elanous 0.2.5 → 0.2.7

package/src/nexus/api/graph-approvals.ts

@@ -3,7 +3,9 @@ import { join } from 'node:path';
 import { debug } from '../../debug/log.js';
 import { decideGraphApproval, lastJsonObject, type GraphRunState } from '../../graph-runner/runner.js';
 import { effectiveInstanceRoot } from '../../instance/resolve.js';
+import { getElanousConfigDir } from '../../elanous-config-dir.js';
 import { jsonResponse } from './json-response.js';
+import { applyFeedEdit, feedFolderFor, isFeedPreviewMessage, mediaContentType, readFeedDraft, resolveFeedMedia, writeFeedDraft, type FeedDraft } from './graph-approvals-feed.js';
 
 export const GRAPH_APPROVALS_PATH = '/v1/graph-approvals';
 const SEGMENT = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
@@ -16,15 +18,66 @@ interface GraphApprovalItem {
   since: string;
   path: string[];
   recent: Array<{ nodeId: string; ok: boolean; outcome?: string; summary?: string }>;
+  /** EV10d — present only for a `{"kind":"feed-preview"}` approval whose run folder holds a valid draft. */
+  feed?: Omit<FeedDraft, 'folder'>;
 }
 
+/** One decision this daemon applied through `POST /v1/graph-approvals/:graphId/:runId`. */
+interface GraphApprovalDecided {
+  graphId: string;
+  runId: string;
+  nodeId: string;
+  decision: 'approved' | 'rejected';
+  decidedAt: string;
+}
+
+export const GRAPH_DECISION_RING_CAPACITY = 100;
+export const GRAPH_DECISION_RING_MAX_AGE_MS = 30 * 60 * 1000;
+
+/**
+ * Recent decisions, in memory. The undecided list drops a run the moment it is decided, so
+ * another device (Fold ↔ iPhone) could only see «gone» — this ring lets it say «승인됨/거절됨».
+ * ⚠️ In-memory: a daemon restart forgets it, and a decision made outside this process
+ * (`elanous graph approve` CLI) is not recorded — clients keep a «decided elsewhere» fallback.
+ */
+export function createGraphDecisionRing(opts: { capacity?: number; maxAgeMs?: number; now?: () => number } = {}) {
+  const capacity = opts.capacity ?? GRAPH_DECISION_RING_CAPACITY;
+  const maxAgeMs = opts.maxAgeMs ?? GRAPH_DECISION_RING_MAX_AGE_MS;
+  const now = opts.now ?? Date.now;
+  let entries: Array<{ atMs: number; record: GraphApprovalDecided }> = [];
+  const prune = () => {
+    const cutoff = now() - maxAgeMs;
+    entries = entries.filter((entry) => entry.atMs > cutoff).slice(-capacity);
+  };
+  return {
+    record(decision: Omit<GraphApprovalDecided, 'decidedAt'>): void {
+      const atMs = now();
+      entries.push({ atMs, record: { ...decision, decidedAt: new Date(atMs).toISOString() } });
+      prune();
+    },
+    /** Newest first, pruned by age and capacity. */
+    list(): GraphApprovalDecided[] {
+      prune();
+      return entries.map((entry) => entry.record).reverse();
+    },
+  };
+}
+
+export type GraphDecisionRing = ReturnType<typeof createGraphDecisionRing>;
+
+const defaultDecisionRing = createGraphDecisionRing();
+
 interface GraphApprovalsDeps {
+  /** Injected in tests; production shares one per-process ring. */
+  decisions?: GraphDecisionRing;
   authorize?: (request: Request) => boolean;
   /** Credential the request carries, checked independently of same-origin (`bearerCredential`).
    * A decision needs a bearer token: same-origin alone is not trusted because behind
    * `tailscale serve` every tailnet peer (Pod included) arrives from loopback. */
   authReason?: (request: Request) => string | undefined;
   root?: string;
+  /** Config dir whose `field/<slug>` folders may hold feed drafts (EV10d). */
+  configDir?: string;
 }
 
 const DECISION_AUTH_REASONS = new Set(['bearer-match', 'temp-token', 'noauth']);
@@ -49,7 +102,16 @@ function undecided(state: GraphRunState, root: string): boolean {
     && Array.isArray(state.path) && !existsSync(join(root, 'graph-runs', state.graphId, `${state.runId}.json.${state.path.length}.decision.json`));
 }
 
