@interactive-inc/claude-funnel 0.28.0 → 0.30.0

package/dist/index.d.ts

@@ -570,40 +570,14 @@ declare class FunnelClaude {
  */
 type OnFunnelError = (error: Error, context?: Record<string, unknown>) => void;
 //#endregion
-//#region lib/engine/local-config/dotenv-reader.d.ts
-type Deps$10 = {
-  fs: FunnelFileSystem;
-};
-/**
- * Minimal `.env.local` parser. Supports `KEY=value` lines, blank lines, and
- * `#` comments. Strips matching surrounding single or double quotes. No
- * interpolation, no `export` prefix — anything fancier should live in a real
- * env file loaded by the shell.
- */
-declare class FunnelDotenvReader {
-  private readonly fs;
-  constructor(deps: Deps$10);
-  read(cwd: string): Record<string, string>;
-}
-//#endregion
 //#region lib/engine/local-config/local-config-schema.d.ts
 declare const connectorSpecSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   type: z.ZodLiteral<"slack">;
   name: z.ZodString;
-  botToken: z.ZodOptional<z.ZodString>;
-  appToken: z.ZodOptional<z.ZodString>;
   minify: z.ZodOptional<z.ZodBoolean>;
-  env: z.ZodOptional<z.ZodObject<{
-    botToken: z.ZodOptional<z.ZodString>;
-    appToken: z.ZodOptional<z.ZodString>;
-  }, z.core.$strip>>;
 }, z.core.$strip>, z.ZodObject<{
   type: z.ZodLiteral<"discord">;
   name: z.ZodString;
-  botToken: z.ZodOptional<z.ZodString>;
-  env: z.ZodOptional<z.ZodObject<{
-    botToken: z.ZodOptional<z.ZodString>;
-  }, z.core.$strip>>;
 }, z.core.$strip>, z.ZodObject<{
   type: z.ZodLiteral<"gh">;
   name: z.ZodString;
@@ -618,20 +592,10 @@ declare const channelSpecSchema: z.ZodObject<{
   connectors: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
     type: z.ZodLiteral<"slack">;
     name: z.ZodString;
-    botToken: z.ZodOptional<z.ZodString>;
-    appToken: z.ZodOptional<z.ZodString>;
     minify: z.ZodOptional<z.ZodBoolean>;
-    env: z.ZodOptional<z.ZodObject<{
-      botToken: z.ZodOptional<z.ZodString>;
-      appToken: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>>;
   }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"discord">;
     name: z.ZodString;
-    botToken: z.ZodOptional<z.ZodString>;
-    env: z.ZodOptional<z.ZodObject<{
-      botToken: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>>;
   }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"gh">;
     name: z.ZodString;
@@ -651,25 +615,16 @@ declare const profileSpecSchema: z.ZodObject<{
 type ProfileSpec = z.infer<typeof profileSpecSchema>;
 declare const localConfigSchema: z.ZodObject<{
   $schema: z.ZodOptional<z.ZodString>;
+  id: z.ZodOptional<z.ZodString>;
   channels: z.ZodArray<z.ZodObject<{
     name: z.ZodString;
     connectors: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
       type: z.ZodLiteral<"slack">;
       name: z.ZodString;
-      botToken: z.ZodOptional<z.ZodString>;
-      appToken: z.ZodOptional<z.ZodString>;
       minify: z.ZodOptional<z.ZodBoolean>;
-      env: z.ZodOptional<z.ZodObject<{
-        botToken: z.ZodOptional<z.ZodString>;
-        appToken: z.ZodOptional<z.ZodString>;
-      }, z.core.$strip>>;
     }, z.core.$strip>, z.ZodObject<{
       type: z.ZodLiteral<"discord">;
       name: z.ZodString;
-      botToken: z.ZodOptional<z.ZodString>;
-      env: z.ZodOptional<z.ZodObject<{
-        botToken: z.ZodOptional<z.ZodString>;
-      }, z.core.$strip>>;
     }, z.core.$strip>, z.ZodObject<{
       type: z.ZodLiteral<"gh">;
       name: z.ZodString;
@@ -688,10 +643,9 @@ declare const localConfigSchema: z.ZodObject<{
 }, z.core.$strip>;
 type LocalConfig = z.infer<typeof localConfigSchema>;
 declare const LOCAL_CONFIG_FILENAME = "funnel.json";
-declare const LOCAL_ENV_FILENAME = ".env.local";
 //#endregion
 //#region lib/engine/local-config/local-config.d.ts
-type Deps$9 = {
+type Deps$10 = {
   fs: FunnelFileSystem;
 };
 /**
@@ -702,7 +656,7 @@ type Deps$9 = {
  */
 declare class FunnelLocalConfig {
   private readonly fs;
-  constructor(deps: Deps$9);
+  constructor(deps: Deps$10);
   read(cwd: string): LocalConfig | null;
   private assertProfilesValid;
 }
@@ -719,11 +673,9 @@ declare abstract class FunnelTokenPrompter {
 }
 //#endregion
 //#region lib/engine/local-config/local-config-sync.d.ts
-type Deps$8 = {
+type Deps$9 = {
   channels: FunnelChannels;
-  dotenv: FunnelDotenvReader;
   prompter: FunnelTokenPrompter;
-  env?: NodeJS.ProcessEnv;
 };
 type ConnectorSyncOutcome = {
   name: string;
@@ -754,11 +706,9 @@ type LocalConfigSyncResult = {
  */
 declare class FunnelLocalConfigSync {
   private readonly channels;
-  private readonly dotenv;
   private readonly prompter;
-  private readonly env;
-  constructor(deps: Deps$8);
-  ensure(channel: ChannelSpec, cwd: string): Promise<LocalConfigSyncResult>;
+  constructor(deps: Deps$9);
+  ensure(channel: ChannelSpec): Promise<LocalConfigSyncResult>;
   private ensureConnector;
   private ensureSlack;
   private ensureDiscord;
@@ -768,20 +718,33 @@ declare class FunnelLocalConfigSync {
   private findExistingDiscord;
   private removeExtras;
   /**
-   * Decides how a single token slot is stored in settings.json:
-   *
-   *   - `env.<field>` reference → `{ tokenEnv: "<VAR>" }`; the secret is NOT
-   *     resolved into settings, it stays in the environment / `.env.local` and
-   *     the listener resolves it at start. We still assert the var is set so a
-   *     typo fails loudly here instead of as a dead listener later.
