elanous 0.2.5 → 0.2.6

package/src/relay/channel.ts

@@ -0,0 +1,184 @@
+import { createHash, timingSafeEqual } from 'node:crypto';
+import sodium from 'libsodium-wrappers';
+
+/** Maximum size of a complete encrypted frame, including sequence and MAC. */
+export const MAX_FRAME_BYTES = 1024 * 1024;
+const SEQUENCE_BYTES = 8;
+const MAC_BYTES = 16;
+const NONCE_BYTES = 24;
+const MAX_SEQUENCE = (1n << 64n) - 1n;
+
+export type ChannelResult<T> = { ok: true; value: T } | { ok: false; reason: string };
+export interface DaemonKeyPair {
+  publicKey: Uint8Array;
+  secretKey: Uint8Array;
+}
+export interface SerializedDaemonKeyPair {
+  publicKey: string;
+  secretKey: string;
+}
+
+function rejected<T>(reason: string): ChannelResult<T> {
+  return { ok: false, reason };
+}
+
+function validKey(key: Uint8Array): boolean {
+  return key instanceof Uint8Array && key.length === 32;
+}
+
+function equalKeys(left: Uint8Array, right: Uint8Array): boolean {
+  return validKey(left) && validKey(right) && timingSafeEqual(left, right);
+}
+
+/** The daemon persists this pair; the phone creates a fresh pair per connection. */
+export async function generateDaemonKeyPair(seed?: Uint8Array): Promise<DaemonKeyPair> {
+  await sodium.ready;
+  if (seed !== undefined && !validKey(seed)) throw new RangeError('X25519 seed must be 32 bytes');
+  const pair = seed === undefined ? sodium.crypto_kx_keypair() : sodium.crypto_kx_seed_keypair(seed);
+  return { publicKey: pair.publicKey, secretKey: pair.privateKey };
+}
+
+export function serverIdFromPublicKey(publicKey: Uint8Array): string {
+  if (!validKey(publicKey)) throw new RangeError('X25519 public key must be 32 bytes');
+  return createHash('sha256').update(publicKey).digest('hex');
+}
+
+export function serializeDaemonKeyPair(pair: DaemonKeyPair): SerializedDaemonKeyPair {
+  if (!validKey(pair.publicKey) || !validKey(pair.secretKey)) throw new RangeError('invalid X25519 key pair');
+  return { publicKey: Buffer.from(pair.publicKey).toString('base64'), secretKey: Buffer.from(pair.secretKey).toString('base64') };
+}
+
+export async function deserializeDaemonKeyPair(serialized: SerializedDaemonKeyPair): Promise<ChannelResult<DaemonKeyPair>> {
+  await sodium.ready;
+  if (typeof serialized?.publicKey !== 'string' || typeof serialized?.secretKey !== 'string' ||
+      !/^[A-Za-z0-9+/]{43}=$/.test(serialized.publicKey) || !/^[A-Za-z0-9+/]{43}=$/.test(serialized.secretKey)) {
+    return rejected('invalid daemon key serialization');
+  }
+  const publicKey = new Uint8Array(Buffer.from(serialized.publicKey, 'base64'));
+  const secretKey = new Uint8Array(Buffer.from(serialized.secretKey, 'base64'));
+  try {
+    if (!validKey(publicKey) || !validKey(secretKey) ||
+        !equalKeys(sodium.crypto_scalarmult_base(secretKey), publicKey)) {
+      return rejected('invalid daemon key pair');
+    }
+  } catch {
+    return rejected('invalid daemon key pair');
+  }
+  return { ok: true, value: { publicKey, secretKey } };
+}
+
+function sequenceBytes(sequence: bigint): Uint8Array {
+  const bytes = new Uint8Array(SEQUENCE_BYTES);
+  new DataView(bytes.buffer).setBigUint64(0, sequence, false);
+  return bytes;
+}
+
+function nonceFor(sequence: bigint): Uint8Array {
+  const nonce = new Uint8Array(NONCE_BYTES);
+  nonce.set(sequenceBytes(sequence), NONCE_BYTES - SEQUENCE_BYTES);
+  return nonce;
+}
+
+/** Each direction uses its own crypto_kx key and monotonically increasing sequence. */
+export class EncryptedChannel {
+  private sendSequence = 0n;
+  private receiveSequence = 0n;
+  private readonly sendKey: Uint8Array;
+  private readonly receiveKey: Uint8Array;
+
+  constructor(sendKey: Uint8Array, receiveKey: Uint8Array) {
+    if (!validKey(sendKey) || !validKey(receiveKey)) throw new RangeError('invalid session keys');
+    this.sendKey = new Uint8Array(sendKey);
+    this.receiveKey = new Uint8Array(receiveKey);
+  }
+
+  seal(plaintext: Uint8Array): ChannelResult<Uint8Array> {
