elanous 0.2.7 → 0.2.9

package/src/nexus/api/ops-seats-sources.ts

@@ -0,0 +1,65 @@
+// Live sources for /v1/ops/seats: the coordination PR and merged PRs through gh (automation App identity, proxy variables
+// removed — same rule as decision replies), the release checklist, and the decision ledger. Each failure becomes null upstream.
+import { DecisionLedger } from '../../decisions/decision-ledger.js';
+import { devVersion, listChecklist, type ChecklistItem } from '../../release-loop/checklist.js';
+import { getUserConfig } from '../../user-config.js';
+import { kstDayRange, type ChannelComment, type MergedPr, type SeatsSources } from './ops-seats.js';
+
+const GH_TIMEOUT_MS = 20_000;
+
+async function ghLines(args: string[]): Promise<string[] | null> {
+  const env: Record<string, string> = {};
+  for (const [k, v] of Object.entries(process.env)) if (v !== undefined && !/^(https?|all|no)_proxy$/i.test(k)) env[k] = v;
+  try {
+    const { githubAutomationToken } = await import('../../auth/github-app-token.js');
+    const token = githubAutomationToken();
+    if (token) env.GH_TOKEN = token;
+  } catch { /* machine login */ }
+  const proc = Bun.spawn(['gh', ...args], { stdin: 'ignore', stdout: 'pipe', stderr: 'ignore', env });
+  const timer = setTimeout(() => proc.kill(), GH_TIMEOUT_MS);
+  try {
+    const [out, code] = await Promise.all([new Response(proc.stdout).text(), proc.exited]);
+    return code === 0 ? out.split('\n').filter(Boolean) : null;
+  } finally { clearTimeout(timer); }
+}
+
+function channelTarget(): { repo: string; pr: string } | null {
+  const raw = (getUserConfig().raw?.decisions as { replyGhPr?: unknown } | undefined)?.replyGhPr;
+  const m = typeof raw === 'string' ? /^([\w.-]+\/[\w.-]+)#(\d+)$/.exec(raw.trim()) : null;
+  return m ? { repo: m[1]!, pr: m[2]! } : null;
+}
+
+function nextPatch(version: string): string {
+  const [major, minor, patch] = version.split('.').map(Number);
+  return `${major}.${minor}.${patch! + 1}`;
+}
+
+export function liveSeatsSources(): SeatsSources {
+  return {
+    async channel(date) {
+      const target = channelTarget();
+      if (!target) return null;
+      const lines = await ghLines(['api', '--paginate', `repos/${target.repo}/issues/${target.pr}/comments?since=${kstDayRange(date).start}&per_page=100`,
+        '--jq', '.[] | {body: .body, createdAt: .created_at} | tojson']);
+      return lines?.map((line) => JSON.parse(line) as ChannelComment) ?? null;
+    },
+    async merged(date) {
+      const target = channelTarget();
+      if (!target) return null;
+      const { start, end } = kstDayRange(date);
+      const lines = await ghLines(['pr', 'list', '--repo', target.repo, '--state', 'merged', '--limit', '300',
+        '--search', `merged:${start.slice(0, 19)}Z..${end.slice(0, 19)}Z`, '--json', 'number,title,body,mergedAt', '--jq', '.[] | tojson']);
+      return lines?.map((line) => JSON.parse(line) as MergedPr) ?? null;
+    },
+    checklist() {
+      const dev = devVersion();
+      const next = listChecklist(nextPatch(dev)).items;
+      const current = listChecklist(dev).items;
+      const all: ChecklistItem[] = [...current, ...next];
+      return { current: next.length ? next : current, all };
+    },
+    openDecisionRaisers() {
+      return new DecisionLedger().list({ status: 'open' }).map((entry) => entry.raisedBy.agent);
+    },
+  };
+}

