@ekanos/cli 0.13.0 → 0.14.0

package/dist/commands/team-agents.js.map

@@ -1 +1 @@
-{"version":3,"file":"team-agents.js","sourceRoot":"","sources":["../../src/commands/team-agents.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAEzE,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvC,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,EAAE,WAAW,EAAkB,MAAM,SAAS,CAAC;AAEtD;;;;;;;;GAQG;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,CAAU,CAAC;AAGhF,MAAM,UAAU,eAAe,CAC7B,KAAyB;IAEzB,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;AACzD,CAAC;AAeD,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,GAAe,EACf,IAAe;IAEf,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC;IACnD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,UAAU,CACd,uBAAuB,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,EAAE,IAAI,EACrC,4BAA4B,CAC7B,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,UAAU,CAAC,SAAS,IAAI,sBAAsB,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,GAAG,GAAG,sBAAsB,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE;QAC3D,UAAU,EAAE,IAAI,CAAC,GAAG;KACrB,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CACxC,GAAG,EACH,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,EACnC,IAAI,CACL,CAAC;IACF,MAAM,GAAG,GAAiB;QACxB,IAAI;QACJ,MAAM,EAAE,IAAI,WAAW,CAAC,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC;QAC9C,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,IAAI;QACJ,QAAQ;KACT,CAAC;IAEF,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,QAAQ;YACX,OAAO,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACrC,KAAK,UAAU;YACb,OAAO,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACnC,KAAK,OAAO;YACV,OAAO,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAChC,KAAK,KAAK;YACR,OAAO,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAChC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,IAAmB;IAC1C,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,QAAQ;YACX,OAAO,+QAA+Q,CAAC;QACzR,KAAK,UAAU;YACb,OAAO,8IAA8I,CAAC;QACxJ,KAAK,OAAO;YACV,OAAO,qKAAqK,CAAC;QAC/K,KAAK,KAAK;YACR,OAAO,mQAAmQ,CAAC;IAC/Q,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,cAAc,CAC5B,KAAyB,EACzB,IAAY,EACZ,IAAmB;IAEnB,MAAM,IAAI,GAAG,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,IAAI,GAAG,WAAW,EAAE,CAAC;IACzC,IAAI,IAAI,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3D,MAAM,UAAU,CACd,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,IAAI,GAAG,CAAC,CAAC,CAAC,YAAY,IAAI,GAAG,EAC5D,QAAQ,CAAC,IAAI,CAAC,CACf,CAAC;AACJ,CAAC","sourcesContent":["import { requireSession, resolveAuthEnvironment } from '../auth/session';\nimport type { CliContext } from '../context';\nimport { usageError } from '../errors';\nimport type { ExitCode } from '../exit-codes';\nimport { resolveSourceTarget } from '../source-target';\nimport { runTeamAgentsArea } from './team-agents-agents';\nimport { runTeamMcp } from './team-agents-mcp';\nimport { runTeamLinks, runTeamTriggers } from './team-agents-triggers';\nimport { TeamsClient, type TeamsArgs } from './teams';\n\n/**\n * `ekanos teams agents|triggers|links|mcp …` — a Source admin setting up a\n * team's agents from the terminal, acting on that team through the partner\n * API (`/api/partner/teams/<team>/agents/*`, `/mcp/*`). Every write goes\n * through the same checks the app's agent pages make and leaves an Admin\n * Audit row naming the person.\n *\n * The shape is always `teams <area> <verb> <team> [<agent-key> …]`.\n */\n\nexport const TEAM_AGENT_AREAS = ['agents', 'triggers', 'links', 'mcp'] as const;\nexport type TeamAgentArea = (typeof TEAM_AGENT_AREAS)[number];\n\nexport function isTeamAgentArea(\n  value: string | undefined,\n): value is TeamAgentArea {\n  return TEAM_AGENT_AREAS.some((area) => area === value);\n}\n\n/** What every area handler gets: an authorized client and its operands. */\nexport interface TeamAgentRun {\n  args: TeamsArgs;\n  client: TeamsClient;\n  host: string;\n  /** The Source slug, for `?source=`. */\n  source: string;\n  /** The verb. */\n  verb: string;\n  /** Everything after the verb: `<team> [<key> …]`. */\n  operands: readonly string[];\n}\n\nexport async function runTeamAgentCommands(\n  ctx: CliContext,\n  args: TeamsArgs,\n): Promise<ExitCode> {\n  const [area, verb, ...operands] = args.positionals;\n  if (!isTeamAgentArea(area)) {\n    throw usageError(\n      `Unknown teams area \"${area ?? ''}\".`,\n      'See \"ekanos teams --help\".',\n    );\n  }\n  if (!verb) {\n    throw usageError(`teams ${area} needs a subcommand.`, usageFor(area));\n  }\n\n  const env = resolveAuthEnvironment(ctx, args.host, args.env, {\n    projectDir: args.dir,\n  });\n  const resolved = await resolveSourceTarget(\n    env,\n    requireSession(env.store, env.host),\n    args,\n  );\n  const run: TeamAgentRun = {\n    args,\n    client: new TeamsClient(env, resolved.session),\n    host: env.host,\n    source: resolved.source,\n    verb,\n    operands,\n  };\n\n  switch (area) {\n    case 'agents':\n      return runTeamAgentsArea(ctx, run);\n    case 'triggers':\n      return runTeamTriggers(ctx, run);\n    case 'links':\n      return runTeamLinks(ctx, run);\n    case 'mcp':\n      return runTeamMcp(ctx, run);\n  }\n}\n\nexport function usageFor(area: TeamAgentArea): string {\n  switch (area) {\n    case 'agents':\n      return 'Run one of: ekanos teams agents list <team> | enable <team> <key> [--as <member-email>] | disable <team> <key> | pin <team> <key> <version> | unpin <team> <key> | policy <team> <key> [set <tool> auto|approve | unset <tool> | --reads auto|approve --writes auto|approve].';\n    case 'triggers':\n      return 'Run one of: ekanos teams triggers list <team> <key> | add <team> <key> <manual|schedule|webhook|event> … | remove <team> <key> <trigger-id>.';\n    case 'links':\n      return 'Run one of: ekanos teams links list <team> <key> | add <team> <from-key> <to-key> --kind talk|delegate [--mode await|handoff] | remove <team> <from-key> <link-id>.';\n    case 'mcp':\n      return 'Run one of: ekanos teams mcp list <team> | add <team> <server-key> --url <url> [--auth none|token|oauth] [--name <name>] | status <team> <server-key> | token <team> <server-key> (hidden input at your terminal) | effect <team> <server-key> <tool> read|write.';\n  }\n}\n\n/** A slug operand (team, agent key, server key), or a usage error naming it. */\nexport function requireOperand(\n  value: string | undefined,\n  what: string,\n  area: TeamAgentArea,\n): string {\n  const slug = value?.trim().toLowerCase();\n  if (slug && /^[a-z0-9][a-z0-9-]*$/.test(slug)) return slug;\n  throw usageError(\n    value ? `\"${value}\" is not a ${what}.` : `Name the ${what}.`,\n    usageFor(area),\n  );\n}\n"]}
