@codeam/shared 2.61.29 → 2.61.31

package/dist/index.d.mts

@@ -351,12 +351,36 @@ declare function isHeadroomWrappable(agentId: string): boolean;
  * ubiquitous CLI for the tool → `cliEnv`; otherwise → `mcp`. A tool may
  * declare both.
  */
-type IntegrationId = 'jira' | 'sentry' | 'linear' | 'slack' | 'notion' | 'azure_devops' | 'figma' | 'microsoft_teams' | 'google_chat' | 'discord';
-type IntegrationAuthKind = 'oauth_redirect' | 'oauth_device' | 'api_key';
+type IntegrationId = 'jira' | 'sentry' | 'linear' | 'slack' | 'notion' | 'azure_devops' | 'figma' | 'microsoft_teams' | 'google_chat' | 'discord' | 'github_issues' | 'github';
+/**
+ * `derived` = no link flow of its own: the credential is BORROWED live from a
+ * connection the user already made elsewhere (see `derivedFrom`). The backend
+ * resolves it per call instead of vaulting a copy, so it can never go stale and
+ * there is exactly one source of truth. Such an integration is "linked" iff its
+ * source connection exists, and has no Connect/Disconnect action of its own.
+ */
+/**
+ * `connection` = the integration IS a standing connection whose credential lives
+ * in a `ProviderToken` row rather than the integrations vault, and whose
+ * connect/disconnect flow is owned by ANOTHER module (GitHub's OAuth belongs to
+ * the codespaces rail). It renders and acts like any other connector — the only
+ * difference is which code performs the link.
+ *
+ * Contrast `derived`, which BORROWS such a connection and owns no actions at
+ * all. Both resolve their credential from the same place; only `derived` has no
+ * link flow of its own.
+ */
+type IntegrationAuthKind = 'oauth_redirect' | 'oauth_device' | 'api_key' | 'derived' | 'connection';
+/**
+ * A standing connection whose credential lives in a `ProviderToken` row — either
+ * because the integration IS that connection (`kind: 'connection'`) or because
+ * it borrows it (`kind: 'derived'`). Its own id doubles as the source name.
+ */
+type DerivedCredentialSource = 'github';
 /** Grouping used by category-driven surfaces (Start-from-Work-Item picker,
  *  catalog sections). A future tracker integration joins those features with
  *  ZERO feature code — they resolve sources from the registry by category. */
-type IntegrationCategory = 'tracker' | 'design' | 'comms' | 'docs' | 'observability';
+type IntegrationCategory = 'version_control' | 'tracker' | 'design' | 'comms' | 'docs' | 'observability';
 /**
  * One user-entered field for an `api_key` integration (no browser OAuth — the
  * user pastes credentials directly, e.g. a PAT + an org URL). The mobile form
@@ -402,6 +426,15 @@ interface IntegrationDefinition {
         scopes?: string[];
         /** For `kind: 'api_key'` — the credential fields the user pastes (no OAuth). */
         fields?: IntegrationApiKeyField[];
+        /** For `kind: 'derived'` — the connection whose credential this borrows.
