elanous 0.2.10 → 0.2.12

package/src/nexus/api/inside-events.ts

@@ -0,0 +1,226 @@
+import { randomUUID } from 'node:crypto';
+import { appendFileSync, existsSync, mkdirSync, openSync, closeSync, readSync, readFileSync, statSync, unlinkSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { StringDecoder } from 'node:string_decoder';
+import { debug } from '../../debug/log.js';
+import { nexusRootDir } from '../paths.js';
+import { SSE_HEARTBEAT_MS } from './sse-heartbeat.js';
+
+/** The node envelope matches apps/pwa/src/lib/inside-events.ts without importing browser code. */
+export interface InsideNodeEvent {
+  kind: 'node';
+  graphId: string;
+  runId: string;
+  nodeId: string;
+  phase: 'start' | 'ok' | 'fail';
+  ts: string;
+  seconds?: number;
+}
+
+/** Other producers can add their own domain fields without changing the transport. */
+export type InsideLiveEvent = InsideNodeEvent | ({ kind: string; ts: string } & Record<string, unknown>);
+export type InsideEventInput = { kind: string; ts?: string } & Record<string, unknown>;
+
+export const INSIDE_EVENTS_PATH = '/v1/inside/events';
+const MAX_PENDING_FRAMES = 16;
+const MAX_FRAME_BYTES = 64 * 1024;
+const MASK = '[REDACTED]';
+const SECRET_KEY = /(?:secret|password|passwd|token|api[_-]?key|authorization|credential|private[_-]?key|cookie|session[_-]?key)/i;
+const INLINE_SECRET = /\b((?:Bearer|Basic)\s+|(?:sk|ghp|gho|ghu|ghs|ghr|github_pat|glpat|xox[baprs])[-_])[^\s"'`,;]+/gi;
+const ASSIGNMENT_SECRET = /\b((?:api[_-]?key|(?:access[_-]?)?token|secret|password|authorization)\s*[:=]\s*)(?:(["'])[^\r\n]*?\2|[^\s"'`,;]+)/gi;
+
+function maskString(value: string): string {
+  return value.replace(INLINE_SECRET, `$1${MASK}`)
+    .replace(ASSIGNMENT_SECRET, (_match, prefix: string, quote?: string) => `${prefix}${quote ?? ''}${MASK}${quote ?? ''}`);
+}
+
+/** Sanitize before fan-out; never put an unmasked payload in the subscriber queue. */
+export function maskInsideEventValue(value: unknown, seen = new WeakSet<object>()): unknown {
+  if (typeof value === 'string') return maskString(value);
+  if (!value || typeof value !== 'object') return value;
+  if (seen.has(value)) return MASK;
+  seen.add(value);
+  if (Array.isArray(value)) {
+    const result = value.map((item) => maskInsideEventValue(item, seen));
+    seen.delete(value);
+    return result;
+  }
+  const result: Record<string, unknown> = {};
+  for (const [key, item] of Object.entries(value)) {
+    result[key] = SECRET_KEY.test(key) ? MASK : maskInsideEventValue(item, seen);
+  }
+  seen.delete(value);
+  return result;
+}
+
+type Listener = (event: InsideLiveEvent) => void;
+const listeners = new Set<Listener>();
+const RELAY_INTERVAL_MS = 20;
+const RELAY_MAX_RECORD_BYTES = 64 * 1024;
+const RELAY_ROTATE_BYTES = 4 * 1024 * 1024;
+const RELAY_RETIRE_GRACE_MS = 2000;
+const relayIdentity = randomUUID();
+
+function relayPaths() {
+  const root = nexusRootDir();
+  return { root, pointer: join(root, 'inside-events-relay.json') };
+}
+
+function dispatch(event: InsideLiveEvent): void {
+  for (const listener of listeners) {
+    try { listener(event); } catch { /* a disconnected observer must not stop a run */ }
+  }
+}
+
+/** Each daemon owns its journal; child processes append masked records to that journal.
+ *  The journal rotates once fully consumed past RELAY_ROTATE_BYTES: the pointer moves to a fresh file and the old one is
+ *  drained for a grace period (producers that read the old pointer may still append) before it is removed. */