+{"version":3,"file":"team-agents.js","sourceRoot":"","sources":["../../src/commands/team-agents.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAEzE,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvC,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,EAAE,WAAW,EAAkB,MAAM,SAAS,CAAC;AAEtD;;;;;;;;;;GAUG;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,CAAU,CAAC;AAGhF,MAAM,UAAU,eAAe,CAC7B,KAAyB;IAEzB,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;AACzD,CAAC;AAeD,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,GAAe,EACf,IAAe;;IAEf,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC;IACrD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,UAAU,CACd,uBAAuB,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,EAAE,IAAI,EACrC,4BAA4B,CAC7B,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,UAAU,CAAC,SAAS,IAAI,sBAAsB,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,QAAQ,GAAG,YAAY,CAAC,UAAU,EAAE,MAAA,IAAI,CAAC,KAAK,0CAAE,IAAI,CAAC,CAAC;IAE5D,MAAM,GAAG,GAAG,sBAAsB,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE;QAC3D,UAAU,EAAE,IAAI,CAAC,GAAG;KACrB,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,cAAc,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;IAC3E,MAAM,GAAG,GAAiB;QACxB,IAAI;QACJ,MAAM,EAAE,IAAI,WAAW,CAAC,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC;QAC9C,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,IAAI;QACJ,QAAQ;KACT,CAAC;IAEF,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,QAAQ;YACX,OAAO,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACrC,KAAK,UAAU;YACb,OAAO,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACnC,KAAK,OAAO;YACV,OAAO,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAChC,KAAK,KAAK;YACR,OAAO,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAChC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,IAAmB;IAC1C,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,QAAQ;YACX,OAAO,sbAAsb,CAAC;QAChc,KAAK,UAAU;YACb,OAAO,oNAAoN,CAAC;QAC9N,KAAK,OAAO;YACV,OAAO,gPAAgP,CAAC;QAC1P,KAAK,KAAK;YACR,OAAO,sSAAsS,CAAC;IAClT,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CACnB,QAA2B,EAC3B,IAA6C;;IAE7C,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACxC,MAAM,IAAI,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,UAAU,CAAC,2BAA2B,EAAE,oBAAoB,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,CAAA,MAAA,QAAQ,CAAC,CAAC,CAAC,0CAAE,IAAI,GAAG,WAAW,EAAE,MAAK,IAAI;QAC/C,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,QAAQ,CAAC,CAAC;AAC1B,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,cAAc,CAC5B,KAAyB,EACzB,IAAY,EACZ,IAAmB;IAEnB,MAAM,IAAI,GAAG,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,IAAI,GAAG,WAAW,EAAE,CAAC;IACzC,IAAI,IAAI,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3D,MAAM,UAAU,CACd,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,IAAI,GAAG,CAAC,CAAC,CAAC,YAAY,IAAI,GAAG,EAC5D,QAAQ,CAAC,IAAI,CAAC,CACf,CAAC;AACJ,CAAC","sourcesContent":["import { requireSession, resolveAuthEnvironment } from '../auth/session';\nimport type { CliContext } from '../context';\nimport { usageError } from '../errors';\nimport type { ExitCode } from '../exit-codes';\nimport { resolveSourceTarget } from '../source-target';\nimport { runTeamAgentsArea } from './team-agents-agents';\nimport { runTeamMcp } from './team-agents-mcp';\nimport { runTeamLinks, runTeamTriggers } from './team-agents-triggers';\nimport { TeamsClient, type TeamsArgs } from './teams';\n\n/**\n * `ekanos teams agents|triggers|links|mcp …` — a Source admin setting up a\n * team's agents from the terminal, acting on that team through the partner\n * API (`/api/partner/teams/<team>/agents/*`, `/mcp/*`). Every write goes\n * through the same checks the app's agent pages make and leaves an Admin\n * Audit row naming the person.\n *\n * The shape is always `teams <area> <verb> <team> [<agent-key> …]`; the\n * team may also be named with `--team <slug>`, as `runs`, `approvals`,\n * `skills` and `knowledge` name it.\n */\n\nexport const TEAM_AGENT_AREAS = ['agents', 'triggers', 'links', 'mcp'] as const;\nexport type TeamAgentArea = (typeof TEAM_AGENT_AREAS)[number];\n\nexport function isTeamAgentArea(\n  value: string | undefined,\n): value is TeamAgentArea {\n  return TEAM_AGENT_AREAS.some((area) => area === value);\n}\n\n/** What every area handler gets: an authorized client and its operands. */\nexport interface TeamAgentRun {\n  args: TeamsArgs;\n  client: TeamsClient;\n  host: string;\n  /** The Source slug, for `?source=`. */\n  source: string;\n  /** The verb. */\n  verb: string;\n  /** Everything after the verb: `<team> [<key> …]`. */\n  operands: readonly string[];\n}\n\nexport async function runTeamAgentCommands(\n  ctx: CliContext,\n  args: TeamsArgs,\n): Promise<ExitCode> {\n  const [area, verb, ...positional] = args.positionals;\n  if (!isTeamAgentArea(area)) {\n    throw usageError(\n      `Unknown teams area \"${area ?? ''}\".`,\n      'See \"ekanos teams --help\".',\n    );\n  }\n  if (!verb) {\n    throw usageError(`teams ${area} needs a subcommand.`, usageFor(area));\n  }\n  const operands = withTeamFlag(positional, args.flags?.team);\n\n  const env = resolveAuthEnvironment(ctx, args.host, args.env, {\n    projectDir: args.dir,\n  });\n  const resolved = await resolveSourceTarget(env, requireSession(env), args);\n  const run: TeamAgentRun = {\n    args,\n    client: new TeamsClient(env, resolved.session),\n    host: env.host,\n    source: resolved.source,\n    verb,\n    operands,\n  };\n\n  switch (area) {\n    case 'agents':\n      return runTeamAgentsArea(ctx, run);\n    case 'triggers':\n      return runTeamTriggers(ctx, run);\n    case 'links':\n      return runTeamLinks(ctx, run);\n    case 'mcp':\n      return runTeamMcp(ctx, run);\n  }\n}\n\nexport function usageFor(area: TeamAgentArea): string {\n  switch (area) {\n    case 'agents':\n      return 'Run one of: ekanos teams agents list <team> | show <team> <key> | enable <team> <key> [--as <member-email>] [--draft] [--confirm-access] | confirm <team> <key> | disable <team> <key> --yes | pin <team> <key> <version> | pin <team> <key> --draft | unpin <team> <key> | policy <team> <key> [set <tool> auto|approve | unset <tool> | --reads auto|approve --writes auto|approve] [--confirm-access] | skills <team> <key> [add|remove <skill>].';\n    case 'triggers':\n      return 'Run one of: ekanos teams triggers list <team> <key> | add <team> <key> <manual|schedule|webhook|event|slack|linear> … | remove <team> <key> <trigger-id|key> --yes | rotate <team> <key> <trigger-key|id> [--yes].';\n    case 'links':\n      return 'Run one of: ekanos teams links list <team> <key> | add <team> <from-key> <to-key> --kind talk|delegate [--mode await|handoff] | remove <team> <from-key> <link-id|to-key> [--kind talk|delegate] --yes. The team may be --team <slug> instead.';\n    case 'mcp':\n      return 'Run one of: ekanos teams mcp list <team> | add <team> <server-key> --url <url> [--auth none|token|oauth] [--name <name>] | status <team> <server-key> | token <team> <server-key> (hidden input at your terminal) | effect <team> <server-key> <tool> read|write | remove <team> <server-key> --yes.';\n  }\n}\n\n/**\n * `--team <slug>` in place of the leading team operand. Given both, they\n * must agree; given only the flag, it becomes the first operand.\n */\nfunction withTeamFlag(\n  operands: readonly string[],\n  flag: string | boolean | string[] | undefined,\n): readonly string[] {\n  if (flag === undefined) return operands;\n  const team = typeof flag === 'string' ? flag.trim().toLowerCase() : '';\n  if (!team) {\n    throw usageError('--team needs a team slug.', 'e.g. --team bank-a');\n  }\n  return operands[0]?.trim().toLowerCase() === team\n    ? operands\n    : [team, ...operands];\n}\n\n/** A slug operand (team, agent key, server key), or a usage error naming it. */\nexport function requireOperand(\n  value: string | undefined,\n  what: string,\n  area: TeamAgentArea,\n): string {\n  const slug = value?.trim().toLowerCase();\n  if (slug && /^[a-z0-9][a-z0-9-]*$/.test(slug)) return slug;\n  throw usageError(\n    value ? `\"${value}\" is not a ${what}.` : `Name the ${what}.`,\n    usageFor(area),\n  );\n}\n"]}

package/dist/commands/teams-channel-install.d.ts

@@ -0,0 +1,24 @@
+import { type TeamChannel } from '@ekanos/integration-schema';
+import type { CliContext } from '../context.js';
+import type { ExitCode } from '../exit-codes.js';
+import type { TeamsArgs, TeamsClient } from './teams.js';
+/**
+ * `teams connect <team> slack|linear-app` — install, for one team, the
+ * channel a `slack` or `linear` agent trigger answers through: Slack, or
+ * Ekanos's own Linear Agents app (not the team's own Linear app, which is
+ * `teams connect <team> linear --connection agent`).
