elanous 0.2.6 → 0.2.8

package/src/intake-plane/submit-intake-work.ts

@@ -4,7 +4,7 @@
  *
  * - absorb → 흡수 원장(`ingestIntakeItems`) — URL 이 있으면 URL 마다, 없으면 글 한 덩이(PWA `absorbItemsFromText` 와 같은 규칙).
  * - tasks  → TOX(`dispatchTaskCreate`) — 외부 출처(텔레그램 등)는 `external` 로 실어 M1(backlog ⊕ 승인 대기)을 탄다.
- * - graph  → 하니스 ask(`handleHarnessAskPost` 를 요청 하나로 부른다 — 흐름을 복제하지 않는다).
+ * - graph  → 자리 문서 요청은 A5 실행 요청, 나머지는 하니스 ask(`handleHarnessAskPost`).
  * - ask-human → 실행하지 않는다. 고를 갈래를 돌려준다.
  *
  * 로그엔 원문이 아니라 길이만 남긴다(앞문 RFC · `user-private`).
@@ -16,6 +16,7 @@ import type { ExternalTaskSource } from '../task-orchestrator/types.js';
 import { TASK_DEFAULTS } from '../task-orchestrator/types.js';
 import { decideIntakeFrontRoute, type IntakeFrontRouteDecision } from './front-route-rules.js';
 import { ingestIntakeItems, intakeItemId, type IntakeSource, type RawIntakeItem } from './items.js';
+import { isCooPlannerRequest, isSeatDocRequest, submitSeatDocRequest, type SeatDocDeps } from './seat-doc-route.js';
 
 export type IntakeWorkTrack = 'absorb' | 'tasks' | 'graph';
 
@@ -40,6 +41,8 @@ export interface SubmitIntakeWorkDeps {
   ingest?: typeof ingestIntakeItems;
   createTask?: (input: CreateTaskInput) => Promise<{ taskId?: string; deduplicated?: boolean; output: string }>;
   askHarness?: (text: string, origin?: MissionOrigin) => Promise<{ acceptanceId?: string; error?: string }>;
+  seatDoc?: typeof submitSeatDocRequest;
+  seatDocDeps?: SeatDocDeps;
   handleHarnessAskPost?: typeof import('../nexus/api/harness-api.js').handleHarnessAskPost;
   log?: (event: string, data: Record<string, unknown>) => void;
 }
@@ -130,6 +133,11 @@ export async function submitIntakeWork(
       return { ok: true, track: 'tasks', taskId: res.taskId, deduplicated: res.deduplicated ?? false };
     }
     const reportTo = input.origin.kind === 'external' ? input.origin.reportTo : undefined;
+    if (isSeatDocRequest(text) || isCooPlannerRequest(text)) {
+      const { id } = await (deps.seatDoc ?? submitSeatDocRequest)({ text, reportTo, deps: deps.seatDocDeps });
+      log('submitted', { ...base, acceptanceId: id });
+      return { ok: true, track: 'graph', acceptanceId: id };
+    }
     const res = await (deps.askHarness ? deps.askHarness(text, reportTo) : defaultAskHarness(text, reportTo, deps.handleHarnessAskPost));
     if (!res.acceptanceId) {
       log('failed', { ...base, reason: res.error ?? 'no-acceptance-id' });

