elanous 0.2.0 → 0.2.5

package/src/autopilot/pty-control-loop.ts

@@ -18,6 +18,8 @@ import { decideInterventionStep, type InterventionStep } from '../self-implement
 import type { AutopilotTermination } from './agent-loop.js';
 import type { PtyHandle } from '../pty-shell/registry.js';
 import { requestRemotePtyControl } from '../pty-shell/pty-control-ipc.js';
+import { encodeSgrMouse, detectMouseMode, mouseModeOffReason, MOUSE_MODE_OFF_REASON, MAX_PTY_KEY_REPEAT, type PtyMouseInput } from '../pty-shell/pty-mouse.js';
+import { resolvePtySpecialKey } from '../pty-shell/pty-special-keys.js';
 import type { PtyWriteActor } from '../pty-shell/pty-write-arbiter.js';
 import { debug } from '../debug/log.js';
 import { probeControlStance, reportProbeError, stanceBlocksWrite, type ControlStance } from '../pty-shell/pty-control-stance.js';
@@ -71,13 +73,20 @@ export interface ControlObservation {
   readonly subjectPtyId?: string;
   /** 이 판단이 속한 harness run. harness 밖 감독자는 생략한다. */
   readonly runId?: string;
+  /** Last structured action that could not be performed; brain sees the reason next round. */
+  readonly unavailableAction?: string;
 }
 
 /** brain 의 결정 — 입력 주입 | 완료 | 대기 | 무진행 보고. */
 export type ControlDecision =
   | { readonly action: 'input'; readonly text: string }
+  | { readonly action: 'key'; readonly name: string; readonly repeat?: number }
+  | ({ readonly action: 'mouse' } & PtyMouseInput)
+  | { readonly action: 'resize'; readonly cols: number; readonly rows: number }
   | { readonly action: 'done'; readonly reason: string }
   | { readonly action: 'wait' }
+  | { readonly action: 'handoff'; readonly to: 'codex' | 'claude' | 'elanous'; readonly mission: string; readonly carry?: 'diff' | 'summary' }
+  | { readonly action: 'ask-human'; readonly reason: string; readonly url?: string; readonly code?: string }
   /** `no-progress` reports observed lack of progress without claiming completion. */
   | { readonly action: 'no-progress'; readonly reason: string };
 
@@ -97,6 +106,10 @@ export interface PtyControlDeps {
   readonly observe: () => Promise<string> | string;
   /** 입력 주입 — arbiter-gated write('agent'). 반환 false = 거부(사람 takeover)→루프 cancelled. */
   readonly inject: (text: string) => boolean;
+  readonly injectKey?: (name: string, repeat?: number) => boolean;
+  readonly injectMouse?: (input: PtyMouseInput) => boolean;
+  readonly resize?: (cols: number, rows: number) => boolean;
+  readonly mouseModeEnabled?: () => boolean;
   /** 이 child가 PTY 입력을 실제로 소비한다는 호출자 선언. 추론 금지. */
   readonly canReceiveInput?: boolean;
   /** 이 supervisor가 제어하는 child PTY id. 호출자가 선언하며 추론하지 않는다. */
@@ -107,6 +120,10 @@ export interface PtyControlDeps {
   readonly autoAssist?: { readonly enabled: boolean; readonly minRung: number };
   /** brain의 done 선언을 ground truth로 확정한다. false면 retry를 주입하고 루프를 계속한다. */
   readonly verifyDone?: (obs: ControlObservation) => VerifyDoneResult | Promise<VerifyDoneResult>;
+  /** Mission-only handoff; absent in generic PTY callers. A successful handoff ends this child loop. */
+  readonly handoff?: (decision: Extract<ControlDecision, { action: 'handoff' }>, obs: ControlObservation) => Promise<void>;
+  /** Notify and wait without killing the child PTY. */
+  readonly askHuman?: (decision: Extract<ControlDecision, { action: 'ask-human' }>, obs: ControlObservation) => Promise<void>;
   /** ⭐매 스텝 소유권 확인 — false = agent 가 write 제어 상실(사람 takeover). `wait` 중에도 감지해
    *  즉시 yield(review: takeover 를 input 시에만 보면 wait 중 놓침). 기본 항상 true.
    *  ⚠️ **boolean 은 {상실}∪{확인 불가} 를 뭉친다** — 실 PTY 배선은 아래 `controlStance` 를 쓴다.
@@ -151,6 +168,7 @@ export interface PtyControlOpts {
 export interface PtyControlResult {
   readonly termination: AutopilotTermination;
   readonly steps: number;
+  readonly handoff?: Extract<ControlDecision, { action: 'handoff' }>;
 }
 
