elanous 0.2.9 → 0.2.10

package/src/nexus/api/exec-requests.ts

@@ -1,5 +1,9 @@
-import { extname } from 'node:path';
+import { realpathSync, statSync } from 'node:fs';
+import { extname, isAbsolute, join, sep } from 'node:path';
 import { ExecRequestRunner } from '../../exec-requests/runner.js';
+import type { ExecAttachment } from '../../exec-requests/store.js';
+import { getElanousConfigDir } from '../../elanous-config-dir.js';
+import { defaultAttachmentBaseDir } from '../../boot/attachment-store.js';
 import { jsonResponse } from './json-response.js';
 
 const mime: Record<string, string> = {
@@ -8,7 +12,21 @@ const mime: Record<string, string> = {
   '.md': 'text/markdown; charset=utf-8', '.txt': 'text/plain; charset=utf-8',
 };
 
-export async function handleExecRequests(req: Request, runner: ExecRequestRunner): Promise<Response> {
+function resolveAttachment(path: string, roots: string[]): string | null {
+  if (!isAbsolute(path)) return null;
+  try {
+    const real = realpathSync(path);
+    if (!statSync(real).isFile()) return null;
+    return roots.some(root => {
+      try {
+        const base = realpathSync(root);
+        return real.startsWith(`${base}${sep}`);
+      } catch { return false; }
+    }) ? real : null;
+  } catch { return null; }
+}
+
+export async function handleExecRequests(req: Request, runner: ExecRequestRunner, uploadDir = defaultAttachmentBaseDir(), fieldDir = join(getElanousConfigDir(), 'field')): Promise<Response> {
   const path = new URL(req.url).pathname;
   if (path === '/v1/exec-requests') {
     if (req.method === 'POST') {
@@ -16,7 +34,19 @@ export async function handleExecRequests(req: Request, runner: ExecRequestRunner
       try { body = await req.json(); } catch { return jsonResponse({ error: 'bad_request' }, 400); }
       const text = body && typeof body === 'object' && !Array.isArray(body) ? (body as { text?: unknown }).text : undefined;
       if (typeof text !== 'string' || !text.trim()) return jsonResponse({ error: 'bad_request', reason: 'text required' }, 400);
-      const item = runner.submit(text.trim());
+      const supplied = (body as { attachments?: unknown }).attachments;
+      if (supplied !== undefined && (!Array.isArray(supplied) || supplied.some(entry =>
+        !entry || typeof entry !== 'object' || Array.isArray(entry)
+        || typeof entry.name !== 'string' || !entry.name.trim() || typeof entry.path !== 'string'))) {
+        return jsonResponse({ error: 'bad_request', reason: 'attachments must be [{name,path}]' }, 400);
+      }
+      const roots = [uploadDir, fieldDir];
+      const resolved: Array<{ name: string; path: string | null }> | undefined = supplied?.map((entry: ExecAttachment) => ({
+        name: entry.name, path: resolveAttachment(entry.path, roots),
+      }));
+      if (resolved?.some(entry => !entry.path)) return jsonResponse({ error: 'attachment-outside' }, 400);
+      const attachments: ExecAttachment[] | undefined = resolved?.map(entry => ({ name: entry.name, path: entry.path! }));
+      const item = runner.submit(text.trim(), attachments);
       return jsonResponse({ id: item.id, status: 'planning' }, 202);
     }
     if (req.method === 'GET') return jsonResponse({ items: runner.store.list().map(item => {

