@bragduck/cli 2.39.0 → 2.40.0

package/dist/bin/bragduck.js

@@ -109,6 +109,9 @@ var init_constants = __esm({
         CREATE: "/v1/users/{userId}/stories",
         DELETE: "/v1/users/{userId}/stories/{storyId}"
       },
+      INTEGRATIONS: {
+        ACCESS_TOKEN: "/v1/integrations/{provider}/access-token"
+      },
       VERSION: "/v1/cli/version",
       /**
        * @deprecated Use BRAGS.REFINE instead
@@ -193,7 +196,7 @@ var init_env_loader = __esm({
 });
 
 // src/utils/errors.ts
-var BragduckError, AuthenticationError, GitError, ApiError, NetworkError, ValidationError, OAuthError, TokenExpiredError, GitHubError, BitbucketError, GitLabError, JiraError, ConfluenceError, AtlassianError, GoogleDocsError, SlackError;
+var BragduckError, AuthenticationError, GitError, ApiError, NetworkError, ValidationError, OAuthError, TokenExpiredError, GitHubError, BitbucketError, GitLabError, JiraError, ConfluenceError, AtlassianError, GoogleDocsError, SlackError, IntegrationError;
 var init_errors = __esm({
   "src/utils/errors.ts"() {
     "use strict";
@@ -302,6 +305,12 @@ var init_errors = __esm({
         this.name = "SlackError";
       }
     };
+    IntegrationError = class extends BragduckError {
+      constructor(message, details) {
+        super(message, "INTEGRATION_ERROR", details);
+        this.name = "IntegrationError";
+      }
+    };
   }
 });
 
@@ -1300,8 +1309,8 @@ __export(version_exports, {
 import { readFileSync as readFileSync6 } from "fs";
 import { fileURLToPath as fileURLToPath7 } from "url";
 import { dirname as dirname6, join as join8 } from "path";
-import chalk4 from "chalk";
-import boxen2 from "boxen";
+import chalk2 from "chalk";
+import boxen from "boxen";
 function getCurrentVersion() {
   try {
     const packageJsonPath2 = join8(__dirname7, "../../package.json");
@@ -1361,16 +1370,16 @@ async function checkForUpdates(options = {}) {
   }
 }
 function displayUpdateNotification(currentVersion, latestVersion, critical = false) {
-  const urgency = critical ? chalk4.red.bold("CRITICAL UPDATE") : chalk4.yellow.bold("Update Available");
+  const urgency = critical ? chalk2.red.bold("CRITICAL UPDATE") : chalk2.yellow.bold("Update Available");
   const message = `${urgency}
 
-Current version: ${chalk4.dim(currentVersion)}
-Latest version:  ${chalk4.green(latestVersion)}
+Current version: ${chalk2.dim(currentVersion)}
+Latest version:  ${chalk2.green(latestVersion)}
 
-Update with: ${chalk4.cyan("npm install -g @bragduck/cli@latest")}`;
+Update with: ${chalk2.cyan("npm install -g @bragduck/cli@latest")}`;
   console.log("");
   console.log(
-    boxen2(message, {
+    boxen(message, {
       padding: 1,
       margin: { top: 0, right: 1, bottom: 0, left: 1 },
       borderStyle: "round",
@@ -1422,7 +1431,7 @@ function getPlatformInfo() {
   const arch = process.arch;
   return `${platform}-${arch}`;
 }
-var __filename8, __dirname8, ApiService, apiService;
+var __filename8, __dirname8, REFINE_BATCH_SIZE, CREATE_BATCH_SIZE, inBatches, ApiService, apiService;
 var init_api_service = __esm({
   "src/services/api.service.ts"() {
     "use strict";
@@ -1433,6 +1442,15 @@ var init_api_service = __esm({
     init_logger();
     __filename8 = fileURLToPath8(import.meta.url);
     __dirname8 = dirname7(__filename8);
+    REFINE_BATCH_SIZE = 20;
+    CREATE_BATCH_SIZE = 50;
+    inBatches = (items, size) => {
+      const batches = [];
+      for (let start = 0; start < items.length; start += size) {
+        batches.push(items.slice(start, start + size));
+      }
+      return batches;
+    };
     ApiService = class {
       baseURL;
       client;
@@ -1548,10 +1566,23 @@ var init_api_service = __esm({
         };
         logger.debug(`Refining ${trimmedRequest.brags.length} brags`);
         try {
-          const response = await this.makeRequest(API_ENDPOINTS.BRAGS.REFINE, {
-            method: "POST",
-            body: trimmedRequest
-          });
+          const response = {
+            refined_brags: [],
+            processing_time_ms: 0,
+            tokens_used: 0
+          };
+          for (const batch of inBatches(trimmedRequest.brags, REFINE_BATCH_SIZE)) {
+            const batchResponse = await this.makeRequest(
+              API_ENDPOINTS.BRAGS.REFINE,
+              {
+                method: "POST",
+                body: { ...trimmedRequest, brags: batch }
+              }
+            );
+            response.refined_brags.push(...batchResponse.refined_brags);
+            response.processing_time_ms += batchResponse.processing_time_ms;
+            response.tokens_used += batchResponse.tokens_used;
+          }
           logger.debug(`Successfully refined ${response.refined_brags.length} brags`);
           return response;
         } catch (_error) {
@@ -1585,10 +1616,18 @@ var init_api_service = __esm({
         logger.debug(`Creating ${request.brags.length} brags`);
         logger.debug(`Request body: ${JSON.stringify(request, null, 2)}`);
         try {
-          const response = await this.makeRequest(API_ENDPOINTS.BRAGS.CREATE, {
-            method: "POST",
-            body: request
-          });
+          const response = { created: 0, brags: [] };
+          for (const batch of inBatches(request.brags, CREATE_BATCH_SIZE)) {
+            const batchResponse = await this.makeRequest(
+              API_ENDPOINTS.BRAGS.CREATE,
+              {
+                method: "POST",
+                body: { ...request, brags: batch }
+              }
+            );
+            response.created += batchResponse.created;
+            response.brags.push(...batchResponse.brags);
+          }
           logger.debug(`Response: ${JSON.stringify(response, null, 2)}`);
           logger.debug(`Successfully created ${response.created} brags`);
           return response;
@@ -1729,6 +1768,18 @@ var init_api_service = __esm({
           throw error;
         }
       }
+      /**
+       * Get the access token of a tool connected on the BragDuck web app.
+       * The server refreshes it; error statuses are not retried.
+       */
+      async getIntegrationAccessToken(provider) {
+        logger.debug(`Fetching web-connected ${provider} access token`);
+        const url = API_ENDPOINTS.INTEGRATIONS.ACCESS_TOKEN.replace("{provider}", provider);
+        return this.makeRequest(url, {
+          method: "GET",
+          retry: 0
+        });
+      }
       /**
        * Check for CLI updates
        */
@@ -1790,8 +1841,8 @@ import { dirname as dirname8, join as join10 } from "path";
 // src/commands/auth.ts
 init_esm_shims();
 init_auth_service();
-import boxen from "boxen";
-import chalk3 from "chalk";
+import boxen2 from "boxen";
+import chalk4 from "chalk";
 import { input } from "@inquirer/prompts";
 
