elanous 0.2.7 → 0.2.9

package/src/intake-plane/seat-doc-route.ts

@@ -10,6 +10,7 @@ import { getElanousConfigDir } from '../elanous-config-dir.js';
 import type { ExecRequest } from '../exec-requests/store.js';
 import { resolveDaemonEndpoint } from '../nexus/daemon-endpoint.js';
 import { parseSeatAddress, resolveSeat } from '../seat-address/seat-address.js';
+import { answerAsSeat, isNoGraphFailure } from './seat-answer.js';
 
 const POLL_MS = 5_000;
 const TIMEOUT_MS = 30 * 60_000;
@@ -34,7 +35,9 @@ export interface SeatDocDeps {
   sleep?: (ms: number) => Promise<void>;
   now?: () => number;
   pwaUrl?: () => string | undefined;
-  log?: (event: 'submitted' | 'research' | 'settled' | 'delivered' | 'delivery-failed', data: Record<string, unknown>) => void;
+  log?: (event: 'submitted' | 'research' | 'settled' | 'delivered' | 'delivery-failed' | 'seat-answer', data: Record<string, unknown>) => void;
+  /** EV12d — the seat's own answer when no installed graph fits (default = role file ⊕ owned checklist ⊕ recent, one LLM call). */
+  seatAnswer?: (seatAddress: string, question: string) => Promise<{ title: string; text: string } | null>;
 }
 
 export function isSeatDocRequest(text: string): boolean {
@@ -194,9 +197,20 @@ export async function submitSeatDocRequest({ text, reportTo, deps = {} }: {
     }
     log('settled', { id, status: result?.status ?? (lookupAvailable ? 'timeout' : 'lookup-unavailable'), lastConfirmedStatus });
     const links = result?.status === 'done' ? await fileLinks(id, result, deps) : new Map<string, string>();
+    let reply = message(id, result, withoutResearch, lookupAvailable, accessiblePwaUrl((deps.pwaUrl ?? chatPwaUrl)()), links);
+    if (isNoGraphFailure(result)) {
+      // EV12d — a question with no fitting graph gets the seat's own answer, not «문서 요청 실패».
+      const seat = result!.seats![0]!.seat;
+      try {
+        const answer = await (deps.seatAnswer ?? answerAsSeat)(seat, body);
+        if (answer) reply = `${answer.title} 답 (접수번호 ${id})\n${answer.text}`;
+        log('seat-answer', { id, seat, answered: !!answer });
+      } catch (error) {
+        log('seat-answer', { id, seat, answered: false, reason: String(error).slice(0, 200) });
+      }
+    }
     try {
-      const sent = await (deps.sendOutbound ?? sendOutbound)(message(id, result, withoutResearch, lookupAvailable,
-        accessiblePwaUrl((deps.pwaUrl ?? chatPwaUrl)()), links), 'report', reportTo);
+      const sent = await (deps.sendOutbound ?? sendOutbound)(reply, 'report', reportTo);
       log(sent ? 'delivered' : 'delivery-failed', { id });
     } catch (error) {
       log('delivery-failed', { id, reason: String(error).slice(0, 200) });

package/src/maturity/feature-maturity.ts

@@ -38,6 +38,8 @@ export const FEATURE_MATURITY = {
     '/design-check': { pwa: 'tool' },
     '/control': { pwa: 'tool' },
     '/scheduler': { pwa: 'ops' },
+    '/ops/release': { pwa: 'ops' },
+    '/ops/checklist': { pwa: 'ops' },
     '/dashboard': { pwa: 'ops' },
     '/bots': { pwa: 'ops' },
     '/botlab': { pwa: 'ops' },

package/src/nexus/api/consult-requests.ts

@@ -2,7 +2,8 @@ import { closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, re
 import { randomUUID } from 'node:crypto';
 import { dirname, join } from 'node:path';
 import { debug } from '../../debug/log.js';
-import { sendOutbound } from '../../domains/outbound-alert.js';
+import { routeOutbound } from '../outbound/router.js';
+import { getUserConfig } from '../../user-config.js';
 import { effectiveInstanceRoot } from '../../instance/resolve.js';
 import { jsonResponse } from './json-response.js';
 
