elanous 0.2.8 → 0.2.10

package/src/nexus/api/exec-requests.ts

@@ -1,5 +1,9 @@
-import { extname } from 'node:path';
+import { realpathSync, statSync } from 'node:fs';
+import { extname, isAbsolute, join, sep } from 'node:path';
 import { ExecRequestRunner } from '../../exec-requests/runner.js';
+import type { ExecAttachment } from '../../exec-requests/store.js';
+import { getElanousConfigDir } from '../../elanous-config-dir.js';
+import { defaultAttachmentBaseDir } from '../../boot/attachment-store.js';
 import { jsonResponse } from './json-response.js';
 
 const mime: Record<string, string> = {
@@ -8,7 +12,21 @@ const mime: Record<string, string> = {
   '.md': 'text/markdown; charset=utf-8', '.txt': 'text/plain; charset=utf-8',
 };
 
-export async function handleExecRequests(req: Request, runner: ExecRequestRunner): Promise<Response> {
+function resolveAttachment(path: string, roots: string[]): string | null {
+  if (!isAbsolute(path)) return null;
+  try {
+    const real = realpathSync(path);
+    if (!statSync(real).isFile()) return null;
+    return roots.some(root => {
+      try {
+        const base = realpathSync(root);
+        return real.startsWith(`${base}${sep}`);
+      } catch { return false; }
+    }) ? real : null;
+  } catch { return null; }
+}
+
+export async function handleExecRequests(req: Request, runner: ExecRequestRunner, uploadDir = defaultAttachmentBaseDir(), fieldDir = join(getElanousConfigDir(), 'field')): Promise<Response> {
   const path = new URL(req.url).pathname;
   if (path === '/v1/exec-requests') {
     if (req.method === 'POST') {
@@ -16,7 +34,19 @@ export async function handleExecRequests(req: Request, runner: ExecRequestRunner
       try { body = await req.json(); } catch { return jsonResponse({ error: 'bad_request' }, 400); }
       const text = body && typeof body === 'object' && !Array.isArray(body) ? (body as { text?: unknown }).text : undefined;
       if (typeof text !== 'string' || !text.trim()) return jsonResponse({ error: 'bad_request', reason: 'text required' }, 400);
-      const item = runner.submit(text.trim());
+      const supplied = (body as { attachments?: unknown }).attachments;
+      if (supplied !== undefined && (!Array.isArray(supplied) || supplied.some(entry =>
+        !entry || typeof entry !== 'object' || Array.isArray(entry)
+        || typeof entry.name !== 'string' || !entry.name.trim() || typeof entry.path !== 'string'))) {
+        return jsonResponse({ error: 'bad_request', reason: 'attachments must be [{name,path}]' }, 400);
+      }
+      const roots = [uploadDir, fieldDir];
+      const resolved: Array<{ name: string; path: string | null }> | undefined = supplied?.map((entry: ExecAttachment) => ({
+        name: entry.name, path: resolveAttachment(entry.path, roots),
+      }));
+      if (resolved?.some(entry => !entry.path)) return jsonResponse({ error: 'attachment-outside' }, 400);
+      const attachments: ExecAttachment[] | undefined = resolved?.map(entry => ({ name: entry.name, path: entry.path! }));
+      const item = runner.submit(text.trim(), attachments);
       return jsonResponse({ id: item.id, status: 'planning' }, 202);
     }
     if (req.method === 'GET') return jsonResponse({ items: runner.store.list().map(item => {