-function list(root: string): GraphApprovalItem[] {
+function feedFor(state: GraphRunState, configDir: string): Omit<FeedDraft, 'folder'> | undefined {
+  if (!isFeedPreviewMessage(state.pending?.message ?? '')) return undefined;
+  const folder = feedFolderFor(state, configDir);
+  const draft = folder ? readFeedDraft(folder) : null;
+  if (!draft) return undefined;
+  const { folder: _folder, ...rest } = draft;
+  return rest;
+}
+
+function list(root: string, configDir: string): GraphApprovalItem[] {
   const dir = join(root, 'graph-runs');
   let graphs: Dirent[];
   try { graphs = readdirSync(dir, { withFileTypes: true }); }
@@ -66,6 +128,7 @@ function list(root: string): GraphApprovalItem[] {
       const state = readRun(root, graph.name, runId);
       if (!state || !undecided(state, root) || !Array.isArray(state.nodes)) continue;
       const pending = state.pending!;
+      const feed = feedFor(state, configDir);
       items.push({
         graphId: state.graphId, runId: state.runId, nodeId: pending.nodeId, message: pending.message,
         since: pending.since, path: state.path,
@@ -77,6 +140,7 @@ function list(root: string): GraphApprovalItem[] {
             ...(typeof output?.summary === 'string' ? { summary: output.summary } : {}),
           };
         }),
+        ...(feed ? { feed } : {}),
       });
     }
   }
@@ -84,13 +148,17 @@ function list(root: string): GraphApprovalItem[] {
 }
 
 export async function handleGraphApprovals(req: Request, deps: GraphApprovalsDeps = {}): Promise<Response> {
-  const pathname = new URL(req.url).pathname;
+  const url = new URL(req.url);
+  const pathname = url.pathname;
+  const sub = /^\/v1\/graph-approvals\/([^/]+)\/([^/]+)\/(feed-draft|media)$/.exec(pathname);
   const match = /^\/v1\/graph-approvals\/([^/]+)\/([^/]+)$/.exec(pathname);
-  if (pathname !== GRAPH_APPROVALS_PATH && !match) return jsonResponse({ error: 'not-found' }, 404);
+  if (pathname !== GRAPH_APPROVALS_PATH && !match && !sub) return jsonResponse({ error: 'not-found' }, 404);
   if (!deps.authorize?.(req)) return jsonResponse({ error: 'unauthorized' }, 401);
+  if (sub) return handleFeed(req, url, sub[1]!, sub[2]!, sub[3] as 'feed-draft' | 'media', deps);
   if (pathname === GRAPH_APPROVALS_PATH) {
     if (req.method !== 'GET') return jsonResponse({ error: 'method-not-allowed' }, 405);
-    return jsonResponse({ items: list(deps.root ?? effectiveInstanceRoot()) });
+    // ⭐ `items` is unchanged; `decided` is additive (newest first) for other devices' cards.
+    return jsonResponse({ items: list(deps.root ?? effectiveInstanceRoot(), deps.configDir ?? getElanousConfigDir()), decided: (deps.decisions ?? defaultDecisionRing).list() });
   }
   if (req.method !== 'POST') return jsonResponse({ error: 'method-not-allowed' }, 405);
   const authReason = deps.authReason?.(req);
@@ -120,6 +188,54 @@ export async function handleGraphApprovals(req: Request, deps: GraphApprovalsDep
     if (error instanceof Error && error.message.startsWith('run is not awaiting an undecided approval:')) return jsonResponse({ error: 'already-decided' }, 409);
     throw error;
   }
+  (deps.decisions ?? defaultDecisionRing).record({ graphId, runId, nodeId, decision });
   debug.log('approvals.graph', 'decided', { graphId, runId, nodeId, decision, by: `pwa:${authReason}` });
   return jsonResponse({ graphId, runId, decision });
 }
+
+/** EV10d — `PUT …/:graphId/:runId/feed-draft` (사람 수정 저장) · `GET …/:graphId/:runId/media?path=` (초안 미디어). */
+async function handleFeed(req: Request, url: URL, rawGraphId: string, rawRunId: string, kind: 'feed-draft' | 'media', deps: GraphApprovalsDeps): Promise<Response> {
+  let graphId: string;
+  let runId: string;
+  try { graphId = decodeURIComponent(rawGraphId); runId = decodeURIComponent(rawRunId); }
+  catch { return jsonResponse({ error: 'not-found' }, 404); }
+  if (!validSegment(graphId) || !validSegment(runId)) return jsonResponse({ error: 'not-found' }, 404);
+  const root = deps.root ?? effectiveInstanceRoot();
+  const state = readRun(root, graphId, runId);
+  const folder = state && isFeedPreviewMessage(state.pending?.message ?? '') ? feedFolderFor(state, deps.configDir ?? getElanousConfigDir()) : null;
+  if (!state || !folder) {
+    debug.log('approvals.feed', 'refused', { graphId, reason: 'not-feed' });
+    return jsonResponse({ error: 'not-found' }, 404);
+  }
+  if (kind === 'media') {
+    if (req.method !== 'GET') return jsonResponse({ error: 'method-not-allowed' }, 405);
+    const file = resolveFeedMedia(folder, url.searchParams.get('path') ?? '');
+    if (!file) {
+      debug.log('approvals.feed', 'refused', { graphId, reason: 'media-path' });
+      return jsonResponse({ error: 'not-found' }, 404);
+    }
+    debug.log('approvals.feed', 'media-served', { graphId });
+    return new Response(Bun.file(file), { headers: { 'content-type': mediaContentType(file), 'cache-control': 'private, max-age=60' } });
+  }
+  if (req.method !== 'PUT') return jsonResponse({ error: 'method-not-allowed' }, 405);
+  const authReason = deps.authReason?.(req);
+  if (!authReason || !DECISION_AUTH_REASONS.has(authReason)) {
+    debug.log('approvals.feed', 'refused', { graphId, reason: 'pairing-required' });
+    return jsonResponse({ error: 'pairing-required' }, 403);
+  }
+  if (!undecided(state, root)) return jsonResponse({ error: 'already-decided' }, 409);
+  const current = readFeedDraft(folder);
+  if (!current) return jsonResponse({ error: 'not-found' }, 404);
+  let body: unknown;
+  try { body = await req.json(); }
+  catch { return jsonResponse({ error: 'bad_request' }, 400); }
+  const result = applyFeedEdit(current, body);
+  if (!result.ok) {
+    debug.log('approvals.feed', 'refused', { graphId, reason: result.error });
+    return jsonResponse({ error: result.error }, 400);
+  }
+  writeFeedDraft(folder, result.draft);
+  debug.log('approvals.feed', 'draft-saved', { graphId, revision: result.draft.revision });
+  const { folder: _folder, ...feed } = result.draft;
+  return jsonResponse({ graphId, runId, feed });
+}

