elanous 0.2.8 → 0.2.9

package/src/dashboard/index.ts

@@ -881,6 +881,10 @@ import { getModelFamily, getModelTier } from '../models/prompts.js';
 import { buildPromptInjection, getPromptBankStore } from '../prompt-bank/index.js';
 import { getInputHistoryStore, inputHistoryDbPath, inputHistoryJsonPath } from '../input-history.js';
 import { inspectActiveProvider } from '../provider-summary.js';
+import { activeCodexAccountView } from '../oauth/codex-account-store.js';
+import { buildDashboardStatusLines } from './dashboard-status-lines.js';
+import { buildFirstScreenBand } from './first-screen-band.js';
+import { runNexusShow, type NexusShowResult } from '../cli/nexus-show.js';
 import {
   workingDirSegment, sessionCwdSegment, modelSegment, gitSegment,
   ctxBarSegment, costSegment, speedSegment, elapsedSegment, cacheSegment,
@@ -2100,6 +2104,35 @@ export function createDashboardLogSearchOpener(deps: {
   };
 }
 
+export function renderDashboardFirstScreenBand(input: {
+  readonly history: ReadonlyArray<{ role: string }>;
+  readonly lines: string[];
+  readonly width: number;
+  readonly draw: () => void;
+  readonly observe: (data: { daemon: boolean; hasPwa: boolean; hasTailnet: boolean }) => void;
+  readonly show?: () => Promise<Pick<NexusShowResult, 'status' | 'urls'>>;
+}): Promise<void> {
+  if (input.history.some((message) => message.role !== 'system')) return Promise.resolve();
+  const band = buildFirstScreenBand({ width: input.width, daemon: false });
+  input.lines.unshift(...band);
+  const show = input.show ?? (() => runNexusShow({ format: 'json', out: { log: () => {}, error: () => {} } }));
+  const observe = (data: { daemon: boolean; hasPwa: boolean; hasTailnet: boolean }): void => {
+    try { input.observe(data); } catch { /* observation cannot interrupt the transcript */ }
+  };
+  return Promise.resolve().then(show).then((result) => {
+    const daemon = result.status !== 'absent';
+    const pwa = result.urls?.pwa;
+    const hasPwa = !!pwa;
+    const hasTailnet = !!pwa?.tailnet;
+    observe({ daemon, hasPwa, hasTailnet });
+    if (input.lines[1] !== band[1]) return;
+    input.lines[1] = buildFirstScreenBand({ width: input.width, daemon, pwa })[1]!;
+    try { input.draw(); } catch { /* screen may have closed */ }
+  }).catch(() => {
+    observe({ daemon: false, hasPwa: false, hasTailnet: false });
+  });
+}
+
 export async function showDashboard(opts: ShowDashboardOptions = {}): Promise<DashboardAction> {
   const dashboardQuitConfirmationState = createQuitConfirmationState();
   const signalQuitConfirmationState = createQuitConfirmationState();
@@ -6330,19 +6363,34 @@ Mode- and sync-specific instructions are injected per-turn when relevant — do
     draw,
   });
 
-  const getDashboardStatusLines = () => [
-    'Dashboard status',
-    ...buildSessionDashboardStatusLines(resolveSessionSurfaceStatus({ chatModeState })).map(
-      line => `  ${line}`,
-    ),
-    `  view: ${workingDir.view}`,
-    `  focus: ${workingDir.focus}`,
-    `  cwd: ${workingDir.cwd}`,
-    `  preview: ${dockedPreview.sourceMode}`,
-    `  starterClosed: ${closedStarterPanes().length ? closedStarterPanes().map((pane) => paneLabel(pane)).join(', ') : 'none'}`,
-    `  chatOnly: ${effectiveChatOnlyMode() ? 'on' : 'off'}${chatOnlyMode ? ' (manual)' : ''}`,
-    `  acp: ${dashboardAcpChat.isBusy() ? 'busy' : 'idle'}`,
-  ];
+  let daemonAttached = false;
+  const getDashboardStatusLines = () => {
+    const cfg = getUserConfig();
+    const active = inspectActiveProvider(cfg);
+    const reasoningProvider = (['openai-codex', 'openai', 'anthropic', 'gemini', 'grok', 'local', 'openrouter'] as const)
+      .find(provider => active.provider === provider || active.provider === `auto:${provider}`);
+    return buildDashboardStatusLines({
+      provider: active.provider,
+      model: active.model,
+      reasoning: reasoningProvider
+        ? modelSupportsReasoning(reasoningProvider, active.model)
+          ? reasoningLevelLabel(effectiveReasoningLevel(cfg.llm, reasoningProvider, active.model))
+          : '미지원'
+        : undefined,
+      daemonAddress: opts.remote?.url,
+      daemonConnected: daemonAttached,
+      accountName: active.provider === 'openai-codex' || active.provider === 'auto:openai-codex'
+        ? activeCodexAccountView().name : undefined,
+      sessionSurfaceLines: buildSessionDashboardStatusLines(resolveSessionSurfaceStatus({ chatModeState })),
+      view: String(workingDir.view),
+      focus: workingDir.focus,
+      cwd: workingDir.cwd,
+      preview: dockedPreview.sourceMode,
+      starterClosed: closedStarterPanes().length ? closedStarterPanes().map((pane) => paneLabel(pane)).join(', ') : 'none',
+      chatOnly: `${effectiveChatOnlyMode() ? 'on' : 'off'}${chatOnlyMode ? ' (manual)' : ''}`,
+      acp: dashboardAcpChat.isBusy() ? 'busy' : 'idle',
+    });
+  };
 
