elanous 0.2.7 → 0.2.9

package/src/auth/setup-link-tokens.ts

@@ -0,0 +1,153 @@
+import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
+import { closeSync, constants, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { dlopen, FFIType } from 'bun:ffi';
+import { getElanousConfigDir } from '../elanous-config-dir.js';
+
+export const SETUP_LINK_TTL_MS = 10 * 60_000;
+const SETUP_BEARER_TTL_MS = 24 * 60 * 60_000;
+const LINK_PREFIX = 'els_';
+const BEARER_PREFIX = 'elsb_';
+const HASH_PATTERN = /^[a-f0-9]{64}$/;
+const LINK_PATTERN = /^els_[A-Za-z0-9_-]{43}$/;
+const BEARER_PATTERN = /^elsb_[A-Za-z0-9_-]{43}$/;
+
+interface SetupLinkEntry {
+  hash: string;
+  expiresAt: string;
+  usedAt?: string;
+  bearerHash?: string;
+  bearerExpiresAt?: string;
+}
+
+type ClaimResult =
+  | { ok: true; bearer: string; expiresAt: string }
+  | { ok: false; reason: 'unknown' | 'used' | 'expired' };
+
+function storePath(dir: string): string { return join(dir, 'setup-link-tokens.json'); }
+function hashOf(token: string): string { return createHash('sha256').update(token).digest('hex'); }
+function mint(prefix: string): string { return `${prefix}${randomBytes(32).toString('base64url')}`; }
+
+function readStore(dir: string): SetupLinkEntry[] {
+  let raw: string;
+  try {
+    const path = storePath(dir);
+    const st = lstatSync(path);
+    if (!st.isFile() || (st.mode & 0o077) !== 0) throw new Error('setup link store must be a private regular file (0600)');
+    raw = readFileSync(path, 'utf8');
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return [];
+    throw error;
+  }
+  const parsed: unknown = JSON.parse(raw);
+  if (!parsed || typeof parsed !== 'object' || !('tokens' in parsed) || !Array.isArray(parsed.tokens)) {
+    throw new Error('setup link store is malformed');
+  }
+  const entries: unknown[] = parsed.tokens;
+  if (!entries.every((entry) => {
+    if (!entry || typeof entry !== 'object') return false;
+    const t = entry as Partial<SetupLinkEntry>;
+    return typeof t.hash === 'string' && HASH_PATTERN.test(t.hash)
+      && typeof t.expiresAt === 'string' && Number.isFinite(Date.parse(t.expiresAt))
+      && (t.usedAt === undefined || (typeof t.usedAt === 'string' && Number.isFinite(Date.parse(t.usedAt))))
+      && (t.bearerHash === undefined || (typeof t.bearerHash === 'string' && HASH_PATTERN.test(t.bearerHash)))
+      && (t.bearerExpiresAt === undefined || (typeof t.bearerExpiresAt === 'string' && Number.isFinite(Date.parse(t.bearerExpiresAt))))
+      && ((t.usedAt === undefined && t.bearerHash === undefined && t.bearerExpiresAt === undefined)
+        || (t.usedAt !== undefined && t.bearerHash !== undefined && t.bearerExpiresAt !== undefined));
+  })) throw new Error('setup link store is malformed');
+  return entries as SetupLinkEntry[];
+}
+
+function writeStore(dir: string, tokens: SetupLinkEntry[]): void {
+  mkdirSync(dir, { recursive: true, mode: 0o700 });
+  const path = storePath(dir);
+  const tmp = `${path}.${process.pid}.${randomBytes(4).toString('hex')}.tmp`;
+  try {
+    writeFileSync(tmp, JSON.stringify({ tokens }, null, 2), { flag: 'wx', mode: 0o600 });
+    renameSync(tmp, path);
+  } finally {
+    try { unlinkSync(tmp); } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error;
+    }
+  }
+}
+
+// A persistent inode and an OS advisory lock avoid stale owner files after an abrupt process exit.
+// Never unlink this file: a replacement inode would let two processes hold different locks.
