elanous 0.2.10 → 0.2.12

package/src/nexus/api/workflow-run-event-bridge.ts

@@ -73,6 +73,7 @@ export function publishWorkflowRunEvent(
   const detail: Record<string, unknown> = {
     runId: ctx.runId,
     workflowName: ctx.workflowName,
+    ...(evt.mode !== undefined ? { mode: evt.mode } : {}),
   };
   if (evt.type === 'node_start' || evt.type === 'node_skipped' || evt.type === 'node_done') {
     detail.nodeId = evt.nodeId;

package/src/nexus/api/workflows.ts

@@ -32,7 +32,9 @@ import { requirePosixShellCommand } from '../../platform/default-shell.js';
 import { spawn } from 'child_process';
 import { existsSync, readFileSync, readdirSync, statSync } from 'fs';
 import { join } from 'path';
+import { debug } from '../../debug/log.js';
 import { elanousStateRoot } from '../../autopilot/state-paths.js';
+import { getWorkflowHistoryVersion, listWorkflowHistory, snapshotBeforeSave } from './workflow-history.js';
 import {
   deleteWorkflow,
   discoverWorkflows,
@@ -40,8 +42,12 @@ import {
   parseWorkflowYaml,
   runWorkflow,
   saveWorkflow,
+  topoSort,
   type WorkflowDeps,
   type WorkflowEvent,
+  type WorkflowRunMode,
+  type NodeOutput,
+  type RunWorkflowOpts,
 } from '../../workflow-runtime/index.js';
 import { buildRunCft, buildRunSkill } from '../../workflow-runtime/deps-bridge.js';
 import {
@@ -59,6 +65,7 @@ import { runApprovalAcrossChannels } from './workflow-approval-multi-channel.js'
 interface RunRecord {
   runId: string;
   workflowName: string;
+  mode: WorkflowRunMode;
   startedAt: number;
   events: WorkflowEvent[];
   /** Settled state: undefined while running, true on workflow_done,
@@ -227,6 +234,45 @@ export function handleWorkflowGet(
   );
 }
 