package/src/nexus/api/harness-api.ts

@@ -1,5 +1,7 @@
-import { readFileSync, writeFileSync } from 'node:fs';
-import { relative } from 'node:path';
+import { readdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';
+import { join, relative } from 'node:path';
+import { hasTerminalRunStatus, loadRunLedger, runLedgerDir, runLedgerPath, type RunLedgerEntry } from '../../self-implement/run-ledger.js';
+import { summarizeTerminalLedger } from '../../self-implement/run-ledger-compact.js';
 import { debug } from '../../debug/log.js';
 import { enqueueSoftStop } from '../../harness/control-inbox.js';
 import { listHarnessScreens, readHarnessScreenTail } from '../../harness/harness-screen.js';
@@ -103,6 +105,10 @@ export interface HarnessApiDeps {
   readonly createAcceptanceId?: () => string;
   readonly log?: (event: string, data: Record<string, unknown>) => void;
   readonly createFeedbackEmitter?: (acceptanceId: string) => (env: FeedbackEnvelope) => void | Promise<void>;
+  /** 시험 심 — `?finishedSince=` 가 읽는 원장 디렉터리(기본 `runLedgerDir()`). */
+  readonly ledgerDir?: string;
+  /** 시험 심 — `?finishedSince=` 의 `landed`(gh 실행기·저장소·시간 초과). */
+  readonly landed?: LandedPrsDeps;
 }
 
 function json(body: unknown, status = 200): Response {
@@ -338,10 +344,218 @@ export function handleHarnessAskStatusGet(req: Request, _metaApi: HarnessMetaApi
   });
 }
 