package/src/nexus/api/http-server.ts

@@ -19,6 +19,8 @@ import { setInProcessOutbound } from '../../domains/outbound-alert.js';
 import { getUserConfig } from '../../user-config.js';
 import type { TelegramEvent } from '../../workflow-runtime/triggers/telegram-source.js';
 import { spawnSync } from 'node:child_process';
+import { isAbsolute } from 'node:path';
+import { createProject, listProjects } from '../../project/project-store.js';
 import { compareTokenConstTime } from '../../acp/transport/auth.js';
 import { ensureAuthToken } from '../../auth/acp-token.js';
 import type { NexusState } from '../state/state.js';
@@ -134,6 +136,7 @@ import {
   type ReflectionRouteOpts,
 } from './reflection.js';
 import { handleSignalBoard } from './signal-board-api.js';
+import { handleUsageGet } from './usage-api.js';
 import {
   handleDashboard,
   handleDashboardRefreshLive,
@@ -155,11 +158,15 @@ import {
 import { handleBuildsGet, parseBuildsPath } from './builds-api.js';
 import { handleHarnessAskPost, handleHarnessAskStatusGet, handleHarnessRunEventsGet, handleHarnessRunScreenGet, handleHarnessRunsGet, handleHarnessStopPost } from './harness-api.js';
 import { dispatchPersonaRoute } from './personas.js';
+import { handleMe } from './operator.js';
+import { handleOpsApi } from './ops-api.js';
 import { handleRoleJudge } from './role-judge.js';
 import { handleAudioStt } from './audio-stt.js';
 import { handleLlmModels } from './llm-models.js';
 import { handleLlmHostsConfig } from './llm-hosts-config.js';
 import { handleLlmRotationGet, handleLlmRotationNext } from './llm-rotation.js';
+import { handleSetupClaim } from './setup-claim.js';
+import { handleSetupCodexLoginGet, handleSetupCodexLoginPost } from './setup-codex-login.js';
 import {
   handleLlmProvidersList,
   handleLlmProviderSet,
@@ -275,7 +282,7 @@ import { handleSchedulesActionPost } from './schedules-action.js';
 import { handleSchedulesList, handleScheduleDetail, handleScheduleRuns } from './schedules-read.js';
 import { handleIntakeRunsList } from './intake-runs.js';
 import { handleMissionsList, handleMissionDetail } from './missions.js';
-import { handleSessionsStoreList, handleSessionsStoreGet, handleSessionsStoreFork, handleSessionsStoreDelete } from './sessions-store.js';
+import { handleSessionsStoreList, handleSessionsStoreGet, handleSessionsStoreFork, handleSessionsStoreDelete, handleSessionsStorePatch } from './sessions-store.js';
 import { handleLogsQuery, handleLogsStream, handleLogsLevelGet, handleLogsLevelPost, handleLogsFacets, handleLogsHistogram, handleLogsInstances } from './log-fabric.js';
 import { handleTrace, handleTraceEvidence } from './trace.js';
 import { handleDispatchRunsList } from './dispatch-runs.js';
@@ -312,6 +319,7 @@ import {
   handleVoiceTranscribe,
   checkAuth,
   bearerCredential,
+  setupBearerScopeDenied,
   registerAuthPeerAddress,
   type MetaApiOpts,
 } from './meta-api.js';
@@ -461,6 +469,8 @@ export interface NexusHttpServerOpts {
   state: NexusState;
   registry: TabRegistry;
   eventBus: NexusEventBus;
+  /** Test seam for the read-only usage collector; production uses the cached handler. */
+  usageHandler?: () => Promise<Response>;
   /** Supervisor handle — required for the write API (PR ι). When omitted
    *  (skipSupervisor mode), mutation routes return 503. */
   supervisor?: Supervisor;
@@ -791,6 +801,27 @@ export function startNexusHttpServer(opts: NexusHttpServerOpts): NexusHttpServer
   };
 }
 
+export function handleProjectsGet(): Response {
+  return jsonResponse({ projects: listProjects() });
+}
+
+export async function handleProjectsPost(req: Request): Promise<Response> {
+  let body: unknown;
+  try { body = await req.json(); }
+  catch { return jsonResponse({ error: 'invalid_json' }, 400); }
+  if (!body || typeof body !== 'object' || Array.isArray(body)) {
+    return jsonResponse({ error: 'invalid_name' }, 400);
+  }
+  const { name, primaryFolder } = body as Record<string, unknown>;
+  if (typeof name !== 'string' || !name.trim() || name.length > 80) {
+    return jsonResponse({ error: 'invalid_name' }, 400);
+  }
+  if (primaryFolder !== undefined && (typeof primaryFolder !== 'string' || !isAbsolute(primaryFolder))) {
+    return jsonResponse({ error: 'invalid_primary_folder' }, 400);
+  }
+  return jsonResponse({ project: createProject({ name, ...(primaryFolder !== undefined ? { primaryFolder } : {}) }) }, 201);
+}
+
 function isPortBusy(err: unknown): boolean {
   if (!err) return false;
   // Bun.serve errors expose `.code === 'EADDRINUSE'` (Node-compatible)
@@ -826,6 +857,9 @@ export async function routeRequest(
   registerAuthPeerAddress(req, (server as BunServerLike & {
     requestIP?: (request: Request) => { address: string } | null;
   }).requestIP?.(req)?.address);
+  if (opts.metaApi && setupBearerScopeDenied(req, opts.metaApi)) {
+    return jsonResponse({ error: 'forbidden' }, 403);
+  }
 
   // PR c — try WS upgrade before HTTP routing. On undefined return the
   // bridge has accepted the upgrade (Bun completes the handshake) and
@@ -852,6 +886,12 @@ export async function routeRequest(
   const { pathname } = url;
   const method = req.method;
 
+  // Operator proxy credentials are distinct from the owner bearer. The ops handler
+  // performs its own operatorSignal gate before reading any run or checklist data.
+  if (pathname === '/v1/ops' || pathname.startsWith('/v1/ops/')) {
+    return handleOpsApi(req, opts.metaApi);
+  }
+
   // Default-deny for every `/v1/` path that is not on PUBLIC_ROUTES.
   // Reuses checkAuth (same-origin exemption + constant-time bearer).
   // setupMode is not implemented on this server (P24b) — pass false.
@@ -1272,11 +1312,22 @@ export async function routeRequest(
     return handleGraphsValidatePost(req, opts.metaApi);
   }
 
