@interactive-inc/claude-funnel 0.26.0 → 0.27.0

package/dist/index.js

@@ -1,10 +1,10 @@
-import { i as FunnelDiscordAdapter, n as FunnelDiscordListener, t as discordConnectorSchema } from "./discord-connector-schema-CpuI6rmE.js";
-import { n as FunnelConnectorListener, t as FunnelLogger } from "./logger-D1A3_JXV.js";
-import { a as FunnelProcessRunner, i as NodeFunnelProcessRunner, n as FunnelGhListener, r as FunnelGhAdapter, t as ghConnectorSchema } from "./gh-connector-schema-CQRIvPpz.js";
-import { a as ScheduleStateStore, i as FunnelScheduleListener, n as scheduleConnectorSchema, o as NodeFunnelFileSystem, r as scheduleEntrySchema, s as FunnelFileSystem, t as scheduleCatchupPolicySchema } from "./schedule-connector-schema-CuCjP7z4.js";
-import { i as FunnelSlackAdapter, n as FunnelSlackListener, r as FunnelSlackEventProcessor, t as slackConnectorSchema } from "./slack-connector-schema-BWL7dWlY.js";
+import { i as FunnelDiscordAdapter, n as FunnelDiscordListener, t as discordConnectorSchema } from "./discord-connector-schema-RzDvrNE5.js";
+import { n as FunnelConnectorListener, t as FunnelLogger } from "./logger-Czli2OKh.js";
+import { a as FunnelProcessRunner, i as NodeFunnelProcessRunner, n as FunnelGhListener, r as FunnelGhAdapter, t as ghConnectorSchema } from "./gh-connector-schema-eYE4g77K.js";
+import { a as ScheduleStateStore, i as FunnelScheduleListener, n as scheduleConnectorSchema, o as NodeFunnelFileSystem, r as scheduleEntrySchema, s as FunnelFileSystem, t as scheduleCatchupPolicySchema } from "./schedule-connector-schema-CM-sRkac.js";
+import { i as FunnelSlackAdapter, n as FunnelSlackListener, r as FunnelSlackEventProcessor, t as slackConnectorSchema } from "./slack-connector-schema-CHbRJHGp.js";
 import { dirname, join, resolve } from "node:path";
-import { appendFileSync, existsSync, mkdirSync, readFileSync } from "node:fs";
+import { appendFileSync, chmodSync, existsSync, mkdirSync, readFileSync } from "node:fs";
 import { z } from "zod";
 import { homedir, tmpdir } from "node:os";
 import { stderr, stdin } from "node:process";
@@ -104,6 +104,18 @@ const settingsSchema = z.object({
 });
 //#endregion
 //#region lib/engine/settings/settings-store.ts
+/**
+* Resolves the funnel home dir. Defaults to `~/.funnel`, overridable via
+* `FUNNEL_DIR` so a funnel.json-scoped launch can point everything (settings,
+* gateway pid/token, claude pids) at a repo-local `<repo>/.funnel` and never
+* touch the global home. Read at call time, not module load, so a daemon
+* spawned with the env set resolves the override.
+*/
+function resolveFunnelDir() {
+	const override = process.env.FUNNEL_DIR;
+	if (override && override.length > 0) return override;
+	return join(homedir(), ".funnel");
+}
 const FUNNEL_DIR = join(homedir(), ".funnel");
 const SETTINGS_PATH = join(FUNNEL_DIR, "settings.json");
 const defaultFs$5 = new NodeFunnelFileSystem();
@@ -198,6 +210,7 @@ var FunnelConnectorFactory = class {
 	fs;
 	process;
 	logger;
+	diagnosticLog;
 	dir;
 	slackListenerOptions;
 	scheduleListenerOptions;
@@ -205,6 +218,7 @@ var FunnelConnectorFactory = class {
 		this.fs = deps.fs ?? defaultFs$4;
 		this.process = deps.process ?? defaultProcess$3;
 		this.logger = deps.logger;
+		this.diagnosticLog = deps.diagnosticLog;
 		this.dir = deps.dir ?? FUNNEL_DIR;
 		this.slackListenerOptions = deps.slackListenerOptions ?? {};
 		this.scheduleListenerOptions = deps.scheduleListenerOptions ?? {};
@@ -213,18 +227,24 @@ var FunnelConnectorFactory = class {
 	createListener(channelId, config) {
 		if (config.type === "slack") return new FunnelSlackListener({
 			config,
+			channelId,
 			logger: this.logger,
+			diagnosticLog: this.diagnosticLog,
 			onAppCreated: this.slackListenerOptions.onAppCreated,
 			preprocessEvent: this.slackListenerOptions.preprocessEvent
 		});
 		if (config.type === "gh") return new FunnelGhListener({
 			config,
+			channelId,
 			process: this.process,
-			logger: this.logger
+			logger: this.logger,
+			diagnosticLog: this.diagnosticLog
 		});
 		if (config.type === "discord") return new FunnelDiscordListener({
 			config,
-			logger: this.logger
+			channelId,
+			logger: this.logger,
+			diagnosticLog: this.diagnosticLog
 		});
 		return new FunnelScheduleListener({
 			config,
@@ -232,7 +252,9 @@ var FunnelConnectorFactory = class {
 				path: join(this.connectorDir(channelId, config.id), "state.json"),
 				fs: this.fs
 			}),
+			channelId,
 			logger: this.logger,
+			diagnosticLog: this.diagnosticLog,
 			onFired: this.scheduleListenerOptions.onFired
 		});
 	}
@@ -252,15 +274,17 @@ var FunnelConnectorFactory = class {
 //#endregion
 //#region lib/engine/channels/connector-tokens.ts
 /**
-* Return every secret token contained in a connector config. Used by token
-* collision detection at add/update time so the same Slack bot or Discord
-* bot cannot be registered under two connectors. Centralizes the per-type
-* switch so the channels facade does not embed type-specific knowledge.
+* Return every literal secret token contained in a connector config. Used by
+* token collision detection at add/update time so the same Slack bot or
+* Discord bot cannot be registered under two connectors. Connectors that hold
+* an env *reference* instead of a literal contribute nothing here — two
+* connectors naming the same env var is not a secret collision, and the secret
+* is not in settings.json to compare anyway.
 */
 function connectorTokens(connector) {
 	switch (connector.type) {
-		case "slack": return [connector.botToken, connector.appToken];
-		case "discord": return [connector.botToken];
+		case "slack": return [connector.botToken, connector.appToken].filter((token) => token !== void 0);
+		case "discord": return [connector.botToken].filter((token) => token !== void 0);
 		case "gh":
 		case "schedule": return [];
 	}
@@ -306,6 +330,26 @@ var NodeFunnelClock = class extends FunnelClock {
 };
 //#endregion
 //#region lib/engine/channels/channels.ts
+/**
+* Resolves one token slot (e.g. botToken/botTokenEnv) for an update. The
+* literal and the env-ref form are mutually exclusive: if `fields` supplies
+* either, that form wins and the other key is omitted entirely; if it supplies
+* neither, the connector's current slot is carried over unchanged. Returns a
+* partial object spread into the rebuilt connector, so an omitted key is truly
+* absent rather than set to undefined.