@@ -22,7 +23,10 @@ interface ConsultRequest {
 export interface ConsultRequestsDeps {
   root?: () => string;
   now?: () => string;
-  send?: typeof sendOutbound;
+  /** Owner alert. Default = the daemon's own in-process router (the same one `/v1/outbound` uses).
+   *  ⛔ Never `sendOutbound` here: it is a synchronous curl to this very daemon's `/v1/outbound`, so inside the
+   *  daemon it blocks the event loop until it times out (~25 s · `unreachable`) and the alert is lost (CS1 · 10-01). */
+  send?: (text: string, kind: string) => unknown;
 }
 
 function file(root: string): string {
@@ -107,11 +111,18 @@ export async function handleConsultRequests(req: Request, deps: ConsultRequestsD
     return jsonResponse({ error: 'journal-unavailable' }, 503);
   }
   debug.log('consult.request', 'accepted', { receiptId: entry.receiptId });
-  try {
-    (deps.send ?? sendOutbound)(
-      `📮 상담 문의 ${entry.receiptId} · ${entry.name}(${entry.kind === 'personal' ? '개인' : (entry.org ?? '회사')}) · 관심 ${entry.interest}\n앱에서 보기`,
-      'alert',
-    );
-  } catch { /* the local receipt remains accepted if delivery is unavailable */ }
+  const alert = `📮 상담 문의 ${entry.receiptId} · ${entry.name}(${entry.kind === 'personal' ? '개인' : (entry.org ?? '회사')}) · 관심 ${entry.interest}\n앱에서 보기`;
+  // Fire and forget — the receipt is already on disk; the answer must not wait for the channel.
+  void Promise.resolve()
+    .then(() => (deps.send ?? notifyInProcess)(alert, 'alert'))
+    .catch((error: unknown) => { debug.log('consult.request', 'notify-failed', { receiptId: entry.receiptId, reason: error instanceof Error ? error.message : String(error) }); });
   return jsonResponse({ receiptId: entry.receiptId, receivedAt: entry.receivedAt }, 202);
 }
+
+async function notifyInProcess(text: string, kind: string): Promise<void> {
+  const result = await routeOutbound(getUserConfig(), { text, markdown: false, kind });
+  debug.log('consult.request', result.delivered ? 'notified' : 'notify-failed', {
+    delivered: result.delivered,
+    channels: result.channels.map((channel) => `${channel.type}:${channel.ok ? 'ok' : 'fail'}`),
+  });
+}