+const libc = dlopen(process.platform === 'darwin' ? '/usr/lib/libSystem.B.dylib' : 'libc.so.6', {
+  flock: { args: [FFIType.i32, FFIType.i32], returns: FFIType.i32 },
+});
+const LOCK_EX = 2;
+const LOCK_NB = 4;
+const LOCK_UN = 8;
+
+function withLock<T>(dir: string, fn: () => T): T {
+  mkdirSync(dir, { recursive: true, mode: 0o700 });
+  const lock = `${storePath(dir)}.lock`;
+  const fd = openSync(lock, constants.O_CREAT | constants.O_RDWR | constants.O_NOFOLLOW, 0o600);
+  try {
+    const stat = fstatSync(fd);
+    const current = lstatSync(lock);
+    if (!stat.isFile() || (stat.mode & 0o077) !== 0 || stat.ino !== current.ino || stat.dev !== current.dev) {
+      throw new Error('setup link lock must be a private regular file (0600)');
+    }
+    const until = Date.now() + 3000;
+    while (libc.symbols.flock(fd, LOCK_EX | LOCK_NB) !== 0) {
+      if (Date.now() > until) throw new Error('setup link store is locked — try again');
+      Bun.sleepSync(20);
+    }
+    try {
+      const locked = lstatSync(lock);
+      if (stat.ino !== locked.ino || stat.dev !== locked.dev) throw new Error('setup link lock changed');
+      return fn();
+    } finally {
+      libc.symbols.flock(fd, LOCK_UN);
+    }
+  } finally {
+    closeSync(fd);
+  }
+}
+
+/** The plaintext link token is returned once; only its SHA-256 digest is persisted. */
+export function issueSetupLinkToken(opts: { dir?: string; now?: number } = {}): { token: string; expiresAt: string } {
+  const dir = opts.dir ?? getElanousConfigDir();
+  const now = opts.now ?? Date.now();
+  const token = mint(LINK_PREFIX);
+  const expiresAt = new Date(now + SETUP_LINK_TTL_MS).toISOString();
+  withLock(dir, () => writeStore(dir, [...readStore(dir), { hash: hashOf(token), expiresAt }]));
+  return { token, expiresAt };
+}
+
+/** Claim exactly once under the same lock used by issuance. Expired and used links retain their diagnostic status. */
+export function claimSetupLinkToken(token: string, opts: { dir?: string; now?: number } = {}): ClaimResult {
+  if (typeof token !== 'string' || !LINK_PATTERN.test(token)) return { ok: false, reason: 'unknown' };
+  const dir = opts.dir ?? getElanousConfigDir();
+  const now = opts.now ?? Date.now();
+  return withLock(dir, () => {
+    const entries = readStore(dir);
+    const digest = Buffer.from(hashOf(token), 'hex');
+    const hit = entries.find((entry) => timingSafeEqual(digest, Buffer.from(entry.hash, 'hex')));
+    if (!hit) return { ok: false, reason: 'unknown' };
+    if (hit.usedAt) return { ok: false, reason: 'used' };
+    if (Date.parse(hit.expiresAt) <= now) return { ok: false, reason: 'expired' };
+    const bearer = mint(BEARER_PREFIX);
+    const expiresAt = new Date(now + SETUP_BEARER_TTL_MS).toISOString();
+    hit.usedAt = new Date(now).toISOString();
+    hit.bearerHash = hashOf(bearer);
+    hit.bearerExpiresAt = expiresAt;
+    writeStore(dir, entries);
+    return { ok: true, bearer, expiresAt };
+  });
+}
+
+/** A setup bearer is not an owner or temp-owner token; validate it only on setup-allowed routes. */
+export function matchSetupBearer(bearer: string, opts: { dir?: string; now?: number } = {}): { expiresAt: string } | null {
+  if (typeof bearer !== 'string' || !BEARER_PATTERN.test(bearer)) return null;
+  let entries: SetupLinkEntry[];
+  try { entries = readStore(opts.dir ?? getElanousConfigDir()); } catch { return null; }
+  const digest = Buffer.from(hashOf(bearer), 'hex');
+  const now = opts.now ?? Date.now();
+  const hit = entries.find((entry) => entry.bearerHash && entry.bearerExpiresAt
+    && timingSafeEqual(digest, Buffer.from(entry.bearerHash, 'hex')) && Date.parse(entry.bearerExpiresAt) > now);
+  return hit?.bearerExpiresAt ? { expiresAt: hit.bearerExpiresAt } : null;
+}

package/src/budget/unified-usage.ts

@@ -18,6 +18,7 @@ import { listCodexAccountsInStore } from '../oauth/codex-account-store.js';
 import { loadTokens } from '../oauth/store.js';
