elanous 0.2.8 → 0.2.9

package/src/auth/setup-link-tokens.ts

@@ -0,0 +1,153 @@
+import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
+import { closeSync, constants, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { dlopen, FFIType } from 'bun:ffi';
+import { getElanousConfigDir } from '../elanous-config-dir.js';
+
+export const SETUP_LINK_TTL_MS = 10 * 60_000;
+const SETUP_BEARER_TTL_MS = 24 * 60 * 60_000;
+const LINK_PREFIX = 'els_';
+const BEARER_PREFIX = 'elsb_';
+const HASH_PATTERN = /^[a-f0-9]{64}$/;
+const LINK_PATTERN = /^els_[A-Za-z0-9_-]{43}$/;
+const BEARER_PATTERN = /^elsb_[A-Za-z0-9_-]{43}$/;
+
+interface SetupLinkEntry {
+  hash: string;
+  expiresAt: string;
+  usedAt?: string;
+  bearerHash?: string;
+  bearerExpiresAt?: string;
+}
+
+type ClaimResult =
+  | { ok: true; bearer: string; expiresAt: string }
+  | { ok: false; reason: 'unknown' | 'used' | 'expired' };
+
+function storePath(dir: string): string { return join(dir, 'setup-link-tokens.json'); }
+function hashOf(token: string): string { return createHash('sha256').update(token).digest('hex'); }
+function mint(prefix: string): string { return `${prefix}${randomBytes(32).toString('base64url')}`; }
+
+function readStore(dir: string): SetupLinkEntry[] {
+  let raw: string;
+  try {
+    const path = storePath(dir);
+    const st = lstatSync(path);
+    if (!st.isFile() || (st.mode & 0o077) !== 0) throw new Error('setup link store must be a private regular file (0600)');
+    raw = readFileSync(path, 'utf8');
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return [];
+    throw error;
+  }
+  const parsed: unknown = JSON.parse(raw);
+  if (!parsed || typeof parsed !== 'object' || !('tokens' in parsed) || !Array.isArray(parsed.tokens)) {
+    throw new Error('setup link store is malformed');
+  }
+  const entries: unknown[] = parsed.tokens;
+  if (!entries.every((entry) => {
+    if (!entry || typeof entry !== 'object') return false;
+    const t = entry as Partial<SetupLinkEntry>;
+    return typeof t.hash === 'string' && HASH_PATTERN.test(t.hash)
+      && typeof t.expiresAt === 'string' && Number.isFinite(Date.parse(t.expiresAt))
+      && (t.usedAt === undefined || (typeof t.usedAt === 'string' && Number.isFinite(Date.parse(t.usedAt))))
+      && (t.bearerHash === undefined || (typeof t.bearerHash === 'string' && HASH_PATTERN.test(t.bearerHash)))
+      && (t.bearerExpiresAt === undefined || (typeof t.bearerExpiresAt === 'string' && Number.isFinite(Date.parse(t.bearerExpiresAt))))
+      && ((t.usedAt === undefined && t.bearerHash === undefined && t.bearerExpiresAt === undefined)
+        || (t.usedAt !== undefined && t.bearerHash !== undefined && t.bearerExpiresAt !== undefined));
+  })) throw new Error('setup link store is malformed');
+  return entries as SetupLinkEntry[];
+}
+
+function writeStore(dir: string, tokens: SetupLinkEntry[]): void {
+  mkdirSync(dir, { recursive: true, mode: 0o700 });
+  const path = storePath(dir);
+  const tmp = `${path}.${process.pid}.${randomBytes(4).toString('hex')}.tmp`;
+  try {
+    writeFileSync(tmp, JSON.stringify({ tokens }, null, 2), { flag: 'wx', mode: 0o600 });
+    renameSync(tmp, path);
+  } finally {
+    try { unlinkSync(tmp); } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error;
+    }
+  }
+}
+
+// A persistent inode and an OS advisory lock avoid stale owner files after an abrupt process exit.
+// Never unlink this file: a replacement inode would let two processes hold different locks.
+const libc = dlopen(process.platform === 'darwin' ? '/usr/lib/libSystem.B.dylib' : 'libc.so.6', {
+  flock: { args: [FFIType.i32, FFIType.i32], returns: FFIType.i32 },
+});
+const LOCK_EX = 2;
+const LOCK_NB = 4;
+const LOCK_UN = 8;
+
+function withLock<T>(dir: string, fn: () => T): T {
+  mkdirSync(dir, { recursive: true, mode: 0o700 });
+  const lock = `${storePath(dir)}.lock`;
+  const fd = openSync(lock, constants.O_CREAT | constants.O_RDWR | constants.O_NOFOLLOW, 0o600);
+  try {
+    const stat = fstatSync(fd);
+    const current = lstatSync(lock);
+    if (!stat.isFile() || (stat.mode & 0o077) !== 0 || stat.ino !== current.ino || stat.dev !== current.dev) {
+      throw new Error('setup link lock must be a private regular file (0600)');
+    }
+    const until = Date.now() + 3000;
+    while (libc.symbols.flock(fd, LOCK_EX | LOCK_NB) !== 0) {
+      if (Date.now() > until) throw new Error('setup link store is locked — try again');
+      Bun.sleepSync(20);
+    }
+    try {
+      const locked = lstatSync(lock);
+      if (stat.ino !== locked.ino || stat.dev !== locked.dev) throw new Error('setup link lock changed');
+      return fn();
+    } finally {
+      libc.symbols.flock(fd, LOCK_UN);
+    }
+  } finally {
+    closeSync(fd);
+  }
+}
+
+/** The plaintext link token is returned once; only its SHA-256 digest is persisted. */
+export function issueSetupLinkToken(opts: { dir?: string; now?: number } = {}): { token: string; expiresAt: string } {
+  const dir = opts.dir ?? getElanousConfigDir();
+  const now = opts.now ?? Date.now();
+  const token = mint(LINK_PREFIX);
+  const expiresAt = new Date(now + SETUP_LINK_TTL_MS).toISOString();
+  withLock(dir, () => writeStore(dir, [...readStore(dir), { hash: hashOf(token), expiresAt }]));
+  return { token, expiresAt };
+}
+
+/** Claim exactly once under the same lock used by issuance. Expired and used links retain their diagnostic status. */
+export function claimSetupLinkToken(token: string, opts: { dir?: string; now?: number } = {}): ClaimResult {
+  if (typeof token !== 'string' || !LINK_PATTERN.test(token)) return { ok: false, reason: 'unknown' };
+  const dir = opts.dir ?? getElanousConfigDir();
+  const now = opts.now ?? Date.now();
+  return withLock(dir, () => {
+    const entries = readStore(dir);
+    const digest = Buffer.from(hashOf(token), 'hex');
+    const hit = entries.find((entry) => timingSafeEqual(digest, Buffer.from(entry.hash, 'hex')));
+    if (!hit) return { ok: false, reason: 'unknown' };
+    if (hit.usedAt) return { ok: false, reason: 'used' };
+    if (Date.parse(hit.expiresAt) <= now) return { ok: false, reason: 'expired' };
+    const bearer = mint(BEARER_PREFIX);
+    const expiresAt = new Date(now + SETUP_BEARER_TTL_MS).toISOString();
+    hit.usedAt = new Date(now).toISOString();
+    hit.bearerHash = hashOf(bearer);
+    hit.bearerExpiresAt = expiresAt;
+    writeStore(dir, entries);
+    return { ok: true, bearer, expiresAt };
+  });
+}
+
+/** A setup bearer is not an owner or temp-owner token; validate it only on setup-allowed routes. */
+export function matchSetupBearer(bearer: string, opts: { dir?: string; now?: number } = {}): { expiresAt: string } | null {
+  if (typeof bearer !== 'string' || !BEARER_PATTERN.test(bearer)) return null;
+  let entries: SetupLinkEntry[];
+  try { entries = readStore(opts.dir ?? getElanousConfigDir()); } catch { return null; }
+  const digest = Buffer.from(hashOf(bearer), 'hex');
+  const now = opts.now ?? Date.now();
+  const hit = entries.find((entry) => entry.bearerHash && entry.bearerExpiresAt
+    && timingSafeEqual(digest, Buffer.from(entry.bearerHash, 'hex')) && Date.parse(entry.bearerExpiresAt) > now);
+  return hit?.bearerExpiresAt ? { expiresAt: hit.bearerExpiresAt } : null;
+}

