elanous 0.2.5 → 0.2.7

package/src/task-orchestrator/surfaces/pod-command-job.ts

@@ -11,6 +11,7 @@ import { getUserConfig } from '../../user-config.js';
 import { debug } from '../../debug/log.js';
 import { effectiveInstanceRoot } from '../../instance/resolve.js';
 import { collectPodArtifacts } from './pod-artifact-return.js';
+import { podBunCacheVolume } from './pod-bun-cache.js';
 import { type PodPoolMember, PodPoolScheduler, resolvePodPoolSpec, parsePodPool, checkPodPool, syncPoolImages, type PoolKubectl } from './pod-pool.js';
 import { readSkillEnvFiles } from './pod-skills.js';
 import { podSourceScript, type PodSource } from './pod-source-receive.js';
@@ -76,6 +77,7 @@ export interface PodCommandJobInput {
   /** 저장소를 clone 한다 — 비공개 저장소라 GitHub 토큰이 Secret 으로 간다(명시 opt-in). 기본은 clone 없이 `~/work` 에서 이미지의 `elanous` 로 돈다. */
   clone?: boolean;
   hostMirror?: string;
+  bunCache?: string;
   /** 컨테이너 메모리 한도(기본 16Gi) — 게이트가 파일 하나 격리 Job 에 올린다. */
   memoryLimit?: string;
   source?: PodSource;
@@ -94,6 +96,7 @@ export function podCommandJobManifest(o: PodCommandJobInput): Record<string, unk
     if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/u.test(name)) throw new Error(`pod command skill name rejected: ${name}`);
   }
   const grok = o.llm === 'grok';
+  const bunCache = o.bunCache ? podBunCacheVolume(o.bunCache) : undefined;
   const quotedArgs = o.command.map(bashSingleQuote).join(' ');
   const credLines = [
     ...(grok ? ['mkdir -p ~/.grok && install -m 600 /creds/grok-auth.json ~/.grok/auth.json'] : []),
@@ -108,6 +111,7 @@ export function podCommandJobManifest(o: PodCommandJobInput): Record<string, unk
     ...(o.clone
       ? ['export GH_TOKEN="$(cat /creds/gh-token)" && gh auth setup-git', podSourceScript(o.source ?? { kind: 'default' }, o.repoUrl)]
       : ['mkdir -p ~/work && cd ~/work']),
+    ...(bunCache ? [bunCache.shellPrefix] : []),
     `set -- ${quotedArgs}`,
     '"$@"',
     'rc=$?',
@@ -138,14 +142,16 @@ export function podCommandJobManifest(o: PodCommandJobInput): Record<string, unk
               { name: 'ELANOUS_SUBSTRATE', value: 'pod' },
               { name: 'ELANOUS_POD_NAME', valueFrom: { fieldRef: { fieldPath: 'metadata.name' } } },
             ],
-            ...(secretKeys || o.hostMirror ? { volumeMounts: [
+            ...(secretKeys || o.hostMirror || bunCache ? { volumeMounts: [
               ...(secretKeys ? [{ name: 'creds', mountPath: '/creds', readOnly: true }] : []),
               ...(o.hostMirror ? [{ name: 'host-mirror', mountPath: '/host-mirror', readOnly: true }] : []),
+              ...(bunCache ? [bunCache.volumeMount] : []),
             ] } : {}),
           }],
-          ...(secretKeys || o.hostMirror ? { volumes: [
+          ...(secretKeys || o.hostMirror || bunCache ? { volumes: [
             ...(secretKeys ? [{ name: 'creds', secret: { secretName: `${o.name}-creds`, defaultMode: 0o400 } }] : []),
             ...(o.hostMirror ? [{ name: 'host-mirror', hostPath: { path: o.hostMirror, type: 'Directory' } }] : []),
+            ...(bunCache ? [bunCache.volume] : []),
           ] } : {}),
         },
       },
@@ -201,6 +207,7 @@ export interface RunPodCommandOptions {
   llm?: 'grok';
   clone?: boolean;
   hostMirror?: string;
+  bunCache?: string;
   /** 컨테이너 메모리 한도(기본 16Gi). */
   memoryLimit?: string;
   source?: PodSource;
@@ -263,6 +270,8 @@ export async function runPodCommand(options: RunPodCommandOptions): Promise<PodC
   const hostMirror = (options.hostMirror ?? env.ELANOUS_POD_HOST_MIRROR
     ?? (options.configHostMirror ?? (() => getUserConfig().pod?.hostMirror))())?.trim() || undefined;
   if (hostMirror && !isAbsolute(hostMirror)) throw new Error('pod.hostMirror must be an absolute directory path');
+  const bunCache = options.bunCache?.trim() || undefined;
+  if (bunCache && !isAbsolute(bunCache)) throw new Error('pod.bunCache must be an absolute directory path');
 
   let member: PodPoolMember | null = null;
   let pool = options.poolScheduler;
@@ -328,7 +337,7 @@ export async function runPodCommand(options: RunPodCommandOptions): Promise<PodC
       name, namespace, image: member?.imageRef ?? image,
       ...(member?.imageRef ? { imagePullPolicy: 'IfNotPresent' as const } : {}),
       repoUrl, command, skills, ...(llm ? { llm } : {}), ...(options.clone ? { clone: true } : {}),
-      ...(options.source ? { source: options.source } : {}), ...(hostMirror ? { hostMirror } : {}), ...(options.memoryLimit ? { memoryLimit: options.memoryLimit } : {}), deadlineSeconds,
+      ...(options.source ? { source: options.source } : {}), ...(hostMirror ? { hostMirror } : {}), ...(bunCache ? { bunCache } : {}), ...(options.memoryLimit ? { memoryLimit: options.memoryLimit } : {}), deadlineSeconds,
       ...(options.runId ? { runId: options.runId } : {}),
     });
     kubectl(['-n', namespace, 'delete', 'job', name, '--ignore-not-found']);

