elanous 0.2.6 → 0.2.8

package/src/hooks/error-report.ts

@@ -0,0 +1,210 @@
+// Error reports from users' devices (ER2 · contract v1, channel 10-01 22:16). The public bot VM receives them on
+// `POST /v1/reports`, checks size, rate and schema, queues them on disk and forwards them over the tailnet to the
+// Primary, which stores them for 30 days and alerts the operator. No S3 credentials live on the VM.
+import { createHash, randomBytes } from 'node:crypto';
+import { closeSync, fsyncSync, mkdirSync, openSync, readFileSync, readdirSync, renameSync, rmSync, writeSync } from 'node:fs';
+import { join } from 'node:path';
+
+export const REPORT_MAX_BYTES = 64 * 1024;
+/** Queue bounds while the Primary is unreachable: oldest reports beyond these are dropped (logged). */
+export const REPORT_QUEUE_MAX = 5000;
+export const REPORT_QUEUE_MAX_AGE_MS = 7 * 24 * 3600_000;
+
+const SURFACES = ['tui', 'pwa', 'cli', 'daemon'] as const;
+export interface ErrorReport {
+  kind: 'error-report';
+  v: 1;
+  code: string;
+  message: string;
+  stack?: string;
+  app: { version: string; sha: string; surface: (typeof SURFACES)[number]; os: string; arch: string };
+  nexus: { alive: boolean; version?: string; instance?: string };
+  who: { installId: string; email?: string; telegramUser?: string };
+  at: string;
+  consent: true;
+}
+/** What the VM forwards: the report plus what the receiver derived. */
+export interface ReceivedReport { reportId: string; dedupe: string; receivedAt: string; report: ErrorReport }
+
+const str = (v: unknown, max: number): string | undefined => (typeof v === 'string' && v.length > 0 && v.length <= max ? v : undefined);
+const obj = (v: unknown): Record<string, unknown> | undefined => (v && typeof v === 'object' && !Array.isArray(v) ? v as Record<string, unknown> : undefined);
+
+/** Strict schema: unknown fields are dropped, a bad required field names itself. */
+export function validateErrorReport(body: unknown): { ok: true; report: ErrorReport } | { ok: false; field: string } {
+  const b = obj(body);
+  if (!b) return { ok: false, field: 'body' };
+  if (b.kind !== 'error-report') return { ok: false, field: 'kind' };
+  if (b.v !== 1) return { ok: false, field: 'v' };
+  if (b.consent !== true) return { ok: false, field: 'consent' };
+  const code = typeof b.code === 'string' && /^[a-z0-9-]{1,64}$/.test(b.code) ? b.code : undefined;
+  if (!code) return { ok: false, field: 'code' };
+  const message = str(b.message, 2000);
+  if (!message) return { ok: false, field: 'message' };
+  if (b.stack !== undefined && !str(b.stack, 8000)) return { ok: false, field: 'stack' };
+  const app = obj(b.app);
+  const version = str(app?.version, 64);
+  const sha = str(app?.sha, 64);
+  const surface = SURFACES.find((s) => s === app?.surface);
+  const os = str(app?.os, 64);
+  const arch = str(app?.arch, 32);
+  if (!version || !sha || !surface || !os || !arch) return { ok: false, field: 'app' };
+  const nexus = obj(b.nexus);
+  if (!nexus || typeof nexus.alive !== 'boolean') return { ok: false, field: 'nexus' };
+  const who = obj(b.who);
+  const installId = typeof who?.installId === 'string' && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(who.installId) ? who.installId : undefined;
+  if (!installId) return { ok: false, field: 'who.installId' };
+  const at = typeof b.at === 'string' && Number.isFinite(Date.parse(b.at)) ? b.at : undefined;
+  if (!at) return { ok: false, field: 'at' };
+  // nexus.instance is accepted only as a hash — a raw instance name can carry a host name.
