elanous 0.2.9 → 0.2.11

package/src/nexus/api/http-server.ts

@@ -19,6 +19,9 @@ import { setInProcessOutbound } from '../../domains/outbound-alert.js';
 import { getUserConfig } from '../../user-config.js';
 import type { TelegramEvent } from '../../workflow-runtime/triggers/telegram-source.js';
 import { spawnSync } from 'node:child_process';
+import { isAbsolute } from 'node:path';
+import { createProject, listProjects } from '../../project/project-store.js';
+import { handleOutputsGet, type OutputsDeps } from './outputs-route.js';
 import { compareTokenConstTime } from '../../acp/transport/auth.js';
 import { ensureAuthToken } from '../../auth/acp-token.js';
 import type { NexusState } from '../state/state.js';
@@ -40,6 +43,7 @@ import { OPENAI_RELAY_PATH, tryHandleOpenAiRelay } from './openai-relay.js';
 import { handleHealth, type HealthSetupContext } from './health.js';
 import { handleTabsList, handleTabDetail, handleNexusSnapshot } from './tabs.js';
 import { handleSseEvents } from './events.js';
+import { handleInsideEvents, INSIDE_EVENTS_PATH, startInsideEventRelay } from './inside-events.js';
 import { dispatchIntentPredictionRoute } from './intent-prediction.js';
 import { handleNotificationAction } from './notification-action.js';
 import { handleUserIntentEmit, handleUserIntentBatch } from './user-intents.js';
@@ -134,6 +138,7 @@ import {
   type ReflectionRouteOpts,
 } from './reflection.js';
 import { handleSignalBoard } from './signal-board-api.js';
+import { handleUsageGet } from './usage-api.js';
 import {
   handleDashboard,
   handleDashboardRefreshLive,
@@ -154,6 +159,7 @@ import {
 } from './vault-api.js';
 import { handleBuildsGet, parseBuildsPath } from './builds-api.js';
 import { handleHarnessAskPost, handleHarnessAskStatusGet, handleHarnessRunEventsGet, handleHarnessRunScreenGet, handleHarnessRunsGet, handleHarnessStopPost } from './harness-api.js';
+import { handleFabricPlans, type FabricPlansRouteOpts } from './fabric-plans.js';
 import { dispatchPersonaRoute } from './personas.js';
 import { handleMe } from './operator.js';
 import { handleOpsApi } from './ops-api.js';
@@ -163,6 +169,7 @@ import { handleLlmModels } from './llm-models.js';
 import { handleLlmHostsConfig } from './llm-hosts-config.js';
 import { handleLlmRotationGet, handleLlmRotationNext } from './llm-rotation.js';
 import { handleSetupClaim } from './setup-claim.js';
+import { handleSetupCodexLoginGet, handleSetupCodexLoginPost } from './setup-codex-login.js';
 import {
   handleLlmProvidersList,
   handleLlmProviderSet,
@@ -174,6 +181,7 @@ import { handleChannelBotsGet, handleChannelBotSet } from './setup-channel-bot.j
 import { handleLlmRoutePredict } from './llm-route-predict.js';
 import type { MissionRouter } from '../../llm/mission-router.js';
 import { handleContextFetchUrl } from './context-url.js';
+import { contextNow } from '../../context-bus/context-now.js';
 import type { IntentPredictionService } from '../../intent-prediction/index.js';
 import type { NotificationActionLoopback } from '../../web-push/notification-action-loopback.js';
 import { handlePlatforms } from './platforms.js';
@@ -278,7 +286,7 @@ import { handleSchedulesActionPost } from './schedules-action.js';
 import { handleSchedulesList, handleScheduleDetail, handleScheduleRuns } from './schedules-read.js';
 import { handleIntakeRunsList } from './intake-runs.js';
 import { handleMissionsList, handleMissionDetail } from './missions.js';
-import { handleSessionsStoreList, handleSessionsStoreGet, handleSessionsStoreFork, handleSessionsStoreDelete } from './sessions-store.js';
+import { handleSessionsStoreList, handleSessionsStoreGet, handleSessionsStoreFork, handleSessionsStoreDelete, handleSessionsStorePatch } from './sessions-store.js';
 import { handleLogsQuery, handleLogsStream, handleLogsLevelGet, handleLogsLevelPost, handleLogsFacets, handleLogsHistogram, handleLogsInstances } from './log-fabric.js';
 import { handleTrace, handleTraceEvidence } from './trace.js';
 import { handleDispatchRunsList } from './dispatch-runs.js';
@@ -457,14 +465,19 @@ export function probeNexusHttpPort(
 export type NexusWsBridgeInit = Omit<WsBridgeOpts, 'hostname' | 'port'>;
 