package/src/nexus/api/error-reports.ts

@@ -0,0 +1,108 @@
+// ER2 — the Primary side of error reports. The bot VM forwards each accepted report here over the tailnet
+// (ingest token). It is stored under <instance>/error-reports/YYYY/MM/DD/<reportId>.json for 30 days, and the
+// operator gets one Telegram line per distinct error per hour — never the message, stack or identity.
+import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { debug } from '../../debug/log.js';
+import { effectiveInstanceRoot } from '../../instance/resolve.js';
+import type { ReceivedReport } from '../../hooks/error-report.js';
+import { validateErrorReport } from '../../hooks/error-report.js';
+import { jsonResponse } from './json-response.js';
+import { routeOutboundInProcess } from './outbound-report.js';
+
+export const ERROR_REPORT_KEEP_DAYS = 30;
+const DAY_MS = 86_400_000;
+
+export interface ErrorReportIngestDeps {
+  root?: () => string;
+  now?: () => number;
+  /** Operator alert. Default = the daemon's in-process router (never a self-call · OB8). */
+  alert?: (text: string, kind: string) => Promise<boolean>;
+}
+
+function storeDir(root: string): string { return join(root, 'error-reports'); }
+
+/** Removes day folders older than the keep window. Returns how many days were removed. */
+export function pruneErrorReports(root: string, now: number): number {
+  const base = storeDir(root);
+  if (!existsSync(base)) return 0;
+  let removed = 0;
+  for (const year of readdirSync(base).filter((n) => /^\d{4}$/.test(n))) {
+    for (const month of readdirSync(join(base, year)).filter((n) => /^\d{2}$/.test(n))) {
+      for (const day of readdirSync(join(base, year, month)).filter((n) => /^\d{2}$/.test(n))) {
+        const at = Date.parse(`${year}-${month}-${day}T00:00:00Z`);
+        if (Number.isFinite(at) && now - at > ERROR_REPORT_KEEP_DAYS * DAY_MS + DAY_MS) {
+          rmSync(join(base, year, month, day), { recursive: true, force: true });
+          removed++;
+        }
+      }
+    }
+  }
+  return removed;
+}
+
+/** One alert per dedupe per hour, remembered on disk so a restart does not repeat it. */
+function shouldAlert(root: string, dedupe: string, now: number): boolean {
+  const path = join(storeDir(root), 'alerts.json');
+  let seen: Record<string, number> = {};
+  try { seen = JSON.parse(readFileSync(path, 'utf8')) as Record<string, number>; } catch { /* first alert */ }
+  for (const [k, t] of Object.entries(seen)) if (now - t > DAY_MS) delete seen[k];
+  const last = seen[dedupe];
+  if (last !== undefined && now - last < 3600_000) return false;
+  seen[dedupe] = now;
+  mkdirSync(storeDir(root), { recursive: true, mode: 0o700 });
+  writeFileSync(path, JSON.stringify(seen), { mode: 0o600 });
+  return true;
+}
+
+export function errorReportAlertText(item: ReceivedReport, count24h: number): string {
+  const r = item.report;
+  return `🧯 오류 보고 ${r.code} · v${r.app.version} · ${r.app.surface} · 같은 오류 24h ${count24h}회 · ${item.reportId}`;
+}
+
+/** Same dedupe stored in the last 24 h, counted from the store itself. */
+function count24h(root: string, dedupe: string, now: number): number {
+  let n = 0;
+  for (const offset of [0, 1]) {
+    const d = new Date(now - offset * DAY_MS);
+    const dir = join(storeDir(root), String(d.getUTCFullYear()), String(d.getUTCMonth() + 1).padStart(2, '0'), String(d.getUTCDate()).padStart(2, '0'));
+    if (!existsSync(dir)) continue;
+    for (const name of readdirSync(dir).filter((f) => f.endsWith('.json'))) {
+      try {
+        const item = JSON.parse(readFileSync(join(dir, name), 'utf8')) as ReceivedReport;
+        if (item.dedupe === dedupe && now - Date.parse(item.receivedAt) < DAY_MS) n++;
+      } catch { /* a broken file is not counted */ }
+    }
+  }
+  return n;
+}
+
+/** POST /v1/reports/ingest — the caller (router) has already checked the ingest token. */
+export async function handleErrorReportIngest(req: Request, deps: ErrorReportIngestDeps = {}): Promise<Response> {
+  const root = (deps.root ?? effectiveInstanceRoot)();
+  const now = (deps.now ?? Date.now)();
+  let body: unknown;
+  try { body = await req.json(); } catch { return jsonResponse({ error: 'invalid', field: 'body' }, 400); }
+  const item = body as Partial<ReceivedReport>;
+  if (typeof item.reportId !== 'string' || !/^er_[0-9a-z]{26}$/.test(item.reportId)) return jsonResponse({ error: 'invalid', field: 'reportId' }, 400);
+  if (typeof item.dedupe !== 'string' || !/^[0-9a-f]{12}$/.test(item.dedupe)) return jsonResponse({ error: 'invalid', field: 'dedupe' }, 400);
+  if (typeof item.receivedAt !== 'string' || !Number.isFinite(Date.parse(item.receivedAt))) return jsonResponse({ error: 'invalid', field: 'receivedAt' }, 400);
+  const checked = validateErrorReport(item.report);
+  if (!checked.ok) return jsonResponse({ error: 'invalid', field: `report.${checked.field}` }, 400);
+  const stored: ReceivedReport = { reportId: item.reportId, dedupe: item.dedupe, receivedAt: item.receivedAt, report: checked.report };
+  const at = new Date(Date.parse(stored.receivedAt));
+  const dir = join(storeDir(root), String(at.getUTCFullYear()), String(at.getUTCMonth() + 1).padStart(2, '0'), String(at.getUTCDate()).padStart(2, '0'));
+  mkdirSync(dir, { recursive: true, mode: 0o700 });
+  writeFileSync(join(dir, `${stored.reportId}.json`), JSON.stringify(stored), { mode: 0o600 });
+  let pruned = 0;
+  try { pruned = pruneErrorReports(root, now); } catch { /* pruning never blocks a receipt */ }
+  const count = count24h(root, stored.dedupe, now);
+  const alerted = shouldAlert(root, stored.dedupe, now);
+  debug.log('error-report.ingest', 'stored', { code: stored.report.code, surface: stored.report.app.surface, count24h: count, alerted, pruned });
+  if (alerted) {
+    const alert = deps.alert ?? routeOutboundInProcess;
+    void Promise.resolve().then(() => alert(errorReportAlertText(stored, count), 'alert'))
+      .catch((error: unknown) => debug.log('error-report.ingest', 'alert-failed', { reason: error instanceof Error ? error.message : String(error) }));
+  }
+  return jsonResponse({ stored: true, reportId: stored.reportId, count }, 202);
+}

package/src/nexus/api/http-server.ts

@@ -15,6 +15,7 @@
 // Port policy (N1-2 decision): auto-pick from 31415 upward. Actual port
 // is recorded in runtime.json + printed in boot banner.
 