+         *  Drives both the backend's credential resolution and the client's
+         *  "no connect action, managed by <source>" rendering. */
+        derivedFrom?: DerivedCredentialSource;
+        /** For `kind: 'connection'` — the connection this integration IS. Same
+         *  credential lookup as `derivedFrom`, but this one owns its link flow
+         *  (performed by the module that owns the connection, not by the generic
+         *  integrations OAuth path). */
+        connection?: DerivedCredentialSource;
     };
     delivery: IntegrationDelivery;
 }
@@ -1489,4 +1522,4 @@ type UserEventName = (typeof USER_EVENTS)[keyof typeof USER_EVENTS];
  */
 declare const PREVIEW_DETECT_PROMPT: string;
 
-export { AGENT_REGISTRY, type AgentAuth, type AgentAuthKind, type AgentId, type AgentMetadata, type AgentMode, type AgentModel, type AgentReviewFinding, type AgentReviewPlan, type AgentReviewReport, type AnswerResolvedEvent, type AwaitingAnswerEvent, type BeadsActionCommand, type BeadsActionKind, type BeadsActionPayload, type BeadsActionRequest, type BeadsActionType, type BeadsConfigureAction, type BeadsDependencyDto, type BeadsDependencyKind, type BeadsIngestPayload, type BeadsIssueDto, type BeadsIssueStatus, type BeadsMemoryDto, type BeadsProjectDto, type BeadsProvisioningPayload, type BeadsProvisioningStatus, type BeadsSnapshotDto, type BeadsStatus, type BeadsStatusState, type BeadsStatusSummary, type BlameLineWire, type BrokeredIntegrationToken, type ChromeStep, type ChromeToolType, type CommitEntryWire, DEFAULT_API_BASE_URL, DEV_API_BASE_URL, type EnvVar, type FileBlameEvent, type FileChangeStatus, type FileChangedEvent, type FileHistoryEvent, type FileReviewStatus, HEADROOM_BACKEND_ENV, HEADROOM_EXTRAS_BY_SURFACE, HEADROOM_MODELS, HEADROOM_PIP_COMPANIONS, HEADROOM_PROXY_PORT, HEARTBEAT_INTERVAL_MS_DEFAULT, HOUSE_AGENT_ID, HOUSE_AGENT_NAME, HOUSE_AGENT_PROVIDER, HOUSE_AGENT_SUBTITLE, HOUSE_AGENT_VENDOR, type HeadroomBudgetCommand, type HeadroomBudgetPeriod, type HeadroomBudgetUsage, type HeadroomKind, type HeadroomModelSpec, type HeadroomPythonRenderOpts, type HeadroomStatus, type HeadroomStep, type HeadroomSurface, type HunkLineType, INTEGRATION_BRANDING, INTEGRATION_REGISTRY, INTERNAL_TO_PUBLIC, type InputSuggestionChunk, type IntegrationApiKeyField, type IntegrationAuthKind, type IntegrationBranding, type IntegrationCategory, type IntegrationDefinition, type IntegrationDelivery, type IntegrationHealth, type IntegrationId, type IntegrationMcpDelivery, type IntegrationStatus, type IntegrationsManifest, type IntegrationsManifestEntry, LINKED_AGENT_IDS, type LinkedAgentId, MODEL_CONTEXT_WINDOW, MODEL_PRICING, type ModelPricing, type NormalizedMessage, OBSERVER_BRIDGE_PORT, PREVIEW_DETECT_PROMPT, PROTOCOL_VERSION, PUBLIC_TO_INTERNAL, type PendingReviewHunkEvent, type PendingReviewHunkLine, type PrCheck, type PrRef, type PrReviewEntry, type PrReviewVerdict, type PreviewDetection, type PreviewErrorStage, type PreviewState, type PreviewStatus, type PullRequestDetail, type PullRequestSummary, type RemoteCommand, SKILL_REGISTRY, SSE_SOCKET_TIMEOUT_MS, type SelectPrompt, type SkillDefinition, type SkillDelivery, type SkillFileDelivery, type SkillId, type SkillRail, type SkillsManifest, type SkillsManifestEntry, type StreamingChunkEvent, type StreamingChunkKind, TERMINAL_AGENT_PREFIX, UNKNOWN_MODEL_PRICING, UPCOMING_INTEGRATION_IDS, USER_EVENTS, type UserEventName, getAgent, getContextWindow, getEnabledAgents, getEnabledIntegrations, getIntegration, getIntegrationBranding, getIntegrationsByCategory, getPricing, getSkillDefinition, headroomKindFor, headroomModelPredownloadScript, headroomPipPackage, headroomSnapshotDownloadLine, internalToPublic, isHeadroomWrappable, isKnownAgentId, isKnownIntegrationId, isKnownModel, isLinkedAgentId, isSkillId, normalizeAgentId, publicToInternal, renderToLines, resolveApiBaseUrl, skillHasRail, toRemoteCommand, tryGetContextWindow };