package/src/intake-plane/telegram-seat-work.ts

@@ -0,0 +1,72 @@
+import { debug } from '../debug/log.js';
+import { parseSeatAddress, resolveSeat } from '../seat-address/seat-address.js';
+import {
+  submitIntakeWork,
+  type SubmitIntakeWorkDeps,
+} from './submit-intake-work.js';
+import type { TelegramWorkMessage } from './telegram-work.js';
+
+export interface TelegramSeatWorkDeps extends SubmitIntakeWorkDeps {
+  submit?: typeof submitIntakeWork;
+}
+
+/** Addressed Telegram work goes through graph intake, not the chat turn. */
+export async function handleTelegramSeatWork(
+  text: string,
+  msg: TelegramWorkMessage,
+  deps: TelegramSeatWorkDeps = {},
+): Promise<string | null> {
+  if (!text.startsWith('@')) return null;
+  const address = parseSeatAddress(text);
+  if (!address) return null;
+
+  const seats = address.seats.map((name) => ({ name, seat: resolveSeat(name) }));
+  const names = address.seats;
+  debug.log('seat-address.telegram', 'parsed', { seats: names });
+  const unknown = seats.filter(({ seat }) => !seat).map(({ name }) => `@${name}`);
+  if (unknown.length) {
+    debug.log('seat-address.telegram', 'rejected', { seats: names, reason: 'unknown-seat' });
+    return `어느 좌석을 말씀하시나요? ${unknown.join(', ')}은(는) 등록된 좌석이 아닙니다. 좌석을 확인해 다시 보내 주세요.`;
+  }
+  const body = address.body.trim();
+  if (!body) {
+    debug.log('seat-address.telegram', 'rejected', { seats: names, reason: 'empty-body' });
+    return '어떤 일을 맡길까요? 좌석 주소 뒤에 요청 내용을 적어 다시 보내 주세요.';
+  }
+
+  const reportTo = {
+    channel: 'telegram' as const,
+    chatId: msg.chatId,
+    ...(msg.botId ? { botId: msg.botId } : {}),
+    ...(msg.threadId ? { threadId: msg.threadId } : {}),
+  };
+  const replies: string[] = [];
+  for (const { seat } of seats) {
+    if (!seat) continue;
+    const label = seat.title ?? seat.id;
+    let result: Awaited<ReturnType<typeof submitIntakeWork>>;
+    try {
+      result = await (deps.submit ?? submitIntakeWork)({
+        text: `@${label} ${body}`,
+        track: 'graph',
+        origin: {
+          kind: 'external', ledgerSource: 'telegram-bot', provider: 'telegram',
+          ref: `telegram:${msg.chatId}:${msg.messageId}`, reportTo,
+        },
+      }, deps);
+    } catch (error) {
+      // 접수 문이 던져도 사람은 같은 대화에서 결과를 받는다(리뷰 must-fix: 예외 시 응답 누락).
+      debug.log('seat-address.telegram', 'rejected', { seats: [label], reason: 'submission-threw' });
+      replies.push(`@${label} 접수 실패 — ${String(error instanceof Error ? error.message : error).split('\n')[0]!.slice(0, 200)}`);
+      continue;
+    }
+    if (result.ok && result.track === 'graph') {
+      debug.log('seat-address.telegram', 'enqueued', { seats: [label] });
+      replies.push(`@${label} 접수번호: ${result.acceptanceId}`);
+    } else {
+      debug.log('seat-address.telegram', 'rejected', { seats: [label], reason: 'submission-failed' });
+      replies.push(`@${label} 접수 실패 — ${result.ok ? '접수번호가 없습니다' : result.reason.split('\n')[0]!.slice(0, 200)}`);
+    }
+  }
+  return replies.join('\n');
+}

package/src/llm/model-defaults.ts

@@ -20,7 +20,30 @@ import { getUserConfig, type LLMProviderName, type ReasoningLevel } from '../use
  *     openai-codex 눈금이고 openai 기본값을 덮어쓰지 않는다.
  *  ⛔ Do not import this file from user-config — that is the cycle. */
 function activeProviderForDefaults(provider?: LLMProviderName): LLMProviderName {
-  return provider ?? getUserConfig().llm.provider;
+  if (provider) return provider;
+  const configured = getUserConfig().llm.provider;
+  return configured === 'auto' ? decidedAutoProvider() : configured;
+}
+
+/** `auto` has no ladder of its own — the tier map answers it with Anthropic's model, so a grok-only
+ *  (or codex-only) user asked for a Claude model at every tier call site and hit «set ANTHROPIC_API_KEY».
+ *  Resolve `auto` the way the router does (decideProviderForConfig) and use that provider's ladder.
+ *  Late require: llm.ts imports this module. */
+let decideAuto: () => LLMProviderName | undefined = () => {
+  const { decideProviderForConfig } = require('../llm.js') as typeof import('../llm.js');
+  const decided = String(decideProviderForConfig(getUserConfig()).provider).replace(/^auto:/, '');
+  return decided && decided !== 'auto' ? decided as LLMProviderName : undefined;
+};
+function decidedAutoProvider(): LLMProviderName {
+  try { return decideAuto() ?? 'auto'; } catch { return 'auto'; }
+}
+/** Test seam — swap the auto decision. */
+export function setAutoProviderDecisionForTest(fn: (() => LLMProviderName | undefined) | undefined): void {
+  decideAuto = fn ?? (() => {
+    const { decideProviderForConfig } = require('../llm.js') as typeof import('../llm.js');
+    const decided = String(decideProviderForConfig(getUserConfig()).provider).replace(/^auto:/, '');
+    return decided && decided !== 'auto' ? decided as LLMProviderName : undefined;
+  });
 }
 
 /** config/tier 해석이 «실패»했을 때만 타는 최후 폴백. 티어 사다리가 안 읽히는

package/src/llm.ts

@@ -3942,7 +3942,8 @@ function providerDecisionCandidates(): Array<LLMProvider & { name: ProviderDecis
   return PROVIDER_DECISION_ORDER.map((name) => PROVIDERS[name]! as LLMProvider & { name: ProviderDecisionName });
 }
 
