets({ installMode, pluginPath });
+  if (networkTargets.length > 0) {
+    const networkStatus = await checkNetworkAvailability(networkTargets);
+    if (!networkStatus.online) {
+      fail(`네트워크 확인 실패: ${networkStatus.unreachable.join(", ")}`);
+      info("네트워크 연결을 확인한 뒤 다시 시도하세요.");
+      return;
+    }
+    ok(`네트워크 확인 완료 (${networkStatus.reachable.join(", ")})`);
+  }
+
+  const cacheValidation = validateRuntimeCachePaths(join(CLAUDE_DIR, "cache"));
+  if (!cacheValidation.ok) {
+    warn(`런타임 캐시 검증 이슈 ${cacheValidation.issues.length}건 발견`);
+    for (const issue of cacheValidation.issues) {
+      info(`${issue.file}: ${issue.error}`);
+    }
+  } else {
+    ok("런타임 캐시 검증 완료");
+  }
+
   // 2. 설치 방식에 따라 업데이트
   const oldVer = PKG.version;
   let updated = false;
@@ -2666,9 +2777,23 @@ function cmdUpdate() {
       }
     }
 
+    // ── Post-update: CLAUDE.md 라우팅 동기화 ──
+    console.log(`\n${CYAN}── CLAUDE.md 라우팅 동기화 ──${RESET}`);
+    {
+      const claudeRoutingResults = syncClaudeRoutingSectionsForCli();
+      const claudeRoutingSummary = getClaudeRoutingSyncSummary(claudeRoutingResults);
+      if (claudeRoutingSummary.changed > 0) {
+        ok(`CLAUDE.md 라우팅 ${claudeRoutingSummary.changed}개 파일 반영`);
+      } else if (claudeRoutingSummary.skipped > 0) {
+        ok("CLAUDE.md 라우팅 대상 파일 없음 (건너뜀)");
+      } else {
+        ok("CLAUDE.md 라우팅 최신 상태");
+      }
+    }
+
     // ── Post-update: 설정 동기화 ──
     console.log(`\n${CYAN}── 설정 동기화 ──${RESET}`);
-    cmdSetup({ fromUpdate: true, overrideVersion: newVer });
+    cmdSetup({ fromUpdate: true, overrideVersion: newVer, skipClaudeMdSync: true });
 
     // ── Post-update: 훅 오케스트레이터 적용 ──
     {
@@ -3688,7 +3813,7 @@ async function main() {
       cmdSchema(cmdArgs);
       return;
     case "update":
-      cmdUpdate();
+      await cmdUpdate();
       return;
     case "list":
     case "ls":

package/hooks/safety-guard.mjs

@@ -65,13 +65,20 @@ function main() {
   // psmux 명령이 실제 CLI 호출인지 판별 (오탐 방지)
   // git commit 메시지, echo, grep, cat, heredoc 안의 텍스트는 무시
   function isPsmuxInvocation(cmd) {
-    // 명령을 세그먼트로 분할 (&&, ;, | 기준)
-    const segments = cmd.split(/[;&|]+/);
-    return segments.some((seg) => {
-      const trimmed = seg.trim();
-      if (trimmed.startsWith("#")) return false; // 주석
-      // 세그먼트의 첫 단어가 psmux인 경우만 실제 호출
-      return /^\s*psmux\s+kill-(session|server)\b/i.test(trimmed);
+    // psmux kill-session/server가 명령에 없으면 즉시 false
+    if (!/\bpsmux\s+kill-(session|server)\b/i.test(cmd)) return false;
+
+    // 줄 분할 → 세그먼트 분할(&&, ;, ||)로 각 명령 단위 검사
+    // 세그먼트가 echo/grep/git-commit으로 시작하면 인자 텍스트이므로 무시
+    const lines = cmd.split(/\n/);
+    return lines.some((line) => {
+      const segments = line.split(/\s*(?:&&|;|\|\|)\s*/);
+      return segments.some((seg) => {
+        const t = seg.trim();
+        if (!t || t.startsWith("#")) return false;
+        if (/^\s*(echo|printf|grep|git\s+commit)\b/i.test(t)) return false;
+        return /\bpsmux\s+kill-(session|server)\b/i.test(t);
+      });
     });
   }
 