package/src/nexus/api/http-server.ts

@@ -19,6 +19,8 @@ import { setInProcessOutbound } from '../../domains/outbound-alert.js';
 import { getUserConfig } from '../../user-config.js';
 import type { TelegramEvent } from '../../workflow-runtime/triggers/telegram-source.js';
 import { spawnSync } from 'node:child_process';
+import { isAbsolute } from 'node:path';
+import { createProject, listProjects } from '../../project/project-store.js';
 import { compareTokenConstTime } from '../../acp/transport/auth.js';
 import { ensureAuthToken } from '../../auth/acp-token.js';
 import type { NexusState } from '../state/state.js';
@@ -134,6 +136,7 @@ import {
   type ReflectionRouteOpts,
 } from './reflection.js';
 import { handleSignalBoard } from './signal-board-api.js';
+import { handleUsageGet } from './usage-api.js';
 import {
   handleDashboard,
   handleDashboardRefreshLive,
@@ -163,6 +166,7 @@ import { handleLlmModels } from './llm-models.js';
 import { handleLlmHostsConfig } from './llm-hosts-config.js';
 import { handleLlmRotationGet, handleLlmRotationNext } from './llm-rotation.js';
 import { handleSetupClaim } from './setup-claim.js';
+import { handleSetupCodexLoginGet, handleSetupCodexLoginPost } from './setup-codex-login.js';
 import {
   handleLlmProvidersList,
   handleLlmProviderSet,
@@ -278,7 +282,7 @@ import { handleSchedulesActionPost } from './schedules-action.js';
 import { handleSchedulesList, handleScheduleDetail, handleScheduleRuns } from './schedules-read.js';
 import { handleIntakeRunsList } from './intake-runs.js';
 import { handleMissionsList, handleMissionDetail } from './missions.js';
-import { handleSessionsStoreList, handleSessionsStoreGet, handleSessionsStoreFork, handleSessionsStoreDelete } from './sessions-store.js';
+import { handleSessionsStoreList, handleSessionsStoreGet, handleSessionsStoreFork, handleSessionsStoreDelete, handleSessionsStorePatch } from './sessions-store.js';
 import { handleLogsQuery, handleLogsStream, handleLogsLevelGet, handleLogsLevelPost, handleLogsFacets, handleLogsHistogram, handleLogsInstances } from './log-fabric.js';
 import { handleTrace, handleTraceEvidence } from './trace.js';
 import { handleDispatchRunsList } from './dispatch-runs.js';
@@ -465,6 +469,8 @@ export interface NexusHttpServerOpts {
   state: NexusState;
   registry: TabRegistry;
   eventBus: NexusEventBus;
+  /** Test seam for the read-only usage collector; production uses the cached handler. */
+  usageHandler?: () => Promise<Response>;
   /** Supervisor handle — required for the write API (PR ι). When omitted
    *  (skipSupervisor mode), mutation routes return 503. */
   supervisor?: Supervisor;
@@ -795,6 +801,27 @@ export function startNexusHttpServer(opts: NexusHttpServerOpts): NexusHttpServer
   };
 }
 
+export function handleProjectsGet(): Response {
+  return jsonResponse({ projects: listProjects() });
+}
+
+export async function handleProjectsPost(req: Request): Promise<Response> {
+  let body: unknown;
+  try { body = await req.json(); }
+  catch { return jsonResponse({ error: 'invalid_json' }, 400); }
+  if (!body || typeof body !== 'object' || Array.isArray(body)) {
+    return jsonResponse({ error: 'invalid_name' }, 400);
+  }
+  const { name, primaryFolder } = body as Record<string, unknown>;
+  if (typeof name !== 'string' || !name.trim() || name.length > 80) {
+    return jsonResponse({ error: 'invalid_name' }, 400);
+  }
+  if (primaryFolder !== undefined && (typeof primaryFolder !== 'string' || !isAbsolute(primaryFolder))) {
+    return jsonResponse({ error: 'invalid_primary_folder' }, 400);
+  }
+  return jsonResponse({ project: createProject({ name, ...(primaryFolder !== undefined ? { primaryFolder } : {}) }) }, 201);
+}
+
 function isPortBusy(err: unknown): boolean {
   if (!err) return false;
   // Bun.serve errors expose `.code === 'EADDRINUSE'` (Node-compatible)
@@ -1285,11 +1312,22 @@ export async function routeRequest(
     return handleGraphsValidatePost(req, opts.metaApi);
   }
 
+  if (pathname === '/v1/projects' && (method === 'GET' || method === 'POST')) {
+    if (!opts.metaApi || !checkAuth(req, opts.metaApi)) return jsonResponse({ error: 'unauthorized' }, 401);
+    return method === 'GET' ? handleProjectsGet() : handleProjectsPost(req);
+  }
+
   if (pathname === '/v1/config/chat-fast-path' && (method === 'GET' || method === 'PUT')) {
     if (!opts.metaApi || !checkAuth(req, opts.metaApi)) return jsonResponse({ error: 'unauthorized' }, 401);
     return handleChatFastPathConfig(req);
   }
 