 export interface NexusHttpServerOpts {
+  /** Optional fabric-plan ledger and decomposition seam; production uses the instance root and existing fabric decomposer. */
+  fabricPlans?: FabricPlansRouteOpts;
   /** Optional installer state root for isolated API consumers and tests. */
   pluginStateRoot?: string;
+  outputs?: OutputsDeps;
   execRequests?: ExecRequestRunner;
   seatRequests?: SeatRequestsDeps;
   consultRequests?: ConsultRequestsDeps;
   state: NexusState;
   registry: TabRegistry;
   eventBus: NexusEventBus;
+  /** Test seam for the read-only usage collector; production uses the cached handler. */
+  usageHandler?: () => Promise<Response>;
   /** Supervisor handle — required for the write API (PR ι). When omitted
    *  (skipSupervisor mode), mutation routes return 503. */
   supervisor?: Supervisor;
@@ -784,17 +797,40 @@ export function startNexusHttpServer(opts: NexusHttpServerOpts): NexusHttpServer
   }
 
   const url = `http://${hostname}:${resolvedPort}`;
+  const stopInsideRelay = startInsideEventRelay();
   return {
     port: resolvedPort,
     hostname,
     url,
     stop() {
+      stopInsideRelay();
       try { server!.stop(true); } catch { /* idempotent */ }
       setInProcessOutbound(null);
     },
   };
 }
 
+export function handleProjectsGet(): Response {
+  return jsonResponse({ projects: listProjects() });
+}
+
+export async function handleProjectsPost(req: Request): Promise<Response> {
+  let body: unknown;
+  try { body = await req.json(); }
+  catch { return jsonResponse({ error: 'invalid_json' }, 400); }
+  if (!body || typeof body !== 'object' || Array.isArray(body)) {
+    return jsonResponse({ error: 'invalid_name' }, 400);
+  }
+  const { name, primaryFolder } = body as Record<string, unknown>;
+  if (typeof name !== 'string' || !name.trim() || name.length > 80) {
+    return jsonResponse({ error: 'invalid_name' }, 400);
+  }
+  if (primaryFolder !== undefined && (typeof primaryFolder !== 'string' || !isAbsolute(primaryFolder))) {
+    return jsonResponse({ error: 'invalid_primary_folder' }, 400);
+  }
+  return jsonResponse({ project: createProject({ name, ...(primaryFolder !== undefined ? { primaryFolder } : {}) }) }, 201);
+}
+
 function isPortBusy(err: unknown): boolean {
   if (!err) return false;
   // Bun.serve errors expose `.code === 'EADDRINUSE'` (Node-compatible)
@@ -957,6 +993,11 @@ export async function routeRequest(
     }
   }
 
+  if (pathname === INSIDE_EVENTS_PATH) {
+    if (!opts.metaApi || !checkAuth(req, opts.metaApi)) return jsonResponse({ error: 'unauthorized' }, 401);
+    return handleInsideEvents(req);
+  }
+
   if (pathname === LIVE_SHIPPED_PATH) {
     return handleLiveShipped(req, { authorize: (request) => !!opts.metaApi && checkAuth(request, opts.metaApi) });
   }
@@ -1285,11 +1326,40 @@ export async function routeRequest(
     return handleGraphsValidatePost(req, opts.metaApi);
   }
 
+  if (pathname === '/v1/fabric/decompose' || pathname.startsWith('/v1/fabric/plans/')) {
+    if (!opts.metaApi || !checkAuth(req, opts.metaApi)) return jsonResponse({ error: 'unauthorized' }, 401);
+    return handleFabricPlans(req, opts.fabricPlans);
+  }
+
+  if (pathname === '/v1/projects' && (method === 'GET' || method === 'POST')) {
+    if (!opts.metaApi || !checkAuth(req, opts.metaApi)) return jsonResponse({ error: 'unauthorized' }, 401);
+    return method === 'GET' ? handleProjectsGet() : handleProjectsPost(req);
+  }
+
+  if (method === 'GET' && pathname === '/v1/outputs') {
+    if (!opts.metaApi || !checkAuth(req, opts.metaApi)) return jsonResponse({ error: 'unauthorized' }, 401);
+    return handleOutputsGet(req, opts.outputs);
+  }
+
   if (pathname === '/v1/config/chat-fast-path' && (method === 'GET' || method === 'PUT')) {
     if (!opts.metaApi || !checkAuth(req, opts.metaApi)) return jsonResponse({ error: 'unauthorized' }, 401);
     return handleChatFastPathConfig(req);
   }
 