 import { envLiteral } from '../platform/env-literal.js';
 import { describeResetCreditExpiry } from './codex-reset-credit-state.js';
+import { visibleWidth } from '../tui.js';
 import { listCodexResetCredits, type CodexResetCreditsResult } from './codex-reset-credits.js';
 import type {
   AccountUsageRow,
@@ -268,6 +269,80 @@ async function collectOpenRouterRows(deps: UnifiedUsageDeps): Promise<AccountUsa
   }
 }
 
+export function formatUsageCompact(report: UnifiedUsageReport, options: { width: number; nowMs: number }): string[] {
+  return report.rows.map((row) => {
+    const credits = row.credits;
+    const subscription = row.subscription;
+    const remaining = subscription.status === 'available' && Number.isFinite(subscription.remainingPercent)
+      ? subscription.remainingPercent
+      : credits.status === 'ok' && credits.usedPercent !== null && Number.isFinite(credits.usedPercent)
+        ? Math.round((100 - credits.usedPercent) * 10) / 10
+        : null;
+    const period = subscription.status === 'available'
+      ? subscription.windowKind
+      : credits.status === 'ok' ? credits.periodType : null;
+    const reset = subscription.status === 'available' ? subscription.resetsAt
+      : credits.status === 'ok' && credits.periodEnd ? Date.parse(credits.periodEnd) : Number.NaN;
+    const periodLabel = period ? `${formatCompactPeriod(period)} ` : '';
+    const when = period === 'prepaid-usd' ? '' : !isValidEpochMs(reset)
+      ? ` · ${periodLabel}시각 모름`
+      : reset <= options.nowMs
+        ? ` · ${periodLabel}재조회 필요`
+        : ` · ${periodLabel}${formatCompactReset(reset, options.nowMs)}에 다시 참`;
+    const balance = credits.status === 'ok' && credits.balance !== null && Number.isFinite(credits.balance)
+      ? ` · 크레딧 ${new Intl.NumberFormat('en-US', { maximumFractionDigits: credits.balance >= 1_000 ? 0 : 1 }).format(credits.balance)}` : '';
+    const prefix = `${row.provider} `;
+    const name = row.accountName.replace(/[\r\n\t\x00-\x1f\x7f]/g, ' ');
+    const remainingLabel = `남은 ${remaining === null ? '잔량 모름' : `${remaining}%`}`;
+    const width = Number.isFinite(options.width) ? Math.max(0, Math.floor(options.width)) : 120;
+    const suffix = ` · ${remainingLabel}${when}${balance}`;
+    const available = width - visibleWidth(prefix) - visibleWidth(suffix);
+    if (available >= 1) {
+      const account = visibleWidth(name) <= available ? name
+        : available === 1 ? '…' : `${compactSlice(name, available - 1)}…`;
+      return `${prefix}${account}${suffix}`;
+    }
+    // The fixed labels can exceed very narrow widths even with no account name.
+    // Keep the measured value when possible rather than slicing its digits.
+    const essential = `${row.provider} · ${remainingLabel}`;
+    if (visibleWidth(essential) <= width) return essential;
+    if (visibleWidth(remainingLabel) <= width) return remainingLabel;
+    const value = remaining === null ? '잔량 모름' : `${remaining}%`;
+    if (visibleWidth(value) <= width) return value;
+    return width > 0 ? '…' : '';
+  });
+}
+
+function formatCompactPeriod(value: string): string {
+  const period = value.replace(/^USAGE_PERIOD_TYPE_/, '').toLowerCase();
+  switch (period) {
+    case 'weekly': return '주간';
+    case 'monthly': return '월간';
+    case 'daily': return '일간';
+    default: return period;
+  }
+}
+
+function formatCompactReset(reset: number, nowMs: number): string {
+  const remaining = reset - nowMs;
+  if (remaining < 86_400_000) {
+    if (remaining < 3_600_000) return `${Math.ceil(remaining / 60_000)}분 뒤`;
+    return `${Math.ceil(remaining / 3_600_000)}시간 뒤`;
+  }
+  const date = new Date(reset);
+  const weekdays = ['일', '월', '화', '수', '목', '금', '토'];
+  return `${date.getMonth() + 1}/${date.getDate()} (${weekdays[date.getDay()]}) ${String(date.getHours()).padStart(2, '0')}:${String(date.getMinutes()).padStart(2, '0')}`;
+}
+
+function compactSlice(text: string, width: number): string {
+  let result = '';