+export function handleWorkflowHistoryList(
+  req: Request,
+  name: string,
+  opts: MetaApiOpts,
+): Response {
+  if (!checkAuth(req, opts)) return jsonResponse({ error: 'unauthorized' }, 401);
+  if (req.method !== 'GET') return jsonResponse({ error: 'method-not-allowed', method: req.method }, 405);
+  const scope = new URL(req.url).searchParams.get('scope') === 'global' ? 'global' : 'project';
+  try {
+    return jsonResponse({ versions: listWorkflowHistory(name, { scope }) }, 200);
+  } catch (err) {
+    if (err instanceof Error && err.message === 'invalid workflow name') {
+      return jsonResponse({ error: 'bad_request', reason: err.message }, 400);
+    }
+    throw err;
+  }
+}
+
+export function handleWorkflowHistoryVersionGet(
+  req: Request,
+  name: string,
+  id: string,
+  opts: MetaApiOpts,
+): Response {
+  if (!checkAuth(req, opts)) return jsonResponse({ error: 'unauthorized' }, 401);
+  if (req.method !== 'GET') return jsonResponse({ error: 'method-not-allowed', method: req.method }, 405);
+  const scope = new URL(req.url).searchParams.get('scope') === 'global' ? 'global' : 'project';
+  try {
+    const yaml = getWorkflowHistoryVersion(name, id, { scope });
+    if (yaml === null) return jsonResponse({ error: 'not_found', name, id }, 404);
+    return jsonResponse({ yaml }, 200);
+  } catch (err) {
+    if (err instanceof Error && (err.message === 'invalid workflow name' || err.message === 'invalid workflow history version id')) {
+      return jsonResponse({ error: 'bad_request', reason: err.message }, 400);
+    }
+    throw err;
+  }
+}
+
 export async function handleWorkflowPut(
   req: Request,
   name: string,
@@ -243,6 +289,17 @@ export async function handleWorkflowPut(
     return jsonResponse({ error: 'bad_request', reason: '`yaml` must be a string' }, 400);
   }
   const scope = scopeRaw === 'global' ? 'global' : 'project';
+  const parsed = parseWorkflowYaml(yamlText);
+  if (parsed.ok && parsed.workflow?.name === name) {
+    // Capture the existing file before saveWorkflow overwrites it; a failed snapshot is non-fatal.
+    try {
+      snapshotBeforeSave(name, { scope });
+    } catch (err) {
+      debug.log('nexus.workflow-history', 'snapshot-failed', {
+        name, scope, error: err instanceof Error ? err.message : String(err),
+      }, { level: 'warn' });
+    }
+  }
   const r = saveWorkflow(name, yamlText, { scope });
   if (!r.ok) {
     return jsonResponse(
@@ -384,10 +441,51 @@ export async function handleWorkflowRunStart(
   // so the PWA "▶ Run now" button runs the dependent chain straight
   // through. Default false preserves the production wire.
   const dryRun: boolean = Boolean(body && typeof body === 'object' && (body as { dryRun?: unknown }).dryRun === true);
+  const input = body && typeof body === 'object' ? body as Record<string, unknown> : {};
+  const { onlyNode, fromNode, fromRunId } = input;
+  if ('usePins' in input || (onlyNode !== undefined && (fromNode !== undefined || fromRunId !== undefined))
+    || (onlyNode !== undefined && (typeof onlyNode !== 'string' || !onlyNode.trim()))
+    || (fromNode !== undefined && (typeof fromNode !== 'string' || !fromNode.trim()))
+    || (fromRunId !== undefined && (typeof fromRunId !== 'string' || !fromRunId.trim()))
+    || (fromNode === undefined) !== (fromRunId === undefined)
+    || (input.mode !== undefined && input.mode !== 'test')) {
+    return jsonResponse({ error: 'bad_request', reason: 'invalid run selection' }, 400);
+  }
+  if ((onlyNode && !entry.definition.nodes.some(n => n.id === onlyNode))
+    || (fromNode && !entry.definition.nodes.some(n => n.id === fromNode))) {
+    return jsonResponse({ error: 'bad_request', reason: 'unknown selected node' }, 400);
+  }
+  let previousOutputs: Record<string, NodeOutput> | undefined;
+  if (typeof fromRunId === 'string') {
+    const previous = RUN_REGISTRY.get(fromRunId);
+    if (previous) {
+      if (previous.workflowName !== name || previous.ok === undefined) {
+        return jsonResponse({ error: 'bad_request', reason: 'source run must be settled for this workflow' }, 400);
+      }
+      const terminal = previous.events.find(e => e.type === 'workflow_done' || e.type === 'workflow_failed');
+      previousOutputs = terminal?.type === 'workflow_done' ? terminal.outputs
+        : terminal?.type === 'workflow_failed' ? terminal.partial : {};
+    } else {
+      const disk = readRunOutputSnapshot(fromRunId);
+      if (!disk || disk.workflowName !== name || (disk.status !== 'done' && disk.status !== 'failed')) {
+        return jsonResponse({ error: 'bad_request', reason: 'source run must be settled for this workflow' }, 400);
+      }
+      previousOutputs = disk.outputs;
+    }
+    let order: string[];
+    try { order = topoSort(entry.definition.nodes); }
+    catch { return jsonResponse({ error: 'bad_request', reason: 'invalid workflow topology' }, 400); }
+    const upstream = order.slice(0, order.indexOf(fromNode as string));
+    if (upstream.some(id => previousOutputs?.[id] === undefined)) {
+      return jsonResponse({ error: 'bad_request', reason: 'source run missing upstream outputs' }, 400);
+    }
+  }
+  const mode: WorkflowRunMode = input.mode === 'test' ? 'test' : onlyNode ? 'only' : fromNode ? 'from' : 'full';
   const runId = `wf-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
   const record: RunRecord = {
     runId,
     workflowName: name,
+    mode,
     startedAt: Date.now(),
     events: [],
     ok: undefined,
@@ -400,10 +498,14 @@ export async function handleWorkflowRunStart(
   void (async () => {
     const deps = buildDefaultWorkflowDeps({ runId });
     try {
-      for await (const evt of runWorkflow(
-        { workflow: entry.definition, arguments: args, runId, dryRun },
-        deps,
-      )) {
+      const runOpts: RunWorkflowOpts = {
+        workflow: entry.definition, arguments: args, runId, dryRun, mode,
+        ...(typeof onlyNode === 'string' ? { onlyNode } : {}),
+        ...(typeof fromNode === 'string' ? { fromNode } : {}),
+        ...(previousOutputs ? { previousOutputs } : {}),
+      };
+      for await (const runtimeEvent of runWorkflow(runOpts, deps)) {
+        const evt = { ...runtimeEvent, mode };
         record.events.push(evt);
         // §15.8(b) — fan into NexusEventBus → PWA invalidates queries
         // on push instead of polling. No-op when bus is unwired
@@ -423,13 +525,14 @@ export async function handleWorkflowRunStart(
         type: 'workflow_failed' as const,
         error: err instanceof Error ? err.message : String(err),
         partial: {},
+        mode,
       };
       record.events.push(failEvt);
       publishWorkflowRunEvent({ runId, workflowName: name }, failEvt);
     }
   })();
 