package/hub/account-broker.mjs

@@ -0,0 +1,242 @@
+// hub/account-broker.mjs — Multi-account CLI pool broker
+// Manages lease/release/cooldown for Codex and Gemini accounts.
+// Singleton export. All state changes create new objects (immutable pattern).
+
+import { readFileSync, existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+import * as z from 'zod';
+
+// ── Zod schema ───────────────────────────────────────────────────
+
+const AccountSchema = z.object({
+  id: z.string().min(1),
+  mode: z.enum(['profile', 'env', 'auth']),
+  profile: z.string().optional(),
+  env: z.record(z.string(), z.string()).optional(),
+  authFile: z.string().optional(),
+}).superRefine((val, ctx) => {
+  if (val.mode === 'auth' && !val.authFile) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      message: 'authFile is required when mode is "auth"',
+      path: ['authFile'],
+    });
+  }
+});
+
+const ConfigSchema = z.object({
+  defaults: z.object({
+    cooldownMs: z.number().int().positive().optional(),
+  }).optional(),
+  codex: z.array(AccountSchema).optional(),
+  gemini: z.array(AccountSchema).optional(),
+});
+
+const DEFAULT_COOLDOWN_MS = 300_000; // 5 minutes
+const LEASE_TTL_MS = 30 * 60 * 1000; // 30 minutes
+const AUTH_BASE_PATH = join(homedir(), '.claude', 'cache', 'tfx-hub');
+
+// ── env var resolution ───────────────────────────────────────────
+
+function resolveEnvValues(env) {
+  if (!env) return undefined;
+  const resolved = {};
+  for (const [key, value] of Object.entries(env)) {
+    if (typeof value === 'string' && value.startsWith('$')) {
+      const varName = value.slice(1);
+      resolved[key] = process.env[varName] ?? '';
+    } else {
+      resolved[key] = value;
+    }
+  }
+  return resolved;
+}
+
+// ── AccountBroker ────────────────────────────────────────────────
+
+class AccountBroker {
+  #config;
+  #state; // Map<accountId, accountState>
+  #roundRobinIndex; // Map<provider, number>
+
+  constructor(config) {
+    const parsed = ConfigSchema.parse(config);
+    this.#config = parsed;
+
+    this.#state = new Map();
+    this.#roundRobinIndex = new Map();
+
+    const allAccounts = [
+      ...(parsed.codex || []).map((a) => ({ ...a, provider: 'codex' })),
+      ...(parsed.gemini || []).map((a) => ({ ...a, provider: 'gemini' })),
+    ];
+
+    for (const account of allAccounts) {
+      this.#state.set(account.id, {
+        id: account.id,
+        provider: account.provider,
+        mode: account.mode,
+        profile: account.profile,
+        env: account.env,
+        authFile: account.authFile,
+        busy: false,
+        leasedAt: null,
+        cooldownUntil: 0,
+        failures: 0,
+        lastUsedAt: 0,
+        totalSessions: 0,
+      });
+    }
+  }
+
+  // ── lease TTL pruning ──────────────────────────────────────────
+
+  #pruneExpiredLeases(now) {
+    for (const [id, acct] of this.#state) {
+      if (acct.busy && acct.leasedAt !== null && now - acct.leasedAt > LEASE_TTL_MS) {
+        this.#state.set(id, { ...acct, busy: false, leasedAt: null });
+      }
+    }
+  }
+
+  // ── lease ─────────────────────────────────────────────────────
+
+  lease({ provider }) {
+    const now = Date.now();
+    this.#pruneExpiredLeases(now);
+
+    const accounts = [...this.#state.values()].filter((a) => a.provider === provider);
+    if (!accounts.length) return null;
+
+    const current = this.#roundRobinIndex.get(provider) ?? 0;
+    const count = accounts.length;
+
+    // round-robin starting from current index, skip busy/cooldown
