elanous 0.2.7 → 0.2.8

package/src/exec-requests/planner.ts

@@ -21,6 +21,8 @@ export interface ExecPlanItem {
   graphId: string;
   inputs: Record<string, unknown>;
   reason?: string;
+  /** A5b — indexes of earlier items whose results this item needs (it starts after they finish). */
+  after?: number[];
 }
 
 /** 설치된 플러그인의 실행 그래프 — `<state>/plugins/<market>/<name>/<version>/graphs/{recipes.yaml, <id>.yaml}`
@@ -107,7 +109,7 @@ export function seatTitles(path = fileURLToPath(new URL('../../scripts/coord-tra
 }
 
 export async function judgeExecPlan(text: string, graphs: readonly InstalledGraph[], seats: readonly string[]): Promise<unknown> {
-  const prompt = `COO 역할. 요청을 실행 가능한 자리별 그래프로 나눠 맡겨라. JSON 배열만 출력: [{"seat":"자리","title":"할 일","graphId":"설치된 그래프 ID 또는 빈 문자열","inputs":{}}]. 자리 이름은 주어진 목록에서만, 그래프 ID는 설치된 목록에서만 고른다. 맞는 그래프가 없으면 graphId=""로 표시한다. 그래프에 inputKeys 가 있으면 inputs 를 그 키로만 채우되 한 줄에서 알 수 있는 값만 넣는다(모르는 값은 넣지 않는다). 그 그래프가 꼭 받아야 할 값(예: 브랜드 이름 · 사진 파일)을 한 줄에서 얻을 수 없으면 graphId=""로 두고 title 끝에 « — <무엇> 필요»를 적는다. 없는 그래프나 산출을 지어내지 마라. 바깥 게시·발행·광고·결제는 승인 노드를 거치기 전 실행하면 안 된다.\n자리: ${JSON.stringify(seats)}\n실행 가능한 그래프: ${JSON.stringify(graphs.map(({ id, title, description, inputKeys }) => ({ id, title, description, ...(inputKeys ? { inputKeys } : {}) })))}\n한 줄: ${JSON.stringify(text)}`;
+  const prompt = `COO 역할. 요청을 실행 가능한 자리별 그래프로 나눠 맡겨라. JSON 배열만 출력: [{"seat":"자리","title":"할 일","graphId":"설치된 그래프 ID 또는 빈 문자열","inputs":{},"after":[]}]. 앞 항목의 결과가 있어야 할 수 있는 일(예: 점검·조사 «결과로» 쓰는 한 장 · 보고)은 after 에 그 앞 항목 번호(0부터)를 적는다 — 그 항목은 앞 항목이 끝난 뒤 그 결과를 받아 시작한다. 서로 기다릴 필요가 없으면 after 는 빈 배열. 자리 이름은 주어진 목록에서만, 그래프 ID는 설치된 목록에서만 고른다. 맞는 그래프가 없으면 graphId=""로 표시한다. 그래프에 inputKeys 가 있으면 inputs 를 그 키로만 채우되 한 줄에서 알 수 있는 값만 넣는다(모르는 값은 넣지 않는다). 그 그래프가 꼭 받아야 할 값(예: 브랜드 이름 · 사진 파일)을 한 줄에서 얻을 수 없으면 graphId=""로 두고 title 끝에 « — <무엇> 필요»를 적는다. 없는 그래프나 산출을 지어내지 마라. 바깥 게시·발행·광고·결제는 승인 노드를 거치기 전 실행하면 안 된다.\n자리: ${JSON.stringify(seats)}\n실행 가능한 그래프: ${JSON.stringify(graphs.map(({ id, title, description, inputKeys }) => ({ id, title, description, ...(inputKeys ? { inputKeys } : {}) })))}\n한 줄: ${JSON.stringify(text)}`;
   const { streamLLM } = await import('../llm.js');
   const { tierModel } = await import('../llm/model-defaults.js');
   const raw = await streamLLM([{ role: 'user', content: prompt }], () => {}, { model: tierModel('best') });
@@ -124,16 +126,20 @@ export async function planExecRequest(text: string, deps: {
   const raw = await (deps.judge ?? judgeExecPlan)(text, graphs, seats);
   if (!Array.isArray(raw) || raw.length === 0) throw new Error('COO 계획이 비었거나 배열이 아닙니다');
   const known = new Map(graphs.map(graph => [graph.id, graph]));
-  return raw.map((item: unknown) => {
+  return raw.map((item: unknown, index: number) => {
     if (!item || typeof item !== 'object' || Array.isArray(item)) throw new Error('COO 계획 항목 형식 오류');
     const row = item as Record<string, unknown>;
     if (typeof row.seat !== 'string' || !seats.includes(row.seat) || typeof row.title !== 'string' || !row.title.trim()
       || typeof row.graphId !== 'string' || !row.inputs || typeof row.inputs !== 'object' || Array.isArray(row.inputs)) {
       throw new Error('COO 계획 항목 형식 오류');
     }
+    const after = Array.isArray(row.after)
+      ? [...new Set(row.after.filter((n): n is number => Number.isInteger(n) && (n as number) >= 0 && (n as number) < index))]
+      : [];
     return {
       seat: row.seat, title: row.title.trim(), graphId: row.graphId,
       inputs: row.inputs as Record<string, unknown>,
+      ...(after.length ? { after } : {}),
       ...(!known.has(row.graphId) ? { reason: `${row.seat}: 요청에 맞는 설치된 실행 그래프가 없습니다` } : {}),
     };
   });