package/src/nexus/api/ops-seats.ts

@@ -0,0 +1,114 @@
+// GET /v1/ops/seats?date=YYYY-MM-DD — one row per seat: latest channel line, PRs landed that day, red items, open decisions.
+// A source that could not be read is null, never 0 («못 읽음» ≠ «없음»). Contract: 내부 문서 `DESIGN-ops3-seat-board-and-public-demo-2026-10-02` §1.
+import { debug, redactSecretText } from '../../debug/log.js';
+import type { ChecklistItem } from '../../release-loop/checklist.js';
+import { canonicalSeatId } from '../../msg/msg-store.js';
+
+export const SEATS = [
+  { seat: 'OP', role: 'COO' }, { seat: 'TC', role: 'CTO' }, { seat: 'MK', role: 'CMO' }, { seat: 'UX', role: 'CXO' },
+] as const;
+export const SEATS_CACHE_MS = 60_000;
+
+export interface ChannelComment { body: string; createdAt: string }
+export interface MergedPr { number: number; title: string; body: string; mergedAt: string }
+export interface SeatsSources {
+  /** Coordination-channel comments created on `date` (KST) or later; null when unreadable. */
+  channel(date: string): Promise<ChannelComment[] | null>;
+  /** PRs merged on `date` (KST); null when unreadable. */
+  merged(date: string): Promise<MergedPr[] | null>;
+  /** Checklist items of the version being worked on (counts, red) and of every version known (id → owner). */
+  checklist(): { current: ChecklistItem[]; all: ChecklistItem[] } | null;
+  /** `raisedBy.agent` of every open decision. */
+  openDecisionRaisers(): string[] | null;
+}
+
+export interface SeatRow {
+  seat: string; role: string;
+  now: { text: string; at: string } | null;
+  landed: Array<{ pr: number; title: string; at: string; checklistId: string | null }> | null;
+  blocked: Array<{ id: string; title: string; status: 'red' }> | null;
+  pendingDecisions: number | null;
+  checklist: { green: number; yellow: number; red: number; done: number } | null;
+}
+
+function seatOf(value: string | undefined): string | null {
+  if (!value) return null;
+  try { return canonicalSeatId(value); } catch { return null; }
+}
+
+const clip = (text: string, max: number) => redactSecretText(text).slice(0, max);
+
+/** First checklist id that appears as a whole word in the title, else in the body. */
+function checklistIdOf(pr: MergedPr, ids: string[]): string | null {
+  for (const text of [pr.title, pr.body]) {
+    const found = ids.map((id) => ({ id, at: text.search(new RegExp(`(?<![A-Za-z0-9])${id.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}(?![A-Za-z0-9])`)) }))
+      .filter((hit) => hit.at >= 0).sort((a, b) => a.at - b.at || b.id.length - a.id.length);
+    if (found.length) return found[0]!.id;
+  }
+  return null;
+}
+
+export async function buildSeatsBoard(date: string, sources: SeatsSources): Promise<{ date: string; seats: SeatRow[] }> {
+  const [channel, merged] = await Promise.all([
+    sources.channel(date).catch(() => null), sources.merged(date).catch(() => null),
+  ]);
+  let checklist: ReturnType<SeatsSources['checklist']> = null;
+  try { checklist = sources.checklist(); } catch { checklist = null; }
+  let raisers: string[] | null = null;
+  try { raisers = sources.openDecisionRaisers(); } catch { raisers = null; }
+
+  const owners = new Map<string, string>();
+  for (const item of checklist?.all ?? []) { const seat = seatOf(item.owner); if (seat) owners.set(item.id, seat); }
+  const ids = [...owners.keys()];
+  const landedBySeat = new Map<string, NonNullable<SeatRow['landed']>>();
+  for (const pr of merged ?? []) {
+    const id = checklistIdOf(pr, ids);
+    const seat = id ? owners.get(id) : undefined;
+    if (!seat) continue; // ⛔ not by commit author — every seat lands through the same account.
+    landedBySeat.set(seat, [...(landedBySeat.get(seat) ?? []), { pr: pr.number, title: clip(pr.title, 80), at: pr.mergedAt, checklistId: id }]);
+  }
+
+  const seats = SEATS.map(({ seat, role }): SeatRow => {
+    const latest = channel?.filter((c) => c.body.trimStart().startsWith(`**[${seat}]**`)).sort((a, b) => b.createdAt.localeCompare(a.createdAt))[0];
+    const mine = checklist?.current.filter((item) => seatOf(item.owner) === seat);
+    return {
+      seat, role,
+      now: latest ? { text: clip(latest.body.trimStart().split('\n')[0]!, 120), at: latest.createdAt } : null,
+      landed: merged === null || checklist === null ? null : (landedBySeat.get(seat) ?? []).sort((a, b) => a.at.localeCompare(b.at)),
+      blocked: mine ? mine.filter((item) => item.status === 'red').map((item) => ({ id: item.id, title: clip(item.title, 80), status: 'red' as const })) : null,
+      pendingDecisions: raisers === null ? null : raisers.filter((agent) => seatOf(agent) === seat).length,
+      checklist: mine ? {
+        green: mine.filter((i) => i.status === 'green').length, yellow: mine.filter((i) => i.status === 'yellow').length,
+        red: mine.filter((i) => i.status === 'red').length, done: mine.filter((i) => i.status === 'done').length,
+      } : null,
+    };
+  });
+  debug.log('ops.seats', 'built', {
+    date, channel: channel === null ? 'unreadable' : channel.length, merged: merged === null ? 'unreadable' : merged.length,
+    checklist: checklist !== null, decisions: raisers !== null,
+  });
+  return { date, seats };
+}
+
+/** KST calendar day → [start, end) in UTC ISO. */
+export function kstDayRange(date: string): { start: string; end: string } {
+  const start = new Date(`${date}T00:00:00+09:00`);
+  return { start: start.toISOString(), end: new Date(start.getTime() + 86_400_000).toISOString() };
+}
+
+export function todayKst(now = new Date()): string {
+  return new Intl.DateTimeFormat('sv-SE', { timeZone: 'Asia/Seoul' }).format(now);
+}
+
+/** One snapshot per date for 60 s; concurrent requests share one build. */
+export function createSeatsCache(sources: SeatsSources, now: () => number = Date.now, ttlMs = SEATS_CACHE_MS) {
+  const slots = new Map<string, { at: number; value: Promise<{ date: string; seats: SeatRow[] }> }>();
+  return (date: string) => {
+    const slot = slots.get(date);
+    if (slot && now() - slot.at < ttlMs) return slot.value;
+    const value = buildSeatsBoard(date, sources);
+    slots.set(date, { at: now(), value });
+    value.catch(() => slots.delete(date));
+    return value;
+  };
+}

