elanous 0.2.6 → 0.2.7

package/src/nexus/api/graph-approvals-feed.ts

@@ -0,0 +1,140 @@
+// EV10d — «게시 대기» 피드 초안: 승인 노드가 `{"kind":"feed-preview"}` 이면 그 런의 현장폴더 초안
+// (`<folder>/feed/feed-draft.json`)이 정본이다(계약 = MK 10-01 · field-feed 그래프). 경로는 «런 상태의
+// input.folder» 에서만 구하고, 그 폴더는 `<configDir>/field/<slug>` 꼴일 때만 받는다(realpath 로 탈출 거부).
+// 사람의 «수정 저장»은 허용된 칸만 고쳐 그 파일을 덮는다 — 승인 상태는 바꾸지 않는다.
+import { existsSync, readFileSync, realpathSync, renameSync, writeFileSync } from 'node:fs';
+import { basename, dirname, join, normalize, sep } from 'node:path';
+import { fieldEventDir, isFieldSlug } from '../../field/field-media.js';
+import type { GraphRunState } from '../../graph-runner/runner.js';
+
+export interface FeedSlide { image: string; caption: string; include: boolean; [key: string]: unknown }
+export interface FeedDraft {
+  kind: 'feed-draft';
+  version: 1;
+  revision: number;
+  updatedAt: string;
+  updatedBy: string;
+  slides: FeedSlide[];
+  caption: { hook: string; body: string };
+  hashtags: string[];
+  cover: { text: string; sub: string; image?: string; [key: string]: unknown };
+  location: string | null;
+  reel: string | null;
+  brand?: { name?: string; handle?: string; avatar?: string | null };
+  [key: string]: unknown;
+}
+
+/** Fields a person may change from the PWA — everything else (rendered*, source, folder…) is preserved. */
+export interface FeedEdit {
+  slides: Array<{ image: string; caption?: string; include?: boolean }>;
+  caption: { hook: string; body: string };
+  hashtags: string[];
+  cover: { text: string; sub: string };
+  location: string | null;
+}
+
+export const FEED_DRAFT_FILE = join('feed', 'feed-draft.json');
+
+export function isFeedPreviewMessage(message: string): boolean {
+  try {
+    const parsed = JSON.parse(message) as unknown;
+    return !!parsed && typeof parsed === 'object' && (parsed as { kind?: unknown }).kind === 'feed-preview';
+  } catch { return false; }
+}
+
+function real(path: string): string | null {
+  try { return realpathSync(path); } catch { return null; }
+}
+
+/** The run's field folder when it is exactly `<configDir>/field/<slug>` (after resolving links), else null. */
+export function feedFolderFor(state: Pick<GraphRunState, 'input'>, configDir: string): string | null {
+  const input = state.input as { folder?: unknown } | undefined;
+  const folder = typeof input?.folder === 'string' ? input.folder : null;
+  if (!folder) return null;
+  const slug = basename(folder);
+  if (!isFieldSlug(slug)) return null;
+  const resolved = real(folder);
+  const expected = real(fieldEventDir(configDir, slug));
+  if (!resolved || !expected || resolved !== expected) return null;
+  if (dirname(resolved) !== real(join(configDir, 'field'))) return null;
+  return resolved;
+}
+
+function str(value: unknown): string { return typeof value === 'string' ? value : ''; }
+
+export function readFeedDraft(folder: string): FeedDraft | null {
+  try {
+    const raw = JSON.parse(readFileSync(join(folder, FEED_DRAFT_FILE), 'utf8')) as Partial<FeedDraft>;
+    if (raw.kind !== 'feed-draft' || raw.version !== 1 || !Array.isArray(raw.slides)) return null;
+    return raw as FeedDraft;
+  } catch { return null; }
+}
+
+export type FeedEditResult = { ok: true; draft: FeedDraft } | { ok: false; error: string };
+
+/** Apply a person's edit to the current draft. Slides must be the same set of images (order may change,
+ *  removal is `include:false`), so no new path can enter the draft. */
+export function applyFeedEdit(current: FeedDraft, edit: unknown, now = new Date()): FeedEditResult {
+  if (!edit || typeof edit !== 'object') return { ok: false, error: 'bad_request' };
+  const e = edit as Partial<FeedEdit>;
+  if (!Array.isArray(e.slides) || !e.caption || typeof e.caption !== 'object' || !Array.isArray(e.hashtags)
+    || !e.cover || typeof e.cover !== 'object') return { ok: false, error: 'bad_request' };
+  const original = new Map(current.slides.map((slide) => [slide.image, slide]));
+  const seen = new Set<string>();
+  const slides: FeedSlide[] = [];
+  for (const raw of e.slides) {
+    const image = str((raw as { image?: unknown })?.image);
+    const base = original.get(image);
+    if (!base || seen.has(image)) return { ok: false, error: 'unknown-image' };
+    seen.add(image);
+    const caption = (raw as { caption?: unknown }).caption;
+    const include = (raw as { include?: unknown }).include;
+    slides.push({ ...base, ...(typeof caption === 'string' ? { caption } : {}), ...(typeof include === 'boolean' ? { include } : {}) });
+  }
+  if (seen.size !== original.size) return { ok: false, error: 'missing-image' };
+  const location = e.location === null ? null : typeof e.location === 'string' ? e.location : current.location;
+  return {
+    ok: true,
+    draft: {
+      ...current,
+      slides,
+      caption: { ...current.caption, hook: str(e.caption.hook), body: str(e.caption.body) },
+      hashtags: e.hashtags.filter((tag): tag is string => typeof tag === 'string').map((tag) => tag.trim()).filter(Boolean),
+      cover: { ...current.cover, text: str(e.cover.text), sub: str(e.cover.sub) },
+      location,
+      revision: (Number.isFinite(current.revision) ? current.revision : 0) + 1,
+      updatedBy: 'human',
+      updatedAt: now.toISOString(),
+    },
+  };
+}
+
+export function writeFeedDraft(folder: string, draft: FeedDraft): void {
+  const target = join(folder, FEED_DRAFT_FILE);
+  const temp = `${target}.tmp-${process.pid}`;
+  writeFileSync(temp, `${JSON.stringify(draft, null, 2)}\n`);
+  renameSync(temp, target);
+}
+
+const MEDIA_RE = /^(?:feed\/[^/\\]+\.(?:png|jpe?g|webp)|reel\/reel-9x16\.mp4)$/i;
+
+/** Absolute file for a folder-relative media path, only `feed/*.png|jpg|jpeg|webp` and `reel/reel-9x16.mp4`. */
+export function resolveFeedMedia(folder: string, relative: string): string | null {
+  if (!relative || relative.startsWith('/') || relative.includes('\\') || relative.includes('\0')) return null;
+  const clean = normalize(relative).split(sep).join('/');
+  if (clean !== relative || !MEDIA_RE.test(clean)) return null;
+  const file = join(folder, clean);
+  if (!existsSync(file)) return null;
+  const resolved = real(file);
+  const root = real(folder);
+  if (!resolved || !root || !resolved.startsWith(`${root}${sep}`)) return null;
+  return resolved;
+}
+
+export function mediaContentType(path: string): string {
+  const lower = path.toLowerCase();
+  if (lower.endsWith('.png')) return 'image/png';
+  if (lower.endsWith('.webp')) return 'image/webp';
+  if (lower.endsWith('.mp4')) return 'video/mp4';
+  return 'image/jpeg';
+}