+export { AGENT_REGISTRY, type AgentAuth, type AgentAuthKind, type AgentId, type AgentMetadata, type AgentMode, type AgentModel, type AgentReviewFinding, type AgentReviewPlan, type AgentReviewReport, type AnswerResolvedEvent, type AwaitingAnswerEvent, type BeadsActionCommand, type BeadsActionKind, type BeadsActionPayload, type BeadsActionRequest, type BeadsActionType, type BeadsConfigureAction, type BeadsDependencyDto, type BeadsDependencyKind, type BeadsIngestPayload, type BeadsIssueDto, type BeadsIssueStatus, type BeadsMemoryDto, type BeadsProjectDto, type BeadsProvisioningPayload, type BeadsProvisioningStatus, type BeadsSnapshotDto, type BeadsStatus, type BeadsStatusState, type BeadsStatusSummary, type BlameLineWire, type BrokeredIntegrationToken, type ChromeStep, type ChromeToolType, type CommitEntryWire, DEFAULT_API_BASE_URL, DEV_API_BASE_URL, type DerivedCredentialSource, type EnvVar, type FileBlameEvent, type FileChangeStatus, type FileChangedEvent, type FileHistoryEvent, type FileReviewStatus, HEADROOM_BACKEND_ENV, HEADROOM_EXTRAS_BY_SURFACE, HEADROOM_MODELS, HEADROOM_PIP_COMPANIONS, HEADROOM_PROXY_PORT, HEARTBEAT_INTERVAL_MS_DEFAULT, HOUSE_AGENT_ID, HOUSE_AGENT_NAME, HOUSE_AGENT_PROVIDER, HOUSE_AGENT_SUBTITLE, HOUSE_AGENT_VENDOR, type HeadroomBudgetCommand, type HeadroomBudgetPeriod, type HeadroomBudgetUsage, type HeadroomKind, type HeadroomModelSpec, type HeadroomPythonRenderOpts, type HeadroomStatus, type HeadroomStep, type HeadroomSurface, type HunkLineType, INTEGRATION_BRANDING, INTEGRATION_REGISTRY, INTERNAL_TO_PUBLIC, type InputSuggestionChunk, type IntegrationApiKeyField, type IntegrationAuthKind, type IntegrationBranding, type IntegrationCategory, type IntegrationDefinition, type IntegrationDelivery, type IntegrationHealth, type IntegrationId, type IntegrationMcpDelivery, type IntegrationStatus, type IntegrationsManifest, type IntegrationsManifestEntry, LINKED_AGENT_IDS, type LinkedAgentId, MODEL_CONTEXT_WINDOW, MODEL_PRICING, type ModelPricing, type NormalizedMessage, OBSERVER_BRIDGE_PORT, PREVIEW_DETECT_PROMPT, PROTOCOL_VERSION, PUBLIC_TO_INTERNAL, type PendingReviewHunkEvent, type PendingReviewHunkLine, type PrCheck, type PrRef, type PrReviewEntry, type PrReviewVerdict, type PreviewDetection, type PreviewErrorStage, type PreviewState, type PreviewStatus, type PullRequestDetail, type PullRequestSummary, type RemoteCommand, SKILL_REGISTRY, SSE_SOCKET_TIMEOUT_MS, type SelectPrompt, type SkillDefinition, type SkillDelivery, type SkillFileDelivery, type SkillId, type SkillRail, type SkillsManifest, type SkillsManifestEntry, type StreamingChunkEvent, type StreamingChunkKind, TERMINAL_AGENT_PREFIX, UNKNOWN_MODEL_PRICING, UPCOMING_INTEGRATION_IDS, USER_EVENTS, type UserEventName, getAgent, getContextWindow, getEnabledAgents, getEnabledIntegrations, getIntegration, getIntegrationBranding, getIntegrationsByCategory, getPricing, getSkillDefinition, headroomKindFor, headroomModelPredownloadScript, headroomPipPackage, headroomSnapshotDownloadLine, internalToPublic, isHeadroomWrappable, isKnownAgentId, isKnownIntegrationId, isKnownModel, isLinkedAgentId, isSkillId, normalizeAgentId, publicToInternal, renderToLines, resolveApiBaseUrl, skillHasRail, toRemoteCommand, tryGetContextWindow };

package/dist/index.d.ts

@@ -351,12 +351,36 @@ declare function isHeadroomWrappable(agentId: string): boolean;
  * ubiquitous CLI for the tool → `cliEnv`; otherwise → `mcp`. A tool may
  * declare both.
