elanous 0.2.5 → 0.2.6

package/src/field/field-media.ts

@@ -0,0 +1,245 @@
+// 현장(field) 업로드 폴더 계약 — HTTP 입구(`/v1/field/uploads`)와 텔레그램 `#현장` 이 «같은» 저장 함수를 쓴다.
+//
+// 폴더 계약(2026-09-30 합의 · 소비자 = reel 파이프라인):
+//   <configDir>/field/<event>/<ISO 기본형 타임스탬프>-<device>-<원래 이름>
+//   타임스탬프 = 클라이언트가 준 촬영 시각(있으면) · 없으면 업로드 시각 · UTC · `20261015T193012Z`(ISO 8601 기본형 —
+//   파일 이름에 콜론을 넣지 않으려고 기본형을 쓴다. 사전순 = 시간순).
+//   배치가 끝나면 `<folder>/.ready` 를 한 줄(= 폴더의 미디어 파일 수)로 덮어쓴다.
+
+import { appendFileSync, mkdirSync, readdirSync, renameSync, statSync, unlinkSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { randomUUID } from 'node:crypto';
+
+export const FIELD_SLUG_RE = /^[a-z0-9][a-z0-9._-]{0,63}$/;
+export const FIELD_MAX_FILE_BYTES = 100 * 1024 * 1024; // 폰 현장 사진·짧은 영상 — 데몬 전역 요청 한도를 과하게 올리지 않으려고 낮게(2026-09-30)
+export const FIELD_MAX_REQUEST_BYTES = 250 * 1024 * 1024;
+export const FIELD_READY_FILE = '.ready';
+const MAX_ORIGINAL_NAME = 80;
+
+/** 허용 MIME → 대표 확장자. heif 는 heic 의 별칭으로 받는다. */
+const MIME_EXT: Record<string, string> = {
+  'image/jpeg': 'jpg',
+  'image/jpg': 'jpg',
+  'image/png': 'png',
+  'image/heic': 'heic',
+  'image/heif': 'heic',
+  'image/webp': 'webp',
+  'video/mp4': 'mp4',
+  'video/quicktime': 'mov',
+};
+const EXT_MIME: Record<string, string> = {
+  jpg: 'image/jpeg', jpeg: 'image/jpeg', png: 'image/png', heic: 'image/heic', heif: 'image/heif',
+  webp: 'image/webp', mp4: 'video/mp4', mov: 'video/quicktime',
+};
+
+export type FieldUploadErrorCode = 'bad-slug' | 'unsupported-media-type' | 'too-large' | 'no-files' | 'bad-request';
+
+export class FieldUploadError extends Error {
+  constructor(readonly code: FieldUploadErrorCode, message: string) {
+    super(message);
+    this.name = 'FieldUploadError';
+  }
+  get status(): number {
+    if (this.code === 'unsupported-media-type') return 415;
+    if (this.code === 'too-large') return 413;
+    return 400;
+  }
+}
+
+export interface FieldMediaInput {
+  originalName: string;
+  mimeType?: string;
+  bytes: Uint8Array;
+  /** 촬영 시각(ISO 문자열·epoch ms). 못 읽으면 업로드 시각. */
+  capturedAt?: string | number | Date;
+}
+
+export interface FieldSaveOptions {
+  /** config 뿌리(`~/.elanous` 또는 격리 뿌리). 폴더 = `<rootDir>/field/<event>`. */
+  rootDir: string;
+  event: string;
+  device: string;
+  now?: () => Date;
+  /** 사람이 쓴 한 줄(텔레그램 캡션·앱 입력칸) — 있으면 `captions.txt` 에 «<첫 파일 이름> | <글>» 로 덧붙인다(reel 자막 · MK 2026-09-30). */
+  caption?: string;
+}
+
+export interface FieldSaveResult {
+  event: string;
+  dir: string;
+  saved: Array<{ name: string; bytes: number }>;
+  /** 저장 «후» 폴더의 미디어 파일 수(= `.ready` 에 쓴 값). */
+  count: number;
+}
+
+export function isFieldSlug(value: unknown): value is string {
+  return typeof value === 'string' && FIELD_SLUG_RE.test(value);
+}
+
+export function fieldEventDir(rootDir: string, event: string): string {
+  if (!isFieldSlug(event)) throw new FieldUploadError('bad-slug', 'event slug must match ^[a-z0-9][a-z0-9._-]{0,63}$');