-  return jsonResponse({ ok: true, runId }, 202);
+  return jsonResponse({ ok: true, runId, mode }, 202);
 }
 
 export function handleWorkflowRunGet(
@@ -444,6 +547,7 @@ export function handleWorkflowRunGet(
       {
         runId: rec.runId,
         workflowName: rec.workflowName,
+        mode: rec.mode,
         startedAt: rec.startedAt,
         ok: rec.ok,
         events: rec.events,
@@ -597,6 +701,21 @@ interface DiskRunSummary {
  *  enough that abandoned runs don't pollute the list across sessions. */
 const STALE_RUNNING_AFTER_MS = 30 * 60 * 1000;
 
+function readRunOutputSnapshot(runId: string): {
+  workflowName: string;
+  status: string;
+  outputs: Record<string, NodeOutput>;
+} | null {
+  if (!/^wf-[A-Za-z0-9-]+$/.test(runId) || runId.includes('..')) return null;
+  try {
+    const parsed = JSON.parse(readFileSync(join(workflowsRunsRoot(), runId, 'run.json'), 'utf-8')) as {
+      workflowName?: string; status?: string; outputs?: Record<string, NodeOutput>;
+    };
+    if (!parsed.workflowName || !parsed.status || !parsed.outputs || typeof parsed.outputs !== 'object') return null;
+    return { workflowName: parsed.workflowName, status: parsed.status, outputs: parsed.outputs };
+  } catch { return null; }
+}
+
 /** Read `<root>/<runId>/run.json` and translate into the same shape as
  *  GET /runs/<id> serves from memory. Returns null when the file is
  *  missing or unreadable. Events are reconstructed minimally from the
@@ -608,6 +727,7 @@ function loadRunFromDisk(runId: string): {
   ok: boolean | undefined;
   events: WorkflowEvent[];
   outputs: Record<string, unknown>;
+  mode?: WorkflowRunMode;
 } | null {
   if (!runId || runId.includes('/') || runId.includes('..')) return null;
   const root = workflowsRunsRoot();
@@ -623,6 +743,7 @@ function loadRunFromDisk(runId: string): {
       completedAt?: number;
       ok?: boolean;
       status?: string;
+      mode?: WorkflowRunMode;
       outputs?: Record<string, { output?: unknown }>;
     };
     if (!parsed.runId || !parsed.workflowName) return null;
@@ -634,7 +755,8 @@ function loadRunFromDisk(runId: string): {
     // so a polling client still sees the node_done sequence even
     // though the live run.json doesn't store events.
     const events: WorkflowEvent[] = [];
-    events.push({ type: 'workflow_start', workflow: parsed.workflowName, runId: parsed.runId });
+    events.push({ type: 'workflow_start', workflow: parsed.workflowName, runId: parsed.runId,
+      ...(parsed.mode !== undefined ? { mode: parsed.mode } : {}) });
     const nodesDir = join(runDir, 'nodes');
     // Iterate `parsed.outputs` keys instead of `readdirSync(nodesDir)`
     // so the reconstructed node_done sequence is in execution order
@@ -673,6 +795,7 @@ function loadRunFromDisk(runId: string): {
       events.push({
         type: 'node_done',
         nodeId,
+        ...(parsed.mode !== undefined ? { mode: parsed.mode } : {}),
         result: {
           ok: nodeData.ok,
           output: nodeData.output ?? '',
@@ -684,6 +807,7 @@ function loadRunFromDisk(runId: string): {
     if (parsed.status === 'done') {
       events.push({
         type: 'workflow_done',
+        ...(parsed.mode !== undefined ? { mode: parsed.mode } : {}),
         outputs: Object.fromEntries(
           Object.entries(parsed.outputs ?? {}).map(([k, v]) => [
             k,
@@ -694,6 +818,7 @@ function loadRunFromDisk(runId: string): {
     } else if (parsed.status === 'failed') {
       events.push({
         type: 'workflow_failed',
+        ...(parsed.mode !== undefined ? { mode: parsed.mode } : {}),
         error: 'failed (see node events)',
         partial: Object.fromEntries(
           Object.entries(parsed.outputs ?? {}).map(([k, v]) => [
@@ -706,6 +831,7 @@ function loadRunFromDisk(runId: string): {
     return {
       runId: parsed.runId,
       workflowName: parsed.workflowName,
+      ...(parsed.mode !== undefined ? { mode: parsed.mode } : {}),
       startedAt: parsed.startedAt ?? 0,
       ok: parsed.status === 'done' ? true : parsed.status === 'failed' ? false : undefined,
       events,