package/src/nexus/api/outbound-report.ts

@@ -44,6 +44,13 @@ function json(body: unknown, status: number): Response {
   });
 }
 
+/** The daemon's own sendOutbound path (OB8) — what POST /v1/outbound does, without the HTTP self-call. */
+export async function routeOutboundInProcess(text: string, kind: string): Promise<boolean> {
+  const result = await routeOutbound(getUserConfig(), { text, markdown: false, kind });
+  if (result.delivered) recordOutboundEvent(text, kind);
+  return result.delivered;
+}
+
 /** POST /v1/outbound — fan one message out to the routed channels. */
 export async function handleOutboundReport(req: Request, metaApi: MetaApiOpts): Promise<Response> {
   if (!checkAuth(req, metaApi)) return json({ error: 'unauthorized' }, 401);

package/src/nexus/api/public-routes.ts

@@ -36,6 +36,12 @@ export const PUBLIC_ROUTES: Array<PublicRoute> = [
     path: '/v1/push/vapid-public-key',
     why: 'PWA fetches the VAPID public key before a bearer is pasted',
   },
+  {
+    method: 'GET',
+    match: 'exact',
+    path: '/v1/me',
+    why: 'operator signal only (draw the ops area or not); false unless operator.enabled, no other data',
+  },
   {
     method: 'GET',
     match: 'exact',
@@ -56,6 +62,13 @@ export const PUBLIC_ROUTES: Array<PublicRoute> = [
     selfVerified: true,
     why: 'Pod GitHub App credential relay verifies its own run-scoped gh-credential token before minting a repository-scoped installation token',
   },
+  {
+    method: 'POST',
+    match: 'exact',
+    path: '/v1/setup/claim',
+    selfVerified: true,
+    why: 'one-use setup link is verified by the claim handler without an owner bearer',
+  },
   {
     method: 'GET',
     match: 'prefix',
@@ -76,7 +89,7 @@ export function isPublicRoute(
 ): boolean {
   for (const route of PUBLIC_ROUTES) {
     if (route.method !== method) continue;
-    if (route.path.startsWith('/v1/setup/') && !ctx.setupMode) continue;
+    if (route.path.startsWith('/v1/setup/') && route.path !== '/v1/setup/claim' && !ctx.setupMode) continue;
     if (route.match === 'exact') {
       if (pathname === route.path) return true;
     } else if (pathname === route.path || pathname.startsWith(route.path)) {