-function codexOAuthAvailable(): boolean {
+/** Exported (OB1) so onboarding and `setup` judge «is there a usable ChatGPT/Codex login» exactly as the runtime does. */
+export function codexOAuthAvailable(): boolean {
   try {
     const account = resolveCodexAccount(process.env, { storedHome: (key) => loadTokens(key)?.codexHome });
     if (loadTokens(account.storeKey)) return true;
@@ -4478,9 +4479,9 @@ async function consumeProviderText(
 export async function streamLLM(
   messages: LLMMessage[],
   onChunk: (delta: string, full: string) => void,
-  opts: LLMOpts & { provider?: LLMProvider; onResolvedProvider?: (provider: string) => void } = {},
+  opts: LLMOpts & { provider?: LLMProvider; initialProvider?: LLMProvider; onResolvedProvider?: (provider: string, model: string) => void } = {},
 ): Promise<string> {
-  let activeProvider = opts.provider ?? resolveDefaultProvider(opts.model);
+  let activeProvider = opts.provider ?? opts.initialProvider ?? resolveDefaultProvider(opts.model);
   const attemptedProviders = new Set<string>([activeProvider.name]);
   let blockedProviders: ProviderFallbackAttempt[] = [];
   let modelOverride = opts.model;
@@ -4493,7 +4494,7 @@ export async function streamLLM(
     );
     activeProvider = finalized.provider;
     const activeModel = finalized.model;
-    opts.onResolvedProvider?.(activeProvider.name);
+    opts.onResolvedProvider?.(activeProvider.name, activeModel);
     debug.log('llm.router', 'streamLLM', {
       provider: activeProvider.name,
       model: activeModel,