package/src/nexus/index.ts

@@ -1949,10 +1949,12 @@ export async function runNexus(opts: RunNexusOptions = {}): Promise<RunNexusHand
     const tab = registry.get(tabId);
     if (!tab || tab.spec.kind !== 'webterm') return;
     const cwdMeta = (tab.spec.meta as { cwd?: string } | undefined)?.cwd;
+    const projectSessionId = (tab.spec.meta as { sessionId?: string } | undefined)?.sessionId;
     const backendFactory = effectiveWebtermSpawn
       ? () => {
           const decided = resolveWebtermCwd({
             ...(cwdMeta ? { tabCwd: cwdMeta } : {}),
+            ...(projectSessionId ? { sessionId: projectSessionId } : {}),
             ...(runtimeToolCwd ? { toolCwd: runtimeToolCwd } : {}),
             instance: resolveCurrentInstance(),
             processCwd: process.cwd(),

package/src/nexus/kinds/webterm.ts

@@ -24,6 +24,7 @@ export interface WebtermTabOpts {
   id?: string;          // default: 'webterm:1'
   label?: string;
   cwd?: string;
+  sessionId?: string;
 }
 
 export const WEBTERM_KIND: TabKind = 'webterm';
@@ -34,7 +35,7 @@ export function createWebtermTabSpec(opts: WebtermTabOpts = {}): TabSpec {
     id,
     kind: WEBTERM_KIND,
     label: opts.label ?? id,
-    ...(opts.cwd ? { meta: { cwd: opts.cwd } } : {}),
+    ...(opts.cwd || opts.sessionId ? { meta: { ...(opts.cwd ? { cwd: opts.cwd } : {}), ...(opts.sessionId ? { sessionId: opts.sessionId } : {}) } } : {}),
   };
 }
 

package/src/nexus/outbound/delivery-ledger.ts

@@ -52,20 +52,29 @@ export function deliveryDedupKey(kind: string, text: string): string {
   return createHash('sha1').update(`${kind}\n${norm}`).digest('hex').slice(0, 16);
 }
 