+  const instance = typeof nexus.instance === 'string' && /^[0-9a-f]{12,64}$/.test(nexus.instance) ? nexus.instance : undefined;
+  const email = str(who?.email, 254);
+  const telegramUser = str(who?.telegramUser, 64);
+  return {
+    ok: true,
+    report: {
+      kind: 'error-report', v: 1, code, message, ...(typeof b.stack === 'string' ? { stack: b.stack } : {}),
+      app: { version, sha, surface, os, arch },
+      nexus: { alive: nexus.alive, ...(str(nexus.version, 64) ? { version: nexus.version as string } : {}), ...(instance ? { instance } : {}) },
+      who: { installId, ...(email ? { email } : {}), ...(telegramUser ? { telegramUser } : {}) },
+      at, consent: true,
+    },
+  };
+}
+
+/** Same error = same code and same first stack frame. Computed by the receiver, never sent by the device. */
+export function reportDedupe(report: Pick<ErrorReport, 'code' | 'stack'>): string {
+  const frame = (report.stack ?? '').split('\n').map((l) => l.trim()).find((l) => l.length > 0 && l !== report.code) ?? '';
+  return createHash('sha256').update(`${report.code}\n${frame}`).digest('hex').slice(0, 12);
+}
+
+const B32 = '0123456789abcdefghjkmnpqrstvwxyz';
+/** `er_` + 26 chars: 10 time chars then 16 random — sortable by receipt time. */
+export function newReportId(now: number = Date.now()): string {
+  let t = '';
+  let n = now;
+  for (let i = 0; i < 10; i++) { t = B32[n % 32]! + t; n = Math.floor(n / 32); }
+  const r = [...randomBytes(16)].map((x) => B32[x % 32]).join('');
+  return `er_${t}${r}`;
+}
+
+/** In-memory sliding windows: per install 5/min and 20/day, per IP 60/hour; same (install, dedupe) stored once an hour. */
+export class ReportLimiter {
+  private readonly hits = new Map<string, number[]>();
+  private readonly stored = new Map<string, number>();
+  private readonly seen = new Map<string, number[]>();
+  constructor(private readonly now: () => number = Date.now) {}
+
+  private take(key: string, windowMs: number, max: number): number | null {
+    const t = this.now();
+    const list = (this.hits.get(key) ?? []).filter((x) => t - x < windowMs);
+    if (list.length >= max) { this.hits.set(key, list); return Math.ceil((windowMs - (t - list[0]!)) / 1000); }
+    list.push(t);
+    this.hits.set(key, list);
+    return null;
+  }
+
+  /** Returns seconds to wait when limited, otherwise null (and records the hit). */
+  admit(installId: string, ip: string): number | null {
+    return this.take(`ip:${ip}`, 3600_000, 60)
+      ?? this.take(`im:${installId}`, 60_000, 5)
+      ?? this.take(`id:${installId}`, 24 * 3600_000, 20);
+  }
+
+  /** Counts this occurrence; true when it should be stored (first of this install+dedupe within an hour). */
+  occurrence(installId: string, dedupe: string): { store: boolean; count24h: number } {
+    const t = this.now();
+    const list = (this.seen.get(dedupe) ?? []).filter((x) => t - x < 24 * 3600_000);
+    list.push(t);
+    this.seen.set(dedupe, list);
+    const key = `${installId}:${dedupe}`;
+    const last = this.stored.get(key);
+    const store = last === undefined || t - last >= 3600_000;
+    if (store) this.stored.set(key, t);
+    return { store, count24h: list.length };
+  }
+}
+
+/** On-disk queue on the VM: one file per report, atomic writes, bounded by count and age. */
+export class ReportQueue {
+  readonly directory: string;
+  constructor(root: string, private readonly log: (event: string, data: Record<string, unknown>) => void = () => {}) {
+    this.directory = join(root, 'hooks', 'reports');
+    mkdirSync(this.directory, { recursive: true, mode: 0o700 });
+  }
+  private path(reportId: string): string { return join(this.directory, `${reportId}.json`); }
+  enqueue(item: ReceivedReport): void {
+    const path = this.path(item.reportId);
+    const temp = `${path}.${randomBytes(6).toString('hex')}.tmp`;
+    try {
+      const fd = openSync(temp, 'wx', 0o600);
+      try { writeSync(fd, JSON.stringify(item)); fsyncSync(fd); } finally { closeSync(fd); }
+      renameSync(temp, path);
+    } finally { rmSync(temp, { force: true }); }
+  }
+  /** Oldest first; drops entries past the age or count bound (logged, never silent). */
+  entries(now: number = Date.now()): ReceivedReport[] {
+    const names = readdirSync(this.directory).filter((n) => /^er_[0-9a-z]{26}\.json$/.test(n)).sort();
+    const kept: ReceivedReport[] = [];
+    let expired = 0;
+    for (const name of names) {
+      const full = join(this.directory, name);
+      try {
+        const item = JSON.parse(readFileSync(full, 'utf8')) as ReceivedReport;
+        if (now - Date.parse(item.receivedAt) > REPORT_QUEUE_MAX_AGE_MS) { rmSync(full, { force: true }); expired++; continue; }
+        kept.push(item);
+      } catch { rmSync(full, { force: true }); }
+    }
+    const overflow = kept.length - REPORT_QUEUE_MAX;
