elanous 0.2.0 → 0.2.4

package/src/boot/acp-server.ts

@@ -11,6 +11,7 @@
 //   --socket-path=<path>                       unix-socket only
 //   --port=<n>                                 websocket only
 //   --host=<host>                              websocket only
+//   --tool-cwd=<path>                          overrides ELANOUS_TOOL_CWD
 //   --no-auth                                  websocket: skip token
 //
 // The boot wraps `runAcpServer` with a SIGINT/SIGTERM-aware shutdown
@@ -35,6 +36,7 @@ import {
 } from '../acp/transport/index.js';
 import { runAcpServer, type AcpServerOptions } from '../acp/server.js';
 import type { LlmBrand } from '../llm-vision-capability.js';
+import { DEFAULT_NEXUS_HTTP_PORT } from '../nexus/default-port.js';
 
 export type AcpBootTransport = 'stdio' | 'unix-socket' | 'websocket';
 
@@ -50,6 +52,8 @@ export interface AcpBootOptions {
    *  other pre-auth'd private transports). Default `false` →
    *  token check ON. */
   noAuth?: boolean;
+  /** Optional ACP tool cwd fallback; overrides ELANOUS_TOOL_CWD when set. */
+  toolCwd?: string;
 }
 
 /** Default socket path — XDG-ish; `~/.elanous/elanous.sock`. */
@@ -58,7 +62,7 @@ export function defaultUnixSocketPath(): string {
 }
 
 /** Default websocket bind port. Mnemonic: π × 10⁴. */
-export const DEFAULT_WEBSOCKET_PORT = 31415;
+export const DEFAULT_WEBSOCKET_PORT = DEFAULT_NEXUS_HTTP_PORT;
 
 /** Parse --flag / --flag=value / --flag value out of argv. Returns
  *  the value string or undefined. Exported for tests; the boot
@@ -101,6 +105,8 @@ export function parseAcpBootArgs(argv: readonly string[]): AcpBootOptions {
   const host = readFlagValue(argv, '--host');
   if (host) opts.host = host;
   if (argv.includes('--no-auth')) opts.noAuth = true;
+  const toolCwd = readFlagValue(argv, '--tool-cwd');
+  if (toolCwd !== undefined) opts.toolCwd = toolCwd;
   return opts;
 }
 
@@ -131,7 +137,7 @@ export interface BootRuntimeStatus {
   /** Active tool surface kind ('none' | 'readonly'). When omitted or
    *  'none', the banner says so + hints at ELANOUS_TOOLS=readonly. */
   tools?: string;
-  /** Resolved tool cwd when tools !== 'none'. */
+  /** Optional boot cwd fallback; session cwd takes precedence. */
   toolCwd?: string;
 }
 
@@ -226,6 +232,11 @@ export async function bootAcpServer(
   const runTurn = deps.runTurn;
   const hasSession = deps.hasSession;
   const runtimeStatus = deps.runtimeStatus;
+  const bootToolCwd = runtimeStatus?.toolCwd || opts.toolCwd?.trim() || process.env.ELANOUS_TOOL_CWD?.trim();
+  const cwdPolicy = {
+    requireSessionToolCwd: true,
+    ...(bootToolCwd ? { bootToolCwd } : {}),
+  };
   const declarationIdentity = {
     ...(deps.agentBrand !== undefined ? { agentBrand: deps.agentBrand } : {}),
     ...(deps.agentModel !== undefined ? { agentModel: deps.agentModel } : {}),
@@ -260,6 +271,7 @@ export async function bootAcpServer(
         shutdownSignal: ownSignal,
         ...(runTurn ? { runTurn } : {}),
         ...(hasSession ? { hasSession } : {}),
+        ...cwdPolicy,
         ...declarationIdentity,
       });
       return;
@@ -276,6 +288,7 @@ export async function bootAcpServer(
         shutdownSignal: ownSignal,
         ...(runTurn ? { runTurn } : {}),
         ...(hasSession ? { hasSession } : {}),
+        ...cwdPolicy,
         ...declarationIdentity,
       });
       return;
@@ -308,6 +321,7 @@ export async function bootAcpServer(
       shutdownSignal: ownSignal,
       ...(runTurn ? { runTurn } : {}),
       ...(hasSession ? { hasSession } : {}),
+      ...cwdPolicy,
       ...declarationIdentity,
     });
   } finally {

package/src/boot/check-same-origin.ts

@@ -28,10 +28,11 @@
 // kept passing on tier 1 — the regression was Tailscale-only.
 