   bootDashboardSlashExecutor({
     initDashboardSlashExecutor,
@@ -15397,6 +15445,7 @@ Mode- and sync-specific instructions are injected per-turn when relevant — do
         ...(opts.remote ? {
           remote: opts.remote,
           onRemoteDisconnect: () => {
+            daemonAttached = false;
             pushChatLine(C.warning('  ⚠ 데몬 연결이 끊겼다 · 입력 중인 글은 그대로다 · 다시 붙으려면 TUI 를 다시 띄워라'));
             draw();
           },
@@ -15610,6 +15659,7 @@ Mode- and sync-specific instructions are injected per-turn when relevant — do
         },
     });
     const dashboardAcpSession: DashboardSession = dashboardAcpBootResult.session;
+    daemonAttached = !!opts.remote && dashboardAcpBootResult.mode !== 'in-process';
     // ⭐ `B3` — 턴 중 발화를 «도는 턴»에 넣을 때 쓰는 키.
     try { acpSessionIdRef.current = dashboardAcpSession.currentSessionId ?? null; } catch { /* 없으면 넣지 않는다 */ }
     pushDebugLine(C.muted('[acp-boot] dashboard ACP session ready'));
@@ -15702,6 +15752,13 @@ Mode- and sync-specific instructions are injected per-turn when relevant — do
       }
     }
     chatScrollOffset = -1;
+    void renderDashboardFirstScreenBand({
+      history: chat.history,
+      lines: chatLines,
+      width: Math.max(0, termSize().cols - 4),
+      draw: () => draw(),
+      observe: (data) => { try { debug.log('dashboard.first-screen-band', 'resolved', data); } catch { /* observation is best-effort */ } },
+    });
 
     while (true) {
       draw();

package/src/dashboard/provider-slash-runtime.ts

@@ -8,7 +8,7 @@ export interface DashboardProviderRotationEntryView {
 export interface DashboardProviderAvailabilityView {
   available: boolean;
   name: string;
-  model: string;
+  model: string | undefined;
 }
 
 export interface DashboardProviderSlashRuntimeDeps {
@@ -31,6 +31,7 @@ export interface DashboardProviderSlashRuntime {
   overviewLines(
     rotationEntries: readonly DashboardProviderRotationEntryView[],
     providers: readonly DashboardProviderAvailabilityView[],
+    catalogModelIds?: ReadonlySet<string>,
   ): string[];
 }
 