  */
-type IntegrationId = 'jira' | 'sentry' | 'linear' | 'slack' | 'notion' | 'azure_devops' | 'figma' | 'microsoft_teams' | 'google_chat' | 'discord';
-type IntegrationAuthKind = 'oauth_redirect' | 'oauth_device' | 'api_key';
+type IntegrationId = 'jira' | 'sentry' | 'linear' | 'slack' | 'notion' | 'azure_devops' | 'figma' | 'microsoft_teams' | 'google_chat' | 'discord' | 'github_issues' | 'github';
+/**
+ * `derived` = no link flow of its own: the credential is BORROWED live from a
+ * connection the user already made elsewhere (see `derivedFrom`). The backend
+ * resolves it per call instead of vaulting a copy, so it can never go stale and
+ * there is exactly one source of truth. Such an integration is "linked" iff its
+ * source connection exists, and has no Connect/Disconnect action of its own.
+ */
+/**
+ * `connection` = the integration IS a standing connection whose credential lives
+ * in a `ProviderToken` row rather than the integrations vault, and whose
+ * connect/disconnect flow is owned by ANOTHER module (GitHub's OAuth belongs to
+ * the codespaces rail). It renders and acts like any other connector — the only
+ * difference is which code performs the link.
+ *
+ * Contrast `derived`, which BORROWS such a connection and owns no actions at
+ * all. Both resolve their credential from the same place; only `derived` has no
+ * link flow of its own.
+ */
+type IntegrationAuthKind = 'oauth_redirect' | 'oauth_device' | 'api_key' | 'derived' | 'connection';
+/**
+ * A standing connection whose credential lives in a `ProviderToken` row — either
+ * because the integration IS that connection (`kind: 'connection'`) or because
+ * it borrows it (`kind: 'derived'`). Its own id doubles as the source name.
+ */
+type DerivedCredentialSource = 'github';
 /** Grouping used by category-driven surfaces (Start-from-Work-Item picker,
  *  catalog sections). A future tracker integration joins those features with
  *  ZERO feature code — they resolve sources from the registry by category. */
-type IntegrationCategory = 'tracker' | 'design' | 'comms' | 'docs' | 'observability';
+type IntegrationCategory = 'version_control' | 'tracker' | 'design' | 'comms' | 'docs' | 'observability';
 /**
  * One user-entered field for an `api_key` integration (no browser OAuth — the
  * user pastes credentials directly, e.g. a PAT + an org URL). The mobile form
@@ -402,6 +426,15 @@ interface IntegrationDefinition {
         scopes?: string[];
         /** For `kind: 'api_key'` — the credential fields the user pastes (no OAuth). */
         fields?: IntegrationApiKeyField[];
+        /** For `kind: 'derived'` — the connection whose credential this borrows.