+  if (pathname === '/v1/usage') {
+    if (!opts.metaApi || !checkAuth(req, opts.metaApi)) return jsonResponse({ error: 'unauthorized' }, 401);
+    if (method !== 'GET') return jsonResponse({ error: 'method-not-allowed' }, 405);
+    return (opts.usageHandler ?? handleUsageGet)();
+  }
+
+  // SK2 (PWA) list — GET must be routed before the non-GET block below; the original route sat inside it,
+  // so the PWA banner's GET always fell through to «not-found» (found by the DEMO-RUNa rehearsal · 10-03).
+  if (method === 'GET' && pathname === '/v1/skills/problems') {
+    if (!opts.metaApi) return jsonResponse({ error: 'meta-api-not-wired' }, 503);
+    const { handleSkillProblems } = await import('./skill-problems.js');
+    return handleSkillProblems(req, opts.metaApi);
+  }
+
   // Mutation routes (PR ι) — POST/PATCH/DELETE on /v1/nexus/tabs[/:id[/action]].
   // Templates POST handled here too (PR κ).
   // Config / secrets PUT/POST/DELETE here too (PR μ).
@@ -1540,6 +1610,11 @@ export async function routeRequest(
     // PWA `/setup` wizard Phase 1 (2026-05-19) — LLM provider 첫 셋업.
     // POST 는 mutation 블록 안에서 등록 (memory `feedback_post_route_must_be_in_method_block`).
     // GET sibling 은 아래 GET-only 블록에 등록.
+    if (pathname === '/v1/setup/codex-login' && (method === 'POST' || method === 'OPTIONS')) {
+      if (method === 'OPTIONS') return corsPreflight('GET, POST, OPTIONS');
+      if (!opts.metaApi || !checkAuth(req, opts.metaApi)) return jsonResponse({ error: 'unauthorized' }, 401);
+      return handleSetupCodexLoginPost(req);
+    }
     if (pathname === '/v1/setup/llm-provider' && (method === 'POST' || method === 'OPTIONS')) {
       if (method === 'POST') { if (!opts.metaApi || !checkAuth(req, opts.metaApi)) return jsonResponse({ error: 'unauthorized' }, 401); }
       return handleLlmProviderSet(req);
@@ -1904,6 +1979,11 @@ export async function routeRequest(
       const id = decodeURIComponent(pathname.slice('/v1/sessions/store/'.length, -'/fork'.length));
       return handleSessionsStoreFork(req, id, opts.metaApi);
     }
+    if (pathname.startsWith('/v1/sessions/store/') && !pathname.endsWith('/fork') && method === 'PATCH') {
+      if (!opts.metaApi) return jsonResponse({ error: 'unauthorized' }, 401);
+      const id = decodeURIComponent(pathname.slice('/v1/sessions/store/'.length));
+      return handleSessionsStorePatch(req, id, opts.metaApi);
+    }
     // on-disk 세션 삭제(파괴적) — 라이브 세션 관리. /store/:id (fork/transcript 와 구분).
     if (pathname.startsWith('/v1/sessions/store/') && !pathname.endsWith('/fork') && method === 'DELETE') {
       if (!opts.metaApi) return jsonResponse({ error: 'meta-api-runtime-not-wired' }, 503);
@@ -2425,6 +2505,10 @@ export async function routeRequest(
   }
   // PWA `/setup` wizard Phase 1 (2026-05-19) — provider catalog 표시.
   // POST sibling (`/v1/setup/llm-provider`) 는 위 mutation 블록.
+  if (pathname === '/v1/setup/codex-login') {
+    if (!opts.metaApi || !checkAuth(req, opts.metaApi)) return jsonResponse({ error: 'unauthorized' }, 401);
+    return handleSetupCodexLoginGet();
+  }
   if (pathname === '/v1/setup/llm-providers') {
     return handleLlmProvidersList(req);
   }
@@ -2723,6 +2807,10 @@ export async function routeRequest(
     const result = await dispatchPersonaRoute(req, pathname);
     if (result) return result;
   }
+  if (pathname === '/v1/context/now') {
+    if (!opts.metaApi || !checkAuth(req, opts.metaApi)) return jsonResponse({ error: 'unauthorized' }, 401);
+    return jsonResponse(contextNow({ ...(url.searchParams.has('topic') ? { topic: url.searchParams.get('topic') ?? '' } : {}) }));
+  }
   // §6.3 (2026-05-09) — context URL fetch (showroom).
   // POST /v1/context/fetch-url
   if (pathname === '/v1/context/fetch-url') {