+import { setInProcessOutbound } from '../../domains/outbound-alert.js';
 import { getUserConfig } from '../../user-config.js';
 import type { TelegramEvent } from '../../workflow-runtime/triggers/telegram-source.js';
 import { spawnSync } from 'node:child_process';
@@ -154,11 +155,14 @@ import {
 import { handleBuildsGet, parseBuildsPath } from './builds-api.js';
 import { handleHarnessAskPost, handleHarnessAskStatusGet, handleHarnessRunEventsGet, handleHarnessRunScreenGet, handleHarnessRunsGet, handleHarnessStopPost } from './harness-api.js';
 import { dispatchPersonaRoute } from './personas.js';
+import { handleMe } from './operator.js';
+import { handleOpsApi } from './ops-api.js';
 import { handleRoleJudge } from './role-judge.js';
 import { handleAudioStt } from './audio-stt.js';
 import { handleLlmModels } from './llm-models.js';
 import { handleLlmHostsConfig } from './llm-hosts-config.js';
 import { handleLlmRotationGet, handleLlmRotationNext } from './llm-rotation.js';
+import { handleSetupClaim } from './setup-claim.js';
 import {
   handleLlmProvidersList,
   handleLlmProviderSet,
@@ -311,6 +315,7 @@ import {
   handleVoiceTranscribe,
   checkAuth,
   bearerCredential,
+  setupBearerScopeDenied,
   registerAuthPeerAddress,
   type MetaApiOpts,
 } from './meta-api.js';
@@ -385,6 +390,8 @@ import {
 import { handleSessionTurnControl, SESSION_TURN_CONTROL_PATH } from '../../session/session-turn-control.js';
 import { authenticatePodCredential, handlePodGrokCredential, handlePodGithubCredential, POD_CREDENTIAL_GROK_PATH, POD_CREDENTIAL_GITHUB_PATH } from './pod-credential-api.js';
 import { handleOutboundReport } from './outbound-report.js';
+import { handleErrorReportIngest } from './error-reports.js';
+import { routeOutboundInProcess } from './outbound-report.js';
 import { handleSelfEvent } from './self-event.js';
 /** 매매 «실행»은 애드온이다(대표 09-20 결정 ③ · 별도 상용 저장소 · release/trading-export.yaml) — 공개 코어엔 없다.
  *  있으면 그 경로를 켜고, 없으면 501. 경로를 변수로 둬 공개본 타입 검사가 «모듈 없음»으로 막히지 않게 한다. */
@@ -757,6 +764,8 @@ export function startNexusHttpServer(opts: NexusHttpServerOpts): NexusHttpServer
         ...(websocketHandler ? { websocket: websocketHandler } : {}),
       } as unknown as Parameters<typeof Bun.serve>[0];
       server = Bun.serve(fetchOpts);
+      // OB8 — this process now answers /v1/outbound itself; its own sendOutbound calls must not curl it.
+      setInProcessOutbound(routeOutboundInProcess);
       // 데몬이 «실제로» 떴을 때만 재시작 복구(맡긴 일) — 주입된 러너(시험)는 건드리지 않는다.
       if (!opts.execRequests) { try { execRequestRunner().reconcileInterrupted(); } catch { /* 복구 실패가 서버 기동을 막지 않는다 */ } }
       resolvedPort = port;
@@ -781,6 +790,7 @@ export function startNexusHttpServer(opts: NexusHttpServerOpts): NexusHttpServer
     url,
     stop() {
       try { server!.stop(true); } catch { /* idempotent */ }
+      setInProcessOutbound(null);
     },
   };
 }
@@ -820,6 +830,9 @@ export async function routeRequest(
   registerAuthPeerAddress(req, (server as BunServerLike & {
     requestIP?: (request: Request) => { address: string } | null;
   }).requestIP?.(req)?.address);
+  if (opts.metaApi && setupBearerScopeDenied(req, opts.metaApi)) {
+    return jsonResponse({ error: 'forbidden' }, 403);
+  }
 
   // PR c — try WS upgrade before HTTP routing. On undefined return the
   // bridge has accepted the upgrade (Bun completes the handshake) and
@@ -846,6 +859,12 @@ export async function routeRequest(
   const { pathname } = url;
   const method = req.method;
 