+  return join(rootDir, 'field', event);
+}
+
+function extOf(name: string): string {
+  const dot = name.lastIndexOf('.');
+  return dot > 0 ? name.slice(dot + 1).toLowerCase() : '';
+}
+
+/** 허용 MIME 이면 정규화한 MIME, 아니면 null. MIME 이 비었거나 octet-stream 이면 확장자로 추정한다. */
+export function resolveFieldMime(mimeType: string | undefined, originalName: string): string | null {
+  const mime = (mimeType ?? '').split(';')[0]!.trim().toLowerCase();
+  if (mime && mime !== 'application/octet-stream') return MIME_EXT[mime] ? mime : null;
+  return EXT_MIME[extOf(originalName)] ?? null;
+}
+
+/** basename · `[A-Za-z0-9._-]` 외는 `_` · 앞 점 제거 · 최대 80자(확장자 보존) · 확장자가 MIME 과 안 맞으면 붙인다. */
+export function sanitizeFieldName(originalName: string, mime?: string): string {
+  const base = originalName.split(/[\\/]/).pop() ?? '';
+  let name = base.replace(/[^A-Za-z0-9._-]/g, '_').replace(/_+/g, '_').replace(/^\.+/, '');
+  const wantExt = mime ? MIME_EXT[mime] : undefined;
+  const ext = extOf(name);
+  if (wantExt && EXT_MIME[ext] === undefined) name = name ? `${name}.${wantExt}` : `media.${wantExt}`;
+  if (!name) name = 'media';
+  if (name.length > MAX_ORIGINAL_NAME) {
+    const e = extOf(name);
+    const suffix = e && e.length < 10 ? `.${e}` : '';
+    name = name.slice(0, MAX_ORIGINAL_NAME - suffix.length) + suffix;
+  }
+  return name;
+}
+
+/** `20261015T193012Z` — ISO 8601 기본형 UTC(초 단위). */
+export function fieldTimestamp(capturedAt: FieldMediaInput['capturedAt'], now: Date): string {
+  let at: Date | null = null;
+  if (capturedAt instanceof Date) at = capturedAt;
+  else if (typeof capturedAt === 'number') at = new Date(capturedAt);
+  else if (typeof capturedAt === 'string' && capturedAt.trim()) {
+    const trimmed = capturedAt.trim();
+    at = /^\d{10,13}$/.test(trimmed) ? new Date(Number(trimmed) * (trimmed.length === 10 ? 1000 : 1)) : new Date(trimmed);
+  }
+  if (!at || Number.isNaN(at.getTime())) at = now;
+  return at.toISOString().replace(/\.\d{3}Z$/, 'Z').replace(/[-:]/g, '');
+}
+
+function isMediaFile(name: string): boolean {
+  return !name.startsWith('.') && EXT_MIME[extOf(name)] !== undefined;
+}
+
+export function listFieldMedia(dir: string): Array<{ name: string; bytes: number }> {
+  let names: string[];
+  try { names = readdirSync(dir); }
+  catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return [];
+    throw error;
+  }
+  const out: Array<{ name: string; bytes: number }> = [];
+  for (const name of names.sort()) {
+    if (!isMediaFile(name)) continue;
+    try {
+      const st = statSync(join(dir, name));
+      if (st.isFile()) out.push({ name, bytes: st.size });
+    } catch { /* 사이에 지워졌다 */ }
+  }
+  return out;
+}
+
+function atomicWrite(dir: string, name: string, bytes: Uint8Array | string): void {
+  const tmp = join(dir, `.tmp-${randomUUID()}`);
+  try {
+    writeFileSync(tmp, bytes);
+    renameSync(tmp, join(dir, name));
+  } catch (error) {
+    try { unlinkSync(tmp); } catch { /* 없음 */ }
