elanous 0.2.11 → 0.2.12

package/src/domains/outbound-alert.ts

@@ -17,6 +17,8 @@ import { getUserConfig, type UserConfig } from '../user-config.js';
 import { resolveChannelBotToken } from '../channel-bot-token.js';
 import { isOperationalKind, kindRouteTarget, logKindRouteFallback, mainHomeTarget } from './telegram-kind-route.js';
 import { debug } from '../debug/log.js';
+import { registerLogStoreSink, setLogInstanceName } from '../mss/logging/log-store.js';
+import type { LogSink } from '../mss/logging/sink.js';
 import { resolveDaemonEndpoint } from '../nexus/daemon-endpoint.js';
 import { effectiveInstanceRoot, prodInstanceRoot } from '../instance/resolve.js';
 // ★ origin 되돌림(대표 2026-07-12) — 미션 알림을 발신 채널(메인 Q&A 봇)로 되돌린다. type-only
@@ -36,6 +38,29 @@ function nexusUrl(): string | null {
 const ACP_TOKEN_PATH = join(getElanousConfigDir(), 'acp-token');
 const DEFERRED_PATH = conatusPath('outbound_deferred.jsonl');
 
+// CLI/cron do not inherit the daemon's StoreSink. Register once before the first
+// send, but never attach a second sink to a daemon which already owns one.
+let outboundLogSink: (() => void) | null = null;
+function ensureOutboundLogSink(): void {
+  if (outboundLogSink || inProcessOutbound || process.env.NODE_ENV === 'test') return;
+  try {
+    const logs = getUserConfig().logs;
+    setLogInstanceName(logs.instanceName);
+    outboundLogSink = registerLogStoreSink((s: LogSink) => debug.registerSink(s), 'outbound', logs.retention);
+    if (outboundLogSink) process.once('exit', outboundLogSink);
+  } catch { /* observations must not prevent delivery */ }
+}
+
+function botLabel(token: string): string {
+  // Telegram bot IDs are public numeric IDs; never log the token's secret suffix.
+  const id = token.split(':', 1)[0];
+  return /^\d+$/.test(id ?? '') ? `telegram:${id}` : 'telegram:configured';
+}
+
+function safeObservationLabel(value: string): string {
+  return /^[a-zA-Z0-9_./-]{1,160}$/.test(value) ? value : 'unknown';
+}
+
 // ── 발송 관측 (대표 지시 2026-07-15): 발송 시각·mode·밀림(burst/lag) 를 logs.db 에 남겨
 //    "실시간인지 밀린 것인지" 를 `elanous logs --category outbound.send` 로 판단 가능하게. ──
 /** 밀림(버스트) 판정 — 최근 창 내 이 수 이상 발송이 몰리면 밀려 나가는 중으로 본다. */
@@ -61,7 +86,7 @@ function logSend(
   extra: Record<string, unknown> = {},
   opts?: { level?: 'trace' | 'debug' | 'info' | 'warn' | 'error' | 'critical' },
 ): void {
-  try { debug.log('outbound.send', mode, { kind, ...extra }, opts); } catch { /* fail-open */ }
+  try { debug.log('outbound.send', mode, { kind: safeObservationLabel(kind), ...extra }, opts); } catch { /* fail-open */ }
 }
 
 /** 밀림 경고 임계 env 이름 — 비교 값은 여기서만 읽는다(호출부에 리터럴을 박지 않는다). */
@@ -143,12 +168,13 @@ function resolveBotToken(botId?: string): string | null {
 }
 
 /** origin(발신 채널)으로 직접 발송. 실패하면 호출자가 report 폴백/재시도한다. */
-function deliverToOrigin(origin: MissionOrigin, text: string): boolean {
+function deliverToOrigin(origin: MissionOrigin, text: string, onBot?: (bot: string) => void): boolean {
   if (origin.channel === 'discord') {
     if (!origin.channelId) return false;
     try {
       const token = resolveChannelBotToken('discord', getUserConfig())?.token;
       if (!token) return false;
+      onBot?.('discord:configured');
       const channelId = origin.discordThreadId || origin.channelId;
       const out = spillLongContent(text).text;
       for (let start = 0; start < out.length;) {
@@ -168,19 +194,21 @@ function deliverToOrigin(origin: MissionOrigin, text: string): boolean {
   if (origin.channel !== 'telegram' || origin.chatId == null) return false;
   const token = resolveBotToken(origin.botId);
   if (!token) return false;
+  onBot?.(botLabel(token));
   try { return sendTelegramRaw(token, origin.chatId, text, origin.threadId); } catch { return false; }
 }
 