+export function startInsideEventRelay(opts: { rotateBytes?: number; retireGraceMs?: number } = {}): () => void {
+  const { root, pointer } = relayPaths();
+  mkdirSync(root, { recursive: true });
+  const rotateBytes = opts.rotateBytes ?? RELAY_ROTATE_BYTES;
+  const retireGraceMs = opts.retireGraceMs ?? RELAY_RETIRE_GRACE_MS;
+  type Journal = { file: string; offset: number; pending: string; decoder: StringDecoder; retireAt?: number };
+  const journals: Journal[] = [];
+  let descriptor = '';
+  const open = (): Journal => {
+    const id = randomUUID();
+    const file = join(root, `inside-events-${id}.jsonl`);
+    writeFileSync(file, '', { mode: 0o600, flag: 'wx' });
+    descriptor = JSON.stringify({ pid: process.pid, id });
+    writeFileSync(pointer, descriptor, { mode: 0o600 });
+    const journal: Journal = { file, offset: 0, pending: '', decoder: new StringDecoder('utf8') };
+    journals.push(journal);
+    return journal;
+  };
+  let current = open();
+  const drain = (journal: Journal): void => {
+    const size = statSync(journal.file).size;
+    if (size < journal.offset) { journal.offset = 0; journal.pending = ''; journal.decoder = new StringDecoder('utf8'); }
+    while (size > journal.offset) {
+      const count = Math.min(size - journal.offset, 1024 * 1024);
+      const chunk = Buffer.alloc(count);
+      const fd = openSync(journal.file, 'r');
+      let length: number;
+      try { length = readSync(fd, chunk, 0, count, journal.offset); }
+      finally { closeSync(fd); }
+      if (length <= 0) break;
+      journal.offset += length;
+      // A chunk boundary may split a multi-byte character; the decoder carries the partial bytes into the next read.
+      journal.pending += journal.decoder.write(chunk.subarray(0, length));
+      const lines = journal.pending.split('\n');
+      journal.pending = lines.pop() ?? '';
+      if (journal.pending.length > RELAY_MAX_RECORD_BYTES) journal.pending = '';
+      for (const line of lines) {
+        if (line.length > RELAY_MAX_RECORD_BYTES) continue;
+        try {
+          const record = JSON.parse(line) as { origin?: string; event?: InsideEventInput };
+          if (record.origin === relayIdentity || !record.event || typeof record.event.kind !== 'string'
+            || !/^[a-z][a-z0-9._-]*$/i.test(record.event.kind)) continue;
+          dispatch(maskInsideEventValue(record.event) as InsideLiveEvent);
+        } catch { /* malformed producer record */ }
+      }
+    }
+  };
+  const remove = (journal: Journal): void => {
+    try { unlinkSync(journal.file); } catch { /* already removed */ }
+    journals.splice(journals.indexOf(journal), 1);
+  };
+  const timer = setInterval(() => {
+    for (const journal of [...journals]) {
+      try { drain(journal); } catch { /* journal disappeared during shutdown */ }
+      if (journal.retireAt !== undefined && Date.now() >= journal.retireAt && journal.pending === '') remove(journal);
+    }
+    if (current.offset >= rotateBytes && current.pending === '') {
+      try {
+        current.retireAt = Date.now() + retireGraceMs;
+        current = open();
+        debug.log('inside.events', 'relay-rotated', { journals: journals.length });
+      } catch { /* keep appending to the current journal */ }
+    }
+  }, RELAY_INTERVAL_MS);
+  timer.unref();
+  return () => {
+    clearInterval(timer);