+    if (!(plaintext instanceof Uint8Array)) return rejected('invalid plaintext');
+    if (plaintext.length + SEQUENCE_BYTES + MAC_BYTES > MAX_FRAME_BYTES) return rejected('frame exceeds 1MB');
+    if (this.sendSequence > MAX_SEQUENCE) return rejected('send sequence exhausted');
+    const header = sequenceBytes(this.sendSequence);
+    try {
+      const ciphertext = sodium.crypto_aead_xchacha20poly1305_ietf_encrypt(
+        plaintext, header, null, nonceFor(this.sendSequence), this.sendKey,
+      );
+      const frame = new Uint8Array(header.length + ciphertext.length);
+      frame.set(header);
+      frame.set(ciphertext, header.length);
+      this.sendSequence++;
+      return { ok: true, value: frame };
+    } catch {
+      return rejected('frame encryption failed');
+    }
+  }
+
+  open(frame: Uint8Array): ChannelResult<Uint8Array> {
+    if (!(frame instanceof Uint8Array) || frame.length < SEQUENCE_BYTES + MAC_BYTES) return rejected('invalid frame');
+    if (frame.length > MAX_FRAME_BYTES) return rejected('frame exceeds 1MB');
+    if (this.receiveSequence > MAX_SEQUENCE) return rejected('receive sequence exhausted');
+    const sequence = new DataView(frame.buffer, frame.byteOffset, SEQUENCE_BYTES).getBigUint64(0, false);
+    if (sequence < this.receiveSequence) return rejected('replayed frame');
+    if (sequence > this.receiveSequence) return rejected('out-of-order frame');
+    const header = frame.subarray(0, SEQUENCE_BYTES);
+    try {
+      const plaintext = sodium.crypto_aead_xchacha20poly1305_ietf_decrypt(
+        null, frame.subarray(SEQUENCE_BYTES), header, nonceFor(sequence), this.receiveKey,
+      );
+      this.receiveSequence++;
+      return { ok: true, value: plaintext };
+    } catch {
+      return rejected('frame authentication failed');
+    }
+  }
+}
+
+export interface PhoneChannel {
+  /** Sent to the daemon during handshake; the private key stays on the phone. */
+  phonePublicKey: Uint8Array;
+  serverId: string;
+  channel: EncryptedChannel;
+}
+
+/** Pin the daemon's public key before deriving any traffic keys. */
+export async function createPhoneChannel(
+  daemonPublicKey: Uint8Array,
+  expectedDaemonPublicKey: Uint8Array,
+  phoneSeed?: Uint8Array,
+): Promise<ChannelResult<PhoneChannel>> {
+  await sodium.ready;
+  if (!validKey(daemonPublicKey) || !equalKeys(daemonPublicKey, expectedDaemonPublicKey)) {
+    return rejected('wrong daemon public key');
+  }
+  if (phoneSeed !== undefined && !validKey(phoneSeed)) return rejected('invalid phone seed');
+  const phoneKeys = phoneSeed === undefined ? sodium.crypto_kx_keypair() : sodium.crypto_kx_seed_keypair(phoneSeed);
+  try {
+    const keys = sodium.crypto_kx_client_session_keys(phoneKeys.publicKey, phoneKeys.privateKey, daemonPublicKey);
+    return { ok: true, value: {
+      phonePublicKey: phoneKeys.publicKey,
+      serverId: serverIdFromPublicKey(daemonPublicKey),
+      channel: new EncryptedChannel(keys.sharedTx, keys.sharedRx),
+    } };
+  } catch {
+    return rejected('invalid daemon public key');
+  }
+}
+
+/** Called with the phone's ephemeral public key; crypto_kx supplies opposite Tx/Rx keys. */
+export async function acceptDaemonChannel(
+  daemonKeys: DaemonKeyPair,
+  phonePublicKey: Uint8Array,
+): Promise<ChannelResult<EncryptedChannel>> {
+  await sodium.ready;
+  if (!validKey(daemonKeys?.publicKey) || !validKey(daemonKeys?.secretKey)) {
+    return rejected('invalid daemon key pair');
+  }
+  if (!validKey(phonePublicKey)) return rejected('invalid phone public key');
+  try {
+    if (!equalKeys(sodium.crypto_scalarmult_base(daemonKeys.secretKey), daemonKeys.publicKey)) {
+      return rejected('invalid daemon key pair');
+    }
+    const keys = sodium.crypto_kx_server_session_keys(daemonKeys.publicKey, daemonKeys.secretKey, phonePublicKey);
+    return { ok: true, value: new EncryptedChannel(keys.sharedTx, keys.sharedRx) };
+  } catch {
+    return rejected('invalid handshake key');
+  }
+}