+    throw error;
+  }
+}
+
+/** `.ready` 를 «지금» 폴더의 미디어 파일 수로 덮어쓴다. */
+export function refreshFieldReady(dir: string): number {
+  const count = listFieldMedia(dir).length;
+  atomicWrite(dir, FIELD_READY_FILE, `${count}\n`);
+  return count;
+}
+
+/** 검증(전부) → 쓰기(전부, 원자적) → `.ready` 갱신. 하나라도 검증에 걸리면 아무것도 안 쓴다. */
+export function saveFieldMedia(inputs: FieldMediaInput[], opts: FieldSaveOptions): FieldSaveResult {
+  const dir = fieldEventDir(opts.rootDir, opts.event);
+  if (!isFieldSlug(opts.device)) throw new FieldUploadError('bad-slug', 'device slug must match ^[a-z0-9][a-z0-9._-]{0,63}$');
+  if (inputs.length === 0) throw new FieldUploadError('no-files', 'at least one file is required');
+  const now = (opts.now ?? (() => new Date()))();
+  let total = 0;
+  const planned = inputs.map((input) => {
+    const mime = resolveFieldMime(input.mimeType, input.originalName);
+    if (!mime) throw new FieldUploadError('unsupported-media-type', 'only jpeg/png/heic/webp images and mp4/mov videos are accepted');
+    const size = input.bytes.byteLength;
+    if (size === 0) throw new FieldUploadError('bad-request', 'empty file');
+    if (size > FIELD_MAX_FILE_BYTES) throw new FieldUploadError('too-large', 'a file exceeds 100 MB');
+    total += size;
+    if (total > FIELD_MAX_REQUEST_BYTES) throw new FieldUploadError('too-large', 'the request exceeds 250 MB');
+    const name = `${fieldTimestamp(input.capturedAt, now)}-${opts.device}-${sanitizeFieldName(input.originalName, mime)}`;
+    return { name, bytes: input.bytes };
+  });
+
+  mkdirSync(dir, { recursive: true });
+  const taken = new Set<string>();
+  const saved: FieldSaveResult['saved'] = [];
+  for (const item of planned) {
+    const name = uniqueName(dir, item.name, item.bytes.byteLength, taken);
+    taken.add(name);
+    atomicWrite(dir, name, item.bytes);
+    saved.push({ name, bytes: item.bytes.byteLength });
+  }
+  const line = normalizeFieldCaption(opts.caption);
+  if (line && saved[0]) appendFileSync(join(dir, FIELD_CAPTIONS_FILE), `${saved[0].name} | ${line}\n`);
+  const count = refreshFieldReady(dir);
+  return { event: opts.event, dir, saved, count };
+}
+
+/** 같은 이름·같은 크기면 재전송으로 보고 덮는다(중복 방지). 크기가 다르면 `-1`,`-2`… 를 붙인다. */
+function uniqueName(dir: string, name: string, size: number, taken: Set<string>): string {
+  const dot = name.lastIndexOf('.');
+  const stem = dot > 0 ? name.slice(0, dot) : name;
+  const ext = dot > 0 ? name.slice(dot) : '';
+  for (let i = 0; ; i += 1) {
+    const candidate = i === 0 ? name : `${stem}-${i}${ext}`;
+    if (taken.has(candidate)) continue;
+    let existing: number | null = null;
+    try { existing = statSync(join(dir, candidate)).size; } catch { existing = null; }
+    if (existing === null || existing === size) return candidate;
+  }
+}
+
+// ── 텔레그램 캡션 문법 ──────────────────────────────────────────────
+
+export const FIELD_CAPTION_TAG = '#현장';
+
+/** 캡션에 독립 토큰 `#현장` 이 있으면 `{ event? }`, 없으면 null.