+    try { if (readFileSync(pointer, 'utf8') === descriptor) unlinkSync(pointer); } catch { /* another daemon owns it */ }
+    for (const journal of [...journals]) remove(journal);
+  };
+}
+
+/** Ordered local delivery plus best-effort cross-process delivery to the current daemon. */
+export function publishInsideEvent(event: InsideEventInput): void {
+  if (!event || typeof event.kind !== 'string' || !/^[a-z][a-z0-9._-]*$/i.test(event.kind)) return;
+  const safe = maskInsideEventValue({ ...event, ts: event.ts ?? new Date().toISOString() }) as InsideLiveEvent;
+  dispatch(safe);
+  try {
+    const { root, pointer } = relayPaths();
+    if (!existsSync(pointer)) return;
+    const descriptor = JSON.parse(readFileSync(pointer, 'utf8')) as { pid?: number; id?: string };
+    if (!Number.isSafeInteger(descriptor.pid) || typeof descriptor.id !== 'string' || !/^[a-f0-9-]{36}$/.test(descriptor.id)) return;
+    process.kill(descriptor.pid!, 0);
+    const file = join(root, `inside-events-${descriptor.id}.jsonl`);
+    const line = JSON.stringify({ origin: relayIdentity, event: safe }) + '\n';
+    if (Buffer.byteLength(line) > RELAY_MAX_RECORD_BYTES) return;
+    appendFileSync(file, line, { mode: 0o600, flag: 'a' });
+  } catch { /* a missing daemon must not interrupt the producer */ }
+}
+
+export function subscribeInsideEvent(listener: Listener): () => void {
+  listeners.add(listener);
+  return () => { listeners.delete(listener); };
+}
+
+/** No history/replay: the stream starts at the moment a client subscribes. */
+export function handleInsideEvents(req: Request): Response {
+  if (req.method !== 'GET') return new Response(null, { status: 405, headers: { allow: 'GET' } });
+  const encoder = new TextEncoder();
+  let cleanup: (() => void) | undefined;
+  const stream = new ReadableStream<Uint8Array>({
+    start(controller) {
+      let closed = false;
+      let unsubscribe = () => {};
+      let heartbeat: ReturnType<typeof setInterval> | undefined;
+      const onAbort = () => close();
+      cleanup = () => {
+        if (closed) return;
+        closed = true;
+        if (heartbeat !== undefined) clearInterval(heartbeat);
+        unsubscribe();
+        req.signal.removeEventListener('abort', onAbort);
+      };
+      const close = () => {
+        cleanup?.();
+        try { controller.close(); } catch { /* cancelled already */ }
+      };
+      const send = (text: string): void => {
+        if (closed) return;
+        const bytes = encoder.encode(text);
+        if (bytes.byteLength > MAX_FRAME_BYTES || (controller.desiredSize ?? 0) <= 0) {
+          close();
+          return;
+        }
+        try { controller.enqueue(bytes); } catch { close(); }
+      };
+      if (req.signal.aborted) {
+        close();
+        return;
+      }
+      unsubscribe = subscribeInsideEvent((event) => {
+        send(`event: ${event.kind}\ndata: ${JSON.stringify(event)}\n\n`);
+      });
+      heartbeat = setInterval(() => send(': ping\n\n'), SSE_HEARTBEAT_MS);
+      req.signal.addEventListener('abort', onAbort, { once: true });
+      if (req.signal.aborted) close();
+      else send(': inside events stream\n\n');
+    },
+    cancel() { cleanup?.(); },
+  }, { highWaterMark: MAX_PENDING_FRAMES, size: () => 1 });
+  return new Response(stream, {
+    headers: {
+      'content-type': 'text/event-stream; charset=utf-8',
+      'cache-control': 'no-cache, no-transform',
+      'x-accel-buffering': 'no',
+      connection: 'keep-alive',
+    },
+  });
+}