-/** Return the structured shared running-runs observation without human rendering. */
-export function handleHarnessRunsGet(_req: Request, _metaApi: HarnessMetaApi, deps: HarnessApiDeps = {}): Response {
+/** One terminated run for `GET /v1/harness/runs?finishedSince=` (iPhone «오늘 끝난 일» · 2026-09-30). */
+export interface HarnessFinishedRun {
+  runId: string;
+  status: string;
+  endedAt: string;
+  /** 마지막 `run-status` 의 `stage`(예: `merged`·`pr-declined`) — 칩을 더 정확히 고를 때. */
+  stage?: string;
+  objective?: string;
+  prUrl?: string;
+  /** `merged` 이벤트의 값 — 이벤트가 없으면 칸이 없다(«병합 안 됨»으로 접지 않는다). */
+  merged?: boolean;
+  /** 마지막 `merge-decision` 의 `decision`(`auto`·`hitl`) — 병합 «결정»이지 병합 «사실»이 아니다. */
+  mergeDecision?: string;
+}
+
+export const FINISHED_RUNS_LIMIT = 20;
+export const FINISHED_RUNS_MAX_FILES = 300;
+export const FINISHED_RUNS_MAX_FILE_BYTES = 5 * 1024 * 1024;
+const FINISHED_OBJECTIVE_MAX_CHARS = 160;
+
+/**
+ * 원장 디렉터리에서 `sinceMs` 이후에 쓰인 «끝난» 런을 요약한다. 읽기는 묶여 있다 —
+ * mtime 최신 {@link FINISHED_RUNS_MAX_FILES} 개만 보고, {@link FINISHED_RUNS_MAX_FILE_BYTES} 를 넘는 파일은 건너뛴다.
+ */
+export function collectFinishedRuns(dir: string, sinceMs: number): { runs: HarnessFinishedRun[]; scannedFiles: number; skippedFiles: number } {
+  let names: string[];
+  try { names = readdirSync(dir); }
+  catch { return { runs: [], scannedFiles: 0, skippedFiles: 0 }; }
+  const candidates: Array<{ runId: string; mtimeMs: number; size: number }> = [];
+  for (const name of names) {
+    if (!name.endsWith('.jsonl')) continue;
+    try {
+      const st = statSync(join(dir, name));
+      if (st.isFile() && st.mtimeMs >= sinceMs) candidates.push({ runId: name.slice(0, -'.jsonl'.length), mtimeMs: st.mtimeMs, size: st.size });
+    } catch { /* 사이에 지워졌다 */ }
+  }
+  candidates.sort((a, b) => b.mtimeMs - a.mtimeMs);
+  const scanned = candidates.slice(0, FINISHED_RUNS_MAX_FILES);
+  let skippedFiles = candidates.length - scanned.length;
+  const runs: HarnessFinishedRun[] = [];
+  for (const file of scanned) {
+    if (file.size > FINISHED_RUNS_MAX_FILE_BYTES) { skippedFiles += 1; continue; }
+    let entries: RunLedgerEntry[] | null;
+    try { entries = loadRunLedger(file.runId, dir); }
+    catch { skippedFiles += 1; continue; }
+    if (!entries?.length || !hasTerminalRunStatus(entries)) continue;
+    let summary: ReturnType<typeof summarizeTerminalLedger>;
+    try { summary = summarizeTerminalLedger(file.runId, entries); }
+    catch { skippedFiles += 1; continue; }
+    if (!(Date.parse(summary.endedAt) >= sinceMs)) continue;
+    const feature = entries.find((entry) => entry.event === 'start' && typeof entry.data.feature === 'string')?.data.feature as string | undefined;
+    const objective = feature?.trim().slice(0, FINISHED_OBJECTIVE_MAX_CHARS);
+    const mergedEvent = [...entries].reverse().find((entry) => entry.event === 'merged' && typeof entry.data.merged === 'boolean');
+    const decision = [...entries].reverse().find((entry) => entry.event === 'merge-decision' && typeof entry.data.decision === 'string');
+    const statusEntry = [...entries].reverse().find((entry) => entry.event === 'run-status' && typeof entry.data.stage === 'string');
+    runs.push({
+      runId: summary.runId,
+      status: summary.status,
+      endedAt: summary.endedAt,
+      ...(statusEntry ? { stage: statusEntry.data.stage as string } : {}),
+      ...(objective ? { objective } : {}),
+      ...(summary.prUrl ? { prUrl: summary.prUrl } : {}),
+      ...(mergedEvent ? { merged: mergedEvent.data.merged as boolean } : {}),
+      ...(decision ? { mergeDecision: decision.data.decision as string } : {}),
+    });
+  }
+  runs.sort((a, b) => Date.parse(b.endedAt) - Date.parse(a.endedAt));