-   *   - literal → `{ token: "<secret>" }`.
-   *   - neither, but a prior value exists → carry it over verbatim (whichever
-   *     form it already was), so a tokenless re-sync is a no-op.
-   *   - nothing at all → prompt for a literal (TTY only; throws otherwise).
+   * Decides how a single token slot is stored in settings.json. funnel.json
+   * never carries tokens, so the only sources are a value already in
+   * settings.json (carried over verbatim, whichever form it was — literal or an
+   * `env`-var reference set via the CLI) or, on first sync, a TTY prompt for a
+   * literal (throws when stdin is not a TTY). Either way the secret lands in the
+   * repo-scoped settings, never in the repo itself.
    */
   private resolveSlot;
 }
 //#endregion
+//#region lib/engine/local-config/local-config-writer.d.ts
+type Deps$8 = {
+  fs: FunnelFileSystem;
+};
+/**
+ * The one path that mutates the repo-committed funnel.json, and it only ever
+ * inserts `id`. On first launch a repo has no `id`; funnel generates one and
+ * writes it back here so future launches resolve the same `~/.funnel/projects/<id>/`.
+ * Idempotent — a no-op once `id` is present. Kept separate from the read-only
+ * FunnelLocalConfig so reads stay side-effect free.
+ */
+declare class FunnelLocalConfigWriter {
+  private readonly fs;
+  constructor(deps: Deps$8);
+  ensureId(cwd: string, id: string): void;
+}
+//#endregion
 //#region lib/gateway/publish-schema.d.ts
 /**
  * Shared schema for `POST /channels/:channel/publish` — used by both the
@@ -1159,7 +1122,8 @@ declare class FunnelGateway {
 type Deps$3 = {
   channels: FunnelChannels;
   settings: FunnelSettingsReader;
-  port?: number; /** SQLite event store file path. Parent directory is created on demand. Defaults to `<os.tmpdir()>/funnel/events.db`. Ignored when `eventLog` is supplied. */
+  port?: number; /** Bind address for `Bun.serve`. Defaults to `127.0.0.1` (loopback only). Set to `0.0.0.0` to expose on the network. */
+  hostname?: string; /** SQLite event store file path. Parent directory is created on demand. Defaults to `<os.tmpdir()>/funnel/events.db`. Ignored when `eventLog` is supplied. */
   dbPath?: string; /** Durable replay log. Defaults to a `SqliteFunnelEventLog` at `dbPath`. Inject a `MemoryFunnelEventLog` (or any `FunnelEventLog`) to swap or disable persistence. */
   eventLog?: FunnelEventLog;
   process?: FunnelProcessRunner;
@@ -1200,6 +1164,7 @@ declare class FunnelGatewayServer {
   private readonly channels;
   private readonly settings;
   private readonly port;
+  private readonly hostname;
   private readonly dbPath;
   private readonly process?;
   private readonly logger;
@@ -1450,8 +1415,8 @@ declare class Funnel {
   get profiles(): FunnelProfiles;
   /** Reads `funnel.json` from a cwd. `fnl claude` consults it before falling back to the default profile. */
   get localConfig(): FunnelLocalConfig;
-  /** Parses `.env.local` from a cwd (used by sync to back $VAR references). */
-  get dotenv(): FunnelDotenvReader;
+  /** Writes the stable `id` into funnel.json on first launch so state can be scoped to `~/.funnel/projects/<id>/`. */
+  get localConfigWriter(): FunnelLocalConfigWriter;
   /** Secret prompter. Defaults to a TTY-only stdin reader; tests inject MemoryFunnelTokenPrompter. */
   get tokenPrompter(): FunnelTokenPrompter;
   /** Reconciles funnel.json's channel + connectors with `~/.funnel/settings.json` on launch. */
@@ -1482,7 +1447,8 @@ declare class Funnel {
    * useful for tests, embedding, or custom hosts.