package/src/nexus/api/graph-approvals.ts

@@ -3,7 +3,9 @@ import { join } from 'node:path';
 import { debug } from '../../debug/log.js';
 import { decideGraphApproval, lastJsonObject, type GraphRunState } from '../../graph-runner/runner.js';
 import { effectiveInstanceRoot } from '../../instance/resolve.js';
+import { getElanousConfigDir } from '../../elanous-config-dir.js';
 import { jsonResponse } from './json-response.js';
+import { applyFeedEdit, feedFolderFor, isFeedPreviewMessage, mediaContentType, readFeedDraft, resolveFeedMedia, writeFeedDraft, type FeedDraft } from './graph-approvals-feed.js';
 
 export const GRAPH_APPROVALS_PATH = '/v1/graph-approvals';
 const SEGMENT = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
@@ -16,6 +18,8 @@ interface GraphApprovalItem {
   since: string;
   path: string[];
   recent: Array<{ nodeId: string; ok: boolean; outcome?: string; summary?: string }>;
+  /** EV10d — present only for a `{"kind":"feed-preview"}` approval whose run folder holds a valid draft. */
+  feed?: Omit<FeedDraft, 'folder'>;
 }
 
 /** One decision this daemon applied through `POST /v1/graph-approvals/:graphId/:runId`. */
@@ -72,6 +76,8 @@ interface GraphApprovalsDeps {
    * `tailscale serve` every tailnet peer (Pod included) arrives from loopback. */
   authReason?: (request: Request) => string | undefined;
   root?: string;
+  /** Config dir whose `field/<slug>` folders may hold feed drafts (EV10d). */
+  configDir?: string;
 }
 
 const DECISION_AUTH_REASONS = new Set(['bearer-match', 'temp-token', 'noauth']);
@@ -96,7 +102,16 @@ function undecided(state: GraphRunState, root: string): boolean {
     && Array.isArray(state.path) && !existsSync(join(root, 'graph-runs', state.graphId, `${state.runId}.json.${state.path.length}.decision.json`));
 }
 