+  if (pathname === '/v1/projects' && (method === 'GET' || method === 'POST')) {
+    if (!opts.metaApi || !checkAuth(req, opts.metaApi)) return jsonResponse({ error: 'unauthorized' }, 401);
+    return method === 'GET' ? handleProjectsGet() : handleProjectsPost(req);
+  }
+
   if (pathname === '/v1/config/chat-fast-path' && (method === 'GET' || method === 'PUT')) {
     if (!opts.metaApi || !checkAuth(req, opts.metaApi)) return jsonResponse({ error: 'unauthorized' }, 401);
     return handleChatFastPathConfig(req);
   }
 
+  if (pathname === '/v1/usage') {
+    if (!opts.metaApi || !checkAuth(req, opts.metaApi)) return jsonResponse({ error: 'unauthorized' }, 401);
+    if (method !== 'GET') return jsonResponse({ error: 'method-not-allowed' }, 405);
+    return (opts.usageHandler ?? handleUsageGet)();
+  }
+
   // Mutation routes (PR ι) — POST/PATCH/DELETE on /v1/nexus/tabs[/:id[/action]].
   // Templates POST handled here too (PR κ).
   // Config / secrets PUT/POST/DELETE here too (PR μ).
@@ -1520,9 +1571,18 @@ export async function routeRequest(
     if (pathname === '/v1/llm/rotation' && method === 'OPTIONS') {
       return handleLlmRotationGet(req);
     }
+    // The one-use link is verified by the claim handler, not by the owner bearer.
+    if (pathname === '/v1/setup/claim' && (method === 'POST' || method === 'OPTIONS')) {
+      return method === 'OPTIONS' ? corsPreflight('POST, OPTIONS') : handleSetupClaim(req);
+    }
     // PWA `/setup` wizard Phase 1 (2026-05-19) — LLM provider 첫 셋업.
     // POST 는 mutation 블록 안에서 등록 (memory `feedback_post_route_must_be_in_method_block`).
     // GET sibling 은 아래 GET-only 블록에 등록.
+    if (pathname === '/v1/setup/codex-login' && (method === 'POST' || method === 'OPTIONS')) {
+      if (method === 'OPTIONS') return corsPreflight('GET, POST, OPTIONS');
+      if (!opts.metaApi || !checkAuth(req, opts.metaApi)) return jsonResponse({ error: 'unauthorized' }, 401);
+      return handleSetupCodexLoginPost(req);
+    }
     if (pathname === '/v1/setup/llm-provider' && (method === 'POST' || method === 'OPTIONS')) {
       if (method === 'POST') { if (!opts.metaApi || !checkAuth(req, opts.metaApi)) return jsonResponse({ error: 'unauthorized' }, 401); }
       return handleLlmProviderSet(req);
@@ -1887,6 +1947,11 @@ export async function routeRequest(
       const id = decodeURIComponent(pathname.slice('/v1/sessions/store/'.length, -'/fork'.length));
       return handleSessionsStoreFork(req, id, opts.metaApi);
     }
+    if (pathname.startsWith('/v1/sessions/store/') && !pathname.endsWith('/fork') && method === 'PATCH') {
+      if (!opts.metaApi) return jsonResponse({ error: 'unauthorized' }, 401);
+      const id = decodeURIComponent(pathname.slice('/v1/sessions/store/'.length));
+      return handleSessionsStorePatch(req, id, opts.metaApi);
+    }
     // on-disk 세션 삭제(파괴적) — 라이브 세션 관리. /store/:id (fork/transcript 와 구분).
     if (pathname.startsWith('/v1/sessions/store/') && !pathname.endsWith('/fork') && method === 'DELETE') {
       if (!opts.metaApi) return jsonResponse({ error: 'meta-api-runtime-not-wired' }, 503);
@@ -2153,6 +2218,9 @@ export async function routeRequest(
     }
     return jsonResponse({ error: 'static-not-wired' }, 404);
   }
+  // OPS1·OPS2 — whether this caller is an operator (draws the ops area). Answers everyone before any auth gate;
+  // false unless this daemon's config has operator.enabled.
+  if (pathname === '/v1/me' && req.method === 'GET') return handleMe(req, opts.metaApi ?? ({} as MetaApiOpts));
   if (pathname === '/v1/health') {
     return handleHealth(opts.state, opts.registry, {
       bindHost: bind.hostname,
@@ -2405,6 +2473,10 @@ export async function routeRequest(
   }
   // PWA `/setup` wizard Phase 1 (2026-05-19) — provider catalog 표시.
   // POST sibling (`/v1/setup/llm-provider`) 는 위 mutation 블록.
+  if (pathname === '/v1/setup/codex-login') {
+    if (!opts.metaApi || !checkAuth(req, opts.metaApi)) return jsonResponse({ error: 'unauthorized' }, 401);
+    return handleSetupCodexLoginGet();
+  }
   if (pathname === '/v1/setup/llm-providers') {
     return handleLlmProvidersList(req);
   }