package/src/nexus/api/inside-events.ts

@@ -0,0 +1,226 @@
+import { randomUUID } from 'node:crypto';
+import { appendFileSync, existsSync, mkdirSync, openSync, closeSync, readSync, readFileSync, statSync, unlinkSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { StringDecoder } from 'node:string_decoder';
+import { debug } from '../../debug/log.js';
+import { nexusRootDir } from '../paths.js';
+import { SSE_HEARTBEAT_MS } from './sse-heartbeat.js';
+
+/** The node envelope matches apps/pwa/src/lib/inside-events.ts without importing browser code. */
+export interface InsideNodeEvent {
+  kind: 'node';
+  graphId: string;
+  runId: string;
+  nodeId: string;
+  phase: 'start' | 'ok' | 'fail';
+  ts: string;
+  seconds?: number;
+}
+
+/** Other producers can add their own domain fields without changing the transport. */
+export type InsideLiveEvent = InsideNodeEvent | ({ kind: string; ts: string } & Record<string, unknown>);
+export type InsideEventInput = { kind: string; ts?: string } & Record<string, unknown>;
+
+export const INSIDE_EVENTS_PATH = '/v1/inside/events';
+const MAX_PENDING_FRAMES = 16;
+const MAX_FRAME_BYTES = 64 * 1024;
+const MASK = '[REDACTED]';
+const SECRET_KEY = /(?:secret|password|passwd|token|api[_-]?key|authorization|credential|private[_-]?key|cookie|session[_-]?key)/i;
+const INLINE_SECRET = /\b((?:Bearer|Basic)\s+|(?:sk|ghp|gho|ghu|ghs|ghr|github_pat|glpat|xox[baprs])[-_])[^\s"'`,;]+/gi;
+const ASSIGNMENT_SECRET = /\b((?:api[_-]?key|(?:access[_-]?)?token|secret|password|authorization)\s*[:=]\s*)(?:(["'])[^\r\n]*?\2|[^\s"'`,;]+)/gi;
+
+function maskString(value: string): string {
+  return value.replace(INLINE_SECRET, `$1${MASK}`)
+    .replace(ASSIGNMENT_SECRET, (_match, prefix: string, quote?: string) => `${prefix}${quote ?? ''}${MASK}${quote ?? ''}`);
+}
+
+/** Sanitize before fan-out; never put an unmasked payload in the subscriber queue. */
+export function maskInsideEventValue(value: unknown, seen = new WeakSet<object>()): unknown {
+  if (typeof value === 'string') return maskString(value);
+  if (!value || typeof value !== 'object') return value;
+  if (seen.has(value)) return MASK;
+  seen.add(value);
+  if (Array.isArray(value)) {
+    const result = value.map((item) => maskInsideEventValue(item, seen));
+    seen.delete(value);
+    return result;
+  }
+  const result: Record<string, unknown> = {};
+  for (const [key, item] of Object.entries(value)) {
+    result[key] = SECRET_KEY.test(key) ? MASK : maskInsideEventValue(item, seen);
+  }
+  seen.delete(value);
+  return result;
+}
+
+type Listener = (event: InsideLiveEvent) => void;
+const listeners = new Set<Listener>();
+const RELAY_INTERVAL_MS = 20;
+const RELAY_MAX_RECORD_BYTES = 64 * 1024;
+const RELAY_ROTATE_BYTES = 4 * 1024 * 1024;
+const RELAY_RETIRE_GRACE_MS = 2000;
+const relayIdentity = randomUUID();
+
+function relayPaths() {
+  const root = nexusRootDir();
+  return { root, pointer: join(root, 'inside-events-relay.json') };
+}
+
+function dispatch(event: InsideLiveEvent): void {
+  for (const listener of listeners) {
+    try { listener(event); } catch { /* a disconnected observer must not stop a run */ }
+  }
+}
+
+/** Each daemon owns its journal; child processes append masked records to that journal.
+ *  The journal rotates once fully consumed past RELAY_ROTATE_BYTES: the pointer moves to a fresh file and the old one is
+ *  drained for a grace period (producers that read the old pointer may still append) before it is removed. */