+ *
+ * The same open-the-link-and-wait as `teams connect`'s sign-in: the host
+ * mints a one-time link for the team member who installs it (the caller when
+ * a member, else `--as`), the CLI opens it for the caller, prints it always,
+ * and polls until it is installed. Only that member, signed in to the app,
+ * can finish it.
+ */
+export declare function isTeamChannel(value: string): value is TeamChannel;
+export declare function runTeamChannelInstall(ctx: CliContext, args: TeamsArgs, client: TeamsClient, host: string, source: string, input: {
+    team: string;
+    channel: TeamChannel;
+    as?: string;
+    /** Opens the link in the caller's browser (`teams connect`'s opener). */
+    open: (url: string) => void;
+}): Promise<ExitCode>;

package/dist/commands/teams-channel-install.js

@@ -0,0 +1,94 @@
+import { TeamChannelInstallStartSchema, TeamChannelInstallStatusSchema, TeamChannelSchema, } from '@ekanos/integration-schema';
+import { invalidStateError, validationError } from '../errors.js';
+import { assertBrowserSafeUrl } from '../open-url.js';
+import { call } from '../teams-api.js';
+/**
+ * `teams connect <team> slack|linear-app` — install, for one team, the
+ * channel a `slack` or `linear` agent trigger answers through: Slack, or
+ * Ekanos's own Linear Agents app (not the team's own Linear app, which is
+ * `teams connect <team> linear --connection agent`).
+ *
+ * The same open-the-link-and-wait as `teams connect`'s sign-in: the host
+ * mints a one-time link for the team member who installs it (the caller when
+ * a member, else `--as`), the CLI opens it for the caller, prints it always,
+ * and polls until it is installed. Only that member, signed in to the app,
+ * can finish it.
+ */
+export function isTeamChannel(value) {
+    return TeamChannelSchema.safeParse(value).success;
+}
+export async function runTeamChannelInstall(ctx, args, client, host, source, input) {
+    var _a, _b, _c, _d;
+    const path = `/api/partner/teams/${encodeURIComponent(input.team)}/channels/${input.channel}`;
+    const read = () => client.call((token) => call(host, token, TeamChannelInstallStatusSchema, {
+        method: 'GET',
+        path,
+        source,
+    }));
+    const status = await read();
+    if (status.installed) {
+        return ctx.succeed(Object.assign({ host }, status), ctx.ui.result({
+            title: `${status.team.slug} has installed ${status.name}`,
+            rows: [['Workspace', (_a = status.workspace) !== null && _a !== void 0 ? _a : 'installed']],
+            notes: [triggerHint(status.team.slug, input.channel)],
+        }));
+    }
+    if (status.problem) {
+        throw invalidStateError(`${status.problem}.`, input.channel === 'slack'
+            ? `"ekanos sources products --source ${source}" shows whether Slack is enabled; a super-admin enables it.`
+            : 'Ekanos sets the Linear Agents app up for a host; ask Ekanos.');
+    }
+    const started = await client.call((token) => call(host, token, TeamChannelInstallStartSchema, {
+        method: 'POST',
+        path: `${path}/install`,
+        source,
+        body: input.as ? { as: input.as } : {},
+    }));
+    assertBrowserSafeUrl(started.authorizeUrl, 'install link');
+    const { member } = started;
+    const expires = started.expiresAt.replace('T', ' ').slice(0, 16);
+    const consent = input.channel === 'slack'
+        ? 'pick the Slack workspace and approve'
+        : 'approve it as an admin of the Linear workspace it goes into';
+    ctx.log(member.isCaller
+        ? [
+            `Install ${status.name} for ${status.team.slug} — sign in to the app as yourself if asked, then ${consent}:`,
+            `  ${started.authorizeUrl}`,
+            `  (one-time link, valid until ${expires} UTC)`,
+        ].join('\n')
+        : [
+            `Send this link to ${(_b = member.email) !== null && _b !== void 0 ? _b : 'the member'} — they install ${status.name} for ${status.team.slug}, signed in to the app as themselves (${consent}):`,
+            `  ${started.authorizeUrl}`,
+            `  (one-time, for them only, valid until ${expires} UTC)`,
+        ].join('\n'));
+    // Only ever the caller's own browser: the link is bound to its member.