package/src/nexus/api/meta-api.ts

@@ -81,6 +81,7 @@ import { createPwaConfirmChannel, createPwaQuestionChannel } from './hitl-pwa-ch
 import type { NexusEventBus } from './event-bus.js';
 import { jsonResponse } from './http-server.js';
 import { defaultChatEventBus } from './chat-event-bus.js';
+import { resolveSessionProjectContext } from '../../project/session-context.js';
 
 const MIME_BY_EXT: Record<string, string> = {
   '.png': 'image/png',
@@ -803,13 +804,18 @@ export async function handlePromptPost(
 ): Promise<Response> {
   if (!checkAuth(req, opts)) return authFailureResponse(req, opts);
   if (!opts.history) return jsonResponse({ error: RUNTIME_NOT_WIRED }, 503);
-  let body: DaemonPromptBody;
+  let rawBody: unknown;
   try {
-    body = (await req.json()) as DaemonPromptBody;
+    rawBody = await req.json();
   } catch {
     return badRequest('invalid JSON body');
   }
-  const parsed = parseDaemonPromptBody(body, opts.systemPrompt);
+  if (!rawBody || typeof rawBody !== 'object' || Array.isArray(rawBody)) {
+    return badRequest('userText or userContent required');
+  }
+  const body = rawBody as DaemonPromptBody;
+  const projectContext = resolveSessionProjectContext(typeof body.sessionId === 'string' ? body.sessionId : undefined);
+  const parsed = parseDaemonPromptBody(body, projectContext?.instructions ? [opts.systemPrompt, projectContext.instructions].filter(Boolean).join('\n\n') : opts.systemPrompt);
   if (!parsed.ok) return badRequest(parsed.reason);
   const submit = createDaemonPromptTurnSubmit({
     kind: 'submit-turn',
@@ -843,7 +849,8 @@ export async function handlePromptPost(
         ...((owner) => owner ? { verifiedOwner: owner } : {})(promptVerifiedOwner(req, opts)),
         ...(resolvePromptHitlChannels(typeof body.sessionId === 'string' ? body.sessionId : '', opts) ?? {}),
         ...(effectiveSurface ? { toolSurface: effectiveSurface } : {}),
-        ...(opts.toolCwd ? { toolCwd: opts.toolCwd } : {}),
+        ...(projectContext?.cwd || opts.toolCwd ? { toolCwd: projectContext?.cwd ?? opts.toolCwd } : {}),
+        ...(projectContext?.instructions ? { projectInstructions: projectContext.instructions } : {}),
         dispatchToolErrorMessage: 'NEXUS prompt runtime has no tool surface (start nexus with `--tools readonly|webterm`)',
         });
       },
@@ -930,13 +937,18 @@ export async function handlePromptStreamPost(
 ): Promise<Response> {
   if (!checkAuth(req, opts)) return authFailureResponse(req, opts);
   if (!opts.history) return jsonResponse({ error: RUNTIME_NOT_WIRED }, 503);
-  let body: DaemonPromptBody;
+  let rawBody: unknown;
   try {
-    body = (await req.json()) as DaemonPromptBody;
+    rawBody = await req.json();
   } catch {
     return badRequest('invalid JSON body');
   }
-  const parsed = parseDaemonPromptBody(body, opts.systemPrompt);
+  if (!rawBody || typeof rawBody !== 'object' || Array.isArray(rawBody)) {
+    return badRequest('userText or userContent required');
+  }
+  const body = rawBody as DaemonPromptBody;
+  const projectContext = resolveSessionProjectContext(typeof body.sessionId === 'string' ? body.sessionId : undefined);
+  const parsed = parseDaemonPromptBody(body, projectContext?.instructions ? [opts.systemPrompt, projectContext.instructions].filter(Boolean).join('\n\n') : opts.systemPrompt);
   if (!parsed.ok) return badRequest(parsed.reason);
   // M6 PR 1 (PLAN-rich-dev-feedback-multi-surface · 2026-05-13) — opt-in
   // debug-tap. PWA `/chat?debug-tap=on` propagates the query down to
@@ -1201,7 +1213,8 @@ export async function handlePromptStreamPost(
                 ...((owner) => owner ? { verifiedOwner: owner } : {})(promptVerifiedOwner(req, opts)),
                 ...(resolvePromptHitlChannels(typeof body.sessionId === 'string' ? body.sessionId : '', opts) ?? {}),
                 ...(effectiveSurface ? { toolSurface: effectiveSurface } : {}),
-                ...(opts.toolCwd ? { toolCwd: opts.toolCwd } : {}),
+                ...(projectContext?.cwd || opts.toolCwd ? { toolCwd: projectContext?.cwd ?? opts.toolCwd } : {}),
+                ...(projectContext?.instructions ? { projectInstructions: projectContext.instructions } : {}),
                 signal: turnAbortController.signal,
                 onTextDelta: dualEmitTextDelta,
                 onImageBlock: dualEmitImageBlock,