 // src/services/atlassian-auth.service.ts
@@ -2629,20 +2680,123 @@ var GitService = class {
 };
 var gitService = new GitService();
 
+// src/services/integrations.service.ts
+init_esm_shims();
+init_api_service();
+init_auth_service();
+init_storage_service();
+init_errors();
+init_logger();
+var WEB_APP_HOST = "app.bragduck.com";
+var EXPIRY_MARGIN_MS = 60 * 1e3;
+var PROVIDER_LABELS = {
+  atlassian: "Atlassian",
+  github: "GitHub",
+  slack: "Slack",
+  google: "Google Docs"
+};
+function toHost(url) {
+  return url.trim().toLowerCase().replace(/^https?:\/\//, "").replace(/\/+$/, "");
+}
+var IntegrationsService = class {
+  cache = /* @__PURE__ */ new Map();
+  loggedSites = /* @__PURE__ */ new Set();
+  /**
+   * Get the access token for a web-connected tool.
+   * Returns null when the user is not logged in to BragDuck or the tool is not connected.
+   */
+  async getConnectedAccessToken(provider) {
+    const cached = this.cache.get(provider);
+    if (cached && this.isFresh(cached)) {
+      return cached;
+    }
+    if (!await authService.isAuthenticated()) {
+      return null;
+    }
+    const label = PROVIDER_LABELS[provider];
+    try {
+      const connection = await apiService.getIntegrationAccessToken(provider);
+      this.cache.set(provider, connection);
+      logger.debug(`Using ${label} connected via web (${connection.accountName})`);
+      return connection;
+    } catch (error) {
+      if (!(error instanceof ApiError)) {
+        throw error;
+      }
+      if (error.statusCode === 404) {
+        logger.debug(`${label} is not connected on the web`);
+        return null;
+      }
+      if (error.statusCode === 409) {
+        throw new IntegrationError(
+          `Your ${label} connection has expired. Reconnect ${label} at ${WEB_APP_HOST}`,
+          { hint: `Reconnect ${label} at https://${WEB_APP_HOST}` }
+        );
+      }
+      if (error.statusCode === 502) {
+        throw new IntegrationError(`Could not refresh your ${label} token. Try again shortly.`, {
+          hint: `If this keeps happening, reconnect ${label} at https://${WEB_APP_HOST}`
+        });
+      }
+      throw error;
+    }
+  }
+  /**
+   * Build Jira/Confluence OAuth credentials from the web-connected Atlassian account.
+   * Uses the site matching the configured instance, otherwise the first site.
+   */
+  async getAtlassianCredentials(service) {
+    const connection = await this.getConnectedAccessToken("atlassian");
+    const sites = connection?.metadata.sites ?? [];
+    if (!connection || sites.length === 0) {
+      return null;
+    }
+    const configuredInstance = await storageService.getConfigWithHierarchy(`${service}Instance`);
+    const matchingSite = configuredInstance ? sites.find((s) => toHost(s.url) === toHost(configuredInstance)) : void 0;
+    const site = matchingSite ?? sites[0];
+    if (sites.length > 1 && !this.loggedSites.has(site.id)) {
+      this.loggedSites.add(site.id);
+      logger.info(`Using Atlassian site ${site.name} (${site.url}) connected via web`);
+    }
+    return {
+      accessToken: connection.accessToken,
+      cloudId: site.id,
+      instanceUrl: site.url,
+      authMethod: "oauth"
+    };
+  }
+  isFresh(connection) {
+    if (!connection.expiresAt) {
+      return true;
+    }
+    return new Date(connection.expiresAt).getTime() - EXPIRY_MARGIN_MS > Date.now();
+  }
+};
+var integrationsService = new IntegrationsService();
+
 // src/services/github.service.ts
 var execAsync2 = promisify2(exec2);
 var GitHubService = class {
   MAX_BODY_LENGTH = 5e3;
   PR_SEARCH_FIELDS = "number,title,body,author,mergedAt,additions,deletions,changedFiles,url,labels";
+  // Set when gh has no login of its own and GitHub is connected on the BragDuck web app
+  useWebConnection = false;
   /**
    * Execute a gh CLI command with clean environment
    * Unsets GITHUB_TOKEN and GH_TOKEN to prevent .envrc tokens from interfering
-   * with gh CLI's own authentication
+   * with gh CLI's own authentication. When using the web connection, GH_TOKEN
+   * is set to the server-held token instead.
    */
   async execGhCommand(command, cwd) {
     const env = { ...process.env };
     delete env.GITHUB_TOKEN;
     delete env.GH_TOKEN;
+    if (this.useWebConnection) {
+      const connection = await integrationsService.getConnectedAccessToken("github");
+      if (connection) {
+        env.GH_TOKEN = connection.accessToken;
+      }
+    }
     return execAsync2(command, { env, cwd: cwd || process.cwd() });
   }
   /**
@@ -2668,14 +2822,30 @@ var GitHubService = class {
     }
   }
   /**
-   * Check if user is authenticated with GitHub CLI
+   * Check if user is authenticated with GitHub CLI, falling back to
+   * the GitHub account connected on the BragDuck web app
    */
   async checkAuthentication() {
     try {
       await this.execGhCommand("command gh auth status");
       return true;
     } catch {
-      return false;
+      return this.checkWebConnection();
+    }
+  }
+  /**
+   * Use the server-held GitHub token when GitHub is connected on the web
+   */
+  async checkWebConnection() {
+    try {
+      const connection = await integrationsService.getConnectedAccessToken("github");
+      this.useWebConnection = connection !== null;
+      return this.useWebConnection;
+    } catch (error) {
+      if (error instanceof IntegrationError) {
+        throw new GitHubError(error.message, error.details);
+      }
+      throw error;
     }
   }
   /**
@@ -2699,6 +2869,9 @@ var GitHubService = class {
       return { installed: false, authenticated: false };
     }
     const authenticated = await this.checkAuthentication();
+    if (this.useWebConnection) {
+      return { installed, authenticated, connectedViaWeb: true };
+    }
     return { installed, authenticated };
   }
   /**
@@ -2873,33 +3046,33 @@ init_logger();
 