 /** 보류분 일괄 발송 — 묶음 1건(아침 폭주 방지). 발송 건수 반환.
  *  무음 창 밖 첫 sendOutbound 가 자동 호출 + 06:31 플러시 크론이 보장. */
 export function flushDeferred(path = DEFERRED_PATH): number {
+  ensureOutboundLogSink();
   const observeFlush = (count: number, lagMin: number, kinds: string[]): void => {
     const lagWarnMin = flushLagWarnMin();
     const over = count > 0 && lagMin > lagWarnMin;
     logSend(
       'flush',
       'deferred-batch',
-      { count, lagMin, kinds, path, lagWarnMin },
+      { count, lagMin, kinds: kinds.map(safeObservationLabel), path, lagWarnMin },
       over ? { level: 'warn' } : undefined,
     );
   };
@@ -209,14 +237,28 @@ export function flushDeferred(path = DEFERRED_PATH): number {
     ...list.map(i => `\n── [${kst(i.ts)} · ${i.kind}] ──\n${i.text}`),
   ].join('\n');
   observeFlush(items.length, lagMin, [...new Set(items.map(i => i.kind))]);
+  const sendBatch = (text: string, kind: string, origin?: MissionOrigin): boolean => {
+    let bot = 'unknown';
+    const path = origin
+      ? (deliverToOrigin(origin, text, label => { bot = label; }) ? 'origin' : false)
+      : deliver(text, kind, label => { bot = label; }, 'deferred-flush');
+    if (path === 'daemon') return true;
+    try {
+      debug.log('outbound.send', path ? 'sent' : 'failed', {
+        kind: safeObservationLabel(kind), source: 'deferred-flush', bot,
+        chars: text.length, path: path || 'undeliverable',
+      });
+    } catch { /* observation must not change delivery */ }
+    return path !== false;
+  };
   let delivered = 0;
   // origin 없는 매매 알림만 report 묶음. 그 외는 kind 별로 운영 봇 경계를 유지한다.
   const noOrigin = items.filter(i => !i.origin);
   const tradingBatch = noOrigin.filter(i => !isOperationalKind(i.kind));
-  if (tradingBatch.length && deliver(fmt(tradingBatch), 'report')) delivered += tradingBatch.length;
+  if (tradingBatch.length && sendBatch(fmt(tradingBatch), 'report')) delivered += tradingBatch.length;
   for (const kind of new Set(noOrigin.filter(i => isOperationalKind(i.kind)).map(i => i.kind))) {
     const batch = noOrigin.filter(i => i.kind === kind);
-    if (deliver(fmt(batch), kind)) delivered += batch.length;
+    if (sendBatch(fmt(batch), kind)) delivered += batch.length;
   }
   // origin 있는 것 = 발신 채널·스레드별로 묶어 서로 다른 수신자에게 섞이지 않게 발송.
   const groups = new Map<string, { origin: MissionOrigin; list: Item[] }>();
@@ -228,7 +270,10 @@ export function flushDeferred(path = DEFERRED_PATH): number {
     if (!groups.has(key)) groups.set(key, { origin: it.origin, list: [] });
     groups.get(key)!.list.push(it);
   }
-  for (const g of groups.values()) { if (deliverToOrigin(g.origin, fmt(g.list))) delivered += g.list.length; }
+  for (const g of groups.values()) {
+    const kinds = new Set(g.list.map(i => i.kind));
+    if (sendBatch(fmt(g.list), kinds.size === 1 ? g.list[0]!.kind : 'mixed', g.origin)) delivered += g.list.length;
+  }
   // 전량 배달 성공 시에만 파일 제거(부분 실패는 다음 flush 재시도 — 성공분 중복은 드문 엣지 수용).
   if (delivered >= items.length) { try { unlinkSync(path); } catch { /* */ } }
   return delivered;
@@ -268,17 +313,19 @@ export function sendOutbound(text: string, kind = 'alert', origin?: (MissionOrig
   const source = origin?.surface || (callerPath
     ? relative(repoRoot, callerPath.startsWith('file://') ? fileURLToPath(callerPath) : callerPath).replace(/\\/g, '/')
     : 'unknown');
-  const logOutcome = (event: 'sent' | 'deferred' | 'failed'): void => {
-    try { debug.log('outbound.send', event, { kind, source, chars: text.length }); } catch { /* fail-open */ }
+  ensureOutboundLogSink();
+  let bot = origin?.channel === 'discord' ? 'discord:configured' : 'unknown';
+  const logOutcome = (event: 'sent' | 'deferred' | 'failed', path?: string): void => {
+    try { debug.log('outbound.send', event, { kind: safeObservationLabel(kind), source: safeObservationLabel(source), chars: text.length, bot, ...(path ? { path } : {}) }); } catch { /* fail-open */ }
   };
   // ★ 무음 우회(대표 2026-07-14) — 사용자가 최근(기본 30분) genuine 인텐트(타이핑/버튼탭)를 냈으면
   //   깨어있으므로 야간 무음이어도 즉시 발송(사용자 발원 흐름의 결과물이 아침까지 묶이지 않게).
   //   우회 시 flushDeferred 로 그간 보류분도 함께 전달(사용자가 지금 볼 수 있음).
   if (inQuietHours() && !userRecentlyActive()) {
     const queued = deferOutbound(text, kind, origin);
-    recordOutbound(text, kind); // 보류도 논리적 발송 — 회상 대상(데몬 미경유라 클라 기록)
-    logOutcome(queued ? 'deferred' : 'failed');
-    return true; // 보류 시 수락 — 적재 오류에서도 기존 호출측 재시도 계약 유지
+    if (queued) recordOutbound(text, kind); // 성공한 보류만 회상 대상
+    logOutcome(queued ? 'deferred' : 'failed', queued ? 'deferred' : 'queue-failed');
+    return queued; // 적재가 성공했을 때만 보류 수락
   }
   const bypass = inQuietHours();
   if (bypass) console.error('[outbound] 야간 무음 우회 — 최근 사용자 활동(깨어있음) → 즉시 발송 + 보류분 flush');
@@ -288,16 +335,15 @@ export function sendOutbound(text: string, kind = 'alert', origin?: (MissionOrig
   const { recentCount, burst } = recentSendBurst();
   logSend(bypass ? 'quiet-bypass' : 'realtime', kind, { burst, recentCount, ...(burst ? { backlog: true } : {}) });
   // ★ origin 되돌림(무음 밖) — 발신 채널로 직접 발송. 성공 시 종료, 실패면 report 폴백.
-  if (origin && deliverToOrigin(origin, text)) {
+  if (origin && deliverToOrigin(origin, text, (label) => { bot = label; })) {
     recordOutbound(text, kind);
-    logOutcome('sent');
+    logOutcome('sent', 'origin');
     return true;
   }
-  const path = deliver(text, kind);
-  // 원장 기록은 정확히 1회. 데몬 경유(daemon)면 /v1/outbound 핸들러(outbound-report.ts)
-  // 가 기록하므로 클라는 중복 금지 — 직접 폴백(direct·데몬 다운)만 클라가 기록.
+  const path = deliver(text, kind, (label) => { bot = label; }, source);
+  // 데몬 경유는 실제 라우터의 최종 결과만 기록한다. 직접 폴백과 미전달만 여기서 기록.
   if (path === 'direct') recordOutbound(text, kind);
-  logOutcome(path === false ? 'failed' : 'sent');
+  if (path !== 'daemon') logOutcome(path === false ? 'failed' : 'sent', path === false ? 'undeliverable' : path);
   return path !== false;
 }
 