package/src/nexus/api/missions.ts

@@ -20,6 +20,7 @@
  * Query params (list):
  *   status=<MissionStatus>   filter by status (active / planning / ...)
  *   goalSlug=<slug>          filter by goal binding
+ *   projectId=<id>          filter by project association
  *
  * Cross-ref:
  *   src/task-orchestrator/store.ts (listMissions · getMission ·
@@ -53,6 +54,7 @@ export interface MissionCardWire {
   status: MissionStatus;
   priority: Mission['priority'];
   goalSlug: string | null;
+  projectId?: string;
   taskCount: number;
   /** Counts so the PWA mission lane shows progress at a glance. */
   taskStatusCounts: Record<string, number>;
@@ -85,6 +87,7 @@ export function summarise(mission: Mission, tasks: readonly Task[]): MissionCard
     status: mission.status,
     priority: mission.priority,
     goalSlug: mission.goalSlug ?? null,
+    ...(mission.projectId !== undefined ? { projectId: mission.projectId } : {}),
     taskCount: tasks.length,
     taskStatusCounts,
     surfaceKindCounts,
@@ -103,9 +106,11 @@ export function handleMissionsList(
   const url = new URL(req.url);
   const statusParam = url.searchParams.get('status');
   const goalSlug = url.searchParams.get('goalSlug') ?? undefined;
-  const filter: { status?: MissionStatus; goalSlug?: string } = {};
+  const projectId = url.searchParams.get('projectId') ?? undefined;
+  const filter: { status?: MissionStatus; goalSlug?: string; projectId?: string } = {};
   if (statusParam && isMissionStatus(statusParam)) filter.status = statusParam;
   if (goalSlug) filter.goalSlug = goalSlug;
+  if (projectId !== undefined) filter.projectId = projectId;
 
   const store = new TaskStore();
   try {

package/src/nexus/api/ops-seats.ts

@@ -3,6 +3,7 @@
 import { debug, redactSecretText } from '../../debug/log.js';
 import { parseOwner, type ChecklistItem } from '../../release-loop/checklist.js';
 import { canonicalSeatId } from '../../msg/msg-store.js';
+import { listSubSeatCharters, type SubSeatCharter } from './sub-seat-charters.js';
 
 export const SEATS = [
   { seat: 'OP', role: 'COO' }, { seat: 'TC', role: 'CTO' }, { seat: 'MK', role: 'CMO' }, { seat: 'UX', role: 'CXO' },
@@ -26,6 +27,7 @@ export interface SeatsSources {
   checklist(): { current: ChecklistItem[]; all: ChecklistItem[] } | null;
   /** `raisedBy.agent` of every open decision. */
   openDecisionRaisers(): string[] | null;
+  charters?(): SubSeatCharter[] | null;
 }
 
 export interface SeatRow {
@@ -36,6 +38,7 @@ export interface SeatRow {
   blocked: Array<{ id: string; title: string; status: 'red' }> | null;
   pendingDecisions: number | null;
   checklist: { green: number; yellow: number; red: number; done: number } | null;
+  subSeats: Array<{ id: string; title: string; open: number | null; landed: number | null; blocked: Array<{ id: string; title: string }> | null }> | null;
 }
 