-/** ① 중복 발사 제어 — 같은 dedupKey가 windowSec 내에 이미 발송됐나(재팬아웃 억제).
- *  보수적 짧은 창(기본 120s) — 크론 재시도·이중호출 같은 즉시 중복만 잡고,
- *  시간 지난 정당한 재발송은 통과. (의미 중복은 상류 signal-dedup 6h 담당.) */
-export function recentlyDelivered(
+/** ① 중복 발사 제어 — windowSec 내 동일 메시지가 한 채널 이상 성공했으면 그 messageId.
+ *  실패 기록은 재시도를 막지 않는다. 짧은 창(기본 120s) 밖의 재발송은 통과. */
+export function successfulDeliveryId(
   db: Database, dedupKey: string, windowSec = 120, nowMs: number = Date.now(),
-): boolean {
+): string | null {
   // ⚠️ 축 ②(JS 임계 · db-window 참조) — 같은 파일의 `recentDeliveryCount` 와 동형이다.
   //    SQL 안의 `datetime('now')` 를 쓰면 **시계를 주입할 수 없어** 테스트가 실제 시각에
   //    매달린다. 실제로 이 함수의 테스트가 고정 날짜로 seed 한 채 시간이 흘러 어느 날 빨개진
   //    시한폭탄이었다. `deliveries.ts` 는 ISO 로만 쓰므로 raw 비교가 옳고 인덱스도 산다.
   const row = db.prepare(
-    `SELECT 1 FROM deliveries WHERE dedup_key = ? AND ts >= ? LIMIT 1`,
-  ).get(dedupKey, sinceTs(SECONDS(windowSec), nowMs));
-  return !!row;
+    `SELECT message_id FROM deliveries
+     WHERE dedup_key = ? AND ts >= ?
+       AND EXISTS (SELECT 1 FROM json_each(deliveries.channels) WHERE json_extract(value, '$.ok') = 1)
+     ORDER BY ts DESC LIMIT 1`,
+  ).get(dedupKey, sinceTs(SECONDS(windowSec), nowMs)) as { message_id: string } | null;
+  return row?.message_id ?? null;
+}
+
+/** 기존 boolean 호출부 호환 — 성공 배송 기록만 중복으로 센다. */
+export function recentlyDelivered(
+  db: Database, dedupKey: string, windowSec = 120, nowMs: number = Date.now(),
+): boolean {
+  return successfulDeliveryId(db, dedupKey, windowSec, nowMs) !== null;
 }
 
 /** 최근 창(windowSec) 내 총 발송 수 — 버스트(밀림) 판정용. 전 kind 합산.

package/src/nexus/outbound/router.ts

@@ -27,13 +27,14 @@
 // that boolean before falling back to direct Telegram).
 
 import { createHash } from 'node:crypto';
+import { debug } from '../../debug/log.js';
 import { sendTelegramReport } from '../../telegram-report.js';
 import { getPushcutClient } from '../../pushcut/client.js';
 import type { UserConfig } from '../../user-config.js';
 import { formatForChannel, type OutboundChannelType, type OutboundMsg } from './format.js';
 import { spillLongContent } from '../../storage/content-spill.js';
 import {
-  openDeliveryDb, deliveryDedupKey, recentlyDelivered, recordDelivery, type ChannelDelivery,
+  openDeliveryDb, deliveryDedupKey, successfulDeliveryId, recordDelivery, type ChannelDelivery,
 } from './delivery-ledger.js';
 
 // 채널 타입·메시지·분할기는 format.ts가 단일 출처 — 기존 소비처(test 등) 호환 재export.
@@ -71,6 +72,8 @@ export interface RouteResult {
   channels: ChannelResult[];
   /** 중복 발사 제어(dedup)로 재팬아웃이 억제됨 — 최근 동일 발송 존재. */
   suppressed?: boolean;
+  /** 억제 근거가 된 앞선 성공 발송의 식별자. */
+  suppressedBy?: string;
   /** 이 발송의 식별자(리드 동기화·회상 교차참조용). */
   messageId?: string;
 }
@@ -207,9 +210,11 @@ export async function routeOutbound(cfg: UserConfig, msg: OutboundMsg, deps: Rou
   // ① 중복 발사 제어 — 최근(120s) 동일 발송이면 재팬아웃 억제.
   if (ledger && deps.dedup !== false) {
     try {
-      if (recentlyDelivered(ledger, dedupKey)) {
+      const suppressedBy = successfulDeliveryId(ledger, dedupKey);
+      if (suppressedBy) {
         if (ownLedger) ledger.close();
-        return { delivered: true, channels: [], suppressed: true, messageId };
+        try { debug.log('outbound.send', 'suppressed', { kind: msg.kind, suppressedBy }); } catch { /* 관측 실패는 발송 결과에 영향 없음 */ }
+        return { delivered: true, channels: [], suppressed: true, suppressedBy, messageId };
       }
     } catch { /* 원장 조회 실패 — 억제 없이 진행 */ }
   }

package/src/nexus/webterm/pty.ts

@@ -31,6 +31,7 @@ import { startPty as realStartPty, onPtyEvent as realOnPtyEvent } from '../../pt
 import type { StartOpts, PtyHandle, PtyEvent } from '../../pty-shell/registry.js';
 
 import { debug } from '../../debug/log.js';
+import { resolveSessionProjectContext } from '../../project/session-context.js';
 