@@ -318,7 +364,14 @@ export function classifyDaemonResponse(j: unknown): DaemonPathClass {
 /** 데몬 경로를 못 쓴 이유를 남긴다. 관측 실패가 발송을 막지 않음(recordOutbound 과 같은 fail-soft).
  *  비-ok 분류는 크론 운영자가 읽는 표준 출력에도 한 줄 — 싱크 미등록 스크립트에서도 즉시 보이게. */
 function logDaemonPath(classification: DaemonPathClass, kind: string, extra: Record<string, unknown> = {}): void {
-  try { debug.log('outbound.send', 'daemon-path', { classification, kind, ...extra }); } catch { /* fail-soft */ }
+  ensureOutboundLogSink();
+  try {
+    debug.log('outbound.send', 'daemon-path', {
+      classification, kind: safeObservationLabel(kind),
+      ...('hasToken' in extra ? { hasToken: extra.hasToken === true } : {}),
+      ...('inProcess' in extra ? { inProcess: extra.inProcess === true } : {}),
+    });
+  } catch { /* fail-soft */ }
   if (classification === 'ok') return;
   try { console.error(`[outbound] daemon-path ${classification}`); } catch { /* fail-soft */ }
 }
@@ -326,23 +379,33 @@ function logDaemonPath(classification: DaemonPathClass, kind: string, extra: Rec
 /** OB8 — the daemon registers its own in-process sender at startup. Inside the daemon, deliver() must never curl
  *  its own `/v1/outbound`: the curl is synchronous, the event loop that would answer it is the one it blocks, and the
  *  whole daemon freezes until the curl times out (~25 s · `unreachable`) — the message is lost (CS1 · 10-01). */
-export type InProcessOutbound = (text: string, kind: string) => Promise<boolean>;
+export type InProcessOutbound = (text: string, kind: string, source?: string, deferFailureObservation?: boolean) => Promise<boolean>;
 let inProcessOutbound: InProcessOutbound | null = null;
 export function setInProcessOutbound(send: InProcessOutbound | null): void { inProcessOutbound = send; }
 