+*/
+const slotFields = (literalKey, envKey, fields, current) => {
+	const literal = fields[literalKey];
+	if (literal !== void 0) return { [literalKey]: literal };
+	const envVar = fields[envKey];
+	if (envVar !== void 0) return { [envKey]: envVar };
+	const result = {};
+	const currentLiteral = current[literalKey];
+	const currentEnv = current[envKey];
+	if (typeof currentLiteral === "string") result[literalKey] = currentLiteral;
+	if (typeof currentEnv === "string") result[envKey] = currentEnv;
+	return result;
+};
 const defaultClock$1 = new NodeFunnelClock();
 const defaultIdGenerator$1 = new NodeFunnelIdGenerator();
 /**
@@ -412,8 +456,10 @@ var FunnelChannels = class {
 				id,
 				type: "slack",
 				name: input.name,
-				botToken: input.botToken,
-				appToken: input.appToken,
+				...input.botToken !== void 0 ? { botToken: input.botToken } : {},
+				...input.appToken !== void 0 ? { appToken: input.appToken } : {},
+				...input.botTokenEnv !== void 0 ? { botTokenEnv: input.botTokenEnv } : {},
+				...input.appTokenEnv !== void 0 ? { appTokenEnv: input.appTokenEnv } : {},
 				minify: input.minify ?? true,
 				createdAt,
 				updatedAt
@@ -430,7 +476,8 @@ var FunnelChannels = class {
 				id,
 				type: "discord",
 				name: input.name,
-				botToken: input.botToken,
+				...input.botToken !== void 0 ? { botToken: input.botToken } : {},
+				...input.botTokenEnv !== void 0 ? { botTokenEnv: input.botTokenEnv } : {},
 				createdAt,
 				updatedAt
 			};
@@ -464,15 +511,20 @@ var FunnelChannels = class {
 	}
 	updateSlackConnector(channelName, connectorName, fields) {
 		const settings = this.store.read();
-		const connector = requireConnectorOfType(this.requireChannel(settings, channelName), connectorName, "slack");
+		const channel = this.requireChannel(settings, channelName);
+		const connector = requireConnectorOfType(channel, connectorName, "slack");
 		const updated = {
-			...connector,
-			botToken: fields.botToken ?? connector.botToken,
-			appToken: fields.appToken ?? connector.appToken,
-			updatedAt: this.clock.iso()
+			id: connector.id,
+			name: connector.name,
+			type: "slack",
+			minify: connector.minify,
+			createdAt: connector.createdAt,
+			updatedAt: this.clock.iso(),
+			...slotFields("botToken", "botTokenEnv", fields, connector),
+			...slotFields("appToken", "appTokenEnv", fields, connector)
 		};
 		this.assertNoTokenCollision(settings, updated);
-		Object.assign(connector, updated);
+		this.replaceConnector(channel, connector.name, updated);
 		this.store.write(settings);
 	}
 	updateGhConnector(channelName, connectorName, fields) {
@@ -484,14 +536,18 @@ var FunnelChannels = class {
 	}
 	updateDiscordConnector(channelName, connectorName, fields) {
 		const settings = this.store.read();
-		const connector = requireConnectorOfType(this.requireChannel(settings, channelName), connectorName, "discord");
+		const channel = this.requireChannel(settings, channelName);
+		const connector = requireConnectorOfType(channel, connectorName, "discord");
 		const updated = {
-			...connector,
-			botToken: fields.botToken ?? connector.botToken,
-			updatedAt: this.clock.iso()
+			id: connector.id,
+			name: connector.name,
+			type: "discord",
+			createdAt: connector.createdAt,
+			updatedAt: this.clock.iso(),
+			...slotFields("botToken", "botTokenEnv", fields, connector)
 		};
 		this.assertNoTokenCollision(settings, updated);
-		Object.assign(connector, updated);
+		this.replaceConnector(channel, connector.name, updated);
 		this.store.write(settings);
 	}
 	listScheduleEntries(channelName, connectorName) {
@@ -554,6 +610,11 @@ var FunnelChannels = class {
 		if (!channel) throw new Error(`channel "${name}" not found`);
 		return channel;
 	}
+	replaceConnector(channel, connectorName, next) {
+		const index = channel.connectors.findIndex((c) => c.name === connectorName);
+		if (index < 0) throw new Error(`connector "${connectorName}" not found in channel "${channel.name}"`);
+		channel.connectors[index] = next;
+	}
 	assertNoTokenCollision(settings, candidate) {
 		const tokens = connectorTokens(candidate);
 		if (tokens.length === 0) return;
@@ -1054,26 +1115,31 @@ var FunnelLocalConfigSync = class {
 	}
 	async ensureSlack(channelName, spec, dotenv) {
 		const byName = this.findExistingSlack(channelName, spec.name);
-		const botToken = await this.resolveField({
+		const bot = await this.resolveSlot({
 			literal: spec.botToken,
 			envVar: spec.env?.botToken,
 			dotenv,
 			label: `${spec.name}.botToken`,
-			existing: byName?.botToken
+			existingLiteral: byName?.botToken,
+			existingEnv: byName?.botTokenEnv
 		});
-		const appToken = await this.resolveField({
+		const app = await this.resolveSlot({
 			literal: spec.appToken,
 			envVar: spec.env?.appToken,
 			dotenv,
 			label: `${spec.name}.appToken`,
-			existing: byName?.appToken
+			existingLiteral: byName?.appToken,
+			existingEnv: byName?.appTokenEnv
 		});
+		const update = {
+			botToken: bot.token,
+			botTokenEnv: bot.tokenEnv,
+			appToken: app.token,
+			appTokenEnv: app.tokenEnv
+		};
 		if (byName) {
-			if (byName.botToken !== botToken || byName.appToken !== appToken) {
-				this.channels.updateSlackConnector(channelName, spec.name, {
-					botToken,
-					appToken
-				});
+			if (!(byName.botToken === bot.token && byName.botTokenEnv === bot.tokenEnv && byName.appToken === app.token && byName.appTokenEnv === app.tokenEnv)) {
+				this.channels.updateSlackConnector(channelName, spec.name, update);
 				return {
 					id: byName.id,
 					name: spec.name,
@@ -1086,25 +1152,11 @@ var FunnelLocalConfigSync = class {
 				changed: false
 			};
 		}
-		const byToken = this.findSlackByToken(channelName, [botToken, appToken]);
-		if (byToken) {
-			this.channels.renameConnector(channelName, byToken.name, spec.name);
-			if (byToken.botToken !== botToken || byToken.appToken !== appToken) this.channels.updateSlackConnector(channelName, spec.name, {
-				botToken,
-				appToken
-			});
-			return {
-				id: byToken.id,
-				name: spec.name,
-				changed: true
-			};
-		}
 		return {
 			id: this.channels.addConnector(channelName, {
 				type: "slack",
 				name: spec.name,
-				botToken,
-				appToken,
+				...update,
 				...spec.minify !== void 0 ? { minify: spec.minify } : {}
 			}).id,
 			name: spec.name,
@@ -1113,16 +1165,21 @@ var FunnelLocalConfigSync = class {
 	}
 	async ensureDiscord(channelName, spec, dotenv) {
 		const byName = this.findExistingDiscord(channelName, spec.name);
-		const botToken = await this.resolveField({
+		const bot = await this.resolveSlot({
 			literal: spec.botToken,
 			envVar: spec.env?.botToken,
 			dotenv,
 			label: `${spec.name}.botToken`,
-			existing: byName?.botToken