+ *  `#현장 <slug>` — 바로 다음 토큰을 소문자로 바꿔 슬러그 규칙에 맞으면 행사 이름, 아니면 기본 행사. */
+export function parseFieldCaption(caption: string | undefined | null): { event?: string; text?: string } | null {
+  if (!caption) return null;
+  const tokens = caption.trim().split(/\s+/);
+  const at = tokens.indexOf(FIELD_CAPTION_TAG);
+  if (at < 0) return null;
+  const next = tokens[at + 1]?.toLowerCase();
+  const hasEvent = !!next && isFieldSlug(next);
+  // 태그·행사 이름을 뺀 나머지가 «글»(자막) — 태그 앞에 쓴 글도 같이.
+  const rest = tokens.filter((_, i) => i !== at && !(hasEvent && i === at + 1)).join(' ');
+  const text = normalizeFieldCaption(rest);
+  return { ...(hasEvent ? { event: next } : {}), ...(text ? { text } : {}) };
+}
+
+export const FIELD_CAPTIONS_FILE = 'captions.txt';
+
+/** 자막 한 줄 — 줄바꿈은 공백으로, `|` 는 구분자라 전각 `｜` 로, 280자까지. 비면 빈 값. */
+export function normalizeFieldCaption(value: string | undefined | null): string {
+  if (typeof value !== 'string') return '';
+  return value.replace(/[\r\n]+/g, ' ').replace(/\|/g, '｜').replace(/\s+/g, ' ').trim().slice(0, 280);
+}
+
+/** 기본 행사 = 유효한 config 값 · 없으면 `field-<로컬 YYYY-MM-DD>`. */
+export function defaultFieldEvent(configured: string | undefined, now: Date = new Date()): string {
+  if (configured && isFieldSlug(configured)) return configured;
+  const pad = (n: number) => String(n).padStart(2, '0');
+  return `field-${now.getFullYear()}-${pad(now.getMonth() + 1)}-${pad(now.getDate())}`;
+}

package/src/index.ts

@@ -26,6 +26,7 @@ import { CLI_HARNESS_DOGFOOD_ENTRANCE, CLI_HARNESS_ORCHESTRATE_ENTRANCE, describ
 import { collectCommandEntrances, renderCommandEntrances } from './self-dev/entrance-inventory.js';
 import { isGoalAuthorFileName } from './self-implement/goal-document.js';
 import { DEV_PIPELINE_SINK_SURFACE } from './self-implement/self-cli-sink-surface.js';
+import { registerPrivateLedgerCommands } from './cli/private-ledger-commands.js';
 import { applyTestStateDirFlagFromArgv } from './cli/test-state-dir-flag.js';
 import { applyTestFlagFromArgv, observeTestFlagOwnership, uncoveredTestFlagPaths, staleTestFlagPaths } from './cli/test-flag.js';
 import { registerPtyTakeoverCommands } from './cli/pty-takeover-cli.js';
@@ -5429,30 +5430,7 @@ program.command('ad [input...]')
   });
 
 registerDocsCommands(program);
-// Private local decision ledger follows the same JS-only dispatch path as directives.