package/src/nexus/api/running-runs-background.ts

@@ -0,0 +1,68 @@
+// The terminals list must answer at once and must never share the event loop with a ledger scan: the running-runs query
+// reads every run ledger synchronously (~5k files · 0.9–1.8 s on 10-02), which froze typing in the web terminal while the
+// PWA polled the list. This keeps the last result as a snapshot and refreshes it in a separate bun process, on demand.
+import { join } from 'node:path';
+import { debug } from '../../debug/log.js';
+import type { RunningRunsResult } from '../../self-implement/running-runs.js';
+
+export const RUNNING_RUNS_REFRESH_MS = 15_000;
+/** A refresh that has not answered by then is abandoned; the next request starts another. */
+export const RUNNING_RUNS_REFRESH_TIMEOUT_MS = 60_000;
+
+export interface RunningRunsSnapshot {
+  /** Last result, or null before the first refresh finished (subjects then keep unknown assessments). */
+  readonly result: RunningRunsResult | null;
+  /** Milliseconds since `result` was computed; null when there is none. */
+  readonly ageMs: number | null;
+}
+
+/** Runs the query somewhere other than this event loop and resolves with its JSON output. */
+export type RunningRunsRunner = (includeTest: boolean) => Promise<RunningRunsResult>;
+
+export const RUNNING_RUNS_CHILD_SCRIPT = join(import.meta.dir, 'running-runs-child.ts');
+
+/** Default runner: `bun running-runs-child.ts [--include-test]` — the child does the ledger I/O, we only parse its stdout. */
+export const childProcessRunner: RunningRunsRunner = async (includeTest) => {
+  const proc = Bun.spawn([process.execPath, RUNNING_RUNS_CHILD_SCRIPT, ...(includeTest ? ['--include-test'] : [])], {
+    stdout: 'pipe', stderr: 'ignore', stdin: 'ignore', env: process.env,
+  });
+  const timer = setTimeout(() => proc.kill(), RUNNING_RUNS_REFRESH_TIMEOUT_MS);
+  try {
+    const [out, code] = await Promise.all([new Response(proc.stdout).text(), proc.exited]);
+    if (code !== 0) throw new Error(`running-runs child exit ${code}`);
+    return JSON.parse(out) as RunningRunsResult;
+  } finally { clearTimeout(timer); }
+};
+
+export interface RunningRunsBackground {
+  /** Never blocks: returns the last snapshot and starts a refresh when it is stale and none is in flight. */
+  snapshot(options: { includeTest?: boolean }): RunningRunsSnapshot;
+}
+
+export function createRunningRunsBackground(runner: RunningRunsRunner = childProcessRunner, now: () => number = Date.now, refreshMs = RUNNING_RUNS_REFRESH_MS): RunningRunsBackground {
+  const slots = new Map<boolean, { at: number; result: RunningRunsResult }>();
+  const flights = new Set<boolean>();
+  const refresh = (includeTest: boolean): void => {
+    if (flights.has(includeTest)) return;
+    flights.add(includeTest);
+    const started = now();
+    void runner(includeTest)
+      .then((result) => {
+        slots.set(includeTest, { at: now(), result });
+        debug.log('nexus.terminals', 'running-runs-refreshed', { includeTest, ms: now() - started });
+      })
+      .catch((error: unknown) => {
+        debug.log('nexus.terminals', 'running-runs-refresh-failed', { includeTest, reason: error instanceof Error ? error.message.slice(0, 80) : 'unknown' }, { level: 'warn' });
+      })
+      .finally(() => { flights.delete(includeTest); });
+  };
+  return {
+    snapshot(options) {
+      const includeTest = options.includeTest === true;
+      const slot = slots.get(includeTest);
+      const t = now();
+      if (!slot || t - slot.at >= refreshMs) refresh(includeTest);
+      return slot ? { result: slot.result, ageMs: t - slot.at } : { result: null, ageMs: null };
+    },
+  };
+}

package/src/nexus/api/running-runs-child.ts

@@ -0,0 +1,6 @@
+#!/usr/bin/env bun
+// Child of running-runs-background.ts: runs the running-runs query (all the ledger I/O) and prints the result as JSON.
+import { queryRunningRuns } from '../../self-implement/running-runs.js';
+
+const result = queryRunningRuns({ includeTest: process.argv.includes('--include-test'), caller: 'nexus.terminals' });
+process.stdout.write(JSON.stringify(result));

package/src/nexus/api/setup-claim.ts

@@ -0,0 +1,21 @@
+import { claimSetupLinkToken } from '../../auth/setup-link-tokens.js';
+import { jsonResponse } from './json-response.js';
+
+/** A setup link is its own credential; this handler never reads the owner bearer. */
+export async function handleSetupClaim(req: Request): Promise<Response> {
+  let body: unknown;
+  try {
+    body = await req.json();
+  } catch {
+    return jsonResponse({ error: 'bad_request' }, 400);
+  }
+  if (!body || typeof body !== 'object' || Array.isArray(body)
+    || typeof (body as Record<string, unknown>).t !== 'string'
+    || !(body as { t: string }).t.trim()) {
+    return jsonResponse({ error: 'bad_request' }, 400);
+  }
+
+  const result = claimSetupLinkToken((body as { t: string }).t);
+  if (!result.ok) return jsonResponse({ error: result.reason }, 401);
+  return jsonResponse({ scope: 'setup', bearer: result.bearer, expiresAt: result.expiresAt });
+}