package/src/relay/mux.ts

@@ -0,0 +1,182 @@
+import { MAX_FRAME_BYTES } from './channel.js';
+import type { ChannelResult } from './channel.js';
+
+export type MuxFrame =
+  | { streamId: number; kind: 'open'; protocol: 'http'; method: string; path: string; headers: Record<string, string> }
+  | { streamId: number; kind: 'open'; protocol: 'ws'; path: string; headers: Record<string, string> }
+  | { streamId: number; kind: 'data'; data: Uint8Array }
+  | { streamId: number; kind: 'close'; reason: string };
+
+// u32 BE length (remaining bytes), u32 BE stream ID, u8 kind (1=open, 2=data, 3=close).
+// Open: u8 protocol (1=http, 2=ws), [http: u16 method bytes + UTF-8 method],
+// u32 path bytes + UTF-8 path, u16 header count, then u16 name bytes + UTF-8 name,
+// u16 value bytes + UTF-8 value per header. Data: remaining raw bytes.
+// Close: u16 reason bytes + UTF-8 reason. One frame per encrypted plaintext.
+const encoder = new TextEncoder();
+const decoder = new TextDecoder('utf-8', { fatal: true });
+const HEADER_BYTES = 9;
+// EncryptedChannel appends an 8-byte sequence and 16-byte MAC to each plaintext.
+export const MAX_MUX_FRAME_BYTES = MAX_FRAME_BYTES - 24;
+
+type Result<T> = ChannelResult<T>;
+function reject<T>(reason: string): Result<T> { return { ok: false, reason }; }
+
+class Writer {
+  private parts: Uint8Array[] = [];
+  length = 0;
+  bytes(value: Uint8Array) { this.parts.push(value); this.length += value.length; }
+  number(value: number, size: 1 | 2 | 4) {
+    const bytes = new Uint8Array(size);
+    const view = new DataView(bytes.buffer);
+    if (size === 1) view.setUint8(0, value);
+    else if (size === 2) view.setUint16(0, value, false);
+    else view.setUint32(0, value, false);
+    this.bytes(bytes);
+  }
+  text(value: string, size: 2 | 4): boolean {
+    if (typeof value !== 'string') return false;
+    const bytes = encoder.encode(value);
+    if (bytes.length > (size === 2 ? 0xffff : 0xffffffff)) return false;
+    this.number(bytes.length, size);
+    this.bytes(bytes);
+    return true;
+  }
+  finish(): Uint8Array {
+    const out = new Uint8Array(this.length);
+    let offset = 0;
+    for (const part of this.parts) { out.set(part, offset); offset += part.length; }
+    return out;
+  }
+}
+
+class Reader {
+  offset = 0;
+  constructor(readonly bytes: Uint8Array) {}
+  number(size: 1 | 2 | 4): number | undefined {
+    if (this.offset + size > this.bytes.length) return undefined;
+    const view = new DataView(this.bytes.buffer, this.bytes.byteOffset + this.offset, size);
+    this.offset += size;
+    return size === 1 ? view.getUint8(0) : size === 2 ? view.getUint16(0, false) : view.getUint32(0, false);
+  }
+  text(size: 2 | 4): string | undefined {
+    const length = this.number(size);
+    if (length === undefined || this.offset + length > this.bytes.length) return undefined;
+    const bytes = this.bytes.subarray(this.offset, this.offset + length);
+    this.offset += length;
+    return decoder.decode(bytes);
+  }
+}
+
+function validId(id: number): boolean { return Number.isInteger(id) && id >= 0 && id <= 0xffffffff; }
+
+/** Share one instance between the encoder and decoder of a single endpoint. */
+export class MuxStreamState {
+  private readonly active = new Set<number>();
+
+  isOpen(id: number): boolean { return this.active.has(id); }
+  opened(id: number): void { this.active.add(id); }
+  closed(id: number): void { this.active.delete(id); }
+}
+
+/** No network I/O; shares stream IDs with the receiving decoder when supplied a state. */
+export class MuxEncoder {
+  constructor(private readonly streams: MuxStreamState = new MuxStreamState()) {}
+
+  encode(frame: MuxFrame): Result<Uint8Array> {
+    if (!frame || !validId(frame.streamId)) return reject('invalid stream ID');
+    if (frame.kind !== 'open' && frame.kind !== 'data' && frame.kind !== 'close') return reject('unknown frame kind');
+    if (frame.kind === 'open' ? this.streams.isOpen(frame.streamId) : !this.streams.isOpen(frame.streamId)) {
+      return reject(frame.kind === 'open' ? 'stream already open' : 'stream not open');
+    }
+    const writer = new Writer();
+    writer.number(0, 4);
+    writer.number(frame.streamId, 4);
+    if (frame.kind === 'open') {
+      writer.number(1, 1);
+      if (frame.protocol !== 'http' && frame.protocol !== 'ws') return reject('unknown protocol');
+      writer.number(frame.protocol === 'http' ? 1 : 2, 1);