+    for (let i = 0; i < count; i++) {
+      const idx = (current + i) % count;
+      const acct = accounts[idx];
+
+      if (acct.busy) continue;
+      if (acct.cooldownUntil > now) continue;
+
+      // advance round-robin index
+      this.#roundRobinIndex.set(provider, (idx + 1) % count);
+
+      // update state
+      this.#state.set(acct.id, {
+        ...acct,
+        busy: true,
+        leasedAt: now,
+        lastUsedAt: now,
+        totalSessions: acct.totalSessions + 1,
+      });
+
+      return {
+        id: acct.id,
+        mode: acct.mode,
+        profile: acct.mode === 'profile' ? acct.profile : undefined,
+        env: acct.mode === 'env' ? resolveEnvValues(acct.env) : undefined,
+        authFile: acct.mode === 'auth' ? join(AUTH_BASE_PATH, acct.authFile) : undefined,
+      };
+    }
+
+    return null;
+  }
+
+  // ── release ───────────────────────────────────────────────────
+
+  release(accountId, result) {
+    const acct = this.#state.get(accountId);
+    if (!acct) return;
+
+    const ok = result?.ok === true;
+    const newFailures = ok ? 0 : acct.failures + 1;
+    const cooldownMs = this.#config.defaults?.cooldownMs ?? DEFAULT_COOLDOWN_MS;
+
+    const updated = {
+      ...acct,
+      busy: false,
+      leasedAt: null,
+      failures: newFailures,
+    };
+
+    // consecutive failure guard: 3+ failures → auto-cooldown
+    if (newFailures >= 3) {
+      updated.cooldownUntil = Date.now() + cooldownMs;
+      updated.failures = 0; // reset after cooldown triggered
+    }
+
+    this.#state.set(accountId, updated);
+  }
+
+  // ── markRateLimited ───────────────────────────────────────────
+
+  markRateLimited(id, coolMs) {
+    const acct = this.#state.get(id);
+    if (!acct) return;
+    this.#state.set(id, {
+      ...acct,
+      busy: false,
+      leasedAt: null,
+      cooldownUntil: Date.now() + coolMs,
+    });
+  }
+
+  // ── snapshot ──────────────────────────────────────────────────
+
+  snapshot() {
+    return [...this.#state.values()].map((acct) => ({ ...acct }));
+  }
+
+  // ── nextAvailableEta ──────────────────────────────────────────
+
+  nextAvailableEta(provider) {
+    const now = Date.now();
+    this.#pruneExpiredLeases(now);
+
+    const accounts = [...this.#state.values()].filter((a) => a.provider === provider);
+    if (!accounts.length) return null;
+
+    // find minimum cooldownUntil among accounts that are in cooldown or busy
+    let earliest = null;
+    for (const acct of accounts) {
+      if (!acct.busy && acct.cooldownUntil <= now) {
+        // this account is available now — no ETA needed
+        return null;
+      }
+      const eta = acct.busy ? (acct.leasedAt ?? now) + LEASE_TTL_MS : acct.cooldownUntil;
+      if (earliest === null || eta < earliest) {
+        earliest = eta;
+      }
+    }
+    return earliest;
+  }
+}
+
+// ── Config loader ────────────────────────────────────────────────
+
+function loadConfig() {
+  const configPath = join(homedir(), '.claude', 'cache', 'tfx-hub', 'accounts.json');
+  if (!existsSync(configPath)) return null;
+  try {
+    return JSON.parse(readFileSync(configPath, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+// ── Singleton ────────────────────────────────────────────────────
+
+function createBroker() {
+  const config = loadConfig();
+  if (!config) return null;
+  try {
+    return new AccountBroker(config);
+  } catch {
+    return null;
+  }
+}
+
+export const broker = createBroker();
+export { AccountBroker };