 /** elanous `/v1/outbound` 우선 → 실패 시 텔레그램 직접. 성공 경로 반환(원장 중복방지용). */
-export function deliver(text: string, kind = 'alert'): 'daemon' | 'direct' | false {
+export function deliver(text: string, kind = 'alert', onBot?: (bot: string) => void, source?: string): 'daemon' | 'direct' | false {
   // 0) inside the daemon — route in-process, asynchronously; the caller's synchronous answer is «accepted».
   if (inProcessOutbound && process.env.SEND_VIA_ELANOUS !== '0') {
+    onBot?.('daemon:configured');
     const send = inProcessOutbound;
-    void send(text, kind)
+    const fallback = (): void => {
+      let bot = 'unknown';
+      const ok = sendTelegramDirect(text, kind, {}, label => { bot = label; });
+      if (ok) recordOutbound(text, kind);
+      try { debug.log('outbound.send', ok ? 'sent' : 'failed', {
+        kind: safeObservationLabel(kind), source: safeObservationLabel(source ?? 'daemon-fallback'),
+        bot, path: ok ? 'direct' : 'undeliverable', chars: text.length,
+      }); } catch { /* fail-open */ }
+    };
+    void send(text, kind, source, true)
       .then((ok) => {
         logDaemonPath(ok ? 'ok' : 'rejected', kind, { inProcess: true });
-        if (!ok && sendTelegramDirect(text, kind)) recordOutbound(text, kind);
+        if (!ok) fallback();
       })
-      .catch((error: unknown) => {
-        logDaemonPath('rejected', kind, { inProcess: true, error: error instanceof Error ? error.message : String(error) });
-        if (sendTelegramDirect(text, kind)) recordOutbound(text, kind);
+      .catch(() => {
+        logDaemonPath('rejected', kind, { inProcess: true });
+        fallback();
       });
     return 'daemon';
   }
@@ -351,20 +414,22 @@ export function deliver(text: string, kind = 'alert'): 'daemon' | 'direct' | fal
   if (process.env.SEND_VIA_ELANOUS !== '0') {
     let token = '';
     try { if (existsSync(ACP_TOKEN_PATH)) token = readFileSync(ACP_TOKEN_PATH, 'utf-8').trim(); } catch { /* no token */ }
-    const headers = ['Content-Type: application/json', ...(token ? [`Authorization: Bearer ${token}`] : [])];
+    const headers = ['Content-Type: application/json', 'X-Elanous-Client-Fallback: direct',
+      ...(source ? [`X-Elanous-Outbound-Source: ${safeObservationLabel(source)}`] : []),
+      ...(token ? [`Authorization: Bearer ${token}`] : [])];
     const nexus = nexusUrl();
     const j = nexus
       ? curlPost(`${nexus}/v1/outbound`, JSON.stringify({ text, markdown: false, kind }), headers)
       : null;
     const classification = classifyDaemonResponse(j);
-    if (classification === 'ok') return 'daemon';
+    if (classification === 'ok') { onBot?.('daemon:configured'); return 'daemon'; }
     daemonPath = nexus ? classification : 'not-found';
     const extra: Record<string, unknown> = { hasToken: token.length > 0 };
     if (j && typeof j === 'object' && 'error' in (j as object)) extra.error = (j as { error?: unknown }).error;
     logDaemonPath(classification, kind, extra);
   }
   // 2) fallback: 텔레그램 sendMessage 직접(3900자 분할) — 데몬 미경유라 클라가 원장 기록.
-  if (sendTelegramDirect(text, kind)) return 'direct';
+  if (sendTelegramDirect(text, kind, {}, onBot)) return 'direct';
   reportUndeliverable(kind, daemonPath);
   return false;
 }
@@ -379,7 +444,8 @@ function reportUndeliverable(kind: string, daemonPath: DaemonPathClass | 'not-fo
     root = effectiveInstanceRoot();
     universe = root === prodInstanceRoot() ? 'prod' : 'test';
   } catch { /* the report still goes out */ }
-  try { debug.log('outbound.send', 'undeliverable', { kind, daemonPath, universe, root }); } catch { /* fail-soft */ }
+  ensureOutboundLogSink();
+  try { debug.log('outbound.send', 'undeliverable', { kind: safeObservationLabel(kind), daemonPath, universe, root }); } catch { /* fail-soft */ }
   const hint = universe === 'prod'
     ? '운영 데몬이 떠 있는지 확인: elanous nexus show'
     : '운영으로 보내려면 설치본 elanous 로 실행하거나 ELANOUS_STATE_DIR=~/.elanous ELANOUS_CONFIG_DIR=~/.elanous 를 준다';
@@ -411,6 +477,7 @@ function sendTelegramRaw(token: string, chatId: string | number, text: string, t
 export function sendTelegramDirect(
   text: string, kind?: string,
   deps: { config?: UserConfig; sendRaw?: typeof sendTelegramRaw; legacyEnv?: typeof conatusEnv } = {},
+  onBot?: (bot: string) => void,
 ): boolean {
   const sendRaw = deps.sendRaw ?? sendTelegramRaw;
   let cfg: UserConfig | undefined;
@@ -418,7 +485,7 @@ export function sendTelegramDirect(
   if (cfg) {
     try {
       const target = kindRouteTarget(cfg, kind);
-      if (target) return sendRaw(target.botToken, String(target.chatId), text);
+      if (target) { onBot?.(botLabel(target.botToken)); return sendRaw(target.botToken, String(target.chatId), text); }
     } catch { /* unavailable channel routing: fall through */ }
     // A declared table is authoritative: missing roles cannot escape to an env bot.
     if (cfg.telegram.channels?.length) {
@@ -437,7 +504,7 @@ export function sendTelegramDirect(
     } catch { /* unavailable main bot */ }
     const rcToken = cfg?.telegram.reportChannel?.botToken;
     logKindRouteFallback(kind, home ? 'main-home' : 'none', !!mainToken && !!cfg?.telegram.reportChannel && (!rcToken || rcToken === mainToken));
-    if (home) return sendRaw(home.botToken, String(home.chatId), text);
+    if (home) { onBot?.(botLabel(home.botToken)); return sendRaw(home.botToken, String(home.chatId), text); }
     console.error('[outbound] 운영 kind 메인 봇/홈 미설정 — 콘솔 출력\n' + text);
     return false;
   }
@@ -450,5 +517,6 @@ export function sendTelegramDirect(
   }
   logKindRouteFallback(kind, tok && chat ? 'conatus-env' : 'none', false);
   if (!tok || !chat) { console.error('[outbound] 토큰/chat 미설정 — 콘솔 출력\n' + text); return false; }
+  onBot?.(botLabel(tok));
   return sendRaw(tok, chat, text);
 }