package/src/budget/unified-usage.ts

@@ -18,6 +18,7 @@ import { listCodexAccountsInStore } from '../oauth/codex-account-store.js';
 import { loadTokens } from '../oauth/store.js';
 import { envLiteral } from '../platform/env-literal.js';
 import { describeResetCreditExpiry } from './codex-reset-credit-state.js';
+import { visibleWidth } from '../tui.js';
 import { listCodexResetCredits, type CodexResetCreditsResult } from './codex-reset-credits.js';
 import type {
   AccountUsageRow,
@@ -268,6 +269,80 @@ async function collectOpenRouterRows(deps: UnifiedUsageDeps): Promise<AccountUsa
   }
 }
 
+export function formatUsageCompact(report: UnifiedUsageReport, options: { width: number; nowMs: number }): string[] {
+  return report.rows.map((row) => {
+    const credits = row.credits;
+    const subscription = row.subscription;
+    const remaining = subscription.status === 'available' && Number.isFinite(subscription.remainingPercent)
+      ? subscription.remainingPercent
+      : credits.status === 'ok' && credits.usedPercent !== null && Number.isFinite(credits.usedPercent)
+        ? Math.round((100 - credits.usedPercent) * 10) / 10
+        : null;
+    const period = subscription.status === 'available'
+      ? subscription.windowKind
+      : credits.status === 'ok' ? credits.periodType : null;
+    const reset = subscription.status === 'available' ? subscription.resetsAt
+      : credits.status === 'ok' && credits.periodEnd ? Date.parse(credits.periodEnd) : Number.NaN;
+    const periodLabel = period ? `${formatCompactPeriod(period)} ` : '';
+    const when = period === 'prepaid-usd' ? '' : !isValidEpochMs(reset)
+      ? ` · ${periodLabel}시각 모름`
+      : reset <= options.nowMs
+        ? ` · ${periodLabel}재조회 필요`
+        : ` · ${periodLabel}${formatCompactReset(reset, options.nowMs)}에 다시 참`;
+    const balance = credits.status === 'ok' && credits.balance !== null && Number.isFinite(credits.balance)
+      ? ` · 크레딧 ${new Intl.NumberFormat('en-US', { maximumFractionDigits: credits.balance >= 1_000 ? 0 : 1 }).format(credits.balance)}` : '';
+    const prefix = `${row.provider} `;
+    const name = row.accountName.replace(/[\r\n\t\x00-\x1f\x7f]/g, ' ');
+    const remainingLabel = `남은 ${remaining === null ? '잔량 모름' : `${remaining}%`}`;
+    const width = Number.isFinite(options.width) ? Math.max(0, Math.floor(options.width)) : 120;
+    const suffix = ` · ${remainingLabel}${when}${balance}`;
+    const available = width - visibleWidth(prefix) - visibleWidth(suffix);
+    if (available >= 1) {
+      const account = visibleWidth(name) <= available ? name
+        : available === 1 ? '…' : `${compactSlice(name, available - 1)}…`;
+      return `${prefix}${account}${suffix}`;
+    }
+    // The fixed labels can exceed very narrow widths even with no account name.
+    // Keep the measured value when possible rather than slicing its digits.
+    const essential = `${row.provider} · ${remainingLabel}`;
+    if (visibleWidth(essential) <= width) return essential;
+    if (visibleWidth(remainingLabel) <= width) return remainingLabel;
+    const value = remaining === null ? '잔량 모름' : `${remaining}%`;
+    if (visibleWidth(value) <= width) return value;
+    return width > 0 ? '…' : '';
+  });
+}
+
+function formatCompactPeriod(value: string): string {
+  const period = value.replace(/^USAGE_PERIOD_TYPE_/, '').toLowerCase();
+  switch (period) {
+    case 'weekly': return '주간';
+    case 'monthly': return '월간';
+    case 'daily': return '일간';
+    default: return period;
+  }
+}
+
+function formatCompactReset(reset: number, nowMs: number): string {
+  const remaining = reset - nowMs;
+  if (remaining < 86_400_000) {
+    if (remaining < 3_600_000) return `${Math.ceil(remaining / 60_000)}분 뒤`;
+    return `${Math.ceil(remaining / 3_600_000)}시간 뒤`;
+  }
+  const date = new Date(reset);
+  const weekdays = ['일', '월', '화', '수', '목', '금', '토'];
+  return `${date.getMonth() + 1}/${date.getDate()} (${weekdays[date.getDay()]}) ${String(date.getHours()).padStart(2, '0')}:${String(date.getMinutes()).padStart(2, '0')}`;
+}
+
+function compactSlice(text: string, width: number): string {
+  let result = '';
+  for (const { segment } of new Intl.Segmenter(undefined, { granularity: 'grapheme' }).segment(text)) {
+    if (visibleWidth(result + segment) > width) break;
+    result += segment;
+  }
+  return result;
+}
+
 export function formatUnifiedUsage(report: UnifiedUsageReport): string {
   const lines: string[] = [
     'usage — 계정마다 한 행 · 크레딧 축과 구독 축은 각각 칸',

package/src/channel-bot-token.ts

@@ -1,35 +1,62 @@
 import { existsSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
 import { randomUUID } from 'node:crypto';
 import { debug } from './debug/log.js';
-import { getSecret, setSecretAsync } from './nexus/config/secrets/index.js';
-import { userConfigPath } from './nexus/config/paths.js';
+import { getSecret, setSecretAsync, currentBackendId } from './nexus/config/secrets/index.js';
+import { userConfigPath, secretsPath } from './nexus/config/paths.js';
 import { isSecretRef, makeSecretRef, secretIdFromRef } from './nexus/config/types.js';
 import { acquireLockAsync } from './storage/file-lock.js';
 import type { UserConfig } from './user-config.js';
 
 export type ChannelBotPlatform = 'telegram' | 'discord';
-export type ChannelBotTokenSource = 'tokenRef' | 'env' | 'plaintext';
+export type ChannelBotTokenSource = 'tokenRef' | 'env' | 'botToken' | 'channels.main';
+export type ChannelBotTokenResolution = { token: string; source: ChannelBotTokenSource; reason?: never }
+  | { token: ''; source?: never; reason: string };
 