@@ -48,25 +49,41 @@ export function createDashboardProviderSlashRuntime(
     switchedLine: (label, provider, model) => deps.success(`  ✓ switched → ${label}  (${providerDetail(provider, model)})`),
     resetEmptyLine: () => deps.warning('  rotation empty — nothing to reset'),
     resetLine: (label) => deps.success(`  ✓ reset → ${label}`),
-    overviewLines: (rotationEntries, providers) => {
+    overviewLines: (rotationEntries, providers, catalogModelIds) => {
       const lines = ['', deps.accent('\u276f /provider')];
       if (rotationEntries.length > 0) {
-        lines.push(deps.muted('  Rotation (cycle with `/provider next` or `/provider use <label>`):'));
+        lines.push(deps.muted('  회전(바꾸기: /provider next · /provider use <이름>)'));
         for (const entry of rotationEntries) {
           const marker = entry.current ? deps.success('▸') : ' ';
-          lines.push(`  ${marker} ${entry.label.padEnd(14)} ${deps.subtext(entry.provider)}  ${deps.muted(entry.model)}`);
+          const missing = catalogModelIds && entry.model !== '(provider default)' && !catalogModelIds.has(entry.model)
+            ? deps.muted(' · 목록에 없는 모델 — /provider use 로 바꾸기')
+            : '';
+          lines.push(`  ${marker} ${entry.label.padEnd(14)} ${deps.subtext(entry.provider)}  ${deps.muted(entry.model)}${missing}`);
         }
         lines.push('');
       }
-      lines.push(deps.muted('  Available providers (env-detected):'));
+      lines.push(deps.muted('  쓸 수 있는 공급자'));
+      // PROVIDERS has anthropic, not claude; collapse the legacy claude display alias.
+      const canonicalName = (name: string): string => {
+        const lower = name.toLowerCase();
+        return lower === 'claude' ? 'anthropic' : lower;
+      };
+      const unique = new Map<string, DashboardProviderAvailabilityView>();
       for (const provider of providers) {
-        const mark = provider.available ? deps.success('\u2713') : deps.muted('\u00B7');
-        const label = provider.available ? deps.text(provider.name) : deps.muted(provider.name);
-        const hint = !provider.available
-          ? deps.muted(`  (set ${provider.name.toUpperCase()}_API_KEY${provider.name === 'local' ? ' or LOCAL_LLM_URL' : ''})`)
-          : '';
-        lines.push(`  ${mark} ${label.padEnd(20)} ${deps.subtext(provider.model)}${hint}`);
+        const key = canonicalName(provider.name);
+        const previous = unique.get(key);
+        if (!previous || (!previous.available && provider.available) || (key === provider.name && previous.name !== key && previous.available === provider.available)) {
+          unique.set(key, provider);
+        }
+      }
+      let unavailable = 0;
+      for (const provider of unique.values()) {
+        if (!provider.available) { unavailable++; continue; }
+        lines.push(`  ${deps.success('\u2713')} ${deps.text(provider.name).padEnd(20)} ${deps.subtext(provider.model ?? '')}`);
       }
+      if (unavailable > 0) lines.push(deps.muted(`  그 밖 ${unavailable}개는 키·로그인 필요 — elanous setup llm`));
+      // Keep the old English search terms as a subordinate hint, not section headings.
+      lines.push(deps.muted('  · Rotation (cycle with /provider next) · Available providers'));
       return lines;
     },
   };

package/src/dashboard/slash-runtime/dashboard-handlers.ts

@@ -301,6 +301,7 @@ import {
 import type { LLMProviderName } from '../../user-config.js';
 import { lookupLlmTierSpec } from '../../model-tier/index.js';
 import { listProviders } from '../../llm.js';
+import { enabledModels, loadCatalog } from '../../intelligence-map/model-catalog.js';
 import { selfOrchestrateRuntime } from '../../self-dev/self-orchestrate-runtime.js';
 import type { ToolRuntime } from '../../tool-runtime/types.js';
 import { getSessionCwd } from '../../session/working-dir.js';
@@ -742,6 +743,7 @@ export interface DashboardSlashContext {
       overviewLines(
         rotation: readonly { label: string; provider: string; model: string; current: boolean }[],
         providers: readonly { available: boolean; name: string; model: string | undefined }[],
+        catalogModelIds?: ReadonlySet<string>,
       ): readonly string[];
     };
     /** 2026-05-05 — open the visual model picker programmatically.
@@ -5281,6 +5283,13 @@ export function buildDashboardSlashRegistry(): SlashCommandRegistry<DashboardSla
     const cfgNow = getUserConfig();
     const rot = cfgNow.llm.rotation;
     const curIdx = rot && rot.length > 0 ? currentRotationIndex(cfgNow) : -1;
+    let catalogModelIds: Set<string> | undefined;
+    try {
+      const loaded = loadCatalog();
+      if (loaded.source !== 'fallback') {
+        catalogModelIds = new Set(enabledModels(loaded.catalog).map((model) => model.id));
+      }
+    } catch { /* catalog unreadable: no stale-model verdict */ }
     ctx.chatLines.push(...ctx.provider.slashRuntime.overviewLines(
       (rot ?? []).map((entry, index) => ({
         label: rotationEntryLabel(entry),
@@ -5293,6 +5302,7 @@ export function buildDashboardSlashRegistry(): SlashCommandRegistry<DashboardSla
         name: provider.name,
         model: provider.model,
       })),
+      catalogModelIds,
     ));
     const currentRoute = currentRouteDecision('dashboard');
     if (currentRoute) ctx.chatLines.push(ctx.muted(`  current route: ${formatRouteDecisionSummary(currentRoute)}`));