package/src/nexus/api/share-captures.ts

@@ -0,0 +1,91 @@
+// SC1 — 앱 안 «공유용 캡처»(beta) 받는 쪽. PWA 가 화면을 가린 뒤 PNG 로 올린다(티저·현장·보고용).
+// POST /v1/captures          body = image/png(≤ 8 MiB) → { id, bytes, droppedChunks }
+// GET  /v1/captures          → { items: [{ id, bytes, at }] } (최신 먼저 · 50개)
+// GET  /v1/captures/<id>     → image/png
+// ⛔ 두 번째 방어: 받은 PNG 에서 «그림 아닌» 덩어리(tEXt·iTXt·zTXt·eXIf·iCCP·tIME 등 메타)를 전부 걷고 저장한다 —
+//    화면 쪽 가림이 놓친 것이 파일 메타로 새지 않게. 남기는 것은 그림을 그리는 데 필요한 덩어리뿐이다.
+import { randomBytes } from 'node:crypto';
+import { existsSync, mkdirSync, readdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { debug } from '../../debug/log.js';
+import { getElanousConfigDir } from '../../elanous-config-dir.js';
+import { jsonResponse } from './json-response.js';
+import { checkAuth, type MetaApiOpts } from './meta-api.js';
+
+export const SHARE_CAPTURES_PATH = '/v1/captures';
+const MAX_BYTES = 8 * 1024 * 1024;
+const PNG_SIGNATURE = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]);
+/** Chunks needed to draw the picture. Everything else (text, EXIF, ICC profile, time…) is dropped. */
+const KEEP = new Set(['IHDR', 'PLTE', 'IDAT', 'IEND', 'tRNS', 'gAMA', 'cHRM', 'sRGB', 'pHYs']);
+const ID = /^share-\d{8}-\d{6}-[0-9a-f]{6}$/;
+
+export interface ShareCapturesDeps { configDir?: string; now?: () => Date }
+
+/** Rebuild a PNG with only drawing chunks. Returns null when it is not a well-formed PNG. */
+export function stripPngMetadata(input: Uint8Array): { png: Buffer; dropped: string[] } | null {
+  const buf = Buffer.from(input);
+  if (buf.length < 8 + 12 || !buf.subarray(0, 8).equals(PNG_SIGNATURE)) return null;
+  const parts: Buffer[] = [PNG_SIGNATURE];
+  const dropped: string[] = [];
+  let offset = 8;
+  let sawHeader = false;
+  let sawEnd = false;
+  while (offset + 12 <= buf.length) {
+    const length = buf.readUInt32BE(offset);
+    const type = buf.subarray(offset + 4, offset + 8).toString('latin1');
+    const end = offset + 12 + length;
+    if (end > buf.length || !/^[A-Za-z]{4}$/.test(type)) return null;
+    if (!sawHeader && type !== 'IHDR') return null;
+    sawHeader = true;
+    if (KEEP.has(type)) parts.push(buf.subarray(offset, end)); else dropped.push(type);
+    offset = end;
+    if (type === 'IEND') { sawEnd = true; break; }
+  }
+  if (!sawEnd) return null;
+  return { png: Buffer.concat(parts), dropped };
+}
+
+function capturesDir(deps: ShareCapturesDeps): string {
+  return join(deps.configDir ?? getElanousConfigDir(), 'captures');
+}
+
+function newId(now: Date): string {
+  const p = (n: number) => String(n).padStart(2, '0');
+  return `share-${now.getFullYear()}${p(now.getMonth() + 1)}${p(now.getDate())}-${p(now.getHours())}${p(now.getMinutes())}${p(now.getSeconds())}-${randomBytes(3).toString('hex')}`;
+}
+
+export async function handleShareCaptures(req: Request, metaApi: MetaApiOpts, deps: ShareCapturesDeps = {}): Promise<Response> {
+  if (!checkAuth(req, metaApi)) return jsonResponse({ error: 'unauthorized' }, 401);
+  const pathname = new URL(req.url).pathname;
+  const dir = capturesDir(deps);
+
+  if (pathname === SHARE_CAPTURES_PATH && req.method === 'POST') {
+    const declared = Number(req.headers.get('content-length') ?? 0);
+    if (declared > MAX_BYTES) return jsonResponse({ error: 'too-large', maxBytes: MAX_BYTES }, 413);
+    const body = new Uint8Array(await req.arrayBuffer());
+    if (body.byteLength > MAX_BYTES) return jsonResponse({ error: 'too-large', maxBytes: MAX_BYTES }, 413);
+    const cleaned = stripPngMetadata(body);
+    if (!cleaned) return jsonResponse({ error: 'not-png' }, 400);
+    const id = newId((deps.now ?? (() => new Date()))());
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    writeFileSync(join(dir, `${id}.png`), cleaned.png, { mode: 0o600, flag: 'wx' });
+    debug.log('share-capture', 'stored', { id, bytes: cleaned.png.length, dropped: cleaned.dropped });
+    return jsonResponse({ id, bytes: cleaned.png.length, droppedChunks: cleaned.dropped }, 201);
+  }
+
+  if (pathname === SHARE_CAPTURES_PATH && req.method === 'GET') {
+    const items = existsSync(dir)
+      ? readdirSync(dir).filter((f) => f.endsWith('.png') && ID.test(f.slice(0, -4))).sort().reverse().slice(0, 50)
+        .map((f) => { const s = statSync(join(dir, f)); return { id: f.slice(0, -4), bytes: s.size, at: s.mtime.toISOString() }; })
+      : [];
+    return jsonResponse({ items });
+  }
+
+  const id = pathname.slice(SHARE_CAPTURES_PATH.length + 1);
+  if (req.method === 'GET' && ID.test(id)) {
+    const file = join(dir, `${id}.png`);
+    if (!existsSync(file)) return jsonResponse({ error: 'not-found' }, 404);
+    return new Response(readFileSync(file), { headers: { 'content-type': 'image/png', 'cache-control': 'no-store' } });
+  }
+  return jsonResponse({ error: 'not-found' }, 404);
+}