package/src/nexus/api/meta-api.ts

@@ -16,6 +16,7 @@
 
 import { randomUUID } from 'node:crypto';
 import { matchTempToken } from '../../auth/temp-tokens.js';
+import { matchSetupBearer } from '../../auth/setup-link-tokens.js';
 import { existsSync, readFileSync, statSync } from 'node:fs';
 import { extname } from 'node:path';
 
@@ -146,6 +147,10 @@ export interface MetaApiOpts {
    *  compared constant-time against the `Authorization: Bearer …`
    *  header. */
   bearerToken?: string;
+  /** Server-side human identity verification, independent of the shared bearer credential.
+   *  Never derive this result from request body, claimed source, or bearer possession alone.
+   *  Without a verifier, prompt tool mutations remain unavailable. */
+  resolveVerifiedOwner?: (req: Request) => { id: string } | undefined;
   /** Convenience for Tailscale-only / dogfood-loopback mode. */
   noAuth?: boolean;
   // ── PR k · runtime DI for the lifted endpoints ─────────────────
@@ -215,6 +220,8 @@ type AuthReason =
   | 'untrusted-same-origin-peer'
   | 'bearer-match'
   | 'temp-token'
+  | 'setup-bearer'
+  | 'setup-scope-denied'
   | 'no-bearer-configured'
   | 'missing-auth-header'
   | 'bearer-length-mismatch'
@@ -248,8 +255,27 @@ export function registerAuthPeerAddress(req: Request, peerAddress: string | unde
   authPeerAddresses.set(req, peerAddress);
 }
 
+function setupRouteAllowed(req: Request): boolean {
+  const path = new URL(req.url).pathname;
+  if (path.startsWith('/v1/setup/')) return true;
+  return (req.method === 'POST' && path === '/v1/prompt/stream')
+    || (req.method === 'GET' && (
+      /^\/v1\/sessions\/store\/[^/]+$/.test(path) || path === '/v1/chat/events'
+    ));
+}
+
 function decideAuth(req: Request, opts: MetaApiOpts): { ok: boolean; reason: AuthReason } {
   if (opts.noAuth) return { ok: true, reason: 'noauth' };
+  const offered = req.headers.get('authorization');
+  if (offered?.startsWith('Bearer elsb_')) {
+    const owner = decideBearer(req, opts);
+    if (owner.ok) return owner;
+    const bearer = offered.slice('Bearer '.length).trim();
+    if (!matchSetupBearer(bearer)) return { ok: false, reason: 'bearer-mismatch' };
+    return setupRouteAllowed(req)
+      ? { ok: true, reason: 'setup-bearer' }
+      : { ok: false, reason: 'setup-scope-denied' };
+  }
   const peerAddress = authPeerAddresses.get(req);
   if (isSameOriginRequest(req, peerAddress)) return { ok: true, reason: 'same-origin' };
   const peerRejected = req.headers.get('sec-fetch-site') === 'same-origin'
@@ -292,6 +318,10 @@ export function bearerCredential(req: Request, opts: MetaApiOpts): 'noauth' | 'b
 // check — without duplicating security-sensitive code.
 const authDecisions = new WeakMap<Request, { ok: boolean; reason: AuthReason }>();
 
+export function setupBearerScopeDenied(req: Request, opts: MetaApiOpts): boolean {
+  return decideAuth(req, opts).reason === 'setup-scope-denied';
+}
+
 export function checkAuth(req: Request, opts: MetaApiOpts): boolean {
   const decision = decideAuth(req, opts);
   authDecisions.set(req, decision);
@@ -322,6 +352,7 @@ export function checkAuth(req: Request, opts: MetaApiOpts): boolean {
  * intentionally collapse here to avoid exposing token-length information. */
 function authFailureResponse(req: Request, opts: MetaApiOpts): Response {
   const decision = authDecisions.get(req) ?? decideAuth(req, opts);
+  if (decision.reason === 'setup-scope-denied') return jsonResponse({ error: 'forbidden' }, 403);
   return jsonResponse({ error: 'unauthorized', reason: publicAuthFailureReason(decision.reason) }, 401);
 }
 
@@ -761,6 +792,11 @@ function notFound(payload: Record<string, unknown> = {}): Response {
 