+  return { runs: runs.slice(0, FINISHED_RUNS_LIMIT), scannedFiles: scanned.length, skippedFiles };
+}
+
+/** 도는 런의 목표 — 그 런 원장의 첫 `start.data.feature`(≤160자). 원장 경로는 그 항목이 준 디렉터리들만 본다(런 수만큼만 읽는다). */
+export function runObjectiveFromLedgers(runId: string, directories: readonly string[]): string | undefined {
+  for (const dir of directories) {
+    try {
+      if (statSync(runLedgerPath(runId, dir)).size > FINISHED_RUNS_MAX_FILE_BYTES) continue;
+      const feature = loadRunLedger(runId, dir)?.find((entry) => entry.event === 'start' && typeof entry.data.feature === 'string')?.data.feature;
+      const objective = typeof feature === 'string' ? feature.trim().slice(0, FINISHED_OBJECTIVE_MAX_CHARS) : '';
+      if (objective) return objective;
+    } catch { /* 없거나 못 읽음 — 다음 디렉터리 */ }
+  }
+  return undefined;
+}
+
+// ── 오늘 착지(= main 에 병합된 PR) — 원장은 Pod·시험 우주의 런을 못 보므로 GitHub 이 정본이다 ──
+
+/** `landed` 한 줄 — `gh pr list --json number,title,url,mergedAt` 모양 그대로. */
+export interface HarnessLandedPr {
+  number: number;
+  title: string;
+  url: string;
+  mergedAt: string;
+}
+
+export const LANDED_PRS_LIMIT = 30;
+export const LANDED_PRS_TIMEOUT_MS = 4_000;
+const LANDED_CACHE_MS = 60_000;
+const landedCache = new Map<string, { at: number; prs: HarnessLandedPr[]; truncated: boolean }>();
+let cachedRepoSlug: string | null | undefined;
+
+export function _resetLandedPrsCacheForTest(): void {
+  landedCache.clear();
+  cachedRepoSlug = undefined;
+}
+
+export interface LandedPrsDeps {
+  /** gh 실행기(기본 = `git-fs/gh-cli` 의 재시도 게이트웨이 · 비동기). */
+  readonly runGh?: (args: string[]) => Promise<{ ok: boolean; exitCode: number; stdout: Buffer | string; stderr: Buffer | string }>;
+  /** 저장소 `owner/name` — 기본은 데몬이 아는 저장소 뿌리(`harness.defaultRepo` → cwd)의 origin. */
+  readonly repoSlug?: () => Promise<string | null>;
+  readonly timeoutMs?: number;
+  readonly now?: () => number;
+}
+
+async function defaultRepoSlug(): Promise<string | null> {
+  if (cachedRepoSlug !== undefined) return cachedRepoSlug;
+  const [{ resolveWorktreesRepoRoot }, { slugFromRemote }] = await Promise.all([import('./worktrees.js'), import('./live-shipped.js')]);
+  const root = resolveWorktreesRepoRoot();
+  if (!root) return (cachedRepoSlug = null);
+  const proc = Bun.spawn(['git', '-C', root, 'remote', 'get-url', 'origin'], { stdout: 'pipe', stderr: 'ignore' });
+  const [out, code] = await Promise.all([new Response(proc.stdout).text(), proc.exited]);
+  return (cachedRepoSlug = code === 0 ? slugFromRemote(out) : null);
+}
+
+async function defaultRunGh(args: string[]) {
+  const { runGhCliWithResultAsync } = await import('../../git-fs/gh-cli.js');
+  return runGhCliWithResultAsync(args);
+}
+
+function isLandedPr(value: unknown): value is HarnessLandedPr {
+  const v = value as Partial<HarnessLandedPr> | null;
+  return !!v && typeof v.number === 'number' && typeof v.title === 'string' && typeof v.url === 'string' && typeof v.mergedAt === 'string';
+}
+
+/** `sinceMs` 이후 main 에 병합된 PR(최신순 ≤30). 실패·시간 초과는 던지지 않고 `error` 로 돌려준다. 성공만 60초 캐시한다. */
+export async function listLandedPrs(sinceMs: number, deps: LandedPrsDeps = {}): Promise<{ prs: HarnessLandedPr[]; error?: string; cached?: boolean; truncated?: boolean }> {
+  const now = deps.now?.() ?? Date.now();
+  const sinceIso = new Date(Math.floor(sinceMs / 60_000) * 60_000).toISOString().replace(/\.\d{3}Z$/, 'Z');
+  const hit = landedCache.get(sinceIso);
+  if (hit && now - hit.at < LANDED_CACHE_MS) return { prs: hit.prs, cached: true, ...(hit.truncated ? { truncated: true } : {}) };
+  const timeoutMs = deps.timeoutMs ?? LANDED_PRS_TIMEOUT_MS;
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  const timeout = new Promise<{ prs: HarnessLandedPr[]; error: string }>((resolve) => {