 // src/ui/theme.ts
 init_esm_shims();
-import chalk2 from "chalk";
+import chalk3 from "chalk";
 var colors = {
   // Primary colors for main actions and interactive elements
-  primary: chalk2.cyan,
+  primary: chalk3.cyan,
   // Success states
-  success: chalk2.green,
-  successBold: chalk2.green.bold,
+  success: chalk3.green,
+  successBold: chalk3.green.bold,
   // Warning states
-  warning: chalk2.yellow,
-  warningBold: chalk2.yellow.bold,
+  warning: chalk3.yellow,
+  warningBold: chalk3.yellow.bold,
   // Error states
-  error: chalk2.red,
-  errorBold: chalk2.red.bold,
+  error: chalk3.red,
+  errorBold: chalk3.red.bold,
   // Info and metadata
-  info: chalk2.gray,
-  infoDim: chalk2.dim,
+  info: chalk3.gray,
+  infoDim: chalk3.dim,
   // Highlighted/important data
-  highlight: chalk2.yellow.bold,
-  highlightCyan: chalk2.cyan.bold,
+  highlight: chalk3.yellow.bold,
+  highlightCyan: chalk3.cyan.bold,
   // Text emphasis
-  bold: chalk2.bold,
-  dim: chalk2.dim,
+  bold: chalk3.bold,
+  dim: chalk3.dim,
   // Special purpose
-  white: chalk2.white,
-  gray: chalk2.gray,
+  white: chalk3.white,
+  gray: chalk3.gray,
   // Links and URLs
-  link: chalk2.blue.underline
+  link: chalk3.blue.underline
 };
 var theme = {
   /**
@@ -3068,13 +3241,13 @@ async function authLogin() {
     const userInfo = authService.getUserInfo();
     if (userInfo) {
       logger.log(
-        boxen(
-          `${chalk3.yellow("Already authenticated!")}
+        boxen2(
+          `${chalk4.yellow("Already authenticated!")}
 
-${chalk3.gray("User:")} ${userInfo.name}
-${chalk3.gray("Email:")} ${userInfo.email}
+${chalk4.gray("User:")} ${userInfo.name}
+${chalk4.gray("Email:")} ${userInfo.email}
 
-${chalk3.dim("Run")} ${chalk3.cyan("bragduck logout")} ${chalk3.dim("to sign out")}`,
+${chalk4.dim("Run")} ${chalk4.cyan("bragduck logout")} ${chalk4.dim("to sign out")}`,
           {
             padding: 1,
             margin: 1,
@@ -3091,13 +3264,13 @@ ${chalk3.dim("Run")} ${chalk3.cyan("bragduck logout")} ${chalk3.dim("to sign out
     const userInfo = await authService.login();
     logger.log("");
     logger.log(
-      boxen(
-        `${chalk3.green.bold("\u2713 Successfully authenticated!")}
+      boxen2(
+        `${chalk4.green.bold("\u2713 Successfully authenticated!")}
 
-${chalk3.gray("Welcome,")} ${chalk3.cyan(userInfo.name)}
-${chalk3.gray("Email:")} ${userInfo.email}
+${chalk4.gray("Welcome,")} ${chalk4.cyan(userInfo.name)}
+${chalk4.gray("Email:")} ${userInfo.email}
 
-${chalk3.dim("Use")} ${chalk3.cyan("bragduck sync")} ${chalk3.dim("to create brags")}`,
+${chalk4.dim("Use")} ${chalk4.cyan("bragduck sync")} ${chalk4.dim("to create brags")}`,
         {
           padding: 1,
           margin: 1,
@@ -3111,7 +3284,7 @@ ${chalk3.dim("Use")} ${chalk3.cyan("bragduck sync")} ${chalk3.dim("to create bra
     const err = error;
     logger.log("");
     logger.log(
-      boxen(`${chalk3.red.bold("\u2717 Authentication Failed")}
+      boxen2(`${chalk4.red.bold("\u2717 Authentication Failed")}
 