-function list(root: string): GraphApprovalItem[] {
+function feedFor(state: GraphRunState, configDir: string): Omit<FeedDraft, 'folder'> | undefined {
+  if (!isFeedPreviewMessage(state.pending?.message ?? '')) return undefined;
+  const folder = feedFolderFor(state, configDir);
+  const draft = folder ? readFeedDraft(folder) : null;
+  if (!draft) return undefined;
+  const { folder: _folder, ...rest } = draft;
+  return rest;
+}
+
+function list(root: string, configDir: string): GraphApprovalItem[] {
   const dir = join(root, 'graph-runs');
   let graphs: Dirent[];
   try { graphs = readdirSync(dir, { withFileTypes: true }); }
@@ -113,6 +128,7 @@ function list(root: string): GraphApprovalItem[] {
       const state = readRun(root, graph.name, runId);
       if (!state || !undecided(state, root) || !Array.isArray(state.nodes)) continue;
       const pending = state.pending!;
+      const feed = feedFor(state, configDir);
       items.push({
         graphId: state.graphId, runId: state.runId, nodeId: pending.nodeId, message: pending.message,
         since: pending.since, path: state.path,
@@ -124,6 +140,7 @@ function list(root: string): GraphApprovalItem[] {
             ...(typeof output?.summary === 'string' ? { summary: output.summary } : {}),
           };
         }),
+        ...(feed ? { feed } : {}),
       });
     }
   }
@@ -131,14 +148,17 @@ function list(root: string): GraphApprovalItem[] {
 }
 
 export async function handleGraphApprovals(req: Request, deps: GraphApprovalsDeps = {}): Promise<Response> {
-  const pathname = new URL(req.url).pathname;
+  const url = new URL(req.url);
+  const pathname = url.pathname;
+  const sub = /^\/v1\/graph-approvals\/([^/]+)\/([^/]+)\/(feed-draft|media)$/.exec(pathname);
   const match = /^\/v1\/graph-approvals\/([^/]+)\/([^/]+)$/.exec(pathname);
-  if (pathname !== GRAPH_APPROVALS_PATH && !match) return jsonResponse({ error: 'not-found' }, 404);
+  if (pathname !== GRAPH_APPROVALS_PATH && !match && !sub) return jsonResponse({ error: 'not-found' }, 404);
   if (!deps.authorize?.(req)) return jsonResponse({ error: 'unauthorized' }, 401);
+  if (sub) return handleFeed(req, url, sub[1]!, sub[2]!, sub[3] as 'feed-draft' | 'media', deps);
   if (pathname === GRAPH_APPROVALS_PATH) {
     if (req.method !== 'GET') return jsonResponse({ error: 'method-not-allowed' }, 405);
     // ⭐ `items` is unchanged; `decided` is additive (newest first) for other devices' cards.
-    return jsonResponse({ items: list(deps.root ?? effectiveInstanceRoot()), decided: (deps.decisions ?? defaultDecisionRing).list() });
+    return jsonResponse({ items: list(deps.root ?? effectiveInstanceRoot(), deps.configDir ?? getElanousConfigDir()), decided: (deps.decisions ?? defaultDecisionRing).list() });
   }
   if (req.method !== 'POST') return jsonResponse({ error: 'method-not-allowed' }, 405);
   const authReason = deps.authReason?.(req);
@@ -172,3 +192,50 @@ export async function handleGraphApprovals(req: Request, deps: GraphApprovalsDep
   debug.log('approvals.graph', 'decided', { graphId, runId, nodeId, decision, by: `pwa:${authReason}` });
   return jsonResponse({ graphId, runId, decision });
 }
+
+/** EV10d — `PUT …/:graphId/:runId/feed-draft` (사람 수정 저장) · `GET …/:graphId/:runId/media?path=` (초안 미디어). */
+async function handleFeed(req: Request, url: URL, rawGraphId: string, rawRunId: string, kind: 'feed-draft' | 'media', deps: GraphApprovalsDeps): Promise<Response> {
+  let graphId: string;
+  let runId: string;
+  try { graphId = decodeURIComponent(rawGraphId); runId = decodeURIComponent(rawRunId); }
+  catch { return jsonResponse({ error: 'not-found' }, 404); }
+  if (!validSegment(graphId) || !validSegment(runId)) return jsonResponse({ error: 'not-found' }, 404);
+  const root = deps.root ?? effectiveInstanceRoot();
+  const state = readRun(root, graphId, runId);
+  const folder = state && isFeedPreviewMessage(state.pending?.message ?? '') ? feedFolderFor(state, deps.configDir ?? getElanousConfigDir()) : null;
+  if (!state || !folder) {
+    debug.log('approvals.feed', 'refused', { graphId, reason: 'not-feed' });
+    return jsonResponse({ error: 'not-found' }, 404);
+  }
+  if (kind === 'media') {
+    if (req.method !== 'GET') return jsonResponse({ error: 'method-not-allowed' }, 405);
+    const file = resolveFeedMedia(folder, url.searchParams.get('path') ?? '');
+    if (!file) {
+      debug.log('approvals.feed', 'refused', { graphId, reason: 'media-path' });
+      return jsonResponse({ error: 'not-found' }, 404);
+    }
+    debug.log('approvals.feed', 'media-served', { graphId });
+    return new Response(Bun.file(file), { headers: { 'content-type': mediaContentType(file), 'cache-control': 'private, max-age=60' } });
+  }
+  if (req.method !== 'PUT') return jsonResponse({ error: 'method-not-allowed' }, 405);
+  const authReason = deps.authReason?.(req);
+  if (!authReason || !DECISION_AUTH_REASONS.has(authReason)) {
+    debug.log('approvals.feed', 'refused', { graphId, reason: 'pairing-required' });
+    return jsonResponse({ error: 'pairing-required' }, 403);
+  }
+  if (!undecided(state, root)) return jsonResponse({ error: 'already-decided' }, 409);
+  const current = readFeedDraft(folder);
+  if (!current) return jsonResponse({ error: 'not-found' }, 404);
+  let body: unknown;
+  try { body = await req.json(); }
+  catch { return jsonResponse({ error: 'bad_request' }, 400); }
+  const result = applyFeedEdit(current, body);
+  if (!result.ok) {
+    debug.log('approvals.feed', 'refused', { graphId, reason: result.error });
+    return jsonResponse({ error: result.error }, 400);
+  }
+  writeFeedDraft(folder, result.draft);
+  debug.log('approvals.feed', 'draft-saved', { graphId, revision: result.draft.revision });
+  const { folder: _folder, ...feed } = result.draft;
+  return jsonResponse({ graphId, runId, feed });
+}