+  if (pathname === '/v1/usage') {
+    if (!opts.metaApi || !checkAuth(req, opts.metaApi)) return jsonResponse({ error: 'unauthorized' }, 401);
+    if (method !== 'GET') return jsonResponse({ error: 'method-not-allowed' }, 405);
+    return (opts.usageHandler ?? handleUsageGet)();
+  }
+
   // Mutation routes (PR ι) — POST/PATCH/DELETE on /v1/nexus/tabs[/:id[/action]].
   // Templates POST handled here too (PR κ).
   // Config / secrets PUT/POST/DELETE here too (PR μ).
@@ -1540,6 +1578,11 @@ export async function routeRequest(
     // PWA `/setup` wizard Phase 1 (2026-05-19) — LLM provider 첫 셋업.
     // POST 는 mutation 블록 안에서 등록 (memory `feedback_post_route_must_be_in_method_block`).
     // GET sibling 은 아래 GET-only 블록에 등록.
+    if (pathname === '/v1/setup/codex-login' && (method === 'POST' || method === 'OPTIONS')) {
+      if (method === 'OPTIONS') return corsPreflight('GET, POST, OPTIONS');
+      if (!opts.metaApi || !checkAuth(req, opts.metaApi)) return jsonResponse({ error: 'unauthorized' }, 401);
+      return handleSetupCodexLoginPost(req);
+    }
     if (pathname === '/v1/setup/llm-provider' && (method === 'POST' || method === 'OPTIONS')) {
       if (method === 'POST') { if (!opts.metaApi || !checkAuth(req, opts.metaApi)) return jsonResponse({ error: 'unauthorized' }, 401); }
       return handleLlmProviderSet(req);
@@ -1904,6 +1947,11 @@ export async function routeRequest(
       const id = decodeURIComponent(pathname.slice('/v1/sessions/store/'.length, -'/fork'.length));
       return handleSessionsStoreFork(req, id, opts.metaApi);
     }
+    if (pathname.startsWith('/v1/sessions/store/') && !pathname.endsWith('/fork') && method === 'PATCH') {
+      if (!opts.metaApi) return jsonResponse({ error: 'unauthorized' }, 401);
+      const id = decodeURIComponent(pathname.slice('/v1/sessions/store/'.length));
+      return handleSessionsStorePatch(req, id, opts.metaApi);
+    }
     // on-disk 세션 삭제(파괴적) — 라이브 세션 관리. /store/:id (fork/transcript 와 구분).
     if (pathname.startsWith('/v1/sessions/store/') && !pathname.endsWith('/fork') && method === 'DELETE') {
       if (!opts.metaApi) return jsonResponse({ error: 'meta-api-runtime-not-wired' }, 503);
@@ -2425,6 +2473,10 @@ export async function routeRequest(
   }
   // PWA `/setup` wizard Phase 1 (2026-05-19) — provider catalog 표시.
   // POST sibling (`/v1/setup/llm-provider`) 는 위 mutation 블록.
+  if (pathname === '/v1/setup/codex-login') {
+    if (!opts.metaApi || !checkAuth(req, opts.metaApi)) return jsonResponse({ error: 'unauthorized' }, 401);
+    return handleSetupCodexLoginGet();
+  }
   if (pathname === '/v1/setup/llm-providers') {
     return handleLlmProvidersList(req);
   }

package/src/nexus/api/meta-api.ts

@@ -147,6 +147,10 @@ export interface MetaApiOpts {
    *  compared constant-time against the `Authorization: Bearer …`
    *  header. */
   bearerToken?: string;
+  /** Server-side human identity verification, independent of the shared bearer credential.
+   *  Never derive this result from request body, claimed source, or bearer possession alone.
+   *  Without a verifier, prompt tool mutations remain unavailable. */
+  resolveVerifiedOwner?: (req: Request) => { id: string } | undefined;
   /** Convenience for Tailscale-only / dogfood-loopback mode. */
   noAuth?: boolean;
   // ── PR k · runtime DI for the lifted endpoints ─────────────────
@@ -788,6 +792,11 @@ function notFound(payload: Record<string, unknown> = {}): Response {
 