 // eslint-disable-next-line no-control-regex
@@ -354,6 +372,8 @@ export async function runPtyControlLoop(
   let previousIntervention: InterventionStep | null = null;
   let frameObs: FrameObservationState = INITIAL_FRAME_OBSERVATION;
   let step = 0;
+  let unavailableAction: string | undefined;
+  const mouseMode = detectMouseMode('');
   // ⚠️ 재개는 `continue` 로 같은 스텝을 다시 하므로 **스텝 예산을 소비하지 않는다**(그게
   //   *"재개한 스텝은 재관측·재결정한다"* 의 뜻이다). 그러면 소유권이 `lost ↔ owned` 로
   //   플래핑할 때 루프가 `maxSteps` 를 영구 우회해 **무한**이 된다 — 대기 자체는 유한한데
@@ -401,6 +421,7 @@ export async function runPtyControlLoop(
       // 전 스텝 try 가 잡아 error termination 으로 수렴(observe 실패와 동일 정책).
       if (deps.settle) await deps.settle();
       const screen = await deps.observe();
+      mouseMode.feed(screen);
       const norm = normalizeScreen(screen);
       const changed = prevNorm !== null && norm !== prevNorm;
       const state = classify(screen);
@@ -427,6 +448,7 @@ export async function runPtyControlLoop(
         stallRung: frameObs.stallRung,
         ...(deps.subjectPtyId ? { subjectPtyId: deps.subjectPtyId } : {}),
         ...(runId ? { runId } : {}),
+        ...(unavailableAction ? { unavailableAction } : {}),
       };
 
       // ⭐안전계약(review): decide()(LLM 호출)가 오래 걸려도 그동안 사람이 takeover 하면 **≤250ms 내** 감지
@@ -501,6 +523,7 @@ export async function runPtyControlLoop(
         return finish({ kind: 'cancelled' }, step);
       }
       const decision = outcome.decision;
+      unavailableAction = undefined;
       // ⭐결정 직후 소유권 재검사(review) — decide 가 250ms watcher 틱 前에 완료되면 그 사이 takeover 를
       // 놓쳐 done 을 success 로 확정할 수 있다. 여기서 재검사해 상실이면 결정 무시하고 cancelled.
       const postStance = controlStance();
@@ -561,7 +584,30 @@ export async function runPtyControlLoop(
       });
       await deps.onStep?.(obs, decision);
 
-      if (decision.action === 'done') {
+      if (decision.action === 'handoff') {
+        if (!deps.handoff) {
+          unavailableAction = 'handoff: unavailable';
+          debug.log('autopilot.control', 'action-unavailable', { step, action: decision.action });
+        } else {
+          await deps.handoff(decision, obs);
+          debug.log('autopilot.control', 'handoff', { step, to: decision.to });
+          return { ...finish({ kind: 'success', reason: `handoff:${decision.to}` }, step), handoff: decision };
+        }
+      } else if (decision.action === 'ask-human') {
+        if (!deps.askHuman) {
+          unavailableAction = 'ask-human: unavailable';
+          debug.log('autopilot.control', 'action-unavailable', { step, action: decision.action });
+        } else {
+          await deps.askHuman(decision, obs);
+          if (deps.isAlive?.() === false) return finish({ kind: 'stuck', iteration: step, reason: 'login PTY exited' }, step);
+          prevNorm = null;
+          previousIntervention = null;
+          frameObs = INITIAL_FRAME_OBSERVATION;
+          await sleep(pollMs);
+          step += 1;
+          continue;
+        }
+      } else if (decision.action === 'done') {
         const verification = deps.verifyDone ? await deps.verifyDone(obs) : { ok: true as const };
         debug.log('autopilot.control', 'verify-done', { ok: verification.ok });
         if (verification.ok) {
@@ -600,6 +646,23 @@ export async function runPtyControlLoop(
           }
           previousIntervention = { ...intervention, sameScreenCount: 1 };
         }
+      } else if (decision.action === 'key' || decision.action === 'mouse' || decision.action === 'resize') {
+        const refusal = decision.action === 'key' ? !deps.injectKey ? 'injectKey unavailable' : undefined
+          : decision.action === 'mouse' ? !deps.injectMouse ? 'injectMouse unavailable' : !(deps.mouseModeEnabled?.() ?? mouseMode.enabled) ? MOUSE_MODE_OFF_REASON : undefined
+          : !deps.resize ? 'resize unavailable' : undefined;
+        if (refusal) {
+          unavailableAction = `${decision.action}: ${refusal}`;
+          debug.log('autopilot.control', 'action-unavailable', { step, action: decision.action, reason: refusal });
+        } else {
+          const applied = decision.action === 'key' ? deps.injectKey!(decision.name, decision.repeat)
+            : decision.action === 'mouse' ? deps.injectMouse!(decision)
+            : deps.resize!(decision.cols, decision.rows);
+          if (!applied) {
+            debug.log('autopilot.control', 'yield', { step, reason: `arbiter denied ${decision.action} — 사람 takeover` });
+            return finish({ kind: 'cancelled' }, step);
+          }
+          previousIntervention = { ...intervention, sameScreenCount: 1 };
+        }
       } else if (decision.action === 'wait' || decision.action === 'no-progress') {
         // wait/no-progress — 종료된 자식은 새 출력을 낼 수 없으므로 대기 없이 즉시 수렴한다.
         if (deps.isAlive?.() === false) {
@@ -664,8 +727,37 @@ export function controlDepsForRemoteRef(id: string, opts: {
   };
 }
 