+      if (frame.protocol === 'http' && (!frame.method || !writer.text(frame.method, 2))) return reject('invalid method');
+      if (!frame.path || !writer.text(frame.path, 4)) return reject('invalid path');
+      if (!frame.headers || typeof frame.headers !== 'object' || Array.isArray(frame.headers)) return reject('invalid headers');
+      const entries = Object.entries(frame.headers);
+      if (entries.length > 0xffff) return reject('invalid headers');
+      writer.number(entries.length, 2);
+      for (const [name, value] of entries) {
+        if (!name || !writer.text(name, 2) || !writer.text(value, 2)) return reject('invalid headers');
+      }
+    } else if (frame.kind === 'data') {
+      if (!(frame.data instanceof Uint8Array)) return reject('invalid data');
+      writer.number(2, 1);
+      writer.bytes(frame.data);
+    } else if (frame.kind === 'close') {
+      writer.number(3, 1);
+      if (!writer.text(frame.reason, 2)) return reject('invalid reason');
+    }
+    if (writer.length > MAX_MUX_FRAME_BYTES) return reject('frame exceeds 1MB');
+    const out = writer.finish();
+    new DataView(out.buffer).setUint32(0, out.length - 4, false);
+    if (frame.kind === 'open') this.streams.opened(frame.streamId);
+    if (frame.kind === 'close') this.streams.closed(frame.streamId);
+    return { ok: true, value: out };
+  }
+}
+
+/** Rejected frames never change stream state. Share state with the sending encoder per endpoint. */
+export class MuxDecoder {
+  constructor(private readonly streams: MuxStreamState = new MuxStreamState()) {}
+
+  decode(bytes: Uint8Array): Result<MuxFrame> {
+    if (!(bytes instanceof Uint8Array)) return reject('invalid frame');
+    if (bytes.length > MAX_MUX_FRAME_BYTES) return reject('frame exceeds 1MB');
+    if (bytes.length < HEADER_BYTES) return reject('truncated frame');
+    const reader = new Reader(bytes);
+    const length = reader.number(4)!;
+    if (length !== bytes.length - 4) return reject(length > bytes.length - 4 ? 'truncated frame' : 'trailing frame bytes');
+    const streamId = reader.number(4)!;
+    const kind = reader.number(1)!;
+    if (kind !== 1 && kind !== 2 && kind !== 3) return reject('unknown frame kind');
+    if (kind === 1 ? this.streams.isOpen(streamId) : !this.streams.isOpen(streamId)) {
+      return reject(kind === 1 ? 'stream already open' : 'stream not open');
+    }
+    try {
+      let frame: MuxFrame;
+      if (kind === 1) {
+        const protocolByte = reader.number(1);
+        if (protocolByte !== 1 && protocolByte !== 2) return reject(protocolByte === undefined ? 'truncated frame' : 'unknown protocol');
+        const method = protocolByte === 1 ? reader.text(2) : undefined;
+        if (protocolByte === 1 && method === undefined) return reject('truncated frame');
+        const path = reader.text(4);
+        const count = reader.number(2);
+        if (path === undefined || count === undefined) return reject('truncated frame');
+        if (!path || (protocolByte === 1 && !method)) return reject('invalid open frame');
+        const entries: [string, string][] = [];
+        const names = new Set<string>();
+        for (let i = 0; i < count; i++) {
+          const name = reader.text(2);
+          const value = reader.text(2);
+          if (name === undefined || value === undefined) return reject('truncated frame');
+          if (!name || names.has(name)) return reject('invalid headers');
+          names.add(name);
+          entries.push([name, value]);
+        }
+        const headers = Object.fromEntries(entries);
+        frame = protocolByte === 1
+          ? { streamId, kind: 'open', protocol: 'http', method: method!, path, headers }
+          : { streamId, kind: 'open', protocol: 'ws', path, headers };
+      } else if (kind === 2) {
+        frame = { streamId, kind: 'data', data: bytes.slice(reader.offset) };
+        reader.offset = bytes.length;
+      } else {
+        const reason = reader.text(2);
+        if (reason === undefined) return reject('truncated frame');
+        frame = { streamId, kind: 'close', reason };
+      }
+      if (reader.offset !== bytes.length) return reject('trailing frame bytes');
+      if (kind === 1) this.streams.opened(streamId);
+      if (kind === 3) this.streams.closed(streamId);
+      return { ok: true, value: frame };
+    } catch {
+      return reject('invalid UTF-8 frame');
+    }
+  }
+}