package/src/nexus/api/http-server.ts

@@ -15,6 +15,7 @@
 // Port policy (N1-2 decision): auto-pick from 31415 upward. Actual port
 // is recorded in runtime.json + printed in boot banner.
 
+import { getUserConfig } from '../../user-config.js';
 import type { TelegramEvent } from '../../workflow-runtime/triggers/telegram-source.js';
 import { spawnSync } from 'node:child_process';
 import { compareTokenConstTime } from '../../acp/transport/auth.js';
@@ -198,7 +199,11 @@ import { handleMcpResourceGet, MCP_RESOURCE_ROUTE_PATH } from './mcp-resource-ro
 import { APPROVALS_MERGES_PATH, DESIGN_DIRECTION_PATH, DESIGN_PREVIEW_PATH_PREFIX, DESIGN_PREVIEWS_PATH, DESIGN_SYSTEM_PATH, IPA_PATH_PREFIX, MANIFEST_PATH } from './rest-route-paths.js';
 import { handleMergeApprovals } from './merge-approvals.js';
 import { GRAPH_APPROVALS_PATH, handleGraphApprovals } from './graph-approvals.js';
-import { FIELD_SERVER_MAX_BODY_BYTES, FIELD_UPLOADS_PATH, handleFieldUploads } from './field-uploads.js';
+import { handleExecRequests } from './exec-requests.js';
+import { handleSeatRequests, SEAT_REQUESTS_PATH, type SeatRequestsDeps } from './seat-requests.js';
+import { handleConsultRequests, CONSULT_REQUESTS_PATH, type ConsultRequestsDeps } from './consult-requests.js';
+import { ExecRequestRunner } from '../../exec-requests/runner.js';
+import { FIELD_SERVER_MAX_BODY_BYTES, FIELD_UPLOADS_PATH, FIELD_REEL_PATH, FIELD_REEL_FILE_PATH, handleFieldUploads } from './field-uploads.js';
 import { handleLiveDetail, LIVE_DETAIL_PATH } from './live-detail.js';
 import { handleLiveShipped, LIVE_SHIPPED_PATH } from './live-shipped.js';
 import { handleMcpWidgetCall, MCP_WIDGET_CALL_ROUTE_PATH, persistWidgetTurnToSessionStore } from './mcp-widget-call-route.js';
@@ -236,6 +241,7 @@ import {
   parseErrorsPath,
 } from './errors.js';
 import { handleChatBackendDetection } from './chat-backend-detection.js';
+import { handleChatFastPathConfig } from './chat-fast-path-config.js';
 import { connectInfoTokenAllowed, handleConnectInfoGet, handleConnectTokenMint, type ConnectInfoCtx } from './connect-info.js';
 import { handleStaticAppRequest, pathMatchesStaticPrefix } from './static-app.js';
 import {
@@ -446,6 +452,9 @@ export type NexusWsBridgeInit = Omit<WsBridgeOpts, 'hostname' | 'port'>;
 export interface NexusHttpServerOpts {
   /** Optional installer state root for isolated API consumers and tests. */
   pluginStateRoot?: string;
+  execRequests?: ExecRequestRunner;
+  seatRequests?: SeatRequestsDeps;
+  consultRequests?: ConsultRequestsDeps;
   state: NexusState;
   registry: TabRegistry;
   eventBus: NexusEventBus;
@@ -748,6 +757,8 @@ export function startNexusHttpServer(opts: NexusHttpServerOpts): NexusHttpServer
         ...(websocketHandler ? { websocket: websocketHandler } : {}),
       } as unknown as Parameters<typeof Bun.serve>[0];
       server = Bun.serve(fetchOpts);
+      // 데몬이 «실제로» 떴을 때만 재시작 복구(맡긴 일) — 주입된 러너(시험)는 건드리지 않는다.
+      if (!opts.execRequests) { try { execRequestRunner().reconcileInterrupted(); } catch { /* 복구 실패가 서버 기동을 막지 않는다 */ } }
       resolvedPort = port;
       break;
     } catch (err) {
@@ -786,6 +797,13 @@ function isPortBusy(err: unknown): boolean {
   return /EADDRINUSE|address already in use/i.test(msg);
 }
 