package/src/dashboard/turn-stream-formatter.ts

@@ -236,7 +236,7 @@ export function createTurnStreamFormatter(
     },
     onToolCall(call: TurnStreamCall): void {
       toolCallCount += 1;
-      deps.thinking.update(`Streaming ${call.name} (${toolCallCount} tools)`);
+      deps.thinking.update(`Streaming ${call.name} (${toolCallCount} ${toolCallCount === 1 ? 'tool' : 'tools'})`);
       const ptyLine = deps.ptyCallLine(call.name, call.args);
       if (ptyLine) {
         nonGenericCallIds.add(call.id);

package/src/decisions/decision-cards.ts

@@ -277,7 +277,7 @@ export function ghPrReplier(target: string, run: (args: string[], stdin: string)
 
 /** Post as the automation App (not the machine's personal gh login — that would make 대표 a participant and mail them),
  *  with proxy variables removed (they break gh on the ops host). TC review #22660. */
-async function runGh(args: string[], stdin: string): Promise<number> {
+export async function runGh(args: string[], stdin: string): Promise<number> {
   const env: Record<string, string> = {};
   for (const [k, v] of Object.entries(process.env)) if (v !== undefined && !/^(https?|all|no)_proxy$/i.test(k)) env[k] = v;
   try {

package/src/index.ts

@@ -10114,10 +10114,14 @@ tokenCmd
   .description('Rotate the ACP admin token')
   .option('--grace-ms <ms>', 'Previous-token grace period in milliseconds', (value: string) => Number(value))
   .option('--show-token', 'Print the complete new token')
-  .action(async (opts: { graceMs?: number; showToken?: boolean }) => {
+  .option('--sync-op-proxy', 'Update the configured op proxy bearer over SSH after rotation')
+  .action(async (opts: { graceMs?: number; showToken?: boolean; syncOpProxy?: boolean }) => {
     if (opts.graceMs !== undefined && (!Number.isFinite(opts.graceMs) || opts.graceMs < 0)) {
       throw new Error('--grace-ms must be a non-negative finite number');
     }
+    if (opts.syncOpProxy && opts.showToken) {
+      throw new Error('--sync-op-proxy cannot be combined with --show-token');
+    }
     const [{ rotateAdminToken }, { getElanousConfigDir }] = await Promise.all([
       import('./auth/token-store.js'),
       import('./elanous-config-dir.js'),
@@ -10128,9 +10132,17 @@ tokenCmd
     });
     if (opts.showToken) {
       console.log(result.newActive);
-      return;
-    }
-    console.log(`ACP admin token rotated: length=${result.newActive.length} prefix=${result.newActive.slice(0, 4)}`);
+    } else {
+      console.log(opts.syncOpProxy
+        ? `ACP admin token rotated: length=${result.newActive.length}`
+        : `ACP admin token rotated: length=${result.newActive.length} prefix=${result.newActive.slice(0, 4)}`);
+    }
+    const { readOpProxyConfig, finishOpProxyRotation } = await import('./cli/op-proxy-sync.js');
+    finishOpProxyRotation(readOpProxyConfig(), result.newActive, {
+      sync: opts.syncOpProxy === true,
+      tokenFile: `${getElanousConfigDir()}/acp-token`,
+      ...(opts.showToken ? { out: (line: string) => console.error(line) } : {}),
+    });
   });
 
 const acpCmd = program.command('acp').description('Agent Client Protocol — spawn ACP agents (claude-code, codex, gemini)');

package/src/maturity/feature-maturity.ts

@@ -38,6 +38,8 @@ export const FEATURE_MATURITY = {
     '/design-check': { pwa: 'tool' },
     '/control': { pwa: 'tool' },
     '/scheduler': { pwa: 'ops' },
+    '/ops/release': { pwa: 'ops' },
+    '/ops/checklist': { pwa: 'ops' },
     '/dashboard': { pwa: 'ops' },
     '/bots': { pwa: 'ops' },
     '/botlab': { pwa: 'ops' },

