elanous 0.2.7 → 0.2.9

package/src/decisions/discord-decision-cards.ts

@@ -0,0 +1,133 @@
+// DEC-TG — 디스코드 운반(운영 봇 · 대표 DM). 판단은 decision-cards.ts. 버튼 = MESSAGE_COMPONENT · 메모 = 모달.
+import type { DiscordBot } from '../discord.js';
+import type { UserConfig } from '../user-config.js';
+import { debug } from '../debug/log.js';
+import { DECISION_DATA_PREFIX, DecisionCardService, ghPrReplier, type CardTransport, type CardView } from './decision-cards.js';
+
+const TICK_MS = 20_000;
+const MEMO_PREFIX = 'decmemo:';
+const EPHEMERAL = 64;
+let current: DecisionCardService | null = null;
+
+export function discordDecisionService(): DecisionCardService | null { return current; }
+
+export function discordDecisionOwner(cfg: UserConfig): string | null {
+  const raw = (cfg.raw?.decisions as { discordOwnerId?: unknown } | undefined)?.discordOwnerId;
+  if (typeof raw === 'string' && /^\d{5,}$/.test(raw)) {
+    debug.log('decisions.telegram', 'owner-source', { platform: 'discord', source: 'config' });
+    return raw;
+  }
+  debug.log('decisions.telegram', 'owner-source', { platform: 'discord', source: 'default-first', allowlist: cfg.discord.allowedUsers.length }, cfg.discord.allowedUsers.length > 1 ? { level: 'warn' } : undefined);
+  return cfg.discord.allowedUsers[0] ?? null;
+}
+
+/** `/decisions` typed in Discord — owner only, and only in a DM (a guild channel would show the cards to everyone). */
+export async function discordDecisionsCommand(service: DecisionCardService, ctx: { userId: string; channelId: string; isDm: boolean }): Promise<string> {
+  if (!service.isOwner(ctx.userId)) return '결정은 소유자만 볼 수 있습니다.';
+  if (!ctx.isDm) return '결정은 개인 대화(DM)에서만 볼 수 있습니다.';
+  return service.listOpen(ctx.channelId);
+}
+
+/** Card buttons → Discord action rows (choices primary · memo secondary · confirm success). */
+export function discordComponents(view: CardView): Array<Record<string, unknown>> {
+  return view.buttons.map((row) => ({
+    type: 1,
+    components: row.map((b) => ({
+      type: 2,
+      style: b.data.endsWith(':ok') ? 3 : b.data.endsWith(':memo') || b.data.endsWith(':-') ? 2 : 1,
+      label: Array.from(b.label).slice(0, 80).join(''),
+      custom_id: b.data.slice(0, 100),
+    })),
+  }));
+}
+
+type Bot = Pick<DiscordBot, 'openDmChannel' | 'sendMessageWithComponents' | 'editMessageWithComponents' | 'sendMessage' | 'respondToInteraction'>;
+
+export function discordTransport(bot: Bot, owner: string): CardTransport {
+  let dm: string | null = null;
+  return {
+    platform: 'discord',
+    ownerChats: async () => {
+      dm ??= await bot.openDmChannel(owner);
+      return dm ? [dm] : [];
+    },
+    send: async (chat, view) => {
+      const sent = await bot.sendMessageWithComponents(chat, view.text, discordComponents(view));
+      return sent ? { chat, message: sent.id } : null;
+    },
+    edit: async (ref, view) => { await bot.editMessageWithComponents(ref.chat, ref.message, view.text, discordComponents(view)); },
+    notify: async (chat, text) => { await bot.sendMessage(chat, text); },
+  };
+}
+
+function userOf(raw: Record<string, unknown>): string {
+  const member = raw.member as { user?: { id?: string } } | undefined;
+  const user = raw.user as { id?: string } | undefined;
+  return member?.user?.id ?? user?.id ?? '';
+}
+
+/** Handle a decision button or memo modal. Returns true when the interaction was ours (so nothing else answers it). */