-export function controlDepsForHandle(handle: PtyHandle): Pick<PtyControlDeps, 'observe' | 'inject' | 'controlStance' | 'isAlive'> {
+export function controlDepsForHandle(handle: PtyHandle): Pick<PtyControlDeps, 'observe' | 'inject' | 'injectKey' | 'injectMouse' | 'resize' | 'mouseModeEnabled' | 'controlStance' | 'isAlive' | 'subjectPtyId'> {
+  const injectAgent = (chars: string): boolean => {
+    const stance = probeControlStance(handle, 'agent', (e) =>
+      debug.log('autopilot.control', 'hascontrol-error', { ptyId: handle.id, at: 'inject-key', error: (e as Error)?.message ?? String(e) }));
+    if (stanceBlocksWrite(stance)) return false;
+    handle.write(chars, 'agent');
+    return true;
+  };
   return {
+    subjectPtyId: handle.id,
+    mouseModeEnabled: () => !mouseModeOffReason(handle),
+    injectKey: (name, repeat = 1) => {
+      if (!Number.isSafeInteger(repeat) || repeat < 1 || repeat > MAX_PTY_KEY_REPEAT) throw new Error(`key repeat must be between 1 and ${MAX_PTY_KEY_REPEAT}`);
+      return injectAgent(resolvePtySpecialKey(name).repeat(repeat));
+    },
+    injectMouse: (input) => {
+      // Check ownership before reporting mode: a human takeover must never be
+      // mistaken for a recoverable "mouse unavailable" decision.
+      if (stanceBlocksWrite(probeControlStance(handle, 'agent', (e) =>
+        debug.log('autopilot.control', 'hascontrol-error', { ptyId: handle.id, at: 'inject-mouse', error: (e as Error)?.message ?? String(e) })))) return false;
+      const off = mouseModeOffReason(handle);
+      if (off) throw new Error(off);
+      return injectAgent(encodeSgrMouse(input));
+    },
+    resize: (cols, rows) => {
+      if (!Number.isSafeInteger(cols) || cols < 1 || !Number.isSafeInteger(rows) || rows < 1) throw new Error('invalid PTY size');
+      if (stanceBlocksWrite(probeControlStance(handle, 'agent', (e) =>
+        debug.log('autopilot.control', 'hascontrol-error', { ptyId: handle.id, at: 'resize', error: (e as Error)?.message ?? String(e) })))) return false;
+      handle.resize(cols, rows);
+      return true;
+    },
     observe: () => handle.renderScreen(),
     // ⭐공용 seam 경유(P2b P-a′) — `canWrite` 직접 호출 금지. 여기와 driver·headless 가 같은 판정을 본다.
     //   ⚠️boolean 으로 접지 않는다 — 루프가 `unknown` 을 그대로 봐야 상실과 갈린다.