-if (existsSync(resolve(import.meta.dir, 'cli/decisions-cli.ts')) || existsSync(resolve(import.meta.dir, 'cli/decisions-cli.js'))) {
-  program.command('decisions').description('대표 결정 로컬 원장').allowUnknownOption().allowExcessArguments(true)
-    .action(async (_opts: unknown, command: Command) => {
-      try { await (await import('./domains/standalone-log-sink.js')).registerStandaloneLogSink('decisions'); }
-      catch { /* Logging must not prevent recording a decision. */ }
-      const privateDecisionsModule: string = './cli/decisions-cli.js';
-      const { registerDecisionsCommands } = await import(privateDecisionsModule) as { registerDecisionsCommands: (program: Command) => void };
-      const privateProgram = new Command();
-      registerDecisionsCommands(privateProgram);
-      await privateProgram.parseAsync(['decisions', ...command.args], { from: 'user' });
-    });
-}
-// Private command is absent from the public export; JS-only distributions still register it.
-if (existsSync(resolve(import.meta.dir, 'cli/directives-cli.ts')) || existsSync(resolve(import.meta.dir, 'cli/directives-cli.js'))) {
-  program.command('directives').description('대표 지시 로컬 색인·검색').allowUnknownOption().allowExcessArguments(true)
-    .action(async (_opts: unknown, command: Command) => {
-      const privateDirectivesModule: string = './cli/directives-cli.js';
-      const { registerDirectivesCommands } = await import(privateDirectivesModule) as { registerDirectivesCommands: (program: Command) => void };
-      const privateProgram = new Command();
-      registerDirectivesCommands(privateProgram);
-      await privateProgram.parseAsync(['directives', ...command.args], { from: 'user' });
-    });
-}
+registerPrivateLedgerCommands(program);
 registerFleetCommands(program);
 
 // ── ops (운영 관측 — 지금 뭐 도나·이상 없나·상태 전이) ──
@@ -9935,6 +9913,22 @@ nexusCmd
     }
   });
 
+// 휴대폰 앱 온보딩 — 링크 하나(⊕ QR)로 이 Mac 의 넥서스에 붙인다(대표 2026-09-30 · 아이폰 첫 화면 단순화).
+program
+  .command('phone')
+  .description('Connect the phone app to this Mac')
+  .command('link')
+  .description('Print a one-tap connect link (and a QR code) for the Elanous phone app')
+  .option('--simulator', 'Use the loopback address (the simulator on this Mac) instead of the tailnet address — `--local` is taken by the global remote flag')
+  .option('--android [serial]', 'Hand the link straight to a USB-connected Android phone (adb reverse + am start · the token is never printed)')
+  .option('--temp', 'Use a short-lived token instead of the owner token')
+  .option('--ttl <duration>', 'Lifetime for --temp (max 24h)', '24h')
+  .option('--no-qr', 'Do not print a QR code')
+  .action(async (opts: { simulator?: boolean; android?: boolean | string; temp?: boolean; ttl: string; qr: boolean }) => {
+    const { runPhoneLink } = await import('./cli/phone-link.js');
+    process.exitCode = await runPhoneLink({ local: opts.simulator, android: opts.android, temp: opts.temp, ttl: opts.ttl, qr: opts.qr });
+  });
+
 // ── ACP — Agent Client Protocol (claude-code, codex, ...) ──
 const tokenCmd = program
   .command('token')

package/src/nexus/api/field-uploads.ts

@@ -0,0 +1,143 @@
+// 현장 업로드 입구 — POST/GET /v1/field/uploads (owner 전용).
+// 저장 규칙은 src/field/field-media.ts 가 유일한 정본이고 텔레그램 `#현장` 도 같은 함수를 쓴다.