+    if (overflow > 0) for (const item of kept.splice(0, overflow)) rmSync(this.path(item.reportId), { force: true });
+    if (expired || overflow > 0) this.log('dropped', { expired, overflow: Math.max(0, overflow) });
+    return kept;
+  }
+  count(): number { return readdirSync(this.directory).filter((n) => /^er_[0-9a-z]{26}\.json$/.test(n)).length; }
+  delivered(reportId: string): void { rmSync(this.path(reportId), { force: true }); }
+}
+
+/** Handles `POST /v1/reports` on the VM. Pure enough to test without a server. */
+export async function handleReportPost(request: Request, deps: {
+  limiter: ReportLimiter; queue: ReportQueue; now?: () => number; ip?: string;
+  log?: (event: string, data: Record<string, unknown>) => void; wake?: () => void;
+}): Promise<Response> {
+  const now = deps.now ?? Date.now;
+  const log = deps.log ?? (() => {});
+  const declared = Number(request.headers.get('content-length') ?? '0');
+  if (declared > REPORT_MAX_BYTES) { log('rejected', { reason: 'too-large' }); return Response.json({ error: 'too-large' }, { status: 413 }); }
+  const raw = await request.arrayBuffer();
+  if (raw.byteLength > REPORT_MAX_BYTES) { log('rejected', { reason: 'too-large' }); return Response.json({ error: 'too-large' }, { status: 413 }); }
+  let body: unknown;
+  try { body = JSON.parse(new TextDecoder().decode(raw)); } catch { return Response.json({ error: 'invalid', field: 'body' }, { status: 400 }); }
+  const checked = validateErrorReport(body);
+  if (!checked.ok) { log('rejected', { reason: 'invalid', field: checked.field }); return Response.json({ error: 'invalid', field: checked.field }, { status: 400 }); }
+  const report = checked.report;
+  const ip = deps.ip ?? request.headers.get('x-forwarded-for')?.split(',')[0]?.trim() ?? 'unknown';
+  const wait = deps.limiter.admit(report.who.installId, ip);
+  if (wait !== null) {
+    log('rejected', { reason: 'rate-limited' });
+    return Response.json({ error: 'rate-limited', retryAfterSec: wait }, { status: 429, headers: { 'Retry-After': String(wait) } });
+  }
+  const dedupe = reportDedupe(report);
+  const reportId = newReportId(now());
+  const { store, count24h } = deps.limiter.occurrence(report.who.installId, dedupe);
+  if (store) {
+    deps.queue.enqueue({ reportId, dedupe, receivedAt: new Date(now()).toISOString(), report });
+    deps.wake?.();
+  }
+  log('accepted', { code: report.code, surface: report.app.surface, stored: store, count24h });
+  return Response.json({ reportId, dedupe, count: count24h }, { status: 202 });
+}
+
+/** Forward queued reports to the Primary; delivered ones leave the queue, failures wait for the next drain. */
+export async function drainReports(queue: ReportQueue, forward: (item: ReceivedReport) => Promise<boolean>, now: number = Date.now()): Promise<{ delivered: number; failed: number }> {
+  let delivered = 0;
+  let failed = 0;
+  for (const item of queue.entries(now)) {
+    let ok = false;
+    try { ok = await forward(item); } catch { ok = false; }
+    if (ok) { queue.delivered(item.reportId); delivered++; } else { failed++; break; }
+  }
+  return { delivered, failed };
+}
+

package/src/hooks/receiver.ts

@@ -4,6 +4,8 @@ import { userConfigPath } from '../user-config.js';
 import { getSecretAsync } from '../nexus/config/secrets/index.js';
 import { HookQueue, type QueuedHook } from './queue.js';
 import { toExternalTask, verifyWebhook, type HookProvider } from './providers.js';
+import { drainReports, handleReportPost, ReportLimiter, ReportQueue, type ReceivedReport } from './error-report.js';
+import { effectiveInstanceRoot } from '../instance/resolve.js';
 
 export interface HookSecrets {
   linear?: string;
@@ -18,6 +20,8 @@ export interface HookReceiverOptions {
   now?: () => number;
   root?: string;
   retryBaseMs?: number;
+  /** ER2 — forward one queued error report to the Primary; default = POST /v1/reports/ingest over the tailnet. */
+  forwardReport?: (item: ReceivedReport) => Promise<boolean>;
 }
 
 /** `/v1/tasks` lives on the Primary's nexus API, not on the control plane — so the address is its own setting. */
@@ -42,8 +46,40 @@ async function forwardToPrimary(event: QueuedHook): Promise<Response> {
   });
 }
 
+async function forwardReportToPrimary(item: ReceivedReport): Promise<boolean> {
+  const config = JSON.parse(readFileSync(userConfigPath(), 'utf8')) as { hooks?: { primaryTokenRef?: string; primaryUrl?: unknown } };
+  const ref = config.hooks?.primaryTokenRef;
+  if (!ref) throw new Error('primary token reference missing');
+  const token = await getSecretAsync(ref);
+  if (!token) throw new Error('primary token missing');
+  const response = await fetch(new URL('/v1/reports/ingest', hooksPrimaryUrl(config)), {
+    method: 'POST', headers: { 'content-type': 'application/json', authorization: `Bearer ${token}` },
+    body: JSON.stringify(item), signal: AbortSignal.timeout(10_000),
+  });
+  return response.ok;