package/src/nexus/api/http-server.ts

@@ -155,11 +155,14 @@ import {
 import { handleBuildsGet, parseBuildsPath } from './builds-api.js';
 import { handleHarnessAskPost, handleHarnessAskStatusGet, handleHarnessRunEventsGet, handleHarnessRunScreenGet, handleHarnessRunsGet, handleHarnessStopPost } from './harness-api.js';
 import { dispatchPersonaRoute } from './personas.js';
+import { handleMe } from './operator.js';
+import { handleOpsApi } from './ops-api.js';
 import { handleRoleJudge } from './role-judge.js';
 import { handleAudioStt } from './audio-stt.js';
 import { handleLlmModels } from './llm-models.js';
 import { handleLlmHostsConfig } from './llm-hosts-config.js';
 import { handleLlmRotationGet, handleLlmRotationNext } from './llm-rotation.js';
+import { handleSetupClaim } from './setup-claim.js';
 import {
   handleLlmProvidersList,
   handleLlmProviderSet,
@@ -312,6 +315,7 @@ import {
   handleVoiceTranscribe,
   checkAuth,
   bearerCredential,
+  setupBearerScopeDenied,
   registerAuthPeerAddress,
   type MetaApiOpts,
 } from './meta-api.js';
@@ -826,6 +830,9 @@ export async function routeRequest(
   registerAuthPeerAddress(req, (server as BunServerLike & {
     requestIP?: (request: Request) => { address: string } | null;
   }).requestIP?.(req)?.address);
+  if (opts.metaApi && setupBearerScopeDenied(req, opts.metaApi)) {
+    return jsonResponse({ error: 'forbidden' }, 403);
+  }
 
   // PR c — try WS upgrade before HTTP routing. On undefined return the
   // bridge has accepted the upgrade (Bun completes the handshake) and
@@ -852,6 +859,12 @@ export async function routeRequest(
   const { pathname } = url;
   const method = req.method;
 
+  // Operator proxy credentials are distinct from the owner bearer. The ops handler
+  // performs its own operatorSignal gate before reading any run or checklist data.
+  if (pathname === '/v1/ops' || pathname.startsWith('/v1/ops/')) {
+    return handleOpsApi(req, opts.metaApi);
+  }
+
   // Default-deny for every `/v1/` path that is not on PUBLIC_ROUTES.
   // Reuses checkAuth (same-origin exemption + constant-time bearer).
   // setupMode is not implemented on this server (P24b) — pass false.
@@ -1520,6 +1533,10 @@ export async function routeRequest(
     if (pathname === '/v1/llm/rotation' && method === 'OPTIONS') {
       return handleLlmRotationGet(req);
     }
+    // The one-use link is verified by the claim handler, not by the owner bearer.
+    if (pathname === '/v1/setup/claim' && (method === 'POST' || method === 'OPTIONS')) {
+      return method === 'OPTIONS' ? corsPreflight('POST, OPTIONS') : handleSetupClaim(req);
+    }
     // PWA `/setup` wizard Phase 1 (2026-05-19) — LLM provider 첫 셋업.
     // POST 는 mutation 블록 안에서 등록 (memory `feedback_post_route_must_be_in_method_block`).
     // GET sibling 은 아래 GET-only 블록에 등록.
@@ -2153,6 +2170,9 @@ export async function routeRequest(
     }
     return jsonResponse({ error: 'static-not-wired' }, 404);
   }
+  // OPS1·OPS2 — whether this caller is an operator (draws the ops area). Answers everyone before any auth gate;
+  // false unless this daemon's config has operator.enabled.
+  if (pathname === '/v1/me' && req.method === 'GET') return handleMe(req, opts.metaApi ?? ({} as MetaApiOpts));
   if (pathname === '/v1/health') {
     return handleHealth(opts.state, opts.registry, {
       bindHost: bind.hostname,

package/src/nexus/api/meta-api.ts

@@ -16,6 +16,7 @@
 
 import { randomUUID } from 'node:crypto';
 import { matchTempToken } from '../../auth/temp-tokens.js';
+import { matchSetupBearer } from '../../auth/setup-link-tokens.js';
 import { existsSync, readFileSync, statSync } from 'node:fs';
 import { extname } from 'node:path';
 
@@ -215,6 +216,8 @@ type AuthReason =
   | 'untrusted-same-origin-peer'
   | 'bearer-match'
   | 'temp-token'
+  | 'setup-bearer'
+  | 'setup-scope-denied'
   | 'no-bearer-configured'
   | 'missing-auth-header'
   | 'bearer-length-mismatch'
@@ -248,8 +251,27 @@ export function registerAuthPeerAddress(req: Request, peerAddress: string | unde
   authPeerAddresses.set(req, peerAddress);
 }
 