+			existingLiteral: byName?.botToken,
+			existingEnv: byName?.botTokenEnv
 		});
+		const update = {
+			botToken: bot.token,
+			botTokenEnv: bot.tokenEnv
+		};
 		if (byName) {
-			if (byName.botToken !== botToken) {
-				this.channels.updateDiscordConnector(channelName, spec.name, { botToken });
+			if (byName.botToken !== bot.token || byName.botTokenEnv !== bot.tokenEnv) {
+				this.channels.updateDiscordConnector(channelName, spec.name, update);
 				return {
 					id: byName.id,
 					name: spec.name,
@@ -1135,21 +1192,11 @@ var FunnelLocalConfigSync = class {
 				changed: false
 			};
 		}
-		const byToken = this.findDiscordByToken(channelName, botToken);
-		if (byToken) {
-			this.channels.renameConnector(channelName, byToken.name, spec.name);
-			if (byToken.botToken !== botToken) this.channels.updateDiscordConnector(channelName, spec.name, { botToken });
-			return {
-				id: byToken.id,
-				name: spec.name,
-				changed: true
-			};
-		}
 		return {
 			id: this.channels.addConnector(channelName, {
 				type: "discord",
 				name: spec.name,
-				botToken
+				...update
 			}).id,
 			name: spec.name,
 			changed: true
@@ -1212,24 +1259,6 @@ var FunnelLocalConfigSync = class {
 		if (existing.type !== "discord") throw new Error(`connector "${connectorName}" exists in channel "${channelName}" with type "${existing.type}", funnel.json declares "discord"`);
 		return existing;
 	}
-	findSlackByToken(channelName, tokens) {
-		const channel = this.channels.get(channelName);
-		if (!channel) return null;
-		for (const connector of channel.connectors) {
-			if (connector.type !== "slack") continue;
-			if (tokens.includes(connector.botToken) || tokens.includes(connector.appToken)) return connector;
-		}
-		return null;
-	}
-	findDiscordByToken(channelName, token) {
-		const channel = this.channels.get(channelName);
-		if (!channel) return null;
-		for (const connector of channel.connectors) {
-			if (connector.type !== "discord") continue;
-			if (connector.botToken === token) return connector;
-		}
-		return null;
-	}
 	removeExtras(channelName, touched) {
 		const channel = this.channels.get(channelName);
 		if (!channel) return [];
@@ -1237,18 +1266,43 @@ var FunnelLocalConfigSync = class {
 		for (const connector of stale) this.channels.removeConnector(channelName, connector.name);
 		return stale.map((c) => c.name);
 	}
-	async resolveField(input) {
+	/**
+	* Decides how a single token slot is stored in settings.json:
+	*
+	*   - `env.<field>` reference → `{ tokenEnv: "<VAR>" }`; the secret is NOT
+	*     resolved into settings, it stays in the environment / `.env.local` and
+	*     the listener resolves it at start. We still assert the var is set so a
+	*     typo fails loudly here instead of as a dead listener later.
+	*   - literal → `{ token: "<secret>" }`.
+	*   - neither, but a prior value exists → carry it over verbatim (whichever
+	*     form it already was), so a tokenless re-sync is a no-op.
+	*   - nothing at all → prompt for a literal (TTY only; throws otherwise).
+	*/
+	async resolveSlot(input) {
 		if (input.literal !== void 0 && input.envVar !== void 0) throw new Error(`${input.label} is set both as a literal and as env.${input.label.split(".").pop()}; pick one`);
-		if (input.literal !== void 0 && input.literal !== "") return input.literal;
 		if (input.envVar !== void 0 && input.envVar !== "") {
-			const fromProcessEnv = this.env[input.envVar];
-			if (fromProcessEnv) return fromProcessEnv;
-			const fromDotenv = input.dotenv[input.envVar];
-			if (fromDotenv) return fromDotenv;
-			throw new Error(`${input.label} references env var "${input.envVar}" but it is not set in process env or .env.local`);
+			if (!this.env[input.envVar] && !input.dotenv[input.envVar]) throw new Error(`${input.label} references env var "${input.envVar}" but it is not set in process env or .env.local`);
+			return {
+				token: void 0,
+				tokenEnv: input.envVar
+			};
 		}
-		if (input.existing) return input.existing;
-		return await this.prompter.promptSecret(input.label);
+		if (input.literal !== void 0 && input.literal !== "") return {
+			token: input.literal,
+			tokenEnv: void 0
+		};
+		if (input.existingEnv !== void 0) return {
+			token: void 0,
+			tokenEnv: input.existingEnv
+		};
+		if (input.existingLiteral !== void 0) return {
+			token: input.existingLiteral,
+			tokenEnv: void 0
+		};
+		return {
+			token: await this.prompter.promptSecret(input.label),
+			tokenEnv: void 0
+		};
 	}
 };
 //#endregion
@@ -1845,6 +1899,7 @@ var FunnelGateway = class {
 		const gatewayScript = resolveDaemonScript();
 		const command = this.buildStartCommand(gatewayScript, options);
 		this.process.detach(command, {
+			env: { FUNNEL_DIR: this.dir },
 			stdoutFile: this.gatewayLog,
 			stderrFile: this.gatewayLog
 		});
@@ -2358,8 +2413,11 @@ var LeucoLoggerSqliteSink = class {
 		if (props.where) this.appendWhereConditions(props.where, conditions, params);
 		const limit = props.limit ?? 1e3;
 		params.push(limit);
-		const sql = `SELECT seq, ts, type, event FROM leuco_log WHERE ${conditions.join(" AND ")} ORDER BY seq ASC LIMIT ?`;
-		return this.db.prepare(sql).all(...params).map(toRecord);
+		const dir = props.order === "desc" ? "DESC" : "ASC";
+		const sql = `SELECT seq, ts, type, event FROM leuco_log WHERE ${conditions.join(" AND ")} ORDER BY seq ${dir} LIMIT ?`;
+		const rows = this.db.prepare(sql).all(...params);
+		if (dir === "DESC") rows.reverse();
+		return rows.map(toRecord);
 	}
 	/**
 	* Current schema version. Useful for diagnostics and for tests that want
@@ -3480,7 +3538,7 @@ var Funnel = class Funnel {
 	}
 	/** Resolved on-disk paths the facade will read/write when methods are called. Pure compute, not memoized. */
 	get paths() {
-		const dir = this.props.dir ?? FUNNEL_DIR;
+		const dir = this.props.dir ?? resolveFunnelDir();
 		return {
 			dir,
 			tmpDir: this.props.tmpDir ?? funnelTmpDir(),
@@ -3533,6 +3591,7 @@ var Funnel = class Funnel {
 			fs: this.fs,
 			process: this.process,
 			logger: this.logger,
+			diagnosticLog: this.props.diagnosticLog,
 			dir: this.paths.dir,
 			slackListenerOptions: this.props.slackListenerOptions,
 			scheduleListenerOptions: this.props.scheduleListenerOptions
@@ -3976,6 +4035,501 @@ var MemoryFunnelEventLog = class extends FunnelEventLog {
 	close() {}
 };
 //#endregion
+//#region lib/gateway/connector-diagnostic-log.ts
+/**
+* Points in the listener's connection lifecycle. The single source of truth
+* for the value set: the `status` column schema, the `ConnectorConnectionStatus`
+* union, and the runtime Set used to narrow on read-back all derive from this
+* array, so adding a status is a one-line change that cannot drift out of sync.