 /** The tab reference is read from the same persistent config as the NEXUS switch. */
 export function resolveChannelBotToken(
   platform: ChannelBotPlatform,
   cfg: Pick<UserConfig, 'telegram' | 'discord'> & { tabs?: Record<string, { tokenRef?: unknown }> },
-): { token: string; source: ChannelBotTokenSource } | undefined {
+): ChannelBotTokenResolution {
+  let reason: string | undefined;
   const ref = cfg.tabs?.[`${platform}:1`]?.tokenRef;
   if (isSecretRef(ref)) {
     const id = secretIdFromRef(ref);
-    const token = id ? getSecret(id) : undefined;
-    if (token) return { token, source: 'tokenRef' };
+    if (id) {
+      const backend = currentBackendId();
+      if (backend !== 'file') {
+        reason = `backend ${backend} not sync-readable`;
+      } else {
+        const token = getSecret(id);
+        if (token) {
+          debug.log('channel-bot.token', 'resolved', { kind: platform, source: 'tokenRef' });
+          return { token, source: 'tokenRef' };
+        }
+        reason = `ref-id-missing ${id} in ${secretsPath()}`;
+      }
+    }
   }
   const envName = platform === 'telegram' ? 'ELANOUS_TELEGRAM_BOT_TOKEN' : 'ELANOUS_DISCORD_BOT_TOKEN';
   const envToken = process.env[envName];
-  if (envToken) return { token: envToken, source: 'env' };
+  if (envToken) {
+    debug.log('channel-bot.token', 'resolved', { kind: platform, source: 'env' });
+    return { token: envToken, source: 'env' };
+  }
   const token = cfg[platform]?.botToken;
   if (token) {
-    debug.log('channel-bot.token', 'plaintext-fallback', { platform });
-    return { token, source: 'plaintext' };
+    debug.log('channel-bot.token', 'resolved', { kind: platform, source: 'botToken' });
+    return { token, source: 'botToken' };
+  }
+  if (platform === 'telegram') {
+    const channels = cfg.telegram?.channels;
+    const channelToken = (channels?.find(c => c.name === 'main') ?? channels?.[0])?.botToken;
+    if (channelToken) {
+      debug.log('channel-bot.token', 'resolved', { kind: platform, source: 'channels.main' });
+      return { token: channelToken, source: 'channels.main' };
+    }
   }
-  return undefined;
+  reason ??= 'no-source';
+  debug.log('channel-bot.token', 'unresolved', { kind: platform, reason });
+  return { token: '', reason };
 }
 
 /** Publish the secret before its reference, under the config lock. Other config keys survive unchanged. */