+}
+
 export function startHookReceiver(options: HookReceiverOptions): { url: string; stop: () => void; queue: HookQueue } {
   const queue = new HookQueue(options.root);
+  const reportQueue = new ReportQueue(options.root ?? effectiveInstanceRoot(), (event, data) => debug.log('hooks.reports', event, data));
+  const reportLimiter = new ReportLimiter(options.now ?? Date.now);
+  const forwardReport = options.forwardReport ?? forwardReportToPrimary;
+  let reportFailures = 0;
+  let reportNextAt = 0;
+  let reportsDraining = false;
+  async function drainReportQueue(): Promise<void> {
+    if (stopped || reportsDraining || Date.now() < reportNextAt) return;
+    reportsDraining = true;
+    try {
+      const result = await drainReports(reportQueue, forwardReport, (options.now ?? Date.now)());
+      if (result.delivered) debug.log('hooks.reports', 'forwarded', { delivered: result.delivered });
+      if (result.failed) {
+        reportFailures++;
+        reportNextAt = Date.now() + Math.min(300_000, Math.max(1, options.retryBaseMs ?? 1000) * 2 ** Math.min(reportFailures - 1, 20));
+        debug.log('hooks.reports', 'forward-failed', { queued: reportQueue.count(), failures: reportFailures });
+      } else reportFailures = 0;
+    } finally { reportsDraining = false; }
+  }
   const now = options.now ?? Date.now;
   const forward = options.forward ?? forwardToPrimary;
   const attempts = new Map<string, { next: number; failures: number }>();
@@ -75,6 +111,7 @@ export function startHookReceiver(options: HookReceiverOptions): { url: string;
         })();
       }
     } finally {
+      void drainReportQueue();
       draining = false;
       if (!stopped) timer = setTimeout(() => { void drain(); }, Math.min(1000, options.retryBaseMs ?? 1000));
     }
@@ -83,7 +120,10 @@ export function startHookReceiver(options: HookReceiverOptions): { url: string;
     async fetch(request) {
       const url = new URL(request.url);
       if (request.method === 'GET' && url.pathname === '/hooks/health')
-        return Response.json({ ok: true, queued: queue.count() });
+        return Response.json({ ok: true, queued: queue.count(), reportsQueued: reportQueue.count() });
+      if (request.method === 'POST' && url.pathname === '/v1/reports')
+        return handleReportPost(request, { limiter: reportLimiter, queue: reportQueue, ...(options.now ? { now: options.now } : {}),
+          log: (event, data) => debug.log('hooks.reports', event, data), wake: () => { reportNextAt = 0; void drainReportQueue(); } });
       if (request.method !== 'POST' || !/^\/hooks\/(linear|asana)$/.test(url.pathname)) return new Response('Not Found', { status: 404 });
       const provider = url.pathname.slice('/hooks/'.length) as HookProvider;
       const reject = (reason: string) => {

package/src/import/apply.ts

@@ -0,0 +1,128 @@
+// EN7 — `elanous import --apply` / `--undo`: run the EN4 plan. Skills register in place (EN9 `withConnectedSource`, `ref` default)
+// or as link/copy under the import folder; MCP joins `mcp.servers[]` switched off (EN8 `convertMcpEntry`); hooks, logins,
+// secrets and chat-bot tokens are only listed — never copied, never printed. Undo restores the config bytes and removes what apply made.
+import { cpSync, existsSync, mkdirSync, readFileSync, rmSync, symlinkSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { convertMcpEntry } from '../skills/connect-claude-plugin.js';
+import { withConnectedSource } from '../skills/connect.js';
+import type { SkillSource } from '../user-config.js';
+import type { ImportItem, ImportPlan } from './plan.js';
+
+export type ImportMode = 'ref' | 'link' | 'copy';
+export const IMPORT_MODES: readonly ImportMode[] = ['ref', 'link', 'copy'];
+
+export interface ImportManifest {
+  at: string;
+  mode: ImportMode;
+  configPath: string;
+  /** Config bytes before apply; null when there was no config file. */
+  backup: string | null;
+  /** Files and links apply created, removed on undo. */
+  created: string[];
+  applied: Array<{ id: string; how: string }>;
+  kept: Array<{ id: string; status: string; why: string }>;
+}
+
+export interface ApplyDeps {
+  home: string;
+  configPath: string;
+  /** Where links/copies, the manifest and the config backup live. */
+  importRoot: string;
+  sources: readonly SkillSource[];
+  rawMcpServers: ReadonlyArray<Record<string, unknown>>;
+  /** Persist the new skills sources and raw MCP server rows (the config writer). */
+  save: (sources: SkillSource[], rawServers: Array<Record<string, unknown>>) => void;
+  now?: () => Date;
+}
+
+const manifestPath = (importRoot: string) => join(importRoot, 'last-apply.json');
+const expand = (path: string, home: string) => (path.startsWith('~') ? join(home, path.slice(1)) : path);
+
+function readMcpSpec(item: ImportItem, home: string): unknown {
+  try {