 function seatOf(value: string | undefined): string | null {
@@ -65,16 +68,37 @@ export async function buildSeatsBoard(date: string, sources: SeatsSources): Prom
   try { checklist = sources.checklist(); } catch { checklist = null; }
   let raisers: string[] | null = null;
   try { raisers = sources.openDecisionRaisers(); } catch { raisers = null; }
+  let charters: SubSeatCharter[] | null = null;
+  try {
+    if (sources.charters) charters = sources.charters();
+    else {
+      let unreadable = false;
+      const listed = listSubSeatCharters(undefined, () => { unreadable = true; });
+      charters = unreadable ? null : listed;
+    }
+  } catch { charters = null; }
 
   const owners = new Map<string, string>();
   for (const item of checklist?.all ?? []) { const seat = seatOf(item.owner); if (seat) owners.set(item.id, seat); }
   const ids = [...owners.keys()];
   const landedBySeat = new Map<string, NonNullable<SeatRow['landed']>>();
+  const landedBySub = new Map<string, number>();
+  const subOwner = (owner: string | undefined, charter: SubSeatCharter): boolean => {
+    if (!owner) return false;
+    try { const parsed = parseOwner(owner); return owner === charter.id && parsed.seat === charter.seat && parsed.sub === charter.sub; }
+    catch { return false; }
+  };
+  const subOwners = new Map(checklist?.all.flatMap((item) => {
+    const charter = charters?.find((candidate) => subOwner(item.owner, candidate));
+    return charter ? [[item.id, charter.id] as const] : [];
+  }) ?? []);
   for (const pr of merged ?? []) {
     const id = checklistIdOf(pr, ids);
     const seat = id ? owners.get(id) : undefined;
     if (!seat) continue; // ⛔ not by commit author — every seat lands through the same account.
     landedBySeat.set(seat, [...(landedBySeat.get(seat) ?? []), { pr: pr.number, title: clip(pr.title, 80), at: pr.mergedAt, checklistId: id }]);
+    const sub = id ? subOwners.get(id) : undefined;
+    if (sub) landedBySub.set(sub, (landedBySub.get(sub) ?? 0) + 1);
   }
 
   const seats = SEATS.map(({ seat, role }): SeatRow => {
@@ -91,6 +115,15 @@ export async function buildSeatsBoard(date: string, sources: SeatsSources): Prom
         green: mine.filter((i) => i.status === 'green').length, yellow: mine.filter((i) => i.status === 'yellow').length,
         red: mine.filter((i) => i.status === 'red').length, done: mine.filter((i) => i.status === 'done').length,
       } : null,
+      subSeats: charters?.filter((charter) => charter.seat === seat).map((charter) => {
+        const items = checklist?.current.filter((item) => subOwner(item.owner, charter));
+        return {
+          id: charter.id, title: clip(charter.title, 80),
+          open: items ? items.filter((item) => item.status !== 'done').length : null,
+          landed: merged !== null && checklist !== null ? landedBySub.get(charter.id) ?? 0 : null,
+          blocked: items ? items.filter((item) => item.status === 'red').map((item) => ({ id: item.id, title: clip(item.title, 80) })) : null,
+        };
+      }) ?? null,
     };
   });
   debug.log('ops.seats', 'built', {

package/src/nexus/api/outbound-report.ts

@@ -19,6 +19,9 @@ import { checkAuth, type MetaApiOpts } from './meta-api.js';
 import { routeOutbound } from '../outbound/router.js';
 import { getUserConfig } from '../../user-config.js';
 import { openSurfaceEventsDb, recordEvent } from '../../domains/surface-events.js';
+import { debug } from '../../debug/log.js';
+import { resolveReportTarget } from '../../telegram-report.js';
+import type { RouteResult, RouterDeps } from '../outbound/router.js';
 