 // ── PtyBackend interface ─────────────────────────────────────────────
 
@@ -229,15 +230,18 @@ export function createRegistryBackend(
 }
 
 /** 웹 터미널 셸이 열릴 작업 디렉토리를 정한다(실행 맥락 SSOT: 맥락은 «한 번» 정해지고 인자로 내려간다).
- *  순서: 탭이 명시한 cwd → 데몬이 정한 tool cwd → (격리 우주면) 우주 뿌리 → 데몬 프로세스 cwd.
+ *  순서: 탭이 명시한 cwd → 대화 프로젝트 폴더 → 데몬 tool cwd → (격리 우주면) 우주 뿌리 → 프로세스 cwd.
  *  ⛔ 격리(test) 우주에서 `process.cwd()` 로 떨어지면 셸이 «사람 작업 트리»에서 열린다(🅕 실측 2026-09-26). */
 export function resolveWebtermCwd(input: {
   tabCwd?: string;
+  sessionId?: string;
   toolCwd?: string;
   instance: { kind: 'prod' | 'test'; root: string };
   processCwd: string;
-}): { cwd: string; source: 'tab' | 'tool-cwd' | 'isolated-root' | 'process-cwd' } {
+}): { cwd: string; source: 'tab' | 'project' | 'tool-cwd' | 'isolated-root' | 'process-cwd' } {
   if (input.tabCwd) return { cwd: input.tabCwd, source: 'tab' };
+  const projectCwd = resolveSessionProjectContext(input.sessionId)?.cwd;
+  if (projectCwd) return { cwd: projectCwd, source: 'project' };
   if (input.toolCwd) return { cwd: input.toolCwd, source: 'tool-cwd' };
   if (input.instance.kind === 'test') return { cwd: input.instance.root, source: 'isolated-root' };
   return { cwd: input.processCwd, source: 'process-cwd' };

package/src/onboarding/cli-auth-status.ts

@@ -0,0 +1,80 @@
+import { spawnSync } from 'node:child_process';
+import { accessSync, constants, statSync } from 'node:fs';
+import { delimiter, join } from 'node:path';
+
+export type SkillCli = 'gh' | 'gws' | 'op' | 'himalaya';
+
+export interface CliAuthStatus {
+  cli: SkillCli;
+  found: boolean;
+  authenticated: boolean;
+  skippedReason?: string;
+}
+
+export interface CliAuthStatusDeps {
+  path?: string;
+  findExecutable?: (name: SkillCli, path: string) => string | null;
+  runStatus?: (executable: string, args: readonly string[]) => { status: number | null; stdout?: string; error?: unknown };
+}
+
+const STATUS_COMMANDS: readonly { cli: SkillCli; args: readonly string[] }[] = [
+  { cli: 'gh', args: ['auth', 'status'] },
+  { cli: 'gws', args: ['auth', 'status'] },
+  { cli: 'op', args: ['whoami'] },
+  { cli: 'himalaya', args: ['account', 'check'] },
+];
+
+function findOnPath(name: SkillCli, path: string): string | null {
+  for (const directory of path.split(delimiter).filter(Boolean)) {
+    const executable = join(directory, name);
+    try {
+      accessSync(executable, constants.X_OK);
+      if (statSync(executable).isFile()) return executable;
+    } catch { /* Try the next PATH entry. */ }
+  }
+  return null;
+}
+
+function runReadOnlyStatus(executable: string, args: readonly string[]) {
+  const result = spawnSync(executable, [...args], {
+    encoding: 'utf8', timeout: 5_000, maxBuffer: 64 * 1024,
+    stdio: ['ignore', 'pipe', 'ignore'],
+  });
+  return { status: result.status, stdout: result.stdout, error: result.error };
+}
+
+function gwsHasSession(stdout: string | undefined): boolean {
+  try {
+    const status: unknown = JSON.parse(stdout ?? '');
+    if (!status || typeof status !== 'object' || Array.isArray(status)) return false;
+    const auth = status as Record<string, unknown>;
+    return auth.token_valid === true;
+  } catch {
+    return false;
+  }
+}
+
+/** No credential-file reads, login calls, prompts, or token-bearing output leave this probe. */
+export function detectSkillCliAuth(deps: CliAuthStatusDeps = {}): CliAuthStatus[] {
+  const path = deps.path ?? process.env.PATH ?? '';
+  const find = deps.findExecutable ?? findOnPath;
+  const run = deps.runStatus ?? runReadOnlyStatus;
+  return STATUS_COMMANDS.map(({ cli, args }) => {
+    let executable: string | null;
+    try { executable = find(cli, path); }
+    catch { executable = null; }
+    if (!executable) return { cli, found: false, authenticated: false, skippedReason: 'not on PATH' };
+    try {
+      const result = run(executable, args);
+      if (result.error || result.status === null) {
+        return { cli, found: true, authenticated: false, skippedReason: 'status check unavailable' };
+      }
+      if (result.status !== 0 || (cli === 'gws' && !gwsHasSession(result.stdout))) {
+        return { cli, found: true, authenticated: false, skippedReason: 'not authenticated' };
+      }
+      return { cli, found: true, authenticated: true };
+    } catch {
+      return { cli, found: true, authenticated: false, skippedReason: 'status check unavailable' };
+    }
+  });
+}