+  // Operator proxy credentials are distinct from the owner bearer. The ops handler
+  // performs its own operatorSignal gate before reading any run or checklist data.
+  if (pathname === '/v1/ops' || pathname.startsWith('/v1/ops/')) {
+    return handleOpsApi(req, opts.metaApi);
+  }
+
   // Default-deny for every `/v1/` path that is not on PUBLIC_ROUTES.
   // Reuses checkAuth (same-origin exemption + constant-time bearer).
   // setupMode is not implemented on this server (P24b) — pass false.
@@ -876,7 +895,7 @@ export async function routeRequest(
     const fallbackAuthorized = fallbackToken !== undefined && offered?.startsWith('Bearer ') === true
       && compareTokenConstTime(offered.slice('Bearer '.length).trim(), fallbackToken);
     if (!(opts.metaApi ? checkAuth(req, opts.metaApi) : fallbackAuthorized)) {
-      const name = method === 'POST' && pathname === '/v1/tasks' && opts.metaApi
+      const name = method === 'POST' && (pathname === '/v1/tasks' || pathname === '/v1/reports/ingest') && opts.metaApi
         ? matchIngestAuthorization(req)?.name
         : undefined;
       if (name === undefined) {
@@ -1304,6 +1323,8 @@ export async function routeRequest(
       if (!opts.metaApi) return jsonResponse({ error: 'meta-api-not-wired' }, 503);
       return handleTaskCreatePost(req, opts.metaApi);
     }
+    // ER2 — error reports forwarded by the bot VM (ingest token · same as /v1/tasks).
+    if (method === 'POST' && pathname === '/v1/reports/ingest') return handleErrorReportIngest(req);
     if (method === 'POST' && pathname.startsWith('/v1/tasks/') && pathname.endsWith('/approve')) {
       if (!opts.metaApi) return jsonResponse({ error: 'meta-api-not-wired' }, 503);
       let taskId: string;
@@ -1512,6 +1533,10 @@ export async function routeRequest(
     if (pathname === '/v1/llm/rotation' && method === 'OPTIONS') {
       return handleLlmRotationGet(req);
     }
+    // The one-use link is verified by the claim handler, not by the owner bearer.
+    if (pathname === '/v1/setup/claim' && (method === 'POST' || method === 'OPTIONS')) {
+      return method === 'OPTIONS' ? corsPreflight('POST, OPTIONS') : handleSetupClaim(req);
+    }
     // PWA `/setup` wizard Phase 1 (2026-05-19) — LLM provider 첫 셋업.
     // POST 는 mutation 블록 안에서 등록 (memory `feedback_post_route_must_be_in_method_block`).
     // GET sibling 은 아래 GET-only 블록에 등록.
@@ -1969,6 +1994,18 @@ export async function routeRequest(
     }
     // HANDOFF §4.2 follow-up — skill-side mirror of the workflow
     // router. Same regex → LLM cascade, applied to the skill index.
+    // SK2 (PWA) — skills the index could not read: list ⊕ confirmed repair.
+    if (pathname === '/v1/skills/problems' || pathname === '/v1/skills/problems/repair') {
+      if (!opts.metaApi) return jsonResponse({ error: 'meta-api-not-wired' }, 503);
+      const { handleSkillProblems } = await import('./skill-problems.js');
+      return handleSkillProblems(req, opts.metaApi);
+    }
+    // SC1 (PWA · beta) — «공유용 캡처»: masked screen PNG in, metadata chunks stripped, stored under <configDir>/captures.
+    if (pathname === '/v1/captures' || pathname.startsWith('/v1/captures/')) {
+      if (!opts.metaApi) return jsonResponse({ error: 'meta-api-not-wired' }, 503);
+      const { handleShareCaptures } = await import('./share-captures.js');
+      return handleShareCaptures(req, opts.metaApi);
+    }
     if (pathname === '/v1/skills/route' && method === 'POST') {
       if (!opts.metaApi) return jsonResponse({ error: 'meta-api-not-wired' }, 503);
       return handleSkillRoute(req, opts.metaApi);
@@ -2133,6 +2170,9 @@ export async function routeRequest(
     }
     return jsonResponse({ error: 'static-not-wired' }, 404);
   }
+  // OPS1·OPS2 — whether this caller is an operator (draws the ops area). Answers everyone before any auth gate;
+  // false unless this daemon's config has operator.enabled.
+  if (pathname === '/v1/me' && req.method === 'GET') return handleMe(req, opts.metaApi ?? ({} as MetaApiOpts));
   if (pathname === '/v1/health') {
     return handleHealth(opts.state, opts.registry, {
       bindHost: bind.hostname,

package/src/nexus/api/meta-api.ts

@@ -16,6 +16,7 @@
 
 import { randomUUID } from 'node:crypto';
 import { matchTempToken } from '../../auth/temp-tokens.js';
+import { matchSetupBearer } from '../../auth/setup-link-tokens.js';
 import { existsSync, readFileSync, statSync } from 'node:fs';
 import { extname } from 'node:path';
 
@@ -215,6 +216,8 @@ type AuthReason =
   | 'untrusted-same-origin-peer'
   | 'bearer-match'
   | 'temp-token'
+  | 'setup-bearer'
+  | 'setup-scope-denied'
   | 'no-bearer-configured'
   | 'missing-auth-header'
   | 'bearer-length-mismatch'
@@ -248,8 +251,27 @@ export function registerAuthPeerAddress(req: Request, peerAddress: string | unde
   authPeerAddresses.set(req, peerAddress);
 }
 