 /** 크로스서피스 기억(P0.5) — /v1/outbound = ALL outbound 단일 수렴점이므로 여기서
  *  원장 기록하면 sendOutbound 클라 + 직접 POST(morning-report·external) 전부 포착.
@@ -31,6 +34,21 @@ function recordOutboundEvent(text: string, kind: string): void {
   } catch { /* 발송 원장 기록 실패는 무시 */ }
 }
 
+function observeDaemonSend(cfg: ReturnType<typeof getUserConfig>, text: string, kind: string, result: RouteResult, source: string): void {
+  if (result.suppressed) return; // 라우터가 suppressedBy 만 싣는 억제 관측을 남긴다.
+  try {
+    const target = result.channels.some(c => c.type === 'telegram') ? resolveReportTarget(cfg, kind) : null;
+    const id = target?.botToken.split(':', 1)[0];
+    const bot = id && /^\d+$/.test(id) ? `telegram:${id}` : target ? 'telegram:configured' : 'none';
+    debug.log('outbound.send', result.delivered ? 'sent' : 'failed', {
+      kind: /^[a-zA-Z0-9_-]{1,80}$/.test(kind) ? kind : 'unknown',
+      source: /^[a-zA-Z0-9_./-]{1,160}$/.test(source) ? source : 'unknown',
+      chars: text.length, bot, path: 'daemon',
+      channels: result.channels.map(c => ({ type: c.type, ok: c.ok })),
+    });
+  } catch { /* observation must not change the send result */ }
+}
+
 interface OutboundBody {
   text?: string;
   markdown?: boolean;
@@ -45,14 +63,16 @@ function json(body: unknown, status: number): Response {
 }
 
 /** The daemon's own sendOutbound path (OB8) — what POST /v1/outbound does, without the HTTP self-call. */
-export async function routeOutboundInProcess(text: string, kind: string): Promise<boolean> {
-  const result = await routeOutbound(getUserConfig(), { text, markdown: false, kind });
-  if (result.delivered) recordOutboundEvent(text, kind);
+export async function routeOutboundInProcess(text: string, kind: string, source = 'daemon-in-process', deferFailureObservation = false): Promise<boolean> {
+  const cfg = getUserConfig();
+  const result = await routeOutbound(cfg, { text, markdown: false, kind });
+  if (result.delivered || !deferFailureObservation) observeDaemonSend(cfg, text, kind, result, source);
+  if (result.delivered && !result.suppressed) recordOutboundEvent(text, kind);
   return result.delivered;
 }
 
 /** POST /v1/outbound — fan one message out to the routed channels. */
-export async function handleOutboundReport(req: Request, metaApi: MetaApiOpts): Promise<Response> {
+export async function handleOutboundReport(req: Request, metaApi: MetaApiOpts, routerDeps: RouterDeps = {}): Promise<Response> {
   if (!checkAuth(req, metaApi)) return json({ error: 'unauthorized' }, 401);
 