package/src/machines/machine-ledger.ts

@@ -0,0 +1,127 @@
+import { readFileSync, writeFileSync } from 'node:fs';
+import { isIP } from 'node:net';
+import { resolve } from 'node:path';
+import { parseDocument } from 'yaml';
+
+export interface MachineRow {
+  id: string;
+  name: string;
+  specs: string;
+  locationStatus: string;
+  role: string;
+  duties: string;
+}
+
+export interface DeviceRow {
+  id: string;
+  name: string;
+  status: string;
+  purpose: string;
+}
+
+export interface MachineLedger {
+  title: string;
+  policy: string[];
+  machines: MachineRow[];
+  devices: DeviceRow[];
+  rules: string[];
+  changes: string[];
+}
+
+export const machineLedgerPath = (root = process.cwd()): string => resolve(root, 'docs/ops/machines.yaml');
+export const machineMarkdownPath = (root = process.cwd()): string => resolve(root, 'docs/ops/LEDGER-machines-and-devices.md');
+
+// The ledger rule: no secrets, IPs or accounts — token prefixes, key=value assignments, e-mail addresses.
+const forbidden = /(?:sk-(?:proj-|live-|ant-)?|gh[pousr]_|github_pat_|glpat-|xox[abposr]-|tskey-|AKIA|AIza)[A-Za-z0-9_-]{8,}|\b(?:\d{1,3}\.){3}\d{1,3}\b|\b(?:token|secret|password|passwd|api[_-]?key|key)\s*[=:]\s*\S|-----BEGIN [A-Z ]*PRIVATE KEY|[A-Za-z0-9._%+-]+@[A-Za-z0-9-]+(?:\.[A-Za-z0-9-]+)*\.[A-Za-z]{2,}/i;
+// A value lands in a Markdown table cell: a pipe or line break would split the row.
+const tableBreaking = /[|\r\n]/;
+const containsIpv6 = (value: string): boolean => (value.match(/(?:[a-f\d]*:){2,}[a-f\d:.]*/gi) ?? []).some((candidate) => isIP(candidate.replace(/\.+$/, '')) === 6);
+const idPattern = /^[a-z][a-z0-9-]*$/;
+const keys = (value: Record<string, unknown>, allowed: string[], label: string): void => {
+  for (const key of Object.keys(value)) if (!allowed.includes(key)) throw new Error(`unknown ${label} field: ${key}`);
+};
+const record = (value: unknown, label: string): Record<string, unknown> => {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) throw new Error(`invalid ${label}`);
+  return value as Record<string, unknown>;
+};
+const text = (value: unknown, label: string): string => {
+  if (typeof value !== 'string' || !value.trim() || forbidden.test(value) || containsIpv6(value)) throw new Error(`invalid or secret-like ${label}`);
+  if (tableBreaking.test(value)) throw new Error(`${label} must not contain a pipe or line break`);
+  return value;
+};
+const list = (value: unknown, label: string): string[] => {
+  if (!Array.isArray(value)) throw new Error(`invalid ${label}`);
+  return value.map((entry, index) => text(entry, `${label}[${index}]`));
+};
+
+export function validateMachineLedger(value: unknown): MachineLedger {
+  const data = record(value, 'ledger');
+  keys(data, ['title', 'policy', 'machines', 'devices', 'rules', 'changes'], 'ledger');
+  if (!Array.isArray(data.machines) || !Array.isArray(data.devices)) throw new Error('invalid machines or devices');
+  const ids = new Set<string>();
+  const rows = <T extends { id: string }>(entries: unknown[], fields: string[], label: string): T[] => entries.map((entry, index) => {
+    const row = record(entry, `${label}[${index}]`);
+    keys(row, fields, label);
+    const result = Object.fromEntries(fields.map((field) => [field, text(row[field], `${label}.${field}`)])) as T;
+    if (!idPattern.test(result.id) || ids.has(result.id)) throw new Error(`empty, duplicate or invalid id: ${result.id}`);
+    ids.add(result.id);
+    return result;
+  });
+  return {
+    title: text(data.title, 'title'),
+    policy: list(data.policy, 'policy'),
+    machines: rows<MachineRow>(data.machines, ['id', 'name', 'specs', 'locationStatus', 'role', 'duties'], 'machines'),
+    devices: rows<DeviceRow>(data.devices, ['id', 'name', 'status', 'purpose'], 'devices'),
+    rules: list(data.rules, 'rules'),
+    changes: list(data.changes, 'changes'),
+  };
+}
+
+export function loadMachineLedger(root = process.cwd()): MachineLedger {
+  const document = parseDocument(readFileSync(machineLedgerPath(root), 'utf8'), { uniqueKeys: true });
+  if (document.errors.length) throw new Error(document.errors.map((error) => error.message).join('; '));
+  return validateMachineLedger(document.toJS());
+}
+
+export function renderLedgerMarkdown(ledger: MachineLedger): string {
+  const data = validateMachineLedger(ledger);
+  const names = (name: string) => name === '(미정)' ? name : name.split(' · ').map((part) => `\`${part}\``).join(' · ');
+  const portablePolicy = data.policy.find((line) => line.startsWith('창은 '));
+  const portableHeading = portablePolicy ? `## 2. 창 (${portablePolicy.slice('창은 '.length).replace(/\.$/, '')})` : '## 2. 창';
+  return [
+    `# ${data.title}`, '',
+    '> 생성 결과 — 보유·역할과 변경 이력의 단일 원본은 [`machines.yaml`](machines.yaml). 이 문서의 행·규칙·변경 이력은 직접 수정하지 않는다. YAML 수정 후 `bun bin/elanous.mjs --test machine render` 로 재생성하고 `bun bin/elanous.mjs --test machine render --check` 로 확인한다.',
+    ...data.policy.filter((line) => !line.startsWith('창은 ')).map((line) => `> ${line.replace('`docs/ops/machines.yaml` 에', 'YAML 에')}`),
+    '', '## 1. 계산 자원 (일하는 기계)',
+    '| 이름(tailnet) | 기종 · 사양 | 위치 · 상태 | 자리 | 맡은 일 |',
+    '|---|---|---|---|---|',
+    ...data.machines.map((row) => `| ${names(row.name)} | ${row.specs} | ${row.locationStatus} | ${row.role} | ${row.duties} |`),
+    '', portableHeading,
+    '| 기기 | 상태 | 용도 |', '|---|---|---|',
+    ...data.devices.map((row) => `| ${row.name} | ${row.status} | ${row.purpose} |`),
+    '', '## 3. 규칙', ...data.rules.map((rule) => `- ${rule}`),
+    '', '## 변경', ...data.changes.map((change) => `- ${change}`), '',
+  ].join('\n');
+}
+
+export function setMachineField(root: string, id: string, field: string, value: string): MachineLedger {
+  const ledger = loadMachineLedger(root);
+  const row = [...ledger.machines, ...ledger.devices].find((item) => item.id === id);
+  if (!row) throw new Error(`unknown machine id: ${id}`);
+  if (field === 'id' || !(field in row)) throw new Error(`unknown or immutable field: ${field}`);
+  text(value, field);
+  const updated = { ...row, [field]: value };
+  if ('specs' in row) ledger.machines[ledger.machines.findIndex((item) => item.id === id)] = updated as MachineRow;
+  else ledger.devices[ledger.devices.findIndex((item) => item.id === id)] = updated as DeviceRow;
+  validateMachineLedger(ledger);
+  const yamlPath = machineLedgerPath(root);
+  const original = readFileSync(yamlPath, 'utf8');
+  const document = parseDocument(original, { uniqueKeys: true });
+  const section = 'specs' in row ? 'machines' : 'devices';
+  const index = section === 'machines' ? ledger.machines.findIndex((item) => item.id === id) : ledger.devices.findIndex((item) => item.id === id);
+  document.setIn([section, index, field], value);
+  validateMachineLedger(document.toJS());
+  writeFileSync(yamlPath, document.toString(), 'utf8');
+  writeFileSync(machineMarkdownPath(root), renderLedgerMarkdown(ledger), 'utf8');
+  return ledger;
+}