 ${err.message}`, {
         padding: 1,
@@ -3123,6 +3296,12 @@ ${err.message}`, {
     process.exit(1);
   }
 }
+async function getWebConnection(provider) {
+  return integrationsService.getConnectedAccessToken(provider).catch((error) => {
+    logger.debug(`Could not check web-connected ${provider}: ${error}`);
+    return null;
+  });
+}
 async function authStatus() {
   logger.log("");
   logger.info("Authentication Status:");
@@ -3138,9 +3317,14 @@ async function authStatus() {
   logger.log("");
   logger.info("Git Sources:");
   logger.log("");
-  const ghStatus = await githubService.getAuthStatus();
+  const ghStatus = await githubService.getAuthStatus().catch((error) => {
+    logger.debug(`Could not check GitHub auth status: ${error}`);
+    return { installed: true, authenticated: false, connectedViaWeb: false };
+  });
   if (ghStatus.installed) {
-    if (ghStatus.authenticated) {
+    if (ghStatus.connectedViaWeb) {
+      logger.info(`${colors.success("\u2713")} GitHub: connected via web`);
+    } else if (ghStatus.authenticated) {
       logger.info(`${colors.success("\u2713")} GitHub: Authenticated`);
     } else {
       logger.info(`${colors.error("\u2717")} GitHub: Not authenticated`);
@@ -3185,8 +3369,15 @@ async function authStatus() {
     if (jiraAuth) logger.info(theme.secondary("  \xB7 Jira"));
     if (confluenceAuth) logger.info(theme.secondary("  \xB7 Confluence"));
   } else {
-    logger.info(`${colors.error("\u2717")} Atlassian (Jira + Confluence): Not connected`);
-    logger.info(theme.secondary("  Run: bragduck auth atlassian"));
+    const webAtlassian = await getWebConnection("atlassian");
+    if (webAtlassian) {
+      logger.info(
+        `${colors.success("\u2713")} Jira/Confluence: connected via web (${webAtlassian.accountName})`
+      );
+    } else {
+      logger.info(`${colors.error("\u2717")} Atlassian (Jira + Confluence): Not connected`);
+      logger.info(theme.secondary("  Run: bragduck auth atlassian"));
+    }
   }
   logger.log("");
   logger.info("Document Sources:");
@@ -3195,8 +3386,15 @@ async function authStatus() {
   if (googleDocsAuth) {
     logger.info(`${colors.success("\u2713")} Google Docs (OAuth)`);
   } else {
-    logger.info(`${colors.error("\u2717")} Google Docs: Not connected`);
-    logger.info(theme.secondary("  Run: bragduck auth google"));
+    const webGoogle = await getWebConnection("google");
+    if (webGoogle) {
+      logger.info(
+        `${colors.success("\u2713")} Google Docs: connected via web (${webGoogle.accountName})`
+      );
+    } else {
+      logger.info(`${colors.error("\u2717")} Google Docs: Not connected`);
+      logger.info(theme.secondary("  Run: bragduck auth google"));
+    }
   }
   const slackAuth = await storageService.isServiceAuthenticated("slack");
   if (slackAuth) {
@@ -3204,15 +3402,20 @@ async function authStatus() {
     const userLabel = creds?.username ? ` (user: ${creds.username})` : "";
     logger.info(`${colors.success("\u2713")} Slack: Connected${userLabel}`);
   } else {
-    logger.info(`${colors.error("\u2717")} Slack: Not connected`);
-    logger.info(theme.secondary("  Run: bragduck auth slack"));
+    const webSlack = await getWebConnection("slack");
+    if (webSlack) {
+      logger.info(`${colors.success("\u2713")} Slack: connected via web (${webSlack.accountName})`);
+    } else {
+      logger.info(`${colors.error("\u2717")} Slack: Not connected`);
+      logger.info(theme.secondary("  Run: bragduck auth slack"));
+    }
   }
   logger.log("");
 }
 async function authBitbucket() {
   logger.log("");
   logger.log(
-    boxen(
+    boxen2(
       theme.info("Bitbucket API Token Authentication") + "\n\nCreate an API Token at:\n" + colors.highlight("https://bitbucket.org/account/settings/api-token/new") + "\n\nRequired scopes:\n  \u2022 pullrequest:read\n  \u2022 repository:read\n  \u2022 account:read\n\n" + theme.warning("Note: API tokens expire (max 1 year)"),
       boxStyles.info
     )
@@ -3243,7 +3446,7 @@ async function authBitbucket() {
     if (!response.ok) {
       logger.log("");
       logger.log(
-        boxen(
+        boxen2(
           theme.error("\u2717 Authentication Failed") + "\n\nInvalid email or API token",
           boxStyles.error
         )
@@ -3264,7 +3467,7 @@ async function authBitbucket() {
     await storageService.setServiceCredentials("bitbucket", credentials);
     logger.log("");
     logger.log(
-      boxen(
+      boxen2(
         theme.success("\u2713 Successfully authenticated with Bitbucket") + `
 
 Email: ${email}
@@ -3278,7 +3481,7 @@ User: ${user.display_name}
     const err = error;
     logger.log("");
     logger.log(
-      boxen(
+      boxen2(
         theme.error("\u2717 Authentication Failed") + "\n\n" + (err.message || "Unknown error"),
         boxStyles.error
       )
@@ -3290,7 +3493,7 @@ User: ${user.display_name}
 async function authGitLab() {
   logger.log("");
   logger.log(
-    boxen(
+    boxen2(
       theme.info("GitLab Personal Access Token Authentication") + "\n\nCreate a Personal Access Token at:\n" + colors.highlight("https://gitlab.com/-/profile/personal_access_tokens") + "\n\nRequired scopes:\n  \u2022 api (full API access)\n  \u2022 read_api (read API)\n  \u2022 read_user (read user info)\n\n" + theme.warning("For self-hosted GitLab, check your instance docs"),
       boxStyles.info
     )
@@ -3312,7 +3515,7 @@ async function authGitLab() {
     if (!response.ok) {
       logger.log("");
       logger.log(
-        boxen(
+        boxen2(
           theme.error("\u2717 Authentication Failed") + "\n\nInvalid instance URL or access token",
           boxStyles.error
         )
@@ -3328,7 +3531,7 @@ async function authGitLab() {
     await storageService.setServiceCredentials("gitlab", credentials);
     logger.log("");
     logger.log(
-      boxen(
+      boxen2(
         theme.success("\u2713 Successfully authenticated with GitLab") + `
 