+
+import { debug } from '../../debug/log.js';
+import { getElanousConfigDir } from '../../elanous-config-dir.js';
+import {
+  FIELD_MAX_FILE_BYTES,
+  FIELD_MAX_REQUEST_BYTES,
+  FieldUploadError,
+  fieldEventDir,
+  isFieldSlug,
+  listFieldMedia,
+  saveFieldMedia,
+  type FieldMediaInput,
+} from '../../field/field-media.js';
+import { jsonResponse } from './json-response.js';
+
+export const FIELD_UPLOADS_PATH = '/v1/field/uploads';
+
+/** 멀티파트 경계·헤더 여유. */
+const MULTIPART_SLACK_BYTES = 4 * 1024 * 1024;
+/** JSON 본문은 base64(×4/3) 라 더 크다. */
+const JSON_MAX_BODY_BYTES = Math.ceil((FIELD_MAX_REQUEST_BYTES * 4) / 3) + MULTIPART_SLACK_BYTES;
+/** Bun.serve 의 `maxRequestBodySize`(기본 128 MB) — 이 입구의 JSON 상한까지 받도록 서버가 이 값을 쓴다. */
+export const FIELD_SERVER_MAX_BODY_BYTES = JSON_MAX_BODY_BYTES;
+
+interface FieldUploadsDeps {
+  authorize?: (request: Request) => boolean;
+  /** config 뿌리 — 기본 `getElanousConfigDir()`(데몬의 다른 저장소와 같은 해석). 시험은 temp 를 준다. */
+  rootDir?: () => string;
+  now?: () => Date;
+}
+
+function errorResponse(error: FieldUploadError): Response {
+  return jsonResponse({ ok: false, error: error.code, reason: error.message }, error.status);
+}
+
+function parseCapturedAtList(values: FormDataEntryValue[]): Array<string | undefined> {
+  const strings = values.filter((v): v is string => typeof v === 'string');
+  if (strings.length === 1 && strings[0]!.trim().startsWith('[')) {
+    try {
+      const arr = JSON.parse(strings[0]!) as unknown;
+      if (Array.isArray(arr)) return arr.map((v) => (typeof v === 'string' || typeof v === 'number' ? String(v) : undefined));
+    } catch { /* 배열이 아니면 단일 값으로 */ }
+  }
+  return strings;
+}
+
+async function readMultipart(req: Request): Promise<FieldMediaInput[]> {
+  let form: FormData;
+  try { form = await req.formData(); }
+  catch { throw new FieldUploadError('bad-request', 'invalid multipart body'); }
+  const files = form.getAll('file').filter((v): v is File => typeof v !== 'string');
+  const captured = parseCapturedAtList(form.getAll('capturedAt'));
+  let total = 0;
+  const inputs: FieldMediaInput[] = [];
+  for (const [i, file] of files.entries()) {
+    if (file.size > FIELD_MAX_FILE_BYTES) throw new FieldUploadError('too-large', 'a file exceeds 100 MB');
+    total += file.size;
+    if (total > FIELD_MAX_REQUEST_BYTES) throw new FieldUploadError('too-large', 'the request exceeds 250 MB');
+    inputs.push({
+      originalName: file.name || 'media',
+      mimeType: file.type,
+      bytes: new Uint8Array(await file.arrayBuffer()),
+      ...(captured[i] ? { capturedAt: captured[i] } : {}),
+    });
+  }
+  return inputs;
+}
+
+async function readJson(req: Request): Promise<FieldMediaInput[]> {
+  let body: unknown;
+  try { body = await req.json(); }
+  catch { throw new FieldUploadError('bad-request', 'JSON body required'); }
+  const files = body && typeof body === 'object' && !Array.isArray(body) ? (body as { files?: unknown }).files : undefined;
+  if (!Array.isArray(files)) throw new FieldUploadError('bad-request', 'files[] required');
+  return files.map((raw) => {
+    const f = (raw ?? {}) as Record<string, unknown>;
+    if (typeof f.name !== 'string' || typeof f.dataBase64 !== 'string') {
+      throw new FieldUploadError('bad-request', 'each file needs name and dataBase64');
+    }
+    // base64 길이로 먼저 거른다 — 파일 상한(FIELD_MAX_FILE_BYTES)을 넘는 것을 디코드하지 않는다.