package/src/chat/index.ts

@@ -431,7 +431,14 @@ export interface SlashCommand {
 
 // Default commands available in the input
 export const SLASH_COMMANDS: SlashCommand[] = [
-  { name: 'directive', aliases: [], description: 'Record a directive as a Linear issue' },
+  { name: 'help',  aliases: ['?'],         description: '명령과 키 보기' },
+  { name: 'resume',    aliases: [],             description: '지난 대화 이어 가기 · /resume <id 앞자리>' },
+  { name: 'model',     aliases: ['m'],           description: '모델 바꾸기 — /model <codex|terra|sol|luna|opus|sonnet|grok> (list + current when no arg). OpenAI 는 Codex(Responses API)만. effort 는 /reasoning.', subcommands: ['codex', 'terra', 'sol', 'luna', 'opus', 'sonnet', 'grok'] },
+  { name: 'clear', aliases: ['cls'],       description: '대화 기록 지우기' },
+  { name: 'status', aliases: ['st'], description: '지금 상태 — 모델 · 연결 · 계정' },
+  { name: 'remaining', aliases: [], description: '계정별 남은 사용량' },
+  { name: 'setup', aliases: [], description: '상세 설정 — /setup · /setup reset(다음 실행 때 마법사 다시)', subcommands: ['help', 'reset'] },
+  { name: 'quit',  aliases: ['q', 'exit'], description: '나가기' },
   { name: 'run-skill', aliases: ['rs', 'run'], description: 'Execute a skill via its SKILL.md prompt' },
   { name: 'ad', aliases: [], description: 'Create an advertising plan from a URL, brief, or attached image' },
   // B4 — craft rulebook verdict, same resolution as `elanous repo design-check`
@@ -440,10 +447,8 @@ export const SLASH_COMMANDS: SlashCommand[] = [
   { name: 'design',    aliases: ['design-check'], description: 'Design rulebooks this repository declares · /design [--declared] · /design pick [number|id] to choose a design direction', subcommands: ['--declared', 'pick'] },
   { name: 'provider',  aliases: ['p'],          description: 'LLM providers — /provider (list) · next (cycle, also Alt+M / pill click) · use <name> · pick (visual picker) · reset', subcommands: ['next', 'use', 'pick', 'picker', 'menu', 'reset', 'list'] },
   { name: 'reasoning', aliases: ['r', 'think'],  description: 'Reasoning level (codex effort + summary, anthropic extended-thinking budget) — /reasoning [off|low|medium|high|xhigh] (cycle when no arg · xhigh 는 모델 상한이 xhigh 이상일 때만 wire 에 실린다, 아니면 high 로 깎인다)', subcommands: ['off', 'low', 'medium', 'high', 'xhigh'] },
-  { name: 'model',     aliases: ['m'],           description: 'Switch active model — /model <codex|terra|sol|luna|opus|sonnet|grok> (list + current when no arg). OpenAI 는 Codex(Responses API)만. effort 는 /reasoning.', subcommands: ['codex', 'terra', 'sol', 'luna', 'opus', 'sonnet', 'grok'] },
   { name: 'local',     aliases: ['ll'],         description: 'Local OpenAI-compatible LLM — ping / models / test / use', subcommands: ['ping', 'models', 'test', 'use', 'status'] },
   { name: 'session',   aliases: ['sess'],       description: 'Session resume — list / load / sync / new (handoff from mobile)', subcommands: ['list', 'load', 'sync', 'new'] },
-  { name: 'resume',    aliases: [],             description: 'Pick a past session, or load one by id prefix · /resume <id-prefix>' },
   { name: 'fork',      aliases: [],             description: 'Copy this session into a new one' },
   { name: 'rewind',    aliases: [],             description: 'Rewind — 과거 user 턴 픽커로 되감기 (원본 보존 · 새 세션 분기 · /rewind <n> 숏컷)' },
   // TUI 부활 C-a (2026-07-12): autopilot 미션 TUI 표면 — CLI 동등 단일 창구 소비.
@@ -454,12 +459,8 @@ export const SLASH_COMMANDS: SlashCommand[] = [
   { name: 'sync',  aliases: ['s'],         description: 'Enter sync mode' },
   { name: 'plugin', aliases: ['plugins'], description: 'Manage plugins', subcommands: ['list', 'activate', 'deactivate', 'reload'] },
   { name: 'widget', aliases: ['widgets'], description: 'Manage widgets', subcommands: ['list', 'reload', 'instances'] },
-  { name: 'clear', aliases: ['cls'],       description: 'Clear chat log' },