 // ── /v1/prompt ────────────────────────────────────────────────────
 
+export function promptVerifiedOwner(req: Request, opts: MetaApiOpts): { id: string } | undefined {
+  const owner = opts.resolveVerifiedOwner?.(req);
+  return typeof owner?.id === 'string' && owner.id.trim() ? { id: owner.id.trim() } : undefined;
+}
+
 export async function handlePromptPost(
   req: Request,
   opts: MetaApiOpts,
@@ -804,6 +840,7 @@ export async function handlePromptPost(
         surface: surfaceResolution.surface,
         surfaceResolutionReason: surfaceResolution.reason,
         ...(parsed.value.userContent ? { promptBlocks: parsed.value.userContent } : {}),
+        ...((owner) => owner ? { verifiedOwner: owner } : {})(promptVerifiedOwner(req, opts)),
         ...(resolvePromptHitlChannels(typeof body.sessionId === 'string' ? body.sessionId : '', opts) ?? {}),
         ...(effectiveSurface ? { toolSurface: effectiveSurface } : {}),
         ...(opts.toolCwd ? { toolCwd: opts.toolCwd } : {}),
@@ -1161,6 +1198,7 @@ export async function handlePromptStreamPost(
                 surface: surfaceResolution.surface,
                 surfaceResolutionReason: surfaceResolution.reason,
                 ...(parsed.value.userContent ? { promptBlocks: parsed.value.userContent } : {}),
+                ...((owner) => owner ? { verifiedOwner: owner } : {})(promptVerifiedOwner(req, opts)),
                 ...(resolvePromptHitlChannels(typeof body.sessionId === 'string' ? body.sessionId : '', opts) ?? {}),
                 ...(effectiveSurface ? { toolSurface: effectiveSurface } : {}),
                 ...(opts.toolCwd ? { toolCwd: opts.toolCwd } : {}),

package/src/nexus/api/operator.ts

@@ -0,0 +1,61 @@
+// OPS1·OPS2 — who is an «operator» (sees the ops area). Off unless this daemon's config says `operator.enabled: true`
+// (only our own machines); an external install never reports an operator, whatever header or token arrives.
+// Design: 내부 문서 `DESIGN-pwa-menu-reorg-and-ops-area-2026-10-02` §2.
+import { timingSafeEqual } from 'node:crypto';
+import { readFileSync, statSync } from 'node:fs';
+import { debug } from '../../debug/log.js';
+import { getUserConfig } from '../../user-config.js';
+import { checkAuth, type MetaApiOpts } from './meta-api.js';
+
+/** Set by the op.elanous.ai proxy (Caddy) after Google sign-in, server side; the proxy strips any incoming copy. */
+export const OPERATOR_HEADER = 'x-elanous-operator';
+
+export type OperatorSource = 'op-proxy' | 'owner' | null;
+export interface OperatorSignal { operator: boolean; operatorSource: OperatorSource }
+export interface OperatorConfig { enabled: boolean; proxySecretFile?: string }
+
+export function readOperatorConfig(raw: unknown = getUserConfig().raw?.operator): OperatorConfig {
+  const o = raw && typeof raw === 'object' && !Array.isArray(raw) ? raw as Record<string, unknown> : {};
+  return {
+    enabled: o.enabled === true,
+    ...(typeof o.proxySecretFile === 'string' && o.proxySecretFile.trim() ? { proxySecretFile: o.proxySecretFile.trim() } : {}),
+  };
+}
+
+/** The proxy secret, only from a regular file nobody but the owner can read (mode 600); anything else turns the header path off. */
+export function readProxySecret(path: string | undefined): string | null {
+  if (!path) return null;
+  try {
+    const st = statSync(path);
+    if (!st.isFile() || (st.mode & 0o077) !== 0) return null;
+    const value = readFileSync(path, 'utf8').trim();
+    return value.length >= 16 ? value : null;
+  } catch { return null; }
+}
+
+function sameSecret(offered: string, secret: string): boolean {
+  const a = Buffer.from(offered);
+  const b = Buffer.from(secret);
+  return a.length === b.length && timingSafeEqual(a, b);
+}
+
+export interface OperatorDeps { config?: OperatorConfig; readSecret?: (path: string | undefined) => string | null; isOwner?: (req: Request) => boolean }
+
+export function operatorSignal(req: Request, opts: MetaApiOpts, deps: OperatorDeps = {}): OperatorSignal {
+  const config = deps.config ?? readOperatorConfig();
+  if (!config.enabled) return { operator: false, operatorSource: null };
+  const offered = req.headers.get(OPERATOR_HEADER);
+  if (offered) {
+    const secret = (deps.readSecret ?? readProxySecret)(config.proxySecretFile);
+    if (secret && sameSecret(offered, secret)) return { operator: true, operatorSource: 'op-proxy' };
+  }
+  if ((deps.isOwner ?? ((r: Request) => checkAuth(r, opts)))(req)) return { operator: true, operatorSource: 'owner' };
+  return { operator: false, operatorSource: null };
+}
+
+/** `GET /v1/me` — answers every caller (no auth needed: it only says whether to draw the ops area). */
+export function handleMe(req: Request, opts: MetaApiOpts, deps: OperatorDeps = {}): Response {
+  const signal = operatorSignal(req, opts, deps);
+  debug.log('ops.api', 'me', { operator: signal.operator, source: signal.operatorSource });
+  return Response.json(signal, { headers: { 'cache-control': 'no-store' } });
+}