package/src/autopilot/track-agent.ts

@@ -0,0 +1,138 @@
+import { execFile, spawn } from 'node:child_process';
+import { readdirSync, readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { promisify } from 'node:util';
+import { debug, redactSecretText } from '../debug/log.js';
+import { getOrCreatePersonaSession } from '../session/index.js';
+import { getUserConfig } from '../user-config.js';
+import { decideBudget, readBudgetInputsLive } from '../self-implement/budget-gate.js';
+import { loadTrackRegistry } from './mission-phase-track.js';
+import { effectiveInstanceRoot } from '../instance/resolve.js';
+
+export type TrackAgentInput = { missionId: string; taskId: string; title: string; prompt: string; track: string };
+export type TrackAgentDecision = { action: 'say' | 'hold'; reason?: string };
+export type TrackAgentResult = { status: 'launched' | 'held' | 'failed'; detail?: string };
+export type TrackAgentRunner = {
+  decideTrackAction: (input: TrackAgentInput) => Promise<TrackAgentDecision> | TrackAgentDecision;
+  executeTrackAction: (decision: TrackAgentDecision, input: TrackAgentInput) => Promise<TrackAgentResult> | TrackAgentResult;
+};
+
+type RunnerDeps = {
+  run?: (args: string[]) => Promise<{ stdout: string }>;
+  /** Resolves once the child is spawned; `exited` settles when that run ends (the concurrency slot is held until then). */
+  launch?: (args: string[]) => Promise<void | { exited?: Promise<unknown> }>;
+  checkBudget?: () => Promise<boolean>;
+  session?: (persona: string) => string;
+  root?: string;
+  maxConcurrent?: number;
+};
+const root = resolve(import.meta.dir, '../..');
+// The installed package is not a git checkout — the daemon's target repository comes first.
+const repoDir = (): string => process.env.ELANOUS_TOOL_CWD?.trim() || root;
+const exec = promisify(execFile);
+const log = (event: string, data: Record<string, unknown>) => {
+  try { debug.log('autopilot.track-agent', event, data); } catch { /* observation is fail-soft */ }
+};
+/** The daemon's own universe, resolved once and pinned on the child (config ⊕ state) — the harness isolates its own workers. */
+export function universeLaunch(args: readonly string[], root: string = effectiveInstanceRoot()): { argv: string[]; env: NodeJS.ProcessEnv } {
+  return { argv: ['bin/elanous.mjs', '--config-dir', root, ...args], env: { ...process.env, ELANOUS_STATE_DIR: root } };
+}
+const runCli = async (args: string[]): Promise<{ stdout: string }> => {
+  const { argv, env } = universeLaunch(args);
+  return exec('bun', argv, { cwd: repoDir(), env, timeout: 120_000, maxBuffer: 1024 * 1024, encoding: 'utf8' });
+};
+const forbidden = /\b(?:delete|remove|deploy|publish|release|restart|reboot|merge|force|pay|purchase|secret|credential|sudo|rm\s+-rf|config\s+set)\b|(?:^|\s)--prod\b|삭제|배포|게시|릴리스|재시작|재부팅|병합|결제|자격|비밀|강제/i;
+let running = 0;
+
+function context(input: TrackAgentInput, repo: string): string {
+  const track = loadTrackRegistry().find(({ id }) => id === input.track);
+  if (!track) throw new Error('unknown track');
+  const docs = resolve(repo, 'docs');
+  let handoff = '';
+  let decisionTable = '';
+  try { decisionTable = readFileSync(resolve(repo, 'CLAUDE.md'), 'utf8').slice(0, 8_000); }
+  catch { decisionTable = '(없음)'; }
+  try {
+    const latest = readdirSync(docs)
+      .filter((name) => name.startsWith(`HANDOFF-${input.track}-`) && name.endsWith('.md'))
+      .sort().at(-1);
+    if (latest) handoff = `${latest}\n${readFileSync(resolve(docs, latest), 'utf8').slice(0, 12_000)}`;
+  } catch { /* missing handoff is explicitly marked in the prompt */ }
+  return [
+    `트랙 ${input.track} 소유: ${track.owns.join(', ')}`,
+    `최근 인계 문서: ${handoff || '(없음)'}`,
+    `CLAUDE.md 진입·결정표: ${decisionTable}`,
+    `미션 ${input.missionId} · 페이즈 ${input.taskId} · ${input.title}`,
+    input.prompt,
+    '도구를 호출하지 마라. 허용 판정: say 또는 hold. 금지: 운영 설정/원장 쓰기, 재시작, 배포, 삭제, 강제 브랜치, 결제, 타인 PR 병합.',
+    'JSON 객체 하나만 답하라: {"action":"say"|"hold","reason":"판정 이유"}.',
+  ].join('\n\n');
+}
+
+export async function decideTrackAction(input: TrackAgentInput, deps: RunnerDeps = {}): Promise<TrackAgentDecision> {
+  try {
+    const prompt = context(input, deps.root ?? repoDir());
+    const persona = `track-${input.track}`;
+    const session = deps.session?.(persona) ?? getOrCreatePersonaSession(persona).id;
+    const { stdout } = await (deps.run ?? runCli)(['agent', '--session', session, '--json', '--no-tools', prompt]);
+    const envelope: unknown = JSON.parse(stdout.trim());
+    if (!envelope || typeof envelope !== 'object' || typeof (envelope as { reply?: unknown }).reply !== 'string') throw new Error('invalid agent response');
+    const reply = (envelope as { reply: string }).reply.trim();
+    const decision: unknown = JSON.parse(reply);
+    if (!decision || typeof decision !== 'object' || Array.isArray(decision)) throw new Error('invalid decision');
+    const values = decision as Record<string, unknown>;
+    if (!['say', 'hold'].includes(String(values.action)) || (values.reason !== undefined && typeof values.reason !== 'string')
+      || Object.keys(values).some((key) => !['action', 'reason'].includes(key))) throw new Error('invalid decision');
+    if (typeof values.reason === 'string' && forbidden.test(values.reason)) throw new Error('forbidden action');
+    return decision as TrackAgentDecision;
+  } catch (error) {
+    log('decision-failed', { track: input.track, taskId: input.taskId, error: redactSecretText(String(error)) });
+    return { action: 'hold', reason: '판정 실패 — 사람 확인' };
+  }
+}
+
+export async function executeTrackAction(decision: TrackAgentDecision, input: TrackAgentInput, deps: RunnerDeps = {}): Promise<TrackAgentResult> {
+  if (decision.action !== 'say') return { status: 'held', detail: decision.reason ?? '사람 확인' };
+  if (forbidden.test(`${input.title}\n${input.prompt}`)) return { status: 'held', detail: '금지 작업 — 사람 확인' };
+  if (!loadTrackRegistry().some(({ id }) => id === input.track)) return { status: 'held', detail: '트랙 미정 — 사람 확인' };
+  try {
+    const checkBudget = deps.checkBudget ?? (async () => {
+      const action = decideBudget(await readBudgetInputsLive()).action;
+      return action === 'proceed' || action === 'next-provider';
+    });
+    const allowed = await checkBudget();
+    if (!allowed) return { status: 'held', detail: '예산 관문' };
+  } catch (error) {
+    log('budget-failed', { track: input.track, taskId: input.taskId, error: redactSecretText(String(error)) });
+    return { status: 'held', detail: '예산 관문 측정 실패' };
+  }
+  const configured = deps.maxConcurrent ?? getUserConfig().autopilot?.trackAgent?.maxConcurrent ?? 2;
+  const limit = Number.isSafeInteger(configured) && configured > 0 ? Math.min(2, configured) : 2;
+  if (running >= limit) return { status: 'held', detail: '동시 실행 상한' };
+  running++;
+  let held = false;
+  try {
+    const launch = deps.launch ?? (async (args: string[]) => {
+      const { argv, env } = universeLaunch(args);
+      const child = spawn('bun', argv, { cwd: repoDir(), env, stdio: 'ignore', detached: true });
+      const exited = new Promise<void>((done) => { child.once('exit', () => done()); child.once('error', () => done()); });
+      await new Promise<void>((resolve, reject) => {
+        child.once('spawn', () => { child.unref(); resolve(); });
+        child.once('error', reject);
+      });
+      return { exited };
+    });
+    const handle = await launch(['harness', 'say', '--no-auto-merge', `${input.title}\n${input.prompt}`]);
+    if (handle && handle.exited) {
+      held = true;
+      void handle.exited.finally(() => { running--; log('run-exited', { track: input.track, taskId: input.taskId, running }); });
+    }
+    log('launched', { track: input.track, taskId: input.taskId, running });
+    return { status: 'launched', detail: 'detached harness say' };
+  } catch (error) {
+    log('launch-failed', { track: input.track, taskId: input.taskId, error: redactSecretText(String(error)) });
+    return { status: 'failed', detail: '하니스 발사 실패' };
+  } finally {
+    if (!held) running--;
+  }
+}