package/src/market/pack-internal-refs.ts

@@ -0,0 +1,28 @@
+export const INTERNAL_REF_MARKERS = [
+  { marker: 'internal-doc-path', pattern: /docs\/(?:marketing|plans|goals|manual|roles|archive|measurements|brand|backlog|harness|system)(?=\/|[\s)\]}>.,;:!?'"`]|$)/g },
+  { marker: 'private-pr-number', pattern: /(?:PR #\d{4,}|#\d{5,})/g },
+  { marker: 'cut-hash', pattern: /(?:컷|cut) [0-9a-f]{7,40}(?![0-9a-f])/g },
+] as const;
+
+export type InternalRefHit = { file: string; line: number; marker: typeof INTERNAL_REF_MARKERS[number]['marker'] };
+
+export function scanPackInternalRefs(files: { path: string; text: string }[]): InternalRefHit[] {
+  const hits: InternalRefHit[] = [];
+  for (const file of files) {
+    for (const [index, line] of file.text.split(/\r?\n/).entries()) {
+      for (const { marker, pattern } of INTERNAL_REF_MARKERS) {
+        for (const match of line.matchAll(pattern)) {
+          if (marker === 'private-pr-number') {
+            const start = match.index;
+            const end = start + match[0].length;
+            if ((start > 0 && /[0-9a-f]/i.test(line[start - 1]!)) ||
+                (end < line.length && /[0-9a-f]/i.test(line[end]!)) ||
+                /^#[0-9a-f]{6}$/i.test(match[0])) continue;
+          }
+          hits.push({ file: file.path, line: index + 1, marker });
+        }
+      }
+    }
+  }
+  return hits;
+}

package/src/market/publish.ts

@@ -5,6 +5,7 @@ import { gunzipSync } from 'node:zlib';
 import { parse as parseYaml } from 'yaml';
 import { debug } from '../debug/log.js';
 import { packDirDeterministic } from './tgz.js';
+import { scanPackInternalRefs, type InternalRefHit } from './pack-internal-refs.js';
 import { signIndex, verifyIndex, type MarketplaceIndex } from './signed-index.js';
 
 type IndexConnector = MarketplaceIndex['plugins'][number]['ai.elanous']['connectors'][number];
@@ -62,11 +63,35 @@ function unpackLocal(archive: Uint8Array, destination: string): void {
   }
 }
 
+function scanArchiveInternalRefs(archive: Uint8Array): InternalRefHit[] {
+  const tar = gunzipSync(archive);
+  const field = (part: Buffer) => part.toString('utf8').replace(/\0.*$/, '');
+  const files: { path: string; text: string }[] = [];
+  for (let offset = 0; offset + 512 <= tar.length;) {
+    const header = tar.subarray(offset, offset + 512);
+    if (header.every(byte => byte === 0)) break;
+    const size = parseInt(field(header.subarray(124, 136)).trim(), 8);
+    const name = field(header.subarray(0, 100));
+    const prefix = field(header.subarray(345, 500));
+    const path = prefix ? `${prefix}/${name}` : name;
+    const contents = tar.subarray(offset + 512, offset + 512 + size);
+    // Recognized text formats remain scannable even if they contain a NUL byte.
+    const textFile = /(?:^|\/)(?:README|LICENSE|Dockerfile)(?:\.[^/]*)?$|\.(?:md|mdx|txt|json|jsonc|ya?ml|toml|xml|html?|css|scss|svg|mmd|sh|bash|py|js|jsx|mjs|cjs|ts|tsx|mts|cts|sql|csv)$/i.test(path);
+    if (textFile || !contents.includes(0)) {
+      // A known text format is decoded leniently — one invalid byte must not hide the rest of the file from the scan.
+      try { files.push({ path, text: new TextDecoder('utf-8', { fatal: !textFile }).decode(contents) }); }
+      catch { /* Binary files are not scanned as text. */ }
+    }
+    offset += 512 + Math.ceil(size / 512) * 512;
+  }
+  return scanPackInternalRefs(files);
+}
+
 export interface PublishResult {
   ok: boolean;
   sequence: number;
   published: Array<{ name: string; version: string; sha256: string; bundled: string[] }>;
-  skipped: Array<{ dir: string; reason: string }>;
+  skipped: Array<{ dir: string; reason: string; hits?: InternalRefHit[] }>;
   /** Published anyway, but a reviewer should look (e.g. a third-party graph relying on core recipes). */
   warnings: Array<{ dir: string; graph: string; reason: 'third-party-core-recipe'; recipes: string[] }>;
 }
@@ -128,8 +153,8 @@ export function publishMarket(input: {
       currentName = dir;
       currentVersion = undefined;
       const manifestPath = join(folder, 'plugin.json');
-      const skip = (reason: string) => {
-        skipped.push({ dir, reason });
+      const skip = (reason: string, hits?: InternalRefHit[]) => {
+        skipped.push({ dir, reason, ...(hits ? { hits } : {}) });
         debug.log('market.publish', 'skipped', { name: dir, version: currentVersion, sequence, reason });
       };
       if (!existsSync(manifestPath)) { skip('missing-plugin.json'); continue; }
@@ -245,6 +270,8 @@ export function publishMarket(input: {
         if (message.startsWith('bundle-conflict')) { skip('bundle-conflict'); continue; }
         throw error;
       }
+      const hits = scanArchiveInternalRefs(archive);
+      if (hits.length) { skip('internal-reference', hits.slice(0, 20)); continue; }
       let sha256 = createHash('sha256').update(archive).digest('hex');
       const recorded = recordedHashes.get(JSON.stringify([manifest.name, manifest.version]));
       if (recorded && recorded !== sha256) {
@@ -318,7 +345,7 @@ export function publishMarket(input: {
       signatureText: readFileSync(join(input.outDir, 'index.sig'), 'utf8'), trustedKeys });
     if (!verified.ok) throw new Error(`index verification failed: ${verified.reason}: ${verified.detail}`);
     for (const item of published) debug.log('market.publish', 'published', { name: item.name, version: item.version, sequence });
-    return { ok: true, sequence, published, skipped, warnings };
+    return { ok: !skipped.some(item => item.reason === 'internal-reference'), sequence, published, skipped, warnings };
   } catch (error) {
     const rawReason = error instanceof Error ? error.message : 'unknown-error';
     const reason = input.key.privateKeyPem && rawReason.includes(input.key.privateKeyPem) ? 'invalid signing key' : rawReason;