   let body: OutboundBody;
@@ -68,16 +88,29 @@ export async function handleOutboundReport(req: Request, metaApi: MetaApiOpts):
     // Router is per-channel fail-soft; `delivered` = any channel ok.
     // Producers (outbound-alert.ts deliver()) gate their direct-telegram
     // fallback on this top-level boolean — keep it stable.
-    const result = await routeOutbound(cfg, { text, markdown: body.markdown ?? true, kind });
-    if (result.delivered) recordOutboundEvent(text, kind); // 크로스서피스 기억 원장(P0.5)
+    const result = await routeOutbound(cfg, { text, markdown: body.markdown ?? true, kind }, routerDeps);
+    const clientFallback = req.headers.get('X-Elanous-Client-Fallback') === 'direct';
+    const source = req.headers.get('X-Elanous-Outbound-Source') ?? 'daemon-http';
+    if (result.delivered || !clientFallback) observeDaemonSend(cfg, text, kind, result, source);
+    if (result.delivered && !result.suppressed) recordOutboundEvent(text, kind); // 크로스서피스 기억 원장(P0.5)
     return json({
       delivered: result.delivered,
       // Legacy single-channel field (pre-R6 consumers) + full breakdown.
-      channel: result.delivered ? (result.channels.find(c => c.ok)?.type ?? 'none') : 'none',
+      channel: result.suppressed ? 'suppressed' : (result.channels.find(c => c.ok)?.type ?? 'none'),
       channels: result.channels,
+      ...(result.suppressed ? { suppressed: true, suppressedBy: result.suppressedBy } : {}),
+      ...(!result.suppressed && result.channels.length === 0 ? { reason: 'no-channel' } : {}),
       kind,
     }, result.delivered ? 200 : 503);
   } catch (e) {
+    if (req.headers.get('X-Elanous-Client-Fallback') !== 'direct') {
+      try {
+        debug.log('outbound.send', 'failed', {
+          kind: /^[a-zA-Z0-9_-]{1,80}$/.test(kind) ? kind : 'unknown',
+          source: 'daemon-http', chars: text.length, bot: 'unknown', path: 'daemon',
+        });
+      } catch { /* observation must not change the response */ }
+    }
     return json({ error: e instanceof Error ? e.message : String(e) }, 502);
   }
 }

package/src/nexus/api/outputs-route.ts

@@ -0,0 +1,44 @@
+import { basename } from 'node:path';
+import { debug } from '../../debug/log.js';
+import { OUTPUT_KINDS } from '../../exec-requests/default-outputs.js';
+import { listOutputs } from '../../outputs/ledger.js';
+import { jsonResponse } from './json-response.js';
+
+export interface OutputsDeps {
+  list?: typeof listOutputs;
+}
+
+export function handleOutputsGet(req: Request, deps: OutputsDeps = {}): Response {
+  const params = new URL(req.url).searchParams;
+  const rawLimit = params.get('limit');
+  if (rawLimit !== null && (!/^[1-9]\d*$/.test(rawLimit) || Number(rawLimit) > 200)) {
+    return jsonResponse({ error: 'invalid_limit' }, 400);
+  }
+  const limit = rawLimit === null ? 50 : Number(rawLimit);
+  const rawSource = params.get('source');
+  if (rawSource !== null && rawSource !== 'exec' && rawSource !== 'field-reel' && rawSource !== 'field-feed') {
+    return jsonResponse({ error: 'invalid_source' }, 400);
+  }
+  const source = rawSource ?? undefined;
+  const rawSince = params.get('since');
+  if (rawSince !== null && (!/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?(?:Z|[+-]\d{2}:\d{2})$/.test(rawSince)
+    || !Number.isFinite(Date.parse(rawSince))
+    || !Number.isFinite(Date.parse(`${rawSince.slice(0, 10)}T00:00:00Z`))
+    || new Date(`${rawSince.slice(0, 10)}T00:00:00Z`).toISOString().slice(0, 10) !== rawSince.slice(0, 10))) {
+    return jsonResponse({ error: 'invalid_since' }, 400);
+  }
+  const since = rawSince ? new Date(rawSince).toISOString() : undefined;
+  const rows = (deps.list ?? listOutputs)({ limit, ...(source ? { source } : {}), ...(since ? { since } : {}) });
+  const outputs = rows.map(({ kind, title, path, url, source: entrySource, seat, at }) => ({
+    kind,
+    kindLabel: kind === 'file' ? '파일' : OUTPUT_KINDS[kind]?.cardTitle ?? '파일',
+    title,
+    ...(path ? { fileName: basename(path) } : {}),
+    ...(url ? { url } : {}),
+    source: entrySource,
+    ...(seat ? { seat } : {}),
+    at,
+  }));
+  debug.log('outputs.route', 'listed', { count: outputs.length, source, limit });
+  return jsonResponse({ outputs });
+}