 // ── /v1/prompt ────────────────────────────────────────────────────
 
+export function promptVerifiedOwner(req: Request, opts: MetaApiOpts): { id: string } | undefined {
+  const owner = opts.resolveVerifiedOwner?.(req);
+  return typeof owner?.id === 'string' && owner.id.trim() ? { id: owner.id.trim() } : undefined;
+}
+
 export async function handlePromptPost(
   req: Request,
   opts: MetaApiOpts,
@@ -831,6 +840,7 @@ export async function handlePromptPost(
         surface: surfaceResolution.surface,
         surfaceResolutionReason: surfaceResolution.reason,
         ...(parsed.value.userContent ? { promptBlocks: parsed.value.userContent } : {}),
+        ...((owner) => owner ? { verifiedOwner: owner } : {})(promptVerifiedOwner(req, opts)),
         ...(resolvePromptHitlChannels(typeof body.sessionId === 'string' ? body.sessionId : '', opts) ?? {}),
         ...(effectiveSurface ? { toolSurface: effectiveSurface } : {}),
         ...(opts.toolCwd ? { toolCwd: opts.toolCwd } : {}),
@@ -1188,6 +1198,7 @@ export async function handlePromptStreamPost(
                 surface: surfaceResolution.surface,
                 surfaceResolutionReason: surfaceResolution.reason,
                 ...(parsed.value.userContent ? { promptBlocks: parsed.value.userContent } : {}),
+                ...((owner) => owner ? { verifiedOwner: owner } : {})(promptVerifiedOwner(req, opts)),
                 ...(resolvePromptHitlChannels(typeof body.sessionId === 'string' ? body.sessionId : '', opts) ?? {}),
                 ...(effectiveSurface ? { toolSurface: effectiveSurface } : {}),
                 ...(opts.toolCwd ? { toolCwd: opts.toolCwd } : {}),

package/src/nexus/api/ops-api.ts

@@ -3,6 +3,7 @@ import { join } from 'node:path';
 import { debug, redactSecretText } from '../../debug/log.js';
 import { effectiveInstanceRoot } from '../../instance/resolve.js';
 import { listChecklist } from '../../release-loop/checklist.js';
+import { getSchedule } from '../../release-loop/release-schedule.js';
 import { jsonResponse } from './json-response.js';
 import { operatorSignal } from './operator.js';
 import { createSeatsCache, todayKst } from './ops-seats.js';
@@ -90,7 +91,15 @@ export function handleOpsApi(req: Request, metaApi: MetaApiOpts | undefined): Re
   const version = url.searchParams.get('version');
   if (pathname === '/v1/ops/checklist') {
     if (!version || !VERSION.test(version)) return jsonResponse({ error: 'invalid-version' }, 400);
-    return served(jsonResponse(listChecklist(version)));
+    // OPS2 header «컷 · 착지 마감»: the version's row in the release schedule (REL9a), or null when none is set.
+    let schedule: { cutAt: string; landBy: string | null } | null = null;
+    try {
+      const row = getSchedule(version);
+      schedule = row ? { cutAt: row.cutAt, landBy: row.landBy ?? null } : null;
+    } catch (error) {
+      debug.log('ops.api', 'schedule-unreadable', { version, reason: error instanceof Error ? error.message.slice(0, 80) : 'unknown' }, { level: 'warn' });
+    }
+    return served(jsonResponse({ ...listChecklist(version), schedule }));
   }
   if (pathname === '/v1/ops/release/runs') {
     if (version !== null && !VERSION.test(version)) return jsonResponse({ error: 'invalid-version' }, 400);

package/src/nexus/api/ops-seats-sources.ts

@@ -1,9 +1,10 @@
 // Live sources for /v1/ops/seats: the coordination PR and merged PRs through gh (automation App identity, proxy variables
 // removed — same rule as decision replies), the release checklist, and the decision ledger. Each failure becomes null upstream.
 import { DecisionLedger } from '../../decisions/decision-ledger.js';
+import { listCoordEvents, type CoordEvent } from '../../context-bus/coord-events.js';
 import { devVersion, listChecklist, type ChecklistItem } from '../../release-loop/checklist.js';
 import { getUserConfig } from '../../user-config.js';
-import { kstDayRange, type ChannelComment, type MergedPr, type SeatsSources } from './ops-seats.js';
+import { SEATS, kstDayRange, type ChannelComment, type ChannelSource, type MergedPr, type SeatsSources } from './ops-seats.js';
 
 const GH_TIMEOUT_MS = 20_000;
 
@@ -29,19 +30,48 @@ function channelTarget(): { repo: string; pr: string } | null {
   return m ? { repo: m[1]!, pr: m[2]! } : null;
 }
 
+export async function channelCommentsSince(sinceIso: string): Promise<Array<{ body: string; createdAt: string; url: string }> | null> {
+  const target = channelTarget();
+  if (!target) return null;
+  const lines = await ghLines(['api', '--paginate', `repos/${target.repo}/issues/${target.pr}/comments?since=${sinceIso}&per_page=100`,
+    '--jq', '.[] | {body: .body, createdAt: .created_at, url: .html_url} | tojson']);
+  return lines?.map((line) => JSON.parse(line) as { body: string; createdAt: string; url: string }) ?? null;
+}
+
 function nextPatch(version: string): string {
   const [major, minor, patch] = version.split('.').map(Number);
   return `${major}.${minor}.${patch! + 1}`;
 }
 