+    if (member.isCaller && !args.noOpen && !ctx.jsonMode) {
+        input.open(started.authorizeUrl);
+    }
+    if (args.noWait || ctx.jsonMode) {
+        return ctx.succeed(Object.assign(Object.assign({ host }, started.status), { authorizeUrl: started.authorizeUrl, expiresAt: started.expiresAt, member }), ctx.ui.hint(`Then check with "ekanos teams connect ${input.team} ${input.channel}".`));
+    }
+    ctx.log('Waiting for the install to finish (Ctrl-C stops waiting; the link stays valid)…');
+    const deadline = Date.parse(started.expiresAt) || Date.now() + 10 * 60 * 1000;
+    while (Date.now() < deadline) {
+        await new Promise((resolve) => { var _a; return setTimeout(resolve, (_a = args.pollDelayMs) !== null && _a !== void 0 ? _a : 3000); });
+        const polled = await read();
+        if (polled.installed) {
+            return ctx.succeed(Object.assign({ host }, polled), ctx.ui.result({
+                title: `Installed ${polled.name} for ${polled.team.slug}`,
+                rows: [
+                    ['Workspace', (_c = polled.workspace) !== null && _c !== void 0 ? _c : 'installed'],
+                    ['Installed by', (_d = member.email) !== null && _d !== void 0 ? _d : 'the member'],
+                ],
+                notes: [triggerHint(polled.team.slug, input.channel)],
+            }));
+        }
+    }
+    throw validationError('The install did not finish before the link expired.', `Run "ekanos teams connect ${input.team} ${input.channel}${input.as ? ` --as ${input.as}` : ''}" again for a fresh link.`);
+}
+function triggerHint(team, channel) {
+    return channel === 'slack'
+        ? `Next: an agent answers there once it has a slack trigger — "ekanos teams triggers add ${team} <agent-key> slack --channel '#<channel>' --yes" (invite the bot to the channel first).`
+        : `Next: an agent answers @mentions there once it has a linear trigger — "ekanos teams triggers add ${team} <agent-key> linear".`;
+}
+//# sourceMappingURL=teams-channel-install.js.map

package/dist/commands/teams-channel-install.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"teams-channel-install.js","sourceRoot":"","sources":["../../src/commands/teams-channel-install.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,6BAA6B,EAC7B,8BAA8B,EAC9B,iBAAiB,GAClB,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAE/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAGpC;;;;;;;;;;;GAWG;AAEH,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,OAAO,iBAAiB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AACpD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,GAAe,EACf,IAAe,EACf,MAAmB,EACnB,IAAY,EACZ,MAAc,EACd,KAMC;;IAED,MAAM,IAAI,GAAG,sBAAsB,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,KAAK,CAAC,OAAO,EAAE,CAAC;IAC9F,MAAM,IAAI,GAAG,GAAG,EAAE,CAChB,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CACpB,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,8BAA8B,EAAE;QAChD,MAAM,EAAE,KAAK;QACb,IAAI;QACJ,MAAM;KACP,CAAC,CACH,CAAC;IAEJ,MAAM,MAAM,GAAG,MAAM,IAAI,EAAE,CAAC;IAC5B,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,OAAO,GAAG,CAAC,OAAO,iBACd,IAAI,IAAK,MAAM,GACjB,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC;YACZ,KAAK,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,kBAAkB,MAAM,CAAC,IAAI,EAAE;YACzD,IAAI,EAAE,CAAC,CAAC,WAAW,QAAE,MAAM,CAAC,SAAS,mCAAI,WAAW,CAAC,CAAC;YACtD,KAAK,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;SACtD,CAAC,CACH,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,MAAM,iBAAiB,CACrB,GAAG,MAAM,CAAC,OAAO,GAAG,EACpB,KAAK,CAAC,OAAO,KAAK,OAAO;YACvB,CAAC,CAAC,qCAAqC,MAAM,6DAA6D;YAC1G,CAAC,CAAC,8DAA8D,CACnE,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAC1C,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,6BAA6B,EAAE;QAC/C,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,GAAG,IAAI,UAAU;QACvB,MAAM;QACN,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE;KACvC,CAAC,CACH,CAAC;IACF,oBAAoB,CAAC,OAAO,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IAC3D,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAC3B,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjE,MAAM,OAAO,GACX,KAAK,CAAC,OAAO,KAAK,OAAO;QACvB,CAAC,CAAC,sCAAsC;QACxC,CAAC,CAAC,6DAA6D,CAAC;IACpE,GAAG,CAAC,GAAG,CACL,MAAM,CAAC,QAAQ;QACb,CAAC,CAAC;YACE,WAAW,MAAM,CAAC,IAAI,QAAQ,MAAM,CAAC,IAAI,CAAC,IAAI,oDAAoD,OAAO,GAAG;YAC5G,KAAK,OAAO,CAAC,YAAY,EAAE;YAC3B,iCAAiC,OAAO,OAAO;SAChD,CAAC,IAAI,CAAC,IAAI,CAAC;QACd,CAAC,CAAC;YACE,qBAAqB,MAAA,MAAM,CAAC,KAAK,mCAAI,YAAY,mBAAmB,MAAM,CAAC,IAAI,QAAQ,MAAM,CAAC,IAAI,CAAC,IAAI,yCAAyC,OAAO,IAAI;YAC3J,KAAK,OAAO,CAAC,YAAY,EAAE;YAC3B,2CAA2C,OAAO,OAAO;SAC1D,CAAC,IAAI,CAAC,IAAI,CAAC,CACjB,CAAC;IAEF,uEAAuE;IACvE,IAAI,MAAM,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QACrD,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QAChC,OAAO,GAAG,CAAC,OAAO,+BAEd,IAAI,IACD,OAAO,CAAC,MAAM,KACjB,YAAY,EAAE,OAAO,CAAC,YAAY,EAClC,SAAS,EAAE,OAAO,CAAC,SAAS,EAC5B,MAAM,KAER,GAAG,CAAC,EAAE,CAAC,IAAI,CACT,yCAAyC,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,IAAI,CACzE,CACF,CAAC;IACJ,CAAC;IAED,GAAG,CAAC,GAAG,CACL,iFAAiF,CAClF,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAC9E,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,kBAC5B,UAAU,CAAC,OAAO,QAAE,IAAI,CAAC,WAAW,mCAAI,IAAI,CAAC,GAAA,CAC9C,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,IAAI,EAAE,CAAC;QAC5B,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,OAAO,GAAG,CAAC,OAAO,iBACd,IAAI,IAAK,MAAM,GACjB,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC;gBACZ,KAAK,EAAE,aAAa,MAAM,CAAC,IAAI,QAAQ,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE;gBACzD,IAAI,EAAE;oBACJ,CAAC,WAAW,QAAE,MAAM,CAAC,SAAS,mCAAI,WAAW,CAAC;oBAC9C,CAAC,cAAc,QAAE,MAAM,CAAC,KAAK,mCAAI,YAAY,CAAC;iBAC/C;gBACD,KAAK,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;aACtD,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,eAAe,CACnB,qDAAqD,EACrD,6BAA6B,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,2BAA2B,CAC1H,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,OAAoB;IACrD,OAAO,OAAO,KAAK,OAAO;QACxB,CAAC,CAAC,yFAAyF,IAAI,yFAAyF;QACxL,CAAC,CAAC,oGAAoG,IAAI,uBAAuB,CAAC;AACtI,CAAC","sourcesContent":["import {\n  type TeamChannel,\n  TeamChannelInstallStartSchema,\n  TeamChannelInstallStatusSchema,\n  TeamChannelSchema,\n} from '@ekanos/integration-schema';\n\nimport type { CliContext } from '../context';\nimport { invalidStateError, validationError } from '../errors';\nimport type { ExitCode } from '../exit-codes';\nimport { assertBrowserSafeUrl } from '../open-url';\nimport { call } from '../teams-api';\nimport type { TeamsArgs, TeamsClient } from './teams';\n\n/**\n * `teams connect <team> slack|linear-app` — install, for one team, the\n * channel a `slack` or `linear` agent trigger answers through: Slack, or\n * Ekanos's own Linear Agents app (not the team's own Linear app, which is\n * `teams connect <team> linear --connection agent`).\n *\n * The same open-the-link-and-wait as `teams connect`'s sign-in: the host\n * mints a one-time link for the team member who installs it (the caller when\n * a member, else `--as`), the CLI opens it for the caller, prints it always,\n * and polls until it is installed. Only that member, signed in to the app,\n * can finish it.\n */\n\nexport function isTeamChannel(value: string): value is TeamChannel {\n  return TeamChannelSchema.safeParse(value).success;\n}\n\nexport async function runTeamChannelInstall(\n  ctx: CliContext,\n  args: TeamsArgs,\n  client: TeamsClient,\n  host: string,\n  source: string,\n  input: {\n    team: string;\n    channel: TeamChannel;\n    as?: string;\n    /** Opens the link in the caller's browser (`teams connect`'s opener). */\n    open: (url: string) => void;\n  },\n): Promise<ExitCode> {\n  const path = `/api/partner/teams/${encodeURIComponent(input.team)}/channels/${input.channel}`;\n  const read = () =>\n    client.call((token) =>\n      call(host, token, TeamChannelInstallStatusSchema, {\n        method: 'GET',\n        path,\n        source,\n      }),\n    );\n\n  const status = await read();\n  if (status.installed) {\n    return ctx.succeed(\n      { host, ...status },\n      ctx.ui.result({\n        title: `${status.team.slug} has installed ${status.name}`,\n        rows: [['Workspace', status.workspace ?? 