+let execRequestRunnerInstance: ExecRequestRunner | undefined;
+/** 게으른 한 벌 — import 만으로는 만들지 않는다(재시작 복구가 import 에 묶이지 않게). */
+function execRequestRunner(): ExecRequestRunner {
+  execRequestRunnerInstance ??= new ExecRequestRunner();
+  return execRequestRunnerInstance;
+}
+
 export async function routeRequest(
   req: Request,
   opts: NexusHttpServerOpts,
@@ -834,16 +852,26 @@ export async function routeRequest(
   // Per-route checkAuth calls below stay in place.
   // OPTIONS is a CORS preflight and cannot carry Authorization; existing
   // handlers answer it themselves, so the gate does not swallow it.
-  // A runtime-less tab mutation still needs authentication before the
-  // dispatcher can return its 503. Do not enable this fallback for other paths.
-  const runtimeLessTabMutation = !opts.metaApi && method !== 'GET' && method !== 'OPTIONS'
-    && (pathname === '/v1/nexus/tabs' || pathname.startsWith('/v1/nexus/tabs/'));
+  // Without metaApi, only the owner bearer may reach these runtime-less
+  // meta-API stubs. All other private paths remain default-denied.
+  const runtimeLessMetaRoute = !opts.metaApi && (
+    (method !== 'GET' && method !== 'OPTIONS'
+      && (pathname === '/v1/nexus/tabs' || pathname.startsWith('/v1/nexus/tabs/')))
+    || (method === 'GET' && (
+      ['/v1/simulations', '/v1/tools', '/v1/intake', '/v1/sessions', '/v1/control-signals', '/v1/turns/last/screenshot'].includes(pathname)
+      || pathname.startsWith('/v1/recordings/')
+    ))
+    || (method === 'POST' && (
+      ['/v1/intake', '/v1/sessions/external', '/v1/control-signals', '/v1/prompt'].includes(pathname)
+      || pathname.startsWith('/v1/hitl/callback/')
+    ))
+  );
   if (
     method !== 'OPTIONS'
     && pathname.startsWith('/v1/')
     && !isPublicRoute(method, pathname, { setupMode: false })
   ) {
-    const fallbackToken = runtimeLessTabMutation ? ensureAuthToken().token : undefined;
+    const fallbackToken = runtimeLessMetaRoute ? ensureAuthToken().token : undefined;
     const offered = req.headers.get('authorization');
     const fallbackAuthorized = fallbackToken !== undefined && offered?.startsWith('Bearer ') === true
       && compareTokenConstTime(offered.slice('Bearer '.length).trim(), fallbackToken);
@@ -919,6 +947,25 @@ export async function routeRequest(
     });
   }
 