package/src/domains/outbound-log-probe.ts

@@ -0,0 +1,8 @@
+import { sendOutbound, setInProcessOutbound } from './outbound-alert.js';
+import { setUserConfigOverlay } from '../user-config.js';
+
+// Focused subprocess fixture: isolated state/config roots and a fake curl on PATH.
+setUserConfigOverlay(cfg => ({ ...cfg, telegram: { ...cfg.telegram, botToken: '123456:private-secret', homeChannel: 98765 } }));
+process.env.SEND_VIA_ELANOUS = '0';
+setInProcessOutbound(null);
+if (!sendOutbound('SECRET-BODY-DO-NOT-LOG', 'ops-alert', { channel: 'cli', surface: process.env.OUTBOUND_PROBE_SOURCE ?? 'outbound-log-probe' })) process.exitCode = 1;

package/src/execution-loop/launch-gate.ts

@@ -26,17 +26,20 @@ export function activeRunsForGoal(goalId: string, deps: ActiveRunsForGoalDeps =
     const loadLedger = deps.loadLedger ?? loadRunLedger;
     const readGoalDocument = deps.readGoalDocument ?? ((path: string) => readFileSync(path, 'utf8'));
     let unknown = observation.completeness !== 'complete' || observation.pty.unreadable.length > 0;
+    const unknownReasons = new Set<string>();
+    if (observation.completeness !== 'complete') unknownReasons.add(`ledger observation ${observation.completeness}`);
+    for (const root of observation.pty.unreadable) unknownReasons.add(`unreadable PTY: ${root}`);
     const active = new Set<string>();
     for (const run of observation.entries) {
       if (run.status === 'ended-unclosed') continue;
-      if (run.ledgerDirectories.length === 0) { unknown = true; continue; }
+      if (run.ledgerDirectories.length === 0) { unknown = true; unknownReasons.add(`${run.runId}: ledger directory absent`); continue; }
       let identified = false;
       for (const directory of run.ledgerDirectories) {
         try {
           const ledger = loadLedger(run.runId, directory);
-          if (ledger === null) { unknown = true; continue; }
+          if (ledger === null) { unknown = true; unknownReasons.add(`${run.runId}: ledger unavailable`); continue; }
           const ids = new Set(ledger.flatMap((entry) => entry.goalId ? [entry.goalId] : []));
-          if (ids.size !== 1) { unknown = true; continue; }
+          if (ids.size !== 1) { unknown = true; unknownReasons.add(`${run.runId}: expected one goalId, found ${ids.size}`); continue; }
           identified = true;
           let matches = ids.has(goalId);
           if (!matches && goalId.startsWith('request-') && run.status === 'running' && run.ptyRefs.length > 0) {
@@ -45,20 +48,26 @@ export function activeRunsForGoal(goalId: string, deps: ActiveRunsForGoalDeps =
               try {
                 const ask = extractVerbatimOriginalAsk(readGoalDocument(document));
                 matches = ask?.range !== undefined && launchRequestId(ask.ask) === goalId;
-              } catch { unknown = true; }
+              } catch { unknown = true; unknownReasons.add(`${run.runId}: goal document unreadable`); }
             }
           }
           if (matches) {
             if (run.status === 'running' && run.ptyRefs.length > 0) active.add(run.runId);
-            else unknown = true;
+            else { unknown = true; unknownReasons.add(`${run.runId}: matching ledger without live PTY`); }
           }
-        } catch { unknown = true; }
+        } catch { unknown = true; unknownReasons.add(`${run.runId}: ledger read failed`); }
       }
       if (!identified) unknown = true;
     }
     // Positive evidence wins even if a different process or store is unreadable.
-    return active.size > 0 ? [...active].sort() : unknown ? 'unknown' : [];
-  } catch {
+    if (active.size > 0) return [...active].sort();
+    if (unknown) {
+      try { debug.log('execution-loop.launch-gate', 'active-runs-unknown', { goalId, reasons: [...unknownReasons] }); } catch { /* observation is fail-soft */ }
+      return 'unknown';
+    }
+    return [];
+  } catch (error) {
+    try { debug.log('execution-loop.launch-gate', 'active-runs-unknown', { goalId, reasons: [error instanceof Error ? error.message : String(error)] }); } catch { /* observation is fail-soft */ }
     return 'unknown';
   }
 }