package/src/onboarding/voice-ai.ts

@@ -154,12 +154,12 @@ export async function askVoiceAI(
 
   if (mode === 'preset') {
     // Phase 2 catalog isn't shipped yet; the wizard records the intent
-    // by keeping the user on Smart defaults but tagging persona='power'
+    // by keeping the user on Smart defaults but tagging profile='power'
     // so the auto-suggest hint in PWA opens the preset card directly.
     io.print('  (Preset catalog ships in Phase 2 · for now Smart defaults stay active.)');
     io.print('  elanous has noted your preference — preset hints will appear when ready.');
     return {
-      modelTier: { persona: 'power' },
+      modelTier: { profile: 'power' },
     };
   }
 
@@ -175,7 +175,7 @@ export async function askVoiceAI(
 
   const answer: VoiceAIAnswer = {
     modelTier: {
-      persona: 'custom',
+      profile: 'custom',
       voice: { stt: tier as ModelTier },
     },
   };

package/src/org/seat-budget.ts

@@ -0,0 +1,48 @@
+import { getUserConfig, type UserConfig } from '../user-config.js';
+import type { SeatEntry } from '../seat-loop/seat-loop.js';
+
+export const DEFAULT_DAILY_GOALS = 6;
+export const DEFAULT_CONCURRENT_PODS = 2;
+
+export type SeatBudgetResult = { allowed: true } | { allowed: false; reason: string };
+export type RunningSeatPod = { seat: string; substrate?: string; status?: string };
+export type SeatBudgetInput = {
+  seat: string;
+  now: Date;
+  ledger: readonly SeatEntry[];
+  running: readonly RunningSeatPod[];
+  config?: Pick<UserConfig, 'org'>;
+};
+
+function limit(value: unknown, fallback: number): number {
+  return typeof value === 'number' && Number.isSafeInteger(value) && value >= 0 ? value : fallback;
+}
+
+function day(date: Date): string {
+  return new Intl.DateTimeFormat('en-CA', { timeZone: 'Asia/Seoul', year: 'numeric', month: '2-digit', day: '2-digit' }).format(date);
+}
+
+/** A read-only seat quota judgment; the caller owns the launch and ledger write. */
+export function checkSeatBudget({ seat, now, ledger, running, config }: SeatBudgetInput): SeatBudgetResult {
+  const override = (config ?? getUserConfig()).org?.budget?.[seat];
+  const dailyGoals = limit(override?.dailyGoals, DEFAULT_DAILY_GOALS);
+  const concurrentPods = limit(override?.concurrentPods, DEFAULT_CONCURRENT_PODS);
+  const today = day(now);
+  const launchedToday = ledger.filter((entry) => entry.seat === seat && entry.status === 'launched'
+    && Number.isFinite(Date.parse(entry.ts ?? entry.at))
+    && day(new Date(entry.ts ?? entry.at)) === today).length;
+  if (launchedToday >= dailyGoals) {
+    return { allowed: false, reason: `${seat} daily goals budget reached (${launchedToday}/${dailyGoals})` };
+  }
+  const active = running.filter((run) => run.seat === seat && (run.status === undefined || run.status === 'running' || run.status === 'unknown'));
+  // Confirmed = a Pod known to be running; an unknown substrate OR unknown liveness only counts as «cannot verify».
+  const pods = active.filter((run) => run.substrate === 'pod' && run.status !== 'unknown').length;
+  if (pods >= concurrentPods) {
+    return { allowed: false, reason: `${seat} concurrent Pods budget reached (${pods}/${concurrentPods})` };
+  }
+  const unknown = active.filter((run) => run.substrate === undefined || run.status === 'unknown').length;
+  if (pods + unknown >= concurrentPods) {
+    return { allowed: false, reason: `${seat} concurrent Pods budget cannot be verified (${pods} confirmed, ${unknown} unknown; limit ${concurrentPods})` };
+  }
+  return { allowed: true };
+}