+export function startInsideEventRelay(opts: { rotateBytes?: number; retireGraceMs?: number } = {}): () => void {
+  const { root, pointer } = relayPaths();
+  mkdirSync(root, { recursive: true });
+  const rotateBytes = opts.rotateBytes ?? RELAY_ROTATE_BYTES;
+  const retireGraceMs = opts.retireGraceMs ?? RELAY_RETIRE_GRACE_MS;
+  type Journal = { file: string; offset: number; pending: string; decoder: StringDecoder; retireAt?: number };
+  const journals: Journal[] = [];
+  let descriptor = '';
+  const open = (): Journal => {
+    const id = randomUUID();
+    const file = join(root, `inside-events-${id}.jsonl`);
+    writeFileSync(file, '', { mode: 0o600, flag: 'wx' });
+    descriptor = JSON.stringify({ pid: process.pid, id });
+    writeFileSync(pointer, descriptor, { mode: 0o600 });
+    const journal: Journal = { file, offset: 0, pending: '', decoder: new StringDecoder('utf8') };
+    journals.push(journal);
+    return journal;
+  };
+  let current = open();
+  const drain = (journal: Journal): void => {
+    const size = statSync(journal.file).size;
+    if (size < journal.offset) { journal.offset = 0; journal.pending = ''; journal.decoder = new StringDecoder('utf8'); }
+    while (size > journal.offset) {
+      const count = Math.min(size - journal.offset, 1024 * 1024);
+      const chunk = Buffer.alloc(count);
+      const fd = openSync(journal.file, 'r');
+      let length: number;
+      try { length = readSync(fd, chunk, 0, count, journal.offset); }
+      finally { closeSync(fd); }
+      if (length <= 0) break;
+      journal.offset += length;
+      // A chunk boundary may split a multi-byte character; the decoder carries the partial bytes into the next read.
+      journal.pending += journal.decoder.write(chunk.subarray(0, length));
+      const lines = journal.pending.split('\n');
+      journal.pending = lines.pop() ?? '';
+      if (journal.pending.length > RELAY_MAX_RECORD_BYTES) journal.pending = '';
+      for (const line of lines) {
+        if (line.length > RELAY_MAX_RECORD_BYTES) continue;
+        try {
+          const record = JSON.parse(line) as { origin?: string; event?: InsideEventInput };
+          if (record.origin === relayIdentity || !record.event || typeof record.event.kind !== 'string'
+            || !/^[a-z][a-z0-9._-]*$/i.test(record.event.kind)) continue;
+          dispatch(maskInsideEventValue(record.event) as InsideLiveEvent);
+        } catch { /* malformed producer record */ }
+      }
+    }
+  };
+  const remove = (journal: Journal): void => {
+    try { unlinkSync(journal.file); } catch { /* already removed */ }
+    journals.splice(journals.indexOf(journal), 1);
+  };
+  const timer = setInterval(() => {
+    for (const journal of [...journals]) {
+      try { drain(journal); } catch { /* journal disappeared during shutdown */ }
+      if (journal.retireAt !== undefined && Date.now() >= journal.retireAt && journal.pending === '') remove(journal);
+    }
+    if (current.offset >= rotateBytes && current.pending === '') {
+      try {
+        current.retireAt = Date.now() + retireGraceMs;
+        current = open();
+        debug.log('inside.events', 'relay-rotated', { journals: journals.length });
+      } catch { /* keep appending to the current journal */ }
+    }
+  }, RELAY_INTERVAL_MS);
+  timer.unref();
+  return () => {
+    clearInterval(timer);