+         *  Drives both the backend's credential resolution and the client's
+         *  "no connect action, managed by <source>" rendering. */
+        derivedFrom?: DerivedCredentialSource;
+        /** For `kind: 'connection'` — the connection this integration IS. Same
+         *  credential lookup as `derivedFrom`, but this one owns its link flow
+         *  (performed by the module that owns the connection, not by the generic
+         *  integrations OAuth path). */
+        connection?: DerivedCredentialSource;
     };
     delivery: IntegrationDelivery;
 }
@@ -1489,4 +1522,4 @@ type UserEventName = (typeof USER_EVENTS)[keyof typeof USER_EVENTS];
  */
 declare const PREVIEW_DETECT_PROMPT: string;
 
-export { AGENT_REGISTRY, type AgentAuth, type AgentAuthKind, type AgentId, type AgentMetadata, type AgentMode, type AgentModel, type AgentReviewFinding, type AgentReviewPlan, type AgentReviewReport, type AnswerResolvedEvent, type AwaitingAnswerEvent, type BeadsActionCommand, type BeadsActionKind, type BeadsActionPayload, type BeadsActionRequest, type BeadsActionType, type BeadsConfigureAction, type BeadsDependencyDto, type BeadsDependencyKind, type BeadsIngestPayload, type BeadsIssueDto, type BeadsIssueStatus, type BeadsMemoryDto, type BeadsProjectDto, type BeadsProvisioningPayload, type BeadsProvisioningStatus, type BeadsSnapshotDto, type BeadsStatus, type BeadsStatusState, type BeadsStatusSummary, type BlameLineWire, type BrokeredIntegrationToken, type ChromeStep, type ChromeToolType, type CommitEntryWire, DEFAULT_API_BASE_URL, DEV_API_BASE_URL, type EnvVar, type FileBlameEvent, type FileChangeStatus, type FileChangedEvent, type FileHistoryEvent, type FileReviewStatus, HEADROOM_BACKEND_ENV, HEADROOM_EXTRAS_BY_SURFACE, HEADROOM_MODELS, HEADROOM_PIP_COMPANIONS, HEADROOM_PROXY_PORT, HEARTBEAT_INTERVAL_MS_DEFAULT, HOUSE_AGENT_ID, HOUSE_AGENT_NAME, HOUSE_AGENT_PROVIDER, HOUSE_AGENT_SUBTITLE, HOUSE_AGENT_VENDOR, type HeadroomBudgetCommand, type HeadroomBudgetPeriod, type HeadroomBudgetUsage, type HeadroomKind, type HeadroomModelSpec, type HeadroomPythonRenderOpts, type HeadroomStatus, type HeadroomStep, type HeadroomSurface, type HunkLineType, INTEGRATION_BRANDING, INTEGRATION_REGISTRY, INTERNAL_TO_PUBLIC, type InputSuggestionChunk, type IntegrationApiKeyField, type IntegrationAuthKind, type IntegrationBranding, type IntegrationCategory, type IntegrationDefinition, type IntegrationDelivery, type IntegrationHealth, type IntegrationId, type IntegrationMcpDelivery, type IntegrationStatus, type IntegrationsManifest, type IntegrationsManifestEntry, LINKED_AGENT_IDS, type LinkedAgentId, MODEL_CONTEXT_WINDOW, MODEL_PRICING, type ModelPricing, type NormalizedMessage, OBSERVER_BRIDGE_PORT, PREVIEW_DETECT_PROMPT, PROTOCOL_VERSION, PUBLIC_TO_INTERNAL, type PendingReviewHunkEvent, type PendingReviewHunkLine, type PrCheck, type PrRef, type PrReviewEntry, type PrReviewVerdict, type PreviewDetection, type PreviewErrorStage, type PreviewState, type PreviewStatus, type PullRequestDetail, type PullRequestSummary, type RemoteCommand, SKILL_REGISTRY, SSE_SOCKET_TIMEOUT_MS, type SelectPrompt, type SkillDefinition, type SkillDelivery, type SkillFileDelivery, type SkillId, type SkillRail, type SkillsManifest, type SkillsManifestEntry, type StreamingChunkEvent, type StreamingChunkKind, TERMINAL_AGENT_PREFIX, UNKNOWN_MODEL_PRICING, UPCOMING_INTEGRATION_IDS, USER_EVENTS, type UserEventName, getAgent, getContextWindow, getEnabledAgents, getEnabledIntegrations, getIntegration, getIntegrationBranding, getIntegrationsByCategory, getPricing, getSkillDefinition, headroomKindFor, headroomModelPredownloadScript, headroomPipPackage, headroomSnapshotDownloadLine, internalToPublic, isHeadroomWrappable, isKnownAgentId, isKnownIntegrationId, isKnownModel, isLinkedAgentId, isSkillId, normalizeAgentId, publicToInternal, renderToLines, resolveApiBaseUrl, skillHasRail, toRemoteCommand, tryGetContextWindow };