package/src/task-orchestrator/surfaces/pod-ledger-collect.ts

@@ -2,6 +2,7 @@ import { appendFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } fr
 import { gunzipSync } from 'node:zlib';
 import { debug } from '../../debug/log.js';
 import { runLedgerDir, runLedgerPath } from '../../self-implement/run-ledger.js';
+import { ledgerLineToLogEvent } from './pod-ledger-events.js';
 
 type Ledger = { runId: string; jsonl: string };
 type Incomplete = { runId: string; reason: string };
@@ -124,7 +125,7 @@ export function createPodLedgerFollower(opts: {
   let owned = false;
   let disabled = false;
   let lastProgressAt = now();
-  let lastProgressEvent: string | null = null;
+  let visibleProgressEvent: string | null = null;
   let lastActivityMeasuredAt = lastProgressAt;
   let lastActivityLogAt = -Infinity;
   let nextStallMinute = stallMinutes;
@@ -132,11 +133,11 @@ export function createPodLedgerFollower(opts: {
   function checkStall(ledgerRead: boolean, activityMeasured: boolean) {
     const idleMinutes = Math.max(0, (now() - lastProgressAt) / 60_000);
     if (idleMinutes >= nextStallMinute) {
-      log('self-implement.pod', 'stalled', { runId: opts.runId, lastProgressEvent, idleMinutes });
+      log('self-implement.pod', 'stalled', { runId: opts.runId, lastProgressEvent: visibleProgressEvent, idleMinutes });
       const observation = ledgerRead
         ? (activityMeasured ? '원장·작업 트리 모두 조용함' : '원장 조용함')
         : '원장 못 잼';
-      onStall(`[pod] 진행 없음 ${Math.floor(idleMinutes)}분 — ${observation} · 마지막 진행 ${lastProgressEvent ?? '없음'}${activityMeasured ? '' : ' (작업 트리 못 잼)'}`);
+      onStall(`[pod] 진행 없음 ${Math.floor(idleMinutes)}분 — ${observation} · 마지막 진행 ${visibleProgressEvent ?? '없음'}${activityMeasured ? '' : ' (작업 트리 못 잼)'}`);
       stalled = true;
       nextStallMinute = (Math.floor(idleMinutes / stallMinutes) + 1) * stallMinutes;
     }
@@ -169,7 +170,7 @@ export function createPodLedgerFollower(opts: {
           if (stalled) log('self-implement.pod', 'stall-cleared', { runId: opts.runId, idleMinutes });
           stalled = false;
           lastProgressAt = now();
-          lastProgressEvent = 'worktree-activity';
+          visibleProgressEvent = 'worktree-activity';
           nextStallMinute = stallMinutes;
           if (now() - lastActivityLogAt >= 5 * 60_000) {
             log('self-implement.pod', 'worktree-activity', { runId: opts.runId, files });
@@ -190,6 +191,11 @@ export function createPodLedgerFollower(opts: {
       log('self-implement.pod', 'ledger-live-appended', { runId: opts.runId, lines: complete.split('\n').filter(Boolean).length, bytes: Buffer.byteLength(complete), offset });
       for (const line of complete.split('\n')) {
         if (!line) continue;
+        let logEvent: ReturnType<typeof ledgerLineToLogEvent>;
+        try {
+          logEvent = ledgerLineToLogEvent(line, opts.runId);
+          if (logEvent) log(logEvent.category, logEvent.event, logEvent.data);
+        } catch { /* A failed host log write must not interrupt ledger following or stall accounting. */ }
         let entry: unknown;
         try { entry = JSON.parse(line); } catch { continue; }
         const event = (entry && typeof entry === 'object' && 'event' in entry) ? entry.event : undefined;
@@ -198,7 +204,7 @@ export function createPodLedgerFollower(opts: {
         if (stalled) log('self-implement.pod', 'stall-cleared', { runId: opts.runId, idleMinutes });
         stalled = false;
         lastProgressAt = now();
-        lastProgressEvent = event;
+        visibleProgressEvent = logEvent?.event ?? '[redacted]';
         nextStallMinute = stallMinutes;
       }
       checkStall(true, activityMeasured);