package/src/field-note/telegram.ts

@@ -0,0 +1,142 @@
+import { copyFileSync, existsSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
+import { randomUUID } from 'node:crypto';
+import { join } from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { generateFieldNote, type FieldPhoto, type TranscriptEntry } from './index.js';
+import { transcribeFieldAudio, type FieldAudio, type TranscriptionEngine } from './transcribe.js';
+import type { TgIncoming, TgIncomingAttachment } from '../telegram.js';
+
+interface SavedMedia { kind: 'photo' | 'voice' | 'audio'; file: string; receivedAt: string; messageId: number }
+interface NoteWindow { title: string; start: string; end: string; status: 'open' | 'done'; openedBy: number; media: SavedMedia[]; notePath?: string }
+
+export interface TelegramFieldNoteDeps {
+  rootDir: string;
+  download: (fileId: string) => Promise<{ localPath: string }>;
+  reply: (ctx: TgIncoming, text: string) => Promise<void>;
+  engine?: TranscriptionEngine;
+  decodeAudio?: (file: string, recordedAt: string) => FieldAudio;
+  now?: () => Date;
+}
+
+/** Decode Telegram's Ogg/Opus (or audio file) into NOTE3a's 16kHz mono float PCM. */
+export function decodeFieldAudio(file: string, recordedAt: string): FieldAudio {
+  const result = spawnSync('ffmpeg', ['-v', 'error', '-i', file, '-f', 'f32le', '-ac', '1', '-ar', '16000', 'pipe:1'], { maxBuffer: 1024 * 1024 * 1024 });
+  if (result.status !== 0) throw new Error(`음성 디코딩 실패: ${result.stderr.toString().trim() || result.error?.message || 'ffmpeg'}`);
+  if (result.stdout.length % 4) throw new Error('음성 디코딩 실패: 잘못된 PCM 길이');
+  const bytes = result.stdout;
+  const samples = new Float32Array(bytes.length / 4);
+  for (let i = 0; i < samples.length; i++) samples[i] = bytes.readFloatLE(i * 4);
+  return { samples, sampleRate: 16000, recordedAt };
+}
+
+function windowPath(ctx: TgIncoming, root: string): string {
+  const bot = (ctx.botId ?? 'bot').replace(/[^a-zA-Z0-9_-]/g, '_');
+  return join(root, 'field-notes', 'telegram', bot, String(ctx.chatId), String(ctx.threadId ?? 0), String(ctx.userId), 'window.json');
+}
+
+function readWindow(path: string): NoteWindow | null {
+  return existsSync(path) ? JSON.parse(readFileSync(path, 'utf8')) as NoteWindow : null;
+}
+
+function saveWindow(path: string, window: NoteWindow): void {
+  mkdirSync(join(path, '..'), { recursive: true });
+  const temp = `${path}.${randomUUID()}.tmp`;
+  try {
+    writeFileSync(temp, JSON.stringify(window, null, 2) + '\n');
+    renameSync(temp, path);
+  } finally {
+    if (existsSync(temp)) unlinkSync(temp);
+  }
+}
+
+function parseWindow(text: string, now: Date): { title: string; start: string; end: string } | null {
+  const match = /^노트:\s*(.+?)\s+(\d{2}):(\d{2})\s*[~～]\s*(\d{2}):(\d{2})$/.exec(text.trim());
+  if (!match) return null;
+  const [, title, h1, m1, h2, m2] = match;
+  if (!Number.isFinite(now.getTime()) || +h1! > 23 || +h2! > 23 || +m1! > 59 || +m2! > 59) return null;
+  const local = new Date(now.getTime() + 9 * 60 * 60_000).toISOString().slice(0, 10);
+  const start = new Date(`${local}T${h1}:${m1}:00+09:00`);
+  const end = new Date(`${local}T${h2}:${m2}:00+09:00`);
+  if (end <= start) return null;
+  return { title: title!.trim(), start: start.toISOString(), end: end.toISOString() };
+}
+
+export async function handleTelegramFieldNote(ctx: TgIncoming, deps: TelegramFieldNoteDeps): Promise<boolean> {
+  const text = ctx.text.trim();
+  const path = windowPath(ctx, deps.rootDir);
+  if (text.startsWith('노트:')) {
+    const parsed = parseWindow(text, ctx.receivedAt ? new Date(ctx.receivedAt) : (deps.now ?? (() => new Date()))());
+    if (!parsed) await deps.reply(ctx, '노트 시간 형식: 노트: 세미나 18:00~20:00');
+    else {
+      const previous = readWindow(path);
+      if (previous?.status === 'open' && previous.media.length) {
+        await deps.reply(ctx, '열린 노트 창이 있습니다 — 먼저 노트 만들기를 완료하세요.');
+        return true;
+      }
+      saveWindow(path, { ...parsed, status: 'open', openedBy: ctx.messageId, media: [] });