package/src/nexus/api/skill-problems.ts

@@ -0,0 +1,56 @@
+// SK2 (PWA) — 색인이 못 읽은 스킬을 PWA 에도 «안내 ⊕ 확인 뒤 수리»로.
+// GET  /v1/skills/problems           → { items: [{ id, name, code, fixable, hint? }] } — 경로 대신 해시 id 만 내보낸다
+// POST /v1/skills/problems/repair    → body { id } · 고칠 수 있는 것만 고친다(남의 도구 파일 — PWA 가 먼저 확인을 받는다)
+import { createHash } from 'node:crypto';
+import { debug } from '../../debug/log.js';
+import { getSkillIndex, skillIndexProblems, type SkillIndexProblem } from '../../skills/index.js';
+import { applySkillRepair, planSkillRepair } from '../../skills/repair.js';
+import { jsonResponse } from './json-response.js';
+import { checkAuth, type MetaApiOpts } from './meta-api.js';
+
+export const SKILL_PROBLEMS_PATH = '/v1/skills/problems';
+
+export interface SkillProblemsDeps {
+  problems?: () => SkillIndexProblem[];
+}
+
+function problemId(p: SkillIndexProblem): string {
+  return createHash('sha256').update(`${p.dir}\u0000${p.name}`).digest('hex').slice(0, 16);
+}
+
+function current(deps: SkillProblemsDeps): SkillIndexProblem[] {
+  if (deps.problems) return deps.problems();
+  getSkillIndex();
+  return skillIndexProblems();
+}
+
+export async function handleSkillProblems(req: Request, metaApi: MetaApiOpts, deps: SkillProblemsDeps = {}): Promise<Response> {
+  if (!checkAuth(req, metaApi)) return jsonResponse({ error: 'unauthorized' }, 401);
+  const pathname = new URL(req.url).pathname;
+  if (pathname === SKILL_PROBLEMS_PATH) {
+    if (req.method !== 'GET') return jsonResponse({ error: 'method-not-allowed' }, 405);
+    const items = current(deps).map((p) => {
+      const plan = planSkillRepair(p);
+      return {
+        id: problemId(p), name: p.name, code: p.code,
+        fixable: plan.kind === 'fixable' || plan.kind === 'fixable-permission',
+        ...(plan.kind === 'permission' || plan.kind === 'manual' ? { hint: plan.hint.replace(p.dir, '…') } : {}),
+      };
+    });
+    return jsonResponse({ items });
+  }
+  if (pathname === `${SKILL_PROBLEMS_PATH}/repair`) {
+    if (req.method !== 'POST') return jsonResponse({ error: 'method-not-allowed' }, 405);
+    let body: unknown;
+    try { body = await req.json(); } catch { return jsonResponse({ error: 'bad_request' }, 400); }
+    const id = body && typeof body === 'object' && typeof (body as { id?: unknown }).id === 'string' ? (body as { id: string }).id : '';
+    const problem = current(deps).find((p) => problemId(p) === id);
+    if (!problem) return jsonResponse({ error: 'not-found' }, 404);
+    const plan = planSkillRepair(problem);
+    if (plan.kind !== 'fixable' && plan.kind !== 'fixable-permission') return jsonResponse({ error: 'not-fixable', hint: plan.hint.replace(problem.dir, '…') }, 409);
+    const result = applySkillRepair(plan);
+    debug.log('skills.repair', 'pwa-request', { name: problem.name, ok: result.ok });
+    return result.ok ? jsonResponse({ ok: true, name: problem.name }) : jsonResponse({ ok: false, reason: result.reason }, 409);
+  }
+  return jsonResponse({ error: 'not-found' }, 404);
+}