package/src/task-orchestrator/surfaces/pod-ledger-events.ts

@@ -0,0 +1,68 @@
+const SECRET_FIELD = /token|secret|password|authorization|key/i;
+const SAFE_FIELD = /^[A-Za-z][A-Za-z0-9_]{0,63}$/;
+const SECRET_VALUE = /(?:\b(?:bearer|basic)\s+\S+|\b(?:token|secret|password|authorization|api[-_]?key|access[-_]?key|private[-_]?key)\b\s*(?:is|[=:])\s*["']?\S+|\b(?:sk-[A-Za-z0-9_-]{8,}|gh[pousr]_[A-Za-z0-9_]{8,}))\b/i;
+const MAX_FIELDS = 32;
+// Review R2: only lifecycle events the host needs to see, and no free text. Event names must start with a known
+// lifecycle prefix; string fields survive only when they are short code-like values in a fixed set of keys.
+const EVENT_ALLOWED = /^(?:gate|gated|review|reviewed|repair|repaired|rework|merge|merged|pr|land|landed|stage|round|supervisor|child|plan|planned|decompose|decomposed|shard|stall|harvest|decision|run|pipeline|progress|human|start|started|finish|finished|done|implement|implemented|commit|test|typecheck)(?:-(?:started|finished|round|opened|closed|failed|passed|blocked|done|entry|node|outcome|delivery|decision|stop|merged|ready|requested|resolved|result|fix|must-fix|verdict|skipped|origin|cleared))*$/;
+const CODE_FIELDS = new Set(['stage', 'outcome', 'verdict', 'status', 'kind', 'phase', 'role', 'result']);
+const CODE_VALUE = /^[a-z0-9_.:-]{1,40}$/i;
+
+function secretValues(root: Record<string, unknown>): string[] {
+  const secrets: string[] = [];
+  const pending: unknown[] = [root];
+  while (pending.length) {
+    const current = pending.pop();
+    if (!current || typeof current !== 'object') continue;
+    if (Array.isArray(current)) {
+      pending.push(...current);
+      continue;
+    }
+    for (const [name, value] of Object.entries(current)) {
+      if (SECRET_FIELD.test(name) && typeof value === 'string' && value.length >= 3) secrets.push(value);
+      if (value && typeof value === 'object') pending.push(value);
+    }
+  }
+  return secrets;
+}
+
+/** Project bounded ledger metadata, excluding named secrets and recognizable credential values. */
+export function ledgerLineToLogEvent(line: string, runId: string): {
+  category: string;
+  event: string;
+  data: Record<string, unknown>;
+} | undefined {
+  let entry: unknown;
+  try { entry = JSON.parse(line); } catch { return undefined; }
+  if (!entry || typeof entry !== 'object' || Array.isArray(entry) || !('event' in entry) || typeof entry.event !== 'string') return undefined;
+  // The real run-ledger writer wraps observer fields in `data`; older/synthetic lines can be flat.
+  const details = 'data' in entry && entry.data && typeof entry.data === 'object' && !Array.isArray(entry.data)
+    ? entry.data as Record<string, unknown> : undefined;
+  const sources = [entry, details].filter((source): source is Record<string, unknown> => source !== undefined);
+  const knownSecrets = secretValues(entry);
+  const containsCredential = (value: string) => SECRET_VALUE.test(value) || knownSecrets.some((secret) => value.includes(secret));
+  if (containsCredential(entry.event) || !EVENT_ALLOWED.test(entry.event)) return undefined;
+
+  const data: Record<string, unknown> = { runId };
+  let fields = 0;
+  for (const source of sources) {
+    for (const [name, value] of Object.entries(source)) {
+      if (name === 'event' || name === 'runId' || name === 'data' || !SAFE_FIELD.test(name) || SECRET_FIELD.test(name)) continue;
+      if (fields >= MAX_FIELDS) break;
+      const countName = `${name}Count`;
+      const outputName = Array.isArray(value) || value && typeof value === 'object' ? countName : name;
+      if (!SAFE_FIELD.test(outputName) || SECRET_FIELD.test(outputName) || Object.hasOwn(data, outputName)) continue;
+      if (typeof value === 'string') {
+        // Free text (reasons, messages, patches) never leaves the pod ledger; only short code values in known keys.
+        if (!CODE_FIELDS.has(name) || !CODE_VALUE.test(value) || containsCredential(value)) continue;
+        data[name] = value;
+      } else if (typeof value === 'number' && Number.isFinite(value) || typeof value === 'boolean' || value === null) {
+        data[name] = value;
+      } else if (Array.isArray(value) || value && typeof value === 'object') {
+        data[countName] = Array.isArray(value) ? value.length : Object.keys(value).length;
+      } else continue;
+      fields += 1;
+    }
+  }
+  return { category: 'self-implement.pod.ledger', event: entry.event, data };
+}

package/src/task-orchestrator/surfaces/self-implement-pod.ts

@@ -50,7 +50,7 @@ import { findGitDir } from '../../git-fs/locate.js';
 import { debug } from '../../debug/log.js';
 import { selectLiveDetail } from '../../live/detail-switch.js';
 import { authStorePath } from '../../oauth/store.js';
-import { grokAuthFilePath, resolveGrokCredential } from '../../grok/credential.js';
+import { grokAuthFilePath, isGrokSubscriptionExpiring, refreshGrokSubscriptionToken, resolveGrokCredential } from '../../grok/credential.js';
 import { defaultGrokModel } from '../../grok/models.js';
 import { resolveHostId } from '../../platform/host-id.js';
 import { envLiteral } from '../../platform/env-literal.js';
@@ -171,12 +171,26 @@ export function hostCredentials(account: string, storePath: string = authStorePa
   return { elanousAuth, codexAuth, ghToken: ghToken() };
 }
 