+function setupRouteAllowed(req: Request): boolean {
+  const path = new URL(req.url).pathname;
+  if (path.startsWith('/v1/setup/')) return true;
+  return (req.method === 'POST' && path === '/v1/prompt/stream')
+    || (req.method === 'GET' && (
+      /^\/v1\/sessions\/store\/[^/]+$/.test(path) || path === '/v1/chat/events'
+    ));
+}
+
 function decideAuth(req: Request, opts: MetaApiOpts): { ok: boolean; reason: AuthReason } {
   if (opts.noAuth) return { ok: true, reason: 'noauth' };
+  const offered = req.headers.get('authorization');
+  if (offered?.startsWith('Bearer elsb_')) {
+    const owner = decideBearer(req, opts);
+    if (owner.ok) return owner;
+    const bearer = offered.slice('Bearer '.length).trim();
+    if (!matchSetupBearer(bearer)) return { ok: false, reason: 'bearer-mismatch' };
+    return setupRouteAllowed(req)
+      ? { ok: true, reason: 'setup-bearer' }
+      : { ok: false, reason: 'setup-scope-denied' };
+  }
   const peerAddress = authPeerAddresses.get(req);
   if (isSameOriginRequest(req, peerAddress)) return { ok: true, reason: 'same-origin' };
   const peerRejected = req.headers.get('sec-fetch-site') === 'same-origin'
@@ -292,6 +314,10 @@ export function bearerCredential(req: Request, opts: MetaApiOpts): 'noauth' | 'b
 // check — without duplicating security-sensitive code.
 const authDecisions = new WeakMap<Request, { ok: boolean; reason: AuthReason }>();
 
+export function setupBearerScopeDenied(req: Request, opts: MetaApiOpts): boolean {
+  return decideAuth(req, opts).reason === 'setup-scope-denied';
+}
+
 export function checkAuth(req: Request, opts: MetaApiOpts): boolean {
   const decision = decideAuth(req, opts);
   authDecisions.set(req, decision);
@@ -322,6 +348,7 @@ export function checkAuth(req: Request, opts: MetaApiOpts): boolean {
  * intentionally collapse here to avoid exposing token-length information. */
 function authFailureResponse(req: Request, opts: MetaApiOpts): Response {
   const decision = authDecisions.get(req) ?? decideAuth(req, opts);
+  if (decision.reason === 'setup-scope-denied') return jsonResponse({ error: 'forbidden' }, 403);
   return jsonResponse({ error: 'unauthorized', reason: publicAuthFailureReason(decision.reason) }, 401);
 }
 

package/src/nexus/api/operator.ts

@@ -0,0 +1,61 @@
+// OPS1·OPS2 — who is an «operator» (sees the ops area). Off unless this daemon's config says `operator.enabled: true`
+// (only our own machines); an external install never reports an operator, whatever header or token arrives.
+// Design: 내부 문서 `DESIGN-pwa-menu-reorg-and-ops-area-2026-10-02` §2.
+import { timingSafeEqual } from 'node:crypto';
+import { readFileSync, statSync } from 'node:fs';
+import { debug } from '../../debug/log.js';
+import { getUserConfig } from '../../user-config.js';
+import { checkAuth, type MetaApiOpts } from './meta-api.js';
+
+/** Set by the op.elanous.ai proxy (Caddy) after Google sign-in, server side; the proxy strips any incoming copy. */
+export const OPERATOR_HEADER = 'x-elanous-operator';
+
+export type OperatorSource = 'op-proxy' | 'owner' | null;
+export interface OperatorSignal { operator: boolean; operatorSource: OperatorSource }
+export interface OperatorConfig { enabled: boolean; proxySecretFile?: string }
+
+export function readOperatorConfig(raw: unknown = getUserConfig().raw?.operator): OperatorConfig {
+  const o = raw && typeof raw === 'object' && !Array.isArray(raw) ? raw as Record<string, unknown> : {};
+  return {
+    enabled: o.enabled === true,
+    ...(typeof o.proxySecretFile === 'string' && o.proxySecretFile.trim() ? { proxySecretFile: o.proxySecretFile.trim() } : {}),
+  };
+}
+
+/** The proxy secret, only from a regular file nobody but the owner can read (mode 600); anything else turns the header path off. */
+export function readProxySecret(path: string | undefined): string | null {
+  if (!path) return null;
+  try {
+    const st = statSync(path);
+    if (!st.isFile() || (st.mode & 0o077) !== 0) return null;
+    const value = readFileSync(path, 'utf8').trim();
+    return value.length >= 16 ? value : null;
+  } catch { return null; }
+}
+
+function sameSecret(offered: string, secret: string): boolean {
+  const a = Buffer.from(offered);
+  const b = Buffer.from(secret);
+  return a.length === b.length && timingSafeEqual(a, b);
+}
+
+export interface OperatorDeps { config?: OperatorConfig; readSecret?: (path: string | undefined) => string | null; isOwner?: (req: Request) => boolean }
+
+export function operatorSignal(req: Request, opts: MetaApiOpts, deps: OperatorDeps = {}): OperatorSignal {
+  const config = deps.config ?? readOperatorConfig();
+  if (!config.enabled) return { operator: false, operatorSource: null };
+  const offered = req.headers.get(OPERATOR_HEADER);
+  if (offered) {
+    const secret = (deps.readSecret ?? readProxySecret)(config.proxySecretFile);
+    if (secret && sameSecret(offered, secret)) return { operator: true, operatorSource: 'op-proxy' };
+  }
+  if ((deps.isOwner ?? ((r: Request) => checkAuth(r, opts)))(req)) return { operator: true, operatorSource: 'owner' };
+  return { operator: false, operatorSource: null };
+}
+
+/** `GET /v1/me` — answers every caller (no auth needed: it only says whether to draw the ops area). */
+export function handleMe(req: Request, opts: MetaApiOpts, deps: OperatorDeps = {}): Response {
+  const signal = operatorSignal(req, opts, deps);
+  debug.log('ops.api', 'me', { operator: signal.operator, source: signal.operatorSource });
+  return Response.json(signal, { headers: { 'cache-control': 'no-store' } });
+}