    */
   gatewayServer(options?: {
-    port?: number;
+    port?: number; /** Bind address. Defaults to `127.0.0.1` (loopback only). Set to `0.0.0.0` to expose on the network. */
+    hostname?: string;
     dbPath?: string;
     killCompetingSlack?: boolean; /** Override the auth token. Defaults to the persisted gateway.token. Pass "" to disable auth (tests). */
     token?: string; /** Durable replay log. Defaults to a SqliteFunnelEventLog at dbPath; inject a MemoryFunnelEventLog (or any FunnelEventLog) to swap or disable persistence. */
@@ -1843,6 +1809,7 @@ declare class MemoryFunnelEventLog extends FunnelEventLog {
   record(record: FunnelEventRecord): void;
   loadSince(since: number): ReplayableEvent[];
   findMaxOffset(): number;
+  clear(): void;
   close(): void;
 }
 //#endregion
@@ -1917,6 +1884,7 @@ declare class MemoryConnectorDiagnosticLog extends ConnectorDiagnosticLog {
   queryRaw(query: ConnectorRawQuery): StoredRawEvent[];
   queryProcessed(query: ConnectorProcessedQuery): StoredProcessedEvent[];
   queryConnection(query: ConnectorConnectionQuery): StoredConnectionEvent[];
+  clear(): void;
   close(): void;
 }
 //#endregion
@@ -4613,4 +4581,4 @@ ${string}`;
 //#region lib/tui/tui.d.ts
 declare function launchTui(funnel: Funnel): Promise<void>;
 //#endregion
-export { AliveStub, AttachOptions, BroadcastEvent, BroadcastSubscriber, CONNECTOR_CONNECTION_STATUSES, ChannelConfig, ChannelConnectorView, ChannelDeliveryMode, ChannelServerOptions, ChannelSpec, ConnectorConfig, ConnectorConnectionEvent, ConnectorConnectionQuery, ConnectorConnectionRecord, ConnectorConnectionStatus, ConnectorDiagnosticLog, ConnectorDiagnosticSqlReader, ConnectorProcessedEvent, ConnectorProcessedQuery, ConnectorProcessedRecord, ConnectorQuery, ConnectorRawEvent, ConnectorRawQuery, ConnectorRawRecord, ConnectorSpec, ConnectorSyncOutcome, ConnectorType, DEFAULT_GATEWAY_TOKEN_PATH, DetachOptions, DiscordConnectorConfig, Env, FUNNEL_DIR, FUNNEL_MCP_COMMAND, FUNNEL_MCP_NAME, FileStat, Funnel, FunnelBroadcaster, FunnelChannelPublisher, FunnelChannels, FunnelClaude, FunnelClock, FunnelConnectorFactory, FunnelConnectorListener, FunnelDotenvReader, FunnelEvent, FunnelEventLog, FunnelEventRecord, FunnelFileSystem, FunnelGateway, FunnelGatewayServer, FunnelGatewayToken, FunnelIdGenerator, FunnelListenerSupervisor, FunnelListenersClient, FunnelLocalConfig, FunnelLocalConfigSync, FunnelLogger, FunnelMcp, FunnelProcessRunner, FunnelProfiles, FunnelSettingsReader, FunnelSettingsStore, FunnelSlackEventProcessor, FunnelTokenPrompter, type GatewayEmitInput, type GatewayRouteDeps, type Env$1 as GatewayServerEnv, GhConnectorConfig, LOCAL_CONFIG_FILENAME, LOCAL_ENV_FILENAME, LaunchOptions, ListListenersResult, ListenerEntry, ListenerOpResult, LocalConfig, LocalConfigSyncResult, LogEntry, MemoryConnectorDiagnosticLog, MemoryFunnelClock, MemoryFunnelEventLog, MemoryFunnelFileSystem, MemoryFunnelIdGenerator, MemoryFunnelLogger, MemoryFunnelProcessRunner, MemoryFunnelTokenPrompter, MemoryProcessCall, MemoryProcessHandler, MemoryProcessResponse, MemoryProcessSyncHandler, MockFunnelSettingsReader, NodeFunnelClock, NodeFunnelFileSystem, NodeFunnelIdGenerator, NodeFunnelLogger, NodeFunnelProcessRunner, NodeFunnelTokenPrompter, NoopFunnelLogger, NotifyFn, OnFunnelError, ProcessListStub, ProcessSnapshot, ProfileConfig, ProfileSpec, PublishRequest, PublishResponse, PublishResult, ReplayableEvent, RunOptions, RunResult, SETTINGS_PATH, SETTINGS_VERSION, ScheduleCatchupPolicy, ScheduleConnectorConfig, ScheduleEntry, ScheduleListenerOptions, Settings, SlackConnectorConfig, SlackListenerOptions, SlackProcessed, SlackProcessedEmit, SlackProcessedSkip, SlackRawEvent, SlackSkipReason, SqliteConnectorDiagnosticLog, SqliteFunnelEventLog, StoredConnectionEvent, StoredProcessedEvent, StoredRawEvent, channelConfigSchema, channelDeliveryModeSchema, channelSpecSchema, app as cliApp, connectorConfigSchema, connectorConnectionEventSchema, connectorProcessedEventSchema, connectorRawEventSchema, connectorSpecSchema, createCliApp, createSettings, discordConnectorSchema, factory, funnelEventSchema, funnelJsonSchema, ghConnectorSchema, launchTui, localConfigSchema, profileConfigSchema, profileSpecSchema, publishRequestSchema, publishResponseSchema, queryToCliArgs, resolveFunnelDir, scheduleCatchupPolicySchema, scheduleConnectorSchema, scheduleEntrySchema, settingsSchema, slackConnectorSchema, startChannelServer, toRequest };