package/src/exec-requests/runner.ts

@@ -112,6 +112,23 @@ function syncRun(item: ExecRequest, seat: ExecSeat, state: GraphRunState, root:
   if (seat.status === 'failed') seat.reason = state.nodes?.at(-1)?.error ?? `그래프 런 ${state.status}`;
 }
 
+const PRIOR_TEXT_LIMIT = 4_000;
+
+/** Earlier seats' outcome as plain context: the last summary and the head of a text/markdown report it wrote. */
+export function withPriorResults(inputs: Record<string, unknown> | undefined, prior: Array<{ seat: ExecSeat; state: GraphRunState }>): Record<string, unknown> {
+  const parts = prior.map(({ seat, state }) => {
+    const outputs = [...(state.nodes ?? [])].reverse().map(node => lastJsonObject(node.output)).filter((o): o is Record<string, unknown> => !!o);
+    const summary = outputs.map(o => o.summary).find((v): v is string => typeof v === 'string');
+    const report = outputs.map(o => o.report).find((v): v is string => typeof v === 'string' && /\.(md|txt)$/i.test(v));
+    let body = '';
+    if (report && existsSync(report)) { try { body = readFileSync(report, 'utf8').slice(0, PRIOR_TEXT_LIMIT); } catch { /* summary is enough */ } }
+    return [`[${seat.seat} · ${seat.title}]`, summary ?? '', body].filter(Boolean).join('\n');
+  });
+  const base = inputs ?? {};
+  const previous = typeof base.context === 'string' && base.context.trim() ? `${base.context.trim()}\n\n` : '';
+  return { ...base, context: `${previous}앞 자리 결과:\n${parts.join('\n\n')}` };
+}
+
 function aggregate(item: ExecRequest): void {
   if (item.status === 'planning' || item.seats.length === 0) return;
   if (item.seats.some(seat => seat.status === 'waiting' || seat.status === 'running')) item.status = 'running';
@@ -195,34 +212,57 @@ export class ExecRequestRunner {
     const plans = await (this.deps.plan ?? ((text: string) => planExecRequest(text, { graphs: async () => graphs })))(item.text);
     const byId = new Map(graphs.map(graph => [graph.id, graph]));
     item.seats = plans.map(plan => ({ seat: plan.seat, title: plan.title, status: plan.reason || !byId.has(plan.graphId) ? 'failed' : 'waiting', graphId: plan.graphId,
-      runId: plan.reason || !byId.has(plan.graphId) ? '' : randomUUID(), inputs: plan.inputs,
+      runId: plan.reason || !byId.has(plan.graphId) ? '' : randomUUID(), inputs: plan.inputs, ...(plan.after?.length ? { after: plan.after } : {}),
       ...(plan.reason || !byId.has(plan.graphId) ? { reason: plan.reason ?? `${plan.seat}: 요청에 맞는 설치된 실행 그래프가 없습니다` } : {}) }));
     item.status = 'running';
     debug.log('exec-requests', 'planned', { id, seats: item.seats.map(seat => ({ seat: seat.seat, graphId: seat.graphId, status: seat.status })) });
     this.store.save(item);
-    await Promise.all(item.seats.map(async (seat, index) => {
-      const graph = byId.get(seat.graphId);
-      if (!graph || seat.status === 'failed') return;
-      const starting = this.store.get(id)!;
-      starting.seats[index]!.status = 'running';
-      this.store.save(starting);
-      debug.log('exec-requests', 'started', { id, seat: seat.seat, graphId: seat.graphId, runId: seat.runId });
-      debug.log('exec-requests', 'seat-status', { id, seat: seat.seat, from: 'waiting', to: 'running' });
-      try {
-        const state = await (this.deps.run ?? runGraph)(graph.path, { input: seat.inputs, runId: seat.runId, deps: { root: this.root } });
-        const current = this.store.get(id)!;
-        syncRun(current, current.seats[index]!, state, this.root);
-        aggregate(current);
-        this.store.save(current);
-      } catch (error) {