+    if (Math.floor((f.dataBase64.length * 3) / 4) > FIELD_MAX_FILE_BYTES + 3) {
+      throw new FieldUploadError('too-large', 'a file exceeds 100 MB');
+    }
+    const capturedAt = typeof f.capturedAt === 'string' || typeof f.capturedAt === 'number' ? f.capturedAt : undefined;
+    return {
+      originalName: f.name,
+      ...(typeof f.mimeType === 'string' ? { mimeType: f.mimeType } : {}),
+      bytes: new Uint8Array(Buffer.from(f.dataBase64, 'base64')),
+      ...(capturedAt !== undefined ? { capturedAt } : {}),
+    };
+  });
+}
+
+export async function handleFieldUploads(req: Request, deps: FieldUploadsDeps = {}): Promise<Response> {
+  const url = new URL(req.url);
+  if (url.pathname !== FIELD_UPLOADS_PATH) return jsonResponse({ error: 'not-found' }, 404);
+  if (!deps.authorize?.(req)) return jsonResponse({ error: 'unauthorized' }, 401);
+  const rootDir = (deps.rootDir ?? getElanousConfigDir)();
+  const event = url.searchParams.get('event') ?? '';
+  if (!isFieldSlug(event)) return errorResponse(new FieldUploadError('bad-slug', 'event slug must match ^[a-z0-9][a-z0-9._-]{0,63}$'));
+
+  if (req.method === 'GET') {
+    const files = listFieldMedia(fieldEventDir(rootDir, event));
+    debug.log('field.upload', 'listed', { count: files.length });
+    return jsonResponse({ event, count: files.length, files });
+  }
+  if (req.method !== 'POST') return jsonResponse({ error: 'method-not-allowed' }, 405);
+
+  const device = url.searchParams.get('device') ?? '';
+  if (!isFieldSlug(device)) return errorResponse(new FieldUploadError('bad-slug', 'device slug must match ^[a-z0-9][a-z0-9._-]{0,63}$'));
+
+  const contentType = (req.headers.get('content-type') ?? '').toLowerCase();
+  const isMultipart = contentType.startsWith('multipart/form-data');
+  const isJson = contentType.startsWith('application/json');
+  if (!isMultipart && !isJson) {
+    return errorResponse(new FieldUploadError('unsupported-media-type', 'use multipart/form-data or application/json'));
+  }
+  const declared = Number(req.headers.get('content-length') ?? '');
+  const bodyCap = isJson ? JSON_MAX_BODY_BYTES : FIELD_MAX_REQUEST_BYTES + MULTIPART_SLACK_BYTES;
+  if (Number.isFinite(declared) && declared > bodyCap) {
+    debug.log('field.upload', 'refused', { reason: 'too-large', declaredBytes: declared });
+    return errorResponse(new FieldUploadError('too-large', 'the request exceeds 250 MB'));
+  }
+
+  try {
+    const inputs = isMultipart ? await readMultipart(req) : await readJson(req);
+    const caption = url.searchParams.get('caption') ?? undefined;
+    const result = saveFieldMedia(inputs, { rootDir, event, device, ...(caption ? { caption } : {}), ...(deps.now ? { now: deps.now } : {}) });
+    debug.log('field.upload', 'saved', {
+      surface: 'http', files: result.saved.length, bytes: result.saved.reduce((n, s) => n + s.bytes, 0), count: result.count,
+    });
+    return jsonResponse({ ok: true, event, saved: result.saved, count: result.count });
+  } catch (error) {
+    if (error instanceof FieldUploadError) {
+      debug.log('field.upload', 'refused', { surface: 'http', reason: error.code });
+      return errorResponse(error);
+    }
+    debug.log('field.upload', 'failed', { surface: 'http' });
+    throw error;
+  }
+}

package/src/nexus/api/graph-approvals.ts

@@ -18,7 +18,54 @@ interface GraphApprovalItem {
   recent: Array<{ nodeId: string; ok: boolean; outcome?: string; summary?: string }>;
 }
 
+/** One decision this daemon applied through `POST /v1/graph-approvals/:graphId/:runId`. */
+interface GraphApprovalDecided {
+  graphId: string;
+  runId: string;
+  nodeId: string;
+  decision: 'approved' | 'rejected';
+  decidedAt: string;
+}
+
+export const GRAPH_DECISION_RING_CAPACITY = 100;
+export const GRAPH_DECISION_RING_MAX_AGE_MS = 30 * 60 * 1000;
+
+/**
+ * Recent decisions, in memory. The undecided list drops a run the moment it is decided, so
+ * another device (Fold ↔ iPhone) could only see «gone» — this ring lets it say «승인됨/거절됨».