package/src/relay/test-vectors.json

@@ -0,0 +1,29 @@
+{
+  "daemonSeedHex": "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
+  "phoneSeedHex": "202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f",
+  "daemonPublicKeyHex": "0e0216223f147143d32615a91189c288c1728cba3cc5f9f621b1026e03d83129",
+  "phonePublicKeyHex": "99f4674ecc87c0b8e712f192b8f49e7442a9376b4875967ababa28471019a93e",
+  "serverId": "4bc447d530c4044729c44372319cebfcbe079462826a6d39ea4828b149f9c685",
+  "phoneToDaemonKeySha256": "1fd0e0a3bd4e5afff9efb91653c4e67f549b2aaf26e8fea9a5fb263cbd987ea0",
+  "daemonToPhoneKeySha256": "534f8e2462d2bfe07a31cc43a2fd7a46d6109c31289c971c17626324b9806ee8",
+  "nonceHex": "000000000000000000000000000000000000000000000000",
+  "request": {
+    "streamId": 16909060,
+    "kind": "open",
+    "protocol": "http",
+    "method": "POST",
+    "path": "/v1/health",
+    "headers": {
+      "authorization": "Bearer vector-token"
+    }
+  },
+  "requestMuxHex": "000000400102030401010004504f53540000000a2f76312f6865616c74680001000d617574686f72697a6174696f6e001342656172657220766563746f722d746f6b656e",
+  "requestEncryptedHex": "0000000000000000d793343f86630442fcf3812bc1375c4b102aa1ffd546ac4ecbd5f5f4e9e4b3c2de47616a01df19b25b317cd0c5f3c2f0aa7a8b12f307c9872c5f03765a0b1c0e6b6f46dcbda1758ae286b475870eb7ad957f409e",
+  "response": {
+    "streamId": 16909060,
+    "kind": "data",
+    "dataHex": "00ff1020"
+  },
+  "responseMuxHex": "00000009010203040200ff1020",
+  "responseEncryptedHex": "0000000000000000bf589589e25e990a1c7da5fb7a773f0a798e84d1f444d51bd8e3e0bdb4"
+}