-export function liveSeatsSources(): SeatsSources {
+export function liveSeatsSources(deps: { listEvents?: typeof listCoordEvents; githubChannel?: typeof channelCommentsSince } = {}): SeatsSources {
   return {
     async channel(date) {
-      const target = channelTarget();
-      if (!target) return null;
-      const lines = await ghLines(['api', '--paginate', `repos/${target.repo}/issues/${target.pr}/comments?since=${kstDayRange(date).start}&per_page=100`,
-        '--jq', '.[] | {body: .body, createdAt: .created_at} | tojson']);
-      return lines?.map((line) => JSON.parse(line) as ChannelComment) ?? null;
+      const since = kstDayRange(date).start;
+      let events: CoordEvent[] = [];
+      try { events = (deps.listEvents ?? listCoordEvents)({ since }); } catch { /* GitHub fallback */ }
+      const latest = new Map<string, CoordEvent>();
+      for (const event of events) {
+        if (!SEATS.some(({ seat }) => seat === event.refs.seat)) continue;
+        const prior = latest.get(event.refs.seat);
+        if (!prior || event.at > prior.at) latest.set(event.refs.seat, event);
+      }
+      const seatSources: Partial<Record<(typeof SEATS)[number]['seat'], ChannelSource>> = {};
+      if (latest.size) {
+        const comments: ChannelComment[] = [];
+        for (const { seat } of SEATS) {
+          const event = latest.get(seat);
+          if (!event) { seatSources[seat] = 'unknown'; continue; }
+          comments.push({ body: `**[${seat}]** ${event.text}`, createdAt: event.at, url: event.refs.url ?? '' });
+          seatSources[seat] = 'ledger';
+        }
+        return { source: 'ledger', comments, seatSources };
+      }
+      let github: ChannelComment[] | null;
+      try { github = await (deps.githubChannel ?? channelCommentsSince)(since); }
+      catch { github = null; }
+      if (github === null) return null;
+      for (const { seat } of SEATS) seatSources[seat] = 'github';
+      return { source: 'github', comments: github, seatSources };
     },
     async merged(date) {
       const target = channelTarget();

package/src/nexus/api/ops-seats.ts

@@ -1,7 +1,7 @@
 // GET /v1/ops/seats?date=YYYY-MM-DD — one row per seat: latest channel line, PRs landed that day, red items, open decisions.
 // A source that could not be read is null, never 0 («못 읽음» ≠ «없음»). Contract: 내부 문서 `DESIGN-ops3-seat-board-and-public-demo-2026-10-02` §1.
 import { debug, redactSecretText } from '../../debug/log.js';
-import type { ChecklistItem } from '../../release-loop/checklist.js';
+import { parseOwner, type ChecklistItem } from '../../release-loop/checklist.js';
 import { canonicalSeatId } from '../../msg/msg-store.js';
 
 export const SEATS = [
@@ -9,11 +9,17 @@ export const SEATS = [
 ] as const;
 export const SEATS_CACHE_MS = 60_000;
 
-export interface ChannelComment { body: string; createdAt: string }
+export interface ChannelComment { body: string; createdAt: string; url?: string }
+export type ChannelSource = 'ledger' | 'github' | 'unreadable' | 'unknown';
+export type ChannelResult = ChannelComment[] | {
+  comments: ChannelComment[];
+  source: 'ledger' | 'github';
+  seatSources?: Partial<Record<(typeof SEATS)[number]['seat'], ChannelSource>>;
+} | null;
 export interface MergedPr { number: number; title: string; body: string; mergedAt: string }
 export interface SeatsSources {
   /** Coordination-channel comments created on `date` (KST) or later; null when unreadable. */
-  channel(date: string): Promise<ChannelComment[] | null>;
+  channel(date: string): Promise<ChannelResult>;
   /** PRs merged on `date` (KST); null when unreadable. */
   merged(date: string): Promise<MergedPr[] | null>;
   /** Checklist items of the version being worked on (counts, red) and of every version known (id → owner). */
@@ -24,6 +30,7 @@ export interface SeatsSources {
 
 export interface SeatRow {
   seat: string; role: string;
+  channelSource: ChannelSource;
   now: { text: string; at: string } | null;
   landed: Array<{ pr: number; title: string; at: string; checklistId: string | null }> | null;
   blocked: Array<{ id: string; title: string; status: 'red' }> | null;
@@ -33,7 +40,7 @@ export interface SeatRow {
 