package/src/autopilot/track-courier.ts

@@ -0,0 +1,153 @@
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { debug, redactSecretText } from '../debug/log.js';
+import { TaskStore } from '../task-orchestrator/store.js';
+import { getUserConfig, type UserConfig } from '../user-config.js';
+import { inferPhaseTrack, loadTrackRegistry } from './mission-phase-track.js';
+import type { TrackAgentInput, TrackAgentRunner } from './track-agent.js';
+
+type CourierConfig = NonNullable<NonNullable<UserConfig['autopilot']>['trackCourier']>;
+type Comment = { body: string; created_at: string };
+const errorMessage = (error: unknown): string => redactSecretText(error instanceof Error ? error.message : String(error));
+export type TrackAlive = { alive: boolean; lastPostAt: string | null; reason: 'recent-post' | 'stale' | 'no-post' | 'unmeasured' };
+export type PhaseRoute = { taskId: string; title: string; prompt: string; track: string | null; route: 'human' | 'agent' | 'unassigned'; reason: string };
+export type CourierDeps = {
+  store?: TaskStore;
+  config?: CourierConfig;
+  now?: number;
+  listComments?: () => Promise<Comment[]> | Comment[];
+  post?: (body: string) => Promise<void> | void;
+  trackAgent?: { enabled: boolean };
+  agentRunner?: TrackAgentRunner;
+};
+
+const repoRoot = resolve(import.meta.dir, '../..');
+const execFileAsync = promisify(execFile);
+const log = (event: string, data: Record<string, unknown>) => {
+  try { debug.log('autopilot.track-courier', event, data); } catch { /* observation is fail-soft */ }
+};
+const configFor = (deps: CourierDeps): CourierConfig => deps.config ?? getUserConfig().autopilot?.trackCourier ?? {};
+const minutesFor = (config: CourierConfig): number =>
+  typeof config.handoffMinutes === 'number' && Number.isFinite(config.handoffMinutes) && config.handoffMinutes > 0 ? config.handoffMinutes : 60;
+
+async function defaultComments(channelPr: number, now: number, handoffMinutes: number): Promise<Comment[]> {
+  const since = new Date(now - Math.max(120, handoffMinutes) * 60_000).toISOString();
+  const repo = process.env.CH_REPO || 'ElanvitalAI/elanous';
+  const { stdout } = await execFileAsync('gh', ['api', '--paginate', '--slurp',
+    `repos/${repo}/issues/${channelPr}/comments?since=${encodeURIComponent(since)}`],
+  { cwd: repoRoot, encoding: 'utf8', timeout: 20_000, maxBuffer: 8 * 1024 * 1024 });
+  const parsed: unknown = JSON.parse(stdout);
+  if (!Array.isArray(parsed) || !parsed.every(Array.isArray)) throw new Error('comments response is not paged arrays');
+  return parsed.flat() as Comment[];
+}
+
+async function defaultPost(body: string, channelPr: number): Promise<void> {
+  const dir = mkdtempSync(join(tmpdir(), 'track-courier-'));
+  try {
+    const file = join(dir, 'body.md');
+    writeFileSync(file, body);
+    await execFileAsync('bash', [join(repoRoot, 'scripts/coord-post.sh'), file], {
+      cwd: repoRoot, env: { ...process.env, CH_PR: String(channelPr), COORD_ID: 'E' }, timeout: 20_000,
+    });
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+/** The absence of a successful observation is never evidence of an absent human. */
+export async function trackAlive(track: string, deps: CourierDeps = {}): Promise<TrackAlive> {
+  const now = deps.now ?? Date.now();
+  const config = configFor(deps);
+  try {
+    if (!deps.listComments && !config.channelPr) return { alive: true, lastPostAt: null, reason: 'unmeasured' };
+    const comments = await (deps.listComments ?? (() => defaultComments(config.channelPr!, now, minutesFor(config))))();
+    if (!Array.isArray(comments)) throw new Error('comments response is not an array');
+    const timestamps = comments
+      .filter((c) => c && typeof c.body === 'string' && c.body.startsWith(`**[${track}]**`))
+      .map((c) => Date.parse(c.created_at))
+      .filter((at) => Number.isFinite(at) && at <= now);
+    if (!timestamps.length) return { alive: false, lastPostAt: null, reason: 'no-post' };
+    const latest = Math.max(...timestamps);
+    return { alive: now - latest <= minutesFor(config) * 60_000, lastPostAt: new Date(latest).toISOString(),
+      reason: now - latest <= minutesFor(config) * 60_000 ? 'recent-post' : 'stale' };
+  } catch {
+    return { alive: true, lastPostAt: null, reason: 'unmeasured' };
+  }
+}
+
+export async function routeMissionPhases(missionId: string, deps: CourierDeps = {}): Promise<PhaseRoute[]> {
+  const store = deps.store ?? new TaskStore();