package/src/nexus/api/ops-api.ts

@@ -0,0 +1,148 @@
+import { lstatSync, readFileSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { debug, redactSecretText } from '../../debug/log.js';
+import { effectiveInstanceRoot } from '../../instance/resolve.js';
+import { listChecklist } from '../../release-loop/checklist.js';
+import { getSchedule } from '../../release-loop/release-schedule.js';
+import { jsonResponse } from './json-response.js';
+import { operatorSignal } from './operator.js';
+import { createSeatsCache, todayKst } from './ops-seats.js';
+import { liveSeatsSources } from './ops-seats-sources.js';
+import type { MetaApiOpts } from './meta-api.js';
+
+const VERSION = /^\d+\.\d+\.\d+(?:-(?:rc|alpha|beta)\.\d+)?$/;
+const IDENTIFIER = /^[A-Za-z0-9-]+$/;
+const DATE = /^\d{4}-\d{2}-\d{2}$/;
+let seatsCache: ReturnType<typeof createSeatsCache> | null = null;
+/** Tests swap the sources; production builds them lazily on first use. */
+export function setSeatsCacheForTest(cache: ReturnType<typeof createSeatsCache> | null): void { seatsCache = cache; }
+const LOG_PATH = /^\/v1\/ops\/release\/runs\/([^/]+)\/nodes\/([^/]+)\/log$/;
+
+interface RunNode { nodeId: string; ok?: unknown; output?: unknown }
+interface RunRecord {
+  status: string;
+  path: string[];
+  startedAt: string;
+  input?: unknown;
+  nodes: RunNode[];
+}
+
+function recordAt(path: string): RunRecord | null {
+  try {
+    if (!lstatSync(path).isFile()) return null;
+    const value: unknown = JSON.parse(readFileSync(path, 'utf8'));
+    if (!value || typeof value !== 'object') return null;
+    const run = value as Partial<RunRecord>;
+    if (typeof run.status !== 'string' || !Array.isArray(run.path)
+      || typeof run.startedAt !== 'string' || !Array.isArray(run.nodes)) return null;
+    return run as RunRecord;
+  } catch { return null; }
+}
+
+function outputText(output: unknown): string {
+  if (typeof output === 'string') return output;
+  if (output === undefined || output === null) return '';
+  return JSON.stringify(output) ?? '';
+}
+
+function nodeSummary(output: unknown): string {
+  let value = output;
+  if (typeof value === 'string') {
+    const text = value;
+    try { value = JSON.parse(text) as unknown; }
+    catch {
+      const last = text.split('\n').map((line) => line.trim()).filter(Boolean).at(-1);
+      try { value = JSON.parse(last ?? '') as unknown; } catch { return ''; }
+    }
+  }
+  if (!value || typeof value !== 'object') return '';
+  const summary = (value as { summary?: unknown }).summary;
+  return typeof summary === 'string' ? redactSecretText(summary).slice(0, 300) : '';
+}
+
+function runVersion(input: unknown): string | null {
+  if (!input || typeof input !== 'object') return null;
+  const version = (input as { version?: unknown }).version;
+  return typeof version === 'string' && VERSION.test(version) ? version : null;
+}
+
+/** The sole data gate for every read-only /v1/ops endpoint. */
+export function handleOpsApi(req: Request, metaApi: MetaApiOpts | undefined): Response | Promise<Response> {
+  const url = new URL(req.url);
+  const { pathname } = url;
+  if (req.method !== 'GET') return jsonResponse({ error: 'method-not-allowed' }, 405);
+
+  const signal = metaApi ? operatorSignal(req, metaApi) : { operator: false, operatorSource: null };
+  if (!signal.operator) {
+    debug.log('ops.api', 'refused', { path: pathname, source: signal.operatorSource });
+    return jsonResponse({ error: 'forbidden' }, 403);
+  }
+  const served = (response: Response): Response => {
+    debug.log('ops.api', 'served', { path: pathname, source: signal.operatorSource });
+    response.headers.set('cache-control', 'no-store');
+    return response;
+  };
+  if (pathname === '/v1/ops/seats') {