+    try { if (readFileSync(pointer, 'utf8') === descriptor) unlinkSync(pointer); } catch { /* another daemon owns it */ }
+    for (const journal of [...journals]) remove(journal);
+  };
+}
+
+/** Ordered local delivery plus best-effort cross-process delivery to the current daemon. */
+export function publishInsideEvent(event: InsideEventInput): void {
+  if (!event || typeof event.kind !== 'string' || !/^[a-z][a-z0-9._-]*$/i.test(event.kind)) return;
+  const safe = maskInsideEventValue({ ...event, ts: event.ts ?? new Date().toISOString() }) as InsideLiveEvent;
+  dispatch(safe);
+  try {
+    const { root, pointer } = relayPaths();
+    if (!existsSync(pointer)) return;
+    const descriptor = JSON.parse(readFileSync(pointer, 'utf8')) as { pid?: number; id?: string };
+    if (!Number.isSafeInteger(descriptor.pid) || typeof descriptor.id !== 'string' || !/^[a-f0-9-]{36}$/.test(descriptor.id)) return;
+    process.kill(descriptor.pid!, 0);
+    const file = join(root, `inside-events-${descriptor.id}.jsonl`);
+    const line = JSON.stringify({ origin: relayIdentity, event: safe }) + '\n';
+    if (Buffer.byteLength(line) > RELAY_MAX_RECORD_BYTES) return;
+    appendFileSync(file, line, { mode: 0o600, flag: 'a' });
+  } catch { /* a missing daemon must not interrupt the producer */ }
+}
+
+export function subscribeInsideEvent(listener: Listener): () => void {
+  listeners.add(listener);
+  return () => { listeners.delete(listener); };
+}
+
+/** No history/replay: the stream starts at the moment a client subscribes. */
+export function handleInsideEvents(req: Request): Response {
+  if (req.method !== 'GET') return new Response(null, { status: 405, headers: { allow: 'GET' } });
+  const encoder = new TextEncoder();
+  let cleanup: (() => void) | undefined;
+  const stream = new ReadableStream<Uint8Array>({
+    start(controller) {
+      let closed = false;
+      let unsubscribe = () => {};
+      let heartbeat: ReturnType<typeof setInterval> | undefined;
+      const onAbort = () => close();
+      cleanup = () => {
+        if (closed) return;
+        closed = true;
+        if (heartbeat !== undefined) clearInterval(heartbeat);
+        unsubscribe();
+        req.signal.removeEventListener('abort', onAbort);
+      };
+      const close = () => {
+        cleanup?.();
+        try { controller.close(); } catch { /* cancelled already */ }
+      };
+      const send = (text: string): void => {
+        if (closed) return;
+        const bytes = encoder.encode(text);
+        if (bytes.byteLength > MAX_FRAME_BYTES || (controller.desiredSize ?? 0) <= 0) {
+          close();
+          return;
+        }
+        try { controller.enqueue(bytes); } catch { close(); }
+      };
+      if (req.signal.aborted) {
+        close();
+        return;
+      }
+      unsubscribe = subscribeInsideEvent((event) => {
+        send(`event: ${event.kind}\ndata: ${JSON.stringify(event)}\n\n`);
+      });
+      heartbeat = setInterval(() => send(': ping\n\n'), SSE_HEARTBEAT_MS);
+      req.signal.addEventListener('abort', onAbort, { once: true });
+      if (req.signal.aborted) close();
+      else send(': inside events stream\n\n');
+    },
+    cancel() { cleanup?.(); },
+  }, { highWaterMark: MAX_PENDING_FRAMES, size: () => 1 });
+  return new Response(stream, {
+    headers: {
+      'content-type': 'text/event-stream; charset=utf-8',
+      'cache-control': 'no-cache, no-transform',
+      'x-accel-buffering': 'no',
+      connection: 'keep-alive',
+    },
+  });
+}