 /**
- * Trust only local clients and the Tailscale CGNAT allocation for the
- * header-based bypass. We deliberately do not invoke `tailscale whois` per
- * request: authentication must remain available without the CLI/runtime and
- * must not turn an external process into the hot-path availability boundary.
+ * Trust only a connection made on this machine itself (loopback) for the
+ * header-based bypass. 2026-09-27 (RFC `내부 문서 `RFC-pwa-auth-without-header-trust-2026-09-27``
+ * · 대표 A · 🅢 A′): the Tailscale CGNAT range (100.64/10) is no longer trusted —
+ * `Sec-Fetch-Site`/`Origin`/`Referer`/`Host` are freely set by any non-browser
+ * client, and the tailnet includes the bot VM that takes public webhooks.
  * An absent peer is untrusted, so unknown connections must present a bearer.
  */
 export function isTrustedSameOriginPeer(peerAddress: string | undefined): boolean {
@@ -42,11 +43,24 @@ export function isTrustedSameOriginPeer(peerAddress: string | undefined): boolea
   if (octets.length !== 4 || octets.some((octet) => !Number.isInteger(octet) || octet < 0 || octet > 255)) {
     return false;
   }
-  return octets[0] === 127 || (octets[0] === 100 && octets[1] >= 64 && octets[1] <= 127);
+  return octets[0] === 127;
+}
+
+/** Headers a reverse proxy adds. `tailscale serve` reaches NEXUS over loopback but
+ *  always attaches `X-Forwarded-For` and `Tailscale-*`; a client cannot make them
+ *  disappear (it passes `Host` through untouched, so `Host` proves nothing — 🅢 실측 2026-09-27). */
+export function hasProxyMarker(req: Request): boolean {
+  for (const name of ['x-forwarded-for', 'forwarded', 'x-real-ip', 'x-forwarded-host']) {
+    if (req.headers.has(name)) return true;
+  }
+  for (const [name] of req.headers) if (name.toLowerCase().startsWith('tailscale-')) return true;
+  return false;
 }
 
 export function isSameOriginRequest(req: Request, peerAddress?: string): boolean {
   if (!isTrustedSameOriginPeer(peerAddress)) return false;
+  // Loopback via a proxy (tailscale serve · local relay) is someone else's request.
+  if (hasProxyMarker(req)) return false;
   const sfs = req.headers.get('sec-fetch-site');
   if (sfs === 'same-origin') return true;
   if (sfs && sfs !== 'none') return false;

package/src/boot/daemon-multi-llm-runtime.ts

@@ -25,12 +25,14 @@
 //
 // See: 내부 문서 `PLAN-cv-3-daemon-multi-llm-2026-05-08` (RFC v2 · 13 D)
 