+    timer = setTimeout(() => resolve({ prs: [], error: `timeout ${timeoutMs}ms` }), timeoutMs);
+  });
+  const work = (async (): Promise<{ prs: HarnessLandedPr[]; error?: string; truncated?: boolean }> => {
+    try {
+      const slug = await (deps.repoSlug ?? defaultRepoSlug)();
+      if (!slug) return { prs: [], error: 'no-repository' };
+      const result = await (deps.runGh ?? defaultRunGh)([
+        'pr', 'list', '--repo', slug, '--state', 'merged', '--base', 'main',
+        '--search', `merged:>=${sinceIso}`,
+        '--json', 'number,title,url,mergedAt', '--limit', String(LANDED_PRS_LIMIT),
+      ]);
+      if (!result.ok) {
+        const stderr = String(result.stderr).trim().split('\n')[0] ?? '';
+        return { prs: [], error: `gh failed rc=${result.exitCode}${stderr ? `: ${redactSecretText(stderr).slice(0, 120)}` : ''}` };
+      }
+      const parsed: unknown = JSON.parse(String(result.stdout));
+      if (!Array.isArray(parsed)) return { prs: [], error: 'gh returned non-array' };
+      const prs = parsed.filter(isLandedPr)
+        .filter((pr) => Date.parse(pr.mergedAt) >= sinceMs)
+        .sort((a, b) => Date.parse(b.mergedAt) - Date.parse(a.mergedAt));
+      // gh 가 상한만큼 줬으면 더 있을 수 있다 — «전부»라고 말하지 않는다.
+      const truncated = parsed.length >= LANDED_PRS_LIMIT;
+      landedCache.set(sinceIso, { at: now, prs, truncated });
+      return { prs, ...(truncated ? { truncated: true } : {}) };
+    } catch (error) {
+      return { prs: [], error: message(error).slice(0, 120) };
+    }
+  })();
+  try {
+    return await Promise.race([work, timeout]);
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
+
+/** Return the structured shared running-runs observation without human rendering.
+ *  `?finishedSince=<epoch ms>` 가 있으면(iPhone «오늘» · 2026-09-30) 셋을 더한다 —
+ *  `finished`(이 우주 원장의 끝난 런 · 최신순 ≤20) · `landed`(그 시각 뒤 main 에 병합된 PR · ≤30 · 실패면 `[]` ⊕ `landedError`) ·
+ *  도는 항목마다 `objective`(그 런 원장의 `start.feature`). 없으면 응답은 종전 그대로다(동기 응답). */
+export function handleHarnessRunsGet(req: Request, _metaApi: HarnessMetaApi, deps: HarnessApiDeps = {}): Response | Promise<Response> {
   const runs: RunningRunsResult = (deps.queryRunningRuns ?? queryRunningRuns)({ includeTest: false });
-  return json(runs);
+  const raw = new URL(req.url).searchParams.get('finishedSince');
+  if (raw === null) return json(runs);
+  const sinceMs = Number(raw);
+  if (!raw.trim() || !Number.isFinite(sinceMs) || sinceMs < 0) {
+    return json({ error: 'usage: GET /v1/harness/runs?finishedSince=<epoch ms>' }, 400);
+  }
+  return (async () => {
+    const landedWork = listLandedPrs(sinceMs, deps.landed ?? {});
+    const dir = deps.ledgerDir ?? runLedgerDir();
+    const finished = collectFinishedRuns(dir, sinceMs);
+    const entries = runs.entries.map((entry) => {
+      const objective = runObjectiveFromLedgers(entry.runId, entry.ledgerDirectories?.length ? entry.ledgerDirectories : [dir]);
+      return objective ? { ...entry, objective } : entry;
+    });
+    const landed = await landedWork;
+    debug.log('harness-http', 'runs-finished', {
+      sinceMs, count: finished.runs.length, scannedFiles: finished.scannedFiles, skippedFiles: finished.skippedFiles,
+      landed: landed.prs.length, landedCached: landed.cached === true, ...(landed.error ? { landedError: landed.error } : {}),
+    });
+    return json({
+      ...runs,
+      entries,
+      finished: finished.runs,
+      finishedObservation: { sinceMs, scannedFiles: finished.scannedFiles, skippedFiles: finished.skippedFiles, limit: FINISHED_RUNS_LIMIT },
+      landed: landed.prs,
+      ...(landed.truncated ? { landedTruncated: true } : {}),
+      ...(landed.error ? { landedError: landed.error } : {}),
+    });
+  })();
 }
 