package/src/nexus/api/meta-api.ts

@@ -81,6 +81,7 @@ import { createPwaConfirmChannel, createPwaQuestionChannel } from './hitl-pwa-ch
 import type { NexusEventBus } from './event-bus.js';
 import { jsonResponse } from './http-server.js';
 import { defaultChatEventBus } from './chat-event-bus.js';
+import { resolveSessionProjectContext } from '../../project/session-context.js';
 
 const MIME_BY_EXT: Record<string, string> = {
   '.png': 'image/png',
@@ -147,6 +148,10 @@ export interface MetaApiOpts {
    *  compared constant-time against the `Authorization: Bearer …`
    *  header. */
   bearerToken?: string;
+  /** Server-side human identity verification, independent of the shared bearer credential.
+   *  Never derive this result from request body, claimed source, or bearer possession alone.
+   *  Without a verifier, prompt tool mutations remain unavailable. */
+  resolveVerifiedOwner?: (req: Request) => { id: string } | undefined;
   /** Convenience for Tailscale-only / dogfood-loopback mode. */
   noAuth?: boolean;
   // ── PR k · runtime DI for the lifted endpoints ─────────────────
@@ -788,19 +793,29 @@ function notFound(payload: Record<string, unknown> = {}): Response {
 
 // ── /v1/prompt ────────────────────────────────────────────────────
 
+export function promptVerifiedOwner(req: Request, opts: MetaApiOpts): { id: string } | undefined {
+  const owner = opts.resolveVerifiedOwner?.(req);
+  return typeof owner?.id === 'string' && owner.id.trim() ? { id: owner.id.trim() } : undefined;
+}
+
 export async function handlePromptPost(
   req: Request,
   opts: MetaApiOpts,
 ): Promise<Response> {
   if (!checkAuth(req, opts)) return authFailureResponse(req, opts);
   if (!opts.history) return jsonResponse({ error: RUNTIME_NOT_WIRED }, 503);
-  let body: DaemonPromptBody;
+  let rawBody: unknown;
   try {
-    body = (await req.json()) as DaemonPromptBody;
+    rawBody = await req.json();
   } catch {
     return badRequest('invalid JSON body');
   }
-  const parsed = parseDaemonPromptBody(body, opts.systemPrompt);
+  if (!rawBody || typeof rawBody !== 'object' || Array.isArray(rawBody)) {
+    return badRequest('userText or userContent required');
+  }
+  const body = rawBody as DaemonPromptBody;
+  const projectContext = resolveSessionProjectContext(typeof body.sessionId === 'string' ? body.sessionId : undefined);
+  const parsed = parseDaemonPromptBody(body, projectContext?.instructions ? [opts.systemPrompt, projectContext.instructions].filter(Boolean).join('\n\n') : opts.systemPrompt);
   if (!parsed.ok) return badRequest(parsed.reason);
   const submit = createDaemonPromptTurnSubmit({
     kind: 'submit-turn',
@@ -831,9 +846,11 @@ export async function handlePromptPost(
         surface: surfaceResolution.surface,
         surfaceResolutionReason: surfaceResolution.reason,
         ...(parsed.value.userContent ? { promptBlocks: parsed.value.userContent } : {}),
+        ...((owner) => owner ? { verifiedOwner: owner } : {})(promptVerifiedOwner(req, opts)),
         ...(resolvePromptHitlChannels(typeof body.sessionId === 'string' ? body.sessionId : '', opts) ?? {}),
         ...(effectiveSurface ? { toolSurface: effectiveSurface } : {}),
-        ...(opts.toolCwd ? { toolCwd: opts.toolCwd } : {}),
+        ...(projectContext?.cwd || opts.toolCwd ? { toolCwd: projectContext?.cwd ?? opts.toolCwd } : {}),
+        ...(projectContext?.instructions ? { projectInstructions: projectContext.instructions } : {}),
         dispatchToolErrorMessage: 'NEXUS prompt runtime has no tool surface (start nexus with `--tools readonly|webterm`)',
         });
       },
@@ -920,13 +937,18 @@ export async function handlePromptStreamPost(
 ): Promise<Response> {
   if (!checkAuth(req, opts)) return authFailureResponse(req, opts);
   if (!opts.history) return jsonResponse({ error: RUNTIME_NOT_WIRED }, 503);
-  let body: DaemonPromptBody;
+  let rawBody: unknown;
   try {
-    body = (await req.json()) as DaemonPromptBody;
+    rawBody = await req.json();
   } catch {
     return badRequest('invalid JSON body');
   }
-  const parsed = parseDaemonPromptBody(body, opts.systemPrompt);
+  if (!rawBody || typeof rawBody !== 'object' || Array.isArray(rawBody)) {
+    return badRequest('userText or userContent required');
+  }
+  const body = rawBody as DaemonPromptBody;
+  const projectContext = resolveSessionProjectContext(typeof body.sessionId === 'string' ? body.sessionId : undefined);
+  const parsed = parseDaemonPromptBody(body, projectContext?.instructions ? [opts.systemPrompt, projectContext.instructions].filter(Boolean).join('\n\n') : opts.systemPrompt);
   if (!parsed.ok) return badRequest(parsed.reason);
   // M6 PR 1 (PLAN-rich-dev-feedback-multi-surface · 2026-05-13) — opt-in
   // debug-tap. PWA `/chat?debug-tap=on` propagates the query down to
@@ -1188,9 +1210,11 @@ export async function handlePromptStreamPost(
                 surface: surfaceResolution.surface,
                 surfaceResolutionReason: surfaceResolution.reason,
                 ...(parsed.value.userContent ? { promptBlocks: parsed.value.userContent } : {}),
+                ...((owner) => owner ? { verifiedOwner: owner } : {})(promptVerifiedOwner(req, opts)),
                 ...(resolvePromptHitlChannels(typeof body.sessionId === 'string' ? body.sessionId : '', opts) ?? {}),
                 ...(effectiveSurface ? { toolSurface: effectiveSurface } : {}),
-                ...(opts.toolCwd ? { toolCwd: opts.toolCwd } : {}),
+                ...(projectContext?.cwd || opts.toolCwd ? { toolCwd: projectContext?.cwd ?? opts.toolCwd } : {}),
+                ...(projectContext?.instructions ? { projectInstructions: projectContext.instructions } : {}),
                 signal: turnAbortController.signal,
                 onTextDelta: dualEmitTextDelta,
                 onImageBlock: dualEmitImageBlock,