+    const json = JSON.parse(readFileSync(expand(item.path, home), 'utf8')) as Record<string, unknown>;
+    const table = item.source === 'claude' ? json.mcpServers : (json.mcp as Record<string, unknown> | undefined)?.servers;
+    return (table as Record<string, unknown> | undefined)?.[item.name];
+  } catch { return undefined; }
+}
+
+export function readImportManifest(importRoot: string): ImportManifest | null {
+  try { return JSON.parse(readFileSync(manifestPath(importRoot), 'utf8')) as ImportManifest; } catch { return null; }
+}
+
+export function applyImport(plan: ImportPlan, opts: { mode?: ImportMode; pick?: readonly string[] }, deps: ApplyDeps): ImportManifest {
+  if (readImportManifest(deps.importRoot)) throw new Error('이미 적용한 가져오기가 있습니다 — 먼저 `elanous import --undo`');
+  const mode = opts.mode ?? 'ref';
+  const picked = opts.pick?.length ? new Set(opts.pick) : null;
+  const manifest: ImportManifest = {
+    at: (deps.now ?? (() => new Date()))().toISOString(), mode, configPath: deps.configPath,
+    backup: existsSync(deps.configPath) ? readFileSync(deps.configPath, 'utf8') : null, created: [], applied: [], kept: [],
+  };
+  let sources = [...deps.sources];
+  const rawServers = [...deps.rawMcpServers];
+  const keep = (item: ImportItem, why: string) => manifest.kept.push({ id: item.id, status: item.status, why });
+  mkdirSync(deps.importRoot, { recursive: true });
+
+  for (const item of plan.items) {
+    if (picked && !picked.has(item.id)) continue;
+    if (item.status === 'same') continue;
+    if (item.status !== 'new') {
+      keep(item, item.status === 'secret' || item.status === 'archived-only'
+        ? `보관만 — 옮기지도 켜지도 않는다${item.next ? ` · 따로: \`${item.next}\`` : ''}`
+        : item.status === 'conflict' ? '같은 이름 · 다른 내용 — 그대로 둔다' : '형식을 아직 옮기지 않는다');
+      continue;
+    }
+    if (item.kind === 'skill') {
+      const skillDir = expand(item.path, deps.home);
+      if (mode === 'ref') {
+        const root = join(skillDir, '..');
+        sources = withConnectedSource(sources, root, item.source);
+        manifest.applied.push({ id: item.id, how: `ref ${item.path}` });
+        continue;
+      }
+      const target = join(deps.importRoot, 'skills', item.source, item.name);
+      if (existsSync(target)) { keep(item, `이미 있다: ${target}`); continue; }
+      mkdirSync(join(target, '..'), { recursive: true });
+      if (mode === 'link') symlinkSync(skillDir, target, 'dir');
+      else cpSync(skillDir, target, { recursive: true, dereference: true });
+      manifest.created.push(target);
+      sources = withConnectedSource(sources, join(deps.importRoot, 'skills', item.source), `import:${item.source}`);
+      manifest.applied.push({ id: item.id, how: `${mode} ${item.path}` });
+      continue;
+    }
+    if (item.kind === 'mcp' && (item.source === 'claude' || item.source === 'openclaw')) {
+      const converted = convertMcpEntry(item.source, item.name, readMcpSpec(item, deps.home), '');
+      if ('skipped' in converted) { keep(item, converted.skipped); continue; }
+      if (rawServers.some((row) => row.id === item.name)) { keep(item, '같은 id 가 이미 있다'); continue; }
+      rawServers.push({ ...converted, id: item.name });
+      manifest.applied.push({ id: item.id, how: 'mcp 꺼진 채로' });
+      continue;
+    }
+    keep(item, '이 판에서는 옮기지 않는다');
+  }
+
+  if (manifest.applied.length) deps.save(sources, rawServers);
+  writeFileSync(manifestPath(deps.importRoot), `${JSON.stringify(manifest, null, 2)}\n`, { mode: 0o600 });
+  return manifest;
+}
+
+/** Restore the config bytes and remove what apply created. Returns null when nothing was applied. */
+export function undoImport(importRoot: string): ImportManifest | null {
+  const manifest = readImportManifest(importRoot);
+  if (!manifest) return null;
+  if (manifest.backup === null) rmSync(manifest.configPath, { force: true });
+  else writeFileSync(manifest.configPath, manifest.backup);
+  for (const path of manifest.created) rmSync(path, { recursive: true, force: true });
+  rmSync(manifestPath(importRoot), { force: true });
+  return manifest;
+}
+
+export function formatApplied(m: ImportManifest): string {
+  const lines = [`가져왔습니다(${m.mode}) — ${m.applied.length}개 · 그대로 둔 것 ${m.kept.length}개. 되돌리려면: elanous import --undo`];
+  for (const a of m.applied.slice(0, 12)) lines.push(`  + ${a.id} — ${a.how}`);
+  if (m.applied.length > 12) lines.push(`  … 외 ${m.applied.length - 12}개`);
+  for (const k of m.kept.slice(0, 12)) lines.push(`  · ${k.id} [${k.status}] — ${k.why}`);
+  if (m.kept.length > 12) lines.push(`  … 외 ${m.kept.length - 12}개`);
+  if (m.applied.some((a) => a.how.startsWith('mcp'))) lines.push('MCP 서버는 꺼진 채로 넣었습니다. 믿을 수 있는 것만 켜 주세요(켠 뒤 데몬 재시작).');
+  return lines.join('\n');
+}

package/src/import/plan.ts

@@ -0,0 +1,197 @@
+// EN4 — `elanous import`: detect → plan on one screen, writes nothing (RESEARCH-entrances-for-codex-claude-openclaw-hermes-users §5a·§5b).