+export { AGENT_REGISTRY, type AgentAuth, type AgentAuthKind, type AgentId, type AgentMetadata, type AgentMode, type AgentModel, type AgentReviewFinding, type AgentReviewPlan, type AgentReviewReport, type AnswerResolvedEvent, type AwaitingAnswerEvent, type BeadsActionCommand, type BeadsActionKind, type BeadsActionPayload, type BeadsActionRequest, type BeadsActionType, type BeadsConfigureAction, type BeadsDependencyDto, type BeadsDependencyKind, type BeadsIngestPayload, type BeadsIssueDto, type BeadsIssueStatus, type BeadsMemoryDto, type BeadsProjectDto, type BeadsProvisioningPayload, type BeadsProvisioningStatus, type BeadsSnapshotDto, type BeadsStatus, type BeadsStatusState, type BeadsStatusSummary, type BlameLineWire, type BrokeredIntegrationToken, type ChromeStep, type ChromeToolType, type CommitEntryWire, DEFAULT_API_BASE_URL, DEV_API_BASE_URL, type DerivedCredentialSource, type EnvVar, type FileBlameEvent, type FileChangeStatus, type FileChangedEvent, type FileHistoryEvent, type FileReviewStatus, HEADROOM_BACKEND_ENV, HEADROOM_EXTRAS_BY_SURFACE, HEADROOM_MODELS, HEADROOM_PIP_COMPANIONS, HEADROOM_PROXY_PORT, HEARTBEAT_INTERVAL_MS_DEFAULT, HOUSE_AGENT_ID, HOUSE_AGENT_NAME, HOUSE_AGENT_PROVIDER, HOUSE_AGENT_SUBTITLE, HOUSE_AGENT_VENDOR, type HeadroomBudgetCommand, type HeadroomBudgetPeriod, type HeadroomBudgetUsage, type HeadroomKind, type HeadroomModelSpec, type HeadroomPythonRenderOpts, type HeadroomStatus, type HeadroomStep, type HeadroomSurface, type HunkLineType, INTEGRATION_BRANDING, INTEGRATION_REGISTRY, INTERNAL_TO_PUBLIC, type InputSuggestionChunk, type IntegrationApiKeyField, type IntegrationAuthKind, type IntegrationBranding, type IntegrationCategory, type IntegrationDefinition, type IntegrationDelivery, type IntegrationHealth, type IntegrationId, type IntegrationMcpDelivery, type IntegrationStatus, type IntegrationsManifest, type IntegrationsManifestEntry, LINKED_AGENT_IDS, type LinkedAgentId, MODEL_CONTEXT_WINDOW, MODEL_PRICING, type ModelPricing, type NormalizedMessage, OBSERVER_BRIDGE_PORT, PREVIEW_DETECT_PROMPT, PROTOCOL_VERSION, PUBLIC_TO_INTERNAL, type PendingReviewHunkEvent, type PendingReviewHunkLine, type PrCheck, type PrRef, type PrReviewEntry, type PrReviewVerdict, type PreviewDetection, type PreviewErrorStage, type PreviewState, type PreviewStatus, type PullRequestDetail, type PullRequestSummary, type RemoteCommand, SKILL_REGISTRY, SSE_SOCKET_TIMEOUT_MS, type SelectPrompt, type SkillDefinition, type SkillDelivery, type SkillFileDelivery, type SkillId, type SkillRail, type SkillsManifest, type SkillsManifestEntry, type StreamingChunkEvent, type StreamingChunkKind, TERMINAL_AGENT_PREFIX, UNKNOWN_MODEL_PRICING, UPCOMING_INTEGRATION_IDS, USER_EVENTS, type UserEventName, getAgent, getContextWindow, getEnabledAgents, getEnabledIntegrations, getIntegration, getIntegrationBranding, getIntegrationsByCategory, getPricing, getSkillDefinition, headroomKindFor, headroomModelPredownloadScript, headroomPipPackage, headroomSnapshotDownloadLine, internalToPublic, isHeadroomWrappable, isKnownAgentId, isKnownIntegrationId, isKnownModel, isLinkedAgentId, isSkillId, normalizeAgentId, publicToInternal, renderToLines, resolveApiBaseUrl, skillHasRail, toRemoteCommand, tryGetContextWindow };

