@engineeros/connector 1.37.0 → 1.39.0

package/README.md

@@ -344,6 +344,24 @@ Unknown runtime failures may use one read-only LLM diagnosis per run through the
 
 Verification results are cached per commit and role. Completed checks are reused. An interrupted check requires inspection before a new revision; it is not automatically billed again. Existing workers must load the new connector code before these protections apply.
 
+## Integrations: GitHub, GitLab, Jira, Linear and monday.com
+
+EngineerOS holds no credentials for these services and none of them calls EngineerOS. When EngineerOS needs one (pull request review, Goal pull requests, repository import, backlog triage, filing defects in Linear), it asks the connector, which makes the call with this machine's own sign-in and sends back only the answer.
+
+```sh
+engineeros-connector integrations              # what this machine is signed in to
+gh auth login                                  # GitHub, through the GitHub CLI
+glab auth login                                # GitLab, through the GitLab CLI
+engineeros-connector connect linear            # prompts for a Linear API key
+engineeros-connector connect jira --site https://acme.atlassian.net --email you@acme.com
+engineeros-connector connect monday            # prompts for a monday.com API token
+engineeros-connector disconnect linear         # removes the key from this machine
+```
+
+The GitHub and GitLab CLIs need not be installed beforehand. **Install** beside the machine in Admin → Integrations, or `connect github` / `connect gitlab` here, has the connector download the release it pins (GitHub CLI 2.102.0, GitLab CLI 1.120.0) from the vendor's own release page, refuse it unless it matches the SHA-256 recorded in `src/integration-install.mjs`, and unpack it into `~/.engineeros/tools/<tool>/<version>`. Only the connector uses that copy, and only when the tool is not already on PATH; nothing is installed system-wide. Then sign in: **Sign in** beside the machine in Admin → Integrations starts the CLI's own device sign-in here (`gh auth login --web`, `glab auth login --device`) and shows its one-time code and page in EngineerOS. Whoever approves the code becomes the machine's GitHub or GitLab identity, so only the machine's owner can start it; the CLI keeps the token in the system keyring, and an unapproved code is abandoned after 15 minutes. `gh auth login`, `glab auth login` or `connect github` / `connect gitlab` in a terminal work too.
+
+A token is read without echo (or from stdin when piped), checked with the provider, and kept in the platform's protected store: Windows Data Protection, the macOS login Keychain, or the Linux Secret Service (install `secret-tool` and run a keyring such as GNOME Keyring). Sign-ins belong to the machine's user, so every workspace connected on the machine shares them. The running connector reads them on each request; no restart is needed. EngineerOS can ask only for the operations the connector lists (`src/integration-requests.mjs`), each with checked arguments, and answers travel back over the connector's authenticated HTTP channel.
+
 ## Optional tool and plugin inventory
 
 Connector 1.7 advertises a curated candidate catalog alongside the operator-managed inventory. The catalog covers code intelligence, design, work management, source control, documentation, research, API development, browser testing, quality and security, data, infrastructure, observability and development environments. Candidate entries are metadata only: they are not installed, authenticated, admitted, started or exposed to coding agents.