   { name: 'log',   aliases: [],             description: 'Chat Log controls — size / clear / filter / search / freeze / solo / turn / fold / help', subcommands: ['size', 'clear', 'filter', 'search', 'freeze', 'solo', 'turn', 'fold', 'help'] },
-  { name: 'help',  aliases: ['?'],         description: 'Show help overlay' },
-  { name: 'setup', aliases: [], description: 'Onboarding wizard guide — /setup (anchor) · /setup reset (re-run wizard on next boot)', subcommands: ['help', 'reset'] },
   { name: 'memory', aliases: ['mem'], description: 'Memory ops — list / show / search / add / delete (see `elanous memory --help`)', subcommands: ['list', 'show', 'search', 'add', 'delete', 'index'] },
-  { name: 'status', aliases: ['st'], description: 'Print the claude-code-style status pills (working dir + git + model)' },
   { name: 'export', aliases: [], description: 'Export this conversation transcript to a markdown file — /export [path] (default ~/temp/elanous-transcript-<stamp>.md)' },
   { name: 'delta', aliases: ['diffs'], description: 'Source delta browser — open the latest turn-scoped file diff popup', subcommands: ['open', 'help'] },
   { name: 'theme', aliases: [], description: 'Theme controls — list / switch / use / reset / preview / export', subcommands: ['list', 'switch', 'use', 'reset', 'preview', 'export'] },
@@ -486,7 +487,6 @@ export const SLASH_COMMANDS: SlashCommand[] = [
   { name: 'acp',    aliases: [], description: 'ACP chat — stream claude-code / codex / gemini replies into the chat pane (not a VW spawn). /acp codex points at the canonical codex app-server path; /acp cas is a synonym.', subcommands: ['claude', 'codex', 'gemini', 'cas', 'cancel', 'status', 'drop'] },
   { name: 'conv', aliases: [], description: 'Conversation widget/popup host — /conv list · /conv open <session-id> · /conv layout <cascade|tile|stack> · /conv focus <next|prev>.', subcommands: ['list', 'ls', 'open', 'layout', 'focus'] },
   { name: 'handoff', aliases: [], description: 'H5 P3 cross-agent context handoff: /handoff <from_session_id> <to_brand> [--channels r,p,m] [--prompt "prefix"]. Takes source session snapshot (filtered by channels if observer present) and launches target via adapter registry. Brands: codex · claude · claude-code · gemini · elanous.' },
-  { name: 'remaining', aliases: [], description: 'What each account has left' },
   { name: 'agent-room', aliases: [], description: 'H6 P4 VW agent-room — /agent-room <N> <brands...> · /agent-room list · /agent-room close <id> · N ∈ {2,3,4} · brands: codex/claude/gemini/elanous/auto/lll:<m>', subcommands: ['list', 'close', 'preset', 'help'] },
   { name: 'showroom', aliases: ['sr'], description: 'Showroom v2 multi-LLM lane composer — /showroom (default 2-pane) · /showroom <lane1> <lane2> [<lane3> [<lane4>]] · lane = role:provider[:transport] · roles plan/build/exec/review/reflect · pair with /lane and /relay for cross-lane handoffs.', subcommands: ['help'] },
   { name: 'reply',   aliases: [], description: 'H6 P5 AgentReply — /reply <target-session-id> <message...> · send message to a live session, capture the response · flags: --from · --channels r,m · --idle-ms · --timeout-ms', subcommands: ['help'] },
@@ -503,7 +503,7 @@ export const SLASH_COMMANDS: SlashCommand[] = [
   { name: 'qc',      aliases: [],          description: 'Quick-control — arm one-shot control mode; next message runs as control, then auto-return to chat.' },
   { name: 'voice-chat', aliases: ['vc'], description: 'Continuous voice chat mode — speak, elanous replies in voice (Phase 4-5). Subcommands: start / stop / cancel / status. Chord: Alt+R toggles enter/exit anywhere.', subcommands: ['start', 'stop', 'cancel', 'status'] },
   { name: 'auto-tts', aliases: ['tts', 'autotts'], description: 'Auto-TTS for chat responses (Phase 2) — speaks LLM replies sentence-by-sentence. Subcommands: on / off / toggle / status.', subcommands: ['on', 'off', 'toggle', 'status'] },
-  { name: 'quit',  aliases: ['q', 'exit'], description: 'Exit application' },
+  { name: 'directive', aliases: [], description: '(운영) 지시를 Linear 이슈로 기록' },
 ];
 