package/src/release-loop/checklist.ts

@@ -6,12 +6,14 @@ import { debug } from '../debug/log.js';
 import { releaseLedgerRoot } from '../instance/resolve.js';
 
 export type ChecklistStatus = 'green' | 'yellow' | 'red' | 'done';
+export type ChecklistDisposition = 'move' | 'known-issue' | 'block';
 export interface ChecklistItem {
   id: string;
   title: string;
   status: ChecklistStatus;
   owner?: string;
   evidence?: string;
+  disposition?: ChecklistDisposition;
   updatedAt: string;
   updatedBy: string;
 }
@@ -121,12 +123,13 @@ export function addItem(v: string, input: { id: string; title: string; owner?: s
   });
 }
 
-export function setItem(v: string, id: string, patch: { status?: ChecklistStatus; evidence?: string; owner?: string }, by: string): Checklist {
+export function setItem(v: string, id: string, patch: { status?: ChecklistStatus; evidence?: string; owner?: string; disposition?: ChecklistDisposition }, by: string): Checklist {
   return mutate(v, (data) => {
     const item = data.items.find((i) => i.id === id);
     if (!item) throw new Error(`없는 칸: ${id}`);
     if (patch.status !== undefined && !['green', 'yellow', 'red', 'done'].includes(patch.status)) throw new Error(`잘못된 상태: ${patch.status}`);
-    const fields = (['evidence', 'owner', 'status'] as const).filter((field) => patch[field] !== undefined && patch[field] !== item[field]);
+    if (patch.disposition !== undefined && !['move', 'known-issue', 'block'].includes(patch.disposition)) throw new Error(`잘못된 처분: ${patch.disposition}`);
+    const fields = (['evidence', 'owner', 'status', 'disposition'] as const).filter((field) => patch[field] !== undefined && patch[field] !== item[field]);
     if (fields.length === 0) return false;
     const at = new Date().toISOString();
     for (const field of fields) {
@@ -169,6 +172,29 @@ export function summarizeChecklist(data: Checklist): ChecklistSummary {
   return summary;
 }
 
+export interface ChecklistGate {
+  ok: boolean;
+  red: string[];
+  undecided: string[];
+  blocked: string[];
+  moved: string[];
+  knownIssues: Array<{ id: string; title: string; evidence: string }>;
+}
+
+export function checklistGate(v: string): ChecklistGate {
+  const result: ChecklistGate = { ok: true, red: [], undecided: [], blocked: [], moved: [], knownIssues: [] };
+  for (const item of listChecklist(v).items) {
+    if (item.status === 'red') result.red.push(item.id);
+    if (item.status !== 'yellow') continue;
+    if (item.disposition === 'block') result.blocked.push(item.id);
+    else if (item.disposition === 'move') result.moved.push(item.id);
+    else if (item.disposition === 'known-issue') result.knownIssues.push({ id: item.id, title: item.title, evidence: item.evidence ?? '' });
+    else result.undecided.push(item.id);
+  }
+  result.ok = result.red.length === 0 && result.undecided.length === 0 && result.blocked.length === 0;
+  return result;
+}
+
 export function seedFromRoadmap(v: string, markdown: string): Checklist {
   return mutate(v, (data) => {
     let added = false;