+      await deps.reply(ctx, `노트 창 열림 · ${parsed.title} · ${text.slice(text.lastIndexOf(' ') + 1)}`);
+    }
+    return true;
+  }
+  if (text !== '노트 만들기' && !ctx.attachments.some((a) => a.kind === 'photo' || a.kind === 'voice' || a.kind === 'audio')) return false;
+  const window = readWindow(path);
+  if (text === '노트 만들기') {
+    if (!window || window.status !== 'open') {
+      await deps.reply(ctx, '열린 노트 창 없음');
+      return true;
+    }
+    if (window.media.some((item) => item.kind !== 'photo') && !deps.engine) {
+      await deps.reply(ctx, '전사 엔진 없음 — NOTE3a 전사 엔진을 설정해 주세요. 모은 파일은 유지됩니다.');
+      return true;
+    }
+    try {
+      const photos: FieldPhoto[] = window.media.filter((item) => item.kind === 'photo').map((item) => ({ file: item.file, exifTakenAt: item.receivedAt }));
+      const transcript: TranscriptEntry[] = [];
+      for (const item of window.media.filter((m) => m.kind !== 'photo')) {
+        const audio = (deps.decodeAudio ?? decodeFieldAudio)(item.file, item.receivedAt);
+        transcript.push(...await transcribeFieldAudio(audio, deps.engine!));
+      }
+      const markdown = await generateFieldNote(photos, transcript, {
+        summarize: async (entries) => entries.map((entry) => `${entry.timestamp} · ${entry.speaker}: ${entry.text}`).join('\n'),
+      });
+      const notePath = join(path, '..', `note-${window.openedBy}.md`);
+      const noteTemp = `${notePath}.${randomUUID()}.tmp`;
+      try {
+        writeFileSync(noteTemp, `# ${window.title}\n\n시간 창: ${window.start} ~ ${window.end}\n\n${markdown}`);
+        renameSync(noteTemp, notePath);
+      } finally {
+        if (existsSync(noteTemp)) unlinkSync(noteTemp);
+      }
+      saveWindow(path, { ...window, status: 'done', notePath });
+      await deps.reply(ctx, `노트 생성 · ${notePath}`);
+    } catch (error) {
+      await deps.reply(ctx, `노트 생성 실패 · ${error instanceof Error ? error.message : String(error)}`);
+    }
+    return true;
+  }
+  if (!window || window.status !== 'open') return false;
+  const media = ctx.attachments.filter((a): a is TgIncomingAttachment & { kind: 'photo' | 'voice' | 'audio' } =>
+    a.kind === 'photo' || a.kind === 'voice' || a.kind === 'audio');
+  if (!media.length) return false;
+  const receivedAt = ctx.receivedAt ?? (deps.now ?? (() => new Date()))().toISOString();
+  if (ctx.messageId <= window.openedBy || receivedAt < window.start || receivedAt > window.end) return false;
+  const dir = join(path, '..', 'media');
+  mkdirSync(dir, { recursive: true });
+  try {
+    for (const [index, item] of media.entries()) {
+      if (window.media.some((saved) => saved.messageId === ctx.messageId && saved.kind === item.kind)) continue;
+      const downloaded = await deps.download(item.fileId);
+      const extension = item.kind === 'photo' ? 'jpg' : item.kind === 'voice' ? 'ogg'
+        : item.mimeType === 'audio/mpeg' ? 'mp3' : item.mimeType === 'audio/ogg' ? 'ogg' : 'audio';
+      const file = join(dir, `${ctx.messageId}-${index}.${extension}`);
+      try { copyFileSync(downloaded.localPath, file); }
+      finally { try { unlinkSync(downloaded.localPath); } catch { /* download may be reused by the caller */ } }
+      window.media.push({ kind: item.kind, file, receivedAt, messageId: ctx.messageId });
+      saveWindow(path, window);
+    }
+    await deps.reply(ctx, `노트 파일 모음 · 사진 ${window.media.filter((m) => m.kind === 'photo').length}장 · 음성 ${window.media.filter((m) => m.kind !== 'photo').length}개`);
+  } catch (error) {
+    await deps.reply(ctx, `노트 파일 저장 실패 · ${error instanceof Error ? error.message : String(error)}`);
+  }
+  return true;
+}

package/src/graph-runner/graph-grow-llm.ts

@@ -1,25 +1,35 @@
-import { streamLLM } from '../llm.js';
+import { PROVIDERS, streamLLM } from '../llm.js';
+import { getUserConfig, resolveRoleLlm, type UserConfig } from '../user-config.js';
 import type { GrowthProposal, GrowthProposer } from './graph-grow.js';
 