+import { AsyncLocalStorage } from 'node:async_hooks';
 import type { LLMMessage } from '../llm.js';
 import { debug } from '../debug/log.js';
 import { notifyDaemonActivity } from '../dispatch/idle-detector.js';
 import {
   composeDaemonSystemPrompt,
   createDaemonRunTurn,
+  createDaemonBootToolCwdResolver,
   type DaemonRuntimeOpts,
   type DaemonSessionHistory,
 } from './daemon-runtime.js';
@@ -41,7 +43,7 @@ import {
   type MultiLlmTarget,
 } from '../acp/multi-llm-bridge.js';
 import { toolSurface } from './daemon-tools/index.js';
-import { createToolCwdResolver } from './tool-cwd.js';
+import { createToolCwdResolver, type ToolCwdResolver } from './tool-cwd.js';
 import type { AcpServerOptions, AcpTurnContext } from '../acp/server.js';
 import { getGlobalPersonaRegistry } from '../persona/global-registry.js';
 import { assemblePersonaPrompt } from '../persona/prompt-assembler.js';
@@ -57,10 +59,7 @@ import { assemblePersonaPrompt } from '../persona/prompt-assembler.js';
 export function createDaemonMultiLlmRunTurn(
   history: DaemonSessionHistory,
   opts: DaemonRuntimeOpts = {},
-  toolCwdResolver = createToolCwdResolver({
-    tools: opts.tools ?? 'none',
-    ...(opts.toolCwd !== undefined ? { toolCwd: opts.toolCwd } : {}),
-  }),
+  toolCwdResolver = createDaemonBootToolCwdResolver(opts, opts.tools ?? 'none'),
 ): NonNullable<AcpServerOptions['runTurn']> {
   // Legacy single-LLM bridge (used when no multiLlm hint). Both paths share
   // one resolver so cwd validation runs once while write worktrees stay lazy.
@@ -70,6 +69,7 @@ export function createDaemonMultiLlmRunTurn(
   // sharing means each target sees the same surface but invokes its
   // own dispatchTool calls; nothing is shared across targets).
   const surface = toolSurface(opts.tools ?? 'none');
+  const turnToolCwd = new AsyncLocalStorage<ToolCwdResolver>();
 
   // Multi-LLM bridge — fans out N runCoreTurn per target.
   const multiBridge = bridgeMultiLlmCoreTurnsToAcp({
@@ -84,9 +84,10 @@ export function createDaemonMultiLlmRunTurn(
     getTools: () => surface.specs,
     dispatchTool: async (name, args, ctx) => {
       const ctrl = new AbortController();
+      const resolver = turnToolCwd.getStore() ?? toolCwdResolver;
       const dispatchCtx: import('./daemon-tools/types.js').DaemonToolDispatchCtx = {
-        cwd: toolCwdResolver.cwd!,
-        resolveWriteCwd: toolCwdResolver.resolveWriteCwd,
+        cwd: resolver.cwd!,
+        resolveWriteCwd: resolver.resolveWriteCwd,
         signal: ctrl.signal,
         // Elanous's own LLM assembles tool arguments from natural language.
         entry: 'elanous-apparatus',
@@ -120,7 +121,12 @@ export function createDaemonMultiLlmRunTurn(
       await legacyRunTurn(turnCtx);
       return;
     }
-    await multiBridge(turnCtx);
+    if (opts.acpSessionCwd) {
+      const resolver = createToolCwdResolver({ tools: opts.tools ?? 'none', toolCwd: turnCtx.cwd });
+      await turnToolCwd.run(resolver, () => multiBridge(turnCtx));
+    } else {
+      await multiBridge(turnCtx);
+    }
   };
 }
 

package/src/boot/daemon-prompt-turn.ts

@@ -209,6 +209,8 @@ export async function runDaemonPromptTurn(opts: {
             resolveWriteCwd: toolCwdResolver.resolveWriteCwd,
             signal: dispatchCtrl.signal,
             sessionId: request.sessionId,
+            ...(request.source?.kind === 'daemon-api' && request.source.route === '/a2a'
+              ? { requestOrigin: 'external-agent' as const } : {}),
             ...(request.userText ? { userText: request.userText } : {}),
             ...(opts.surface !== undefined || sourceResolution.surface !== 'unknown' ? { surface } : {}),
             ...(opts.surfaceHitlChannels ? { surfaceHitlChannels: opts.surfaceHitlChannels } : {}),

package/src/boot/daemon-runtime.ts

@@ -25,6 +25,7 @@ import {
   unlinkSync,
 } from 'node:fs';
 import { join as joinPath } from 'node:path';
+import { AsyncLocalStorage } from 'node:async_hooks';
 
 import {
   bridgeCoreTurnToAcp,
@@ -51,7 +52,7 @@ import {
 } from '../agent/terminal-surface.js';
 import type { CoreTurnDispatchTool } from '../core-turn/index.js';
 import { elanousSelfAccessPrompt } from '../agent/self-ambient.js';
-import { createToolCwdResolver } from './tool-cwd.js';
+import { createToolCwdResolver, type ToolCwdResolver } from './tool-cwd.js';
 import { debug } from '../debug/log.js';
 