package/src/maturity/feature-maturity.ts

@@ -0,0 +1,65 @@
+export type Maturity = 'stable' | 'beta' | 'tool' | 'ops' | 'broken' | 'system';
+export type Surface = 'pwa' | 'desktop' | 'ios' | 'android' | 'tui' | 'cli' | 'telegram' | 'discord' | 'acp';
+export type Role = 'owner' | 'contributor' | 'general';
+
+type SurfaceMaturity = { pwa: Maturity } & Partial<Record<Exclude<Surface, 'pwa'>, Maturity>>;
+
+/** App Router pages, including the generated 404 and the dynamic missions route. */
+export const FEATURE_MATURITY = {
+  pwaRoute: {
+    '/': { pwa: 'stable' },
+    '/404': { pwa: 'stable' },
+    '/setup': { pwa: 'stable' },
+    '/setup/done': { pwa: 'stable' },
+    '/consult': { pwa: 'stable' },
+    '/chat': { pwa: 'stable' },
+    '/term': { pwa: 'stable' },
+    '/live': { pwa: 'stable' },
+    '/market': { pwa: 'stable' },
+    '/sessions': { pwa: 'stable' },
+    '/settings': { pwa: 'beta' },
+    '/editor': { pwa: 'beta' },
+    '/intake': { pwa: 'beta' },
+    '/trace': { pwa: 'beta' },
+    '/board': { pwa: 'beta' },
+    '/autopilot': { pwa: 'beta' },
+    '/missions/[id]': { pwa: 'beta' },
+    '/tasks': { pwa: 'beta' },
+    '/workspace': { pwa: 'beta' },
+    '/reflection': { pwa: 'beta' },
+    '/vault': { pwa: 'beta' },
+    '/observatory': { pwa: 'beta' },
+    '/exec': { pwa: 'beta' },
+    '/field': { pwa: 'beta' },
+    '/showroom': { pwa: 'beta' },
+    '/workflows': { pwa: 'beta' },
+    '/approvals': { pwa: 'tool' },
+    '/worktrees': { pwa: 'tool' },
+    '/design-check': { pwa: 'tool' },
+    '/control': { pwa: 'tool' },
+    '/scheduler': { pwa: 'ops' },
+    '/dashboard': { pwa: 'ops' },
+    '/bots': { pwa: 'ops' },
+    '/botlab': { pwa: 'ops' },
+    '/morning': { pwa: 'broken' },
+    '/settings/devices': { pwa: 'broken' },
+    '/workflows/chat-ui': { pwa: 'broken' },
+    '/share': { pwa: 'system' },
+  },
+} as const satisfies { pwaRoute: Record<string, SurfaceMaturity> };
+
+/** Unregistered routes and surfaces are not implicitly mature. Desktop shares the PWA implementation. */
+export function maturityOn(route: string, surface: Surface): Maturity | undefined {
+  if (!Object.prototype.hasOwnProperty.call(FEATURE_MATURITY.pwaRoute, route)) return undefined;
+  const grades: SurfaceMaturity = FEATURE_MATURITY.pwaRoute[route as keyof typeof FEATURE_MATURITY.pwaRoute];
+  return grades[surface] ?? (surface === 'desktop' ? grades.pwa : undefined);
+}
+
+export function visibleOn(route: string, surface: Surface, role: Role): boolean {
+  const maturity = maturityOn(route, surface);
+  if (!maturity) return false;
+  if (role === 'owner') return true;
+  if (maturity === 'system') return false;
+  if (route === '/settings') return true;
+  return maturity === 'stable' || (role === 'contributor' && (maturity === 'beta' || maturity === 'tool'));
+}