 function seatOf(value: string | undefined): string | null {
   if (!value) return null;
-  try { return canonicalSeatId(value); } catch { return null; }
+  try { return canonicalSeatId(value.includes('/') ? parseOwner(value).seat : value); } catch { return null; }
 }
 
 const clip = (text: string, max: number) => redactSecretText(text).slice(0, max);
@@ -49,9 +56,11 @@ function checklistIdOf(pr: MergedPr, ids: string[]): string | null {
 }
 
 export async function buildSeatsBoard(date: string, sources: SeatsSources): Promise<{ date: string; seats: SeatRow[] }> {
-  const [channel, merged] = await Promise.all([
+  const [channelResult, merged] = await Promise.all([
     sources.channel(date).catch(() => null), sources.merged(date).catch(() => null),
   ]);
+  const channel = Array.isArray(channelResult) ? channelResult : channelResult?.comments ?? null;
+  const channelSource: ChannelSource = channelResult === null ? 'unreadable' : 'unknown';
   let checklist: ReturnType<SeatsSources['checklist']> = null;
   try { checklist = sources.checklist(); } catch { checklist = null; }
   let raisers: string[] | null = null;
@@ -72,7 +81,8 @@ export async function buildSeatsBoard(date: string, sources: SeatsSources): Prom
     const latest = channel?.filter((c) => c.body.trimStart().startsWith(`**[${seat}]**`)).sort((a, b) => b.createdAt.localeCompare(a.createdAt))[0];
     const mine = checklist?.current.filter((item) => seatOf(item.owner) === seat);
     return {
-      seat, role,
+      seat, role, channelSource: channelResult && !Array.isArray(channelResult)
+        ? channelResult.seatSources?.[seat] ?? channelSource : channelSource,
       now: latest ? { text: clip(latest.body.trimStart().split('\n')[0]!, 120), at: latest.createdAt } : null,
       landed: merged === null || checklist === null ? null : (landedBySeat.get(seat) ?? []).sort((a, b) => a.at.localeCompare(b.at)),
       blocked: mine ? mine.filter((item) => item.status === 'red').map((item) => ({ id: item.id, title: clip(item.title, 80), status: 'red' as const })) : null,

package/src/nexus/api/seat-requests.ts

@@ -1,7 +1,12 @@
 import { closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, readdirSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
 import { createHash, randomUUID } from 'node:crypto';
-import { dirname, join } from 'node:path';
+import { basename, dirname, join } from 'node:path';
 import { debug } from '../../debug/log.js';
+import { resolveAttachmentPath } from '../../boot/attachment-store.js';
+import { runGh } from '../../decisions/decision-cards.js';
+import { openMsgStore, canonicalSeatId } from '../../msg/msg-store.js';
+import { dispatchCeoTask, type CeoCommandDeps } from '../../seat-dispatch/ceo-commands.js';
+import { getUserConfig } from '../../user-config.js';
 import { effectiveInstanceRoot } from '../../instance/resolve.js';
 import { submitIntakeWork } from '../../intake-plane/submit-intake-work.js';
 import { parseSeatAddress, resolveSeat } from '../../seat-address/seat-address.js';
@@ -16,6 +21,9 @@ interface SeatRequestItem {
   text: string;
   queuedAt: string;
   status: 'queued';
+  attachments?: string[];
+  channel?: 'posted' | 'failed' | 'unknown';
+  channelError?: string;
 }
 
 interface PendingRequest {
@@ -25,6 +33,7 @@ interface PendingRequest {
   text: string;
   queuedAt: string;
   ref: string;
+  attachments?: string[];
 }
 
 interface RejectedRequest extends Omit<PendingRequest, 'status'> {
@@ -38,10 +47,17 @@ export interface SeatRequestsDeps {
   submit?: typeof submitIntakeWork;
   now?: () => string;
   append?: (path: string, entry: RecordEntry) => void;
+  resolveAttachment?: typeof resolveAttachmentPath;
+  dispatch?: typeof dispatchCeoTask;
+  ceoDeps?: () => CeoCommandDeps;
 }
 
 const seats = trackData.tracks.filter((entry): entry is typeof entry & { title: string } => 'title' in entry)
   .map(({ id, title }) => ({ id, title }));
+
+function requestSeat(address: string) {
+  return resolveSeat(address) ?? trackData.tracks.find((entry) => entry.id.toLowerCase() === address.replace(/^@/, '').toLowerCase());
+}
 const inFlight = new Map<string, { payload: string; task: Promise<Response> }>();
 