-        const current = this.store.get(id)!;
-        current.seats[index]!.status = 'failed';
-        current.seats[index]!.reason = error instanceof Error ? error.message : String(error);
-        debug.log('exec-requests', 'seat-status', { id, seat: seat.seat, to: 'failed', reason: current.seats[index]!.reason });
-        aggregate(current);
-        this.store.save(current);
-      }
-    }));
+    // A5b — a seat that needs earlier results waits for them and starts with them in its `context`;
+    // seats with nothing to wait for still run together.
+    const states: Array<Promise<GraphRunState | null>> = [];
+    item.seats.forEach((seat, index) => {
+      states[index] = (async (): Promise<GraphRunState | null> => {
+        const graph = byId.get(seat.graphId);
+        if (!graph || seat.status === 'failed') return null;
+        let inputs = seat.inputs;
+        if (seat.after?.length) {
+          debug.log('exec-requests', 'waiting-on', { id, seat: seat.seat, after: seat.after });
+          const earlier = await Promise.all(seat.after.map(j => states[j] ?? Promise.resolve(null)));
+          const now = this.store.get(id)!;
+          const missing = seat.after.filter((j, k) => !earlier[k] || now.seats[j]?.status === 'failed');
+          if (missing.length) {
+            now.seats[index]!.status = 'failed';
+            now.seats[index]!.reason = `${seat.seat}: 앞 자리(${missing.map(j => now.seats[j]?.seat ?? j).join(', ')}) 결과가 없어 진행하지 않았습니다`;
+            debug.log('exec-requests', 'seat-status', { id, seat: seat.seat, to: 'failed', reason: 'dependency-failed' });
+            aggregate(now); this.store.save(now);
+            return null;
+          }
+          inputs = withPriorResults(seat.inputs, seat.after.map((j, k) => ({ seat: now.seats[j]!, state: earlier[k]! })));
+        }
+        const starting = this.store.get(id)!;
+        starting.seats[index]!.status = 'running';
+        this.store.save(starting);
+        debug.log('exec-requests', 'started', { id, seat: seat.seat, graphId: seat.graphId, runId: seat.runId, ...(seat.after?.length ? { after: seat.after } : {}) });
+        debug.log('exec-requests', 'seat-status', { id, seat: seat.seat, from: 'waiting', to: 'running' });
+        try {
+          const state = await (this.deps.run ?? runGraph)(graph.path, { input: inputs, runId: seat.runId, deps: { root: this.root } });
+          const current = this.store.get(id)!;
+          syncRun(current, current.seats[index]!, state, this.root);
+          aggregate(current);
+          this.store.save(current);
+          return current.seats[index]!.status === 'failed' ? null : state;
+        } catch (error) {
+          const current = this.store.get(id)!;
+          current.seats[index]!.status = 'failed';
+          current.seats[index]!.reason = error instanceof Error ? error.message : String(error);
+          debug.log('exec-requests', 'seat-status', { id, seat: seat.seat, to: 'failed', reason: current.seats[index]!.reason });
+          aggregate(current);
+          this.store.save(current);
+          return null;
+        }
+      })();
+    });
+    await Promise.all(states);
     const finished = this.store.get(id)!;
     aggregate(finished);
     this.store.save(finished);

package/src/exec-requests/store.ts

@@ -12,6 +12,8 @@ export interface ExecSeat {
   runId: string;
   inputs?: Record<string, unknown>;
   reason?: string;
+  /** A5b — indexes of earlier seats this seat waits for. */
+  after?: number[];
 }
 export interface ExecResult {
   seat: string;