+ * ⚠️ In-memory: a daemon restart forgets it, and a decision made outside this process
+ * (`elanous graph approve` CLI) is not recorded — clients keep a «decided elsewhere» fallback.
+ */
+export function createGraphDecisionRing(opts: { capacity?: number; maxAgeMs?: number; now?: () => number } = {}) {
+  const capacity = opts.capacity ?? GRAPH_DECISION_RING_CAPACITY;
+  const maxAgeMs = opts.maxAgeMs ?? GRAPH_DECISION_RING_MAX_AGE_MS;
+  const now = opts.now ?? Date.now;
+  let entries: Array<{ atMs: number; record: GraphApprovalDecided }> = [];
+  const prune = () => {
+    const cutoff = now() - maxAgeMs;
+    entries = entries.filter((entry) => entry.atMs > cutoff).slice(-capacity);
+  };
+  return {
+    record(decision: Omit<GraphApprovalDecided, 'decidedAt'>): void {
+      const atMs = now();
+      entries.push({ atMs, record: { ...decision, decidedAt: new Date(atMs).toISOString() } });
+      prune();
+    },
+    /** Newest first, pruned by age and capacity. */
+    list(): GraphApprovalDecided[] {
+      prune();
+      return entries.map((entry) => entry.record).reverse();
+    },
+  };
+}
+
+export type GraphDecisionRing = ReturnType<typeof createGraphDecisionRing>;
+
+const defaultDecisionRing = createGraphDecisionRing();
+
 interface GraphApprovalsDeps {
+  /** Injected in tests; production shares one per-process ring. */
+  decisions?: GraphDecisionRing;
   authorize?: (request: Request) => boolean;
   /** Credential the request carries, checked independently of same-origin (`bearerCredential`).
    * A decision needs a bearer token: same-origin alone is not trusted because behind
@@ -90,7 +137,8 @@ export async function handleGraphApprovals(req: Request, deps: GraphApprovalsDep
   if (!deps.authorize?.(req)) return jsonResponse({ error: 'unauthorized' }, 401);
   if (pathname === GRAPH_APPROVALS_PATH) {
     if (req.method !== 'GET') return jsonResponse({ error: 'method-not-allowed' }, 405);
-    return jsonResponse({ items: list(deps.root ?? effectiveInstanceRoot()) });
+    // ⭐ `items` is unchanged; `decided` is additive (newest first) for other devices' cards.
+    return jsonResponse({ items: list(deps.root ?? effectiveInstanceRoot()), decided: (deps.decisions ?? defaultDecisionRing).list() });
   }
   if (req.method !== 'POST') return jsonResponse({ error: 'method-not-allowed' }, 405);
   const authReason = deps.authReason?.(req);
@@ -120,6 +168,7 @@ export async function handleGraphApprovals(req: Request, deps: GraphApprovalsDep
     if (error instanceof Error && error.message.startsWith('run is not awaiting an undecided approval:')) return jsonResponse({ error: 'already-decided' }, 409);
     throw error;
   }
+  (deps.decisions ?? defaultDecisionRing).record({ graphId, runId, nodeId, decision });
   debug.log('approvals.graph', 'decided', { graphId, runId, nodeId, decision, by: `pwa:${authReason}` });
   return jsonResponse({ graphId, runId, decision });
 }