+// Each item names the existing sub-command that applies it (connect · nexus channel-bot import); `--apply` is EN7 (apply.ts).
+import { createHash } from 'node:crypto';
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { findSkillFolders } from '../skills/connect.js';
+import { detectChannelImports, SOURCE_LABEL } from '../channel-import/detect.js';
+
+export type ImportSourceId = 'agents' | 'claude' | 'codex' | 'openclaw' | 'hermes';
+export type ImportItemKind = 'skill' | 'instructions' | 'mcp' | 'hooks' | 'credentials' | 'channel-bot';
+/** `same` already reachable/identical · `conflict` same name, different content · `archived-only` kept, never run · `secret` moved only on an explicit ask. */
+export type ImportItemStatus = 'new' | 'same' | 'conflict' | 'unsupported' | 'archived-only' | 'secret';
+
+export interface ImportSourceInfo { id: ImportSourceId; root: string; detected: boolean }
+export interface ImportItem {
+  /** `<source>:<kind>:<name>` — what `import --apply --pick` takes. */
+  id: string;
+  source: ImportSourceId;
+  kind: ImportItemKind;
+  name: string;
+  /** `~`-relative path the item was found in. */
+  path: string;
+  status: ImportItemStatus;
+  /** The existing command that applies this item; absent when nothing applies it yet. */
+  next?: string;
+  note?: string;
+}
+export interface ImportPlan { sources: ImportSourceInfo[]; items: ImportItem[] }
+
+export interface ImportPlanInput {
+  home: string;
+  /** `$CODEX_HOME` when set. */
+  codexHome?: string;
+  /** Skill directories elanous reads today (defaultSkillDirs). */
+  activeSkillDirs: readonly string[];
+  /** Ids of MCP servers already in elanous config. */
+  mcpServerIds: readonly string[];
+}
+
+export const IMPORT_STATUSES: readonly ImportItemStatus[] = ['new', 'same', 'conflict', 'unsupported', 'archived-only', 'secret'];
+
+function sourceRoots(input: ImportPlanInput): Record<ImportSourceId, string> {
+  const { home } = input;
+  const openclaw = [join(home, '.openclaw'), join(home, '.clawdbot'), join(home, '.moltbot')].find((p) => existsSync(p)) ?? join(home, '.openclaw');
+  return {
+    agents: join(home, '.agents'),
+    claude: join(home, '.claude'),
+    codex: input.codexHome || join(home, '.codex'),
+    openclaw,
+    hermes: join(home, '.hermes'),
+  };
+}
+
+const tilde = (path: string, home: string) => (path.startsWith(home) ? `~${path.slice(home.length)}` : path);
+const hash = (path: string) => { try { return createHash('sha256').update(readFileSync(path)).digest('hex'); } catch { return null; } };
+const readText = (path: string) => { try { return readFileSync(path, 'utf8'); } catch { return null; } };
+const readJson = (path: string): Record<string, unknown> | null => {
+  const raw = readText(path);
+  if (raw === null) return null;
+  try { const v = JSON.parse(raw) as unknown; return v && typeof v === 'object' && !Array.isArray(v) ? v as Record<string, unknown> : null; } catch { return null; }
+};
+const keysOf = (value: unknown): string[] => (value && typeof value === 'object' && !Array.isArray(value) ? Object.keys(value as object) : []);
+const hasSecretFields = (spec: unknown): boolean => {
+  if (!spec || typeof spec !== 'object') return false;
+  const s = spec as Record<string, unknown>;
+  return keysOf(s.env).length > 0 || keysOf(s.headers).length > 0 || keysOf(s.http_headers).length > 0;
+};
+
+/** Skill folders of one root, each judged against what elanous already reads. */
+function skillItems(source: ImportSourceId, root: string, input: ImportPlanInput, next?: string): Array<Omit<ImportItem, 'id'>> {
+  const names = findSkillFolders(root);
+  const rootActive = input.activeSkillDirs.includes(root);
+  return names.map((name): Omit<ImportItem, 'id'> => {
+    const path = tilde(join(root, name), input.home);
+    if (rootActive) return { source, kind: 'skill', name, path, status: 'same', note: '이미 읽는 폴더' };
+    const mine = hash(join(root, name, 'SKILL.md'));
+    const twin = input.activeSkillDirs.map((dir) => join(dir, name, 'SKILL.md')).find((p) => existsSync(p));
+    if (twin) {
+      return hash(twin) === mine