package/src/field/field-feed-auto.ts

@@ -0,0 +1,48 @@
+// EV10e — 현장 영상 렌더가 끝나면 같은 폴더로 인스타 피드 초안 런(graphs/field/field-feed.yaml)을 떼어 띄운다.
+// 사람 손 없이 «사진 한 번 → 영상 ⊕ 피드 초안이 게시 대기에». 승인 전엔 아무것도 밖으로 안 나간다(그래프의 post 노드).
+// 이미 «아직 안 끝난» 초안이 있으면 띄우지 않는다 — 같은 폴더에 게시 대기 카드가 둘 생기지 않게.
+import { spawn as nodeSpawn } from 'node:child_process';
+import { existsSync, mkdirSync, openSync, readFileSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { debug } from '../debug/log.js';
+
+export interface FieldFeedStart { started: boolean; reason?: 'disabled' | 'pending-draft' | 'no-script' | 'spawn-failed'; pid?: number }
+
+export interface FieldFeedAutoDeps {
+  spawn?: typeof nodeSpawn;
+  /** 기본 = 이 파일 기준 `scripts/field-feed/start.ts`(설치본·작업 트리 둘 다 같은 상대 위치). */
+  script?: string;
+  /** 기본 = 지금 런타임(bun). */
+  runtime?: string;
+}
+
+/** 초안이 있고 아직 deliver 되지 않았으면(게시 대기 · 사람이 고치는 중) 새 런을 띄우지 않는다. */
+export function hasPendingFeedDraft(dir: string): boolean {
+  const path = join(dir, 'feed', 'feed-draft.json');
+  if (!existsSync(path)) return false;
+  try { return !(JSON.parse(readFileSync(path, 'utf8')) as { delivered?: unknown }).delivered; }
+  catch { return true; } // 못 읽으면 «있다»로 — 덮어쓰지 않는 쪽
+}
+
+export function startFieldFeed(dir: string, opts: { enabled?: boolean } = {}, deps: FieldFeedAutoDeps = {}): FieldFeedStart {
+  const event = dir.split(/[\\/]/).at(-1)!;
+  const done = (r: FieldFeedStart): FieldFeedStart => {
+    debug.log('field.feed', r.started ? 'auto-start' : 'auto-skip', { event, ...(r.reason ? { reason: r.reason } : {}), ...(r.pid ? { pid: r.pid } : {}) });
+    return r;
+  };
+  // `bun test` 안에서는 명시적으로 켜지 않는 한 끈다 — 렌더 흐름 시험이 진짜 피드 런(그래프)을 띄우지 않게.
+  const testRun = process.env.NODE_ENV === 'test' && opts.enabled !== true;
+  if (opts.enabled === false || testRun || process.env.ELANOUS_FIELD_FEED_AUTO === '0') return done({ started: false, reason: 'disabled' });
+  if (hasPendingFeedDraft(dir)) return done({ started: false, reason: 'pending-draft' });
+  const script = deps.script ?? resolve(import.meta.dir, '../../scripts/field-feed/start.ts');
+  if (!existsSync(script)) return done({ started: false, reason: 'no-script' });
+  try {
+    mkdirSync(join(dir, 'feed'), { recursive: true });
+    const log = openSync(join(dir, 'feed', 'auto.log'), 'a');
+    const child = (deps.spawn ?? nodeSpawn)(deps.runtime ?? process.execPath, [script, dir], { detached: true, stdio: ['ignore', log, log] });
+    child.unref();
+    return done({ started: true, ...(child.pid ? { pid: child.pid } : {}) });
+  } catch {
+    return done({ started: false, reason: 'spawn-failed' });
+  }
+}

package/src/field/field-reel.ts

@@ -5,8 +5,9 @@ import { randomUUID } from 'node:crypto';
 import { spawn, execFileSync } from 'node:child_process';
 import { debug } from '../debug/log.js';
 import { listFieldMedia } from './field-media.js';
+import { startFieldFeed, type FieldFeedStart } from './field-feed-auto.js';
 
-export interface FieldReelResult { ok: boolean; file?: string; seconds: number; error?: string }
+export interface FieldReelResult { ok: boolean; file?: string; seconds: number; error?: string; feed?: FieldFeedStart }
 export type FieldReelRunner = (dir: string, opts: { title: string; sub: string }) => Promise<FieldReelResult>;
 export interface FieldReelStatus {
   state: 'waiting' | 'rendering' | 'done' | 'failed';
@@ -26,6 +27,10 @@ export interface FieldReelOptions {
   onDone?: (result: FieldReelResult) => void | Promise<void>;
   /** 같은 수신자가 앨범 항목마다 예약해도 한 렌더당 한 번만 통지한다. */
   notificationKey?: string;
+  /** EV10e — 렌더 성공 뒤 인스타 피드 초안 런을 띄운다(기본 켬 · `false` 나 `ELANOUS_FIELD_FEED_AUTO=0` 이면 끔). */
+  autoFeed?: boolean;
+  /** 시험용 — 피드 시작을 바꿔 끼운다. */
+  startFeed?: (dir: string) => FieldFeedStart;
 }
 