+export { AliveStub, AttachOptions, BroadcastEvent, BroadcastSubscriber, CONNECTOR_CONNECTION_STATUSES, ChannelConfig, ChannelConnectorView, ChannelDeliveryMode, ChannelServerOptions, ChannelSpec, ConnectorConfig, ConnectorConnectionEvent, ConnectorConnectionQuery, ConnectorConnectionRecord, ConnectorConnectionStatus, ConnectorDiagnosticLog, ConnectorDiagnosticSqlReader, ConnectorProcessedEvent, ConnectorProcessedQuery, ConnectorProcessedRecord, ConnectorQuery, ConnectorRawEvent, ConnectorRawQuery, ConnectorRawRecord, ConnectorSpec, ConnectorSyncOutcome, ConnectorType, DEFAULT_GATEWAY_TOKEN_PATH, DetachOptions, DiscordConnectorConfig, Env, FUNNEL_DIR, FUNNEL_MCP_COMMAND, FUNNEL_MCP_NAME, FileStat, Funnel, FunnelBroadcaster, FunnelChannelPublisher, FunnelChannels, FunnelClaude, FunnelClock, FunnelConnectorFactory, FunnelConnectorListener, FunnelEvent, FunnelEventLog, FunnelEventRecord, FunnelFileSystem, FunnelGateway, FunnelGatewayServer, FunnelGatewayToken, FunnelIdGenerator, FunnelListenerSupervisor, FunnelListenersClient, FunnelLocalConfig, FunnelLocalConfigSync, FunnelLocalConfigWriter, FunnelLogger, FunnelMcp, FunnelProcessRunner, FunnelProfiles, FunnelSettingsReader, FunnelSettingsStore, FunnelSlackEventProcessor, FunnelTokenPrompter, type GatewayEmitInput, type GatewayRouteDeps, type Env$1 as GatewayServerEnv, GhConnectorConfig, LOCAL_CONFIG_FILENAME, LaunchOptions, ListListenersResult, ListenerEntry, ListenerOpResult, LocalConfig, LocalConfigSyncResult, LogEntry, MemoryConnectorDiagnosticLog, MemoryFunnelClock, MemoryFunnelEventLog, MemoryFunnelFileSystem, MemoryFunnelIdGenerator, MemoryFunnelLogger, MemoryFunnelProcessRunner, MemoryFunnelTokenPrompter, MemoryProcessCall, MemoryProcessHandler, MemoryProcessResponse, MemoryProcessSyncHandler, MockFunnelSettingsReader, NodeFunnelClock, NodeFunnelFileSystem, NodeFunnelIdGenerator, NodeFunnelLogger, NodeFunnelProcessRunner, NodeFunnelTokenPrompter, NoopFunnelLogger, NotifyFn, OnFunnelError, ProcessListStub, ProcessSnapshot, ProfileConfig, ProfileSpec, PublishRequest, PublishResponse, PublishResult, ReplayableEvent, RunOptions, RunResult, SETTINGS_PATH, SETTINGS_VERSION, ScheduleCatchupPolicy, ScheduleConnectorConfig, ScheduleEntry, ScheduleListenerOptions, Settings, SlackConnectorConfig, SlackListenerOptions, SlackProcessed, SlackProcessedEmit, SlackProcessedSkip, SlackRawEvent, SlackSkipReason, SqliteConnectorDiagnosticLog, SqliteFunnelEventLog, StoredConnectionEvent, StoredProcessedEvent, StoredRawEvent, channelConfigSchema, channelDeliveryModeSchema, channelSpecSchema, app as cliApp, connectorConfigSchema, connectorConnectionEventSchema, connectorProcessedEventSchema, connectorRawEventSchema, connectorSpecSchema, createCliApp, createSettings, discordConnectorSchema, factory, funnelEventSchema, funnelJsonSchema, ghConnectorSchema, launchTui, localConfigSchema, profileConfigSchema, profileSpecSchema, publishRequestSchema, publishResponseSchema, queryToCliArgs, resolveFunnelDir, scheduleCatchupPolicySchema, scheduleConnectorSchema, scheduleEntrySchema, settingsSchema, slackConnectorSchema, startChannelServer, toRequest };

package/dist/index.js

@@ -187,7 +187,7 @@ var FunnelSettingsStore = class extends FunnelSettingsReader {
 			...settings,
 			version: 1
 		};
-		this.fs.writeFileSync(this.path, `${JSON.stringify(versioned, null, 2)}\n`);
+		this.fs.writeSecretFileSync(this.path, `${JSON.stringify(versioned, null, 2)}\n`);
 	}
 };
 //#endregion
@@ -887,8 +887,9 @@ var MemoryFunnelIdGenerator = class extends FunnelIdGenerator {
 * `fnl claude` reads this when no global --profile preset is used. It picks one
 * of the declared channels (`--channel <name>` selects by name; otherwise the
 * first entry wins) and materializes its transport (connectors / delivery) into
-* `~/.funnel/settings.json` on launch — token fields in connectors resolve via
-* literal / `env.<field>` / TTY prompt.