+export async function handleDiscordDecisionInteraction(bot: Bot, service: DecisionCardService, raw: Record<string, unknown>): Promise<boolean> {
+  const data = raw.data as { custom_id?: string; components?: Array<{ components?: Array<{ value?: string }> }> } | undefined;
+  const customId = data?.custom_id ?? '';
+  const id = String(raw.id ?? '');
+  const token = String(raw.token ?? '');
+  const reply = (content: string) => bot.respondToInteraction(id, token, { type: 4, data: { content, flags: EPHEMERAL } });
+  if (raw.type === 5 && customId.startsWith(MEMO_PREFIX)) {
+    const value = data?.components?.[0]?.components?.[0]?.value ?? '';
+    const view = await service.setNote(userOf(raw), customId.slice(MEMO_PREFIX.length), value);
+    await reply(view ? '메모를 달았습니다 — 카드에서 선택지를 누르면 함께 기록됩니다.' : '메모를 달지 못했습니다(권한 또는 이미 정해진 결정).');
+    return true;
+  }
+  if (raw.type !== 3 || !customId.startsWith(DECISION_DATA_PREFIX)) return false;
+  const outcome = await service.tap(userOf(raw), customId);
+  switch (outcome.kind) {
+    case 'refused': await reply('권한이 없습니다.'); return true;
+    case 'ignored': case 'unknown': await reply('알 수 없는 결정입니다.'); return true;
+    case 'memo-requested': {
+      const decisionId = /^dec:([^:]+):memo$/.exec(customId)?.[1] ?? '';
+      await bot.respondToInteraction(id, token, { type: 9, data: {
+        custom_id: `${MEMO_PREFIX}${decisionId}`.slice(0, 100), title: Array.from(`메모 달기 · ${decisionId}`).slice(0, 45).join(''),
+        components: [{ type: 1, components: [{ type: 4, custom_id: 'note', style: 2, label: '메모', max_length: 300, required: true }] }],
+      } });
+      return true;
+    }
+    default:
+      // UPDATE_MESSAGE on the tapped card (decided: the service already edited every card it sent — same content).
+      await bot.respondToInteraction(id, token, { type: 7, data: { content: outcome.view.text, components: discordComponents(outcome.view) } });
+      return true;
+  }
+}
+
+export interface DiscordDecisionWire {
+  service: DecisionCardService;
+  onInteraction: (raw: Record<string, unknown>) => Promise<boolean>;
+  stop: () => void;
+}
+
+export function attachDiscordDecisionCards(bot: Bot, cfg: UserConfig, opts: { tickMs?: number } = {}): DiscordDecisionWire | null {
+  const owner = discordDecisionOwner(cfg);
+  if (!owner) {
+    debug.log('decisions.telegram', 'not-attached', { platform: 'discord', reason: 'no-owner' });
+    return null;
+  }
+  const replyTarget = (cfg.raw?.decisions as { replyGhPr?: unknown } | undefined)?.replyGhPr;
+  const service = new DecisionCardService({
+    transport: discordTransport(bot, owner),
+    ownerIds: [owner],
+    ...(typeof replyTarget === 'string' && replyTarget ? { replyToRaiser: ghPrReplier(replyTarget) } : {}),
+  });
+  current = service;
+  const timer = setInterval(() => {
+    void service.tick().catch((error: unknown) => {
+      debug.log('decisions.telegram', 'tick-failed', { platform: 'discord', reason: error instanceof Error ? error.message.slice(0, 80) : 'unknown' }, { level: 'warn' });
+    });
+  }, opts.tickMs ?? TICK_MS);
+  (timer as { unref?: () => void }).unref?.();
+  debug.log('decisions.telegram', 'attached', { platform: 'discord', reply: typeof replyTarget === 'string' && Boolean(replyTarget) });
+  return {
+    service,
+    onInteraction: (raw) => handleDiscordDecisionInteraction(bot, service, raw),
+    stop: () => { clearInterval(timer); if (current === service) current = null; },
+  };
+}