 const REEL_FILE = 'reel-9x16.mp4';
@@ -160,6 +165,8 @@ async function render(dir: string, job: Job): Promise<void> {
       if (t.vision) debug.log('field.reel', 'vision', { event, ...t.vision, music: t.music === true });
     } catch { debug.log('field.reel', 'vision-unread', { event }); }
   }
+  // 뒤이은 업로드로 다시 렌더할 예정이면(dirty) 피드는 그 마지막 렌더 뒤에 한 번만 띄운다.
+  if (result.ok && !job.dirty) result = { ...result, feed: (renderOpts.startFeed ?? ((d: string) => startFieldFeed(d, { enabled: renderOpts.autoFeed })))(dir) };
   job.running = false;
   if (job.dirty) {
     writeStatus(dir, { state: 'waiting', items: listFieldMedia(dir).length });

package/src/hooks/error-report.ts

@@ -0,0 +1,210 @@
+// Error reports from users' devices (ER2 · contract v1, channel 10-01 22:16). The public bot VM receives them on
+// `POST /v1/reports`, checks size, rate and schema, queues them on disk and forwards them over the tailnet to the
+// Primary, which stores them for 30 days and alerts the operator. No S3 credentials live on the VM.
+import { createHash, randomBytes } from 'node:crypto';
+import { closeSync, fsyncSync, mkdirSync, openSync, readFileSync, readdirSync, renameSync, rmSync, writeSync } from 'node:fs';
+import { join } from 'node:path';
+
+export const REPORT_MAX_BYTES = 64 * 1024;
+/** Queue bounds while the Primary is unreachable: oldest reports beyond these are dropped (logged). */
+export const REPORT_QUEUE_MAX = 5000;
+export const REPORT_QUEUE_MAX_AGE_MS = 7 * 24 * 3600_000;
+
+const SURFACES = ['tui', 'pwa', 'cli', 'daemon'] as const;
+export interface ErrorReport {
+  kind: 'error-report';
+  v: 1;
+  code: string;
+  message: string;
+  stack?: string;
+  app: { version: string; sha: string; surface: (typeof SURFACES)[number]; os: string; arch: string };
+  nexus: { alive: boolean; version?: string; instance?: string };
+  who: { installId: string; email?: string; telegramUser?: string };
+  at: string;
+  consent: true;
+}
+/** What the VM forwards: the report plus what the receiver derived. */
+export interface ReceivedReport { reportId: string; dedupe: string; receivedAt: string; report: ErrorReport }
+
+const str = (v: unknown, max: number): string | undefined => (typeof v === 'string' && v.length > 0 && v.length <= max ? v : undefined);
+const obj = (v: unknown): Record<string, unknown> | undefined => (v && typeof v === 'object' && !Array.isArray(v) ? v as Record<string, unknown> : undefined);
+
+/** Strict schema: unknown fields are dropped, a bad required field names itself. */
+export function validateErrorReport(body: unknown): { ok: true; report: ErrorReport } | { ok: false; field: string } {
+  const b = obj(body);
+  if (!b) return { ok: false, field: 'body' };
+  if (b.kind !== 'error-report') return { ok: false, field: 'kind' };
+  if (b.v !== 1) return { ok: false, field: 'v' };
+  if (b.consent !== true) return { ok: false, field: 'consent' };
+  const code = typeof b.code === 'string' && /^[a-z0-9-]{1,64}$/.test(b.code) ? b.code : undefined;
+  if (!code) return { ok: false, field: 'code' };
+  const message = str(b.message, 2000);
+  if (!message) return { ok: false, field: 'message' };
+  if (b.stack !== undefined && !str(b.stack, 8000)) return { ok: false, field: 'stack' };
+  const app = obj(b.app);
+  const version = str(app?.version, 64);
+  const sha = str(app?.sha, 64);
+  const surface = SURFACES.find((s) => s === app?.surface);
+  const os = str(app?.os, 64);
+  const arch = str(app?.arch, 32);
+  if (!version || !sha || !surface || !os || !arch) return { ok: false, field: 'app' };
+  const nexus = obj(b.nexus);
+  if (!nexus || typeof nexus.alive !== 'boolean') return { ok: false, field: 'nexus' };
+  const who = obj(b.who);
+  const installId = typeof who?.installId === 'string' && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(who.installId) ? who.installId : undefined;
+  if (!installId) return { ok: false, field: 'who.installId' };
+  const at = typeof b.at === 'string' && Number.isFinite(Date.parse(b.at)) ? b.at : undefined;