package/src/model-tier/turn-tier.ts

@@ -0,0 +1,24 @@
+import type { UserConfig } from '../user-config.js';
+import { resolveLlmTier, type LlmTierSource } from './tier-resolver.js';
+import type { ModelTier } from './types.js';
+import type { ReasoningLevel } from '../user-config.js';
+
+export type TurnReasoningEffort = 'minimal' | 'low' | 'medium' | 'high' | 'xhigh';
+const REASONING_EFFORT: Record<ReasoningLevel, TurnReasoningEffort> = { off: 'minimal', low: 'low', medium: 'medium', high: 'high', xhigh: 'xhigh' };
+
+/** Only a person's explicit LLM choice changes a chat turn's model. */
+export function explicitTurnTier(
+  cfg: UserConfig,
+  sessionId: string,
+): { model: string; tier: ModelTier; source: LlmTierSource; reasoningEffort?: TurnReasoningEffort } | undefined {
+  try {
+    const resolved = resolveLlmTier(cfg.modelTier, cfg.llm.provider, { sessionId });
+    if (resolved.source !== 'session-override' && resolved.source !== 'user-config-surface') return undefined;
+    // On codex the balanced·better·best tiers share one model and differ only in reasoning level (low·medium·high),
+    // so carrying the model alone left the slider a no-op there (10-01 live).
+    const reasoningEffort = resolved.reasoningLevel ? REASONING_EFFORT[resolved.reasoningLevel] : undefined;
+    return { model: resolved.model, tier: resolved.tier, source: resolved.source, ...(reasoningEffort ? { reasoningEffort } : {}) };
+  } catch {
+    return undefined;
+  }
+}