-/** resolveGrokCredential 과 동일한 출처를 읽되 Pod 로는 refresh 없는 access 사본만 보낸다. */
+/** A Pod gets a refresh-less access copy, so the copy must outlive the Job: same rule as the Codex path (3 h). */
+export const POD_GROK_MIN_VALIDITY_MS = 3 * 3600_000;
+
+/** resolveGrokCredential 과 동일한 출처를 읽되 Pod 로는 refresh 없는 access 사본만 보낸다.
+ *  POD4 (10-01): the copy used to ship whatever the host had — an AUTH1 shard copied a token that had expired
+ *  4 minutes earlier and died at `grok-credential-preflight status=expired`. Refresh on the host first. */
 export function hostGrokCredentials(opts: {
   home?: string; env?: NodeJS.ProcessEnv; apiKeyOptIn?: boolean; ghToken?: () => string;
+  /** Test seams — the host refresh (read-only `grok models`) and the expiry probe. */
+  refresh?: () => void; isExpiring?: () => boolean;
 } = {}): { grokAuth?: string; grokApiKey?: string; ghToken: string } {
-  const credential = resolveGrokCredential({ home: opts.home, env: opts.env });
+  let credential = resolveGrokCredential({ home: opts.home, env: opts.env });
   if (credential?.kind === 'subscription') {
+    const expiring = opts.isExpiring ?? (() => isGrokSubscriptionExpiring({ home: opts.home, bufferMs: POD_GROK_MIN_VALIDITY_MS }));
+    if (expiring()) {
+      try { (opts.refresh ?? (() => { refreshGrokSubscriptionToken({ home: opts.home }); }))(); } catch { /* judged below */ }
+      if (expiring()) throw new Error('grok: 구독 access 토큰이 3시간 안에 만료 — 호스트 갱신(grok models)도 못 늘렸다 · 호스트에서 grok login 후 다시');
+      credential = resolveGrokCredential({ home: opts.home, env: opts.env });
+      if (credential?.kind !== 'subscription') throw new Error('grok: 갱신 뒤 구독 자격을 다시 읽지 못했다');
+    }
     const scopes = JSON.parse(readFileSync(grokAuthFilePath(opts.home), 'utf8')) as Record<string, unknown>;
     const redacted: Record<string, { key: string; expires_at?: string; user_id?: string }> = {};
     for (const [name, value] of Object.entries(scopes)) {
@@ -219,6 +233,64 @@ function githubRepositoryFromUrl(repoUrl: string): string | null {
 
 /** Job 스크립트의 salvage 단계 — 자식 rc 가 0 이 아닐 때만, 변경·미푸시 커밋이 있는 격리 워크트리를 `salvage/<job>/<worktree>` 로 push.
  *  main·self-impl/ 로는 절대 안 민다. 실패해도 제어 흐름을 바꾸지 않는다(호출자는 이 뒤에 `exit $rc`). */
+/**
+ * App installation tokens live one hour and only the host process renews them (at 10 minutes left).
+ * If that process dies (host reboot), nothing renews the Pod's token. hosts.yml unchanged for this long
+ * means the host is gone. Push a snapshot while the token still works.
+ */
+export const POD_GH_STALE_SECONDS = 53 * 60;
+
+/** Snapshot every worktree to salvage/<job>/<wt>-early without touching the child's index, worktree or HEAD. */
+export function podEarlySalvageScript(): string {
+  return [
+    'job_name="${ELANOUS_POD_NAME:-unknown-job}"',
+    'while IFS= read -r wt; do',
+    '  [ -n "$wt" ] || continue',
+    '  case "$wt" in /*) ;; *) continue ;; esac',
+    '  wt_name=$(basename -- "$wt")',
+    "  case \"$wt_name\" in ''|.*|*/*|*'..'*) continue ;; esac",
+    '  branch="salvage/${job_name}/${wt_name}-early"',
+    '  (',
+    '    set +e',
+    '    cd -- "$wt" || exit 0',
+    '    head=$(git rev-parse --verify -q HEAD) || { printf \'ELANOUS_POD_SALVAGE_NONE early-no-head\\n\'; exit 0; }',
+    '    idx=$(mktemp) || exit 0',
+    '    cp -- "$(git rev-parse --git-path index)" "$idx" 2>/dev/null || :',
+    '    GIT_INDEX_FILE="$idx" git add -A -- . >/dev/null 2>&1',
+    '    tree=$(GIT_INDEX_FILE="$idx" git write-tree 2>/dev/null)',
+    '    rm -f -- "$idx"',
+    '    [ -n "$tree" ] || { printf \'ELANOUS_POD_SALVAGE_NONE early-write-tree-failed\\n\'; exit 0; }',
+    '    base=$(git rev-parse --verify -q origin/HEAD || git rev-parse --verify -q origin/main || true)',
+    '    if [ "$tree" = "$(git rev-parse "${head}^{tree}")" ]; then',
+    '      if [ -z "$base" ] || [ "$(git rev-list --count "${base}..${head}" 2>/dev/null || echo 1)" = 0 ]; then printf \'ELANOUS_POD_SALVAGE_NONE clean\\n\'; exit 0; fi',
+    '      commit=$head',
+    '    else',
+    '      commit=$(git commit-tree "$tree" -p "$head" -m "salvage(early): ${job_name} host token refresh stopped") || { printf \'ELANOUS_POD_SALVAGE_NONE commit-failed\\n\'; exit 0; }',
+    '    fi',
+    '    git push --force origin "${commit}:refs/heads/${branch}" || { printf \'ELANOUS_POD_SALVAGE_NONE push-failed\\n\'; exit 0; }',
+    "    printf 'ELANOUS_POD_SALVAGE %s %s\\n' \"$branch\" \"$commit\"",
+    '  )',
+    "done < <(git worktree list --porcelain 2>/dev/null | awk '/^worktree / { sub(/^worktree /, \"\"); print }')",
+  ].join('\n');
+}
+
+/** Background watchdog: fires the early snapshot once when hosts.yml has not been rewritten for staleSeconds. */
+export function podGithubWatchdogScript(staleSeconds: number, intervalSeconds = 30): string {
+  return [
+    '(',
+    `  while sleep ${intervalSeconds}; do`,
+    '    f="$GH_CONFIG_DIR/hosts.yml"',
+    '    m=$(stat -c %Y "$f" 2>/dev/null || stat -f %m "$f" 2>/dev/null) || continue',
+    '    age=$(( $(date +%s) - m ))',
+    `    [ "$age" -ge ${staleSeconds} ] || continue`,
+    "    printf 'ELANOUS_POD_GH_STALE %s\\n' \"$age\"",
+    `    ${podEarlySalvageScript().split('\n').join('\n    ')}`,
+    '    break',
+    '  done',
+    ') & gh_watch_pid=$!',
+  ].join('\n');
+}
+
 export function podSalvageScript(): string {
   return [
     'if [ "${rc:-0}" -ne 0 ]; then',
@@ -368,7 +440,7 @@ export function podMemoryLimitFor(feature: string, env: NodeJS.ProcessEnv | Read
   return { limit: a !== null && b !== null && a > b ? base : high, tier, source };
 }
 