package/src/nexus/api/terminals.ts

@@ -34,6 +34,7 @@ import { classifyPtyOwnerRunUsage, joinPtyLineage, resolveRunTermination, type P
 import { loadRunLedger, resolveFederatedRunLedgerDirectories, runLedgerDir } from '../../self-implement/run-ledger.js';
 import { requestRemotePtyControl, type PtyControlAction, type PtyControlPayload, type PtyControlRequestOptions, type PtyControlResult } from '../../pty-shell/pty-control-ipc.js';
 import { encodeSgrMouse, type PtyMouseInput } from '../../pty-shell/pty-mouse.js';
+import { createRunningRunsBackground, type RunningRunsBackground } from './running-runs-background.js';
 import { queryRunningRuns, type RunningRunAssessment, type RunningRunPresence, type RunningRunStatus, type RunningRunsResult } from '../../self-implement/running-runs.js';
 // ⭐P4 §4-1 — 표시 폭(wide-char/CJK/emoji 인지) SSOT. PNG 캔버스 cols 파생용.
 import { cellWidth } from '../../ui/printer.js';
@@ -494,6 +495,12 @@ function runningRunsCacheFor(
   return binding.cache;
 }
 
+let liveBackground: RunningRunsBackground | null = null;
+function liveRunningRunsBackground(): RunningRunsBackground {
+  liveBackground ??= createRunningRunsBackground();
+  return liveBackground;
+}
+
 const liveTerminalsListDeps: TerminalsListDeps = {
   ptyManifestTargets,
   listPtyManifestRows,
@@ -1054,17 +1061,26 @@ export function handleTerminalsList(req: Request, opts: MetaApiOpts, deps: Termi
   const resolveRunTerminationForRow = (runId: string): RunTermination => deps.runTerminated
     ? deps.runTerminated(runId, { includeTest })
     : 'ledger-indeterminate';
-  const runningRunsCache = runningRunsCacheFor(getRunningRuns, deps.now ?? Date.now);
   let runningRuns: RunningRunsResult | null = null;
   let runningRunsAgeMs = 0;
   let runningRunsQueryFailed = false;
-  try {
-    const cached = runningRunsCache({ includeTest });
-    runningRuns = cached.result;
-    runningRunsAgeMs = cached.ageMs;
-  } catch {
-    // Fail-soft and do not cache: subjects keep unknown assessments.
-    runningRunsQueryFailed = true;
+  if (getRunningRuns === queryRunningRuns) {
+    // Live daemon: never scan ledgers on this event loop (it froze web-terminal typing) — use the last snapshot a
+    // separate process refreshed. Before the first one lands, subjects keep unknown assessments and the age is null.
+    const snap = liveRunningRunsBackground().snapshot({ includeTest });
+    runningRuns = snap.result;
+    if (snap.ageMs === null) runningRunsQueryFailed = true;
+    else runningRunsAgeMs = snap.ageMs;
+  } else {
+    const runningRunsCache = runningRunsCacheFor(getRunningRuns, deps.now ?? Date.now);
+    try {
+      const cached = runningRunsCache({ includeTest });
+      runningRuns = cached.result;
+      runningRunsAgeMs = cached.ageMs;
+    } catch {
+      // Fail-soft and do not cache: subjects keep unknown assessments.
+      runningRunsQueryFailed = true;
+    }
   }
   const ptyLessSubAgentCollection = collectPtyLessSubAgents(
     getLogStore,

package/src/nexus/config/secrets/file-backend.ts

@@ -5,8 +5,10 @@
 // without touching caller code. The legacy module re-exports this
 // backend's accessor functions to preserve backwards compatibility.
 