 Instance: ${instanceUrl}
@@ -3341,7 +3544,7 @@ User: ${user.name} (@${user.username})`,
     const err = error;
     logger.log("");
     logger.log(
-      boxen(
+      boxen2(
         theme.error("\u2717 Authentication Failed") + "\n\n" + (err.message || "Unknown error"),
         boxStyles.error
       )
@@ -3358,7 +3561,7 @@ async function authAtlassian() {
     const result = await atlassianAuthService.login();
     logger.log("");
     logger.log(
-      boxen(
+      boxen2(
         theme.success("\u2713 Successfully authenticated with Atlassian Cloud") + `
 
 Site: ${result.siteName}
@@ -3375,7 +3578,7 @@ Services configured:
     const err = error;
     logger.log("");
     logger.log(
-      boxen(
+      boxen2(
         theme.error("\u2717 Authentication Failed") + "\n\n" + (err.message || "Unknown error"),
         boxStyles.error
       )
@@ -3392,7 +3595,7 @@ async function authGoogle() {
     const result = await googleAuthService.login();
     logger.log("");
     logger.log(
-      boxen(
+      boxen2(
         theme.success("\u2713 Successfully authenticated with Google") + `
 
 Account: ${result.email}
@@ -3407,7 +3610,7 @@ Services configured:
     const err = error;
     logger.log("");
     logger.log(
-      boxen(
+      boxen2(
         theme.error("\u2717 Authentication Failed") + "\n\n" + (err.message || "Unknown error"),
         boxStyles.error
       )
@@ -3424,7 +3627,7 @@ async function authSlack() {
     const result = await slackAuthService.login();
     logger.log("");
     logger.log(
-      boxen(
+      boxen2(
         theme.success("\u2713 Successfully authenticated with Slack") + `
 
 Workspace: ${result.teamName}
@@ -3439,7 +3642,7 @@ Services configured:
     const err = error;
     logger.log("");
     logger.log(
-      boxen(
+      boxen2(
         theme.error("\u2717 Authentication Failed") + "\n\n" + (err.message || "Unknown error"),
         boxStyles.error
       )
@@ -3622,8 +3825,8 @@ var SourceDetector = class {
   async checkAuthentication(type) {
     try {
       if (type === "github") {
-        await execAsync3("command gh auth status");
-        return true;
+        const { authenticated } = await githubService.getAuthStatus();
+        return authenticated;
       } else if (type === "bitbucket" || type === "atlassian") {
         return await storageService.isServiceAuthenticated("bitbucket");
       } else if (type === "gitlab") {
@@ -4372,6 +4575,10 @@ var JiraService = class {
   async getCredentials() {
     const creds = await storageService.getServiceCredentials("jira");
     if (!creds || !creds.accessToken) {
+      const webCreds = await integrationsService.getAtlassianCredentials("jira");
+      if (webCreds) {
+        return webCreds;
+      }
       throw new JiraError("Not authenticated with Jira", {
         hint: "Run: bragduck auth atlassian"
       });
@@ -4498,7 +4705,7 @@ var JiraService = class {
     try {
       await this.request("/rest/api/3/myself");
     } catch (error) {
-      if (error instanceof JiraError) {
+      if (error instanceof JiraError || error instanceof IntegrationError) {
         throw error;
       }
       throw new JiraError("Could not access Jira instance via API", {
@@ -4632,7 +4839,8 @@ var JiraService = class {
       "reporter",
       "assignee",
       "status",
-      "issuetype"
+      "issuetype",
+      "project"
     ];
     const allIssues = [];
     const seenIssueKeys = /* @__PURE__ */ new Set();
@@ -4809,7 +5017,8 @@ ${truncatedDesc}`;
       externalId: issue.key,
       externalType: contribution?.type || "issue",
       externalSource: "jira",
-      externalUrl: url
+      externalUrl: url,
+      sourceName: issue.fields.project?.name || issue.fields.project?.key
     };
   }
 };
@@ -4871,6 +5080,10 @@ var ConfluenceService = class {
   async getCredentials() {
     const creds = await storageService.getServiceCredentials("confluence");
     if (!creds || !creds.accessToken) {
+      const webCreds = await integrationsService.getAtlassianCredentials("confluence");
+      if (webCreds) {
+        return webCreds;
+      }
       throw new ConfluenceError("Not authenticated with Confluence", {
         hint: "Run: bragduck auth atlassian"
       });
@@ -4991,7 +5204,7 @@ var ConfluenceService = class {
     try {
       await this.request("/wiki/rest/api/content?type=page&limit=1");
     } catch (error) {
-      if (error instanceof ConfluenceError) {
+      if (error instanceof ConfluenceError || error instanceof IntegrationError) {
         throw error;
       }
       throw new ConfluenceError("Could not access Confluence instance via API", {
@@ -5115,7 +5328,7 @@ var ConfluenceService = class {
         cql,
         start: start.toString(),
         limit: limit.toString(),
-        expand: "version,history,children.comment,body.storage"
+        expand: "version,history,children.comment,body.storage,space"
       };