package/src/msg/msg-store.ts

@@ -0,0 +1,149 @@
+import { Database } from 'bun:sqlite';
+import { mkdirSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { elanousStateRoot } from '../autopilot/state-paths.js';
+
+export interface MessageEnvelope {
+  from: string;
+  to: string;
+  body: string;
+  kind?: string;
+}
+
+export interface Message extends MessageEnvelope {
+  id: number;
+  createdAt: string;
+}
+
+export interface UnreadRecipient {
+  recipient: string;
+  count: number;
+}
+
+const SEAT_ALIASES: Readonly<Record<string, string>> = {
+  S: 'OP', OP: 'OP', COO: 'OP',
+  T: 'MK', MK: 'MK', CMO: 'MK',
+  O: 'TC', TC: 'TC', CTO: 'TC',
+  F: 'UX', UX: 'UX', CXO: 'UX',
+};
+
+/** Normalize historic role names to the current seats; leave other valid seats usable. */
+export function canonicalSeatId(value: string): string {
+  if (typeof value !== 'string') throw new TypeError('seat must be a string');
+  const seat = value.trim().toUpperCase();
+  if (!/^[A-Z][A-Z0-9_-]{0,63}$/.test(seat)) throw new Error('invalid seat ID');
+  return Object.hasOwn(SEAT_ALIASES, seat) ? SEAT_ALIASES[seat]! : seat;
+}
+
+/** Check untrusted input before opening the DB or executing a write. */
+export function validateMessageEnvelope(input: unknown): MessageEnvelope {
+  if (!input || typeof input !== 'object' || Array.isArray(input)) throw new Error('message must be an object');
+  const record = input as Record<string, unknown>;
+  const from = canonicalSeatId(record.from as string);
+  const to = canonicalSeatId(record.to as string);
+  if (typeof record.body !== 'string' || !record.body.trim()) throw new Error('message body must be nonempty');
+  if (record.kind !== undefined && (typeof record.kind !== 'string' || !/^[a-z][a-z0-9_-]{0,63}$/.test(record.kind))) {
+    throw new Error('invalid message kind');
+  }
+  if (Object.keys(record).some(key => !['from', 'to', 'body', 'kind'].includes(key))) throw new Error('unknown message field');
+  return record.kind === undefined ? { from, to, body: record.body } : { from, to, body: record.body, kind: record.kind as string };
+}
+
+function validCursor(cursor: number): number {
+  if (!Number.isSafeInteger(cursor) || cursor < 0) throw new Error('cursor must be a nonnegative safe integer');
+  return cursor;
+}
+
+interface MessageRow {
+  id: number;
+  sender: string;
+  recipient: string;
+  body: string;
+  kind: string | null;
+  created_at: string;
+}
+
+function fromRow(row: MessageRow): Message {
+  return { id: row.id, from: row.sender, to: row.recipient, body: row.body,
+    ...(row.kind === null ? {} : { kind: row.kind }), createdAt: row.created_at };
+}
+
+/** SQLite owns both append order and per-recipient acknowledgement progress. */
+export class MsgStore {
+  readonly db: Database;
+
+  constructor(path: string = defaultMsgStorePath()) {
+    if (path !== ':memory:') mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    this.db = new Database(path);
+    this.db.exec('PRAGMA busy_timeout = 5000');
+    this.db.exec(`CREATE TABLE IF NOT EXISTS msg_messages (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      sender TEXT NOT NULL,
+      recipient TEXT NOT NULL,
+      body TEXT NOT NULL,
+      kind TEXT,
+      created_at TEXT NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS idx_msg_messages_recipient_id ON msg_messages(recipient, id);
+    CREATE TABLE IF NOT EXISTS msg_cursors (
+      recipient TEXT PRIMARY KEY,
+      last_id INTEGER NOT NULL DEFAULT 0 CHECK(last_id >= 0)
+    );`);
+  }
+
+  append(input: MessageEnvelope): Message {
+    const msg = validateMessageEnvelope(input);
+    const createdAt = new Date().toISOString();
+    const result = this.db.query(`INSERT INTO msg_messages(sender, recipient, body, kind, created_at)
+      VALUES (?, ?, ?, ?, ?)`).run(msg.from, msg.to, msg.body, msg.kind ?? null, createdAt);
+    return { id: Number(result.lastInsertRowid), ...msg, createdAt };
+  }
+
+  post(input: MessageEnvelope): Message { return this.append(input); }
+
+  /** Messages strictly after the supplied cursor, ordered by durable insertion ID. */
+  listByRecipient(recipient: string, after: number = 0, limit: number = 100): Message[] {
+    const to = canonicalSeatId(recipient);
+    validCursor(after);
+    if (!Number.isSafeInteger(limit) || limit < 1 || limit > 1000) throw new Error('limit must be between 1 and 1000');
+    return (this.db.query(`SELECT id, sender, recipient, body, kind, created_at FROM msg_messages
+      WHERE recipient = ? AND id > ? ORDER BY id ASC LIMIT ?`).all(to, after, limit) as MessageRow[]).map(fromRow);
+  }
+
+  list(recipient: string, after: number = 0, limit: number = 100): Message[] {
+    return this.listByRecipient(recipient, after, limit);
+  }
+
+  getCursor(recipient: string): number {
+    const to = canonicalSeatId(recipient);
+    return (this.db.query('SELECT last_id FROM msg_cursors WHERE recipient = ?').get(to) as { last_id: number } | null)?.last_id ?? 0;
+  }
+
+  /** Atomically reject future IDs and keep concurrent or stale acknowledgements from rewinding. */
+  advanceCursor(recipient: string, cursor: number): number {
+    const to = canonicalSeatId(recipient);
+    validCursor(cursor);
+    const result = this.db.query(`INSERT INTO msg_cursors(recipient, last_id)
+      SELECT ?, ? WHERE ? <= (SELECT COALESCE(MAX(id), 0) FROM msg_messages)
+      ON CONFLICT(recipient) DO UPDATE SET last_id = MAX(msg_cursors.last_id, excluded.last_id)`)
+      .run(to, cursor, cursor);
+    if (result.changes === 0) throw new Error('cursor exceeds the latest message ID');
+    return this.getCursor(to);
+  }
+
+  ack(recipient: string, cursor: number): number { return this.advanceCursor(recipient, cursor); }
+
+  unreadRecipients(): UnreadRecipient[] {
+    return this.db.query(`SELECT m.recipient AS recipient, COUNT(*) AS count
+      FROM msg_messages m LEFT JOIN msg_cursors c ON c.recipient = m.recipient
+      WHERE m.id > COALESCE(c.last_id, 0)
+      GROUP BY m.recipient ORDER BY m.recipient ASC`).all() as UnreadRecipient[];
+  }
+
+  unread(): UnreadRecipient[] { return this.unreadRecipients(); }
+
+  close(): void { this.db.close(); }
+}
+
+export function defaultMsgStorePath(): string { return join(elanousStateRoot(), 'msg', 'messages.db'); }
+export function openMsgStore(path?: string): MsgStore { return new MsgStore(path); }