+  for (const { segment } of new Intl.Segmenter(undefined, { granularity: 'grapheme' }).segment(text)) {
+    if (visibleWidth(result + segment) > width) break;
+    result += segment;
+  }
+  return result;
+}
+
 export function formatUnifiedUsage(report: UnifiedUsageReport): string {
   const lines: string[] = [
     'usage — 계정마다 한 행 · 크레딧 축과 구독 축은 각각 칸',

package/src/channel-bot-token.ts

@@ -1,35 +1,62 @@
 import { existsSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
 import { randomUUID } from 'node:crypto';
 import { debug } from './debug/log.js';
-import { getSecret, setSecretAsync } from './nexus/config/secrets/index.js';
-import { userConfigPath } from './nexus/config/paths.js';
+import { getSecret, setSecretAsync, currentBackendId } from './nexus/config/secrets/index.js';
+import { userConfigPath, secretsPath } from './nexus/config/paths.js';
 import { isSecretRef, makeSecretRef, secretIdFromRef } from './nexus/config/types.js';
 import { acquireLockAsync } from './storage/file-lock.js';
 import type { UserConfig } from './user-config.js';
 
 export type ChannelBotPlatform = 'telegram' | 'discord';
-export type ChannelBotTokenSource = 'tokenRef' | 'env' | 'plaintext';
+export type ChannelBotTokenSource = 'tokenRef' | 'env' | 'botToken' | 'channels.main';
+export type ChannelBotTokenResolution = { token: string; source: ChannelBotTokenSource; reason?: never }
+  | { token: ''; source?: never; reason: string };
 
 /** The tab reference is read from the same persistent config as the NEXUS switch. */
 export function resolveChannelBotToken(
   platform: ChannelBotPlatform,
   cfg: Pick<UserConfig, 'telegram' | 'discord'> & { tabs?: Record<string, { tokenRef?: unknown }> },
-): { token: string; source: ChannelBotTokenSource } | undefined {
+): ChannelBotTokenResolution {
+  let reason: string | undefined;
   const ref = cfg.tabs?.[`${platform}:1`]?.tokenRef;
   if (isSecretRef(ref)) {
     const id = secretIdFromRef(ref);
-    const token = id ? getSecret(id) : undefined;
-    if (token) return { token, source: 'tokenRef' };
+    if (id) {
+      const backend = currentBackendId();
+      if (backend !== 'file') {
+        reason = `backend ${backend} not sync-readable`;
+      } else {
+        const token = getSecret(id);
+        if (token) {
+          debug.log('channel-bot.token', 'resolved', { kind: platform, source: 'tokenRef' });
+          return { token, source: 'tokenRef' };
+        }
+        reason = `ref-id-missing ${id} in ${secretsPath()}`;
+      }
+    }
   }
   const envName = platform === 'telegram' ? 'ELANOUS_TELEGRAM_BOT_TOKEN' : 'ELANOUS_DISCORD_BOT_TOKEN';
   const envToken = process.env[envName];
-  if (envToken) return { token: envToken, source: 'env' };
+  if (envToken) {
+    debug.log('channel-bot.token', 'resolved', { kind: platform, source: 'env' });
+    return { token: envToken, source: 'env' };
+  }
   const token = cfg[platform]?.botToken;
   if (token) {
-    debug.log('channel-bot.token', 'plaintext-fallback', { platform });
-    return { token, source: 'plaintext' };
+    debug.log('channel-bot.token', 'resolved', { kind: platform, source: 'botToken' });
+    return { token, source: 'botToken' };
+  }
+  if (platform === 'telegram') {
+    const channels = cfg.telegram?.channels;
+    const channelToken = (channels?.find(c => c.name === 'main') ?? channels?.[0])?.botToken;
+    if (channelToken) {
+      debug.log('channel-bot.token', 'resolved', { kind: platform, source: 'channels.main' });
+      return { token: channelToken, source: 'channels.main' };
+    }
   }
-  return undefined;
+  reason ??= 'no-source';
+  debug.log('channel-bot.token', 'unresolved', { kind: platform, reason });
+  return { token: '', reason };
 }
 
 /** Publish the secret before its reference, under the config lock. Other config keys survive unchanged. */

package/src/channel-import/detect.ts

@@ -0,0 +1,191 @@
+// EN13 — 셋업이 «이미 쓰던» 텔레그램·디스코드 설정을 찾아 온다(대표 10-01).