+  let phases: Array<{ id: string; title: string; prompt: string }>;
+  try {
+    phases = store.listTasks({ goalSlug: missionId })
+      .filter((task) => task.surface.kind === 'subagent')
+      .map((task) => ({ id: task.id, title: task.title, prompt: task.surface.kind === 'subagent' ? task.surface.prompt : '' }));
+  } finally { if (!deps.store) store.close(); }
+  const registry = loadTrackRegistry();
+  const inferred = phases.map((phase) => ({ phase, match: inferPhaseTrack(`${phase.title}\n${phase.prompt}`, registry) }));
+  const tracks = [...new Set(inferred.map(({ match }) => match.track).filter((track): track is string => track !== null))];
+  const alive = new Map(await Promise.all(tracks.map(async (track) => [track, await trackAlive(track, deps)] as const)));
+  const routes: PhaseRoute[] = inferred.map(({ phase, match }) => {
+    if (!match.track) return { taskId: phase.id, title: phase.title, prompt: phase.prompt, track: null, route: 'unassigned', reason: match.reason };
+    const state = alive.get(match.track)!;
+    return { taskId: phase.id, title: phase.title, prompt: phase.prompt, track: match.track,
+      route: state.alive ? 'human' : 'agent', reason: state.reason === 'recent-post' || state.reason === 'stale'
+        ? `${Math.floor(((deps.now ?? Date.now()) - Date.parse(state.lastPostAt!)) / 60_000)}분 ${state.reason === 'recent-post' ? '전 발신' : '무발신'}`
+        : state.reason === 'no-post' ? '최근 2시간 무발신' : 'unmeasured' };
+  });
+  log('routed', { missionId, phases: routes.map(({ taskId, track, route, reason }) => ({ taskId, track, route, reason })) });
+  return routes;
+}
+
+async function deliverTrackAgentResult(missionId: string, route: PhaseRoute & { track: string }, channelPr: number, deps: CourierDeps): Promise<void> {
+  try {
+    const runner: TrackAgentRunner = deps.agentRunner ?? await import('./track-agent.js');
+    const input: TrackAgentInput = { missionId, taskId: route.taskId, title: route.title, prompt: route.prompt, track: route.track };
+    const decision = await runner.decideTrackAction(input);
+    const result = await runner.executeTrackAction(decision, input);
+    const status = redactSecretText(result.status).replace(/\s+/g, ' ').trim();
+    const detail = result.detail && redactSecretText(result.detail).replace(/\s+/g, ' ').trim();
+    const body = `**[E]** {{TS}} ${route.track} · ${route.taskId} · ${status}${detail ? ` · ${detail}` : ''}`;
+    try {
+      await (deps.post ?? ((text) => defaultPost(text, channelPr)))(body);
+      log('agent-result-posted', { missionId, taskId: route.taskId, track: route.track, status });
+    } catch (error) {
+      log('agent-result-post-failed', { missionId, taskId: route.taskId, track: route.track,
+        error: errorMessage(error) });
+    }
+  } catch (error) {
+    log('agent-failed', { missionId, taskId: route.taskId, track: route.track,
+      error: errorMessage(error) });
+  }
+}
+
+export async function deliverMissionPhases(missionId: string, deps: CourierDeps = {}): Promise<void> {
+  const config = configFor(deps);
+  if (config.enabled !== true) return;
+  if (!config.channelPr) { log('post-skipped', { missionId, reason: 'channelPr 미설정' }); return; }
+  try {
+    const routes = await routeMissionPhases(missionId, { ...deps, config });
+    const marks = new Map(loadTrackRegistry().map(({ id, mark }) => [id, mark]));
+    const body = [
+      `**[E]** {{TS}} 🧭 미션 ${missionId} 승인됨 — 페이즈 배달`,
+      ...routes.map(({ taskId, title, track, route, reason }) =>
+        `→ ${marks.get(track ?? 'S') ?? '🅢'} ${title.replace(/\s+/g, ' ').trim()} · ${route}(${route === 'unassigned' ? '트랙 미정' : reason}${route === 'agent' ? ' · 트랙 에이전트 대기 — R5' : ''}) · ${taskId}`),
+      '집으면 이 코멘트에 `[<트랙>] 집음 <taskId>` 로 답',
+    ].join('\n');
+    await (deps.post ?? ((text) => defaultPost(text, config.channelPr!)))(body);
+    log('posted', { missionId, channelPr: config.channelPr, phases: routes.length });
+    if ((deps.trackAgent ?? getUserConfig().autopilot?.trackAgent)?.enabled === true) {
+      for (const route of routes) {
+        if (route.route !== 'agent' || !route.track) continue;
+        const agentRoute = { ...route, track: route.track };
+        const channelPr = config.channelPr;
+        setImmediate(() => { void deliverTrackAgentResult(missionId, agentRoute, channelPr, deps); });
+      }
+    }
+  } catch (error) {
+    log('post-failed', { missionId, error: error instanceof Error ? error.message : String(error) });
+  }
+}