package/dist/index.js

@@ -672,6 +672,54 @@ var INTEGRATION_REGISTRY = {
       }
     }
   },
+  github: {
+    id: "github",
+    name: "GitHub",
+    icon: "github",
+    category: "version_control",
+    // LIVE. GitHub is the product's code substrate (codespaces + the PR
+    // Command Center), and it was historically the ONE connection outside this
+    // registry: its credential lives in a `ProviderToken` row rather than the
+    // integrations vault, so it was rendered by a hand-written special-case row
+    // and could not legally appear in a deploy's `integrationIds` (the manifest
+    // resolver rejects unknown ids — a recurring bug class).
+    //
+    // `kind: 'connection'` closes that gap without re-plumbing OAuth: the entry
+    // makes GitHub a first-class, categorised catalog row whose credential the
+    // backend resolves from the SAME `ProviderToken` it always used, while the
+    // connect/disconnect flow stays owned by the codespaces rail (the clients
+    // route those two actions there). ⚠️ It is a REAL connection with a REAL
+    // disconnect — do NOT treat it like `github_issues`, which merely derives
+    // from it and has no actions of its own.
+    enabled: true,
+    auth: { kind: "connection", connection: "github" },
+    // No MCP: a deployed box already has an authenticated `gh` on PATH.
+    delivery: {}
+  },
+  github_issues: {
+    id: "github_issues",
+    name: "GitHub Issues",
+    icon: "github_issues",
+    category: "tracker",
+    // LIVE, and the ONLY integration with NO link flow of its own: the
+    // credential is DERIVED from the GitHub connection the user already made
+    // for codespaces/PRs (`ProviderToken` provider='github-codespaces', which
+    // carries `repo` scope — enough for the whole Issues surface). So there is
+    // no OAuth app, no client id/secret, no Secret Manager entry and nothing
+    // to configuration-gate. The backend auto-provisions the catalog row the
+    // same way `ensureHouseAgentRow` does for the house agent, and resolves
+    // the token live per call rather than vaulting a copy (it can't go stale,
+    // and GitHub token refresh stays owned by exactly one place).
+    enabled: true,
+    auth: { kind: "derived", derivedFrom: "github" },
+    // NO MCP server on purpose. Every other tracker needs one to give the agent
+    // tools, but a deployed box ALREADY has an authenticated `gh` on PATH (the
+    // codespace bootstrap exports GH_TOKEN), so `gh issue list/create/comment`
+    // works with zero delivery. That also means nothing to pre-warm and no
+    // third-party MCP package to pin and keep alive. The Start-from-Work-Item
+    // side is served backend-side by the `TrackerProvider`, not by delivery.
+    delivery: {}
+  },
   slack: {
     id: "slack",
     name: "Slack",
@@ -908,10 +956,10 @@ function getIntegrationsByCategory(category) {
 
 // src/integrations/branding.ts
 var INTEGRATION_BRANDING = {
-  // GitHub — a brand-only entry (NOT an `IntegrationId`; v1 reuses the
-  // codespaces OAuth token rather than exposing GitHub as a linkable toolkit).
-  // Present so the PR/MR Command Center surfaces (the review-launch toast, etc.)