'installed']],\n        notes: [triggerHint(status.team.slug, input.channel)],\n      }),\n    );\n  }\n  if (status.problem) {\n    throw invalidStateError(\n      `${status.problem}.`,\n      input.channel === 'slack'\n        ? `\"ekanos sources products --source ${source}\" shows whether Slack is enabled; a super-admin enables it.`\n        : 'Ekanos sets the Linear Agents app up for a host; ask Ekanos.',\n    );\n  }\n\n  const started = await client.call((token) =>\n    call(host, token, TeamChannelInstallStartSchema, {\n      method: 'POST',\n      path: `${path}/install`,\n      source,\n      body: input.as ? { as: input.as } : {},\n    }),\n  );\n  assertBrowserSafeUrl(started.authorizeUrl, 'install link');\n  const { member } = started;\n  const expires = started.expiresAt.replace('T', ' ').slice(0, 16);\n  const consent =\n    input.channel === 'slack'\n      ? 'pick the Slack workspace and approve'\n      : 'approve it as an admin of the Linear workspace it goes into';\n  ctx.log(\n    member.isCaller\n      ? [\n          `Install ${status.name} for ${status.team.slug} — sign in to the app as yourself if asked, then ${consent}:`,\n          `  ${started.authorizeUrl}`,\n          `  (one-time link, valid until ${expires} UTC)`,\n        ].join('\\n')\n      : [\n          `Send this link to ${member.email ?? 'the member'} — they install ${status.name} for ${status.team.slug}, signed in to the app as themselves (${consent}):`,\n          `  ${started.authorizeUrl}`,\n          `  (one-time, for them only, valid until ${expires} UTC)`,\n        ].join('\\n'),\n  );\n\n  // Only ever the caller's own browser: the link is bound to its member.\n  if (member.isCaller && !args.noOpen && !ctx.jsonMode) {\n    input.open(started.authorizeUrl);\n  }\n\n  if (args.noWait || ctx.jsonMode) {\n    return ctx.succeed(\n      {\n        host,\n        ...started.status,\n        authorizeUrl: started.authorizeUrl,\n        expiresAt: started.expiresAt,\n        member,\n      },\n      ctx.ui.hint(\n        `Then check with \"ekanos teams connect ${input.team} ${input.channel}\".`,\n      ),\n    );\n  }\n\n  ctx.log(\n    'Waiting for the install to finish (Ctrl-C stops waiting; the link stays valid)…',\n  );\n  const deadline = Date.parse(started.expiresAt) || Date.now() + 10 * 60 * 1000;\n  while (Date.now() < deadline) {\n    await new Promise((resolve) =>\n      setTimeout(resolve, args.pollDelayMs ?? 3000),\n    );\n    const polled = await read();\n    if (polled.installed) {\n      return ctx.succeed(\n        { host, ...polled },\n        ctx.ui.result({\n          title: `Installed ${polled.name} for ${polled.team.slug}`,\n          rows: [\n            ['Workspace', polled.workspace ?? 'installed'],\n            ['Installed by', member.email ?? 'the member'],\n          ],\n          notes: [triggerHint(polled.team.slug, input.channel)],\n        }),\n      );\n    }\n  }\n  throw validationError(\n    'The install did not finish before the link expired.',\n    `Run \"ekanos teams connect ${input.team} ${input.channel}${input.as ? ` --as ${input.as}` : ''}\" again for a fresh link.`,\n  );\n}\n\nfunction triggerHint(team: string, channel: TeamChannel): string {\n  return channel === 'slack'\n    ? `Next: an agent answers there once it has a slack trigger — \"ekanos teams triggers add ${team} <agent-key> slack --channel '#<channel>' --yes\" (invite the bot to the channel first).`\n    : `Next: an agent answers @mentions there once it has a linear trigger — \"ekanos teams triggers add ${team} <agent-key> linear\".`;\n}\n"]}

package/dist/commands/teams-connect.d.ts

@@ -1,3 +1,4 @@
+import { type TeamIntegrationStatus } from '@ekanos/integration-schema';
 import type { CliContext } from '../context.js';
 import type { ExitCode } from '../exit-codes.js';
 import { type TeamsArgs, type TeamsClient } from './teams.js';
@@ -16,10 +17,50 @@ import { type TeamsArgs, type TeamsClient } from './teams.js';
  *     team is connected (unless `--no-wait`);
  *   - a form only the browser can fill → prints the team's page.
  *
+ * `--connection <id>` connects one of the integration's named connections
+ * instead of the main one — Linear's `agent`, the team's own Linear app
+ * installed as a workspace member, which is what makes Linear send the
+ * @mention and assignment webhooks an agent's triggers listen for. It runs
+ * the same way: the team app's fields when missing, then the sign-in, then
+ * the wait until it is installed.
+ *
+ * Without `--connection`, once the main connection is made (or already
+ * was), a named connection the team's agents' triggers wait on is offered
+ * next — at a terminal it asks and installs it, otherwise it names the
+ * command. "Connected" is not the goal; an agent that can be reached is.
+ *
+ * `--reconnect` connects it again even though it reads as connected — for
+ * a revoked or expired sign-in, or new form values. An OAuth reconnect
+ * prints the link and returns: the team already reads as connected, so
+ * there is nothing to wait for.
+ *
  * `--link-only` keeps the old behaviour: the team's page and its status.
+ *
+ * `slack` and `linear-app` install the channels agent triggers answer
+ * through — Slack, and Ekanos's own Linear Agents app — by the same
+ * link-and-wait (`teams-channel-install.ts`).
  */
 export declare function runTeamConnect(ctx: CliContext, args: TeamsArgs, client: TeamsClient, host: string, source: string, input: {
     team: string;
     product: string;
     as?: string;
+    connection?: string;
 }): Promise<ExitCode>;
+/** Named connections the team's agents wait on and the team has not installed. */
+export declare function channelsToInstall(status: TeamIntegrationStatus): {
+    connectionId: string;
+    label: string;
+    teamApp: boolean;
+    credentialsSaved: boolean | null;
+    connected: boolean;
+    connectedAt: string | null;
+    connectedBy: {
+        userId: string;
+        name: string | null;
+        email: string | null;
+    } | null;
+    neededBy: {
+        agent: string;
+        triggers: string[];
+    }[];
+}[];

package/dist/commands/teams-connect.js

@@ -1,9 +1,12 @@
-import { spawn } from 'node:child_process';
+import { TeamAgentListSchema, } from '@ekanos/integration-schema';
 import { invalidStateError, usageError, validationError } from '../errors.js';
+import { assertBrowserSafeUrl, openInBrowser } from '../open-url.js';
 import { showTeamConnect, startTeamConnect, } from '../team-connect-api.js';
-import { showTeamIntegration } from '../teams-api.js';
+import { call, showTeamIntegration } from '../teams-api.js';
 import { promptHidden, promptLine } from './apps.js';
+import { scopeHiddenLines } from './scope-notice.js';
 import { canPrompt, checklist, promptAndSaveTeamApp, } from './teams.js';
+import { isTeamChannel, runTeamChannelInstall } from './teams-channel-install.js';
 /**
  * `teams connect <team> <product>` — connect a product for one team, doing
  * whichever the integration needs (the host's plan decides, never the CLI):
@@ -19,24 +22,61 @@ import { canPrompt, checklist, promptAndSaveTeamApp, } from './teams.js';
  *     team is connected (unless `--no-wait`);
  *   - a form only the browser can fill → prints the team's page.