package/src/decisions/telegram-decision-cards.ts

@@ -0,0 +1,100 @@
+// DEC-TG — 텔레그램 운반(운영 봇 DM). 판단은 decision-cards.ts 에 있고 여기는 «보내고·고치고·누름을 넘긴다»만 한다.
+// ⛔ 카드는 «폴링하는» 본 봇만 보낸다(넥서스가 폴링 없는 봇을 따로 세울 수 있다 — 두 번 가면 안 된다).
+import type { TelegramBot, TgCallbackQuery } from '../telegram.js';
+import type { UserConfig } from '../user-config.js';
+import { debug } from '../debug/log.js';
+import { DECISION_DATA_PREFIX, DecisionCardService, ghPrReplier, type CardTransport, type CardView } from './decision-cards.js';
+
+const TICK_MS = 20_000;
+let current: DecisionCardService | null = null;
+
+/** The running Telegram card service (for the `/decisions` command), or null when none is attached. */
+export function telegramDecisionService(): DecisionCardService | null { return current; }
+
+function buttons(view: CardView): Array<Array<{ text: string; data: string }>> {
+  return view.buttons.map((row) => row.map((b) => ({ text: b.label, data: b.data })));
+}
+
+/** Owner = `decisions.telegramOwnerId` when set, else the first allowlisted user (the bot owner). */
+export function telegramDecisionOwner(cfg: UserConfig): string | null {
+  const raw = (cfg.raw?.decisions as { telegramOwnerId?: unknown } | undefined)?.telegramOwnerId;
+  if (typeof raw === 'number' || (typeof raw === 'string' && /^\d+$/.test(raw))) {
+    debug.log('decisions.telegram', 'owner-source', { platform: 'telegram', source: 'config' });
+    return String(raw);
+  }
+  const first = cfg.telegram.allowedUsers[0];
+  debug.log('decisions.telegram', 'owner-source', { platform: 'telegram', source: 'default-first', allowlist: cfg.telegram.allowedUsers.length }, cfg.telegram.allowedUsers.length > 1 ? { level: 'warn' } : undefined);
+  return typeof first === 'number' ? String(first) : null;
+}
+
+export function telegramTransport(bot: Pick<TelegramBot, 'sendInlineKeyboard' | 'editMessageWithKeyboard' | 'sendMessage'>, owner: string): CardTransport {
+  return {
+    platform: 'telegram',
+    ownerChats: async () => [owner],
+    send: async (chat, view) => {
+      const sent = await bot.sendInlineKeyboard(Number(chat), view.text, buttons(view));
+      return sent ? { chat, message: String(sent.messageId) } : null;
+    },
+    edit: async (ref, view) => { await bot.editMessageWithKeyboard(Number(ref.chat), Number(ref.message), view.text, buttons(view)); },
+    notify: async (chat, text) => { await bot.sendMessage(Number(chat), text); },
+  };
+}
+
+export interface AttachOptions { tickMs?: number; service?: DecisionCardService }
+
+/** Wire cards onto a bot: callback taps, memo capture, and a ticker that runs only while this bot polls. Returns a stop fn. */
+export function attachTelegramDecisionCards(bot: TelegramBot, cfg: UserConfig, opts: AttachOptions = {}): () => void {
+  const owner = telegramDecisionOwner(cfg);
+  if (!owner) {
+    debug.log('decisions.telegram', 'not-attached', { platform: 'telegram', reason: 'no-owner' });
+    return () => undefined;
+  }
+  const replyTarget = (cfg.raw?.decisions as { replyGhPr?: unknown } | undefined)?.replyGhPr;
+  const service = opts.service ?? new DecisionCardService({
+    transport: telegramTransport(bot, owner),
+    ownerIds: [owner],
+    ...(typeof replyTarget === 'string' && replyTarget ? { replyToRaiser: ghPrReplier(replyTarget) } : {}),
+  });
+  current = service;
+  const unsubscribe = bot.onCallbackQuery(async (q: TgCallbackQuery) => {
+    if (!q.data.startsWith(DECISION_DATA_PREFIX)) return;
+    const outcome = await service.tap(String(q.userId), q.data);
+    const where = q.chatId !== undefined && q.messageId !== undefined ? { chat: q.chatId, message: q.messageId } : null;
+    switch (outcome.kind) {
+      case 'refused': await bot.answerCallbackQuery(q.id, { text: '권한이 없습니다' }); return;
+      case 'ignored': case 'unknown': await bot.answerCallbackQuery(q.id, { text: '알 수 없는 결정입니다' }); return;
+      case 'memo-requested': {
+        // The next text in a GROUP could come from another allow-listed member — capture only in the owner's private chat.
+        if (q.chatId === undefined || q.chatId !== q.userId) {
+          debug.log('decisions.telegram', 'memo-refused', { platform: 'telegram', reason: 'not-private-chat' });
+          await bot.answerCallbackQuery(q.id, { text: '메모는 개인 대화에서만 달 수 있습니다' });
+          return;
+        }
+        await bot.answerCallbackQuery(q.id, { text: outcome.toast });
+        {
+          const id = /^dec:([^:]+):memo$/.exec(q.data)?.[1];
+          await bot.sendMessage(q.chatId, `📝 ${id} 메모를 한 줄로 보내 주세요(취소: /cancel).`);
+          bot.captureNextText(q.chatId, undefined, (text) => {
+            if (text && id) void service.setNote(String(q.userId), id, text).then((view) => {
+              if (view && q.chatId !== undefined) void bot.sendMessage(q.chatId, '메모를 달았습니다 — 카드에서 선택지를 누르면 함께 기록됩니다.');
+            });
+          });
+        }
+        return;
+      }
+      default:
+        await bot.answerCallbackQuery(q.id, { text: outcome.toast, ...(outcome.kind === 'confirm' ? { alert: true } : {}) });
+        // decided: the service already edited every card it sent; confirm/cancel/closed: edit the tapped one.
+        if (outcome.kind !== 'decided' && where) await bot.editMessageWithKeyboard(where.chat, where.message, outcome.view.text, buttons(outcome.view)).catch(() => undefined);
+    }
+  });
+  const timer = setInterval(() => {
+    if (!bot.isPolling()) return;
+    void service.tick().catch((error: unknown) => {
+      debug.log('decisions.telegram', 'tick-failed', { reason: error instanceof Error ? error.message.slice(0, 80) : 'unknown' }, { level: 'warn' });
+    });
+  }, opts.tickMs ?? TICK_MS);
+  (timer as { unref?: () => void }).unref?.();
+  debug.log('decisions.telegram', 'attached', { platform: 'telegram', reply: typeof replyTarget === 'string' && Boolean(replyTarget) });
+  return () => { clearInterval(timer); unsubscribe(); if (current === service) current = null; };
+}