+  if (!at) return { ok: false, field: 'at' };
+  // nexus.instance is accepted only as a hash — a raw instance name can carry a host name.
+  const instance = typeof nexus.instance === 'string' && /^[0-9a-f]{12,64}$/.test(nexus.instance) ? nexus.instance : undefined;
+  const email = str(who?.email, 254);
+  const telegramUser = str(who?.telegramUser, 64);
+  return {
+    ok: true,
+    report: {
+      kind: 'error-report', v: 1, code, message, ...(typeof b.stack === 'string' ? { stack: b.stack } : {}),
+      app: { version, sha, surface, os, arch },
+      nexus: { alive: nexus.alive, ...(str(nexus.version, 64) ? { version: nexus.version as string } : {}), ...(instance ? { instance } : {}) },
+      who: { installId, ...(email ? { email } : {}), ...(telegramUser ? { telegramUser } : {}) },
+      at, consent: true,
+    },
+  };
+}
+
+/** Same error = same code and same first stack frame. Computed by the receiver, never sent by the device. */
+export function reportDedupe(report: Pick<ErrorReport, 'code' | 'stack'>): string {
+  const frame = (report.stack ?? '').split('\n').map((l) => l.trim()).find((l) => l.length > 0 && l !== report.code) ?? '';
+  return createHash('sha256').update(`${report.code}\n${frame}`).digest('hex').slice(0, 12);
+}
+
+const B32 = '0123456789abcdefghjkmnpqrstvwxyz';
+/** `er_` + 26 chars: 10 time chars then 16 random — sortable by receipt time. */
+export function newReportId(now: number = Date.now()): string {
+  let t = '';
+  let n = now;
+  for (let i = 0; i < 10; i++) { t = B32[n % 32]! + t; n = Math.floor(n / 32); }
+  const r = [...randomBytes(16)].map((x) => B32[x % 32]).join('');
+  return `er_${t}${r}`;
+}
+
+/** In-memory sliding windows: per install 5/min and 20/day, per IP 60/hour; same (install, dedupe) stored once an hour. */
+export class ReportLimiter {
+  private readonly hits = new Map<string, number[]>();
+  private readonly stored = new Map<string, number>();
+  private readonly seen = new Map<string, number[]>();
+  constructor(private readonly now: () => number = Date.now) {}
+
+  private take(key: string, windowMs: number, max: number): number | null {
+    const t = this.now();
+    const list = (this.hits.get(key) ?? []).filter((x) => t - x < windowMs);
+    if (list.length >= max) { this.hits.set(key, list); return Math.ceil((windowMs - (t - list[0]!)) / 1000); }
+    list.push(t);
+    this.hits.set(key, list);
+    return null;
+  }
+
+  /** Returns seconds to wait when limited, otherwise null (and records the hit). */
+  admit(installId: string, ip: string): number | null {
+    return this.take(`ip:${ip}`, 3600_000, 60)
+      ?? this.take(`im:${installId}`, 60_000, 5)
+      ?? this.take(`id:${installId}`, 24 * 3600_000, 20);
+  }
+
+  /** Counts this occurrence; true when it should be stored (first of this install+dedupe within an hour). */
+  occurrence(installId: string, dedupe: string): { store: boolean; count24h: number } {
+    const t = this.now();
+    const list = (this.seen.get(dedupe) ?? []).filter((x) => t - x < 24 * 3600_000);
+    list.push(t);
+    this.seen.set(dedupe, list);
+    const key = `${installId}:${dedupe}`;
+    const last = this.stored.get(key);
+    const store = last === undefined || t - last >= 3600_000;
+    if (store) this.stored.set(key, t);
+    return { store, count24h: list.length };
+  }
+}
+
+/** On-disk queue on the VM: one file per report, atomic writes, bounded by count and age. */
+export class ReportQueue {
+  readonly directory: string;
+  constructor(root: string, private readonly log: (event: string, data: Record<string, unknown>) => void = () => {}) {
+    this.directory = join(root, 'hooks', 'reports');
+    mkdirSync(this.directory, { recursive: true, mode: 0o700 });
+  }
+  private path(reportId: string): string { return join(this.directory, `${reportId}.json`); }
+  enqueue(item: ReceivedReport): void {
+    const path = this.path(item.reportId);
+    const temp = `${path}.${randomBytes(6).toString('hex')}.tmp`;
+    try {
+      const fd = openSync(temp, 'wx', 0o600);