 /** Every user-visible slash spelling, normalized for runtime-catalog comparison. */

package/src/cli/op-proxy-sync.ts

@@ -0,0 +1,83 @@
+import { spawnSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { ACP_TOKEN_FILE } from '../auth/token-store.js';
+import { debug } from '../debug/log.js';
+import { getElanousConfigDir } from '../elanous-config-dir.js';
+import { userConfigPath } from '../user-config.js';
+
+export interface OpProxyConfig {
+  host: string;
+  bearerFile: string;
+  restart: string;
+}
+
+/** Read the optional, unnormalized nexus setting from the same config file as the CLI. */
+export function readOpProxyConfig(path = userConfigPath()): OpProxyConfig | undefined {
+  try {
+    const raw = JSON.parse(readFileSync(path, 'utf8')) as { nexus?: { opProxy?: OpProxyConfig } };
+    return raw?.nexus?.opProxy;
+  } catch {
+    return undefined;
+  }
+}
+
+type SshExecutor = (argv: string[], input: string) => { status: number | null; error?: Error };
+
+export function finishOpProxyRotation(
+  proxy: OpProxyConfig | undefined,
+  token: string,
+  opts: { sync: boolean; ssh?: SshExecutor; tokenFile?: string; out?: (line: string) => void },
+): boolean | undefined {
+  if (!proxy) return undefined;
+  if (!opts.sync) {
+    (opts.out ?? console.log)('op 프록시 토큰도 갈아야 합니다 — `elanous token rotate --sync-op-proxy`');
+    return undefined;
+  }
+  return syncOpProxyToken(proxy, token, opts);
+}
+
+const executeSsh: SshExecutor = (argv, input) => {
+  const result = spawnSync('ssh', argv, { input, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'], timeout: 30_000 });
+  return { status: result.status, ...(result.error ? { error: result.error } : {}) };
+};
+
+const shellQuote = (value: string): string => `'${value.replaceAll("'", "'\\''")}'`;
+
+/** Never interpolate the token in a command, diagnostic, or log. Only SSH stdin carries it. */
+export function syncOpProxyToken(
+  proxy: OpProxyConfig | undefined,
+  token: string,
+  opts: { ssh?: SshExecutor; tokenFile?: string; out?: (line: string) => void } = {},
+): boolean | undefined {
+  if (!proxy) return undefined;
+  const out = opts.out ?? console.log;
+  const host = typeof proxy.host === 'string' ? proxy.host : '';
+  const file = typeof proxy.bearerFile === 'string' ? proxy.bearerFile : '';
+  const service = typeof proxy.restart === 'string' ? proxy.restart : '';
+  const valid = /^[\w][\w.-]*$/.test(host) && file.startsWith('/') && !/[\r\n\0]/.test(file)
+    && /^[\w@][\w@.-]*$/.test(service) && !/[\r\n\0]/.test(opts.tokenFile ?? '');
+  const remote = `sudo install -m 600 /dev/stdin ${shellQuote(file)} && sudo systemctl restart ${shellQuote(service)}`;
+  const manual = valid
+    ? `token=$(head -n 1 < ${shellQuote(opts.tokenFile ?? join(getElanousConfigDir(), ACP_TOKEN_FILE))}) && [ -n "$token" ] && printf 'ELANOUS_OP_BEARER=%s\\n' "$token" | ssh ${shellQuote(host)} ${shellQuote(remote)}`
+    : 'nexus.opProxy 의 host, bearerFile, restart 를 확인한 뒤 bearer 파일을 갱신하고 서비스를 재시작하세요';
+  let reason = '';
+  if (!valid) {
+    reason = 'nexus.opProxy 설정 오류';
+  } else {
+    try {
+      const result = (opts.ssh ?? executeSsh)([host, remote], `ELANOUS_OP_BEARER=${token}\n`);
+      if (result.status === 0 && !result.error) {
+        debug.log('auth.op-proxy-sync', 'synced', { host, reason: 'ok' });
+        out(`op 프록시 토큰을 바꿨습니다(${host})`);
+        return true;
+      }
+      reason = result.error ? 'ssh 실행 실패' : `ssh 종료 코드 ${result.status ?? '미상'}`;
+    } catch {
+      reason = 'ssh 실행 실패';
+    }
+  }
+  debug.log('auth.op-proxy-sync', 'failed', { host, reason });
+  out(`op 프록시 토큰 동기화 실패(${host}): ${reason} — 직접: ${manual}`);
+  return false;
+}