package/src/directives/version-at.ts

@@ -0,0 +1,77 @@
+import { existsSync, readFileSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { elanousStateRoot } from '../autopilot/state-paths.js';
+import { spawnSync } from 'node:child_process';
+
+export interface Versions { released: string | null; dev: string | null; codename: string | null }
+export interface VersionOptions { releaseRoot?: string; repoRoot?: string; codenames?: Record<string, string> }
+
+/** SemVer order for release ledgers: numeric core, then a prerelease sorts before its release. */
+export function compareVersions(a: string, b: string): number {
+  const parse = (v: string) => { const [core, pre] = v.split('-', 2); return { nums: core!.split('.').map(n => Number(n) || 0), pre: pre ?? null }; };
+  const x = parse(a); const y = parse(b);
+  for (let i = 0; i < Math.max(x.nums.length, y.nums.length); i++) {
+    const d = (x.nums[i] ?? 0) - (y.nums[i] ?? 0);
+    if (d) return d;
+  }
+  if (x.pre === y.pre) return 0;
+  if (x.pre === null) return 1;
+  if (y.pre === null) return -1;
+  return x.pre.localeCompare(y.pre, undefined, { numeric: true });
+}
+
+export function createVersionResolver(opts: VersionOptions = {}): (ts: string) => Versions {
+  const releases: Array<{ at: number; version: string }> = [];
+  const root = opts.releaseRoot ?? join(elanousStateRoot(), 'release');
+  if (existsSync(root)) for (const dir of readdirSync(root, { withFileTypes: true })) {
+    if (!dir.isDirectory()) continue;
+    const path = join(root, dir.name, 'release.json');
+    if (!existsSync(path)) continue;
+    try {
+      const record = JSON.parse(readFileSync(path, 'utf8')) as Record<string, unknown>;
+      const stamp = record.publishedAt ?? record.published_at ?? record.releasedAt;
+      const at = Date.parse(String(stamp ?? ''));
+      if (typeof record.version === 'string' && Number.isFinite(at)) releases.push({ at, version: record.version });
+    } catch { /* a malformed ledger cannot supply a release boundary */ }
+  }
+  releases.sort((a, b) => a.at - b.at);
+  const repo = opts.repoRoot ?? process.cwd();
+  // A current-branch commit date is not proof of when that commit entered origin/main.
+  // Reflog updates are observed branch snapshots; before the first retained update the answer is unknown.
+  const reflog = spawnSync('git', ['reflog', 'show', '--date=unix', '--format=%H%x09%gd', 'refs/remotes/origin/main'], { cwd: repo, encoding: 'utf8', timeout: 10000 });
+  const snapshots: Array<{ at: number; commit: string; order: number }> = [];
+  if (reflog.status === 0) for (const line of reflog.stdout.split('\n')) {
+    const match = /^([0-9a-f]+)\torigin\/main@\{(\d+)\}$/.exec(line.trim());
+    // Reflog lists newest first; keep that order so two updates in the same second resolve to the later one.
+    if (match) snapshots.push({ at: Number(match[2]) * 1000, commit: match[1]!, order: snapshots.length });
+  }
+  snapshots.sort((a, b) => a.at - b.at || b.order - a.order);
+  const versions = new Map<string, string | null>();
+  for (const { commit } of snapshots) {
+    if (versions.has(commit)) continue;
+    const show = spawnSync('git', ['show', `${commit}:package.json`], { cwd: repo, encoding: 'utf8', timeout: 5000 });
+    let version: string | null = null;
+    if (show.status === 0) {
+      try {
+        const parsed = JSON.parse(show.stdout).version;
+        if (typeof parsed === 'string') version = parsed;
+      } catch { /* unreadable package at this snapshot */ }
+    }
+    versions.set(commit, version);
+  }
+  const cache = new Map<string, Versions>();
+  return ts => {
+    const existing = cache.get(ts);
+    if (existing) return existing;
+    const time = Date.parse(ts);
+    // The public version at a moment = the highest version published by then (a re-written old record must not win by date).
+    const released = Number.isFinite(time) ? releases.filter(x => x.at <= time).map(x => x.version).sort(compareVersions).at(-1) ?? null : null;
+    const snapshot = Number.isFinite(time) ? [...snapshots].reverse().find(x => x.at <= time) : undefined;
+    const dev = snapshot ? versions.get(snapshot.commit) ?? null : null;
+    const codenames = opts.codenames ?? {};
+    const codename = codenames[dev?.replace(/-.*/, '') ?? ''] ?? codenames[released ?? ''] ?? null;
+    const value = { released, dev, codename };
+    cache.set(ts, value);
+    return value;
+  };
+}

package/src/discord.ts

@@ -498,6 +498,23 @@ export class DiscordBot {
     return r?.id ? { id: r.id } : null;
   }
 