-export function podJobManifest(o: { name: string; namespace: string; image: string; /** 레지스트리 이미지면 IfNotPresent(노드가 pull) · 반입 이미지면 Never. */ imagePullPolicy?: 'Never' | 'IfNotPresent'; repoUrl: string; source?: PodSource; hostMirror?: string; args: readonly string[]; passEnv: readonly string[]; deadlineSeconds: number; runId?: string; parentRunId?: string; armEnv?: Readonly<Record<string, string>>; hostId?: string; imageCommit?: string | null; skillEnvs?: readonly string[]; memoryLimit?: string; goalDoc?: string; grokCredential?: 'subscription' | 'api_key'; codexAccounts?: readonly string[]; appCredential?: boolean }): Record<string, unknown> {
+export function podJobManifest(o: { name: string; namespace: string; image: string; /** 레지스트리 이미지면 IfNotPresent(노드가 pull) · 반입 이미지면 Never. */ imagePullPolicy?: 'Never' | 'IfNotPresent'; repoUrl: string; source?: PodSource; hostMirror?: string; args: readonly string[]; passEnv: readonly string[]; deadlineSeconds: number; runId?: string; parentRunId?: string; armEnv?: Readonly<Record<string, string>>; hostId?: string; imageCommit?: string | null; skillEnvs?: readonly string[]; memoryLimit?: string; goalDoc?: string; grokCredential?: 'subscription' | 'api_key'; codexAccounts?: readonly string[]; appCredential?: boolean; /** Test seam — default POD_GH_STALE_SECONDS. */ githubStaleSeconds?: number }): Record<string, unknown> {
   const quoted = o.args.map((a) => `'${a.replace(/'/g, `'\\''`)}'`).join(' ');
   const goalPath = o.goalDoc ? `'${(o.goalDoc.startsWith('-') ? `./${o.goalDoc}` : o.goalDoc).replace(/'/g, `'\\''`)}'` : undefined;
   const askBaseIndex = o.goalDoc ? o.args.indexOf('--base') : -1;
@@ -394,6 +466,7 @@ export function podJobManifest(o: { name: string; namespace: string; image: stri
     ] : []),
     // Only fixed command shapes leave the Pod; arbitrary argv (including shell -c text) is never emitted.
     `(while :; do { mem=$(if [ -r /sys/fs/cgroup/memory.current ]; then cat /sys/fs/cgroup/memory.current; elif [ -r /sys/fs/cgroup/memory/memory.usage_in_bytes ]; then cat /sys/fs/cgroup/memory/memory.usage_in_bytes; else printf -- -; fi); top=$(ps -eo rss=,comm=,args= --sort=-rss | head -5 | awk 'function encode(s) { gsub(/%/, "%25", s); gsub(/:/, "%3A", s); gsub(/ /, "%20", s); gsub(/\\t/, "%09", s); return s } { rss=$1; name=$2; sub(/^[[:space:]]*[0-9]+[[:space:]]+[^[:space:]]+[[:space:]]*/, ""); n=split($0, a, /[[:space:]]+/); cmd="<redacted>"; if (name=="sleep" && a[2]=="30") cmd="sleep 30" (n>2 ? " <redacted>" : ""); else if (name=="bun") { cmd="bun <redacted>"; if (a[2]=="test") cmd="bun test <redacted>"; else if (a[2]=="run") cmd="bun run <redacted>"; else if ((a[2]=="x" || a[2]=="exec") && a[3]=="tsc") cmd="bun x tsc <redacted>" } else if (name=="tsc") cmd="tsc <redacted>"; else if (name=="elanous") { cmd="elanous <redacted>"; if (a[2]=="self") cmd="elanous self <redacted>"; else if (a[2]=="harness") cmd="elanous harness <redacted>" } else if (name=="node") cmd="node <redacted>"; if (name=="sleep" && cmd=="<redacted>") cmd="sleep <redacted>"; else if (cmd=="<redacted>" && name!="bash" && name!="sh") name="other"; printf " %s:%s:%s", rss, encode(name), encode(substr(cmd,1,120)) }'); printf "ELANOUS_MEM %s %s%s\\n" "$(date +%s)" "$mem" "$top"; } || true; sleep 15 || break; done) & mem_sampler_pid=$!`,
+    ...(o.appCredential ? [podGithubWatchdogScript(o.githubStaleSeconds ?? POD_GH_STALE_SECONDS)] : []),
     // 마지막 줄 JSON 이 «맨 끝»이어야 한다(parseSelfImplementJson) — rollup 은 그 앞에.
     goalPath
       ? `elanous harness ask ${goalPath} --json${quotedAsk} > /tmp/si.out 2>&1; rc=$?; bun -e 'const fs=require("fs");const p="/tmp/si.out";const s=fs.readFileSync(p,"utf8");const line=s.trimEnd().split("\\n").at(-1);try{const o=JSON.parse(line);if(o.kind==="self"&&o.result&&typeof o.result==="object")fs.appendFileSync(p,"\\n"+JSON.stringify({...o.result,...(typeof o.ok==="boolean"?{ok:o.ok}:{})})+"\\n")}catch{}'`
@@ -454,6 +527,7 @@ for ledger in "\${ELANOUS_STATE_DIR:-$HOME/.elanous}"/run-ledger/*.jsonl; do
 done
 if [ "$found" -eq 0 ]; then echo ELANOUS_RUN_LEDGER_NONE; fi`,
     'kill "$mem_sampler_pid" 2>/dev/null || true',
+    ...(o.appCredential ? ['kill "$gh_watch_pid" 2>/dev/null || true'] : []),
     'wait "$mem_sampler_pid" 2>/dev/null || true',
     'tail -n 1 /tmp/si.out',
     podSalvageScript(),