+    const date = url.searchParams.get('date') ?? todayKst();
+    if (!DATE.test(date) || Number.isNaN(Date.parse(`${date}T00:00:00+09:00`))) return jsonResponse({ error: 'invalid-date' }, 400);
+    seatsCache ??= createSeatsCache(liveSeatsSources());
+    return seatsCache(date).then((board) => served(jsonResponse(board)), () => jsonResponse({ error: 'seats-unavailable' }, 500));
+  }
+  const version = url.searchParams.get('version');
+  if (pathname === '/v1/ops/checklist') {
+    if (!version || !VERSION.test(version)) return jsonResponse({ error: 'invalid-version' }, 400);
+    // OPS2 header «컷 · 착지 마감»: the version's row in the release schedule (REL9a), or null when none is set.
+    let schedule: { cutAt: string; landBy: string | null } | null = null;
+    try {
+      const row = getSchedule(version);
+      schedule = row ? { cutAt: row.cutAt, landBy: row.landBy ?? null } : null;
+    } catch (error) {
+      debug.log('ops.api', 'schedule-unreadable', { version, reason: error instanceof Error ? error.message.slice(0, 80) : 'unknown' }, { level: 'warn' });
+    }
+    return served(jsonResponse({ ...listChecklist(version), schedule }));
+  }
+  if (pathname === '/v1/ops/release/runs') {
+    if (version !== null && !VERSION.test(version)) return jsonResponse({ error: 'invalid-version' }, 400);
+    const dir = join(effectiveInstanceRoot(), 'graph-runs', 'release-loop');
+    let filenames: string[];
+    try {
+      filenames = readdirSync(dir, { withFileTypes: true })
+        .filter((entry) => entry.isFile() && entry.name.endsWith('.json')
+          && IDENTIFIER.test(entry.name.slice(0, -5)))
+        .map((entry) => entry.name);
+    }
+    catch (error) {
+      if ((error as NodeJS.ErrnoException).code === 'ENOENT') return served(jsonResponse([]));
+      return jsonResponse({ error: 'runs-unavailable' }, 500);
+    }
+    const runs = filenames.flatMap((filename) => {
+      const run = recordAt(join(dir, filename));
+      if (!run) return [];
+      const v = runVersion(run.input);
+      if (version !== null && v !== version) return [];
+      return [{
+        runId: redactSecretText(filename.slice(0, -5)), status: redactSecretText(run.status),
+        startedAt: redactSecretText(run.startedAt), version: v,
+        path: run.path.filter((step): step is string => typeof step === 'string').map(redactSecretText),
+        nodes: run.nodes.filter((node) => node && typeof node.nodeId === 'string').map((node) => ({
+          nodeId: redactSecretText(node.nodeId), ok: typeof node.ok === 'boolean' ? node.ok : null,
+          summary: nodeSummary(node.output),
+        })),
+      }];
+    }).sort((a, b) => b.startedAt.localeCompare(a.startedAt)).slice(0, 20);
+    return served(jsonResponse(runs));
+  }
+  // WHATWG URL normalizes a literal runs/../nodes/... before routing.
+  if (pathname.startsWith('/v1/ops/release/nodes/')) return jsonResponse({ error: 'invalid-id' }, 400);
+  if (pathname.startsWith('/v1/ops/release/runs/')) {
+    const match = LOG_PATH.exec(pathname);
+    if (!match) return jsonResponse({ error: 'invalid-id' }, 400);
+    const [, id, nodeId] = match;
+    if (!IDENTIFIER.test(id!) || !IDENTIFIER.test(nodeId!)) return jsonResponse({ error: 'invalid-id' }, 400);
+    const run = recordAt(join(effectiveInstanceRoot(), 'graph-runs', 'release-loop', `${id}.json`));
+    const node = run?.nodes.find((candidate) => candidate?.nodeId === nodeId);
+    if (!node || node.output === undefined || node.output === null) return jsonResponse({ error: 'not-found' }, 404);
+    return served(jsonResponse({ log: redactSecretText(outputText(node.output)).slice(-4_000) }));
+  }
+  return jsonResponse({ error: 'not-found' }, 404);
+}