 /** Return the human-readable skeleton events persisted for one harness run. */

package/src/nexus/api/http-server.ts

@@ -15,6 +15,7 @@
 // Port policy (N1-2 decision): auto-pick from 31415 upward. Actual port
 // is recorded in runtime.json + printed in boot banner.
 
+import { getUserConfig } from '../../user-config.js';
 import type { TelegramEvent } from '../../workflow-runtime/triggers/telegram-source.js';
 import { spawnSync } from 'node:child_process';
 import { compareTokenConstTime } from '../../acp/transport/auth.js';
@@ -198,6 +199,11 @@ import { handleMcpResourceGet, MCP_RESOURCE_ROUTE_PATH } from './mcp-resource-ro
 import { APPROVALS_MERGES_PATH, DESIGN_DIRECTION_PATH, DESIGN_PREVIEW_PATH_PREFIX, DESIGN_PREVIEWS_PATH, DESIGN_SYSTEM_PATH, IPA_PATH_PREFIX, MANIFEST_PATH } from './rest-route-paths.js';
 import { handleMergeApprovals } from './merge-approvals.js';
 import { GRAPH_APPROVALS_PATH, handleGraphApprovals } from './graph-approvals.js';
+import { handleExecRequests } from './exec-requests.js';
+import { handleSeatRequests, SEAT_REQUESTS_PATH, type SeatRequestsDeps } from './seat-requests.js';
+import { handleConsultRequests, CONSULT_REQUESTS_PATH, type ConsultRequestsDeps } from './consult-requests.js';
+import { ExecRequestRunner } from '../../exec-requests/runner.js';
+import { FIELD_SERVER_MAX_BODY_BYTES, FIELD_UPLOADS_PATH, FIELD_REEL_PATH, FIELD_REEL_FILE_PATH, handleFieldUploads } from './field-uploads.js';
 import { handleLiveDetail, LIVE_DETAIL_PATH } from './live-detail.js';
 import { handleLiveShipped, LIVE_SHIPPED_PATH } from './live-shipped.js';
 import { handleMcpWidgetCall, MCP_WIDGET_CALL_ROUTE_PATH, persistWidgetTurnToSessionStore } from './mcp-widget-call-route.js';
@@ -235,6 +241,7 @@ import {
   parseErrorsPath,
 } from './errors.js';
 import { handleChatBackendDetection } from './chat-backend-detection.js';
+import { handleChatFastPathConfig } from './chat-fast-path-config.js';
 import { connectInfoTokenAllowed, handleConnectInfoGet, handleConnectTokenMint, type ConnectInfoCtx } from './connect-info.js';
 import { handleStaticAppRequest, pathMatchesStaticPrefix } from './static-app.js';
 import {
@@ -445,6 +452,9 @@ export type NexusWsBridgeInit = Omit<WsBridgeOpts, 'hostname' | 'port'>;
 export interface NexusHttpServerOpts {
   /** Optional installer state root for isolated API consumers and tests. */
   pluginStateRoot?: string;
+  execRequests?: ExecRequestRunner;
+  seatRequests?: SeatRequestsDeps;
+  consultRequests?: ConsultRequestsDeps;
   state: NexusState;
   registry: TabRegistry;
   eventBus: NexusEventBus;
@@ -739,12 +749,16 @@ export function startNexusHttpServer(opts: NexusHttpServerOpts): NexusHttpServer
         port,
         hostname,
         idleTimeout: 255,
+        // Bun 기본 128 MB 로는 현장 업로드(파일 200 MB · 요청 500 MB · JSON base64)가 못 들어온다.
+        maxRequestBodySize: FIELD_SERVER_MAX_BODY_BYTES,
         fetch: async (req: Request, srv: unknown) =>
           (await routeRequest(req, opts, srv as BunServerLike, bridge, devProxyRef, { hostname, port })) ??
           new Response(null, { status: 101 }),
         ...(websocketHandler ? { websocket: websocketHandler } : {}),
       } as unknown as Parameters<typeof Bun.serve>[0];
       server = Bun.serve(fetchOpts);
+      // 데몬이 «실제로» 떴을 때만 재시작 복구(맡긴 일) — 주입된 러너(시험)는 건드리지 않는다.
+      if (!opts.execRequests) { try { execRequestRunner().reconcileInterrupted(); } catch { /* 복구 실패가 서버 기동을 막지 않는다 */ } }
       resolvedPort = port;
       break;
     } catch (err) {
@@ -783,6 +797,13 @@ function isPortBusy(err: unknown): boolean {
   return /EADDRINUSE|address already in use/i.test(msg);
 }
 