package/src/telegram.ts

@@ -66,7 +66,11 @@ import { observeDevRequestRouteFailSoft } from './skills/dev-request-router.js';
 import { runUrlRoute } from './skills/url-route-exec.js';
 import { recordRoutedLinkAbsorbed } from './intake-plane/link-ledger.js';
 import { classifyFrontInput } from './intake-plane/front-classifier.js';
+import { handleTelegramSeatWork, type TelegramSeatWorkDeps } from './intake-plane/telegram-seat-work.js';
 import { effectiveInstanceRoot } from './instance/resolve.js';
+import { getElanousConfigDir } from './elanous-config-dir.js';
+import { defaultFieldEvent, FieldUploadError, parseFieldCaption, resolveFieldMime, saveFieldMedia } from './field/field-media.js';
+import { scheduleFieldReel, type FieldReelOptions } from './field/field-reel.js';
 
 export type TgAttachmentKind = 'photo' | 'voice' | 'audio' | 'document';
 
@@ -105,6 +109,10 @@ export interface TgIncoming {
   botId?: string;
   /** 답장 대상 메시지의 텍스트(force_reply 정정 가로채기용). parseUpdate 가 채운다. */
   replyToText?: string;
+  /** 앨범(media group) id — `#현장` 캡션은 앨범의 첫 항목에만 붙으므로 나머지를 같은 행사로 묶는 데 쓴다. */
+  mediaGroupId?: string;
+  /** 영상 — `#현장` 저장 전용. `attachments` 에 넣지 않는다(LLM 경로의 동작을 안 바꾸려고). */
+  video?: TgIncomingAttachment;
 }
 
 /** Streaming surface passed to the message handler. The handler can
@@ -200,6 +208,14 @@ export interface TelegramBotOpts {
    *  independently of the LLM chat path. Best-effort: errors are
    *  swallowed by the caller — never blocks chat reply. */
   onTriggerTap?: (event: TgTriggerEvent) => void | Promise<void>;
+  /** Test seam for addressed seat intake; defaults to the real intake door. */
+  seatWorkDeps?: TelegramSeatWorkDeps;
+  /** `#현장` 기본 행사 — 없으면 `slashContext.userConfig.telegram.fieldDefaultEvent` · 그것도 없으면 `field-<로컬 날짜>`. */
+  fieldDefaultEvent?: string;
+  /** 시험 seam — 현장 폴더 뿌리(기본 `getElanousConfigDir()`). */
+  fieldRootDir?: () => string;
+  /** 시험에서는 실제 렌더 대신 가짜 실행기를 주입한다. */
+  fieldReel?: FieldReelOptions;
 }
 
 /** Surface-unification v2 (FU-2) — Telegram trigger event passed to
@@ -314,6 +330,15 @@ export class TelegramBot {
    *  the bot under Telegram's ~30/sec global cap without blocking
    *  further if load is bursty but average-safe. */
   private readonly globalWindow: number[] = [];
+  private readonly fieldDefaultEventOpt?: string;
+  private readonly fieldRootDir: () => string;
+  private readonly fieldReel?: FieldReelOptions;
+  private readonly seatWorkDeps: TelegramSeatWorkDeps;
+  /** 앨범 id → `#현장` 행사 · 답장 디바운스. 태그된 앨범만 들어온다. */
+  private readonly fieldGroups = new Map<string, {
+    event: string; at: number; chatId: number; threadId?: number; replyTo: number; count: number;
+    timer?: ReturnType<typeof setTimeout>;
+  }>();
 