package/src/nexus/api/missions.ts

@@ -20,6 +20,7 @@
  * Query params (list):
  *   status=<MissionStatus>   filter by status (active / planning / ...)
  *   goalSlug=<slug>          filter by goal binding
+ *   projectId=<id>          filter by project association
  *
  * Cross-ref:
  *   src/task-orchestrator/store.ts (listMissions · getMission ·
@@ -53,6 +54,7 @@ export interface MissionCardWire {
   status: MissionStatus;
   priority: Mission['priority'];
   goalSlug: string | null;
+  projectId?: string;
   taskCount: number;
   /** Counts so the PWA mission lane shows progress at a glance. */
   taskStatusCounts: Record<string, number>;
@@ -85,6 +87,7 @@ export function summarise(mission: Mission, tasks: readonly Task[]): MissionCard
     status: mission.status,
     priority: mission.priority,
     goalSlug: mission.goalSlug ?? null,
+    ...(mission.projectId !== undefined ? { projectId: mission.projectId } : {}),
     taskCount: tasks.length,
     taskStatusCounts,
     surfaceKindCounts,
@@ -103,9 +106,11 @@ export function handleMissionsList(
   const url = new URL(req.url);
   const statusParam = url.searchParams.get('status');
   const goalSlug = url.searchParams.get('goalSlug') ?? undefined;
-  const filter: { status?: MissionStatus; goalSlug?: string } = {};
+  const projectId = url.searchParams.get('projectId') ?? undefined;
+  const filter: { status?: MissionStatus; goalSlug?: string; projectId?: string } = {};
   if (statusParam && isMissionStatus(statusParam)) filter.status = statusParam;
   if (goalSlug) filter.goalSlug = goalSlug;
+  if (projectId !== undefined) filter.projectId = projectId;
 
   const store = new TaskStore();
   try {

package/src/nexus/api/ops-api.ts

@@ -3,6 +3,7 @@ import { join } from 'node:path';
 import { debug, redactSecretText } from '../../debug/log.js';
 import { effectiveInstanceRoot } from '../../instance/resolve.js';
 import { listChecklist } from '../../release-loop/checklist.js';
+import { getSchedule } from '../../release-loop/release-schedule.js';
 import { jsonResponse } from './json-response.js';
 import { operatorSignal } from './operator.js';
 import { createSeatsCache, todayKst } from './ops-seats.js';
@@ -90,7 +91,15 @@ export function handleOpsApi(req: Request, metaApi: MetaApiOpts | undefined): Re
   const version = url.searchParams.get('version');
   if (pathname === '/v1/ops/checklist') {
     if (!version || !VERSION.test(version)) return jsonResponse({ error: 'invalid-version' }, 400);
-    return served(jsonResponse(listChecklist(version)));
+    // OPS2 header «컷 · 착지 마감»: the version's row in the release schedule (REL9a), or null when none is set.
+    let schedule: { cutAt: string; landBy: string | null } | null = null;
+    try {
+      const row = getSchedule(version);
+      schedule = row ? { cutAt: row.cutAt, landBy: row.landBy ?? null } : null;
+    } catch (error) {
+      debug.log('ops.api', 'schedule-unreadable', { version, reason: error instanceof Error ? error.message.slice(0, 80) : 'unknown' }, { level: 'warn' });
+    }
+    return served(jsonResponse({ ...listChecklist(version), schedule }));
   }
   if (pathname === '/v1/ops/release/runs') {
     if (version !== null && !VERSION.test(version)) return jsonResponse({ error: 'invalid-version' }, 400);