@lanes-sh/link 0.1.2 → 0.2.0

package/README.md

@@ -1,5 +1,9 @@
 # Lanes Link
 
+[![npm version](https://img.shields.io/npm/v/%40lanes-sh%2Flink?style=flat-square&color=black&label=npm)](https://www.npmjs.com/package/@lanes-sh/link)
+[![license Apache-2.0](https://img.shields.io/github/license/lanes-sh/link?style=flat-square&color=black)](LICENSE)
+[![ci](https://img.shields.io/github/actions/workflow/status/lanes-sh/link/ci.yml?branch=main&style=flat-square&label=ci)](https://github.com/lanes-sh/link/actions/workflows/ci.yml)
+
 **One secure endpoint between your AI agents and all your connections, memory, skills, and secrets.**
 
 Connect your mail, calendar, files, and notes once, and add the memory and skills that only you
@@ -93,13 +97,17 @@ One command per account. Run it again to add a second mailbox, a second calendar
 | iCloud Drive | `lanes link connect icloud_drive` |
 | Notion | `lanes link connect notion` |
 | Linear | `lanes link connect linear` |
+| GitHub | `lanes link connect github` |
+| Slack | `lanes link connect slack` |
 | Gmail (Google MCP) | `lanes link connect gmail_mcp` |
 | Drive (Google MCP) | `lanes link connect drive_mcp` |
 
-Two things worth knowing up front: `lanes link connect icloud` sets up Mail, Calendar, and Contacts
-together, because one app-specific password covers all three. And Google needs no OAuth client of
-your own: `lanes link connect gmail` authorises against the one Lanes operates, so there is no
-Cloud console to visit. Add `--own-client` if you would rather register your own.
+Three things worth knowing up front. `lanes link connect icloud` sets up Mail, Calendar, and
+Contacts together, because one app-specific password covers all three. Google needs no OAuth client
+of your own: `lanes link connect gmail` authorises against the one Lanes operates, so there is no
+Cloud console to visit — add `--own-client` if you would rather register your own. And GitHub and
+Slack take a token you paste rather than a browser sign-in, because neither will register a client
+for us; for Slack that means creating a Slack app once, which is the one console visit left here.
 
 Full guide — what each one gives your agent, what it needs, and adding your own:
 **[docs/connect.md](docs/connect.md)**.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lanes-sh/link",
-  "version": "0.1.2",
+  "version": "0.2.0",
   "description": "A self-hostable MCP gateway for all your connections, memory, skills, and secrets",
   "license": "Apache-2.0",
   "homepage": "https://lanes.sh/link",

package/src/cli/commands/connect/authorise.ts

@@ -21,7 +21,14 @@ import { ensureOAuthApp } from './setup.ts';
  * nothing and the manifest has to name its endpoints.
  */
 
-export function oauthProviderFor(
+/**
+ * No longer exported. `#cli` used to reach for this to answer "what token does
+ * this manifest authenticate with", which is a question the auth component
+ * owns — and answering it here is what let a `bearer` manifest slip through
+ * returning null. `bearerTokenAsStored` is the answer now; this builds the
+ * provider for the browser flow below, which is the one thing it is for.
+ */
+function oauthProviderFor(
   manifest: ProviderManifest,
   connectionId: string,
   credentials: SecretStore,

package/src/cli/commands/connect/index.ts

@@ -1,4 +1,5 @@
 import { createMcpConnector } from '#connectivity/transports';
+import { bearerTokenAsStored } from '#connectivity/auth/index.ts';
 import type { DiscoveredCapability } from '#connectivity';
 import { credentialRefForConnection, WRITE_BUNDLE } from '#connectivity';
 import { ConfigDocument, ensureSetupConnection, repaired } from '../../config-edit.ts';
@@ -6,7 +7,7 @@ import { emit, print, progress, style } from '../../output.ts';
 import { nonInteractivePrompter, terminalPrompter, type Prompter } from '../../prompt.ts';
 import { openRuntime, type GlobalFlags } from '../../runtime.ts';
 import { credentialApp, matchesRule, moveCredential, siblingAccountId } from './accounts.ts';
-import { authorise, oauthProviderFor } from './authorise.ts';
+import { authorise } from './authorise.ts';
 import { preflight } from './requirements.ts';
 import { ALREADY, NOTHING, renderOutcome, type ConnectOutcome } from './outcome.ts';
 import { nextAfterEdit, publishRuntimeEdit } from '#cli/publish.ts';
@@ -266,17 +267,15 @@ async function runConnect(target: string, options: ConnectOptions): Promise<Conn
 