+* the repo's scoped settings (`~/.funnel/projects/<id>/settings.json`) on launch.
+* Connectors carry no tokens here — a token absent from settings is prompted for
+* at launch (TTY) and saved there, never in the repo.
 *
 * The launch recipe (`options` / `env` / `resume`) lives on `profiles[]`, not on
 * the channel: a channel only describes where events come from. `fnl claude`
@@ -896,25 +897,15 @@ var MemoryFunnelIdGenerator = class extends FunnelIdGenerator {
 * straight to the launcher and is not persisted into the global profile list.
 * These profiles are selected by their `channel` binding, not by name.
 */
-const slackEnvSchema = z.object({
-	botToken: z.string().optional(),
-	appToken: z.string().optional()
-}).optional();
 const slackConnectorSpecSchema = z.object({
 	type: z.literal("slack"),
 	name: z.string(),
-	botToken: z.string().optional(),
-	appToken: z.string().optional(),
 	/** Shrink raw Slack events before fanout. Defaults to true. */
-	minify: z.boolean().optional(),
-	env: slackEnvSchema
+	minify: z.boolean().optional()
 });
-const discordEnvSchema = z.object({ botToken: z.string().optional() }).optional();
 const discordConnectorSpecSchema = z.object({
 	type: z.literal("discord"),
-	name: z.string(),
-	botToken: z.string().optional(),
-	env: discordEnvSchema
+	name: z.string()
 });
 const ghConnectorSpecSchema = z.object({
 	type: z.literal("gh"),
@@ -952,54 +943,18 @@ const profileSpecSchema = z.object({
 });
 const localConfigSchema = z.object({
 	$schema: z.string().optional(),
+	/**
+	* Stable per-repo identifier. funnel writes this on first launch when absent;
+	* all funnel state for this repo lives under `~/.funnel/projects/<id>/`, so the
+	* repo itself never holds settings or tokens. Committed alongside funnel.json.
+	*/
+	id: z.string().optional(),
 	/** Declared channels (transport only). First entry is the default; --channel <name> selects by name. */
 	channels: z.array(channelSpecSchema).min(1),
 	/** Launch presets bound to a channel. First entry bound to the chosen channel is the default. */
 	profiles: z.array(profileSpecSchema).optional()
 });
 const LOCAL_CONFIG_FILENAME = "funnel.json";
-const LOCAL_ENV_FILENAME = ".env.local";
-//#endregion
-//#region lib/engine/local-config/dotenv-reader.ts
-const VARIABLE_LINE = /^\s*([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*?)\s*$/;
-const unquote = (value) => {
-	if (value.length < 2) return value;
-	const first = value[0];
-	const last = value[value.length - 1];
-	if (first === "\"" && last === "\"") return value.slice(1, -1);
-	if (first === "'" && last === "'") return value.slice(1, -1);
-	return value;
-};
-/**
-* Minimal `.env.local` parser. Supports `KEY=value` lines, blank lines, and
-* `#` comments. Strips matching surrounding single or double quotes. No
-* interpolation, no `export` prefix — anything fancier should live in a real
-* env file loaded by the shell.
-*/
-var FunnelDotenvReader = class {
-	fs;
-	constructor(deps) {
-		this.fs = deps.fs;
-		Object.freeze(this);
-	}
-	read(cwd) {
-		const path = join(cwd, LOCAL_ENV_FILENAME);
-		if (!this.fs.existsSync(path)) return {};
-		const raw = this.fs.readFileSync(path);
-		const out = {};
-		for (const line of raw.split("\n")) {
-			const trimmed = line.trim();
-			if (trimmed === "" || trimmed.startsWith("#")) continue;
-			const match = trimmed.match(VARIABLE_LINE);
-			if (!match) continue;
-			const key = match[1];
-			const value = match[2];
-			if (!key) continue;
-			out[key] = unquote(value ?? "");
-		}
-		return out;
-	}
-};
 //#endregion
 //#region lib/engine/local-config/local-config.ts
 /**
@@ -1075,27 +1030,22 @@ var FunnelTokenPrompter = class {};
 */
 var FunnelLocalConfigSync = class {
 	channels;
-	dotenv;
 	prompter;
-	env;
 	constructor(deps) {
 		this.channels = deps.channels;
-		this.dotenv = deps.dotenv;
 		this.prompter = deps.prompter;
-		this.env = deps.env ?? process.env;
 		Object.freeze(this);
 	}
-	async ensure(channel, cwd) {
+	async ensure(channel) {
 		if (!this.channels.get(channel.name)) this.channels.add({ name: channel.name });
 		if (channel.connectors === void 0) return {
 			touched: [],
 			removed: []
 		};
-		const dotenv = this.dotenv.read(cwd);
 		const touched = [];
 		const touchedIds = /* @__PURE__ */ new Set();
 		for (const spec of channel.connectors) {
-			const outcome = await this.ensureConnector(channel.name, spec, dotenv);
+			const outcome = await this.ensureConnector(channel.name, spec);
 			touched.push({
 				name: outcome.name,
 				changed: outcome.changed