       const queryString = Object.entries(params).map(([key, value]) => `${encodeURIComponent(key)}=${encodeURIComponent(value)}`).join("&");
       const endpoint = `/wiki/rest/api/content/search?${queryString}`;
@@ -5259,7 +5472,8 @@ ${contribution.details}
       externalId: page.id,
       externalType: contribution?.type || "page",
       externalSource: "confluence",
-      externalUrl: url
+      externalUrl: url,
+      sourceName: page.space?.name || page.space?.key
     };
   }
 };
@@ -5320,6 +5534,10 @@ var GoogleDocsService = class {
   async getCredentials() {
     const creds = await storageService.getServiceCredentials("google-docs");
     if (!creds || !creds.accessToken) {
+      const connection = await integrationsService.getConnectedAccessToken("google");
+      if (connection) {
+        return { accessToken: connection.accessToken };
+      }
       throw new GoogleDocsError("Not authenticated with Google Docs", {
         hint: "Run: bragduck auth google"
       });
@@ -5418,7 +5636,7 @@ var GoogleDocsService = class {
         "https://www.googleapis.com/drive/v3/about?fields=user"
       );
     } catch (error) {
-      if (error instanceof GoogleDocsError) {
+      if (error instanceof GoogleDocsError || error instanceof IntegrationError) {
         throw error;
       }
       throw new GoogleDocsError("Could not access Google Drive API", {
@@ -5575,6 +5793,8 @@ init_logger();
 init_storage_service();
 import { URLSearchParams as URLSearchParams8 } from "url";
 var SlackService = class {
+  // Slack user ID of the web-connected account, looked up once per process
+  webUserId = null;
   /**
    * Get stored Slack credentials.
    * Slack user tokens (xoxp-) don't expire by default — no expiry check needed.
@@ -5582,12 +5802,39 @@ var SlackService = class {
   async getCredentials() {
     const creds = await storageService.getServiceCredentials("slack");
     if (!creds || !creds.accessToken) {
+      const webCreds = await this.getWebCredentials();
+      if (webCreds) {
+        return webCreds;
+      }
       throw new SlackError("Not authenticated with Slack", {
         hint: "Run: bragduck auth slack"
       });
     }
     return creds;
   }
+  /**
+   * Build credentials from the Slack account connected on the BragDuck web app.
+   * The server does not return the Slack user ID, so it is looked up via auth.test.
+   */
+  async getWebCredentials() {
+    const connection = await integrationsService.getConnectedAccessToken("slack");
+    if (!connection) {
+      return null;
+    }
+    if (!this.webUserId) {
+      const data = await this.authTest(connection.accessToken);
+      if (!data.ok) {
+        throw new SlackError(`Slack credentials invalid: ${data.error || "unknown error"}`, {
+          hint: "Reconnect Slack at https://app.bragduck.com"
+        });
+      }
+      this.webUserId = data.user_id;
+    }
+    return {
+      accessToken: connection.accessToken,
+      username: this.webUserId
+    };
+  }
   /**
    * Make authenticated GET request to Slack Web API
    */
@@ -5632,18 +5879,24 @@ var SlackService = class {
     return data;
   }
   /**
-   * Validate Slack credentials via auth.test
+   * Call Slack auth.test with the given token
    */
-  async validateCredentials() {
-    const creds = await this.getCredentials();
+  async authTest(accessToken) {
     const response = await fetch("https://slack.com/api/auth.test", {
       method: "POST",
       headers: {
-        Authorization: `Bearer ${creds.accessToken}`,
+        Authorization: `Bearer ${accessToken}`,
         "Content-Type": "application/json"
       }
     });
-    const data = await response.json();
+    return await response.json();
+  }
+  /**
+   * Validate Slack credentials via auth.test
+   */
+  async validateCredentials() {
+    const creds = await this.getCredentials();
+    const data = await this.authTest(creds.accessToken);
     if (!data.ok) {
       throw new SlackError(`Slack credentials invalid: ${data.error || "unknown error"}`, {
         hint: "Run: bragduck auth slack"
@@ -5656,14 +5909,7 @@ var SlackService = class {
   async getCurrentUser() {
     try {
       const creds = await this.getCredentials();
-      const response = await fetch("https://slack.com/api/auth.test", {
-        method: "POST",
-        headers: {
-          Authorization: `Bearer ${creds.accessToken}`,
-          "Content-Type": "application/json"
-        }
-      });
-      const data = await response.json();
+      const data = await this.authTest(creds.accessToken);
       return data.ok ? data.user : null;
     } catch {
       return null;
@@ -5736,7 +5982,9 @@ var SlackService = class {
       externalId: msg.ts,
       externalType: "message",
       externalSource: "slack",
-      externalUrl: msg.permalink
+      externalUrl: msg.permalink,
+      // Direct messages have no channel name to tag
+      sourceName: msg.channel?.name || void 0
     };
   }
 };
@@ -5815,6 +6063,22 @@ var AdapterFactory = class {
 // src/commands/sync.ts
 init_logger();
 