+function setupRouteAllowed(req: Request): boolean {
+  const path = new URL(req.url).pathname;
+  if (path.startsWith('/v1/setup/')) return true;
+  return (req.method === 'POST' && path === '/v1/prompt/stream')
+    || (req.method === 'GET' && (
+      /^\/v1\/sessions\/store\/[^/]+$/.test(path) || path === '/v1/chat/events'
+    ));
+}
+
 function decideAuth(req: Request, opts: MetaApiOpts): { ok: boolean; reason: AuthReason } {
   if (opts.noAuth) return { ok: true, reason: 'noauth' };
+  const offered = req.headers.get('authorization');
+  if (offered?.startsWith('Bearer elsb_')) {
+    const owner = decideBearer(req, opts);
+    if (owner.ok) return owner;
+    const bearer = offered.slice('Bearer '.length).trim();
+    if (!matchSetupBearer(bearer)) return { ok: false, reason: 'bearer-mismatch' };
+    return setupRouteAllowed(req)
+      ? { ok: true, reason: 'setup-bearer' }
+      : { ok: false, reason: 'setup-scope-denied' };
+  }
   const peerAddress = authPeerAddresses.get(req);
   if (isSameOriginRequest(req, peerAddress)) return { ok: true, reason: 'same-origin' };
   const peerRejected = req.headers.get('sec-fetch-site') === 'same-origin'
@@ -292,6 +314,10 @@ export function bearerCredential(req: Request, opts: MetaApiOpts): 'noauth' | 'b
 // check — without duplicating security-sensitive code.
 const authDecisions = new WeakMap<Request, { ok: boolean; reason: AuthReason }>();
 
+export function setupBearerScopeDenied(req: Request, opts: MetaApiOpts): boolean {
+  return decideAuth(req, opts).reason === 'setup-scope-denied';
+}
+
 export function checkAuth(req: Request, opts: MetaApiOpts): boolean {
   const decision = decideAuth(req, opts);
   authDecisions.set(req, decision);
@@ -322,6 +348,7 @@ export function checkAuth(req: Request, opts: MetaApiOpts): boolean {
  * intentionally collapse here to avoid exposing token-length information. */
 function authFailureResponse(req: Request, opts: MetaApiOpts): Response {
   const decision = authDecisions.get(req) ?? decideAuth(req, opts);
+  if (decision.reason === 'setup-scope-denied') return jsonResponse({ error: 'forbidden' }, 403);
   return jsonResponse({ error: 'unauthorized', reason: publicAuthFailureReason(decision.reason) }, 401);
 }
 

package/src/nexus/api/operator.ts

@@ -0,0 +1,61 @@
+// OPS1·OPS2 — who is an «operator» (sees the ops area). Off unless this daemon's config says `operator.enabled: true`
+// (only our own machines); an external install never reports an operator, whatever header or token arrives.
+// Design: 내부 문서 `DESIGN-pwa-menu-reorg-and-ops-area-2026-10-02` §2.
+import { timingSafeEqual } from 'node:crypto';
+import { readFileSync, statSync } from 'node:fs';
+import { debug } from '../../debug/log.js';
+import { getUserConfig } from '../../user-config.js';
+import { checkAuth, type MetaApiOpts } from './meta-api.js';
+
+/** Set by the op.elanous.ai proxy (Caddy) after Google sign-in, server side; the proxy strips any incoming copy. */
+export const OPERATOR_HEADER = 'x-elanous-operator';
+
+export type OperatorSource = 'op-proxy' | 'owner' | null;
+export interface OperatorSignal { operator: boolean; operatorSource: OperatorSource }
+export interface OperatorConfig { enabled: boolean; proxySecretFile?: string }
+
+export function readOperatorConfig(raw: unknown = getUserConfig().raw?.operator): OperatorConfig {
+  const o = raw && typeof raw === 'object' && !Array.isArray(raw) ? raw as Record<string, unknown> : {};
+  return {
+    enabled: o.enabled === true,
+    ...(typeof o.proxySecretFile === 'string' && o.proxySecretFile.trim() ? { proxySecretFile: o.proxySecretFile.trim() } : {}),
+  };
+}
+
+/** The proxy secret, only from a regular file nobody but the owner can read (mode 600); anything else turns the header path off. */
+export function readProxySecret(path: string | undefined): string | null {
+  if (!path) return null;
+  try {
+    const st = statSync(path);
+    if (!st.isFile() || (st.mode & 0o077) !== 0) return null;
+    const value = readFileSync(path, 'utf8').trim();
+    return value.length >= 16 ? value : null;
+  } catch { return null; }
+}
+
+function sameSecret(offered: string, secret: string): boolean {
+  const a = Buffer.from(offered);
+  const b = Buffer.from(secret);
+  return a.length === b.length && timingSafeEqual(a, b);
+}
+
+export interface OperatorDeps { config?: OperatorConfig; readSecret?: (path: string | undefined) => string | null; isOwner?: (req: Request) => boolean }
+
+export function operatorSignal(req: Request, opts: MetaApiOpts, deps: OperatorDeps = {}): OperatorSignal {
+  const config = deps.config ?? readOperatorConfig();
+  if (!config.enabled) return { operator: false, operatorSource: null };
+  const offered = req.headers.get(OPERATOR_HEADER);
+  if (offered) {
+    const secret = (deps.readSecret ?? readProxySecret)(config.proxySecretFile);
+    if (secret && sameSecret(offered, secret)) return { operator: true, operatorSource: 'op-proxy' };
+  }
+  if ((deps.isOwner ?? ((r: Request) => checkAuth(r, opts)))(req)) return { operator: true, operatorSource: 'owner' };
+  return { operator: false, operatorSource: null };
+}
+
+/** `GET /v1/me` — answers every caller (no auth needed: it only says whether to draw the ops area). */
+export function handleMe(req: Request, opts: MetaApiOpts, deps: OperatorDeps = {}): Response {
+  const signal = operatorSignal(req, opts, deps);
+  debug.log('ops.api', 'me', { operator: signal.operator, source: signal.operatorSource });
+  return Response.json(signal, { headers: { 'cache-control': 'no-store' } });
+}