  *
+ * `--connection <id>` connects one of the integration's named connections
+ * instead of the main one — Linear's `agent`, the team's own Linear app
+ * installed as a workspace member, which is what makes Linear send the
+ * @mention and assignment webhooks an agent's triggers listen for. It runs
+ * the same way: the team app's fields when missing, then the sign-in, then
+ * the wait until it is installed.
+ *
+ * Without `--connection`, once the main connection is made (or already
+ * was), a named connection the team's agents' triggers wait on is offered
+ * next — at a terminal it asks and installs it, otherwise it names the
+ * command. "Connected" is not the goal; an agent that can be reached is.
+ *
+ * `--reconnect` connects it again even though it reads as connected — for
+ * a revoked or expired sign-in, or new form values. An OAuth reconnect
+ * prints the link and returns: the team already reads as connected, so
+ * there is nothing to wait for.
+ *
  * `--link-only` keeps the old behaviour: the team's page and its status.
+ *
+ * `slack` and `linear-app` install the channels agent triggers answer
+ * through — Slack, and Ekanos's own Linear Agents app — by the same
+ * link-and-wait (`teams-channel-install.ts`).
  */
 export async function runTeamConnect(ctx, args, client, host, source, input) {
-    var _a, _b, _c, _d;
-    const target = { source, team: input.team, product: input.product };
+    var _a, _b, _c, _d, _e;
+    const target = Object.assign({ source, team: input.team, product: input.product }, (input.connection ? { connection: input.connection } : {}));
+    // Slack and Ekanos's Linear Agents app: the channels a `slack` or `linear`
+    // agent trigger answers through, installed by their own flows.
+    if (!input.connection && !args.linkOnly && isTeamChannel(input.product)) {
+        return runTeamChannelInstall(ctx, args, client, host, source, Object.assign(Object.assign({ team: input.team, channel: input.product }, (input.as ? { as: input.as } : {})), { open: (_a = args.openUrl) !== null && _a !== void 0 ? _a : openInBrowser }));
+    }
     if (args.linkOnly)
         return printLink(ctx, client, host, target);
     const { plan } = await client.call((token) => showTeamConnect(host, token, target, input.as));
-    const name = plan.product.name;
+    const named = isNamed(plan);
+    const name = named
+        ? await connectionLabel(client, host, target, plan)
+        : plan.product.name;
+    await warnOtherRunsAs(ctx, client, host, source, plan);
+    for (const line of scopeHiddenLines(plan.productScope, {
+        team: plan.team.slug,
+        product: plan.product.slug,
+        source: plan.source.slug,
+    })) {
+        ctx.warn(line);
+    }
     switch (plan.mode) {
         case 'not-entitled':
-            throw invalidStateError((_a = plan.reason) !== null && _a !== void 0 ? _a : `"${input.product}" is not enabled on ${plan.source.slug}.`, `A super-admin enables it for the Source first ("ekanos sources products" shows what ${plan.source.slug} has; "ekanos sources products enable ${input.product}" from a super-admin session, or /admin in the browser).`);
+            throw invalidStateError((_b = plan.reason) !== null && _b !== void 0 ? _b : `"${input.product}" is not enabled on ${plan.source.slug}.`, `Enable it for the Source first: "ekanos sources products enable ${input.product}" as a Source admin if ${plan.source.slug} built it, otherwise a super-admin (/admin in the browser). "ekanos sources products" shows what ${plan.source.slug} has.`);
         case 'not-self-serve':
-            throw invalidStateError((_b = plan.reason) !== null && _b !== void 0 ? _b : `${name} is not connected by a team.`, plan.product.kind === 'experience'
+            throw invalidStateError((_c = plan.reason) !== null && _c !== void 0 ? _c : `${name} is not connected by a team.`, plan.product.kind === 'experience'
                 ? `"ekanos sources products --source ${plan.source.slug}" shows whether it is on for the Source.`
                 : 'It is turned on for the Source by Ekanos; there is nothing for the team to do.');
         case 'unsupported':
-            throw invalidStateError((_c = plan.reason) !== null && _c !== void 0 ? _c : `${name} cannot be connected from here.`, `Open the team's page instead: ${plan.connectUrl}`);
+            throw invalidStateError((_d = plan.reason) !== null && _d !== void 0 ? _d : `${name} cannot be connected from here.`, `Open the team's page instead: ${plan.connectUrl}`);
         case 'works-as-shipped':
             return ctx.succeed({ host, plan, connected: true }, ctx.ui.result({
                 title: `${name} works as shipped for ${plan.team.slug}`,
@@ -55,29 +95,137 @@ export async function runTeamConnect(ctx, args, client, host, source, input) {
                 notes: plan.connected
                     ? []
                     : [
-                        (_d = plan.reason) !== null && _d !== void 0 ? _d : `${name} connects through its own form in the app.`,
+                        (_e = plan.reason) !== null && _e !== void 0 ? _e : `${name} connects through its own form in the app.`,
                         'A team admin signs in there and clicks Connect.',
                     ],
             }));
         default:
             break;
     }
-    if (plan.connected) {
-        return ctx.succeed({ host, plan, connected: true }, ctx.ui.result({
-            title: `${plan.team.slug} has already connected ${name}`,
+    if (plan.connected && !args.reconnect) {
+        const summary = ctx.ui.result({
+            title: `${plan.team.slug} has already ${named ? 'installed' : 'connected'} ${name}`,
             rows: [
-                ['Status', statusOf(plan)],
+                ['Status', statusOf(plan, named)],
                 ['Team page', plan.connectUrl],
             ],
             notes: [
                 `"ekanos teams show ${plan.team.slug} ${plan.product.slug}" shows the full setup.`,
+                `Broken (revoked or expired)? Connect it again: ekanos teams connect ${plan.team.slug} ${plan.product.slug}${named ? ` --connection ${plan.connectionId}` : ''} --reconnect`,
             ],
-        }));
+        });
+        return named
+            ? ctx.succeed({ host, plan, connected: true }, summary)
+            : offerChannels(ctx, args, client, host, source, input, {
+                data: { host, plan, connected: true },
+                summary,
+            });
     }
     if (plan.mode === 'fields' || plan.mode === 'no-fields') {
         return activate(ctx, args, client, host, target, plan);
     }
-    return connectOAuth(ctx, args, client, host, target, plan, input.as);
+    return connectOAuth(ctx, args, client, host, target, plan, input.as, {
+        name,
+        then: named
+            ? undefined
+            : (done) => offerChannels(ctx, args, client, host, source, input, done),
+    });
+}
+/**
+ * A personal connection belongs to whoever makes it, but a provided agent
+ * uses the personal connection of the person it runs as — so connecting
+ * your own leaves the agent missing it (CLI audit P0-5). Name each agent
+ * that runs as someone else and the command that connects it for them.