+      try { writeSync(fd, JSON.stringify(item)); fsyncSync(fd); } finally { closeSync(fd); }
+      renameSync(temp, path);
+    } finally { rmSync(temp, { force: true }); }
+  }
+  /** Oldest first; drops entries past the age or count bound (logged, never silent). */
+  entries(now: number = Date.now()): ReceivedReport[] {
+    const names = readdirSync(this.directory).filter((n) => /^er_[0-9a-z]{26}\.json$/.test(n)).sort();
+    const kept: ReceivedReport[] = [];
+    let expired = 0;
+    for (const name of names) {
+      const full = join(this.directory, name);
+      try {
+        const item = JSON.parse(readFileSync(full, 'utf8')) as ReceivedReport;
+        if (now - Date.parse(item.receivedAt) > REPORT_QUEUE_MAX_AGE_MS) { rmSync(full, { force: true }); expired++; continue; }
+        kept.push(item);
+      } catch { rmSync(full, { force: true }); }
+    }
+    const overflow = kept.length - REPORT_QUEUE_MAX;
+    if (overflow > 0) for (const item of kept.splice(0, overflow)) rmSync(this.path(item.reportId), { force: true });
+    if (expired || overflow > 0) this.log('dropped', { expired, overflow: Math.max(0, overflow) });
+    return kept;
+  }
+  count(): number { return readdirSync(this.directory).filter((n) => /^er_[0-9a-z]{26}\.json$/.test(n)).length; }
+  delivered(reportId: string): void { rmSync(this.path(reportId), { force: true }); }
+}
+
+/** Handles `POST /v1/reports` on the VM. Pure enough to test without a server. */
+export async function handleReportPost(request: Request, deps: {
+  limiter: ReportLimiter; queue: ReportQueue; now?: () => number; ip?: string;
+  log?: (event: string, data: Record<string, unknown>) => void; wake?: () => void;
+}): Promise<Response> {
+  const now = deps.now ?? Date.now;
+  const log = deps.log ?? (() => {});
+  const declared = Number(request.headers.get('content-length') ?? '0');
+  if (declared > REPORT_MAX_BYTES) { log('rejected', { reason: 'too-large' }); return Response.json({ error: 'too-large' }, { status: 413 }); }
+  const raw = await request.arrayBuffer();
+  if (raw.byteLength > REPORT_MAX_BYTES) { log('rejected', { reason: 'too-large' }); return Response.json({ error: 'too-large' }, { status: 413 }); }
+  let body: unknown;
+  try { body = JSON.parse(new TextDecoder().decode(raw)); } catch { return Response.json({ error: 'invalid', field: 'body' }, { status: 400 }); }
+  const checked = validateErrorReport(body);
+  if (!checked.ok) { log('rejected', { reason: 'invalid', field: checked.field }); return Response.json({ error: 'invalid', field: checked.field }, { status: 400 }); }
+  const report = checked.report;
+  const ip = deps.ip ?? request.headers.get('x-forwarded-for')?.split(',')[0]?.trim() ?? 'unknown';
+  const wait = deps.limiter.admit(report.who.installId, ip);
+  if (wait !== null) {
+    log('rejected', { reason: 'rate-limited' });
+    return Response.json({ error: 'rate-limited', retryAfterSec: wait }, { status: 429, headers: { 'Retry-After': String(wait) } });
+  }
+  const dedupe = reportDedupe(report);
+  const reportId = newReportId(now());
+  const { store, count24h } = deps.limiter.occurrence(report.who.installId, dedupe);
+  if (store) {
+    deps.queue.enqueue({ reportId, dedupe, receivedAt: new Date(now()).toISOString(), report });
+    deps.wake?.();
+  }
+  log('accepted', { code: report.code, surface: report.app.surface, stored: store, count24h });
+  return Response.json({ reportId, dedupe, count: count24h }, { status: 202 });
+}
+
+/** Forward queued reports to the Primary; delivered ones leave the queue, failures wait for the next drain. */
+export async function drainReports(queue: ReportQueue, forward: (item: ReceivedReport) => Promise<boolean>, now: number = Date.now()): Promise<{ delivered: number; failed: number }> {
+  let delivered = 0;
+  let failed = 0;
+  for (const item of queue.entries(now)) {
+    let ok = false;
+    try { ok = await forward(item); } catch { ok = false; }
+    if (ok) { queue.delivered(item.reportId); delivered++; } else { failed++; break; }
+  }
+  return { delivered, failed };
+}
+