 type GrowthLLM = (prompt: string) => Promise<string>;
-const OUTPUT_TAIL_LENGTH = 4000;
+const OUTPUT_TAIL_LENGTH = 2000;
+
+export function graphGrowthLlmOptions(config: UserConfig): { model?: string; provider?: string } {
+  const role = config.roleLlm?.['graph-grow'];
+  if (!role || (!role.provider && !role.model && !role.tier)) return {};
+  const selected = resolveRoleLlm('graph-grow', { config });
+  return { model: selected.model, provider: selected.provider };
+}
+
+async function defaultGrowthLLM(prompt: string): Promise<string> {
+  const selected = graphGrowthLlmOptions(getUserConfig());
+  return streamLLM([{ role: 'user', content: prompt }], () => {}, {
+    ...(selected.model ? { model: selected.model, provider: PROVIDERS[selected.provider!] } : {}),
+    reasoningEffort: 'low',
+  });
+}
 
 /** Model output is untrusted: structural and side-effect validation belongs to proposeGrowth. */
-export function createLLMGrowthProposer(callLLM: GrowthLLM = (prompt) =>
-  streamLLM([{ role: 'user', content: prompt }], () => {}, { reasoningEffort: 'low' })): GrowthProposer {
+export function createLLMGrowthProposer(callLLM: GrowthLLM = defaultGrowthLLM): GrowthProposer {
   return async (input: Parameters<GrowthProposer>[0]) => {
     const serializedOutput = typeof input.output === 'string' ? input.output : input.output === undefined ? '' : JSON.stringify(input.output);
-    const graphSummary = {
-      graphId: input.graph.graphId,
-      nodes: input.graph.nodes.map(({ nodeId, kind, recipe }) => ({ nodeId, kind, recipe })),
-      edges: input.graph.edges.map(({ from, to, on, map, fallback }) => ({ from, ...(to === undefined ? {} : { to }),
-        ...(on === undefined ? {} : { on }), ...(map === undefined ? {} : { map }), ...(fallback === undefined ? {} : { fallback }) })),
-    };
     const prompt = [
-      'Propose exactly one new contracted graph node to handle the unseen outcome, then return to an existing node.',
-      'Reply with only JSON: {"node":{"nodeId":"...","kind":"...","recipe":"none","maxVisits":1,"contract":{"inputs":[],"tools":"read-only","outputs":[]}},"returnTo":"existing-node-id","reason":"..."}.',
+      'Propose exactly one new contracted graph node to handle the unseen outcome and one return edge to an existing node.',
+      'Reply with only JSON: {"node":{"nodeId":"...","kind":"agent","recipe":"none","maxVisits":1,"contract":{"inputs":[],"tools":"read-only","outputs":[]}},"returnTo":"existing-node-id","reason":"..."}.',
+      'Use only an existing recipe type (none, an existing cmd:/approval: recipe ID, or a catalog role); never invent commands. The missing-outcome edge and the return edge are built from node and returnTo after validation.',
       'Do not alter existing nodes or edges. The proposal will be validated independently; do not assume a recipe is safe.',
-      `Graph summary: ${JSON.stringify(graphSummary)}`,
+      `Graph snapshot: ${JSON.stringify(input.graph)}`,
       `Blocked node ID: ${JSON.stringify(input.nodeId)}`,
       `Unseen outcome: ${JSON.stringify(input.outcome)}`,
       `Blocked node output tail: ${JSON.stringify(serializedOutput.slice(-OUTPUT_TAIL_LENGTH))}`,

package/src/graph-runner/graph-grow.ts

@@ -25,8 +25,11 @@ export async function proposeGrowth(input: Parameters<GrowthProposer>[0],
   catch (error) { return { ok: false, reason: `proposer failed: ${String(error)}` }; }
   if (!proposal) return { ok: false, reason: 'no proposal' };
   if (!proposal.node || typeof proposal.reason !== 'string' || !proposal.reason.trim()) return { ok: false, reason: 'proposal requires a node and reason' };
-  const result = createGraphVariant({ template: input.graph, goal: `g_${input.runId.replace(/[^a-z0-9_-]/gi, '_')}`,
-    plan: { growth: { node: proposal.node, from: input.nodeId, outcome: input.outcome, returnTo: proposal.returnTo } } });
+  let result: ReturnType<typeof createGraphVariant>;
+  try {
+    result = createGraphVariant({ template: input.graph, goal: `g_${input.runId.replace(/[^a-z0-9_-]/gi, '_')}`,
+      plan: { growth: { node: proposal.node, from: input.nodeId, outcome: input.outcome, returnTo: proposal.returnTo } } });
+  } catch (error) { return { ok: false, reason: `growth rejected: ${String(error)}` }; }
   if (!result.ok) return { ok: false, reason: `growth rejected: ${JSON.stringify(result.rejections)}` };
   // Neither a recipe id nor its declared tools certify arbitrary executable code.
   // Only a trusted classification of the resolved recipe may authorize execution.