+// 출처: OpenClaw(~/.openclaw/openclaw.json · tokenFile) · Hermes(~/.hermes/.env) · 이전 엘라누스(~/.monad/config.json).
+// ⛔ 토큰 값은 이 모듈 밖으로 «문자열»로 나가지 않는다 — `BotToken` 이 감싸고, 문자열화·JSON·inspect 는 전부 가린다.
+//    값이 필요한 곳(저장·연결 확인)만 `reveal()` 을 부른다. 미리보기는 «있음 · 끝 4자리 가림»만 낸다.
+import { createHash } from 'node:crypto';
+import { existsSync, lstatSync, readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+
+export type ImportPlatform = 'telegram' | 'discord';
+export type ImportSource = 'openclaw' | 'hermes' | 'elanous-legacy';
+
+const MASK = '있음 · 끝 4자리 가림';
+
+/** A bot token that never prints itself. */
+export class BotToken {
+  readonly #value: string;
+  constructor(value: string) { this.#value = value; }
+  reveal(): string { return this.#value; }
+  /** Same-token check without exposing either value. */
+  fingerprint(): string { return createHash('sha256').update(this.#value).digest('hex').slice(0, 8); }
+  toString(): string { return MASK; }
+  toJSON(): string { return MASK; }
+  [Symbol.for('nodejs.util.inspect.custom')](): string { return MASK; }
+}
+
+export interface ImportCandidate {
+  platform: ImportPlatform;
+  source: ImportSource;
+  /** `~`-relative file the value came from. */
+  file: string;
+  token: BotToken;
+  allowedUsers: string[];
+  /** Allowlist entries we could not use (not a numeric Telegram id, etc.). */
+  droppedUsers: number;
+}
+
+export const SOURCE_LABEL: Record<ImportSource, string> = {
+  openclaw: 'OpenClaw', hermes: 'Hermes', 'elanous-legacy': '이전 엘라누스(~/.monad)',
+};
+
+function tilde(path: string, home: string): string { return path.startsWith(home) ? `~${path.slice(home.length)}` : path; }
+function obj(value: unknown): Record<string, unknown> | null {
+  return value && typeof value === 'object' && !Array.isArray(value) ? value as Record<string, unknown> : null;
+}
+function text(value: unknown): string | null { return typeof value === 'string' && value.trim() ? value.trim() : null; }
+
+/** JSON with comments and trailing commas (openclaw.json is JSON5-ish). Strings are kept intact. */
+export function parseLooseJson(raw: string): unknown {
+  try { return JSON.parse(raw); } catch { /* fall through */ }
+  let out = '';
+  let inString = false;
+  for (let i = 0; i < raw.length; i++) {
+    const ch = raw[i]!;
+    if (inString) {
+      out += ch;
+      if (ch === '\\') { out += raw[++i] ?? ''; continue; }
+      if (ch === '"') inString = false;
+      continue;
+    }
+    if (ch === '"') { inString = true; out += ch; continue; }
+    if (ch === '/' && raw[i + 1] === '/') { while (i < raw.length && raw[i] !== '\n') i++; out += '\n'; continue; }
+    if (ch === '/' && raw[i + 1] === '*') { i += 2; while (i < raw.length && !(raw[i] === '*' && raw[i + 1] === '/')) i++; i++; continue; }
+    out += ch;
+  }
+  return JSON.parse(out.replace(/,(\s*[}\]])/g, '$1'));
+}
+
+/** `KEY=value` lines (quotes and `export ` allowed, `#` comments ignored). */
+export function parseDotEnv(raw: string): Record<string, string> {
+  const out: Record<string, string> = {};
+  for (const line of raw.split(/\r?\n/)) {
+    const m = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)\s*$/.exec(line);
+    if (!m) continue;
+    let value = m[2]!;
+    if ((value.startsWith('"') && value.endsWith('"')) || (value.startsWith("'") && value.endsWith("'"))) value = value.slice(1, -1);
+    else value = value.replace(/\s+#.*$/, '');
+    out[m[1]!] = value.trim();
+  }
+  return out;
+}
+
+/** Telegram allowlists must be numeric user ids; `telegram:123` / `tg:123` prefixes are accepted. */
+export function normalizeUsers(platform: ImportPlatform, raw: unknown): { users: string[]; dropped: number } {
+  const list = Array.isArray(raw) ? raw : typeof raw === 'string' ? raw.split(',') : [];
+  const users: string[] = [];
+  let dropped = 0;
+  for (const entry of list) {
+    const value = String(entry).trim().replace(/^(?:telegram|tg|discord|user):/i, '');