package/src/boot/acp-server.ts

@@ -11,6 +11,7 @@
 //   --socket-path=<path>                       unix-socket only
 //   --port=<n>                                 websocket only
 //   --host=<host>                              websocket only
+//   --tool-cwd=<path>                          overrides ELANOUS_TOOL_CWD
 //   --no-auth                                  websocket: skip token
 //
 // The boot wraps `runAcpServer` with a SIGINT/SIGTERM-aware shutdown
@@ -23,18 +24,19 @@
 // no dashboard, no tui-client — verified by the expanded guard
 // test.
 
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { mkdirSync } from 'node:fs';
 import { getElanousConfigDir } from '../elanous-config-dir.js';
 import { dirname, join as joinPath } from 'node:path';
+import { ensureAuthToken } from '../auth/acp-token.js';
 
 import {
   listenUnixSocket,
   listenWebSocket,
-  generateAuthToken,
   createAuthVerifier,
 } from '../acp/transport/index.js';
 import { runAcpServer, type AcpServerOptions } from '../acp/server.js';
 import type { LlmBrand } from '../llm-vision-capability.js';
+import { DEFAULT_NEXUS_HTTP_PORT } from '../nexus/default-port.js';
 
 export type AcpBootTransport = 'stdio' | 'unix-socket' | 'websocket';
 
@@ -50,6 +52,8 @@ export interface AcpBootOptions {
    *  other pre-auth'd private transports). Default `false` →
    *  token check ON. */
   noAuth?: boolean;
+  /** Optional ACP tool cwd fallback; overrides ELANOUS_TOOL_CWD when set. */
+  toolCwd?: string;
 }
 
 /** Default socket path — XDG-ish; `~/.elanous/elanous.sock`. */
@@ -58,7 +62,7 @@ export function defaultUnixSocketPath(): string {
 }
 
 /** Default websocket bind port. Mnemonic: π × 10⁴. */
-export const DEFAULT_WEBSOCKET_PORT = 31415;
+export const DEFAULT_WEBSOCKET_PORT = DEFAULT_NEXUS_HTTP_PORT;
 
 /** Parse --flag / --flag=value / --flag value out of argv. Returns
  *  the value string or undefined. Exported for tests; the boot
@@ -101,23 +105,11 @@ export function parseAcpBootArgs(argv: readonly string[]): AcpBootOptions {
   const host = readFlagValue(argv, '--host');
   if (host) opts.host = host;
   if (argv.includes('--no-auth')) opts.noAuth = true;
+  const toolCwd = readFlagValue(argv, '--tool-cwd');
+  if (toolCwd !== undefined) opts.toolCwd = toolCwd;
   return opts;
 }
 