+  /** DEC-TG — edit a message's text AND components (an empty list removes the buttons). */
+  async editMessageWithComponents(
+    channelId: string,
+    messageId: string,
+    text: string,
+    components: ReadonlyArray<Record<string, unknown>>,
+  ): Promise<void> {
+    const content = text.length > this.maxChars ? text.slice(0, this.maxChars - 4) + ' …' : text;
+    await this.restCall('PATCH', `/channels/${channelId}/messages/${messageId}`, { content, components });
+  }
+
+  /** DEC-TG — the DM channel id with one user (Discord returns the existing one when it already exists). */
+  async openDmChannel(userId: string): Promise<string | null> {
+    const r = await this.restCall<{ id?: string }>('POST', '/users/@me/channels', { recipient_id: userId });
+    return r?.id ?? null;
+  }
+
   // ── Gateway: connect + run forever ──────────────────────────
 
   /** Connect to the Gateway, identify, and process events until

package/src/domains/outbound-alert.ts

@@ -18,6 +18,7 @@ import { resolveChannelBotToken } from '../channel-bot-token.js';
 import { kindRouteTarget } from './telegram-kind-route.js';
 import { debug } from '../debug/log.js';
 import { resolveDaemonEndpoint } from '../nexus/daemon-endpoint.js';
+import { effectiveInstanceRoot, prodInstanceRoot } from '../instance/resolve.js';
 // ★ origin 되돌림(대표 2026-07-12) — 미션 알림을 발신 채널(메인 Q&A 봇)로 되돌린다. type-only
 //   import 라 런타임 순환 없음(발송 로직은 이 파일에 self-contained). origin 없으면 report 폴백.
 import type { MissionOrigin } from '../autopilot/mission-origin.js';
@@ -317,9 +318,31 @@ function logDaemonPath(classification: DaemonPathClass, kind: string, extra: Rec
   try { console.error(`[outbound] daemon-path ${classification}`); } catch { /* fail-soft */ }
 }
 
+/** OB8 — the daemon registers its own in-process sender at startup. Inside the daemon, deliver() must never curl
+ *  its own `/v1/outbound`: the curl is synchronous, the event loop that would answer it is the one it blocks, and the
+ *  whole daemon freezes until the curl times out (~25 s · `unreachable`) — the message is lost (CS1 · 10-01). */
+export type InProcessOutbound = (text: string, kind: string) => Promise<boolean>;
+let inProcessOutbound: InProcessOutbound | null = null;
+export function setInProcessOutbound(send: InProcessOutbound | null): void { inProcessOutbound = send; }
+
 /** elanous `/v1/outbound` 우선 → 실패 시 텔레그램 직접. 성공 경로 반환(원장 중복방지용). */
 export function deliver(text: string, kind = 'alert'): 'daemon' | 'direct' | false {
+  // 0) inside the daemon — route in-process, asynchronously; the caller's synchronous answer is «accepted».
+  if (inProcessOutbound && process.env.SEND_VIA_ELANOUS !== '0') {
+    const send = inProcessOutbound;
+    void send(text, kind)
+      .then((ok) => {
+        logDaemonPath(ok ? 'ok' : 'rejected', kind, { inProcess: true });
+        if (!ok && sendTelegramDirect(text, kind)) recordOutbound(text, kind);
+      })
+      .catch((error: unknown) => {
+        logDaemonPath('rejected', kind, { inProcess: true, error: error instanceof Error ? error.message : String(error) });
+        if (sendTelegramDirect(text, kind)) recordOutbound(text, kind);
+      });
+    return 'daemon';
+  }
   // 1) elanous 단일 발송 지점(/v1/outbound) — 데몬이 팬아웃 + 원장 기록.
+  let daemonPath: DaemonPathClass | 'not-found' | 'disabled' = 'disabled';
   if (process.env.SEND_VIA_ELANOUS !== '0') {
     let token = '';
     try { if (existsSync(ACP_TOKEN_PATH)) token = readFileSync(ACP_TOKEN_PATH, 'utf-8').trim(); } catch { /* no token */ }
@@ -330,12 +353,32 @@ export function deliver(text: string, kind = 'alert'): 'daemon' | 'direct' | fal
       : null;
     const classification = classifyDaemonResponse(j);
     if (classification === 'ok') return 'daemon';
+    daemonPath = nexus ? classification : 'not-found';
     const extra: Record<string, unknown> = { hasToken: token.length > 0 };
     if (j && typeof j === 'object' && 'error' in (j as object)) extra.error = (j as { error?: unknown }).error;
     logDaemonPath(classification, kind, extra);
   }
   // 2) fallback: 텔레그램 sendMessage 직접(3900자 분할) — 데몬 미경유라 클라가 원장 기록.
-  return sendTelegramDirect(text, kind) ? 'direct' : false;
+  if (sendTelegramDirect(text, kind)) return 'direct';
+  reportUndeliverable(kind, daemonPath);
+  return false;
+}
+
+/** OB8b — both paths failed: say so loudly, with the universe this process resolved, instead of a silent false.
+ *  The usual cause (10-01 · MK): an ad-hoc `bun -e` or a script from a source tree resolves a cwd-derived test
+ *  universe, so it finds neither the production daemon nor the production bot token. */
+function reportUndeliverable(kind: string, daemonPath: DaemonPathClass | 'not-found' | 'disabled'): void {
+  let root = '?';
+  let universe: 'prod' | 'test' | '?' = '?';
+  try {
+    root = effectiveInstanceRoot();
+    universe = root === prodInstanceRoot() ? 'prod' : 'test';
+  } catch { /* the report still goes out */ }
+  try { debug.log('outbound.send', 'undeliverable', { kind, daemonPath, universe, root }); } catch { /* fail-soft */ }
+  const hint = universe === 'prod'
+    ? '운영 데몬이 떠 있는지 확인: elanous nexus show'
+    : '운영으로 보내려면 설치본 elanous 로 실행하거나 ELANOUS_STATE_DIR=~/.elanous ELANOUS_CONFIG_DIR=~/.elanous 를 준다';
+  try { console.error(`[outbound] ⛔ 못 보냄(${kind}) — 데몬 ${daemonPath} · 직접 발송도 실패(토큰 없음 또는 전송 실패) · 이 프로세스의 우주 ${universe} (${root}) · ${hint}`); } catch { /* fail-soft */ }
 }
 