package/src/org/stall-escalation.ts

@@ -0,0 +1,63 @@
+import type { Checklist, ChecklistItem } from '../release-loop/checklist.js';
+import { parseOwner } from '../release-loop/checklist.js';
+import type { SeatLoopConfig } from '../user-config.js';
+
+export interface StallEscalation {
+  item: ChecklistItem;
+  from: string;
+  to: string;
+  stalledMin: number;
+  /** Stable start of this uninterrupted stall interval (independent of the observation clock). */
+  startedAt: string;
+  reason: 'red' | 'blocked';
+}
+
+/** A missing parent is intentional: OP has no automatic escalation destination. */
+export const DEFAULT_STALL_PARENTS: Readonly<Record<string, string>> = { MK: 'OP', TC: 'OP', UX: 'OP' };
+export const DEFAULT_RED_MINUTES = 30;
+export const DEFAULT_BLOCKED_MINUTES = 60;
+
+function stallReason(item: ChecklistItem): StallEscalation['reason'] | null {
+  if (item.status === 'red') return 'red';
+  return item.status === 'yellow' && item.disposition === 'block' ? 'blocked' : null;
+}
+
+/** Find the beginning of the current uninterrupted red/blocked interval, not the most recent evidence edit. */
+function stallStart(item: ChecklistItem, history: Checklist['history'], reason: StallEscalation['reason']): number {
+  const changes = history.filter((entry) => entry.id === item.id && (entry.field === 'status' || entry.field === 'disposition'))
+    .filter((entry) => Number.isFinite(Date.parse(entry.at)))
+    .sort((a, b) => Date.parse(b.at) - Date.parse(a.at));
+  let status = item.status;
+  let disposition = item.disposition;
+  for (const entry of changes) {
+    const current = status === 'red' ? 'red' : status === 'yellow' && disposition === 'block' ? 'blocked' : null;
+    if (entry.field === 'status') status = entry.from as ChecklistItem['status'];
+    else disposition = entry.from as ChecklistItem['disposition'];
+    const previous = status === 'red' ? 'red' : status === 'yellow' && disposition === 'block' ? 'blocked' : null;
+    if (current === reason && previous !== reason) return Date.parse(entry.at);
+  }
+  return Date.parse(item.updatedAt);
+}
+
+/** Pure checklist snapshot judgment. Age is measured in minutes against the injected clock. */
+export function findStalls(checklist: Checklist, config: SeatLoopConfig = { mode: 'off' }, now: Date = new Date()): StallEscalation[] {
+  const nowMs = now.getTime();
+  const parents = { ...DEFAULT_STALL_PARENTS, ...config.stall?.parents };
+  const results: StallEscalation[] = [];
+  for (const item of checklist.items) {
+    const reason = stallReason(item);
+    if (!reason || !item.owner) continue;
+    let from: string;
+    try { from = parseOwner(item.owner).seat; } catch { continue; }
+    const to = parents[from];
+    if (!to || to === from) continue;
+    const start = stallStart(item, checklist.history, reason);
+    if (!Number.isFinite(start) || start > nowMs) continue;
+    const stalledMin = (nowMs - start) / 60_000;
+    const threshold = reason === 'red' ? config.stall?.redMinutes ?? DEFAULT_RED_MINUTES
+      : config.stall?.blockedMinutes ?? DEFAULT_BLOCKED_MINUTES;
+    if (stalledMin < threshold) continue;
+    results.push({ item, from, to, stalledMin, startedAt: new Date(start).toISOString(), reason });
+  }
+  return results;
+}