+let execRequestRunnerInstance: ExecRequestRunner | undefined;
+/** 게으른 한 벌 — import 만으로는 만들지 않는다(재시작 복구가 import 에 묶이지 않게). */
+function execRequestRunner(): ExecRequestRunner {
+  execRequestRunnerInstance ??= new ExecRequestRunner();
+  return execRequestRunnerInstance;
+}
+
 export async function routeRequest(
   req: Request,
   opts: NexusHttpServerOpts,
@@ -831,16 +852,26 @@ export async function routeRequest(
   // Per-route checkAuth calls below stay in place.
   // OPTIONS is a CORS preflight and cannot carry Authorization; existing
   // handlers answer it themselves, so the gate does not swallow it.
-  // A runtime-less tab mutation still needs authentication before the
-  // dispatcher can return its 503. Do not enable this fallback for other paths.
-  const runtimeLessTabMutation = !opts.metaApi && method !== 'GET' && method !== 'OPTIONS'
-    && (pathname === '/v1/nexus/tabs' || pathname.startsWith('/v1/nexus/tabs/'));
+  // Without metaApi, only the owner bearer may reach these runtime-less
+  // meta-API stubs. All other private paths remain default-denied.
+  const runtimeLessMetaRoute = !opts.metaApi && (
+    (method !== 'GET' && method !== 'OPTIONS'
+      && (pathname === '/v1/nexus/tabs' || pathname.startsWith('/v1/nexus/tabs/')))
+    || (method === 'GET' && (
+      ['/v1/simulations', '/v1/tools', '/v1/intake', '/v1/sessions', '/v1/control-signals', '/v1/turns/last/screenshot'].includes(pathname)
+      || pathname.startsWith('/v1/recordings/')
+    ))
+    || (method === 'POST' && (
+      ['/v1/intake', '/v1/sessions/external', '/v1/control-signals', '/v1/prompt'].includes(pathname)
+      || pathname.startsWith('/v1/hitl/callback/')
+    ))
+  );
   if (
     method !== 'OPTIONS'
     && pathname.startsWith('/v1/')
     && !isPublicRoute(method, pathname, { setupMode: false })
   ) {
-    const fallbackToken = runtimeLessTabMutation ? ensureAuthToken().token : undefined;
+    const fallbackToken = runtimeLessMetaRoute ? ensureAuthToken().token : undefined;
     const offered = req.headers.get('authorization');
     const fallbackAuthorized = fallbackToken !== undefined && offered?.startsWith('Bearer ') === true
       && compareTokenConstTime(offered.slice('Bearer '.length).trim(), fallbackToken);
@@ -916,12 +947,39 @@ export async function routeRequest(
     });
   }
 
+  if (pathname === SEAT_REQUESTS_PATH) {
+    if (!opts.metaApi || !checkAuth(req, opts.metaApi)) return jsonResponse({ error: 'unauthorized' }, 401);
+    return handleSeatRequests(req, opts.seatRequests);
+  }
+
+  if (pathname === CONSULT_REQUESTS_PATH) {
+    if (!opts.metaApi || !checkAuth(req, opts.metaApi)) return jsonResponse({ error: 'unauthorized' }, 401);
+    return handleConsultRequests(req, opts.consultRequests);
+  }
+
+  if (pathname === '/v1/exec-requests' || pathname.startsWith('/v1/exec-requests/')) {
+    if (!opts.metaApi || !checkAuth(req, opts.metaApi)) return jsonResponse({ error: 'unauthorized' }, 401);
+    if (/^\/v1\/exec-requests\/[^/]+\/files\//.test(pathname)) {
+      const credential = bearerCredential(req, opts.metaApi);
+      if (credential !== 'bearer-match' && credential !== 'temp-token') return jsonResponse({ error: 'unauthorized' }, 401);
+    }
+    return handleExecRequests(req, opts.execRequests ?? execRequestRunner());
+  }
+
   if (pathname === GRAPH_APPROVALS_PATH || pathname.startsWith(`${GRAPH_APPROVALS_PATH}/`)) {
     return handleGraphApprovals(req, {
       authorize: (request) => !!opts.metaApi && checkAuth(request, opts.metaApi),
       authReason: (request) => (opts.metaApi ? bearerCredential(request, opts.metaApi) : undefined),
     });
   }
+  // 현장 업로드(owner 전용) — GET 목록 · POST 저장. 저장 규칙 정본 = src/field/field-media.ts.
+  if ((pathname === FIELD_UPLOADS_PATH && (method === 'GET' || method === 'POST'))
+    || ((pathname === FIELD_REEL_PATH || pathname === FIELD_REEL_FILE_PATH) && method === 'GET')) {
+    return handleFieldUploads(req, {
+      authorize: (request) => !!opts.metaApi && checkAuth(request, opts.metaApi),
+      configuredEvent: () => { try { return getUserConfig().telegram?.fieldDefaultEvent; } catch { return undefined; } },
+    });
+  }
   if (pathname === APPROVALS_MERGES_PATH || pathname.startsWith(`${APPROVALS_MERGES_PATH}/`)) {
     return handleMergeApprovals(req, {
       authorize: (request) => !!opts.metaApi && checkAuth(request, opts.metaApi),
@@ -1208,6 +1266,11 @@ export async function routeRequest(
     return handleGraphsValidatePost(req, opts.metaApi);
   }
 
+  if (pathname === '/v1/config/chat-fast-path' && (method === 'GET' || method === 'PUT')) {
+    if (!opts.metaApi || !checkAuth(req, opts.metaApi)) return jsonResponse({ error: 'unauthorized' }, 401);
+    return handleChatFastPathConfig(req);
+  }
+
   // Mutation routes (PR ι) — POST/PATCH/DELETE on /v1/nexus/tabs[/:id[/action]].
   // Templates POST handled here too (PR κ).
   // Config / secrets PUT/POST/DELETE here too (PR μ).