package/src/hooks/receiver.ts

@@ -4,6 +4,8 @@ import { userConfigPath } from '../user-config.js';
 import { getSecretAsync } from '../nexus/config/secrets/index.js';
 import { HookQueue, type QueuedHook } from './queue.js';
 import { toExternalTask, verifyWebhook, type HookProvider } from './providers.js';
+import { drainReports, handleReportPost, ReportLimiter, ReportQueue, type ReceivedReport } from './error-report.js';
+import { effectiveInstanceRoot } from '../instance/resolve.js';
 
 export interface HookSecrets {
   linear?: string;
@@ -18,6 +20,8 @@ export interface HookReceiverOptions {
   now?: () => number;
   root?: string;
   retryBaseMs?: number;
+  /** ER2 — forward one queued error report to the Primary; default = POST /v1/reports/ingest over the tailnet. */
+  forwardReport?: (item: ReceivedReport) => Promise<boolean>;
 }
 
 /** `/v1/tasks` lives on the Primary's nexus API, not on the control plane — so the address is its own setting. */
@@ -42,8 +46,40 @@ async function forwardToPrimary(event: QueuedHook): Promise<Response> {
   });
 }
 
+async function forwardReportToPrimary(item: ReceivedReport): Promise<boolean> {
+  const config = JSON.parse(readFileSync(userConfigPath(), 'utf8')) as { hooks?: { primaryTokenRef?: string; primaryUrl?: unknown } };
+  const ref = config.hooks?.primaryTokenRef;
+  if (!ref) throw new Error('primary token reference missing');
+  const token = await getSecretAsync(ref);
+  if (!token) throw new Error('primary token missing');
+  const response = await fetch(new URL('/v1/reports/ingest', hooksPrimaryUrl(config)), {
+    method: 'POST', headers: { 'content-type': 'application/json', authorization: `Bearer ${token}` },
+    body: JSON.stringify(item), signal: AbortSignal.timeout(10_000),
+  });
+  return response.ok;
+}
+
 export function startHookReceiver(options: HookReceiverOptions): { url: string; stop: () => void; queue: HookQueue } {
   const queue = new HookQueue(options.root);
+  const reportQueue = new ReportQueue(options.root ?? effectiveInstanceRoot(), (event, data) => debug.log('hooks.reports', event, data));
+  const reportLimiter = new ReportLimiter(options.now ?? Date.now);
+  const forwardReport = options.forwardReport ?? forwardReportToPrimary;
+  let reportFailures = 0;
+  let reportNextAt = 0;
+  let reportsDraining = false;
+  async function drainReportQueue(): Promise<void> {
+    if (stopped || reportsDraining || Date.now() < reportNextAt) return;
+    reportsDraining = true;
+    try {
+      const result = await drainReports(reportQueue, forwardReport, (options.now ?? Date.now)());
+      if (result.delivered) debug.log('hooks.reports', 'forwarded', { delivered: result.delivered });
+      if (result.failed) {
+        reportFailures++;
+        reportNextAt = Date.now() + Math.min(300_000, Math.max(1, options.retryBaseMs ?? 1000) * 2 ** Math.min(reportFailures - 1, 20));
+        debug.log('hooks.reports', 'forward-failed', { queued: reportQueue.count(), failures: reportFailures });
+      } else reportFailures = 0;
+    } finally { reportsDraining = false; }
+  }
   const now = options.now ?? Date.now;
   const forward = options.forward ?? forwardToPrimary;
   const attempts = new Map<string, { next: number; failures: number }>();
@@ -75,6 +111,7 @@ export function startHookReceiver(options: HookReceiverOptions): { url: string;
         })();
       }
     } finally {
+      void drainReportQueue();
       draining = false;
       if (!stopped) timer = setTimeout(() => { void drain(); }, Math.min(1000, options.retryBaseMs ?? 1000));
     }
@@ -83,7 +120,10 @@ export function startHookReceiver(options: HookReceiverOptions): { url: string;
     async fetch(request) {
       const url = new URL(request.url);
       if (request.method === 'GET' && url.pathname === '/hooks/health')
-        return Response.json({ ok: true, queued: queue.count() });
+        return Response.json({ ok: true, queued: queue.count(), reportsQueued: reportQueue.count() });
+      if (request.method === 'POST' && url.pathname === '/v1/reports')
+        return handleReportPost(request, { limiter: reportLimiter, queue: reportQueue, ...(options.now ? { now: options.now } : {}),
+          log: (event, data) => debug.log('hooks.reports', event, data), wake: () => { reportNextAt = 0; void drainReportQueue(); } });
       if (request.method !== 'POST' || !/^\/hooks\/(linear|asana)$/.test(url.pathname)) return new Response('Not Found', { status: 404 });
       const provider = url.pathname.slice('/hooks/'.length) as HookProvider;
       const reject = (reason: string) => {