+ */
+async function warnOtherRunsAs(ctx, client, host, source, plan) {
+    var _a, _b, _c, _d;
+    const email = (_b = (_a = plan.member) === null || _a === void 0 ? void 0 : _a.email) === null || _b === void 0 ? void 0 : _b.toLowerCase();
+    if (plan.scope !== 'user' || !email)
+        return;
+    let list;
+    try {
+        list = await client.call((token) => call(host, token, TeamAgentListSchema, {
+            method: 'GET',
+            path: `/api/partner/teams/${encodeURIComponent(plan.team.slug)}/agents`,
+            source,
+        }));
+    }
+    catch (error) {
+        ctx.log(`Could not check who ${plan.team.slug}'s agents run as: ${error instanceof Error ? error.message : String(error)}`);
+        return;
+    }
+    for (const entry of list.agents) {
+        const runsAs = (_d = (_c = entry.agent) === null || _c === void 0 ? void 0 : _c.requirements.find((item) => item.key === plan.product.slug &&
+            item.via === 'person' &&
+            item.viaDetail &&
+            item.viaDetail.toLowerCase() !== email)) === null || _d === void 0 ? void 0 : _d.viaDetail;
+        if (!runsAs)
+            continue;
+        ctx.warn(`Note: ${entry.key} runs as ${runsAs} and uses ${runsAs}'s ${plan.product.name} connection, not ${email}'s. For the agent, run: npx @ekanos/cli teams connect ${plan.team.slug} ${plan.product.slug} --as ${runsAs} --source ${source}`);
+    }
+}
+/**
+ * After the main connection: the named connections the team's agents'
+ * triggers wait on and the team has not installed (Linear's agent). At a
+ * terminal, ask and install each; otherwise name the command, in the
+ * result and its JSON (`channelsToInstall`).
+ */
+async function offerChannels(ctx, args, client, host, source, input, done) {
+    var _a;
+    const status = await client.call((token) => showTeamIntegration(host, token, {
+        source,
+        team: input.team,
+        product: input.product,
+    }));
+    const waiting = channelsToInstall(status);
+    if (waiting.length === 0)
+        return ctx.succeed(done.data, done.summary);
+    const command = (connectionId) => `ekanos teams connect ${input.team} ${input.product} --connection ${connectionId} --source ${status.source.slug}`;
+    const why = (entry) => `${entry.label} is not installed for ${input.team}, and ${entry.neededBy.map((need) => `${need.agent} (${need.triggers.join(', ')})`).join(', ')} only start${entry.neededBy.length === 1 ? 's' : ''} through it.`;
+    if (!canPrompt(ctx, args)) {
+        return ctx.succeed(Object.assign(Object.assign({}, done.data), { channelsToInstall: waiting.map((entry) => ({
+                connectionId: entry.connectionId,
+                label: entry.label,
+                neededBy: entry.neededBy,
+                command: command(entry.connectionId),
+            })) }), [
+            done.summary,
+            ...waiting.flatMap((entry) => [
+                `Next: ${why(entry)}`,
+                `  Install it in your terminal: npx @ekanos/cli ${command(entry.connectionId)}`,
+            ]),
+        ].join('\n'));
+    }
+    ctx.log(done.summary);
+    let code = 0;
+    for (const entry of waiting) {
+        ctx.log(why(entry));
+        const answer = (await ((_a = args.ask) !== null && _a !== void 0 ? _a : promptLine)(`Install ${entry.label} now? [Y/n] `))
+            .trim()
+            .toLowerCase();
+        if (answer !== '' && answer !== 'y' && answer !== 'yes') {
+            ctx.log(`Skipped. Later: ${command(entry.connectionId)}`);
+            continue;
+        }
+        code = await runTeamConnect(ctx, args, client, host, source, Object.assign(Object.assign({}, input), { connection: entry.connectionId }));
+    }
+    return code;
+}
+/** Named connections the team's agents wait on and the team has not installed. */
+export function channelsToInstall(status) {
+    var _a;
+    return ((_a = status.connections) !== null && _a !== void 0 ? _a : []).filter((entry) => entry.connectionId !== 'default' &&
+        !entry.connected &&
+        entry.neededBy.length > 0);
+}
+function isNamed(plan) {
+    return Boolean(plan.connectionId && plan.connectionId !== 'default');
+}
+async function connectionLabel(client, host, target, plan) {
+    var _a, _b, _c;
+    var _d, _e;
+    const status = await client.call((token) => showTeamIntegration(host, token, target));
+    return ((_e = (_d = (_b = (_a = status.connections) === null || _a === void 0 ? void 0 : _a.find((entry) => entry.connectionId === plan.connectionId)) === null || _b === void 0 ? void 0 : _b.label) !== null && _d !== void 0 ? _d : (_c = status.teamApps.find((entry) => entry.connectionId === plan.connectionId)) === null || _c === void 0 ? void 0 : _c.label) !== null && _e !== void 0 ? _e : `${plan.product.name} (${plan.connectionId})`);
 }
 async function activate(ctx, args, client, host, target, plan) {
     var _a;
@@ -120,19 +268,23 @@ async function activate(ctx, args, client, host, target, plan) {
         ],
     }));
 }
-async function connectOAuth(ctx, args, client, host, target, plan, asEmail) {
-    var _a, _b, _c, _d, _e, _f;
+async function connectOAuth(ctx, args, client, host, target, plan, asEmail, options) {
+    var _a, _b, _c, _d, _e, _f, _g;
+    const named = isNamed(plan);
+    const name = options.name;
+    const again = `ekanos teams connect ${target.team} ${target.product}${named ? ` --connection ${plan.connectionId}` : ''}`;
     if (!plan.member) {
-        throw invalidStateError((_a = plan.memberProblem) !== null && _a !== void 0 ? _a : 'No member of the team can sign in yet.', `Name a member of ${plan.team.slug} who signs in: ekanos teams connect ${target.team} ${target.product} --as <email>`);
+        throw invalidStateError((_a = plan.memberProblem) !== null && _a !== void 0 ? _a : 'No member of the team can sign in yet.', `Name a member of ${plan.team.slug} who signs in: ${again} --as <email>`);
     }
     if (plan.teamApp) {
         const status = await client.call((token) => showTeamIntegration(host, token, target));
-        const app = (_b = status.teamApps.find((entry) => entry.connectionId === 'default')) !== null && _b !== void 0 ? _b : status.teamApps[0];
+        const connectionId = (_b = plan.connectionId) !== null && _b !== void 0 ? _b : 'default';
+        const app = (_c = status.teamApps.find((entry) => entry.connectionId === connectionId)) !== null && _c !== void 0 ? _c : (named ? undefined : status.teamApps[0]);
         if (app && app.fields.some((field) => !field.set)) {
             if (!canPrompt(ctx, args)) {
-                throw usageError(`${plan.product.name} needs ${plan.team.slug}'s own app first, entered at a terminal.`, `Run it yourself in your terminal: npx @ekanos/cli teams connect ${target.team} ${target.product} --source ${plan.source.slug}`);
+                throw usageError(`${name} needs ${plan.team.slug}'s own app first, entered at a terminal.`, `Run it yourself in your terminal: npx @ekanos/cli ${again} --source ${plan.source.slug}`);
             }
-            ctx.log(`${plan.product.name} signs ${plan.team.slug} in through the team's own app. Set it up first:`);