-  // render the official GitHub mark from the ONE shared catalog.
+  // GitHub — now a REAL `IntegrationId` (`version_control`, `kind: 'connection'`).
+  // It started life here as a brand-only entry, back when GitHub was rendered by
+  // a hand-written special-case row; the mark is unchanged, it's just also the
+  // catalog row's logo now. Still used by the PR/MR Command Center surfaces.
   github: {
     id: "github",
     name: "GitHub",
@@ -920,6 +968,18 @@ var INTEGRATION_BRANDING = {
     brandColor: "#FFFFFF",
     logoSvg: '<svg role="img" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><title>GitHub</title><path fill="#FFFFFF" d="M12 .297c-6.63 0-12 5.373-12 12 0 5.303 3.438 9.8 8.205 11.385.6.113.82-.258.82-.577 0-.285-.01-1.04-.015-2.04-3.338.724-4.042-1.61-4.042-1.61C4.422 18.07 3.633 17.7 3.633 17.7c-1.087-.744.084-.729.084-.729 1.205.084 1.838 1.236 1.838 1.236 1.07 1.835 2.809 1.305 3.495.998.108-.776.417-1.305.76-1.605-2.665-.3-5.466-1.332-5.466-5.93 0-1.31.465-2.38 1.235-3.22-.135-.303-.54-1.523.105-3.176 0 0 1.005-.322 3.3 1.23.96-.267 1.98-.399 3-.405 1.02.006 2.04.138 3 .405 2.28-1.552 3.285-1.23 3.285-1.23.645 1.653.24 2.873.12 3.176.765.84 1.23 1.91 1.23 3.22 0 4.61-2.805 5.625-5.475 5.92.42.36.81 1.096.81 2.22 0 1.606-.015 2.896-.015 3.286 0 .315.21.69.825.57C20.565 22.092 24 17.592 24 12.297c0-6.627-5.373-12-12-12"/></svg>'
   },
+  // GitHub Issues — the `tracker`-category toolkit integration (a real
+  // `IntegrationId`, unlike the `github` entry above). Same official mark, its
+  // own name/tagline so the catalog row reads as the issue tracker rather than
+  // the code host.
+  github_issues: {
+    id: "github_issues",
+    name: "GitHub Issues",
+    vendor: "GitHub",
+    tagline: "Issues & project tracking",
+    brandColor: "#FFFFFF",
+    logoSvg: '<svg role="img" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><title>GitHub</title><path fill="#FFFFFF" d="M12 .297c-6.63 0-12 5.373-12 12 0 5.303 3.438 9.8 8.205 11.385.6.113.82-.258.82-.577 0-.285-.01-1.04-.015-2.04-3.338.724-4.042-1.61-4.042-1.61C4.422 18.07 3.633 17.7 3.633 17.7c-1.087-.744.084-.729.084-.729 1.205.084 1.838 1.236 1.838 1.236 1.07 1.835 2.809 1.305 3.495.998.108-.776.417-1.305.76-1.605-2.665-.3-5.466-1.332-5.466-5.93 0-1.31.465-2.38 1.235-3.22-.135-.303-.54-1.523.105-3.176 0 0 1.005-.322 3.3 1.23.96-.267 1.98-.399 3-.405 1.02.006 2.04.138 3 .405 2.28-1.552 3.285-1.23 3.285-1.23.645 1.653.24 2.873.12 3.176.765.84 1.23 1.91 1.23 3.22 0 4.61-2.805 5.625-5.475 5.92.42.36.81 1.096.81 2.22 0 1.606-.015 2.896-.015 3.286 0 .315.21.69.825.57C20.565 22.092 24 17.592 24 12.297c0-6.627-5.373-12-12-12"/></svg>'
+  },
   // npm — a brand-only entry (NOT an `IntegrationId`): the registry the
   // codeam-cli ships to. Present so surfaces like the Wiki can render the
   // official npm mark from the ONE shared catalog instead of a loose asset.