+*
+*   started       start() was called
+*   connected     the socket opened and events can flow
+*   disconnected  the socket was closed by a stop() call (a clean teardown)
+*   auth-failed   the token was rejected before the socket opened
+*   stopped       the listener was fully torn down (always follows a stop(),
+*                 paired with the disconnected/error that preceded it)
+*   error         start/stop threw, or Bolt surfaced an error frame — this is
+*                 also where an unsolicited socket drop shows up when Bolt
+*                 reports it (an `error` with no following `stopped` means the
+*                 supervisor recycled the listener, not a clean stop)
+*
+* A connection row is independent of any single inbound event, so it carries
+* no `eventId`. This is how "no notification arrived because the listener
+* never connected (or dropped, or failed auth)" becomes visible: the
+* raw/processed tables only hold events that *did* arrive.
+*/
+const CONNECTOR_CONNECTION_STATUSES = [
+	"started",
+	"connected",
+	"disconnected",
+	"auth-failed",
+	"stopped",
+	"error"
+];
+/**
+* Rows stored in the diagnostic tables. Connector-agnostic on purpose: `type`
+* carries the listener kind ("slack" | "discord" | "gh" | "schedule") so new
+* connectors land in the same tables without a schema change. `event_id` is
+* the correlation key the listener mints once per inbound event and stamps
+* onto both the raw and processed rows, so the two are joinable even though
+* they live in separate tables with independent `seq` counters.
+*
+* These schemas mirror the stored shape (snake_case columns) the way
+* `FunnelEvent` does for the replay log; they exist for `z.infer` and to
+* document the column set, not as a parse boundary.
+*/
+const connectorRawEventSchema = z.object({
+	event_id: z.string(),
+	type: z.string(),
+	connector_id: z.string().nullable(),
+	channel_id: z.string().nullable(),
+	payload: z.string()
+});
+const connectorProcessedEventSchema = z.object({
+	event_id: z.string(),
+	type: z.string(),
+	connector_id: z.string().nullable(),
+	channel_id: z.string().nullable(),
+	outcome: z.string(),
+	payload: z.string()
+});
+const connectorConnectionEventSchema = z.object({
+	type: z.string(),
+	connector_id: z.string().nullable(),
+	channel_id: z.string().nullable(),
+	status: z.enum(CONNECTOR_CONNECTION_STATUSES),
+	detail: z.string()
+});
+/**
+* Three-table diagnostic log of everything a connector listener does, so
+* "why was there no notification?" is answerable whichever way it failed:
+*   - `raw` — every inbound event, before any filtering, with the listener's
+*     untouched payload (the Slack Bolt event, the GH webhook, …)
+*   - `processed` — the verdict for that event: `outcome` (emitted, or the
+*     reason it was dropped) and, when emitted, the body that was delivered.
+*     Shares an `eventId` with its raw row, so the two join into one story.
+*   - `connection` — the listener's lifecycle (started, connected, dropped,
+*     auth-failed, stopped, errored). This is the half the event tables can't
+*     show: an event that never arrived leaves no raw row, but a listener that
+*     never connected leaves a `connection` trail that says so.
+*
+* The three are physically separate (independent retention and payload-size
+* policy) so a query never crosses them by accident and a huge raw payload
+* never bloats the verdict or lifecycle trails. None flow to WS clients or the
+* MCP channel — this is a separate store from `FunnelEventLog` (replay) and
+* exists solely for debugging.
+*
+* Implementations:
+*   - `SqliteConnectorDiagnosticLog` — the default; survives daemon restarts,
+*     bounded by per-table row/age caps.
+*   - `MemoryConnectorDiagnosticLog` — an in-process double for tests.
+*/
+var ConnectorDiagnosticLog = class {};
+//#endregion
+//#region lib/gateway/sqlite-connector-diagnostic-log.ts
+/**
+* Cap on a raw payload kept verbatim. The point of the raw table is to see
+* what Slack/Discord actually sent, and a typical event is a few KB — so 256
+* KiB keeps essentially everything intact while bounding the rare giant
+* payload (a huge Block Kit message, a file dump) that would otherwise let a
+* single row bloat the debug database without limit.
+*/
+const RAW_PAYLOAD_CAP = 256 * 1024;
+/**
+* Default `ConnectorDiagnosticLog`: three independent `LeucoLoggerSqliteSink`s, one
+* per table (raw / processed / connection), in separate files. Each sink
+* indexes the columns its queries filter on — `event_id` / `connector_id` /
+* `channel_id` for raw, plus `outcome` for processed and `status` for
+* connection — so those lookups are indexed scans (`type` is a fixed column
+* the sink extracts separately, not an index, so filtering by it is a scan).
+*
+* The raw table offloads any payload over `RAW_PAYLOAD_CAP`: rather than
+* truncating mid-string (which yields unparseable JSON), it replaces the
+* body with a small JSON object that keeps the diagnostic essentials and
+* records the dropped size under `_funnel_oversized`. Every stored payload
+* therefore stays valid JSON.
+*/
+var SqliteConnectorDiagnosticLog = class extends ConnectorDiagnosticLog {
+	raw;
+	processed;
+	connection;
+	now;
+	logger;
+	constructor(props) {
+		super();
+		this.now = props.now ?? (() => Date.now());
+		this.logger = props.logger;
+		const ageCap = props.maxAgeMs !== void 0 ? { maxAgeMs: props.maxAgeMs } : {};
+		const verdictCap = {
+			now: this.now,
+			...ageCap,
+			...props.maxRows !== void 0 ? { maxRows: props.maxRows } : {}
+		};
+		const rawMax = props.rawMaxRows ?? props.maxRows;
+		const rawCap = {
+			now: this.now,
+			...ageCap,
+			...rawMax !== void 0 ? { maxRows: rawMax } : {}
+		};
+		this.raw = new LeucoLoggerSqliteSink({
+			path: props.rawPath,
+			indexes: [
+				"event_id",
+				"connector_id",
+				"channel_id"
+			],
+			extractIndexes: (event) => ({
+				event_id: event.event_id,
+				connector_id: event.connector_id,
+				channel_id: event.channel_id
+			}),
+			...rawCap
+		});
+		this.processed = new LeucoLoggerSqliteSink({
+			path: props.processedPath,
+			indexes: [
+				"event_id",
+				"connector_id",
+				"channel_id",
+				"outcome"
+			],
+			extractIndexes: (event) => ({
+				event_id: event.event_id,
+				connector_id: event.connector_id,
+				channel_id: event.channel_id,
+				outcome: event.outcome
+			}),
+			...verdictCap
+		});
+		this.connection = new LeucoLoggerSqliteSink({
+			path: props.connectionPath,
+			indexes: [
+				"connector_id",
+				"channel_id",
+				"status"
+			],
+			extractIndexes: (event) => ({
+				connector_id: event.connector_id,
+				channel_id: event.channel_id,
+				status: event.status
+			}),
+			...verdictCap
+		});
+		restrictPermissions(props.rawPath);
+		restrictPermissions(props.processedPath);
+		restrictPermissions(props.connectionPath);
+		Object.freeze(this);
+	}
+	recordRaw(record) {
+		const event = {
+			event_id: record.eventId,