+  if (pathname === SEAT_REQUESTS_PATH) {
+    if (!opts.metaApi || !checkAuth(req, opts.metaApi)) return jsonResponse({ error: 'unauthorized' }, 401);
+    return handleSeatRequests(req, opts.seatRequests);
+  }
+
+  if (pathname === CONSULT_REQUESTS_PATH) {
+    if (!opts.metaApi || !checkAuth(req, opts.metaApi)) return jsonResponse({ error: 'unauthorized' }, 401);
+    return handleConsultRequests(req, opts.consultRequests);
+  }
+
+  if (pathname === '/v1/exec-requests' || pathname.startsWith('/v1/exec-requests/')) {
+    if (!opts.metaApi || !checkAuth(req, opts.metaApi)) return jsonResponse({ error: 'unauthorized' }, 401);
+    if (/^\/v1\/exec-requests\/[^/]+\/files\//.test(pathname)) {
+      const credential = bearerCredential(req, opts.metaApi);
+      if (credential !== 'bearer-match' && credential !== 'temp-token') return jsonResponse({ error: 'unauthorized' }, 401);
+    }
+    return handleExecRequests(req, opts.execRequests ?? execRequestRunner());
+  }
+
   if (pathname === GRAPH_APPROVALS_PATH || pathname.startsWith(`${GRAPH_APPROVALS_PATH}/`)) {
     return handleGraphApprovals(req, {
       authorize: (request) => !!opts.metaApi && checkAuth(request, opts.metaApi),
@@ -926,9 +973,11 @@ export async function routeRequest(
     });
   }
   // 현장 업로드(owner 전용) — GET 목록 · POST 저장. 저장 규칙 정본 = src/field/field-media.ts.
-  if (pathname === FIELD_UPLOADS_PATH && (method === 'GET' || method === 'POST')) {
+  if ((pathname === FIELD_UPLOADS_PATH && (method === 'GET' || method === 'POST'))
+    || ((pathname === FIELD_REEL_PATH || pathname === FIELD_REEL_FILE_PATH) && method === 'GET')) {
     return handleFieldUploads(req, {
       authorize: (request) => !!opts.metaApi && checkAuth(request, opts.metaApi),
+      configuredEvent: () => { try { return getUserConfig().telegram?.fieldDefaultEvent; } catch { return undefined; } },
     });
   }
   if (pathname === APPROVALS_MERGES_PATH || pathname.startsWith(`${APPROVALS_MERGES_PATH}/`)) {
@@ -1217,6 +1266,11 @@ export async function routeRequest(
     return handleGraphsValidatePost(req, opts.metaApi);
   }
 
+  if (pathname === '/v1/config/chat-fast-path' && (method === 'GET' || method === 'PUT')) {
+    if (!opts.metaApi || !checkAuth(req, opts.metaApi)) return jsonResponse({ error: 'unauthorized' }, 401);
+    return handleChatFastPathConfig(req);
+  }
+
   // Mutation routes (PR ι) — POST/PATCH/DELETE on /v1/nexus/tabs[/:id[/action]].
   // Templates POST handled here too (PR κ).
   // Config / secrets PUT/POST/DELETE here too (PR μ).