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, writeFileSync, renameSync, copyFileSync, unlinkSync, chmodSync } from 'node:fs';
+import { randomUUID } from 'node:crypto';
 import { dirname } from 'node:path';
+import { acquireLockSync } from '../../../storage/file-lock.js';
 import { SECRETS_VERSION, type SecretsFile } from '../types.js';
 import { secretsPath } from '../paths.js';
 import type { SecretBackend, SecretBackendAvailability, SyncReadableBackend } from './types.js';
@@ -21,20 +23,47 @@ function readSecretsFile(): SecretsFile {
   try {
     const raw = readFileSync(path, 'utf-8');
     const parsed = JSON.parse(raw) as Partial<SecretsFile>;
-    if (parsed.version !== SECRETS_VERSION) return defaultSecrets();
-    return {
-      version: SECRETS_VERSION,
-      secrets: (parsed.secrets ?? {}) as Record<string, string>,
-    };
-  } catch {
-    return defaultSecrets();
+    if (parsed?.version !== SECRETS_VERSION || !parsed.secrets || typeof parsed.secrets !== 'object'
+      || Array.isArray(parsed.secrets) || Object.values(parsed.secrets).some(value => typeof value !== 'string')) {
+      throw new Error('invalid secrets file version or contents');
+    }
+    return { version: SECRETS_VERSION, secrets: parsed.secrets };
+  } catch (error) {
+    throw new Error(`cannot read secrets file at ${path}`, { cause: error });
   }
 }
 
 function writeSecretsFile(s: SecretsFile): void {
   const path = secretsPath();
   mkdirSync(dirname(path), { recursive: true });
-  writeFileSync(path, JSON.stringify(s, null, 2), { mode: 0o600 });
+  const tmp = `${path}.${randomUUID()}.tmp`;
+  const backupTmp = `${path}.${randomUUID()}.bak.tmp`;
+  try {
+    writeFileSync(tmp, JSON.stringify(s, null, 2), { mode: 0o600, flag: 'wx' });
+    if (existsSync(path)) {
+      copyFileSync(path, backupTmp);
+      chmodSync(backupTmp, 0o600);
+      renameSync(backupTmp, `${path}.bak`);
+    }
+    renameSync(tmp, path);
+  } finally {
+    if (existsSync(tmp)) unlinkSync(tmp);
+    if (existsSync(backupTmp)) unlinkSync(backupTmp);
+  }
+}
+
+function modifySecretsFile(change: (s: SecretsFile) => boolean): boolean {
+  const path = secretsPath();
+  mkdirSync(dirname(path), { recursive: true });
+  const release = acquireLockSync(`${path}.lock`);
+  try {
+    const s = readSecretsFile();
+    if (!change(s)) return false;
+    writeSecretsFile(s);
+    return true;
+  } finally {
+    release();
+  }
 }
 
 const syncReadable: SyncReadableBackend = {
@@ -46,16 +75,14 @@ export const fileBackend: SecretBackend = {
   id: 'file',
   async get(id) { return syncReadable.getSync(id); },
   async set(id, value) {
-    const s = readSecretsFile();
-    s.secrets[id] = value;
-    writeSecretsFile(s);
+    modifySecretsFile(s => { s.secrets[id] = value; return true; });
   },
   async delete(id) {
-    const s = readSecretsFile();
-    if (!(id in s.secrets)) return false;
-    delete s.secrets[id];
-    writeSecretsFile(s);
-    return true;
+    return modifySecretsFile(s => {
+      if (!Object.hasOwn(s.secrets, id)) return false;
+      delete s.secrets[id];
+      return true;
+    });
   },
   async list() { return syncReadable.listSync(); },
   async isAvailable(): Promise<SecretBackendAvailability> {
@@ -74,5 +101,16 @@ export function readSecretsFileRaw(): SecretsFile {
 }
 
 export function writeSecretsFileRaw(s: SecretsFile): void {
-  writeSecretsFile(s);
+  if (s.version !== SECRETS_VERSION || !s.secrets || typeof s.secrets !== 'object'
+    || Array.isArray(s.secrets) || Object.values(s.secrets).some(value => typeof value !== 'string')) {
+    throw new Error('invalid secrets file version or contents');
+  }
+  const path = secretsPath();
+  mkdirSync(dirname(path), { recursive: true });
+  const release = acquireLockSync(`${path}.lock`);
+  try {
+    writeSecretsFile(s);
+  } finally {
+    release();
+  }
 }