 /** 텔레그램 raw 발송(토큰·chatId 명시) — spill + 3900자 분할(줄 경계). thread 지원. */

package/src/domains/repeated-failure.ts

@@ -79,7 +79,7 @@ export function explainFailure(group: RepeatedFailureGroup): string {
   // the first live tick saw it as `webterm.tabs` (list errors re-raise the socket close) and sent the generic line.
   if (group.area.startsWith('webterm.') && /^socket closed: #: auth_failed$/i.test(group.reason)) {
     // Same words as the PWA banners (🅞 #21591·#21602 · 🅕 #21599) so the alert and the screen say one thing.
-    return '이 기기(브라우저)에 소유자 토큰이 없거나 틀리거나 만료돼 데몬이 연결을 거절한다 — 이미 연결된 기기의 설정 › Connect token 에서 토큰을 만들어, 이 기기의 설정 › Daemon › Bearer token 칸(/app/settings/#bearer-token)에 붙인다';
+    return '이 기기(브라우저)에 소유자 토큰이 없거나 틀리거나 만료돼 데몬이 연결을 거절한다 — 이미 연결된 기기의 설정 › 연결 토큰 만들기 에서 토큰을 만들어, 이 기기의 설정 › 데몬 연결 › 연결 토큰 칸(/app/settings/#bearer-token)에 붙인다';
   }
   const span = Date.parse(group.lastTs) - Date.parse(group.firstTs);
   const minutes = Number.isFinite(span) ? Math.max(1, Math.ceil(span / 60_000)) : 10;