package/src/nexus/api/seat-requests.ts

@@ -0,0 +1,254 @@
+import { closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, readdirSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
+import { createHash, randomUUID } from 'node:crypto';
+import { dirname, join } from 'node:path';
+import { debug } from '../../debug/log.js';
+import { effectiveInstanceRoot } from '../../instance/resolve.js';
+import { submitIntakeWork } from '../../intake-plane/submit-intake-work.js';
+import { parseSeatAddress, resolveSeat } from '../../seat-address/seat-address.js';
+import trackData from '../../../scripts/coord-tracks.json';
+import { jsonResponse } from './json-response.js';
+
+export const SEAT_REQUESTS_PATH = '/v1/seat-requests';
+
+interface SeatRequestItem {
+  receiptId: string;
+  seat: string;
+  text: string;
+  queuedAt: string;
+  status: 'queued';
+}
+
+interface PendingRequest {
+  status: 'pending';
+  key: string;
+  seat: string;
+  text: string;
+  queuedAt: string;
+  ref: string;
+}
+
+interface RejectedRequest extends Omit<PendingRequest, 'status'> {
+  status: 'rejected';
+}
+
+type RecordEntry = (SeatRequestItem & { key: string }) | PendingRequest | RejectedRequest;
+
+export interface SeatRequestsDeps {
+  root?: () => string;
+  submit?: typeof submitIntakeWork;
+  now?: () => string;
+  append?: (path: string, entry: RecordEntry) => void;
+}
+
+const seats = trackData.tracks.filter((entry): entry is typeof entry & { title: string } => 'title' in entry)
+  .map(({ id, title }) => ({ id, title }));
+const inFlight = new Map<string, { payload: string; task: Promise<Response> }>();
+
+function unknownSeat(): Response {
+  debug.log('seat-address.pwa', 'rejected', { reason: 'unknown-seat' });
+  return jsonResponse({ error: 'unknown-seat', seats }, 400);
+}
+
+function file(root: string): string {
+  return join(root, 'seat-requests', 'requests.jsonl');
+}
+
+function append(path: string, entry: RecordEntry): void {
+  mkdirSync(dirname(path), { recursive: true });
+  // Atomically replace the journal so a failed write cannot leave a truncated JSON line.
+  const previous = existsSync(path) ? readFileSync(path, 'utf8') : '';
+  const temp = `${path}.${randomUUID()}.tmp`;
+  try {
+    writeFileSync(temp, `${previous}${JSON.stringify(entry)}\n`);
+    const fd = openSync(temp, 'r');
+    try { fsyncSync(fd); } finally { closeSync(fd); }
+    renameSync(temp, path);
+  } catch (error) {
+    try { unlinkSync(temp); } catch { /* no temp file to remove */ }
+    throw error;
+  }
+}
+
+function records(path: string): Map<string, RecordEntry> {
+  let data: string;
+  try { data = readFileSync(path, 'utf8'); }
+  catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT' && !existsSync(path)) data = '';
+    else throw error;
+  }
+  const entries = new Map<string, RecordEntry>();
+  for (const line of data.split('\n')) {
+    if (!line) continue;
+    const entry = JSON.parse(line) as RecordEntry;
+    if (typeof entry.key !== 'string' || typeof entry.seat !== 'string' || typeof entry.text !== 'string'
+      || typeof entry.queuedAt !== 'string' || !['pending', 'queued', 'rejected'].includes(entry.status)
+      || (entry.status === 'queued' && typeof entry.receiptId !== 'string')
+      || (entry.status !== 'queued' && typeof entry.ref !== 'string')) {
+      throw new Error('invalid seat request journal');
+    }
+    entries.set(entry.key, entry);
+  }
+  const dir = join(dirname(path), 'outcomes');
+  let names: string[];
+  try { names = readdirSync(dir); }
+  catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return entries;
+    throw error;
+  }
+  for (const name of names) {
+    if (!/^[a-f0-9]{64}\.json$/.test(name)) continue;
+    const item = JSON.parse(readFileSync(join(dir, name), 'utf8')) as RecordEntry;
+    if (item.key !== name.slice(0, -5) || (item.status !== 'queued' && item.status !== 'rejected')) {
+      throw new Error('invalid seat request outcome');
+    }
+    const current = entries.get(item.key);
+    if (current?.status === 'queued') continue;
+    if (current?.status === 'pending') {
+      if (item.status === 'rejected' && current.ref !== item.ref) continue;
+      if (item.status === 'queued' && current.queuedAt !== item.queuedAt) continue;
+    }
+    entries.set(item.key, item);
+  }
+  return entries;
+}
+
+function outcomeFile(path: string, key: string): string {
+  return join(dirname(path), 'outcomes', `${key}.json`);
+}
+
+function persistOutcome(path: string, entry: RecordEntry, write: typeof append): void {
+  try {
+    write(path, entry);
+    const sidecar = outcomeFile(path, entry.key);
+    if (existsSync(sidecar)) unlinkSync(sidecar);
+  } catch {
+    // The primary journal may be unavailable while the outcome is already committed
+    // to the intake queue. Keep a durable sidecar rather than a process-local receipt.
+    const target = outcomeFile(path, entry.key);
+    mkdirSync(dirname(target), { recursive: true });
+    const temp = `${target}.${randomUUID()}.tmp`;
+    try {
+      writeFileSync(temp, JSON.stringify(entry));
+      const fd = openSync(temp, 'r');
+      try { fsyncSync(fd); } finally { closeSync(fd); }
+      renameSync(temp, target);
+    } catch (error) {
+      try { unlinkSync(temp); } catch { /* no temp file */ }
+      throw error;
+    }
+  }
+}
+
+function receipt(item: SeatRequestItem): Response {
+  return jsonResponse({ receiptId: item.receiptId, seat: item.seat, queuedAt: item.queuedAt }, 202);
+}
+
+function unavailable(): Response {
+  debug.log('seat-address.pwa', 'rejected', { reason: 'journal-unavailable' });
+  return jsonResponse({ error: 'enqueue-failed' }, 503);
+}
+
+export async function handleSeatRequests(req: Request, deps: SeatRequestsDeps = {}): Promise<Response> {