package/hub/codex-adapter.mjs

@@ -20,6 +20,7 @@ const breaker = createCircuitBreaker();
 
 function inferStallMode(stdout, stderr) {
   const text = `${stdout}\n${stderr}`.toLowerCase();
+  if (/(rate.?limit|quota|throttl|too.many.requests|429|usage.limit)/u.test(text)) return 'rate_limited';
   if (/(approval|approve|permission|sandbox|bypass)/u.test(text)) return 'approval_stall';
   if (/\bmcp\b|context7|playwright|tavily|exa|brave|sequential|server/u.test(text)) return 'mcp_stall';
   return 'timeout';

package/hub/gemini-adapter.mjs

@@ -22,6 +22,7 @@ const breaker = createCircuitBreaker();
 
 function inferStallMode(stdout, stderr) {
   const text = `${stdout}\n${stderr}`.toLowerCase();
+  if (/(rate.?limit|quota|resource.?exhaust|429)/u.test(text)) return 'rate_limited';
   if (/(unauthorized|forbidden|auth|login|token|credential|api.?key)/u.test(text)) return 'auth_stall';
   if (/\bmcp\b|playwright|tavily|brave|sequential|server/u.test(text)) return 'mcp_stall';
   return 'timeout';

package/hub/lib/cache-guard.mjs

@@ -0,0 +1,114 @@
+import { accessSync, constants, existsSync, readFileSync, readdirSync } from "node:fs";
+import http from "node:http";
+import https from "node:https";
+import { basename, join, relative } from "node:path";
+
+const NETWORK_TIMEOUT_MS = 3_000;
+
+function toIssuePath(cacheDir, filePath) {
+  const relPath = relative(cacheDir, filePath);
+  return (relPath && relPath.length > 0 ? relPath : basename(filePath)).replace(/\\/g, "/");
+}
+
+function collectCacheFiles(cacheDir) {
+  return readdirSync(cacheDir, { withFileTypes: true }).flatMap((entry) => {
+    const filePath = join(cacheDir, entry.name);
+    if (entry.isDirectory()) return collectCacheFiles(filePath);
+    return entry.isFile() ? [filePath] : [];
+  });
+}
+
+function validateCacheFile(cacheDir, filePath) {
+  try {
+    accessSync(filePath, constants.R_OK);
+    if (filePath.endsWith(".json")) {
+      JSON.parse(readFileSync(filePath, "utf8"));
+    }
+    return null;
+  } catch (error) {
+    return {
+      file: toIssuePath(cacheDir, filePath),
+      error: error instanceof Error ? error.message : String(error),
+    };
+  }
+}
+
+function probeUrl(url) {
+  return new Promise((resolve) => {
+    let settled = false;
+
+    const finish = (ok) => {
+      if (settled) return;
+      settled = true;
+      resolve({ url, ok });
+    };
+
+    try {
+      const parsed = new URL(url);
+      const transport = parsed.protocol === "https:" ? https : parsed.protocol === "http:" ? http : null;
+      if (!transport) {
+        finish(false);
+        return;
+      }
+
+      const request = transport.request(parsed, {
+        method: "HEAD",
+        headers: { "user-agent": "triflux-cache-guard" },
+      }, (response) => {
+        response.resume();
+        finish(true);
+      });
+
+      request.setTimeout(NETWORK_TIMEOUT_MS, () => {
+        request.destroy(new Error("timeout"));
+      });
+      request.on("error", () => finish(false));
+      request.end();
+    } catch {
+      finish(false);
+    }
+  });
+}
+
+export function validateRuntimeCachePaths(cacheDir) {
+  if (!cacheDir || !existsSync(cacheDir)) {
+    return { ok: true, issues: [] };
+  }
+
+  try {
+    const files = collectCacheFiles(cacheDir);
+    const issues = files
+      .map((filePath) => validateCacheFile(cacheDir, filePath))
+      .filter((issue) => issue !== null);
+
+    return {
+      ok: issues.length === 0,
+      issues,
+    };
+  } catch (error) {
+    return {
+      ok: false,
+      issues: [{
+        file: ".",
+        error: error instanceof Error ? error.message : String(error),
+      }],
+    };
+  }
+}
+
+export async function checkNetworkAvailability(urls) {
+  const targets = [...new Set((Array.isArray(urls) ? urls : []).filter(Boolean))];
+  if (targets.length === 0) {
+    return { online: true, reachable: [], unreachable: [] };
+  }
+
+  const results = await Promise.all(targets.map((url) => probeUrl(url)));
+  const reachable = results.filter((result) => result.ok).map((result) => result.url);
+  const unreachable = results.filter((result) => !result.ok).map((result) => result.url);
+
+  return {
+    online: unreachable.length === 0,
+    reachable,
+    unreachable,
+  };
+}

package/hub/team/conductor.mjs

@@ -10,7 +10,8 @@
 
 import { spawn, execFile } from 'node:child_process';
 import { join } from 'node:path';
-import { mkdirSync, createWriteStream, readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { mkdirSync, createWriteStream, readFileSync, copyFileSync } from 'node:fs';
 import { EventEmitter } from 'node:events';
 
 import { killProcess, IS_WINDOWS } from '../platform.mjs';
@@ -18,6 +19,7 @@ import { createEventLog } from './event-log.mjs';
 import { createHealthProbe } from './health-probe.mjs';
 import { createRemoteProbe } from './remote-probe.mjs';
 import { buildLauncher } from './launcher-template.mjs';
+import { broker } from '../account-broker.mjs';
 
 /** 세션 상태 */
 export const STATES = Object.freeze({
@@ -272,6 +274,14 @@ export function createConductor(opts = {}) {
     } else {
       transition(session, STATES.DEAD, `maxRestarts(${maxRestarts})_exceeded`);
       emitter.emit('dead', { sessionId: session.id, reason });
+
+      // broker release on final death
+      if (broker && session.config.accountId) {
+        broker.release(session.config.accountId, { ok: false, failureMode: session.lastFailureMode });
+        if (session.lastFailureMode === 'rate_limited') {
+          broker.markRateLimited(session.config.accountId, 5 * 60 * 1000);
+        }
+      }
     }
   }
 