@@ -1107,26 +1057,20 @@ var FunnelLocalConfigSync = class {
 			removed: this.removeExtras(channel.name, touchedIds)
 		};
 	}
-	async ensureConnector(channelName, spec, dotenv) {
-		if (spec.type === "slack") return await this.ensureSlack(channelName, spec, dotenv);
-		if (spec.type === "discord") return await this.ensureDiscord(channelName, spec, dotenv);
+	async ensureConnector(channelName, spec) {
+		if (spec.type === "slack") return await this.ensureSlack(channelName, spec);
+		if (spec.type === "discord") return await this.ensureDiscord(channelName, spec);
 		if (spec.type === "gh") return this.ensureGh(channelName, spec);
 		return this.ensureSchedule(channelName, spec);
 	}
-	async ensureSlack(channelName, spec, dotenv) {
+	async ensureSlack(channelName, spec) {
 		const byName = this.findExistingSlack(channelName, spec.name);
 		const bot = await this.resolveSlot({
-			literal: spec.botToken,
-			envVar: spec.env?.botToken,
-			dotenv,
 			label: `${spec.name}.botToken`,
 			existingLiteral: byName?.botToken,
 			existingEnv: byName?.botTokenEnv
 		});
 		const app = await this.resolveSlot({
-			literal: spec.appToken,
-			envVar: spec.env?.appToken,
-			dotenv,
 			label: `${spec.name}.appToken`,
 			existingLiteral: byName?.appToken,
 			existingEnv: byName?.appTokenEnv
@@ -1163,12 +1107,9 @@ var FunnelLocalConfigSync = class {
 			changed: true
 		};
 	}
-	async ensureDiscord(channelName, spec, dotenv) {
+	async ensureDiscord(channelName, spec) {
 		const byName = this.findExistingDiscord(channelName, spec.name);
 		const bot = await this.resolveSlot({
-			literal: spec.botToken,
-			envVar: spec.env?.botToken,
-			dotenv,
 			label: `${spec.name}.botToken`,
 			existingLiteral: byName?.botToken,
 			existingEnv: byName?.botTokenEnv
@@ -1267,30 +1208,14 @@ var FunnelLocalConfigSync = class {
 		return stale.map((c) => c.name);
 	}
 	/**
-	* Decides how a single token slot is stored in settings.json:
-	*
-	*   - `env.<field>` reference → `{ tokenEnv: "<VAR>" }`; the secret is NOT
-	*     resolved into settings, it stays in the environment / `.env.local` and
-	*     the listener resolves it at start. We still assert the var is set so a
-	*     typo fails loudly here instead of as a dead listener later.
-	*   - literal → `{ token: "<secret>" }`.
-	*   - neither, but a prior value exists → carry it over verbatim (whichever
-	*     form it already was), so a tokenless re-sync is a no-op.
-	*   - nothing at all → prompt for a literal (TTY only; throws otherwise).
+	* Decides how a single token slot is stored in settings.json. funnel.json
+	* never carries tokens, so the only sources are a value already in
+	* settings.json (carried over verbatim, whichever form it was — literal or an
+	* `env`-var reference set via the CLI) or, on first sync, a TTY prompt for a
+	* literal (throws when stdin is not a TTY). Either way the secret lands in the
+	* repo-scoped settings, never in the repo itself.
 	*/
 	async resolveSlot(input) {
-		if (input.literal !== void 0 && input.envVar !== void 0) throw new Error(`${input.label} is set both as a literal and as env.${input.label.split(".").pop()}; pick one`);
-		if (input.envVar !== void 0 && input.envVar !== "") {
-			if (!this.env[input.envVar] && !input.dotenv[input.envVar]) throw new Error(`${input.label} references env var "${input.envVar}" but it is not set in process env or .env.local`);
-			return {
-				token: void 0,
-				tokenEnv: input.envVar
-			};
-		}
-		if (input.literal !== void 0 && input.literal !== "") return {
-			token: input.literal,
-			tokenEnv: void 0
-		};
 		if (input.existingEnv !== void 0) return {
 			token: void 0,
 			tokenEnv: input.existingEnv
@@ -1306,6 +1231,44 @@ var FunnelLocalConfigSync = class {
 	}
 };
 //#endregion
+//#region lib/engine/local-config/local-config-writer.ts
+const isRecord = (value) => {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+};
+const withIdFirst = (config, id) => {
+	const ordered = {};
+	if (config.$schema !== void 0) ordered.$schema = config.$schema;
+	ordered.id = id;
+	for (const key of Object.keys(config)) {
+		if (key === "$schema" || key === "id") continue;
+		ordered[key] = config[key];
+	}
+	return ordered;
+};
+/**
+* The one path that mutates the repo-committed funnel.json, and it only ever
+* inserts `id`. On first launch a repo has no `id`; funnel generates one and
+* writes it back here so future launches resolve the same `~/.funnel/projects/<id>/`.
+* Idempotent — a no-op once `id` is present. Kept separate from the read-only
+* FunnelLocalConfig so reads stay side-effect free.