+			type: record.type,
+			connector_id: record.connectorId,
+			channel_id: record.channelId,
+			payload: capPayload(record.payload, record.type)
+		};
+		this.report("raw", this.raw.insert({
+			ts: this.now(),
+			event
+		}));
+	}
+	recordProcessed(record) {
+		const event = {
+			event_id: record.eventId,
+			type: record.type,
+			connector_id: record.connectorId,
+			channel_id: record.channelId,
+			outcome: record.outcome,
+			payload: record.payload
+		};
+		this.report("processed", this.processed.insert({
+			ts: this.now(),
+			event
+		}));
+	}
+	recordConnection(record) {
+		const event = {
+			type: record.type,
+			connector_id: record.connectorId,
+			channel_id: record.channelId,
+			status: record.status,
+			detail: record.detail
+		};
+		this.report("connection", this.connection.insert({
+			ts: this.now(),
+			event
+		}));
+	}
+	report(table, result) {
+		if (result instanceof Error) this.logger?.error("diagnostic log insert failed", {
+			table,
+			error: result.message
+		});
+	}
+	queryRaw(query) {
+		return this.raw.getRecords({
+			...query.type !== void 0 ? { type: query.type } : {},
+			...query.limit !== void 0 ? { limit: query.limit } : {},
+			where: buildWhere(query),
+			order: "desc"
+		}).map((record) => ({
+			seq: record.seq,
+			ts: record.ts,
+			eventId: record.event.event_id,
+			type: record.event.type,
+			connectorId: record.event.connector_id,
+			channelId: record.event.channel_id,
+			payload: record.event.payload
+		}));
+	}
+	queryProcessed(query) {
+		const where = buildWhere(query);
+		if (query.outcome !== void 0) where.outcome = query.outcome;
+		return this.processed.getRecords({
+			...query.type !== void 0 ? { type: query.type } : {},
+			...query.limit !== void 0 ? { limit: query.limit } : {},
+			where,
+			order: "desc"
+		}).map((record) => ({
+			seq: record.seq,
+			ts: record.ts,
+			eventId: record.event.event_id,
+			type: record.event.type,
+			connectorId: record.event.connector_id,
+			channelId: record.event.channel_id,
+			outcome: record.event.outcome,
+			payload: record.event.payload
+		}));
+	}
+	queryConnection(query) {
+		const where = buildWhere(query);
+		if (query.status !== void 0) where.status = query.status;
+		return this.connection.getRecords({
+			...query.type !== void 0 ? { type: query.type } : {},
+			...query.limit !== void 0 ? { limit: query.limit } : {},
+			where,
+			order: "desc"
+		}).map((record) => ({
+			seq: record.seq,
+			ts: record.ts,
+			type: record.event.type,
+			connectorId: record.event.connector_id,
+			channelId: record.event.channel_id,
+			status: statusOf(record.event.status),
+			detail: record.event.detail
+		}));
+	}
+	close() {
+		this.raw.close();
+		this.processed.close();
+		this.connection.close();
+	}
+};
+const restrictPermissions = (path) => {
+	if (path === ":memory:") return;
+	for (const suffix of [
+		"",
+		"-wal",
+		"-shm"
+	]) try {
+		chmodSync(`${path}${suffix}`, 384);
+	} catch {}
+};
+const buildWhere = (query) => {
+	const where = {};
+	if (query.connectorId !== void 0) where.connector_id = query.connectorId;
+	if (query.channelId !== void 0) where.channel_id = query.channelId;
+	return where;
+};
+const statusField = connectorConnectionEventSchema.shape.status;
+const statusOf = (value) => {
+	const parsed = statusField.safeParse(value);
+	return parsed.success ? parsed.data : "error";
+};
+const capPayload = (payload, type) => {
+	const size = Buffer.byteLength(payload, "utf8");
+	if (size <= RAW_PAYLOAD_CAP) return payload;
+	return JSON.stringify({
+		...headFields(payload),
+		_funnel_oversized: size,
+		_funnel_type: type
+	});
+};
+const HEAD_KEYS = [
+	"type",
+	"subtype",
+	"ts",
+	"channel",
+	"channel_type",
+	"user",
+	"bot_id"
+];
+const headFields = (payload) => {
+	try {
+		const parsed = JSON.parse(payload);
+		if (typeof parsed !== "object" || parsed === null) return {};
+		const source = parsed;
+		const head = {};
+		for (const key of HEAD_KEYS) if (source[key] !== void 0) head[key] = source[key];
+		return head;
+	} catch {
+		return {};
+	}
+};
+//#endregion
+//#region lib/gateway/memory-connector-diagnostic-log.ts
+/**
+* In-process `ConnectorDiagnosticLog` backed by one array per table. Used by tests
+* and embedders that do not need durability. Like the SQLite log it keeps
+* `seq` per-table (each array's 1-based position) and returns the most recent
+* `limit` rows oldest-first; unlike it, it never prunes and never offloads
+* oversized payloads — it keeps whatever the caller hands it, which is fine
+* for the bounded volumes a test produces. Payload-validity is therefore a
+* SQLite-only guarantee; do not write a test that leans on this double
+* rejecting a malformed payload.
+*/
+var MemoryConnectorDiagnosticLog = class extends ConnectorDiagnosticLog {
+	raws = [];
+	processeds = [];
+	connections = [];
+	constructor(now = () => Date.now()) {
+		super();
+		this.now = now;
+		Object.freeze(this);
+	}
+	recordRaw(record) {
+		this.raws.push({
+			...record,
+			seq: this.raws.length + 1,
+			ts: this.now()
+		});
+	}
+	recordProcessed(record) {
+		this.processeds.push({
+			...record,
+			seq: this.processeds.length + 1,
+			ts: this.now()
+		});
+	}
+	recordConnection(record) {
+		this.connections.push({
+			...record,
+			seq: this.connections.length + 1,
+			ts: this.now()
+		});
+	}
+	queryRaw(query) {
+		return takeRecent(this.raws.filter((event) => matches$1(event, query)), query.limit);
+	}
+	queryProcessed(query) {
+		return takeRecent(this.processeds.filter((event) => {
+			if (!matches$1(event, query)) return false;
+			if (query.outcome !== void 0 && event.outcome !== query.outcome) return false;
+			return true;
+		}), query.limit);
+	}
+	queryConnection(query) {
+		return takeRecent(this.connections.filter((event) => {
+			if (!matches$1(event, query)) return false;
+			if (query.status !== void 0 && event.status !== query.status) return false;
+			return true;
+		}), query.limit);
+	}
+	close() {}
+};
+const matches$1 = (event, query) => {
+	if (query.type !== void 0 && event.type !== query.type) return false;
+	if (query.connectorId !== void 0 && event.connectorId !== query.connectorId) return false;
+	if (query.channelId !== void 0 && event.channelId !== query.channelId) return false;
+	return true;
+};
+const takeRecent = (events, limit) => {
+	if (limit === void 0) return events;
+	if (limit <= 0) return [];
+	return events.slice(-limit);
+};
+//#endregion
+//#region lib/gateway/connector-diagnostic-sql-reader.ts
+/**
+* Read-only SQL surface over the three diagnostic tables, for Claude to query
+* the log with arbitrary `SELECT`s. It opens all files read-only and exposes
+* three views — `raw`, `processed`, `connection` — that hide the storage
+* details (the physical table is `leuco_log` and each row's columns live
+* inside a JSON `event` blob): the views surface the columns as plain fields,
+* with `payload` already pulled out of the nested JSON.