+        ? { source, kind: 'skill', name, path, status: 'same', note: `같은 내용이 이미 있다: ${tilde(twin, input.home)}` }
+        : { source, kind: 'skill', name, path, status: 'conflict', note: `같은 이름 · 다른 내용: ${tilde(twin, input.home)}` };
+    }
+    return { source, kind: 'skill', name, path, status: 'new', ...(next ? { next } : { note: '적용 명령은 0.2.9 `import --apply`' }) };
+  });
+}
+
+function mcpItem(source: ImportSourceId, name: string, path: string, secret: boolean, input: ImportPlanInput): Omit<ImportItem, 'id'> {
+  if (secret) return { source, kind: 'mcp', name, path, status: 'secret', note: 'env·헤더 값이 있다 — 묻기 전까지 옮기지 않는다' };
+  if (input.mcpServerIds.includes(name)) return { source, kind: 'mcp', name, path, status: 'same', note: '같은 id 가 이미 있다' };
+  return { source, kind: 'mcp', name, path, status: 'new', note: '0.2.9 `import --apply` 가 꺼진 채로 넣는다' };
+}
+
+/** `[mcp_servers.<name>]` tables of a Codex config.toml; `env`/`headers` keys or sub-tables count as secret. */
+function codexMcp(raw: string): Array<{ name: string; secret: boolean }> {
+  const out = new Map<string, boolean>();
+  let current: string | null = null;
+  for (const line of raw.split(/\r?\n/)) {
+    const table = /^\s*\[([^\[\]]+)\]\s*(?:#.*)?$/.exec(line)?.[1]?.trim();
+    if (table !== undefined) {
+      const m = /^mcp_servers\.(?:"([^"]+)"|([A-Za-z0-9_-]+))(?:\.([A-Za-z_]+))?$/.exec(table);
+      current = m ? (m[1] ?? m[2]!) : null;
+      if (current) out.set(current, (out.get(current) ?? false) || ['env', 'headers', 'http_headers'].includes(m![3] ?? ''));
+      continue;
+    }
+    if (current && /^\s*(env|headers|http_headers)\s*=/.test(line)) out.set(current, true);
+  }
+  return [...out].map(([name, secret]) => ({ name, secret }));
+}
+
+/** Top-level keys under `mcp_servers:` in a Hermes config.yaml (two-space indent). */
+function hermesMcp(raw: string): string[] {
+  const block = /^mcp_servers:\s*\n((?:[ \t]+.*\n?|\s*\n)*)/m.exec(raw)?.[1] ?? '';
+  return [...block.matchAll(/^ {2}([A-Za-z0-9_.-]+):/gm)].map((m) => m[1]!);
+}
+
+export function planImport(input: ImportPlanInput): ImportPlan {
+  const roots = sourceRoots(input);
+  const sources = (Object.keys(roots) as ImportSourceId[]).map((id) => ({ id, root: tilde(roots[id], input.home), detected: existsSync(roots[id]) }));
+  const items: Array<Omit<ImportItem, 'id'>> = [];
+  const home = input.home;
+  const at = (p: string) => tilde(p, home);
+
+  if (existsSync(roots.agents)) {
+    items.push(...skillItems('agents', join(roots.agents, 'skills'), input));
+    if (existsSync(join(roots.agents, 'AGENTS.md'))) items.push({ source: 'agents', kind: 'instructions', name: 'AGENTS.md', path: at(join(roots.agents, 'AGENTS.md')), status: 'unsupported', note: '전역 지시 파일은 아직 싣지 않는다' });
+  }
+
+  if (existsSync(roots.claude)) {
+    items.push(...skillItems('claude', join(roots.claude, 'skills'), input, 'elanous connect claude'));
+    if (existsSync(join(roots.claude, 'CLAUDE.md'))) items.push({ source: 'claude', kind: 'instructions', name: 'CLAUDE.md', path: at(join(roots.claude, 'CLAUDE.md')), status: 'unsupported', note: '전역 지시 파일은 아직 싣지 않는다' });
+    const claudeJson = join(home, '.claude.json');
+    for (const [name, spec] of Object.entries((readJson(claudeJson)?.mcpServers ?? {}) as Record<string, unknown>)) items.push(mcpItem('claude', name, at(claudeJson), hasSecretFields(spec), input));
+    const settings = join(roots.claude, 'settings.json');
+    for (const event of keysOf(readJson(settings)?.hooks)) items.push({ source: 'claude', kind: 'hooks', name: event, path: at(settings), status: 'archived-only', note: '훅은 보관만 · 켜지 않는다' });
+    if (existsSync(join(roots.claude, '.credentials.json'))) items.push({ source: 'claude', kind: 'credentials', name: 'login', path: at(join(roots.claude, '.credentials.json')), status: 'secret', note: '로그인은 옮기지 않는다 · 엘라누스에서 따로 한 번' });
+  }
+
+  if (existsSync(roots.codex)) {
+    items.push(...skillItems('codex', join(roots.codex, 'skills'), input, 'elanous connect codex'));
+    if (existsSync(join(roots.codex, 'AGENTS.md'))) items.push({ source: 'codex', kind: 'instructions', name: 'AGENTS.md', path: at(join(roots.codex, 'AGENTS.md')), status: 'unsupported', note: '전역 지시 파일은 아직 싣지 않는다' });