+    if (!value || value === '*') { if (value === '*') dropped++; continue; }
+    const ok = platform === 'telegram' ? /^\d+$/.test(value) && Number.isSafeInteger(Number(value)) && Number(value) > 0 : /^\d{5,}$/.test(value);
+    if (ok && !users.includes(value)) users.push(value); else if (!ok) dropped++;
+  }
+  return { users, dropped };
+}
+
+function readRegularFile(path: string): string | null {
+  try { return lstatSync(path).isFile() ? readFileSync(path, 'utf8').trim() || null : null; } catch { return null; }
+}
+
+function candidate(platform: ImportPlatform, source: ImportSource, file: string, token: string | null, users: unknown): ImportCandidate | null {
+  if (!token) return null;
+  const { users: allowedUsers, dropped } = normalizeUsers(platform, users);
+  return { platform, source, file, token: new BotToken(token), allowedUsers, droppedUsers: dropped };
+}
+
+function fromOpenClaw(home: string): ImportCandidate[] {
+  const path = join(home, '.openclaw', 'openclaw.json');
+  if (!existsSync(path)) return [];
+  const cfg = obj(parseLooseJson(readFileSync(path, 'utf8')));
+  const channels = obj(cfg?.channels);
+  const file = tilde(path, home);
+  const out: ImportCandidate[] = [];
+  const telegram = obj(channels?.telegram);
+  if (telegram) {
+    const firstAccount = obj(Object.values(obj(telegram.accounts) ?? {})[0]);
+    const token = text(telegram.botToken) ?? (text(telegram.tokenFile) ? readRegularFile(text(telegram.tokenFile)!.replace(/^~(?=\/)/, home)) : null)
+      ?? text(firstAccount?.botToken);
+    const c = candidate('telegram', 'openclaw', file, token, telegram.allowFrom ?? firstAccount?.allowFrom);
+    if (c) out.push(c);
+  }
+  const discord = obj(channels?.discord);
+  if (discord) {
+    const firstAccount = obj(Object.values(obj(discord.accounts) ?? {})[0]);
+    const c = candidate('discord', 'openclaw', file, text(discord.token) ?? text(firstAccount?.token), discord.allowFrom ?? obj(discord.dm)?.allowFrom);
+    if (c) out.push(c);
+  }
+  return out;
+}
+
+function fromHermes(home: string): ImportCandidate[] {
+  const path = join(home, '.hermes', '.env');
+  if (!existsSync(path)) return [];
+  const env = parseDotEnv(readFileSync(path, 'utf8'));
+  const file = tilde(path, home);
+  return [
+    candidate('telegram', 'hermes', file, text(env.TELEGRAM_BOT_TOKEN), env.TELEGRAM_ALLOWED_USERS),
+    candidate('discord', 'hermes', file, text(env.DISCORD_BOT_TOKEN), env.DISCORD_ALLOWED_USERS),
+  ].filter((c): c is ImportCandidate => c !== null);
+}
+
+function fromElanousLegacy(home: string): ImportCandidate[] {
+  const path = join(home, '.monad', 'config.json');
+  if (!existsSync(path)) return [];
+  const cfg = obj(parseLooseJson(readFileSync(path, 'utf8')));
+  const file = tilde(path, home);
+  return (['telegram', 'discord'] as const)
+    .map((platform) => candidate(platform, 'elanous-legacy', file, text(obj(cfg?.[platform])?.botToken), obj(cfg?.[platform])?.allowedUsers))
+    .filter((c): c is ImportCandidate => c !== null);
+}
+
+export interface DetectResult { candidates: ImportCandidate[]; unreadable: { file: string; reason: string }[] }
+
+/** Look in every known place; a broken file is reported by name (never by content) and the rest still count. */
+export function detectChannelImports(home = homedir()): DetectResult {
+  const candidates: ImportCandidate[] = [];
+  const unreadable: DetectResult['unreadable'] = [];
+  const readers: [string, (h: string) => ImportCandidate[]][] = [
+    [join(home, '.monad', 'config.json'), fromElanousLegacy],
+    [join(home, '.openclaw', 'openclaw.json'), fromOpenClaw],
+    [join(home, '.hermes', '.env'), fromHermes],
+  ];
+  for (const [path, read] of readers) {
+    try { candidates.push(...read(home)); }
+    catch (error) {
+      // JSON parse errors can quote the offending text — keep only the error class.