@@ -299,7 +309,7 @@ export function createConductor(opts = {}) {
     try {
       child = spawn(launcher.command, {
         shell: true,
-        env: { ...process.env, ...launcher.env },
+        env: { ...process.env, ...launcher.env, ...(session.config.env || {}) },
         stdio: ['pipe', 'pipe', 'pipe'],
         windowsHide: true,
       });
@@ -352,7 +362,14 @@ export function createConductor(opts = {}) {
       if (code === 0 && !signal) {
         transition(session, STATES.COMPLETED, 'exit_0');
         emitter.emit('completed', { sessionId: session.id });
+        if (broker && session.config.accountId) {
+          broker.release(session.config.accountId, { ok: true });
+        }
       } else {
+        // detect rate_limited from recent output before handleFailure
+        if (/(rate.?limit|quota|throttl|too.many.requests|429|usage.limit)/ui.test(recentOutput)) {
+          session.lastFailureMode = 'rate_limited';
+        }
         handleFailure(session, `exit_code:${code},signal:${signal}`);
       }
 
@@ -460,20 +477,63 @@ export function createConductor(opts = {}) {
     if (sessions.has(config.id)) throw new Error(`Session "${config.id}" already exists`);
     if (config.remote && !config.host) throw new Error('host is required for remote sessions');
 
+    // broker lease (graceful — broker null if accounts.json absent)
+    let lease = null;
+    if (broker && config.agent && !config.remote) {
+      lease = broker.lease({ provider: config.agent });
+      if (lease === null) {
+        const eta = broker.nextAvailableEta(config.agent);
+        eventLog.append('broker_no_lease', {
+          session: config.id,
+          agent: config.agent,
+          eta: eta ? new Date(eta).toISOString() : 'unknown',
+        });
+        // PoC: skip session when all accounts in cooldown
+        return config.id;
+      }
+    }
+
+    // apply lease profile/env/auth to config (immutable — new object)
+    const resolvedConfig = lease
+      ? {
+          ...config,
+          profile: lease.profile ?? config.profile,
+          env: { ...(config.env || {}), ...(lease.env || {}) },
+          accountId: lease.id,
+        }
+      : config;
+
+    // auth file copy — broker resolved absolute path, conductor does the actual copy
+    if (lease?.mode === 'auth' && lease.authFile) {
+      const destMap = {
+        codex: join(homedir(), '.codex', 'auth.json'),
+        gemini: join(homedir(), '.gemini', 'oauth_creds.json'),
+      };
+      const dest = destMap[config.agent];
+      if (dest) {
+        try {
+          copyFileSync(lease.authFile, dest);
+          eventLog.append('auth_copy', { session: config.id, agent: config.agent, dest });
+        } catch (err) {
+          eventLog.append('auth_copy_error', { session: config.id, error: err.message });
+        }
+      }
+    }
+
     // 원격 세션은 launcher 불필요 (이미 원격에서 실행 중)
-    const launcher = config.remote
+    const launcher = resolvedConfig.remote
       ? null
       : buildLauncher({
-          agent: config.agent,
-          profile: config.profile,
-          prompt: config.prompt,
-          workdir: config.workdir,
-          model: config.model,
+          agent: resolvedConfig.agent,
+          profile: resolvedConfig.profile,
+          prompt: resolvedConfig.prompt,
+          workdir: resolvedConfig.workdir,
+          model: resolvedConfig.model,
         });
 
     const session = {
-      id: config.id,
-      config,
+      id: resolvedConfig.id,
+      config: resolvedConfig,
       launcher,
       state: STATES.INIT,
       child: null,
@@ -485,14 +545,14 @@ export function createConductor(opts = {}) {
       createdAt: Date.now(),
     };
 
-    sessions.set(config.id, session);
+    sessions.set(resolvedConfig.id, session);
 
-    if (config.remote) {
+    if (resolvedConfig.remote) {
       startRemoteSession(session);
     } else {
       void respawnSession(session);
     }
-    return config.id;
+    return resolvedConfig.id;
   }
 