+*/
+var FunnelLocalConfigWriter = class {
+	fs;
+	constructor(deps) {
+		this.fs = deps.fs;
+		Object.freeze(this);
+	}
+	ensureId(cwd, id) {
+		const path = join(cwd, LOCAL_CONFIG_FILENAME);
+		if (!this.fs.existsSync(path)) return;
+		const parsed = JSON.parse(this.fs.readFileSync(path));
+		if (!isRecord(parsed)) return;
+		if (typeof parsed.id === "string" && parsed.id !== "") return;
+		const ordered = withIdFirst(parsed, id);
+		this.fs.writeFileSync(path, `${JSON.stringify(ordered, null, 2)}\n`);
+	}
+};
+//#endregion
 //#region lib/engine/logger/memory-logger.ts
 var MemoryFunnelLogger = class extends FunnelLogger {
 	file = null;
@@ -3084,6 +3047,13 @@ const gatewayRoutes = factory$1.createApp().get("/health", ...healthHandler).get
 //#endregion
 //#region lib/gateway/gateway-server.ts
 const DEFAULT_PORT = 9742;
+const DEFAULT_HOST = "127.0.0.1";
+const LOOPBACK_HOSTS = new Set([
+	"127.0.0.1",
+	"localhost",
+	"::1",
+	"::ffff:127.0.0.1"
+]);
 const defaultDbPath = () => join(funnelTmpDir(), "events.db");
 const defaultOnError = () => {};
 /**
@@ -3100,6 +3070,7 @@ var FunnelGatewayServer = class {
 	channels;
 	settings;
 	port;
+	hostname;
 	dbPath;
 	process;
 	logger;
@@ -3119,6 +3090,7 @@ var FunnelGatewayServer = class {
 		this.channels = deps.channels;
 		this.settings = deps.settings;
 		this.port = deps.port ?? DEFAULT_PORT;
+		this.hostname = deps.hostname ?? DEFAULT_HOST;
 		this.dbPath = deps.dbPath ?? defaultDbPath();
 		this.process = deps.process;
 		this.logger = deps.logger;
@@ -3163,10 +3135,12 @@ var FunnelGatewayServer = class {
 	}
 	async start() {
 		if (this.server) return this.server;
+		if (!this.token && !LOOPBACK_HOSTS.has(this.hostname)) this.logger?.warn("gateway auth is disabled on a non-loopback bind — every endpoint is reachable without a token", { hostname: this.hostname });
 		const app = this.buildApp();
 		this.startedAt = this.nowMs();
 		this.server = Bun.serve({
 			port: this.port,
+			hostname: this.hostname,
 			development: false,
 			fetch: (request, server) => this.handleFetch(request, server, app),
 			websocket: {
@@ -3670,10 +3644,10 @@ var Funnel = class Funnel {
 		if (!this.memos.localConfig) this.memos.localConfig = new FunnelLocalConfig({ fs: this.fs });
 		return this.memos.localConfig;
 	}
-	/** Parses `.env.local` from a cwd (used by sync to back $VAR references). */
-	get dotenv() {
-		if (!this.memos.dotenv) this.memos.dotenv = new FunnelDotenvReader({ fs: this.fs });
-		return this.memos.dotenv;
+	/** Writes the stable `id` into funnel.json on first launch so state can be scoped to `~/.funnel/projects/<id>/`. */
+	get localConfigWriter() {
+		if (!this.memos.localConfigWriter) this.memos.localConfigWriter = new FunnelLocalConfigWriter({ fs: this.fs });
+		return this.memos.localConfigWriter;
 	}
 	/** Secret prompter. Defaults to a TTY-only stdin reader; tests inject MemoryFunnelTokenPrompter. */
 	get tokenPrompter() {
@@ -3684,7 +3658,6 @@ var Funnel = class Funnel {
 	get localConfigSync() {
 		if (!this.memos.localConfigSync) this.memos.localConfigSync = new FunnelLocalConfigSync({
 			channels: this.channels,
-			dotenv: this.dotenv,
 			prompter: this.tokenPrompter
 		});
 		return this.memos.localConfigSync;
@@ -3772,6 +3745,7 @@ var Funnel = class Funnel {
 			channels: this.channels,
 			settings: this.store,
 			port: options.port,
+			hostname: options.hostname,
 			dbPath: options.dbPath,
 			eventLog: options.eventLog,
 			process: this.process,
@@ -4080,6 +4054,9 @@ var MemoryFunnelEventLog = class extends FunnelEventLog {
 		for (const event of this.events) if (event.offset > max) max = event.offset;
 		return max;
 	}
+	clear() {
+		this.events.length = 0;
+	}
 	close() {}
 };
 //#endregion
@@ -4488,6 +4465,11 @@ var MemoryConnectorDiagnosticLog = class extends ConnectorDiagnosticLog {
 			return true;
 		}), query.limit);
 	}
+	clear() {
+		this.raws.length = 0;
+		this.processeds.length = 0;
+		this.connections.length = 0;
+	}
 	close() {}
 };
 const matches$1 = (event, query) => {
@@ -5132,7 +5114,7 @@ const claudeHandler = factory.createHandlers(zValidator$1("query", z.object({
 	if (local) {
 		const picked = query.channel !== void 0 ? local.channels.find((c) => c.name === query.channel) : local.channels[0];