package/src/nexus/api/ops-api.ts

@@ -0,0 +1,139 @@
+import { lstatSync, readFileSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { debug, redactSecretText } from '../../debug/log.js';
+import { effectiveInstanceRoot } from '../../instance/resolve.js';
+import { listChecklist } from '../../release-loop/checklist.js';
+import { jsonResponse } from './json-response.js';
+import { operatorSignal } from './operator.js';
+import { createSeatsCache, todayKst } from './ops-seats.js';
+import { liveSeatsSources } from './ops-seats-sources.js';
+import type { MetaApiOpts } from './meta-api.js';
+
+const VERSION = /^\d+\.\d+\.\d+(?:-(?:rc|alpha|beta)\.\d+)?$/;
+const IDENTIFIER = /^[A-Za-z0-9-]+$/;
+const DATE = /^\d{4}-\d{2}-\d{2}$/;
+let seatsCache: ReturnType<typeof createSeatsCache> | null = null;
+/** Tests swap the sources; production builds them lazily on first use. */
+export function setSeatsCacheForTest(cache: ReturnType<typeof createSeatsCache> | null): void { seatsCache = cache; }
+const LOG_PATH = /^\/v1\/ops\/release\/runs\/([^/]+)\/nodes\/([^/]+)\/log$/;
+
+interface RunNode { nodeId: string; ok?: unknown; output?: unknown }
+interface RunRecord {
+  status: string;
+  path: string[];
+  startedAt: string;
+  input?: unknown;
+  nodes: RunNode[];
+}
+
+function recordAt(path: string): RunRecord | null {
+  try {
+    if (!lstatSync(path).isFile()) return null;
+    const value: unknown = JSON.parse(readFileSync(path, 'utf8'));
+    if (!value || typeof value !== 'object') return null;
+    const run = value as Partial<RunRecord>;
+    if (typeof run.status !== 'string' || !Array.isArray(run.path)
+      || typeof run.startedAt !== 'string' || !Array.isArray(run.nodes)) return null;
+    return run as RunRecord;
+  } catch { return null; }
+}
+
+function outputText(output: unknown): string {
+  if (typeof output === 'string') return output;
+  if (output === undefined || output === null) return '';
+  return JSON.stringify(output) ?? '';
+}
+
+function nodeSummary(output: unknown): string {
+  let value = output;
+  if (typeof value === 'string') {
+    const text = value;
+    try { value = JSON.parse(text) as unknown; }
+    catch {
+      const last = text.split('\n').map((line) => line.trim()).filter(Boolean).at(-1);
+      try { value = JSON.parse(last ?? '') as unknown; } catch { return ''; }
+    }
+  }
+  if (!value || typeof value !== 'object') return '';
+  const summary = (value as { summary?: unknown }).summary;
+  return typeof summary === 'string' ? redactSecretText(summary).slice(0, 300) : '';
+}
+
+function runVersion(input: unknown): string | null {
+  if (!input || typeof input !== 'object') return null;
+  const version = (input as { version?: unknown }).version;
+  return typeof version === 'string' && VERSION.test(version) ? version : null;
+}
+
+/** The sole data gate for every read-only /v1/ops endpoint. */
+export function handleOpsApi(req: Request, metaApi: MetaApiOpts | undefined): Response | Promise<Response> {
+  const url = new URL(req.url);
+  const { pathname } = url;
+  if (req.method !== 'GET') return jsonResponse({ error: 'method-not-allowed' }, 405);
+
+  const signal = metaApi ? operatorSignal(req, metaApi) : { operator: false, operatorSource: null };
+  if (!signal.operator) {
+    debug.log('ops.api', 'refused', { path: pathname, source: signal.operatorSource });
+    return jsonResponse({ error: 'forbidden' }, 403);
+  }