   /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "triflux",
-  "version": "9.8.5",
+  "version": "9.8.7",
   "description": "CLI-first multi-model orchestrator for Claude Code — route tasks to Codex, Gemini, and Claude",
   "type": "module",
   "bin": {

package/scripts/claudemd-sync.mjs

@@ -0,0 +1,103 @@
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const PROJECT_ROOT = fileURLToPath(new URL("..", import.meta.url));
+const PROJECT_CLAUDE_MD_PATH = join(PROJECT_ROOT, "CLAUDE.md");
+const ROUTING_SECTION_HEADING = "## triflux CLI 라우팅";
+
+function findRoutingSection(markdown) {
+  const content = String(markdown || "");
+  const headingPattern = new RegExp(`(^|\\n)${ROUTING_SECTION_HEADING.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&")}(?=\\n|$)`, "u");
+  const match = headingPattern.exec(content);
+
+  if (!match) {
+    return { found: false, startIndex: -1, endIndex: -1, section: "" };
+  }
+
+  const startIndex = match.index + match[1].length;
+  const nextHeadingIndex = content.indexOf("\n## ", startIndex + ROUTING_SECTION_HEADING.length);
+  const endIndex = nextHeadingIndex === -1 ? content.length : nextHeadingIndex + 1;
+
+  return {
+    found: true,
+    startIndex,
+    endIndex,
+    section: content.slice(startIndex, endIndex),
+  };
+}
+
+function normalizeRoutingSection(routingTable) {
+  const section = String(routingTable || "").trim();
+  return section ? `${section}\n` : "";
+}
+
+function buildNextMarkdown(currentMarkdown, routingSection) {
+  const current = String(currentMarkdown || "");
+  const nextSection = normalizeRoutingSection(routingSection);
+  const existing = findRoutingSection(current);
+
+  if (existing.found) {
+    return `${current.slice(0, existing.startIndex)}${nextSection}${current.slice(existing.endIndex)}`;
+  }
+
+  if (!current) {
+    return nextSection;
+  }
+
+  const separator = current.endsWith("\n\n") ? "" : current.endsWith("\n") ? "\n" : "\n\n";
+  return `${current}${separator}${nextSection}`;
+}
+
+function toSkippedResult(path, reason) {
+  return { action: "unchanged", path, skipped: true, reason };
+}
+
+export function getLatestRoutingTable() {
+  if (!existsSync(PROJECT_CLAUDE_MD_PATH)) {
+    throw new Error(`project CLAUDE.md not found: ${PROJECT_CLAUDE_MD_PATH}`);
+  }
+
+  const projectMarkdown = readFileSync(PROJECT_CLAUDE_MD_PATH, "utf8");
+  const section = findRoutingSection(projectMarkdown);
+
+  if (!section.found) {
+    throw new Error(`routing section not found in: ${PROJECT_CLAUDE_MD_PATH}`);
+  }
+
+  return section.section.trim();
+}
+
+export function ensureTfxSection(claudeMdPath, routingTable) {
+  if (!existsSync(claudeMdPath)) {
+    return toSkippedResult(claudeMdPath, "missing_file");
+  }
+
+  const currentMarkdown = readFileSync(claudeMdPath, "utf8");
+  const nextMarkdown = buildNextMarkdown(currentMarkdown, routingTable);
+
+  if (nextMarkdown === currentMarkdown) {
+    return { action: "unchanged", path: claudeMdPath };
+  }
+
+  writeFileSync(claudeMdPath, nextMarkdown, "utf8");
+
+  return {
+    action: findRoutingSection(currentMarkdown).found ? "updated" : "created",
+    path: claudeMdPath,
+  };
+}
+
+export function ensureGlobalClaudeRoutingSection(claudeDir) {
+  const claudeMdPath = join(claudeDir, "CLAUDE.md");
+  if (!existsSync(claudeMdPath)) {
+    return toSkippedResult(claudeMdPath, "missing_file");
+  }
+
+  try {
+    return ensureTfxSection(claudeMdPath, getLatestRoutingTable());
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : "routing_table_unavailable";
+    return toSkippedResult(claudeMdPath, reason);
+  }
+}

package/scripts/setup.mjs

@@ -5,10 +5,11 @@
 // - skills/를 ~/.claude/skills/에 동기화
 
 import { copyFileSync, mkdirSync, readFileSync, writeFileSync, readdirSync, existsSync, chmodSync, unlinkSync } from "fs";
-import { join, dirname } from "path";
+import { join, dirname, relative } from "path";
 import { homedir } from "os";
 import { spawn, execFileSync } from "child_process";
 import { fileURLToPath } from "url";
+import { ensureGlobalClaudeRoutingSection, ensureTfxSection, getLatestRoutingTable } from "./claudemd-sync.mjs";
 import { cleanupTmpFiles } from "./tmp-cleanup.mjs";
 
 const PLUGIN_ROOT = dirname(dirname(fileURLToPath(import.meta.url)));
@@ -54,6 +55,42 @@ const REQUIRED_CODEX_PROFILES = [
   },
 ];
 