 /** C4 (2026-07-12) — arm the non-detached-PTY kill ONCE per turn signal.
@@ -108,9 +109,12 @@ export interface DaemonRuntimeOpts {
    *  to override per-invocation (CLI `--tools <kind>`). */
   tools?: import('./daemon-tools/index.js').DaemonToolSurfaceKind;
   /** M1.5 A.2 — working directory for fs-bound tools (Read · Grep).
-   *  Defaults to the daemon process's `cwd()` at boot. Honoured
-   *  only when `tools !== 'none'`. */
+   *  Non-ACP defaults to the daemon process's `cwd()` at boot; ACP uses
+   *  this only as a fallback when its session supplies no cwd.
+   *  Honoured only when `tools !== 'none'`. */
   toolCwd?: string;
+  /** ACP entry only: the client supplies cwd per session, not at daemon boot. */
+  acpSessionCwd?: boolean;
   /** C4 cancel seam — injected by the boot composition layer when a
    *  runtime exposes PtyShell. Keeps this headless module free of a
    *  direct pty-shell registry import while preserving cancel→PTY kill. */
@@ -519,6 +523,23 @@ export class DaemonSessionHistory {
   }
 }
 
+export function createDaemonBootToolCwdResolver(opts: DaemonRuntimeOpts, tools: string): ToolCwdResolver {
+  if (opts.acpSessionCwd && tools !== 'none') {
+    const defaultCwd = opts.toolCwd?.trim() || process.env.ELANOUS_TOOL_CWD?.trim();
+    if (!defaultCwd) {
+      return {
+        cwd: undefined,
+        resolveWriteCwd: () => { throw new Error('Tool surface has no working directory.'); },
+      };
+    }
+    return createToolCwdResolver({ tools, toolCwd: defaultCwd });
+  }
+  return createToolCwdResolver({
+    tools,
+    ...(opts.toolCwd !== undefined ? { toolCwd: opts.toolCwd } : {}),
+  });
+}
+
 /** Build a `runTurn` handler suitable for `bootAcpServer`'s
  *  `runTurn` option. Uses the supplied history store and the tool
  *  surface chosen via `opts.tools` (default 'none' = current
@@ -526,11 +547,9 @@ export class DaemonSessionHistory {
 export function createDaemonRunTurn(
   history: DaemonSessionHistory,
   opts: DaemonRuntimeOpts = {},
-  toolCwdResolver = createToolCwdResolver({
-    tools: opts.tools ?? 'none',
-    ...(opts.toolCwd !== undefined ? { toolCwd: opts.toolCwd } : {}),
-  }),
+  toolCwdResolver = createDaemonBootToolCwdResolver(opts, opts.tools ?? 'none'),
 ): NonNullable<AcpServerOptions['runTurn']> {
+  const turnToolCwd = new AsyncLocalStorage<ToolCwdResolver>();
   // Resolve tool surface synchronously so getTools is fast on the
   // hot path. M1.5 A.2 — when 'none', behavior matches pre-A.2
   // (`getTools` returns [], dispatchTool throws); when 'readonly',
@@ -605,9 +624,10 @@ export function createDaemonRunTurn(
       // current ACP scope when the LLM omits sessionId from args.
       const turnSignal = ctx?.signal;
       if (surfaceHasPtyShell && turnSignal) wirePtyKillOnAbort(turnSignal, killNonDetachedPty!);
+      const resolver = turnToolCwd.getStore() ?? toolCwdResolver;
       const dispatchCtx: import('./daemon-tools/types.js').DaemonToolDispatchCtx = {
-        cwd: toolCwdResolver.cwd!,
-        resolveWriteCwd: toolCwdResolver.resolveWriteCwd,
+        cwd: resolver.cwd!,
+        resolveWriteCwd: resolver.resolveWriteCwd,
         signal: turnSignal ?? new AbortController().signal,
         // Elanous's own LLM assembles tool arguments from natural language.
         entry: 'elanous-apparatus',
@@ -700,7 +720,12 @@ export function createDaemonRunTurn(
         });
         debugBridge.activate();
       }
-      await inner(turnCtx);
+      if (opts.acpSessionCwd) {
+        const resolver = createToolCwdResolver({ tools: opts.tools ?? 'none', toolCwd: turnCtx.cwd });
+        await turnToolCwd.run(resolver, () => inner(turnCtx));
+      } else {
+        await inner(turnCtx);
+      }
     } finally {
       debugBridge?.dispose();
     }
@@ -774,10 +799,7 @@ export function createDaemonRuntime(
           // permissive default — the sticky-webterm workflow stays
           // intact rather than silently disabling every tool.
           : 'webterm';
-  const toolCwdResolver = createToolCwdResolver({
-    tools: validTools,
-    ...(opts.toolCwd !== undefined ? { toolCwd: opts.toolCwd } : {}),
-  });
+  const toolCwdResolver = createDaemonBootToolCwdResolver(opts, validTools);
   // S4 (2026-07-12) — 크로스서피스 파리티: nexus 부트만 갖던 R5
   // read-through(on-disk SessionStore lazy 로드)를 standalone `elanous
   // serve` 런타임에도 기본 장착 — 어느 데몬으로 열든 텔레그램/디스코드/