package/src/nexus/api/ops-seats-sources.ts

@@ -0,0 +1,95 @@
+// Live sources for /v1/ops/seats: the coordination PR and merged PRs through gh (automation App identity, proxy variables
+// removed — same rule as decision replies), the release checklist, and the decision ledger. Each failure becomes null upstream.
+import { DecisionLedger } from '../../decisions/decision-ledger.js';
+import { listCoordEvents, type CoordEvent } from '../../context-bus/coord-events.js';
+import { devVersion, listChecklist, type ChecklistItem } from '../../release-loop/checklist.js';
+import { getUserConfig } from '../../user-config.js';
+import { SEATS, kstDayRange, type ChannelComment, type ChannelSource, type MergedPr, type SeatsSources } from './ops-seats.js';
+
+const GH_TIMEOUT_MS = 20_000;
+
+async function ghLines(args: string[]): Promise<string[] | null> {
+  const env: Record<string, string> = {};
+  for (const [k, v] of Object.entries(process.env)) if (v !== undefined && !/^(https?|all|no)_proxy$/i.test(k)) env[k] = v;
+  try {
+    const { githubAutomationToken } = await import('../../auth/github-app-token.js');
+    const token = githubAutomationToken();
+    if (token) env.GH_TOKEN = token;
+  } catch { /* machine login */ }
+  const proc = Bun.spawn(['gh', ...args], { stdin: 'ignore', stdout: 'pipe', stderr: 'ignore', env });
+  const timer = setTimeout(() => proc.kill(), GH_TIMEOUT_MS);
+  try {
+    const [out, code] = await Promise.all([new Response(proc.stdout).text(), proc.exited]);
+    return code === 0 ? out.split('\n').filter(Boolean) : null;
+  } finally { clearTimeout(timer); }
+}
+
+function channelTarget(): { repo: string; pr: string } | null {
+  const raw = (getUserConfig().raw?.decisions as { replyGhPr?: unknown } | undefined)?.replyGhPr;
+  const m = typeof raw === 'string' ? /^([\w.-]+\/[\w.-]+)#(\d+)$/.exec(raw.trim()) : null;
+  return m ? { repo: m[1]!, pr: m[2]! } : null;
+}
+
+export async function channelCommentsSince(sinceIso: string): Promise<Array<{ body: string; createdAt: string; url: string }> | null> {
+  const target = channelTarget();
+  if (!target) return null;
+  const lines = await ghLines(['api', '--paginate', `repos/${target.repo}/issues/${target.pr}/comments?since=${sinceIso}&per_page=100`,
+    '--jq', '.[] | {body: .body, createdAt: .created_at, url: .html_url} | tojson']);
+  return lines?.map((line) => JSON.parse(line) as { body: string; createdAt: string; url: string }) ?? null;
+}
+
+function nextPatch(version: string): string {
+  const [major, minor, patch] = version.split('.').map(Number);
+  return `${major}.${minor}.${patch! + 1}`;
+}
+
+export function liveSeatsSources(deps: { listEvents?: typeof listCoordEvents; githubChannel?: typeof channelCommentsSince } = {}): SeatsSources {
+  return {
+    async channel(date) {
+      const since = kstDayRange(date).start;
+      let events: CoordEvent[] = [];
+      try { events = (deps.listEvents ?? listCoordEvents)({ since }); } catch { /* GitHub fallback */ }
+      const latest = new Map<string, CoordEvent>();
+      for (const event of events) {
+        if (!SEATS.some(({ seat }) => seat === event.refs.seat)) continue;
+        const prior = latest.get(event.refs.seat);
+        if (!prior || event.at > prior.at) latest.set(event.refs.seat, event);
+      }
+      const seatSources: Partial<Record<(typeof SEATS)[number]['seat'], ChannelSource>> = {};
+      if (latest.size) {
+        const comments: ChannelComment[] = [];
+        for (const { seat } of SEATS) {
+          const event = latest.get(seat);
+          if (!event) { seatSources[seat] = 'unknown'; continue; }
+          comments.push({ body: `**[${seat}]** ${event.text}`, createdAt: event.at, url: event.refs.url ?? '' });
+          seatSources[seat] = 'ledger';
+        }
+        return { source: 'ledger', comments, seatSources };
+      }
+      let github: ChannelComment[] | null;
+      try { github = await (deps.githubChannel ?? channelCommentsSince)(since); }
+      catch { github = null; }
+      if (github === null) return null;
+      for (const { seat } of SEATS) seatSources[seat] = 'github';
+      return { source: 'github', comments: github, seatSources };
+    },
+    async merged(date) {
+      const target = channelTarget();
+      if (!target) return null;
+      const { start, end } = kstDayRange(date);
+      const lines = await ghLines(['pr', 'list', '--repo', target.repo, '--state', 'merged', '--limit', '300',
+        '--search', `merged:${start.slice(0, 19)}Z..${end.slice(0, 19)}Z`, '--json', 'number,title,body,mergedAt', '--jq', '.[] | tojson']);
+      return lines?.map((line) => JSON.parse(line) as MergedPr) ?? null;
+    },
+    checklist() {
+      const dev = devVersion();
+      const next = listChecklist(nextPatch(dev)).items;
+      const current = listChecklist(dev).items;
+      const all: ChecklistItem[] = [...current, ...next];
+      return { current: next.length ? next : current, all };
+    },
+    openDecisionRaisers() {
+      return new DecisionLedger().list({ status: 'open' }).map((entry) => entry.raisedBy.agent);
+    },
+  };
+}