+const HUD_SYNC_EXCLUDES = new Set(["omc-hud.mjs", "omc-hud.mjs.bak"]);
+
+function scanHudFiles(pluginRoot, claudeDir) {
+  const hudRoot = join(pluginRoot, "hud");
+  if (!existsSync(hudRoot)) return [];
+
+  const walk = (currentDir) => {
+    const entries = readdirSync(currentDir, { withFileTypes: true })
+      .sort((left, right) => left.name.localeCompare(right.name));
+
+    return entries.flatMap((entry) => {
+      const absolutePath = join(currentDir, entry.name);
+      if (entry.isDirectory()) {
+        return walk(absolutePath);
+      }
+
+      if (!entry.isFile() || HUD_SYNC_EXCLUDES.has(entry.name) || !entry.name.endsWith(".mjs")) {
+        return [];
+      }
+
+      const hudRelativePath = relative(hudRoot, absolutePath);
+      const normalizedRelativePath = hudRelativePath.replace(/\\/g, "/");
+
+      return [{
+        src: absolutePath,
+        dst: join(claudeDir, "hud", hudRelativePath),
+        label: normalizedRelativePath === "hud-qos-status.mjs"
+          ? "hud-qos-status.mjs"
+          : `hud/${normalizedRelativePath}`,
+      }];
+    });
+  };
+
+  return walk(hudRoot);
+}
+
 // ── 파일 동기화 ──
 
 const SYNC_MAP = [
@@ -107,51 +144,7 @@ const SYNC_MAP = [
     dst: join(CLAUDE_DIR, "scripts", "hub", "workers", "factory.mjs"),
     label: "hub/workers/factory.mjs",
   },
-  {
-    src: join(PLUGIN_ROOT, "hud", "hud-qos-status.mjs"),
-    dst: join(CLAUDE_DIR, "hud", "hud-qos-status.mjs"),
-    label: "hud-qos-status.mjs",
-  },
-  {
-    src: join(PLUGIN_ROOT, "hud", "colors.mjs"),
-    dst: join(CLAUDE_DIR, "hud", "colors.mjs"),
-    label: "hud/colors.mjs",
-  },
-  {
-    src: join(PLUGIN_ROOT, "hud", "constants.mjs"),
-    dst: join(CLAUDE_DIR, "hud", "constants.mjs"),
-    label: "hud/constants.mjs",
-  },
-  {
-    src: join(PLUGIN_ROOT, "hud", "terminal.mjs"),
-    dst: join(CLAUDE_DIR, "hud", "terminal.mjs"),
-    label: "hud/terminal.mjs",
-  },
-  {
-    src: join(PLUGIN_ROOT, "hud", "utils.mjs"),
-    dst: join(CLAUDE_DIR, "hud", "utils.mjs"),
-    label: "hud/utils.mjs",
-  },
-  {
-    src: join(PLUGIN_ROOT, "hud", "renderers.mjs"),
-    dst: join(CLAUDE_DIR, "hud", "renderers.mjs"),
-    label: "hud/renderers.mjs",
-  },
-  {
-    src: join(PLUGIN_ROOT, "hud", "providers", "claude.mjs"),
-    dst: join(CLAUDE_DIR, "hud", "providers", "claude.mjs"),
-    label: "hud/providers/claude.mjs",
-  },
-  {
-    src: join(PLUGIN_ROOT, "hud", "providers", "codex.mjs"),
-    dst: join(CLAUDE_DIR, "hud", "providers", "codex.mjs"),
-    label: "hud/providers/codex.mjs",
-  },
-  {
-    src: join(PLUGIN_ROOT, "hud", "providers", "gemini.mjs"),
-    dst: join(CLAUDE_DIR, "hud", "providers", "gemini.mjs"),
-    label: "hud/providers/gemini.mjs",
-  },
+  ...scanHudFiles(PLUGIN_ROOT, CLAUDE_DIR),
   {
     src: join(PLUGIN_ROOT, "scripts", "notion-read.mjs"),
     dst: join(CLAUDE_DIR, "scripts", "notion-read.mjs"),
@@ -526,9 +519,23 @@ function ensureCodexProfiles() {
       writeFileSync(CODEX_CONFIG_PATH, updated, "utf8");
     }
 
-    return changed;
-  } catch {
-    return 0;
+    return { ok: true, changed };
+  } catch (error) {
+    const message = error instanceof Error && error.message ? error.message.trim() : "unknown error";
+    return { ok: false, changed: 0, message };
+  }
+}
+
+function syncClaudeRoutingSections() {
+  try {
+    const routingTable = getLatestRoutingTable();
+    return [
+      ensureTfxSection(join(PLUGIN_ROOT, "CLAUDE.md"), routingTable),
+      ensureGlobalClaudeRoutingSection(CLAUDE_DIR),
+    ];
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : "routing_sync_failed";
+    return [{ action: "unchanged", path: join(PLUGIN_ROOT, "CLAUDE.md"), skipped: true, reason }];
   }
 }
 