+*
+* The tables are separate files. `raw` and `processed` share an `event_id`,
+* so a `JOIN` answers "the event arrived, but what verdict did it get?";
+* `connection` answers the other half — "did the listener ever connect at
+* all?". Writes are impossible: the connection is read-only and `query`
+* rejects anything but a single `SELECT`.
+*/
+var ConnectorDiagnosticSqlReader = class {
+	db;
+	constructor(props) {
+		const db = new Database(props.rawPath, { readonly: true });
+		try {
+			db.run("PRAGMA busy_timeout = 500");
+			db.prepare("ATTACH DATABASE ? AS processeddb").run(props.processedPath);
+			db.prepare("ATTACH DATABASE ? AS connectiondb").run(props.connectionPath);
+			db.run(rawViewSql);
+			db.run(processedViewSql);
+			db.run(connectionViewSql);
+		} catch (error) {
+			db.close();
+			throw error;
+		}
+		this.db = db;
+		Object.freeze(this);
+	}
+	/**
+	* Run one read-only `SELECT` and return the rows. Returns an `Error` (rather
+	* than throwing) for a non-SELECT statement or a SQL error, so the caller
+	* can surface the message without a stack trace.
+	*/
+	query(sql) {
+		const trimmed = sql.trim().replace(/;$/, "").trim();
+		if (!/^select\b/i.test(trimmed)) return /* @__PURE__ */ new Error("only a single SELECT statement is allowed");
+		if (trimmed.includes(";")) return /* @__PURE__ */ new Error("only a single statement is allowed (remove the ';')");
+		try {
+			return this.db.prepare(trimmed).all();
+		} catch (error) {
+			return error instanceof Error ? error : new Error(String(error));
+		}
+	}
+	close() {
+		this.db.close();
+	}
+};
+const rawViewSql = `CREATE TEMP VIEW raw AS SELECT
+  seq,
+  ts,
+  json_extract(event, '$.event_id')     AS event_id,
+  json_extract(event, '$.type')         AS type,
+  json_extract(event, '$.connector_id') AS connector_id,
+  json_extract(event, '$.channel_id')   AS channel_id,
+  json_extract(event, '$.payload')      AS payload
+FROM main.leuco_log`;
+const processedViewSql = `CREATE TEMP VIEW processed AS SELECT
+  seq,
+  ts,
+  json_extract(event, '$.event_id')     AS event_id,
+  json_extract(event, '$.type')         AS type,
+  json_extract(event, '$.connector_id') AS connector_id,
+  json_extract(event, '$.channel_id')   AS channel_id,
+  json_extract(event, '$.outcome')      AS outcome,
+  json_extract(event, '$.payload')      AS payload
+FROM processeddb.leuco_log`;
+const connectionViewSql = `CREATE TEMP VIEW connection AS SELECT
+  seq,
+  ts,
+  json_extract(event, '$.type')         AS type,
+  json_extract(event, '$.connector_id') AS connector_id,
+  json_extract(event, '$.channel_id')   AS channel_id,
+  json_extract(event, '$.status')       AS status,
+  json_extract(event, '$.detail')       AS detail
+FROM connectiondb.leuco_log`;
+//#endregion
 //#region lib/cli/factory.ts
 const factory = createFactory();
 //#endregion
@@ -4565,7 +5119,8 @@ subcommands:
   stop                stop
   restart             stop then start
   run                 start in foreground (for developers)
-  logs [-n <N>]       show event logs
+  logs [-n <N>]       tail the daemon diagnostic log (lifecycle, listener boot)
+  sql --query "<SQL>" query inbound connector traffic (raw + processed verdict)
   listeners           list running connector listeners (alive / dead)
 
 examples:
@@ -4682,6 +5237,70 @@ const gatewayLogsHandler = factory.createHandlers(zValidator$1("query", z.object
 	await tail.exited;
 	process.exit(0);
 });
+//#endregion
+//#region lib/cli/routes/gateway.sql.ts
+const sqlHelp = `funnel gateway sql — query inbound connector traffic with SQL
+
+usage: funnel gateway sql --query "<SELECT ...>"
+
+Runs one read-only SELECT against the daemon's diagnostic store of inbound
+connector events and prints the rows as JSON. Use it to answer "Slack
+delivered an event, so why was there no notification?".
+
+Three views:
+  raw         every inbound event, untouched, before any filtering
+  processed   the verdict for that event after the per-type processor ran
+  connection  the listener lifecycle (so you can tell events never arrived)
+
+Shared columns (all three views):
+  seq           row id within the view (not comparable across views)
+  ts            epoch milliseconds
+  type          connector kind: slack | discord | gh | schedule
+  connector_id  funnel connector id
+  channel_id    funnel channel id
+raw and processed also have:
+  event_id      correlation id shared by an event's raw and processed rows
+  payload       raw: the original event JSON (text); processed: the delivered body, or "" when skipped
+processed also has:
+  outcome       'emitted' | 'emitted:delivery-failed' | 'skip:<reason>'
+                (skip reasons: skip:type, skip:subtype, skip:dedup,
+                 skip:self-user, skip:self-bot, skip:preprocess)
+connection also has:
+  status        'started' | 'connected' | 'disconnected' | 'auth-failed' | 'stopped' | 'error'
+  detail        an error message or reason, or "" when none
+
+To trace one event end to end, join raw and processed on event_id. When the
+event tables are empty, query connection — a listener that never connected, or
+failed auth, explains why nothing arrived.