+      unreadable.push({ file: tilde(path, home), reason: error instanceof SyntaxError ? '형식을 읽지 못했습니다' : '읽지 못했습니다' });
+    }
+  }
+  return { candidates, unreadable };
+}
+
+/** One per platform: the first source in priority order; the rest are named as «다른 토큰도 있음». */
+export function pickPerPlatform(candidates: readonly ImportCandidate[]): { chosen: ImportCandidate[]; others: ImportCandidate[] } {
+  const chosen: ImportCandidate[] = [];
+  const others: ImportCandidate[] = [];
+  for (const c of candidates) {
+    const first = chosen.find((x) => x.platform === c.platform);
+    if (!first) chosen.push(c);
+    else if (first.token.fingerprint() !== c.token.fingerprint()) others.push(c);
+    else for (const user of c.allowedUsers) if (!first.allowedUsers.includes(user)) first.allowedUsers.push(user);
+  }
+  return { chosen, others };
+}
+
+export function previewLine(c: ImportCandidate): string {
+  const name = c.platform === 'telegram' ? '텔레그램' : '디스코드';
+  const users = c.allowedUsers.length ? `허용 사용자 ${c.allowedUsers.length}명` : '허용 사용자 없음(나중에 정해야 합니다)';
+  const dropped = c.droppedUsers ? ` · 쓸 수 없는 항목 ${c.droppedUsers}개 제외` : '';
+  return `${name} ← ${SOURCE_LABEL[c.source]} (${c.file}): 토큰 ${MASK} · ${users}${dropped}`;
+}

package/src/channel-import/run.ts

@@ -0,0 +1,111 @@
+// EN13 — 감지 → 미리보기 → 동의 → 시크릿 저장 → 연결 확인(읽기 1회). 토큰 값은 화면·로그·채널 어디에도 안 나간다.
+import { homedir } from 'node:os';
+import { debug } from '../debug/log.js';
+import { detectChannelImports, pickPerPlatform, previewLine, SOURCE_LABEL, type ImportCandidate, type ImportPlatform } from './detect.js';
+
+export interface ChannelImportDeps {
+  home?: string;
+  out?: { log: (s: string) => void; error: (s: string) => void };
+  /** Asks once; returns true for yes. Absent or non-interactive → no. */
+  ask?: (question: string) => Promise<boolean>;
+  yes?: boolean;
+  /** Current token for that platform (to say «already the same»), or null. */
+  currentToken?: (platform: ImportPlatform) => string | null | Promise<string | null>;
+  store?: (platform: ImportPlatform, token: string, allowedUsers: string[] | undefined) => Promise<void>;
+  probe?: (platform: ImportPlatform, token: string) => Promise<{ ok: boolean; botName?: string }>;
+}
+
+export interface ChannelImportOutcome {
+  exitCode: number;
+  imported: { platform: ImportPlatform; source: string; connected: boolean; botName?: string }[];
+}
+
+const NAME: Record<ImportPlatform, string> = { telegram: '텔레그램', discord: '디스코드' };
+
+async function defaultStore(platform: ImportPlatform, token: string, allowedUsers: string[] | undefined): Promise<void> {
+  const { storeChannelBotToken } = await import('../channel-bot-token.js');
+  await storeChannelBotToken(platform, token, allowedUsers);
+}
+
+async function defaultProbe(platform: ImportPlatform, token: string): Promise<{ ok: boolean; botName?: string }> {
+  const { probeChannelBotToken } = await import('../channel-bot-token.js');
+  return probeChannelBotToken(platform, token);
+}
+
+async function defaultCurrentToken(platform: ImportPlatform): Promise<string | null> {
+  try {
+    const { resolveChannelBotToken } = await import('../channel-bot-token.js');
+    const { getUserConfig } = await import('../user-config.js');
+    return resolveChannelBotToken(platform, getUserConfig())?.token ?? null;
+  } catch { return null; }
+}
+
+export async function runChannelImport(deps: ChannelImportDeps = {}): Promise<ChannelImportOutcome> {
+  const out = deps.out ?? console;
+  const home = deps.home ?? homedir();