package/src/error-report/report.ts

@@ -0,0 +1,200 @@
+// ER1 — 액티브 덤퍼 «보내는 쪽». 사용자 기기에서 오류가 나면 운영이 알게 한다(대표 10-01 22:0x).
+// 계약 v1 = TC 10-01 22:16(채널 #20798 · ER2): POST https://hooks.elanous.ai/v1/reports · ≤64KiB · consent:true 필수 ·
+// installId = 무작위 UUID · email/telegramUser 는 «신원도 함께» 동의 때만 · nexus.instance 는 해시 12자 · dedupe 는 수신기가 만든다.
+// 규칙: 비밀·홈 경로를 지운 뒤에만 보낸다 · 실패하면 한 부만 남겨 다음 시작 때 한 번(하루 최대 한 번) · 절대 던지지 않는다.
+import { createHash, randomUUID } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { arch, homedir, platform } from 'node:os';
+import { join } from 'node:path';
+import { debug } from '../debug/log.js';
+import { getElanousConfigDir } from '../elanous-config-dir.js';
+import { codeRevision, packageVersion } from '../version/code-revision.js';
+import { getUserConfig } from '../user-config.js';
+
+export const ERROR_REPORT_URL = 'https://hooks.elanous.ai/v1/reports';
+const MAX_BYTES = 64 * 1024;
+const MAX_MESSAGE = 2_000;
+const MAX_STACK = 8_000;
+const SEND_TIMEOUT_MS = 5_000;
+const RETRY_GAP_MS = 24 * 60 * 60_000;
+const SAME_ERROR_GAP_MS = 60 * 60_000;
+
+export type ReportSurface = 'tui' | 'pwa' | 'cli' | 'daemon';
+
+export interface ErrorReportInput { code: string; message: string; stack?: string; surface: ReportSurface }
+
+export interface ErrorReport {
+  kind: 'error-report'; v: 1; code: string; message: string; stack?: string;
+  app: { version: string; sha: string; surface: ReportSurface; os: string; arch: string };
+  nexus: { alive: boolean; version?: string; instance?: string };
+  who: { installId: string; email?: string; telegramUser?: string };
+  at: string; consent: true;
+}
+
+export interface ErrorReportSettings { enabled: boolean; identity: boolean; email?: string; telegramUser?: string }
+
+export interface ErrorReportDeps {
+  configDir?: () => string;
+  settings?: () => ErrorReportSettings;
+  nexusMeta?: () => Promise<ErrorReport['nexus']>;
+  fetchImpl?: typeof fetch;
+  now?: () => number;
+  /** Tests and the isolated test universe never reach the network. */
+  enabledByEnvironment?: () => boolean;
+}
+
+/** Secrets and the home directory out, before anything leaves the machine. */
+export function scrubText(text: string, home = homedir()): string {
+  let out = text;
+  if (home && home.length > 1) out = out.split(home).join('~');
+  return out
+    .replace(/\/(Users|home)\/[^/\s'"`]+/g, '/$1/~')
+    .replace(/\b(?:elt|els|ghp|gho|ghs|github_pat|xox[abpr]|sk(?:-proj|-ant)?)[-_][A-Za-z0-9_\-]{8,}/g, '[redacted]')
+    .replace(/\b(Bearer|token|apiKey|api_key|password|secret)\b(\s*[:=]\s*|\s+)["']?[^\s"',;]{6,}/gi, '$1$2[redacted]')
+    .replace(/\b\d{6,}:[A-Za-z0-9_-]{30,}\b/g, '[redacted]') // telegram bot token shape
+    .replace(/[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g, '[email]');
+}
+
+/** Frames keep only `file:line:col` — never the directory. */
+export function stripStackPaths(stack: string): string {
+  return stack.split('\n').map((line) => line.replace(/\(?((?:file:\/\/)?\/?[^\s()]*[/\\])([^/\\\s()]+:\d+(?::\d+)?)\)?/g, (_m, _dir: string, tail: string) => `(${tail})`)).join('\n');
+}
+
+/** One random id per install (never derived from the machine or account). */
+export function installId(configDir: string): string {
+  const file = join(configDir, 'install-id');
+  try {
+    const existing = readFileSync(file, 'utf8').trim();
+    if (/^[0-9a-f-]{36}$/.test(existing)) return existing;
+  } catch { /* first time */ }
+  const id = randomUUID();
+  try { mkdirSync(configDir, { recursive: true }); writeFileSync(file, `${id}\n`, { mode: 0o600 }); } catch { /* id still usable this run */ }
+  return id;
+}
+
+export function hash12(value: string): string {
+  return createHash('sha256').update(value).digest('hex').slice(0, 12);
+}
+
+function cut(text: string, max: number): string { return text.length > max ? `${text.slice(0, max - 1)}…` : text; }
+
+export function buildErrorReport(input: ErrorReportInput, ctx: { installId: string; settings: ErrorReportSettings; nexus: ErrorReport['nexus']; at: string }): ErrorReport {
+  const code = input.code.toLowerCase().replace(/[^a-z0-9-]/g, '-').slice(0, 64) || 'unknown';
+  const report: ErrorReport = {
+    kind: 'error-report', v: 1, code,
+    message: cut(scrubText(input.message), MAX_MESSAGE),
+    ...(input.stack ? { stack: cut(scrubText(stripStackPaths(input.stack)), MAX_STACK) } : {}),
+    app: { version: packageVersion(), sha: codeRevision() ?? 'unknown', surface: input.surface, os: platform(), arch: arch() },
+    nexus: ctx.nexus,
+    who: {
+      installId: ctx.installId,
+      ...(ctx.settings.identity && ctx.settings.email ? { email: ctx.settings.email } : {}),
+      ...(ctx.settings.identity && ctx.settings.telegramUser ? { telegramUser: ctx.settings.telegramUser } : {}),
+    },
+    at: ctx.at,
+    consent: true,
+  };
+  // Hard cap: drop the stack first, then shorten the message.
+  if (Buffer.byteLength(JSON.stringify(report)) > MAX_BYTES) delete report.stack;
+  if (Buffer.byteLength(JSON.stringify(report)) > MAX_BYTES) report.message = cut(report.message, 500);
+  return report;
+}
+
+function defaultSettings(): ErrorReportSettings {
+  try {
+    const er = getUserConfig().errorReports;
+    return { enabled: er?.enabled !== false, identity: er?.identity === true, ...(er?.email ? { email: er.email } : {}), ...(er?.telegramUser ? { telegramUser: er.telegramUser } : {}) };