package/src/cli/pr-cli.ts

@@ -115,6 +115,8 @@ export interface PrLandDeps {
   /** iOS 시험 게이트 심(시험 주입용). */
   runIosGate?: (out: { log: (message: string) => void; error: (message: string) => void }, changedFiles: readonly string[]) => boolean;
   isInteractive?: () => boolean;
+  /** Clock for the recent-landings window (test seam · default Date.now). */
+  now?: () => number;
   requestConfirmation?: (opts: ConfirmOpts) => Promise<ConfirmResult>;
   overlapConfirmChannels?: ConfirmChannel[];
   overlapConfirmTimeoutMs?: number;
@@ -822,11 +824,12 @@ function emitRecentLandingRateAdvisory(
   cwd: string,
   commits: readonly { subject: string; authorEmail: string; committedAtMs: number }[] | null,
   out: { log: (message: string) => void },
+  now: () => number = Date.now,
 ): boolean {
   const windowMinutes = RECENT_LANDING_WINDOW_MINUTES;
   const authorEmail = currentAuthorEmail(run, cwd);
   if (!authorEmail || commits === null) {
-    const previous = commits === null ? undefined : previousLandingSummary(commits, Date.now());
+    const previous = commits === null ? undefined : previousLandingSummary(commits, now());
     record('recent-landing-rate', true, {
       recentCount: 0,
       windowMinutes,
@@ -836,7 +839,7 @@ function emitRecentLandingRateAdvisory(
     });
     return false;
   }
-  const nowMs = Date.now();
+  const nowMs = now();
   const recentCount = countRecentLandings(commits, {
     authorEmail,
     nowMs,
@@ -1077,6 +1080,7 @@ export async function runPrLand(opts: PrLandOpts = {}, deps: PrLandDeps = {}): P
     cwd,
     collectResolvedBaseLandings(run, cwd, DEFAULT_GRANULARITY_SINCE, base),
     out,
+    deps.now,
   );
 
   // ⛔ local-path / no-remote 는 gh 가 원리상 못 한다. 이미 아는 자리에서 멈춘다.

package/src/cli/release-cli.ts

@@ -24,6 +24,7 @@ import { getElanousConfigDirOverride } from '../elanous-config-dir.js';
 import { envLiteral } from '../platform/env-literal.js';
 import { userConfigPath } from '../user-config.js';
 import { addItem, devVersion, listChecklist, removeItem, seedFromRoadmap, setItem, summarizeChecklist, type ChecklistStatus, type ChecklistDisposition, type ChecklistKind } from '../release-loop/checklist.js';
+import * as features from '../release-loop/feature-store.js';
 import { writeStdoutJson } from './stdout-json.js';
 import { runUnattendedRelease, type UnattendedReleaseDeps } from '../../scripts/release-loop/unattended-release.js';
 import { releaseReadiness } from '../../scripts/release-loop/release-readiness.js';
@@ -492,7 +493,7 @@ export function registerReleaseCommands(program: Command, releaseRunDeps: Unatte
     .option('--version <v>', '판 또는 별칭(기본: package.json 의 개발판에서 -dev.N 제거)')
     .option('--json', '결과 JSON');
   const context = (cmd: Command) => {
-    const opts = { ...(cmd.parent?.opts() as { version?: string; json?: boolean }), ...(cmd.opts() as { version?: string; json?: boolean }) };
+    const opts = { ...(cmd.parent?.parent?.opts() as { version?: string; json?: boolean }), ...(cmd.parent?.opts() as { version?: string; json?: boolean }), ...(cmd.opts() as { version?: string; json?: boolean }) };
     const codenames = checklistCodenames();
     return { version: checklistVersion(opts.version, codenames), codenames, json: opts.json };
   };
@@ -533,6 +534,45 @@ export function registerReleaseCommands(program: Command, releaseRunDeps: Unatte
       const data = seedFromRoadmap(version, readFileSync(opts.from, 'utf8'));
       if (json) console.log(JSON.stringify(data)); else console.log(`✅ ${version} ${data.items.length}칸`);
     });
+  const actor = () => process.env.ELANOUS_TRACK || 'cli';
+  withContext(checklist.command('move <id>').description('칸을 한 트랜잭션으로 다른 판에 옮긴다'))
+    .requiredOption('--from <v>', '현재 판').requiredOption('--to <v>', '새 판')
+    .action((id: string, opts: { from: string; to: string }, cmd: Command) => {
+      const { codenames, json } = context(cmd);
+      const from = checklistVersion(opts.from, codenames), to = checklistVersion(opts.to, codenames);
+      const data = features.move(id, from, to, actor());
+      if (json) console.log(JSON.stringify(data)); else console.log(`✅ ${id} ${from} → ${to}`);
+    });
+  withContext(checklist.command('retitle <id> <title>').description('칸 제목 수정')).action((id: string, title: string, _opts: unknown, cmd: Command) => {
+    const { version, json } = context(cmd);
+    const snapshot = listChecklist(version);
+    features.retitle(id, title, actor(), snapshot.released, snapshot.dev);
+    if (json) console.log(JSON.stringify(listChecklist(version))); else console.log(`✅ ${id} 제목 수정`);
+  });
+  const evidence = checklist.command('evidence').description('칸의 PR·커밋 근거');
+  withContext(evidence.command('add <id> <ref>').description('근거 참조 추가')).action((id: string, ref: string, _opts: unknown, cmd: Command) => {
+    const { version, json } = context(cmd);
+    const snapshot = listChecklist(version);
+    features.evidenceAdd(id, version, ref, actor(), snapshot.released, snapshot.dev);
+    if (json) console.log(JSON.stringify(features.history(id))); else console.log(`✅ ${id} 근거 ${ref}`);
+  });
+  withContext(checklist.command('history <id>').description('칸의 판 이동·변경 이력')).action((id: string, _opts: unknown, cmd: Command) => {
+    const { json } = context(cmd);
+    const rows = features.history(id);
+    if (json) { console.log(JSON.stringify(rows)); return; }
+    const info = features.details(id);
+    if (info) {
+      console.log(`${info.id} · ${info.title} · 담당 ${info.owner ?? '-'} · 종류 ${info.kind ?? '-'} · 처음 ${info.createdAt}`);
+      for (const ev of info.evidence) console.log(`  근거 ${ev.version} ${ev.ref} (${ev.at} ${ev.by})`);
+    }
+    for (const row of rows) console.log(`${row.at} ${row.version} ${row.by} ${row.field}: ${JSON.stringify(row.from)} → ${JSON.stringify(row.to)}`);
+  });
+  withContext(checklist.command('export').description('SQLite 에서 checklist.json 스냅샷 생성')).action((_opts: unknown, cmd: Command) => {
+    const { version, json } = context(cmd);
+    const snapshot = listChecklist(version);
+    const data = features.exportJson(version, snapshot.released, snapshot.dev);
+    if (json) console.log(JSON.stringify(data)); else console.log(`✅ ${version} checklist.json 내보냄`);
+  });
   release.command('prepare')
     .description('깨끗한 원본 → 공개본 → 공개 저장소 이력 위 커밋 → PWA → 묶음·체크섬 → 로컬 끝까지 (네트워크 쓰기 없음)')
     .requiredOption('--version <x.y.z>', 'package.json 과 같은 버전(먼저 버전 PR 을 착지)')