package/src/seat-address/seat-address.ts

@@ -0,0 +1,34 @@
+import trackData from '../../scripts/coord-tracks.json';
+
+export type SeatEntry = {
+  id: string;
+  title?: string;
+  alias?: string;
+};
+
+export type SeatAddress = { seats: string[]; body: string };
+
+const registry: readonly SeatEntry[] = trackData.tracks.filter((entry) => 'title' in entry);
+const addressLine = /^@([A-Za-z][A-Za-z0-9_-]*(?:,[A-Za-z][A-Za-z0-9_-]*)*)(?:[ \t]+|\r?\n|(?![\s\S]))/gm;
+
+/** Parse an address only when its @ begins a line; leave the instruction text intact. */
+export function parseSeatAddress(text: string): SeatAddress | null {
+  const match = addressLine.exec(text);
+  addressLine.lastIndex = 0;
+  if (!match) return null;
+
+  const seats = match[1]!.split(',');
+  const body = `${text.slice(0, match.index)}${text.slice(match.index + match[0].length)}`;
+  return { seats, body };
+}
+
+/** Resolve against the seat registry, preferring titles to ids to legacy aliases. */
+export function resolveSeat(address: string, seats: readonly SeatEntry[] = registry): SeatEntry | undefined {
+  const needle = address.replace(/^@/, '').toLocaleLowerCase();
+  if (!needle) return undefined;
+  for (const field of ['title', 'id', 'alias'] as const) {
+    const found = seats.find((seat) => seat[field]?.toLocaleLowerCase() === needle);
+    if (found) return found;
+  }
+  return undefined;
+}

package/src/self-implement/run-ledger-compact.ts

@@ -280,7 +280,7 @@ function recordedString(entries: readonly RunLedgerEntry[], field: string): stri
   return undefined;
 }
 
-function summarizeTerminalLedger(runId: string, entries: readonly RunLedgerEntry[]): RunLedgerSummary {
+export function summarizeTerminalLedger(runId: string, entries: readonly RunLedgerEntry[]): RunLedgerSummary {
   const last = entries.at(-1)?.timestamp;
   if (!last || !Number.isFinite(Date.parse(last)) || !hasTerminalRunStatus(entries)) throw new Error('ledger changed since plan');
   const terminator = [...entries].reverse().find((entry) => entry.event === 'human-stop' || entry.event === 'terminal'

package/src/session/index.ts

@@ -434,12 +434,20 @@ function readIndex(root: string = sessionRoot()): SessionMeta[] {
   }
 }
 
-function writeIndex(entries: SessionMeta[], root: string = sessionRoot()): void {
+// 여러 프로세스(`elanous ask` 동시 실행 등)가 같은 목록을 «읽고-고치고-통째로 쓰기» 한다.
+// 쓰기 직전 잠금 안에서 디스크의 최신 목록을 다시 읽어 id 로 합치고, 임시 파일 이름은 프로세스마다 다르게 한다
+// (10-01 MK 재현: 고정 `index.json.tmp` → 한쪽 ENOENT · 덮어쓰기로 남의 세션이 목록에서 사라짐).
+function writeIndex(entries: SessionMeta[], root: string = sessionRoot(), removed: Iterable<string> = []): void {
   ensureRoots(root);
   const p = indexPath(root);
-  const tmp = p + '.tmp';
-  writeFileSync(tmp, JSON.stringify(entries, null, 2) + '\n', 'utf-8');
-  renameSync(tmp, p);
+  withDirLock(join(root, '.index.lock'), INDEX_LOCK_TIMEOUT_MS, () => {
+    const mine = new Set(entries.map((m) => m.id));
+    const gone = new Set(removed);
+    const peers = readIndex(root).filter((m) => !mine.has(m.id) && !gone.has(m.id));
+    const tmp = `${p}.${process.pid}.${randomUUID().slice(0, 8)}.tmp`;
+    writeFileSync(tmp, JSON.stringify([...peers, ...entries], null, 2) + '\n', 'utf-8');
+    renameSync(tmp, p);
+  });
 }
 