+    const toml = join(roots.codex, 'config.toml');
+    const raw = readText(toml);
+    for (const server of raw ? codexMcp(raw) : []) items.push(mcpItem('codex', server.name, at(toml), server.secret, input));
+    if (existsSync(join(roots.codex, 'auth.json'))) items.push({ source: 'codex', kind: 'credentials', name: 'login', path: at(join(roots.codex, 'auth.json')), status: 'secret', note: '로그인은 옮기지 않는다 · 엘라누스에서 따로 한 번' });
+  }
+
+  if (existsSync(roots.openclaw)) {
+    items.push(...skillItems('openclaw', join(roots.openclaw, 'skills'), input));
+    const cfg = join(roots.openclaw, 'openclaw.json');
+    const servers = (readJson(cfg)?.mcp as Record<string, unknown> | undefined)?.servers;
+    for (const [name, spec] of Object.entries((servers && typeof servers === 'object' ? servers : {}) as Record<string, unknown>)) items.push(mcpItem('openclaw', name, at(cfg), hasSecretFields(spec), input));
+  }
+
+  if (existsSync(roots.hermes)) {
+    items.push(...skillItems('hermes', join(roots.hermes, 'skills'), input));
+    const yaml = join(roots.hermes, 'config.yaml');
+    const raw = readText(yaml);
+    for (const name of raw ? hermesMcp(raw) : []) items.push({ source: 'hermes', kind: 'mcp', name, path: at(yaml), status: 'unsupported', note: 'YAML 형식은 아직 변환하지 않는다' });
+  }
+
+  // EN13 — chat bots: token values stay masked; the existing import command stores them after the user agrees.
+  const bots = detectChannelImports(home);
+  for (const c of bots.candidates) {
+    const source: ImportSourceId | null = c.source === 'openclaw' ? 'openclaw' : c.source === 'hermes' ? 'hermes' : null;
+    if (!source) continue;
+    items.push({ source, kind: 'channel-bot', name: c.platform, path: c.file, status: 'secret', next: 'elanous nexus channel-bot import', note: `${SOURCE_LABEL[c.source]} 봇 토큰(가림)` });
+  }
+  for (const u of bots.unreadable) {
+    const source: ImportSourceId | null = u.file.includes('.hermes') ? 'hermes' : u.file.includes('.openclaw') || u.file.includes('.clawdbot') || u.file.includes('.moltbot') ? 'openclaw' : null;
+    if (source) items.push({ source, kind: 'channel-bot', name: 'bot', path: u.file, status: 'unsupported', note: u.reason });
+  }
+  return { sources, items: items.map((item) => ({ ...item, id: `${item.source}:${item.kind}:${item.name}` })) };
+}
+
+const KIND_LABEL: Record<ImportItemKind, string> = { skill: '스킬', instructions: '지시 파일', mcp: 'MCP', hooks: '훅', credentials: '로그인', 'channel-bot': '채팅 봇' };
+
+/** One screen: per source, counts by status, then the items that need a decision. */
+export function formatImportPlan(plan: ImportPlan): string {
+  const lines: string[] = ['가져오기 계획 — 아무것도 쓰지 않았습니다.', ''];
+  const detected = plan.sources.filter((s) => s.detected);
+  if (!detected.length) return [...lines, '쓰던 에이전트를 찾지 못했습니다(~/.agents · ~/.claude · ~/.codex · ~/.openclaw · ~/.hermes).'].join('\n');
+  for (const source of detected) {
+    const mine = plan.items.filter((i) => i.source === source.id);
+    const counts = IMPORT_STATUSES.map((s) => [s, mine.filter((i) => i.status === s).length] as const).filter(([, n]) => n > 0);
+    lines.push(`■ ${source.id} (${source.root}) — ${mine.length ? counts.map(([s, n]) => `${s} ${n}`).join(' · ') : '항목 없음'}`);
+    for (const kind of Object.keys(KIND_LABEL) as ImportItemKind[]) {
+      const group = mine.filter((i) => i.kind === kind && i.status !== 'same');
+      if (!group.length) continue;
+      const shown = group.slice(0, 6).map((i) => `${i.name}[${i.status}]`).join(', ');
+      lines.push(`  ${KIND_LABEL[kind]}: ${shown}${group.length > 6 ? ` 외 ${group.length - 6}개` : ''}`);
+    }
+  }
+  const nexts = [...new Set(plan.items.filter((i) => i.next && i.status !== 'same').map((i) => i.next!))];
+  lines.push('', '한 번에: `elanous import --apply` (스킬은 그 자리 등록 · MCP 는 꺼진 채로 · 비밀·훅은 보관만 · 되돌리기 `--undo`)');
+  lines.push(nexts.length ? `따로: ${nexts.map((n) => `\`${n}\``).join(' · ')}` : '따로 적용할 명령이 있는 항목은 없습니다.', '상태: new · same · conflict · unsupported · archived-only · secret — 자세히는 `elanous import --json`');
+  return lines.join('\n');
+}