package/src/dashboard/dashboard-status-lines.ts

@@ -0,0 +1,45 @@
+export interface DashboardStatusLinesInput {
+  readonly provider?: string | null;
+  readonly model?: string | null;
+  readonly reasoning?: string | null;
+  readonly daemonAddress?: string | null;
+  readonly daemonConnected: boolean;
+  readonly accountName?: string | null;
+  readonly sessionSurfaceLines: readonly string[];
+  readonly view: string;
+  readonly focus: string;
+  readonly cwd: string;
+  readonly preview: string;
+  readonly starterClosed: string;
+  readonly chatOnly: string;
+  readonly acp: string;
+}
+
+export function buildDashboardStatusLines(input: DashboardStatusLinesInput): string[] {
+  const known = (value?: string | null): string => value?.trim() || '모름';
+  // A remote URL can contain credentials or query parameters. Neither belongs in /status.
+  let address = '모름';
+  if (input.daemonAddress?.trim()) {
+    try {
+      const url = new URL(input.daemonAddress);
+      address = `${url.protocol}//${url.host}`;
+    } catch {
+      address = '모름';
+    }
+  }
+  return [
+    `모델: ${known(input.provider)}/${known(input.model)} (${known(input.reasoning)})`,
+    `연결: 데몬 ${address} ${input.daemonConnected ? '붙음' : '안 붙음'}`,
+    `계정: ${input.accountName?.trim() === 'default' ? '기본' : known(input.accountName)}`,
+    '',
+    '자세히',
+    ...input.sessionSurfaceLines.map(line => `  ${line}`),
+    `  view: ${input.view}`,
+    `  focus: ${input.focus}`,
+    `  cwd: ${input.cwd}`,
+    `  preview: ${input.preview}`,
+    `  starterClosed: ${input.starterClosed}`,
+    `  chatOnly: ${input.chatOnly}`,
+    `  acp: ${input.acp}`,
+  ];
+}

package/src/dashboard/first-screen-band.ts

@@ -0,0 +1,35 @@
+export interface FirstScreenBandInput {
+  readonly width: number;
+  readonly daemon: boolean;
+  readonly pwa?: {
+    readonly tailnet?: string | null;
+    readonly lan?: string | null;
+    readonly loopback?: string | null;
+  };
+}
+
+/** A startup transcript band; never includes credentials or a partial address. */
+export function buildFirstScreenBand(input: FirstScreenBandInput): string[] {
+  const width = Number.isFinite(input.width) ? Math.max(0, Math.floor(input.width)) : 0;
+  const fit = (text: string): string => text.slice(0, width);
+  const address = [input.pwa?.tailnet, input.pwa?.lan, input.pwa?.loopback]
+    .map((candidate) => {
+      if (!candidate) return null;
+      try {
+        const url = new URL(candidate);
+        if (!['http:', 'https:'].includes(url.protocol) || !url.hostname) return null;
+        return `${url.origin}${url.pathname === '/app/' ? '/app/' : ''}`;
+      } catch {
+        return null;
+      }
+    })
+    .find((candidate) => candidate !== null);
+  const fallback = input.pwa === undefined ? 'PWA: not checked' : 'PWA: unavailable';
+  const addressLine = address ? `PWA: ${address}` : fallback;
+
+  return [
+    fit(`elanous | daemon: ${input.daemon ? 'online' : 'offline'}`),
+    addressLine.length <= width ? addressLine : fit(address ? 'PWA: address available' : fallback),
+    fit('Type a message to begin | /help for commands'),
+  ];
+}