@@ -536,6 +543,7 @@ export {
   replaceProfileSection,
   hasProfileSection,
   detectDevMode,
+  scanHudFiles,
   SYNC_MAP,
   BREADCRUMB_PATH,
   PLUGIN_ROOT,
@@ -572,14 +580,20 @@ if (isSync) {
 
 const pkgVersion = getPackageVersion();
 const marker = readMarker();
+const claudeRoutingResults = syncClaudeRoutingSections();
+const claudeRoutingChangedCount = claudeRoutingResults.filter((result) => result.action === "created" || result.action === "updated").length;
 if (pkgVersion && marker?.version === pkgVersion && !isForce) {
-  console.log(`setup: skip (v${pkgVersion} already synced)`);
+  if (claudeRoutingChangedCount > 0) {
+    console.log(`setup: skip core sync (v${pkgVersion} already synced, CLAUDE.md ${claudeRoutingChangedCount}건 반영)`);
+  } else {
+    console.log(`setup: skip (v${pkgVersion} already synced)`);
+  }
   process.exit(0);
 }
 
-let synced = 0;
+let synced = claudeRoutingChangedCount;
 
-for (const { src, dst, label } of SYNC_MAP) {
+for (const { src, dst } of SYNC_MAP) {
   if (!existsSync(src)) continue;
 
   const dstDir = dirname(dst);
@@ -990,39 +1004,28 @@ if (process.platform === "win32") {
 
 // ── Codex 프로필 자동 보정 ──
 
-const codexProfilesAdded = ensureCodexProfiles();
-if (codexProfilesAdded > 0) {
+const codexProfilesResult = ensureCodexProfiles();
+if (codexProfilesResult.ok && codexProfilesResult.changed > 0) {
   synced++;
 }
 
-// ── CLAUDE.md TFX 섹션 관리 (마이그레이션 + 업데이트) ──
+// ── CLAUDE.md 라우팅 섹션 자동 동기화 ──
 
 try {
-  const { migrate, readSection, diagnose, getPackageVersion: getTfxVersion } = await import("./lib/claudemd-manager.mjs");
-  const globalClaudeMd = join(CLAUDE_DIR, "CLAUDE.md");
-  const projectClaudeMd = join(PLUGIN_ROOT, "CLAUDE.md");
-
-  for (const mdPath of [globalClaudeMd, projectClaudeMd]) {
-    if (!existsSync(mdPath)) continue;
-    const section = readSection(mdPath);
-    const ver = getTfxVersion();
-
-    if (!section.found || section.version !== ver) {
-      const result = migrate(mdPath, { version: ver });
-      const label = mdPath === globalClaudeMd ? "global" : "project";
-      if (result.action === "migrated") {
-        console.log(`  \x1b[32m✓\x1b[0m CLAUDE.md (${label}): 레거시 → TFX v${ver} 마이그레이션`);
-        synced++;
-      } else if (result.action !== "already_managed") {
-        console.log(`  \x1b[32m✓\x1b[0m CLAUDE.md (${label}): TFX v${ver} ${result.action}`);
-        synced++;
-      }
-    }
+  const routingTable = getLatestRoutingTable();
+  const projectResult = ensureTfxSection(join(PLUGIN_ROOT, "CLAUDE.md"), routingTable);
+  if (projectResult.action !== "unchanged") {
+    console.log(`  \x1b[32m✓\x1b[0m CLAUDE.md (project): ${projectResult.action}`);
+    synced++;
+  }
+  const globalResult = ensureGlobalClaudeRoutingSection(CLAUDE_DIR);
+  if (globalResult.action !== "unchanged") {
+    console.log(`  \x1b[32m✓\x1b[0m CLAUDE.md (global): ${globalResult.action}`);
+    synced++;
   }
 } catch (error) {
-  console.log(`  \x1b[33m⚠\x1b[0m CLAUDE.md 관리 실패: ${error.message}`);
+  console.log(`  \x1b[33m⚠\x1b[0m CLAUDE.md 동기화 실패: ${error.message}`);
 }
-
 // ── MCP 인벤토리 백그라운드 갱신 ──
 
 const mcpCheck = join(PLUGIN_ROOT, "scripts", "mcp-check.mjs");