+  const { candidates, unreadable } = detectChannelImports(home);
+  for (const u of unreadable) out.log(`· ${u.file}: ${u.reason} — 건너뜁니다`);
+  const { chosen, others } = pickPerPlatform(candidates);
+  debug.log('channel-import', 'detected', {
+    sources: candidates.map((c) => `${c.source}:${c.platform}`), chosen: chosen.length, others: others.length, unreadable: unreadable.length,
+  });
+  if (!chosen.length) {
+    out.log('가져올 텔레그램·디스코드 설정을 찾지 못했습니다(OpenClaw · Hermes · 이전 엘라누스). 직접 넣으려면: elanous nexus channel-bot setup telegram');
+    return { exitCode: 0, imported: [] };
+  }
+
+  const current = deps.currentToken ?? defaultCurrentToken;
+  const todo: ImportCandidate[] = [];
+  out.log('이미 쓰던 채널 설정을 찾았습니다:');
+  for (const c of chosen) {
+    const existing = await current(c.platform);
+    if (existing && existing === c.token.reveal()) { out.log(`· ${previewLine(c)} — 이미 같은 토큰을 쓰고 있습니다`); continue; }
+    out.log(`· ${previewLine(c)}${existing ? ' — ⚠️ 지금 쓰는 토큰을 바꿉니다' : ''}`);
+    todo.push(c);
+  }
+  for (const c of others) out.log(`  (${NAME[c.platform]} 토큰이 ${SOURCE_LABEL[c.source]}에도 있습니다 — 다른 토큰이라 위의 것만 가져옵니다)`);
+  if (!todo.length) return { exitCode: 0, imported: [] };
+
+  const question = `가져올까요? 토큰은 엘라누스 비밀 저장소에만 넣고 화면·로그에는 남기지 않습니다. [Y/n] `;
+  const agreed = deps.yes || (deps.ask ? await deps.ask(question) : false);
+  if (!agreed) {
+    out.log(deps.ask || deps.yes ? '가져오지 않았습니다.' : '가져오려면: elanous nexus channel-bot import --yes');
+    debug.log('channel-import', 'declined', { count: todo.length });
+    return { exitCode: 0, imported: [] };
+  }
+
+  const store = deps.store ?? defaultStore;
+  const probe = deps.probe ?? defaultProbe;
+  const imported: ChannelImportOutcome['imported'] = [];
+  let failed = 0;
+  for (const c of todo) {
+    try {
+      await store(c.platform, c.token.reveal(), c.allowedUsers.length ? c.allowedUsers : undefined);
+    } catch (error) {
+      failed++;
+      // Store errors are our own (lock, invalid ids) — print the class only, never the message, in case it carries input.
+      const reason = error instanceof Error && error.message === 'invalid-allowed-users' ? '허용 사용자 형식이 맞지 않습니다' : '저장하지 못했습니다';
+      out.error(`✗ ${NAME[c.platform]}: ${reason}`);
+      debug.log('channel-import', 'store-failed', { platform: c.platform, source: c.source }, { level: 'warn' });
+      continue;
+    }
+    const check = await probe(c.platform, c.token.reveal()).catch(() => ({ ok: false } as { ok: boolean; botName?: string }));
+    imported.push({ platform: c.platform, source: c.source, connected: check.ok, ...(check.botName ? { botName: check.botName } : {}) });
+    debug.log('channel-import', 'stored', { platform: c.platform, source: c.source, connected: check.ok });
+    out.log(check.ok
+      ? `✓ ${NAME[c.platform]}: 저장했고 연결을 확인했습니다 — @${check.botName}`
+      : `△ ${NAME[c.platform]}: 저장했지만 연결 확인에 실패했습니다 — 토큰이 만료됐거나 네트워크 문제일 수 있습니다(다시 넣기: elanous nexus channel-bot setup ${c.platform})`);
+  }
+  if (imported.length) out.log('봇은 다음 넥서스 시작 때 켜집니다.');
+  return { exitCode: failed ? 1 : 0, imported };
+}
+
+/** One line for onboarding — null when there is nothing to import. Never reveals a value. */
+export function channelImportHint(home = homedir()): string | null {
+  try {
+    const { chosen } = pickPerPlatform(detectChannelImports(home).candidates);
+    if (!chosen.length) return null;
+    const what = chosen.map((c) => `${NAME[c.platform]}(${SOURCE_LABEL[c.source]})`).join(' · ');
+    return `쓰던 채널 설정 찾음: ${what} — 가져오려면: elanous nexus channel-bot import`;
+  } catch { return null; }
+}