-/** Load or mint a persistent auth token for websocket boot. Stored
- *  at `~/.elanous/acp-token` with 0600 perms so the socket-holding
- *  user can bind-mount it into a parent client config. */
-function ensureAuthToken(): { token: string; path: string } {
-  const tokenPath = joinPath(getElanousConfigDir(), 'acp-token');
-  mkdirSync(dirname(tokenPath), { recursive: true });
-  if (existsSync(tokenPath)) {
-    return { token: readFileSync(tokenPath, 'utf-8').trim(), path: tokenPath };
-  }
-  const token = generateAuthToken();
-  writeFileSync(tokenPath, token, { mode: 0o600 });
-  return { token, path: tokenPath };
-}
-
 /** Resolved daemon-runtime status surfaced in the startup banner.
  *  Matches the shape returned by `createDaemonRuntime()` so callers
  *  can spread it directly. Lets every transport (stdio / unix-socket
@@ -131,7 +123,7 @@ export interface BootRuntimeStatus {
   /** Active tool surface kind ('none' | 'readonly'). When omitted or
    *  'none', the banner says so + hints at ELANOUS_TOOLS=readonly. */
   tools?: string;
-  /** Resolved tool cwd when tools !== 'none'. */
+  /** Optional boot cwd fallback; session cwd takes precedence. */
   toolCwd?: string;
 }
 
@@ -226,6 +218,11 @@ export async function bootAcpServer(
   const runTurn = deps.runTurn;
   const hasSession = deps.hasSession;
   const runtimeStatus = deps.runtimeStatus;
+  const bootToolCwd = runtimeStatus?.toolCwd || opts.toolCwd?.trim() || process.env.ELANOUS_TOOL_CWD?.trim();
+  const cwdPolicy = {
+    requireSessionToolCwd: true,
+    ...(bootToolCwd ? { bootToolCwd } : {}),
+  };
   const declarationIdentity = {
     ...(deps.agentBrand !== undefined ? { agentBrand: deps.agentBrand } : {}),
     ...(deps.agentModel !== undefined ? { agentModel: deps.agentModel } : {}),
@@ -260,6 +257,7 @@ export async function bootAcpServer(
         shutdownSignal: ownSignal,
         ...(runTurn ? { runTurn } : {}),
         ...(hasSession ? { hasSession } : {}),
+        ...cwdPolicy,
         ...declarationIdentity,
       });
       return;
@@ -276,6 +274,7 @@ export async function bootAcpServer(
         shutdownSignal: ownSignal,
         ...(runTurn ? { runTurn } : {}),
         ...(hasSession ? { hasSession } : {}),
+        ...cwdPolicy,
         ...declarationIdentity,
       });
       return;
@@ -308,6 +307,7 @@ export async function bootAcpServer(
       shutdownSignal: ownSignal,
       ...(runTurn ? { runTurn } : {}),
       ...(hasSession ? { hasSession } : {}),
+      ...cwdPolicy,
       ...declarationIdentity,
     });
   } finally {

package/src/boot/check-same-origin.ts

@@ -28,10 +28,11 @@
 // kept passing on tier 1 — the regression was Tailscale-only.
 
 /**
- * Trust only local clients and the Tailscale CGNAT allocation for the
- * header-based bypass. We deliberately do not invoke `tailscale whois` per
- * request: authentication must remain available without the CLI/runtime and
- * must not turn an external process into the hot-path availability boundary.
+ * Trust only a connection made on this machine itself (loopback) for the
+ * header-based bypass. 2026-09-27 (RFC `내부 문서 `RFC-pwa-auth-without-header-trust-2026-09-27``
+ * · 대표 A · 🅢 A′): the Tailscale CGNAT range (100.64/10) is no longer trusted —
+ * `Sec-Fetch-Site`/`Origin`/`Referer`/`Host` are freely set by any non-browser
+ * client, and the tailnet includes the bot VM that takes public webhooks.
  * An absent peer is untrusted, so unknown connections must present a bearer.
  */
 export function isTrustedSameOriginPeer(peerAddress: string | undefined): boolean {
@@ -42,11 +43,24 @@ export function isTrustedSameOriginPeer(peerAddress: string | undefined): boolea
   if (octets.length !== 4 || octets.some((octet) => !Number.isInteger(octet) || octet < 0 || octet > 255)) {
     return false;
   }
-  return octets[0] === 127 || (octets[0] === 100 && octets[1] >= 64 && octets[1] <= 127);
+  return octets[0] === 127;
+}
+
+/** Headers a reverse proxy adds. `tailscale serve` reaches NEXUS over loopback but
+ *  always attaches `X-Forwarded-For` and `Tailscale-*`; a client cannot make them
+ *  disappear (it passes `Host` through untouched, so `Host` proves nothing — 🅢 실측 2026-09-27). */
+export function hasProxyMarker(req: Request): boolean {
+  for (const name of ['x-forwarded-for', 'forwarded', 'x-real-ip', 'x-forwarded-host']) {
+    if (req.headers.has(name)) return true;
+  }
+  for (const [name] of req.headers) if (name.toLowerCase().startsWith('tailscale-')) return true;
+  return false;
 }
 
 export function isSameOriginRequest(req: Request, peerAddress?: string): boolean {
   if (!isTrustedSameOriginPeer(peerAddress)) return false;
+  // Loopback via a proxy (tailscale serve · local relay) is someone else's request.
+  if (hasProxyMarker(req)) return false;
   const sfs = req.headers.get('sec-fetch-site');
   if (sfs === 'same-origin') return true;
   if (sfs && sfs !== 'none') return false;