+// src/utils/external-source.ts
+init_esm_shims();
+function getGitExternalSource(source) {
+  switch (source) {
+    case "github":
+      return "github";
+    case "gitlab":
+      return "gitlab";
+    case "bitbucket":
+    case "atlassian":
+      return "bitbucket";
+    default:
+      return void 0;
+  }
+}
+
 // src/utils/auth-helper.ts
 init_esm_shims();
 init_auth_service();
@@ -6111,9 +6375,9 @@ async function promptSortOption() {
     default: "date"
   });
 }
-async function promptSelectOrganisation(organisations) {
+async function promptSelectOrganisation(organisations, allowNone = true) {
   const choices = [
-    { name: "No company", value: "none" },
+    ...allowNone ? [{ name: "No company", value: "none" }] : [],
     ...organisations.map((org) => ({
       name: org.name,
       value: org.id
@@ -6122,11 +6386,11 @@ async function promptSelectOrganisation(organisations) {
   const selected = await select3({
     message: "Attach brags to which company?",
     choices,
-    default: "none"
+    default: allowNone ? "none" : void 0
   });
   return selected === "none" ? null : selected;
 }
-async function promptSelectOrganisationWithDefault(organisations, defaultOrgId) {
+async function promptSelectOrganisationWithDefault(organisations, defaultOrgId, allowNone = true) {
   if (defaultOrgId) {
     const defaultOrg = organisations.find((org) => org.id === defaultOrgId);
     if (defaultOrg) {
@@ -6139,7 +6403,7 @@ async function promptSelectOrganisationWithDefault(organisations, defaultOrgId)
       }
     }
   }
-  return await promptSelectOrganisation(organisations);
+  return await promptSelectOrganisation(organisations, allowNone);
 }
 async function promptReviewBrags(refinedBrags, selectedCommits) {
   const acceptedBrags = [];
@@ -6469,9 +6733,67 @@ async function discoverRepositories() {
 // src/sync/multi-repo-sync.ts
 init_esm_shims();
 init_api_service();
+init_storage_service();
+
+// src/sync/organisation.ts
+init_esm_shims();
+init_api_service();
 init_auth_service();
 init_storage_service();
 init_logger();
+init_errors();
+var CREATE_COMPANY_URL = "https://bragduck.com/app";
+async function loadSyncOrganisations() {
+  const userInfo = authService.getUserInfo();
+  if (!userInfo?.id) {
+    throw new AuthenticationError("Could not read your account to load your companies");
+  }
+  const orgsResponse = await apiService.listUserOrganisations(userInfo.id);
+  const companies = orgsResponse.items.filter((org) => org.role !== "__virtual__");
+  if (companies.length === 0) {
+    throw new ValidationError(
+      `Synced brags belong to a company, and you don't have one yet. Create a company at ${CREATE_COMPANY_URL}, then run sync again.`,
+      { hint: `Create a company at ${CREATE_COMPANY_URL}` }
+    );
+  }
+  return companies;
+}
+async function selectSyncOrganisation(organisations, turbo) {
+  if (organisations.length === 1) {
+    return organisations[0].id;
+  }
+  const defaultOrgId = storageService.getConfig("defaultCompany");
+  if (turbo) {
+    if (defaultOrgId && organisations.some((org) => org.id === defaultOrgId)) {
+      logger.debug(`Turbo mode: using default company ${defaultOrgId}`);
+      return defaultOrgId;
+    }
+    const companies = organisations.map((org) => `${org.name} (${org.id})`).join(", ");
+    throw new ValidationError(
+      `Turbo mode needs a default company when you belong to more than one: ${companies}`,
+      {
+        hint: 'Run "bragduck config set defaultCompany <company-id>", or sync without --turbo to pick one'
+      }
+    );
+  }
+  const orgId = await promptSelectOrganisationWithDefault(organisations, defaultOrgId, false);
+  logger.log("");
+  return orgId;
+}
+
+// src/sync/multi-repo-sync.ts
+init_logger();
+
+// src/utils/source-tag.ts
+init_esm_shims();
+var MAX_SOURCE_TAG_LENGTH = 50;
+function withSourceTag(sourceName, tags) {
+  const tag = sourceName?.replace(/,/g, " ").replace(/\s+/g, " ").trim().slice(0, MAX_SOURCE_TAG_LENGTH).trim();
+  if (!tag) return tags;
+  return [tag, ...tags.filter((existing) => existing.toLowerCase() !== tag.toLowerCase())];
+}
+
+// src/sync/multi-repo-sync.ts
 async function syncSingleRepository(repo, days, sortOption, scanMode, orgId, options) {
   const TOTAL_STEPS = 5;
   logger.debug(`Syncing repository: ${repo.name} at ${repo.path}`);
@@ -6590,6 +6912,7 @@ async function syncSingleRepository(repo, days, sortOption, scanMode, orgId, opt
   );
   refineSpinner.start();
   const refineRequest = {
+    orgId,
     brags: selectedCommits.map((c) => ({
       text: c.message,
       date: c.date,
@@ -6629,8 +6952,7 @@ async function syncSingleRepository(repo, days, sortOption, scanMode, orgId, opt
     mode: options.turbo ? "turbo" : "manual",
     brags: acceptedBrags.map((refined, index) => {
       const originalCommit = selectedCommits[index];
-      const repoTag = repo.name;
-      const tagsWithRepo = refined.suggested_tags.includes(repoTag) ? refined.suggested_tags : [repoTag, ...refined.suggested_tags];
+      const tagsWithRepo = withSourceTag(repo.name, refined.suggested_tags);
       return {
         commit_sha: originalCommit?.sha || `brag-${index}`,
         title: refined.refined_title,
@@ -6645,11 +6967,11 @@ async function syncSingleRepository(repo, days, sortOption, scanMode, orgId, opt
         impactDescription: refined.impact_description,
         impact_description: refined.impact_description,
         attachments: originalCommit?.url ? [originalCommit.url] : [],
-        orgId: orgId || void 0,
+        orgId,
         // External fields for non-git sources
         externalId: originalCommit?.externalId,
         externalType: originalCommit?.externalType,
-        externalSource: originalCommit?.externalSource,
+        externalSource: originalCommit?.externalSource ?? getGitExternalSource(repo.service),
         externalUrl: originalCommit?.externalUrl
       };
     })
@@ -6695,6 +7017,8 @@ async function syncSingleRepository(repo, days, sortOption, scanMode, orgId, opt
 }
 async function syncMultipleRepositories(repos, options) {
   logger.debug(`Starting multi-repo sync for ${repos.length} repositories`);
+  const organisations = await loadSyncOrganisations();
+  const turboOrgId = options.turbo ? await selectSyncOrganisation(organisations, true) : void 0;
   let days = options.days;
   if (!days && options.today) {
     days = 1;
@@ -6736,25 +7060,7 @@ async function syncMultipleRepositories(repos, options) {
     logger.log(colors.highlight(`\u2501\u2501\u2501 Syncing ${current}/${total}: ${repo.name} \u2501\u2501\u2501`));
     logger.log("");
     try {
-      let selectedOrgId = null;
-      if (!options.turbo) {
-        const userInfo = authService.getUserInfo();
-        if (userInfo?.id) {
-          try {
-            const orgsResponse = await apiService.listUserOrganisations(userInfo.id);