package/src/boot/daemon-tools/index.ts

@@ -17,6 +17,8 @@ import {
 } from '../../tool-runtime/browser-runtime.js';
 import { askUserQuestionRuntime } from '../../tool-runtime/ask-user-question-runtime.js';
 import { dispatchToolByName, listToolRuntimes } from '../../tool-runtime/registry.js';
+import { ACP_SESSION_RUNTIMES } from '../../tool-runtime/acp-session-runtime.js';
+import { ClaudeSubscriptionNotAllowedError } from '../../policy/claude-subscription-guard.js';
 import { toWireToolName } from '../../tool-runtime/mcp-wire-name.js';
 import type { ToolRuntime } from '../../tool-runtime/types.js';
 
@@ -230,6 +232,7 @@ function dispatchDaemonMcpRuntime(
   return dispatchToolByName(name, args, {
     surface: 'tui',
     signal: ctx.signal,
+    ...(ctx.requestOrigin ? { requestOrigin: ctx.requestOrigin } : {}),
     ...(ctx.sessionId ? { sessionId: ctx.sessionId } : {}),
     ...(ctx.toolCallId ? { toolCallId: ctx.toolCallId } : {}),
     ...(ctx.emitFeedback ? { emitFeedback: ctx.emitFeedback } : {}),
@@ -335,6 +338,7 @@ export function toolSurface(kind: DaemonToolSurfaceKind, cfg?: import('../../use
     //   ⭐ 재발명하지 않는다: `askUserQuestionRuntime` 이 spec ⊕ dispatch 를 한 묶음으로 «이미» 갖고 있고,
     //      ACP 브릿지 → SSE 채널 순의 사다리도 그 안에서 이미 돈다(`#16031`).
     askUserQuestionRuntime.spec,
+    ...ACP_SESSION_RUNTIMES.map((runtime) => runtime.spec),
     ...shared.specs, // L2 core + L3 finance(gated) — buildSharedAppTools 단일 출처(전 서피스 공용)
   ];
 
@@ -372,6 +376,18 @@ export function toolSurface(kind: DaemonToolSurfaceKind, cfg?: import('../../use
       }
       return dispatchDelegateAgent(args, ctx);
     }
+    const acpRuntime = ACP_SESSION_RUNTIMES.find((runtime) => runtime.spec.name === name);
+    if (acpRuntime) {
+      try {
+        return await acpRuntime.run(args, {
+          surface: 'tui',
+          ...(ctx.requestOrigin ? { requestOrigin: ctx.requestOrigin } : {}),
+        });
+      } catch (error) {
+        if (error instanceof ClaudeSubscriptionNotAllowedError) return { error: error.message };
+        throw error;
+      }
+    }
     if (shared.names.has(name)) {
       return shared.dispatch(name, args); // L2 core + L3 finance(gated) — buildSharedAppTools 단일 dispatch
     }

package/src/boot/daemon-tools/self-implement.ts

@@ -189,6 +189,7 @@ export async function dispatchSelfImplement(
   const ground = typeof args.ground === 'boolean' ? args.ground : undefined;
   const adversarialReview = typeof args.adversarialReview === 'boolean' ? args.adversarialReview : undefined;
   const autoMerge = ctx.autoMerge;
+  const autoReview = autoMerge === true ? true : undefined;
 