   constructor(opts: TelegramBotOpts) {
     if (!opts.token) throw new Error('TelegramBot: token required');
@@ -340,6 +365,10 @@ export class TelegramBot {
     this.slashCommands = opts.slashCommands ?? [];
     this.slashContext = opts.slashContext;
     this.voiceAdapter = opts.voiceAdapter;
+    this.fieldDefaultEventOpt = opts.fieldDefaultEvent;
+    this.fieldRootDir = opts.fieldRootDir ?? getElanousConfigDir;
+    this.fieldReel = opts.fieldReel;
+    this.seatWorkDeps = opts.seatWorkDeps ?? {};
     if (opts.onTriggerTap) {
       // Assign through `as unknown` to bypass `readonly` + private —
       // the tap is set once at construction and never reassigned.
@@ -777,6 +806,7 @@ export class TelegramBot {
     replyTo?: number;
     threadId?: number;
     caption?: string;
+    mimeType?: string;
   } = {}): Promise<{ messageId: number } | undefined> {
     // Per-chat gap mirror — keep telegram happy on rapid document spills.
     const last = this.chatLastSentAt.get(chatId) ?? 0;
@@ -797,7 +827,7 @@ export class TelegramBot {
     new Uint8Array(blobBytes).set(bytes);
     form.set(
       'document',
-      new Blob([blobBytes], { type: 'text/plain' }),
+      new Blob([blobBytes], { type: opts.mimeType ?? 'text/plain' }),
       filename,
     );
 
@@ -1347,11 +1377,107 @@ export class TelegramBot {
     return false;
   }
 
+  /** `#현장` 캡션 사진·영상(이미지·영상 문서 포함)을 현장 폴더에 저장하고 한 줄로 답한다.
+   *  처리했으면 true. 저장 규칙은 HTTP 입구와 같은 `saveFieldMedia` 다. */
+  private async tryHandleFieldUpload(ctx: TgIncoming): Promise<boolean> {
+    const media = [
+      ...ctx.attachments.filter((a) => a.kind === 'photo'
+        || (a.kind === 'document' && resolveFieldMime(a.mimeType, a.fileName ?? '') !== null)),
+      ...(ctx.video ? [ctx.video] : []),
+    ];
+    if (media.length === 0) return false;
+    const now = this.nowImpl();
+    for (const [id, g] of this.fieldGroups) if (now - g.at > 10 * 60_000 && !g.timer) this.fieldGroups.delete(id);
+    const tag = parseFieldCaption(ctx.text);
+    const group = ctx.mediaGroupId ? this.fieldGroups.get(ctx.mediaGroupId) : undefined;
+    if (!tag && !group) return false;
+    const event = tag
+      ? tag.event ?? defaultFieldEvent(
+        this.fieldDefaultEventOpt ?? this.slashContext?.userConfig?.telegram?.fieldDefaultEvent, new Date(now))
+      : group!.event;
+
+    let count: number | null = null;
+    let failure: string | null = null;
+    try {
+      const inputs = [];
+      for (const att of media) {
+        const downloaded = await this.downloadFile(att.fileId);
+        try {
+          inputs.push({
+            originalName: att.fileName ?? downloaded.fileName ?? 'media',
+            mimeType: att.mimeType ?? (att.kind === 'photo' ? 'image/jpeg' : undefined),
+            bytes: new Uint8Array(readFileSync(downloaded.localPath)),
+          });
+        } finally {
+          try { unlinkSync(downloaded.localPath); } catch { /* 이미 없음 */ }
+        }
+      }
+      // 글(자막)은 캡션이 달린 항목에만 있다 — 앨범이면 첫 장에만 붙는다(MK 2026-09-30).
+      const saved = saveFieldMedia(inputs, { rootDir: this.fieldRootDir(), event, device: 'telegram', ...(tag?.text ? { caption: tag.text } : {}) });
+      count = saved.count;
+      scheduleFieldReel(saved.dir, {
+        ...this.fieldReel,
+        notificationKey: `telegram:${this.botId}:${ctx.chatId}:${ctx.threadId ?? ''}:${ctx.mediaGroupId ?? ctx.messageId}`,
+        onDone: async (result) => {
+          const reply = { replyTo: ctx.messageId, threadId: ctx.threadId };
+          if (result.ok && result.file) {
+            const sent = await this.sendDocument(ctx.chatId, readFileSync(result.file), 'reel-9x16.mp4', {
+              ...reply, mimeType: 'video/mp4', caption: `현장 영상 · ${event} · ${result.seconds}초`,
+            });
+            if (!sent) throw new Error('sendDocument failed');
+          } else {
+            await this.sendMessage(ctx.chatId, `현장 영상 실패 · ${event} · ${result.error ?? 'render failed'}`, reply);
+          }
+        },
+      });
+      debug.log('field.upload', 'saved', { surface: 'telegram', files: inputs.length, count, album: !!ctx.mediaGroupId });
+    } catch (err) {
+      failure = err instanceof FieldUploadError ? err.code : 'download-failed';
+      debug.log('field.upload', 'refused', { surface: 'telegram', reason: failure });
+    }
+
+    if (failure !== null) {
+      await this.sendMessage(ctx.chatId, `현장 저장 실패 · ${event} · ${failure}`, { replyTo: ctx.messageId, threadId: ctx.threadId });
+      return true;
+    }
+    const line = (n: number) => `현장 폴더에 저장 · ${event} · 지금 ${n}장`;
+    if (!ctx.mediaGroupId) {
+      await this.sendMessage(ctx.chatId, line(count!), { replyTo: ctx.messageId, threadId: ctx.threadId });
+      return true;
+    }
+    // 앨범은 항목마다 답하지 않는다 — 마지막 항목 뒤 한 번(디바운스)만 최신 수로 답한다.
+    const entry = group ?? { event, at: now, chatId: ctx.chatId, threadId: ctx.threadId, replyTo: ctx.messageId, count: 0 };
+    entry.at = now;
+    entry.count = count!;
+    if (entry.timer) clearTimeout(entry.timer);
+    entry.timer = setTimeout(() => {
+      entry.timer = undefined;
+      void this.sendMessage(entry.chatId, line(entry.count), { replyTo: entry.replyTo, threadId: entry.threadId })
+        .catch((e) => this.log(`field reply failed: ${e instanceof Error ? e.message : String(e)}`));
+    }, 1500);
+    (entry.timer as { unref?: () => void }).unref?.();
+    this.fieldGroups.set(ctx.mediaGroupId, entry);
+    return true;
+  }
+
   private async handleIncoming(ctx: TgIncoming): Promise<void> {
     if (!this.isOwnerAllowed(ctx.userId)) {
       await this.refuseMessage(ctx);
       return;
     }
+    // 현장 업로드 — `#현장` 캡션(또는 태그된 앨범의 나머지)의 사진·영상은 LLM 대신 현장 폴더로.
+    if (await this.tryHandleFieldUpload(ctx)) return;
+    if (ctx.text.startsWith('@')) {
+      const reply = await handleTelegramSeatWork(ctx.text, {
+        chatId: ctx.chatId, messageId: ctx.messageId, threadId: ctx.threadId, botId: ctx.botId,
+      }, this.seatWorkDeps);
+      if (reply !== null) {
+        await this.sendMessage(ctx.chatId, reply, { replyTo: ctx.messageId, threadId: ctx.threadId });
+        return;
+      }
+    }
+    // 영상은 `#현장` 저장 전용으로만 파싱한다 — 그 밖의 영상은 종전처럼 무시한다.
+    if (ctx.video && ctx.attachments.length === 0) return;
     // Cascade-zyu U2 — capture utterance intent at update ingress.
     try {
       const { userIntentLogger } = await import('./user-intent/index.js');
@@ -2069,6 +2195,7 @@ export class TelegramBot {
 interface PhotoSize { file_id: string; file_size?: number; width: number; height: number }
 interface VoiceLike { file_id: string; file_size?: number; mime_type?: string; duration?: number }
 interface DocumentLike { file_id: string; file_size?: number; mime_type?: string; file_name?: string }
+interface VideoLike { file_id: string; file_size?: number; mime_type?: string; file_name?: string; duration?: number }
 