package/src/nexus/api/ops-api.ts

@@ -0,0 +1,139 @@
+import { lstatSync, readFileSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { debug, redactSecretText } from '../../debug/log.js';
+import { effectiveInstanceRoot } from '../../instance/resolve.js';
+import { listChecklist } from '../../release-loop/checklist.js';
+import { jsonResponse } from './json-response.js';
+import { operatorSignal } from './operator.js';
+import { createSeatsCache, todayKst } from './ops-seats.js';
+import { liveSeatsSources } from './ops-seats-sources.js';
+import type { MetaApiOpts } from './meta-api.js';
+
+const VERSION = /^\d+\.\d+\.\d+(?:-(?:rc|alpha|beta)\.\d+)?$/;
+const IDENTIFIER = /^[A-Za-z0-9-]+$/;
+const DATE = /^\d{4}-\d{2}-\d{2}$/;
+let seatsCache: ReturnType<typeof createSeatsCache> | null = null;
+/** Tests swap the sources; production builds them lazily on first use. */
+export function setSeatsCacheForTest(cache: ReturnType<typeof createSeatsCache> | null): void { seatsCache = cache; }
+const LOG_PATH = /^\/v1\/ops\/release\/runs\/([^/]+)\/nodes\/([^/]+)\/log$/;
+
+interface RunNode { nodeId: string; ok?: unknown; output?: unknown }
+interface RunRecord {
+  status: string;
+  path: string[];
+  startedAt: string;
+  input?: unknown;
+  nodes: RunNode[];
+}
+
+function recordAt(path: string): RunRecord | null {
+  try {
+    if (!lstatSync(path).isFile()) return null;
+    const value: unknown = JSON.parse(readFileSync(path, 'utf8'));
+    if (!value || typeof value !== 'object') return null;
+    const run = value as Partial<RunRecord>;
+    if (typeof run.status !== 'string' || !Array.isArray(run.path)
+      || typeof run.startedAt !== 'string' || !Array.isArray(run.nodes)) return null;
+    return run as RunRecord;
+  } catch { return null; }
+}
+
+function outputText(output: unknown): string {
+  if (typeof output === 'string') return output;
+  if (output === undefined || output === null) return '';
+  return JSON.stringify(output) ?? '';
+}
+
+function nodeSummary(output: unknown): string {
+  let value = output;
+  if (typeof value === 'string') {
+    const text = value;
+    try { value = JSON.parse(text) as unknown; }
+    catch {
+      const last = text.split('\n').map((line) => line.trim()).filter(Boolean).at(-1);
+      try { value = JSON.parse(last ?? '') as unknown; } catch { return ''; }
+    }
+  }
+  if (!value || typeof value !== 'object') return '';
+  const summary = (value as { summary?: unknown }).summary;
+  return typeof summary === 'string' ? redactSecretText(summary).slice(0, 300) : '';
+}
+
+function runVersion(input: unknown): string | null {
+  if (!input || typeof input !== 'object') return null;
+  const version = (input as { version?: unknown }).version;
+  return typeof version === 'string' && VERSION.test(version) ? version : null;
+}
+
+/** The sole data gate for every read-only /v1/ops endpoint. */
+export function handleOpsApi(req: Request, metaApi: MetaApiOpts | undefined): Response | Promise<Response> {
+  const url = new URL(req.url);
+  const { pathname } = url;
+  if (req.method !== 'GET') return jsonResponse({ error: 'method-not-allowed' }, 405);
+
+  const signal = metaApi ? operatorSignal(req, metaApi) : { operator: false, operatorSource: null };
+  if (!signal.operator) {
+    debug.log('ops.api', 'refused', { path: pathname, source: signal.operatorSource });
+    return jsonResponse({ error: 'forbidden' }, 403);
+  }