 function unknownSeat(): Response {
@@ -140,7 +156,28 @@ function persistOutcome(path: string, entry: RecordEntry, write: typeof append):
 }
 
 function receipt(item: SeatRequestItem): Response {
-  return jsonResponse({ receiptId: item.receiptId, seat: item.seat, queuedAt: item.queuedAt }, 202);
+  return jsonResponse({ receiptId: item.receiptId, seat: item.seat, queuedAt: item.queuedAt,
+    // Only a CEO-seat dispatch knows whether the channel line went out; anything else is reported as unknown.
+    attachments: item.attachments?.length ?? 0, channel: item.channel ?? 'unknown',
+    ...(item.channelError ? { channelError: item.channelError } : {}) }, 202);
+}
+
+function defaultCeoDeps(): CeoCommandDeps {
+  const cfg = getUserConfig();
+  const replyTarget = (cfg.raw?.decisions as { replyGhPr?: unknown } | undefined)?.replyGhPr;
+  return { ownerId: null, replyTarget: typeof replyTarget === 'string' ? replyTarget : null, runGh,
+    append: (message) => { const store = openMsgStore(); try { return store.append(message); } finally { store.close(); } },
+    hasMessage: (seat, ref) => {
+      const store = openMsgStore();
+      try {
+        return store.db.query("SELECT 1 FROM msg_messages WHERE recipient = ? AND kind = 'ceo-task' AND body LIKE ? LIMIT 1")
+          .get(seat, `%\n요청: ${ref}`) !== null;
+      } finally { store.close(); }
+    } };
+}
+
+function canonicalSeatIdSafe(id: string): string {
+  try { return canonicalSeatId(id); } catch { return id; }
 }
 