 interface RawUpdate {
   update_id: number;
@@ -2083,6 +2210,8 @@ interface RawUpdate {
     voice?: VoiceLike;
     audio?: VoiceLike;
     document?: DocumentLike;
+    video?: VideoLike;
+    media_group_id?: string;
     reply_to_message?: { text?: string; message_id?: number };
   };
   callback_query?: {
@@ -2175,8 +2304,20 @@ export function parseUpdate(u: RawUpdate): TgIncoming | null {
     });
   }
 
+  // 영상은 `#현장` 저장 전용 — 태그된 캡션이거나 앨범 항목일 때만 싣는다(그 밖의 영상은 종전처럼 무시).
+  const video = m.video && (parseFieldCaption(m.caption) || m.media_group_id)
+    ? {
+        kind: 'document' as const,
+        fileId: m.video.file_id,
+        fileSize: m.video.file_size,
+        mimeType: m.video.mime_type ?? 'video/mp4',
+        fileName: m.video.file_name,
+        duration: m.video.duration,
+      }
+    : undefined;
+
   // Skip updates with zero signal: no text AND no attachments.
-  if (typeof m.text !== 'string' && attachments.length === 0) return null;
+  if (typeof m.text !== 'string' && attachments.length === 0 && !video) return null;
 
   const isDm = m.chat.type === 'private';
   return {
@@ -2191,6 +2332,8 @@ export function parseUpdate(u: RawUpdate): TgIncoming | null {
     isGroup: !isDm,
     attachments,
     ...(m.reply_to_message?.text ? { replyToText: m.reply_to_message.text } : {}),
+    ...(m.media_group_id ? { mediaGroupId: m.media_group_id } : {}),
+    ...(video ? { video } : {}),
   };
 }
 

package/src/tool-runtime/elanous-skills-list-runtime.ts

@@ -2,7 +2,7 @@
 // `elanous_skills_list` MCP tool. Mirrors the daemon-side ACP method
 // `elanous/skills/list` (src/acp/server.ts:2241) but session-agnostic so
 // the codex app-server can call it through the elanous-tools MCP server
-// without first opening an ACP session. Enumerates `~/.elanous/skills/*`
+// without first opening an ACP session. Enumerates configured skill roots
 // and surfaces the first non-heading line of each SKILL.md as the
 // description.
 //
@@ -14,6 +14,7 @@
 import { join } from 'node:path';
 import { readdir, readFile } from 'node:fs/promises';
 import { defaultSkillDirs } from '../user-config.js';
+import { SKILLS_LIST_DESCRIPTION } from '../onboarding/entry-hints.js';
 import type { LLMToolSpec } from '../llm.js';
 import type { ToolRuntime } from './types.js';
 
@@ -41,8 +42,7 @@ export interface ElanousSkillsListResult extends Record<string, unknown> {
 export function buildElanousSkillsListTool(): LLMToolSpec {
   return {
     name: 'elanous_skills_list',
-    description:
-      'List installed elanous skills (sub-directories of ~/.elanous/skills with optional SKILL.md). Codex app-server callback via the elanous-tools MCP server. Read-only.',
+    description: SKILLS_LIST_DESCRIPTION,
     parameters: {
       type: 'object',
       properties: {