   // 막 — ctx 의 서피스 필드(surfaceHitlChannels/surfaceFileSink/emitFeedback)를 SurfaceUx 로.
   const ux = surfaceUxFromDispatchCtx(ctx);
@@ -204,6 +205,7 @@ export async function dispatchSelfImplement(
     entry,
     ground,
     adversarialReview,
+    autoReview,
   });
   const originalUserText = ctx.userText;
   const goalSourceText = originalUserText;
@@ -268,6 +270,7 @@ export async function dispatchSelfImplement(
     progress: ux.progress,
     ...(goalFile ? { goalFile } : {}),
     ...(autoMerge !== undefined ? { autoMerge } : {}),
+    ...(autoReview ? { autoReview } : {}),
   };
   // 승인 통로는 surface seams.approvePr 하나다. opts/pipelineDeps.approver를 보강하면
   // 중앙 심이 seams를 다시 조립해 fail-closed 승인 게이트를 우회할 수 있다.
@@ -283,6 +286,7 @@ export async function dispatchSelfImplement(
       ...(goalFile ? { goalFile } : {}),
       ...(ground !== undefined ? { ground } : {}),
       ...(autoMerge !== undefined ? { autoMerge } : {}),
+      ...(autoReview ? { autoReview } : {}),
       seams,
     })
     : await runSelfImplementViaCli(runCli, feature, cliOpts, { pipelineDeps });

package/src/boot/daemon-tools/types.ts

@@ -9,6 +9,7 @@ import type { LLMToolSpec } from '../../llm.js';
 import type { FeedbackEnvelope } from '../../feedback/envelope.js';
 import type { IngestionEntry } from '../../agent-substrate/execution/ingestion-policy.js';
 import type { SurfaceKind } from '../../agent/surface-ux/types.js';
+import type { RequestOrigin } from '../../policy/claude-subscription-guard.js';
 
 /** Activation level requested by the operator.
  *
@@ -58,6 +59,8 @@ export interface DaemonToolDispatchCtx {
    *  the args. Optional for backward compat with tests / surfaces that
    *  build the ctx by hand without a session in scope. */
   sessionId?: string;
+  /** Trusted server-side classification of the current turn, never supplied as a tool argument. */
+  requestOrigin?: RequestOrigin;
   /** Ingestion entry class. Omit for conservative external-verbatim fallback. */
   entry?: IngestionEntry;
   /** M5 PR 2 (PLAN-rich-dev-feedback-multi-surface · 2026-05-13) —

package/src/browser-cdp/chrome-flags.ts

@@ -0,0 +1,7 @@
+// A Chrome launched with a fresh --user-data-dir tries to create «Chrome Safe Storage» in the macOS
+// keychain. Headless or temporary profiles cannot, so Chrome pops «Keychain Not Found» on the human's
+// screen (09-28: dozens of popups from headless recorders and CDP clients). These two official flags
+// keep secrets in a per-profile mock store instead. Every launch that sets --user-data-dir must pass
+// them — including the visible sign-in window for a persistent profile, so later headless launches
+// can still decrypt the same profile's cookies (the key must not change between launches).
+export const CHROME_NO_KEYCHAIN_FLAGS = ['--use-mock-keychain', '--password-store=basic'] as const;

package/src/browser-cdp/client.ts

@@ -13,6 +13,7 @@
 // describes. Full Puppeteer feature parity is explicitly out of
 // scope.
 
+import { CHROME_NO_KEYCHAIN_FLAGS } from './chrome-flags.js';
 import { spawn, type ChildProcess } from 'node:child_process';
 import { existsSync, mkdtempSync, readFileSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
@@ -382,6 +383,7 @@ export async function createCdpClient(
     `--user-data-dir=${profileDir}`,
     '--no-first-run',
     '--no-default-browser-check',
+    ...CHROME_NO_KEYCHAIN_FLAGS,
     '--disable-gpu-vsync',
     // Security: lock the remote-debugging endpoint to loopback only.
     '--remote-debugging-address=127.0.0.1',