-            if (orgsResponse.items.length > 0) {
-              const defaultOrgId = storageService.getConfig("defaultCompany");
-              selectedOrgId = await promptSelectOrganisationWithDefault(
-                orgsResponse.items,
-                defaultOrgId
-              );
-              logger.log("");
-            }
-          } catch {
-            logger.debug("Failed to fetch organisations, skipping org selection");
-          }
-        }
-      }
+      const selectedOrgId = turboOrgId ?? await selectSyncOrganisation(organisations);
       const result = await syncSingleRepository(
         repo,
         days,
@@ -6855,6 +7161,7 @@ async function promptSelectService() {
   return selected;
 }
 async function syncSingleService(sourceType, options, TOTAL_STEPS, sharedDays, sharedOrgId) {
+  const selectedOrgId = sharedOrgId ?? await pickSyncOrganisation(options);
   const adapter = AdapterFactory.getAdapter(sourceType);
   const validationText = sourceType === "jira" || sourceType === "confluence" ? "Connecting to Atlassian instance" : sourceType === "google-docs" ? "Connecting to Google Drive" : "Validating repository";
   const repoSpinner = createStepSpinner(2, TOTAL_STEPS, validationText);
@@ -7000,6 +7307,7 @@ async function syncSingleService(sourceType, options, TOTAL_STEPS, sharedDays, s
   );
   refineSpinner.start();
   const refineRequest = {
+    orgId: selectedOrgId,
     brags: selectedCommits.map((c) => ({
       text: c.message,
       date: c.date,
@@ -7029,25 +7337,6 @@ async function syncSingleService(sourceType, options, TOTAL_STEPS, sharedDays, s
     return { created: 0, skipped: duplicates.length };
   }
   logger.log("");
-  let selectedOrgId = sharedOrgId !== void 0 ? sharedOrgId : null;
-  if (sharedOrgId === void 0) {
-    const userInfo = authService.getUserInfo();
-    if (userInfo?.id) {
-      const orgSpinner = createFetchSpinner("Loading organizations...");
-      orgSpinner.start();
-      try {
-        const orgsResponse = await apiService.listUserOrganisations(userInfo.id);
-        orgSpinner.stop();
-        if (orgsResponse.items.length > 0) {
-          selectedOrgId = await promptSelectOrganisation(orgsResponse.items);
-          logger.log("");
-        }
-      } catch {
-        orgSpinner.stop();
-        logger.debug("Failed to fetch organisations, skipping org selection");
-      }
-    }
-  }
   const createSpinner = createStepSpinner(
     5,
     TOTAL_STEPS,
@@ -7059,11 +7348,10 @@ async function syncSingleService(sourceType, options, TOTAL_STEPS, sharedDays, s
     brags: acceptedBrags.map((refined, index) => {
       const originalCommit = selectedCommits[index];
       const isGitSource = sourceType === "github" || sourceType === "gitlab" || sourceType === "bitbucket" || sourceType === "atlassian";
-      let tagsWithRepo = refined.suggested_tags;
-      if (isGitSource && repoInfo.name) {
-        const repoTag = repoInfo.name;
-        tagsWithRepo = refined.suggested_tags.includes(repoTag) ? refined.suggested_tags : [repoTag, ...refined.suggested_tags];
-      }
+      const tagsWithRepo = withSourceTag(
+        isGitSource ? repoInfo.name : originalCommit?.sourceName,
+        refined.suggested_tags
+      );
       return {
         commit_sha: originalCommit?.sha || `brag-${index}`,
         title: refined.refined_title,
@@ -7077,11 +7365,11 @@ async function syncSingleService(sourceType, options, TOTAL_STEPS, sharedDays, s
         impactDescription: refined.impact_description,
         impact_description: refined.impact_description,
         attachments: [],
-        orgId: selectedOrgId || void 0,
+        orgId: selectedOrgId,
         // External fields for non-git sources (Jira, Confluence, etc.)
         externalId: originalCommit?.externalId,
         externalType: originalCommit?.externalType,
-        externalSource: originalCommit?.externalSource,
+        externalSource: originalCommit?.externalSource ?? getGitExternalSource(sourceType),
         externalUrl: originalCommit?.externalUrl
       };
     })
@@ -7193,26 +7481,7 @@ async function syncAllAuthenticatedServices(options) {
     sharedDays = storageService.getConfig("defaultCommitDays") || 30;
     logger.debug(`Turbo mode: using default ${sharedDays} days`);
   }
-  let sharedOrgId = null;
-  if (!options.turbo) {
-    const userInfo = authService.getUserInfo();
-    if (userInfo?.id) {
-      const orgSpinner = createFetchSpinner("Loading organizations...");
-      orgSpinner.start();
-      try {
-        const orgsResponse = await apiService.listUserOrganisations(userInfo.id);
-        orgSpinner.stop();
-        if (orgsResponse.items.length > 0) {
-          const defaultOrgId = storageService.getConfig("defaultCompany");
-          sharedOrgId = await promptSelectOrganisationWithDefault(orgsResponse.items, defaultOrgId);
-          logger.log("");
-        }
-      } catch {
-        orgSpinner.stop();
-        logger.debug("Failed to fetch organisations, skipping org selection");
-      }
-    }
-  }
+  const sharedOrgId = await pickSyncOrganisation(options);
   const results = [];
   for (let i = 0; i < servicesToSync.length; i++) {
     const service = servicesToSync[i];
@@ -7461,7 +7730,8 @@ To authenticate:
         sourceType = selectedSource;
       }
       if (sourceType === "jira" || sourceType === "confluence") {
-        const creds = await storageService.getServiceCredentials(sourceType);
+        const localCreds = await storageService.getServiceCredentials(sourceType);
+        const creds = localCreds?.accessToken ? localCreds : await integrationsService.getAtlassianCredentials(sourceType);
         const envInstance = loadEnvConfig()[`${sourceType}Instance`];
         const projectConfig = await findProjectConfig();
         const configInstance = projectConfig?.[`${sourceType}Instance`];
@@ -7534,6 +7804,17 @@ To authenticate:
     process.exit(1);
   }
 }
+async function pickSyncOrganisation(options) {
+  const orgSpinner = createFetchSpinner("Loading organizations...");
+  orgSpinner.start();
+  let organisations;
+  try {
+    organisations = await loadSyncOrganisations();
+  } finally {
+    orgSpinner.stop();
+  }
+  return await selectSyncOrganisation(organisations, options.turbo);
+}
 function getServiceLabel(service) {
   if (service === "google-docs") return "Google Docs";
   if (service === "slack") return "Slack";
@@ -7564,6 +7845,9 @@ function getErrorHint(error, sourceType) {
     }
     return 'Run "bragduck auth login" to login again';
   }
+  if ((error.name === "IntegrationError" || error.name === "ValidationError") && error.details?.hint) {
+    return error.details.hint;
+  }
   if (error.name === "GoogleDocsError") {
     return 'Run "bragduck auth google" to re-authenticate with Google';
   }