+  const path = file((deps.root ?? effectiveInstanceRoot)());
+  if (req.method === 'GET') {
+    const params = new URL(req.url).searchParams;
+    const requestedSeat = params.get('seat');
+    const seat = requestedSeat ? resolveSeat(requestedSeat) : undefined;
+    if (requestedSeat && !seat) return unknownSeat();
+    const rawLimit = params.get('limit');
+    const limit = rawLimit === null ? 20 : Number(rawLimit);
+    if (!Number.isInteger(limit) || limit < 1 || limit > 100) return jsonResponse({ error: 'bad_request' }, 400);
+    try {
+      const items = [...records(path).values()].filter((entry): entry is RecordEntry & SeatRequestItem => entry.status === 'queued')
+        .reverse().filter((item) => !seat || item.seat === seat.id).slice(0, limit)
+        .map(({ receiptId, seat: id, text, queuedAt, status }) => ({ receiptId, seat: id, text, queuedAt, status }));
+      return jsonResponse({ items, seats });
+    } catch { return unavailable(); }
+  }
+  if (req.method !== 'POST') return jsonResponse({ error: 'method-not-allowed' }, 405);
+
+  let body: unknown;
+  try { body = await req.json(); }
+  catch { return jsonResponse({ error: 'bad_request' }, 400); }
+  if (!body || typeof body !== 'object' || Array.isArray(body)) return jsonResponse({ error: 'bad_request' }, 400);
+  const input = body as Record<string, unknown>;
+  if (typeof input.text !== 'string' || !input.text.trim()
+    || (input.seat !== undefined && typeof input.seat !== 'string')) {
+    debug.log('seat-address.pwa', 'rejected', { reason: 'invalid-body' });
+    return jsonResponse({ error: 'bad_request' }, 400);
+  }
+  // An implicit address must start the text; parseSeatAddress also accepts later lines.
+  const parsed = input.text.startsWith('@') ? parseSeatAddress(input.text) : null;
+  const prefix = parsed ? `@${parsed.seats.join(',')}` : '';
+  const firstAddress = parsed && input.text.startsWith(prefix)
+    && (input.text.length === prefix.length || /[ \t\r\n]/.test(input.text[prefix.length]!)) ? parsed : null;
+  const address = input.seat ?? (firstAddress?.seats.length === 1 ? firstAddress.seats[0] : undefined);
+  const seat = address ? resolveSeat(address) : undefined;
+  if (!seat) return unknownSeat();
+  const text = input.seat === undefined ? firstAddress!.body.trim() : input.text.trim();
+  if (!text) {
+    debug.log('seat-address.pwa', 'rejected', { reason: 'empty-text', seat: seat.id });
+    return jsonResponse({ error: 'bad_request' }, 400);
+  }
+  debug.log('seat-address.pwa', 'parsed', { seat: seat.id, textLength: text.length });
+  const now = (deps.now ?? (() => new Date().toISOString()))();
+  const header = req.headers.get('idempotency-key');
+  if (header !== null && (!header.trim() || header.length > 200)) return jsonResponse({ error: 'bad_request' }, 400);
+  const payload = `${seat.id}\0${text}`;
+  const key = header === null ? createHash('sha256').update(randomUUID()).digest('hex')
+    : createHash('sha256').update(`client\0${header}`).digest('hex');
+  const lock = `${path}\0${key}`;
+  const pending = inFlight.get(lock);
+  if (pending) {
+    if (pending.payload !== payload) return jsonResponse({ error: 'idempotency-conflict' }, 409);
+    return pending.task.then((response) => response.clone());
+  }
+  // Install the lock before starting disk or queue work; a second caller must
+  // wait for the first instead of independently submitting the same key.
+  let start!: () => void;
+  const gate = new Promise<void>((resolve) => { start = resolve; });
+  const task = (async (): Promise<Response> => {
+    await gate;
+    let existing: RecordEntry | undefined;
+    try { existing = records(path).get(key); }
+    catch { return unavailable(); }
+    if (existing) {
+      if (existing.seat !== seat.id || existing.text !== text) return jsonResponse({ error: 'idempotency-conflict' }, 409);
+      if (existing.status === 'queued') return receipt(existing);
+    }
+    const intent: PendingRequest = existing?.status === 'pending'
+      ? existing : { key, seat: seat.id, text, queuedAt: now, status: 'pending', ref: `pwa:${randomUUID()}` };
+    if (existing?.status !== 'pending') {
+      try {
+        (deps.append ?? append)(path, intent);
+        if (existing?.status === 'rejected') {
+          const sidecar = outcomeFile(path, key);
+          if (existsSync(sidecar)) unlinkSync(sidecar);
+        }
+      } catch { return unavailable(); }
+    }
+    let result: Awaited<ReturnType<typeof submitIntakeWork>>;
+    try {
+      result = await (deps.submit ?? submitIntakeWork)({
+        text: `@${seat.title ?? seat.id} ${text}`,
+        track: 'graph',
+        origin: { kind: 'external', ledgerSource: 'pwa', provider: 'other', ref: intent.ref, reportTo: { channel: 'pwa' } },
+      });
+    } catch { return unavailable(); }
+    if (!result.ok || result.track !== 'graph') {
+      debug.log('seat-address.pwa', 'rejected', { reason: result.ok ? 'unexpected-track' : result.reason, seat: seat.id });
+      try { persistOutcome(path, { ...intent, status: 'rejected' }, deps.append ?? append); }
+      catch { return unavailable(); }
+      return unavailable();
+    }
+    const item: RecordEntry & SeatRequestItem = { key, receiptId: result.acceptanceId, seat: seat.id, text, queuedAt: intent.queuedAt, status: 'queued' };
+    try { persistOutcome(path, item, deps.append ?? append); }
+    catch { return unavailable(); }
+    debug.log('seat-address.pwa', 'enqueued', { seat: seat.id, receiptId: item.receiptId });
+    return receipt(item);
+  })();
+  inFlight.set(lock, { payload, task });
+  start();
+  try { return await task; }
+  finally { inFlight.delete(lock); }
+}