+  const served = (response: Response): Response => {
+    debug.log('ops.api', 'served', { path: pathname, source: signal.operatorSource });
+    response.headers.set('cache-control', 'no-store');
+    return response;
+  };
+  if (pathname === '/v1/ops/seats') {
+    const date = url.searchParams.get('date') ?? todayKst();
+    if (!DATE.test(date) || Number.isNaN(Date.parse(`${date}T00:00:00+09:00`))) return jsonResponse({ error: 'invalid-date' }, 400);
+    seatsCache ??= createSeatsCache(liveSeatsSources());
+    return seatsCache(date).then((board) => served(jsonResponse(board)), () => jsonResponse({ error: 'seats-unavailable' }, 500));
+  }
+  const version = url.searchParams.get('version');
+  if (pathname === '/v1/ops/checklist') {
+    if (!version || !VERSION.test(version)) return jsonResponse({ error: 'invalid-version' }, 400);
+    return served(jsonResponse(listChecklist(version)));
+  }
+  if (pathname === '/v1/ops/release/runs') {
+    if (version !== null && !VERSION.test(version)) return jsonResponse({ error: 'invalid-version' }, 400);
+    const dir = join(effectiveInstanceRoot(), 'graph-runs', 'release-loop');
+    let filenames: string[];
+    try {
+      filenames = readdirSync(dir, { withFileTypes: true })
+        .filter((entry) => entry.isFile() && entry.name.endsWith('.json')
+          && IDENTIFIER.test(entry.name.slice(0, -5)))
+        .map((entry) => entry.name);
+    }
+    catch (error) {
+      if ((error as NodeJS.ErrnoException).code === 'ENOENT') return served(jsonResponse([]));
+      return jsonResponse({ error: 'runs-unavailable' }, 500);
+    }
+    const runs = filenames.flatMap((filename) => {
+      const run = recordAt(join(dir, filename));
+      if (!run) return [];
+      const v = runVersion(run.input);
+      if (version !== null && v !== version) return [];
+      return [{
+        runId: redactSecretText(filename.slice(0, -5)), status: redactSecretText(run.status),
+        startedAt: redactSecretText(run.startedAt), version: v,
+        path: run.path.filter((step): step is string => typeof step === 'string').map(redactSecretText),
+        nodes: run.nodes.filter((node) => node && typeof node.nodeId === 'string').map((node) => ({
+          nodeId: redactSecretText(node.nodeId), ok: typeof node.ok === 'boolean' ? node.ok : null,
+          summary: nodeSummary(node.output),
+        })),
+      }];
+    }).sort((a, b) => b.startedAt.localeCompare(a.startedAt)).slice(0, 20);
+    return served(jsonResponse(runs));
+  }
+  // WHATWG URL normalizes a literal runs/../nodes/... before routing.
+  if (pathname.startsWith('/v1/ops/release/nodes/')) return jsonResponse({ error: 'invalid-id' }, 400);
+  if (pathname.startsWith('/v1/ops/release/runs/')) {
+    const match = LOG_PATH.exec(pathname);
+    if (!match) return jsonResponse({ error: 'invalid-id' }, 400);
+    const [, id, nodeId] = match;
+    if (!IDENTIFIER.test(id!) || !IDENTIFIER.test(nodeId!)) return jsonResponse({ error: 'invalid-id' }, 400);
+    const run = recordAt(join(effectiveInstanceRoot(), 'graph-runs', 'release-loop', `${id}.json`));
+    const node = run?.nodes.find((candidate) => candidate?.nodeId === nodeId);
+    if (!node || node.output === undefined || node.output === null) return jsonResponse({ error: 'not-found' }, 404);
+    return served(jsonResponse({ log: redactSecretText(outputText(node.output)).slice(-4_000) }));
+  }
+  return jsonResponse({ error: 'not-found' }, 404);
+}