 function unavailable(): Response {
@@ -153,7 +190,7 @@ export async function handleSeatRequests(req: Request, deps: SeatRequestsDeps =
   if (req.method === 'GET') {
     const params = new URL(req.url).searchParams;
     const requestedSeat = params.get('seat');
-    const seat = requestedSeat ? resolveSeat(requestedSeat) : undefined;
+    const seat = requestedSeat ? requestSeat(requestedSeat) : undefined;
     if (requestedSeat && !seat) return unknownSeat();
     const rawLimit = params.get('limit');
     const limit = rawLimit === null ? 20 : Number(rawLimit);
@@ -183,18 +220,30 @@ export async function handleSeatRequests(req: Request, deps: SeatRequestsDeps =
   const firstAddress = parsed && input.text.startsWith(prefix)
     && (input.text.length === prefix.length || /[ \t\r\n]/.test(input.text[prefix.length]!)) ? parsed : null;
   const address = input.seat ?? (firstAddress?.seats.length === 1 ? firstAddress.seats[0] : undefined);
-  const seat = address ? resolveSeat(address) : undefined;
+  const seat = address ? requestSeat(address) : undefined;
   if (!seat) return unknownSeat();
   const text = input.seat === undefined ? firstAddress!.body.trim() : input.text.trim();
   if (!text) {
     debug.log('seat-address.pwa', 'rejected', { reason: 'empty-text', seat: seat.id });
     return jsonResponse({ error: 'bad_request' }, 400);
   }
+  if (input.attachments !== undefined && (!Array.isArray(input.attachments) || input.attachments.length > 4
+    || input.attachments.some((attachment: unknown) => !attachment || typeof attachment !== 'object' || Array.isArray(attachment)
+      || typeof (attachment as { id?: unknown }).id !== 'string' || !(attachment as { id: string }).id.trim()))) {
+    debug.log('seat.dispatch', 'refused', { seat: seat.id, reason: 'invalid-attachments' });
+    return jsonResponse({ error: 'bad_request' }, 400);
+  }
+  const attachmentIds = (input.attachments as Array<{ id: string }> | undefined)?.map(({ id }) => id) ?? [];
+  // Intake (non-CEO seats) carries text only — refuse attachments there instead of accepting and dropping them.
+  if (attachmentIds.length && !['OP', 'TC', 'MK', 'UX'].includes(canonicalSeatIdSafe(seat.id))) {
+    debug.log('seat.dispatch', 'refused', { seat: seat.id, reason: 'attachments-unsupported' });
+    return jsonResponse({ error: 'attachments-unsupported', seat: seat.id }, 400);
+  }
   debug.log('seat-address.pwa', 'parsed', { seat: seat.id, textLength: text.length });
   const now = (deps.now ?? (() => new Date().toISOString()))();
   const header = req.headers.get('idempotency-key');
   if (header !== null && (!header.trim() || header.length > 200)) return jsonResponse({ error: 'bad_request' }, 400);
-  const payload = `${seat.id}\0${text}`;
+  const payload = JSON.stringify([seat.id, text, attachmentIds]);
   const key = header === null ? createHash('sha256').update(randomUUID()).digest('hex')
     : createHash('sha256').update(`client\0${header}`).digest('hex');
   const lock = `${path}\0${key}`;
@@ -213,11 +262,23 @@ export async function handleSeatRequests(req: Request, deps: SeatRequestsDeps =
     try { existing = records(path).get(key); }
     catch { return unavailable(); }
     if (existing) {
-      if (existing.seat !== seat.id || existing.text !== text) return jsonResponse({ error: 'idempotency-conflict' }, 409);
+      if (existing.seat !== seat.id || existing.text !== text
+        || JSON.stringify(existing.attachments ?? []) !== JSON.stringify(attachmentIds)) return jsonResponse({ error: 'idempotency-conflict' }, 409);
       if (existing.status === 'queued') return receipt(existing);
     }
+    const attachments: Array<{ name: string; path: string }> = [];
+    for (const id of attachmentIds) {
+      const resolved = (deps.resolveAttachment ?? resolveAttachmentPath)(id);
+      if (!resolved) {
+        debug.log('seat.dispatch', 'refused', { seat: seat.id, reason: 'unknown-attachment' });
+        return jsonResponse({ error: 'unknown-attachment', id }, 400);
+      }
+      const metadata = (input.attachments as Array<{ name?: unknown }>)[attachments.length];
+      attachments.push({ name: typeof metadata?.name === 'string' && metadata.name.trim() ? metadata.name : basename(resolved), path: resolved });
+    }
     const intent: PendingRequest = existing?.status === 'pending'
-      ? existing : { key, seat: seat.id, text, queuedAt: now, status: 'pending', ref: `pwa:${randomUUID()}` };
+      ? existing : { key, seat: seat.id, text, queuedAt: now, status: 'pending', ref: `pwa:${randomUUID()}`,
+        ...(attachmentIds.length ? { attachments: attachmentIds } : {}) };
     if (existing?.status !== 'pending') {
       try {
         (deps.append ?? append)(path, intent);
@@ -227,6 +288,24 @@ export async function handleSeatRequests(req: Request, deps: SeatRequestsDeps =
         }
       } catch { return unavailable(); }
     }
+    const ceoSeat = canonicalSeatId(seat.id);
+    if (['OP', 'TC', 'MK', 'UX'].includes(ceoSeat)) {
+      let result: Awaited<ReturnType<typeof dispatchCeoTask>>;
+      try {
+        result = await (deps.dispatch ?? dispatchCeoTask)(ceoSeat, text, (deps.ceoDeps ?? defaultCeoDeps)(), { attachments, via: 'pwa', ref: intent.ref });
+      } catch {
+        debug.log('seat.dispatch', 'refused', { seat: seat.id, reason: 'dispatch-failed' });
+        return unavailable();
+      }
+      const item: RecordEntry & SeatRequestItem = {
+        key, receiptId: intent.ref, seat: seat.id, text, queuedAt: intent.queuedAt, status: 'queued',
+        ...(attachmentIds.length ? { attachments: attachmentIds } : {}), channel: result.channel,
+        ...(result.channelError ? { channelError: result.channelError } : {}),
+      };
+      try { persistOutcome(path, item, deps.append ?? append); }
+      catch { return unavailable(); }
+      return receipt(item);
+    }
     let result: Awaited<ReturnType<typeof submitIntakeWork>>;
     try {
       result = await (deps.submit ?? submitIntakeWork)({
@@ -241,7 +320,8 @@ export async function handleSeatRequests(req: Request, deps: SeatRequestsDeps =
       catch { return unavailable(); }
       return unavailable();
     }
-    const item: RecordEntry & SeatRequestItem = { key, receiptId: result.acceptanceId, seat: seat.id, text, queuedAt: intent.queuedAt, status: 'queued' };
+    const item: RecordEntry & SeatRequestItem = { key, receiptId: result.acceptanceId, seat: seat.id, text, queuedAt: intent.queuedAt,
+      status: 'queued', ...(attachmentIds.length ? { attachments: attachmentIds } : {}) };
     try { persistOutcome(path, item, deps.append ?? append); }
     catch { return unavailable(); }
     debug.log('seat-address.pwa', 'enqueued', { seat: seat.id, receiptId: item.receiptId });