 // ── Tier 1 Phase 3 — listener primitive ──────────────────────────────
@@ -661,7 +669,7 @@ export function rewriteSessionMessages(
   const body = messages
     .map(m => JSON.stringify(m.turn_id !== undefined ? m : { ...m, turn_id: mintTurnUri() }))
     .join('\n');
-  const tmp = file + '.tmp';
+  const tmp = `${file}.${process.pid}.${randomUUID().slice(0, 8)}.tmp`;
   writeFileSync(tmp, body ? body + '\n' : '', 'utf-8');
   renameSync(tmp, file);
 
@@ -800,8 +808,13 @@ function residentSessionLockPath(root: string): string {
 
 function withResidentSessionLock<T>(root: string, action: () => T): T {
   ensureRoots(root);
-  const lock = residentSessionLockPath(root);
-  const deadline = Date.now() + RESIDENT_SESSION_LOCK_TIMEOUT_MS;
+  return withDirLock(residentSessionLockPath(root), RESIDENT_SESSION_LOCK_TIMEOUT_MS, action);
+}
+
+const INDEX_LOCK_TIMEOUT_MS = 10_000;
+
+function withDirLock<T>(lock: string, timeoutMs: number, action: () => T): T {
+  const deadline = Date.now() + timeoutMs;
   for (;;) {
     try {
       mkdirSync(lock);
@@ -814,7 +827,7 @@ function withResidentSessionLock<T>(root: string, action: () => T): T {
           continue;
         }
       } catch { continue; }
-      if (Date.now() >= deadline) throw new Error(`timed out acquiring resident session lock for ${root}`);
+      if (Date.now() >= deadline) throw new Error(`timed out acquiring lock ${lock}`);
       Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 10);
       void error;
     }
@@ -855,7 +868,7 @@ export function deleteSession(id: string, root: string = sessionRoot()): boolean
   const before = idx.length;
   const next = idx.filter(m => m.id !== id);
   if (next.length === before) return false;
-  writeIndex(next, root);
+  writeIndex(next, root, [id]);
   // Clear active marker if it pointed at the deleted session.
   if (getActiveSessionId() === id) clearActiveSessionId();
   return true;
@@ -876,7 +889,7 @@ export function deleteSessions(ids: string[], root: string = sessionRoot()): num
   const idx = readIndex(root);
   const next = idx.filter(m => !set.has(m.id));
   const removed = idx.length - next.length;
-  if (removed > 0) writeIndex(next, root);
+  if (removed > 0) writeIndex(next, root, set);
   const active = getActiveSessionId();
   if (active && set.has(active)) clearActiveSessionId();
   return removed;

package/src/task-orchestrator/surfaces/pod-bun-cache.ts

@@ -0,0 +1,18 @@
+export const POD_BUN_CACHE_HOST_PATH = 'POD_BUN_CACHE_HOST_PATH';
+
+/** A host-backed Bun install cache; only opt into it when the mounted directory is writable. */
+export function podBunCacheVolume(hostPath: string) {
+  return {
+    volume: { name: 'bun-cache', hostPath: { path: hostPath, type: 'DirectoryOrCreate' } },
+    volumeMount: { name: 'bun-cache', mountPath: '/bun-cache', readOnly: false },
+    shellPrefix: 'if [ -d /bun-cache ] && [ -w /bun-cache ]; then export BUN_INSTALL_CACHE_DIR=/bun-cache; fi;',
+  };
+}
+
+/** First Bun install timing in a combined shard log (including a no-op install). */
+export function parseInstallSeconds(log: string): number | null {
+  const match = /(?:\d+ packages? installed|Checked \d+ installs across \d+ packages(?: \(no changes\))?)\s*\[(\d+(?:\.\d+)?)(ms|s)\]/.exec(log);
+  if (!match) return null;
+  const duration = Number(match[1]);
+  return match[2] === 'ms' ? duration / 1000 : duration;
+}