+  const served = (response: Response): Response => {
+    debug.log('ops.api', 'served', { path: pathname, source: signal.operatorSource });
+    response.headers.set('cache-control', 'no-store');
+    return response;
+  };
+  if (pathname === '/v1/ops/seats') {
+    const date = url.searchParams.get('date') ?? todayKst();
+    if (!DATE.test(date) || Number.isNaN(Date.parse(`${date}T00:00:00+09:00`))) return jsonResponse({ error: 'invalid-date' }, 400);
+    seatsCache ??= createSeatsCache(liveSeatsSources());
+    return seatsCache(date).then((board) => served(jsonResponse(board)), () => jsonResponse({ error: 'seats-unavailable' }, 500));
+  }
+  const version = url.searchParams.get('version');
+  if (pathname === '/v1/ops/checklist') {
+    if (!version || !VERSION.test(version)) return jsonResponse({ error: 'invalid-version' }, 400);
+    return served(jsonResponse(listChecklist(version)));
+  }
+  if (pathname === '/v1/ops/release/runs') {
+    if (version !== null && !VERSION.test(version)) return jsonResponse({ error: 'invalid-version' }, 400);
+    const dir = join(effectiveInstanceRoot(), 'graph-runs', 'release-loop');
+    let filenames: string[];
+    try {
+      filenames = readdirSync(dir, { withFileTypes: true })
+        .filter((entry) => entry.isFile() && entry.name.endsWith('.json')
+          && IDENTIFIER.test(entry.name.slice(0, -5)))
+        .map((entry) => entry.name);
+    }
+    catch (error) {
+      if ((error as NodeJS.ErrnoException).code === 'ENOENT') return served(jsonResponse([]));
+      return jsonResponse({ error: 'runs-unavailable' }, 500);
+    }
+    const runs = filenames.flatMap((filename) => {
+      const run = recordAt(join(dir, filename));
+      if (!run) return [];
+      const v = runVersion(run.input);
+      if (version !== null && v !== version) return [];
+      return [{
+        runId: redactSecretText(filename.slice(0, -5)), status: redactSecretText(run.status),
+        startedAt: redactSecretText(run.startedAt), version: v,
+        path: run.path.filter((step): step is string => typeof step === 'string').map(redactSecretText),
+        nodes: run.nodes.filter((node) => node && typeof node.nodeId === 'string').map((node) => ({
+          nodeId: redactSecretText(node.nodeId), ok: typeof node.ok === 'boolean' ? node.ok : null,
+          summary: nodeSummary(node.output),
+        })),
+      }];
+    }).sort((a, b) => b.startedAt.localeCompare(a.startedAt)).slice(0, 20);
+    return served(jsonResponse(runs));
+  }
+  // WHATWG URL normalizes a literal runs/../nodes/... before routing.
+  if (pathname.startsWith('/v1/ops/release/nodes/')) return jsonResponse({ error: 'invalid-id' }, 400);
+  if (pathname.startsWith('/v1/ops/release/runs/')) {
+    const match = LOG_PATH.exec(pathname);
+    if (!match) return jsonResponse({ error: 'invalid-id' }, 400);
+    const [, id, nodeId] = match;
+    if (!IDENTIFIER.test(id!) || !IDENTIFIER.test(nodeId!)) return jsonResponse({ error: 'invalid-id' }, 400);
+    const run = recordAt(join(effectiveInstanceRoot(), 'graph-runs', 'release-loop', `${id}.json`));
+    const node = run?.nodes.find((candidate) => candidate?.nodeId === nodeId);
+    if (!node || node.output === undefined || node.output === null) return jsonResponse({ error: 'not-found' }, 404);
+    return served(jsonResponse({ log: redactSecretText(outputText(node.output)).slice(-4_000) }));
+  }
+  return jsonResponse({ error: 'not-found' }, 404);
+}