 		if (!picked) throw new HTTPException(404, { message: query.channel ? `channel "${query.channel}" is not declared in funnel.json` : `funnel.json declares no channels` });
-		const synced = await funnel.localConfigSync.ensure(picked, cwd);
+		const synced = await funnel.localConfigSync.ensure(picked);
 		for (const outcome of synced.touched) if (outcome.changed) await funnel.listeners.restart(picked.name, outcome.name);
 		else await funnel.listeners.start(picked.name, outcome.name);
 		for (const name of synced.removed) await funnel.listeners.stop(picked.name, name);
@@ -7972,4 +7954,4 @@ async function launchTui(funnel) {
 	});
 }
 //#endregion
-export { CONNECTOR_CONNECTION_STATUSES, ConnectorDiagnosticLog, ConnectorDiagnosticSqlReader, DEFAULT_GATEWAY_TOKEN_PATH, FUNNEL_DIR, FUNNEL_MCP_COMMAND, FUNNEL_MCP_NAME, Funnel, FunnelBroadcaster, FunnelChannelPublisher, FunnelChannels, FunnelClaude, FunnelClock, FunnelConnectorFactory, FunnelConnectorListener, FunnelDotenvReader, FunnelEventLog, FunnelFileSystem, FunnelGateway, FunnelGatewayServer, FunnelGatewayToken, FunnelIdGenerator, FunnelListenerSupervisor, FunnelListenersClient, FunnelLocalConfig, FunnelLocalConfigSync, FunnelLogger, FunnelMcp, FunnelProcessRunner, FunnelProfiles, FunnelSettingsReader, FunnelSettingsStore, FunnelSlackEventProcessor, FunnelTokenPrompter, LOCAL_CONFIG_FILENAME, LOCAL_ENV_FILENAME, MemoryConnectorDiagnosticLog, MemoryFunnelClock, MemoryFunnelEventLog, MemoryFunnelFileSystem, MemoryFunnelIdGenerator, MemoryFunnelLogger, MemoryFunnelProcessRunner, MemoryFunnelTokenPrompter, MockFunnelSettingsReader, NodeFunnelClock, NodeFunnelFileSystem, NodeFunnelIdGenerator, NodeFunnelLogger, NodeFunnelProcessRunner, NodeFunnelTokenPrompter, NoopFunnelLogger, SETTINGS_PATH, SETTINGS_VERSION, SqliteConnectorDiagnosticLog, SqliteFunnelEventLog, channelConfigSchema, channelDeliveryModeSchema, channelSpecSchema, app as cliApp, connectorConfigSchema, connectorConnectionEventSchema, connectorProcessedEventSchema, connectorRawEventSchema, connectorSpecSchema, createCliApp, createSettings, discordConnectorSchema, factory, funnelEventSchema, funnelJsonSchema, ghConnectorSchema, launchTui, localConfigSchema, profileConfigSchema, profileSpecSchema, publishRequestSchema, publishResponseSchema, queryToCliArgs, resolveFunnelDir, scheduleCatchupPolicySchema, scheduleConnectorSchema, scheduleEntrySchema, settingsSchema, slackConnectorSchema, startChannelServer, toRequest };
+export { CONNECTOR_CONNECTION_STATUSES, ConnectorDiagnosticLog, ConnectorDiagnosticSqlReader, DEFAULT_GATEWAY_TOKEN_PATH, FUNNEL_DIR, FUNNEL_MCP_COMMAND, FUNNEL_MCP_NAME, Funnel, FunnelBroadcaster, FunnelChannelPublisher, FunnelChannels, FunnelClaude, FunnelClock, FunnelConnectorFactory, FunnelConnectorListener, FunnelEventLog, FunnelFileSystem, FunnelGateway, FunnelGatewayServer, FunnelGatewayToken, FunnelIdGenerator, FunnelListenerSupervisor, FunnelListenersClient, FunnelLocalConfig, FunnelLocalConfigSync, FunnelLocalConfigWriter, FunnelLogger, FunnelMcp, FunnelProcessRunner, FunnelProfiles, FunnelSettingsReader, FunnelSettingsStore, FunnelSlackEventProcessor, FunnelTokenPrompter, LOCAL_CONFIG_FILENAME, MemoryConnectorDiagnosticLog, MemoryFunnelClock, MemoryFunnelEventLog, MemoryFunnelFileSystem, MemoryFunnelIdGenerator, MemoryFunnelLogger, MemoryFunnelProcessRunner, MemoryFunnelTokenPrompter, MockFunnelSettingsReader, NodeFunnelClock, NodeFunnelFileSystem, NodeFunnelIdGenerator, NodeFunnelLogger, NodeFunnelProcessRunner, NodeFunnelTokenPrompter, NoopFunnelLogger, SETTINGS_PATH, SETTINGS_VERSION, SqliteConnectorDiagnosticLog, SqliteFunnelEventLog, channelConfigSchema, channelDeliveryModeSchema, channelSpecSchema, app as cliApp, connectorConfigSchema, connectorConnectionEventSchema, connectorProcessedEventSchema, connectorRawEventSchema, connectorSpecSchema, createCliApp, createSettings, discordConnectorSchema, factory, funnelEventSchema, funnelJsonSchema, ghConnectorSchema, launchTui, localConfigSchema, profileConfigSchema, profileSpecSchema, publishRequestSchema, publishResponseSchema, queryToCliArgs, resolveFunnelDir, scheduleCatchupPolicySchema, scheduleConnectorSchema, scheduleEntrySchema, settingsSchema, slackConnectorSchema, startChannelServer, toRequest };