+
+examples:
+  funnel gateway sql --query "SELECT event_id, ts, type FROM raw ORDER BY seq DESC LIMIT 20"
+  funnel gateway sql --query "SELECT outcome, COUNT(*) n FROM processed GROUP BY outcome"
+  funnel gateway sql --query "SELECT r.payload FROM raw r JOIN processed p USING(event_id) WHERE p.outcome='skip:dedup'"
+  funnel gateway sql --query "SELECT ts, status, detail FROM connection WHERE status IN ('auth-failed','error') ORDER BY seq DESC"`;
+const gatewaySqlHandler = factory.createHandlers(zValidator$1("query", z.object({ query: z.string().optional() }), sqlHelp), async (c) => {
+	const sql = c.req.valid("query").query;
+	if (!sql) return c.text(sqlHelp);
+	const tmpDir = funnelTmpDir();
+	const rawPath = join(tmpDir, "connector-raw.db");
+	const processedPath = join(tmpDir, "connector-processed.db");
+	const connectionPath = join(tmpDir, "connector-connection.db");
+	if (!existsSync(rawPath) || !existsSync(processedPath) || !existsSync(connectionPath)) return c.text("no diagnostic store yet (the gateway has not initialized it)");
+	const reader = new ConnectorDiagnosticSqlReader({
+		rawPath,
+		processedPath,
+		connectionPath
+	});
+	const rows = (() => {
+		try {
+			return reader.query(sql);
+		} finally {
+			reader.close();
+		}
+	})();
+	if (rows instanceof Error) return c.text(`error: ${rows.message}`);
+	return c.text(JSON.stringify(rows, null, 2));
+});
 const gatewayRestartHandler = factory.createHandlers(zValidator$1("query", z.object({ "no-caffeine": z.string().optional() }), `funnel gateway restart — restart the gateway
 
 usage: funnel gateway restart [--no-caffeine]
@@ -5090,7 +5709,7 @@ const createCliApp = (funnel) => {
 		if (error instanceof HTTPException) return c.text(`error: ${error.message}`, error.status);
 		return c.text(`error: ${error instanceof Error ? error.message : String(error)}`, 400);
 	});
-	return base.get("/claude", ...claudeHandler).get("/channels", ...channelsGroupHandler).post("/channels/add", ...helpRoute(addHelp$3)).post("/channels/add/:channel", ...channelsAddHandler).post("/channels/remove", ...helpRoute(removeHelp$1)).post("/channels/remove/:channel", ...channelsRemoveHandler).post("/channels/rename/:channel/:newName", ...channelsRenameHandler).post("/channels/:channel/rename/:newName", ...channelsRenameHandler).post("/channels/rename", ...helpRoute(renameHelp$1)).post("/channels/:channel/rename", ...helpRoute(renameHelp$1)).post("/channels/:channel/set/delivery/:mode", ...channelsSetDeliveryHandler).post("/channels/publish", ...helpRoute(publishHelp)).post("/channels/:channel/publish", ...channelsPublishHandler).get("/channels/:channel", ...channelsShowHandler).get("/channels/:channel/connectors", ...channelsConnectorsGroupHandler).post("/channels/:channel/connectors/add", ...helpRoute(addHelp$2)).post("/channels/:channel/connectors/add/:connector", ...channelsConnectorsAddHandler).post("/channels/:channel/connectors/remove", ...helpRoute(removeHelp$3)).post("/channels/:channel/connectors/remove/:connector", ...channelsConnectorsRemoveHandler).post("/channels/:channel/connectors/set", ...helpRoute(setHelp$1)).post("/channels/:channel/connectors/set/:connector", ...channelsConnectorsSetHandler).post("/channels/:channel/connectors/rename/:connector/:newName", ...channelsConnectorsRenameHandler).post("/channels/:channel/connectors/:connector/rename/:newName", ...channelsConnectorsRenameHandler).post("/channels/:channel/connectors/rename", ...helpRoute(renameHelp$2)).post("/channels/:channel/connectors/:connector/rename", ...helpRoute(renameHelp$2)).post("/channels/:channel/connectors/:connector/request", ...channelsConnectorsRequestHandler).get("/channels/:channel/connectors/:connector", ...channelsConnectorsShowHandler).get("/channels/:channel/connectors/:connector/schedules", ...channelsConnectorsSchedulesGroupHandler).post("/channels/:channel/connectors/:connector/schedules/add", ...helpRoute(addHelp$1)).post("/channels/:channel/connectors/:connector/schedules/add/:id", ...channelsConnectorsSchedulesAddHandler).post("/channels/:channel/connectors/:connector/schedules/remove", ...helpRoute(removeHelp$2)).post("/channels/:channel/connectors/:connector/schedules/remove/:id", ...channelsConnectorsSchedulesRemoveHandler).get("/profiles", ...profilesGroupHandler).post("/profiles/add", ...helpRoute(addHelp)).post("/profiles/add/:profile", ...profilesAddHandler).post("/profiles/set", ...helpRoute(setHelp)).post("/profiles/set/:profile", ...profilesSetHandler).post("/profiles/remove", ...helpRoute(removeHelp)).post("/profiles/remove/:profile", ...profilesRemoveHandler).post("/profiles/rename/:profile/:newName", ...profilesRenameHandler).post("/profiles/:profile/rename/:newName", ...profilesRenameHandler).post("/profiles/rename", ...helpRoute(renameHelp)).post("/profiles/:profile/rename", ...helpRoute(renameHelp)).post("/profiles/:profile/as-default", ...profilesAsDefaultHandler).get("/profiles/:profile/run", ...profilesLaunchHandler).get("/profiles/:profile", ...profilesLaunchHandler).get("/gateway", ...gatewayGroupHandler).get("/gateway/status", ...gatewayStatusHandler).get("/gateway/start", ...gatewayStartHandler).get("/gateway/stop", ...gatewayStopHandler).get("/gateway/restart", ...gatewayRestartHandler).get("/gateway/run", ...gatewayRunHandler).get("/gateway/logs", ...gatewayLogsHandler).get("/gateway/listeners", ...gatewayListenersHandler).get("/schema", ...schemaHandler).get("/status", ...statusHandler).get("/update", ...updateHandler);
+	return base.get("/claude", ...claudeHandler).get("/channels", ...channelsGroupHandler).post("/channels/add", ...helpRoute(addHelp$3)).post("/channels/add/:channel", ...channelsAddHandler).post("/channels/remove", ...helpRoute(removeHelp$1)).post("/channels/remove/:channel", ...channelsRemoveHandler).post("/channels/rename/:channel/:newName", ...channelsRenameHandler).post("/channels/:channel/rename/:newName", ...channelsRenameHandler).post("/channels/rename", ...helpRoute(renameHelp$1)).post("/channels/:channel/rename", ...helpRoute(renameHelp$1)).post("/channels/:channel/set/delivery/:mode", ...channelsSetDeliveryHandler).post("/channels/publish", ...helpRoute(publishHelp)).post("/channels/:channel/publish", ...channelsPublishHandler).get("/channels/:channel", ...channelsShowHandler).get("/channels/:channel/connectors", ...channelsConnectorsGroupHandler).post("/channels/:channel/connectors/add", ...helpRoute(addHelp$2)).post("/channels/:channel/connectors/add/:connector", ...channelsConnectorsAddHandler).post("/channels/:channel/connectors/remove", ...helpRoute(removeHelp$3)).post("/channels/:channel/connectors/remove/:connector", ...channelsConnectorsRemoveHandler).post("/channels/:channel/connectors/set", ...helpRoute(setHelp$1)).post("/channels/:channel/connectors/set/:connector", ...channelsConnectorsSetHandler).post("/channels/:channel/connectors/rename/:connector/:newName", ...channelsConnectorsRenameHandler).post("/channels/:channel/connectors/:connector/rename/:newName", ...channelsConnectorsRenameHandler).post("/channels/:channel/connectors/rename", ...helpRoute(renameHelp$2)).post("/channels/:channel/connectors/:connector/rename", ...helpRoute(renameHelp$2)).post("/channels/:channel/connectors/:connector/request", ...channelsConnectorsRequestHandler).get("/channels/:channel/connectors/:connector", ...channelsConnectorsShowHandler).get("/channels/:channel/connectors/:connector/schedules", ...channelsConnectorsSchedulesGroupHandler).post("/channels/:channel/connectors/:connector/schedules/add", ...helpRoute(addHelp$1)).post("/channels/:channel/connectors/:connector/schedules/add/:id", ...channelsConnectorsSchedulesAddHandler).post("/channels/:channel/connectors/:connector/schedules/remove", ...helpRoute(removeHelp$2)).post("/channels/:channel/connectors/:connector/schedules/remove/:id", ...channelsConnectorsSchedulesRemoveHandler).get("/profiles", ...profilesGroupHandler).post("/profiles/add", ...helpRoute(addHelp)).post("/profiles/add/:profile", ...profilesAddHandler).post("/profiles/set", ...helpRoute(setHelp)).post("/profiles/set/:profile", ...profilesSetHandler).post("/profiles/remove", ...helpRoute(removeHelp)).post("/profiles/remove/:profile", ...profilesRemoveHandler).post("/profiles/rename/:profile/:newName", ...profilesRenameHandler).post("/profiles/:profile/rename/:newName", ...profilesRenameHandler).post("/profiles/rename", ...helpRoute(renameHelp)).post("/profiles/:profile/rename", ...helpRoute(renameHelp)).post("/profiles/:profile/as-default", ...profilesAsDefaultHandler).get("/profiles/:profile/run", ...profilesLaunchHandler).get("/profiles/:profile", ...profilesLaunchHandler).get("/gateway", ...gatewayGroupHandler).get("/gateway/status", ...gatewayStatusHandler).get("/gateway/start", ...gatewayStartHandler).get("/gateway/stop", ...gatewayStopHandler).get("/gateway/restart", ...gatewayRestartHandler).get("/gateway/run", ...gatewayRunHandler).get("/gateway/logs", ...gatewayLogsHandler).get("/gateway/sql", ...gatewaySqlHandler).get("/gateway/listeners", ...gatewayListenersHandler).get("/schema", ...schemaHandler).get("/status", ...statusHandler).get("/update", ...updateHandler);
 };
 /** CLI Hono app wired to a default `new Funnel()`. For embedding with a custom Funnel use `createCliApp`. */
 const app = createCliApp(new Funnel());
@@ -6493,6 +7112,11 @@ function ChannelsView(props) {
 }
 //#endregion
 //#region lib/tui/views/connectors-view.tsx
+const tokenDisplay = (literal, envVar) => {
+	if (literal !== void 0 && literal !== "") return literal;
+	if (envVar !== void 0 && envVar !== "") return `env:${envVar}`;
+	return "—";
+};
 const formatTimestamp = (iso) => {
 	if (!iso) return "—";
 	const d = new Date(iso);
@@ -6577,10 +7201,10 @@ function ConnectorsView(props) {
 				}),
 				connector.type === "slack" ? /* @__PURE__ */ jsxs(Fragment, { children: [/* @__PURE__ */ jsx(ReadonlyField, {
 					label: "bot-token",
-					value: connector.botToken
+					value: tokenDisplay(connector.botToken, connector.botTokenEnv)
 				}), /* @__PURE__ */ jsx(ReadonlyField, {
 					label: "app-token",
-					value: connector.appToken
+					value: tokenDisplay(connector.appToken, connector.appTokenEnv)
 				})] }) : null,
 				connector.type === "gh" ? /* @__PURE__ */ jsx(ReadonlyField, {
 					label: "poll",
@@ -6588,7 +7212,7 @@ function ConnectorsView(props) {
 				}) : null,
 				connector.type === "discord" ? /* @__PURE__ */ jsx(ReadonlyField, {
 					label: "bot-token",
-					value: connector.botToken
+					value: tokenDisplay(connector.botToken, connector.botTokenEnv)
 				}) : null,
 				connector.type === "schedule" ? /* @__PURE__ */ jsx(ReadonlyField, {
 					label: "entries",
@@ -7295,4 +7919,4 @@ async function launchTui(funnel) {
 	});
 }
 //#endregion
-export { DEFAULT_GATEWAY_TOKEN_PATH, FUNNEL_DIR, FUNNEL_MCP_COMMAND, FUNNEL_MCP_NAME, Funnel, FunnelBroadcaster, FunnelChannelPublisher, FunnelChannels, FunnelClaude, FunnelClock, FunnelConnectorFactory, FunnelConnectorListener, FunnelDotenvReader, FunnelEventLog, FunnelFileSystem, FunnelGateway, FunnelGatewayServer, FunnelGatewayToken, FunnelIdGenerator, FunnelListenerSupervisor, FunnelListenersClient, FunnelLocalConfig, FunnelLocalConfigSync, FunnelLogger, FunnelMcp, FunnelProcessRunner, FunnelProfiles, FunnelSettingsReader, FunnelSettingsStore, FunnelSlackEventProcessor, FunnelTokenPrompter, LOCAL_CONFIG_FILENAME, LOCAL_ENV_FILENAME, MemoryFunnelClock, MemoryFunnelEventLog, MemoryFunnelFileSystem, MemoryFunnelIdGenerator, MemoryFunnelLogger, MemoryFunnelProcessRunner, MemoryFunnelTokenPrompter, MockFunnelSettingsReader, NodeFunnelClock, NodeFunnelFileSystem, NodeFunnelIdGenerator, NodeFunnelLogger, NodeFunnelProcessRunner, NodeFunnelTokenPrompter, NoopFunnelLogger, SETTINGS_PATH, SETTINGS_VERSION, SqliteFunnelEventLog, channelConfigSchema, channelDeliveryModeSchema, channelSpecSchema, app as cliApp, connectorConfigSchema, connectorSpecSchema, createCliApp, createSettings, discordConnectorSchema, factory, funnelEventSchema, funnelJsonSchema, ghConnectorSchema, launchTui, localConfigSchema, profileConfigSchema, profileSpecSchema, publishRequestSchema, publishResponseSchema, queryToCliArgs, scheduleCatchupPolicySchema, scheduleConnectorSchema, scheduleEntrySchema, settingsSchema, slackConnectorSchema, startChannelServer, toRequest };
+export { CONNECTOR_CONNECTION_STATUSES, ConnectorDiagnosticLog, ConnectorDiagnosticSqlReader, DEFAULT_GATEWAY_TOKEN_PATH, FUNNEL_DIR, FUNNEL_MCP_COMMAND, FUNNEL_MCP_NAME, Funnel, FunnelBroadcaster, FunnelChannelPublisher, FunnelChannels, FunnelClaude, FunnelClock, FunnelConnectorFactory, FunnelConnectorListener, FunnelDotenvReader, FunnelEventLog, FunnelFileSystem, FunnelGateway, FunnelGatewayServer, FunnelGatewayToken, FunnelIdGenerator, FunnelListenerSupervisor, FunnelListenersClient, FunnelLocalConfig, FunnelLocalConfigSync, FunnelLogger, FunnelMcp, FunnelProcessRunner, FunnelProfiles, FunnelSettingsReader, FunnelSettingsStore, FunnelSlackEventProcessor, FunnelTokenPrompter, LOCAL_CONFIG_FILENAME, LOCAL_ENV_FILENAME, MemoryConnectorDiagnosticLog, MemoryFunnelClock, MemoryFunnelEventLog, MemoryFunnelFileSystem, MemoryFunnelIdGenerator, MemoryFunnelLogger, MemoryFunnelProcessRunner, MemoryFunnelTokenPrompter, MockFunnelSettingsReader, NodeFunnelClock, NodeFunnelFileSystem, NodeFunnelIdGenerator, NodeFunnelLogger, NodeFunnelProcessRunner, NodeFunnelTokenPrompter, NoopFunnelLogger, SETTINGS_PATH, SETTINGS_VERSION, SqliteConnectorDiagnosticLog, SqliteFunnelEventLog, channelConfigSchema, channelDeliveryModeSchema, channelSpecSchema, app as cliApp, connectorConfigSchema, connectorConnectionEventSchema, connectorProcessedEventSchema, connectorRawEventSchema, connectorSpecSchema, createCliApp, createSettings, discordConnectorSchema, factory, funnelEventSchema, funnelJsonSchema, ghConnectorSchema, launchTui, localConfigSchema, profileConfigSchema, profileSpecSchema, publishRequestSchema, publishResponseSchema, queryToCliArgs, resolveFunnelDir, scheduleCatchupPolicySchema, scheduleConnectorSchema, scheduleEntrySchema, settingsSchema, slackConnectorSchema, startChannelServer, toRequest };