+            ctx.log(`${name} signs ${plan.team.slug} in through the team's own app. Set it up first:`);
             await promptAndSaveTeamApp(ctx, args, client, host, target, status, app);
         }
     }
@@ -140,33 +292,41 @@ async function connectOAuth(ctx, args, client, host, target, plan, asEmail) {
     if (started.result !== 'consent') {
         throw invalidStateError(`The host answered "${started.result}" where a sign-in link was expected.`, 'Run "ekanos upgrade" — the CLI and the host disagree on the connect contract.');
     }
-    const member = (_c = started.plan.member) !== null && _c !== void 0 ? _c : plan.member;
+    assertBrowserSafeUrl(started.authorizeUrl, 'sign-in link');
+    const member = (_d = started.plan.member) !== null && _d !== void 0 ? _d : plan.member;
     const forCaller = member.isCaller;
     const expires = started.expiresAt.replace('T', ' ').slice(0, 16);
     ctx.log(forCaller
         ? [
-            `Sign in to ${plan.product.name} as the account ${plan.team.slug} should use${plan.scope === 'user' ? ' (a personal connection: yours)' : ''}:`,
+            named
+                ? `Install ${name} for ${plan.team.slug} — sign in as an admin of the workspace it goes into, and approve it:`
+                : `Sign in to ${plan.product.name} as the account ${plan.team.slug} should use${plan.scope === 'user' ? ' (a personal connection: yours)' : ''}:`,
             `  ${started.authorizeUrl}`,
             `  (one-time link, valid until ${expires} UTC)`,
         ].join('\n')
         : [
-            `Send this link to ${(_d = member.email) !== null && _d !== void 0 ? _d : 'the member'} — they sign in to ${plan.product.name} for ${plan.team.slug}${plan.scope === 'user' ? ' (a personal connection: theirs)' : ''}:`,
+            `Send this link to ${(_e = member.email) !== null && _e !== void 0 ? _e : 'the member'} — they ${named ? `install ${name}` : `sign in to ${plan.product.name}`} for ${plan.team.slug}${plan.scope === 'user' ? ' (a personal connection: theirs)' : ''}:`,
             `  ${started.authorizeUrl}`,
             `  (one-time, for them only, valid until ${expires} UTC)`,
         ].join('\n'));
     // Only ever the caller's own browser: opening a link meant for another
     // member would sign the caller's provider account in for them.
     if (forCaller && !args.noOpen && !ctx.jsonMode) {
-        ((_e = args.openUrl) !== null && _e !== void 0 ? _e : openInBrowser)(started.authorizeUrl);
+        ((_f = args.openUrl) !== null && _f !== void 0 ? _f : openInBrowser)(started.authorizeUrl);
     }
-    if (args.noWait || ctx.jsonMode) {
+    // A reconnect can't be waited on: the team already reads as connected, so
+    // nothing the host reports changes when the new sign-in lands.
+    const reconnecting = args.reconnect === true && plan.connected;
+    if (args.noWait || ctx.jsonMode || reconnecting) {
         return ctx.succeed({
             host,
             plan: started.plan,
             authorizeUrl: started.authorizeUrl,
             expiresAt: started.expiresAt,
             connected: false,
-        }, ctx.ui.hint(`Then check with "ekanos teams show ${target.team} ${target.product}".`));
+        }, ctx.ui.hint(reconnecting
+            ? `The current connection keeps working until the sign-in finishes; then its tokens are replaced. Check with "ekanos teams show ${target.team} ${target.product}".`
+            : `Then check with "ekanos teams show ${target.team} ${target.product}".`));
     }
     ctx.log('Waiting for the sign-in to finish (Ctrl-C stops waiting; the link stays valid)…');
     const deadline = Date.parse(started.expiresAt) || Date.now() + 10 * 60 * 1000;
@@ -175,19 +335,30 @@ async function connectOAuth(ctx, args, client, host, target, plan, asEmail) {
         const polled = await client.call((token) => showTeamConnect(host, token, target, asEmail));
         if (polled.plan.connected) {
             const status = await client.call((token) => showTeamIntegration(host, token, target));
-            return ctx.succeed({ host, plan: polled.plan, status, connected: true }, [
-                ctx.ui.result({
-                    title: `Connected ${plan.product.name} for ${plan.team.slug}`,
-                    rows: [
-                        ['Signed in by', (_f = member.email) !== null && _f !== void 0 ? _f : member.userId],
-                        ['Status', statusOf(polled.plan)],
-                    ],
-                }),
-                checklist(status).join('\n'),
-            ].join('\n'));
+            const done = {
+                data: { host, plan: polled.plan, status, connected: true },
+                summary: [
+                    ctx.ui.result({
+                        title: `${named ? 'Installed' : 'Connected'} ${name} for ${plan.team.slug}`,
+                        rows: [
+                            ['Signed in by', (_g = member.email) !== null && _g !== void 0 ? _g : member.userId],
+                            ['Status', statusOf(polled.plan, named)],
+                        ],
+                        notes: named
+                            ? [
+                                `Prove it end to end: @mention the agent in ${plan.product.name}, then "ekanos runs list --team ${plan.team.slug}" shows the run it started.`,
+                            ]
+                            : [],
+                    }),
+                    checklist(status).join('\n'),
+                ].join('\n'),
+            };
+            return options.then
+                ? options.then(done)
+                : ctx.succeed(done.data, done.summary);
         }
     }
-    throw validationError('The sign-in did not finish before the link expired.', `Run "ekanos teams connect ${target.team} ${target.product}${asEmail ? ` --as ${asEmail}` : ''}" again for a fresh link.`);
+    throw validationError('The sign-in did not finish before the link expired.', `Run "${again}${asEmail ? ` --as ${asEmail}` : ''}" again for a fresh link.`);
 }
 /** `--link-only`: the team's page and whether it is connected. */
 async function printLink(ctx, client, host, target) {
@@ -218,25 +389,9 @@ async function printLink(ctx, client, host, target) {
         ],
     }));
 }
-function statusOf(plan) {
+function statusOf(plan, named = false) {
     if (!plan.connected)
-        return 'not connected';
-    return `connected${plan.connectedAt ? ` ${plan.connectedAt.slice(0, 10)}` : ''}`;
-}
-/** Best effort: the link is always printed, so a failed open costs nothing. */
-function openInBrowser(url) {
-    const [command, argv] = process.platform === 'darwin'
-        ? ['open', [url]]
-        : process.platform === 'win32'
-            ? ['cmd', ['/c', 'start', '""', url]]
-            : ['xdg-open', [url]];
-    try {
-        const child = spawn(command, argv, { detached: true, stdio: 'ignore' });
-        child.on('error', () => { });
-        child.unref();
-    }
-    catch (_a) {
-        // Printed above; nothing to do.
-    }
+        return named ? 'not installed' : 'not connected';
+    return `${named ? 'installed' : 'connected'}${plan.connectedAt ? ` ${plan.connectedAt.slice(0, 10)}` : ''}`;
 }
 //# sourceMappingURL=teams-connect.js.map