+  } catch { return { enabled: false, identity: false }; }
+}
+
+async function defaultNexusMeta(): Promise<ErrorReport['nexus']> {
+  try {
+    const { resolveDaemonEndpoint } = await import('../nexus/daemon-endpoint.js');
+    const base = resolveDaemonEndpoint({ purpose: 'watch' })?.baseUrl;
+    const instance = hash12(getElanousConfigDir());
+    if (!base) return { alive: false, instance };
+    const response = await fetch(`${base}/v1/health`, { signal: AbortSignal.timeout(1_000) });
+    const body = await response.json().catch(() => ({})) as { version?: unknown };
+    return { alive: response.ok, ...(typeof body.version === 'string' ? { version: body.version } : {}), instance };
+  } catch { return { alive: false }; }
+}
+
+/** Never from `bun test`, and never from the isolated test universe (its config dir lives under a test root). */
+function defaultEnabledByEnvironment(): boolean {
+  if (process.env.NODE_ENV === 'test' || process.env.BUN_TEST) return false;
+  try { return !/[/\\](?:test|\.elanous-test)[/\\]?/.test(getElanousConfigDir()); } catch { return false; }
+}
+
+const lastSent = new Map<string, number>();
+
+export type ReportOutcome = { sent: true; reportId?: string } | { sent: false; reason: string };
+
+/** Send one report — never throws, never blocks the caller beyond the send timeout. */
+export async function reportError(input: ErrorReportInput, deps: ErrorReportDeps = {}): Promise<ReportOutcome> {
+  try {
+    if (!(deps.enabledByEnvironment ?? defaultEnabledByEnvironment)()) return { sent: false, reason: 'environment' };
+    const settings = (deps.settings ?? defaultSettings)();
+    if (!settings.enabled) return { sent: false, reason: 'disabled' };
+    const now = (deps.now ?? Date.now)();
+    const key = `${input.code}\u0000${input.message.slice(0, 200)}`;
+    const previous = lastSent.get(key);
+    if (previous !== undefined && now - previous < SAME_ERROR_GAP_MS) return { sent: false, reason: 'recently-sent' };
+    lastSent.set(key, now);
+    const configDir = (deps.configDir ?? getElanousConfigDir)();
+    const report = buildErrorReport(input, {
+      installId: installId(configDir), settings, nexus: await (deps.nexusMeta ?? defaultNexusMeta)(), at: new Date(now).toISOString(),
+    });
+    return await post(report, configDir, deps);
+  } catch (error) {
+    debug.log('error-report', 'failed', { reason: error instanceof Error ? error.message.slice(0, 120) : 'unknown' });
+    return { sent: false, reason: 'internal' };
+  }
+}
+
+async function post(report: ErrorReport, configDir: string, deps: ErrorReportDeps): Promise<ReportOutcome> {
+  try {
+    const response = await (deps.fetchImpl ?? fetch)(ERROR_REPORT_URL, {
+      method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(report), signal: AbortSignal.timeout(SEND_TIMEOUT_MS),
+    });
+    if (response.status >= 200 && response.status < 300) {
+      const body = await response.json().catch(() => ({})) as { reportId?: unknown };
+      const reportId = typeof body.reportId === 'string' ? body.reportId : undefined;
+      debug.log('error-report', 'sent', { code: report.code, surface: report.app.surface, ...(reportId ? { reportId } : {}) });
+      return { sent: true, ...(reportId ? { reportId } : {}) };
+    }
+    keepPending(report, configDir, deps);
+    debug.log('error-report', 'not-sent', { code: report.code, status: response.status });
+    return { sent: false, reason: `http-${response.status}` };
+  } catch (error) {
+    keepPending(report, configDir, deps);
+    debug.log('error-report', 'not-sent', { code: report.code, reason: error instanceof Error ? error.name : 'network' });
+    return { sent: false, reason: 'network' };
+  }
+}
+
+function pendingFile(configDir: string): string { return join(configDir, 'error-reports', 'pending.json'); }
+
+/** Keep exactly one unsent report (the newest) for a later retry. */
+function keepPending(report: ErrorReport, configDir: string, deps: ErrorReportDeps): void {
+  try {
+    mkdirSync(join(configDir, 'error-reports'), { recursive: true, mode: 0o700 });
+    writeFileSync(pendingFile(configDir), JSON.stringify({ report, lastTry: (deps.now ?? Date.now)() }), { mode: 0o600 });
+  } catch { /* nothing else to do */ }
+}
+
+/** At start-up: retry the one kept report, at most once a day. */
+export async function retryPendingErrorReport(deps: ErrorReportDeps = {}): Promise<ReportOutcome> {
+  try {
+    if (!(deps.enabledByEnvironment ?? defaultEnabledByEnvironment)()) return { sent: false, reason: 'environment' };
+    if (!(deps.settings ?? defaultSettings)().enabled) return { sent: false, reason: 'disabled' };
+    const configDir = (deps.configDir ?? getElanousConfigDir)();
+    const file = pendingFile(configDir);
+    if (!existsSync(file)) return { sent: false, reason: 'none' };
+    const kept = JSON.parse(readFileSync(file, 'utf8')) as { report: ErrorReport; lastTry: number };
+    if ((deps.now ?? Date.now)() - kept.lastTry < RETRY_GAP_MS) return { sent: false, reason: 'too-soon' };
+    const outcome = await post(kept.report, configDir, deps);
+    if (outcome.sent) rmSync(file, { force: true });
+    return outcome;
+  } catch { return { sent: false, reason: 'internal' }; }
+}
+