       // MCP is the one kind that does not use the runtime's connector here: it
       // wants the token exactly as just written, without the refresh machinery
-      // that `resolveUpstreamToken` wraps around it. Every other kind carries
-      // whatever credential it needs from the factory.
+      // that `bearerToken` wraps around it. Every other kind carries whatever
+      // credential it needs from the factory.
       const connector =
         manifest.connector.kind === 'mcp'
           ? createMcpConnector({
               endpoint: manifest.connector.endpoint,
-              accessToken: async () => {
-                const provider = oauthProviderFor(manifest, connectionId, runtime.credentials);
-                const tokens = (await provider.tokens()) as { access_token?: string } | undefined;
-                return tokens?.access_token ?? null;
-              },
+              ...(manifest.connector.headers ? { headers: manifest.connector.headers } : {}),
+              accessToken: () =>
+                bearerTokenAsStored(manifest, connectionId, runtime.credentials),
             })
           : runtime.connectorFor(providerId, connectionId);
 

package/src/cli/commands/connect/settle.ts

@@ -1,4 +1,5 @@
 import { createMcpConnector } from '#connectivity/transports';
+import { bearerTokenAsStored } from '#connectivity/auth/index.ts';
 import type { SecretStore } from '#secrets';
 import type { Config } from '#profile';
 import type { AnyConnector, ProviderManifest } from '#connectivity';
@@ -6,7 +7,6 @@ import { idFromAccount, resolveAccount } from '../../identity.ts';
 import { style } from '../../output.ts';
 import { terminalPrompter, type Prompter } from '../../prompt.ts';
 import { accountSiblings } from './accounts.ts';
-import { oauthProviderFor } from './authorise.ts';
 
 /**
  * Settle which connection this is, and whose account it belongs to.
@@ -49,12 +49,10 @@ export async function settleIdentity(input: {
   }
 
   if (!account) {
+    const token = () => bearerTokenAsStored(manifest, provisionalId, runtime.credentials);
+
     account = await resolveAccount(manifest, {
-      accessToken: async () => {
-        const provider = oauthProviderFor(manifest, provisionalId, runtime.credentials);
-        const tokens = (await provider.tokens()) as { access_token?: string } | undefined;
-        return tokens?.access_token ?? null;
-      },
+      accessToken: token,
       // A protocol that authenticates by username has nothing to GET and no
       // tool to call — it knows, once the server has accepted the login.
       identify: async () =>
@@ -62,13 +60,18 @@ export async function settleIdentity(input: {
       ...(manifest.connector.kind === 'mcp'
         ? {
             callTool: async (name: string, args: Record<string, unknown>) => {
+              // Cast for the same reason `endpoint` already was: the
+              // narrowing that reached this branch does not survive into the
+              // closure. Named field by field rather than spread, so a future
+              // connector field does not silently become a transport option.
+              const mcp = manifest.connector as {
+                endpoint: string;
+                headers?: Record<string, string>;
+              };
               const connector = createMcpConnector({
-                endpoint: (manifest.connector as { endpoint: string }).endpoint,
-                accessToken: async () => {
-                  const provider = oauthProviderFor(manifest, provisionalId, runtime.credentials);
-                  const tokens = (await provider.tokens()) as { access_token?: string } | undefined;
-                  return tokens?.access_token ?? null;
-                },
+                endpoint: mcp.endpoint,
+                ...(mcp.headers ? { headers: mcp.headers } : {}),
+                accessToken: token,
               });
               return connector.invoke({ name, inputSchema: {}, description: '' } as never, args, {
                 manifest,

package/src/connectivity/auth/README.md

@@ -3,7 +3,8 @@
 One folder per method. Each owns both halves of its job: `resolve*` turns the
 stored secret into a `ResolvedCredential`, and `attach*` puts that shape on an
 outbound request. `resolve.ts` and `authorize.ts` are the only files that know
-the whole set.
+the whole set — plus `token.ts`, which answers the narrower question a
+transport asks when it has a token to send and no request to attach it to.
 
 | Folder | `auth.kind` | What is stored |
 |---|---|---|

package/src/connectivity/auth/index.ts

@@ -3,8 +3,9 @@
  *
  * One folder per method, each owning both halves of its job: turning the stored
  * secret into a resolved shape (`resolve*`) and putting that shape on an
- * outbound request (`attach*`). The two dispatchers here are the only files
- * that know the whole set.
+ * outbound request (`attach*`). The dispatchers here are the only files that
+ * know the whole set: `resolve.ts` and `authorize.ts` for anything HTTP-shaped,
+ * and `token.ts` for a transport that takes a bare token instead of a request.
  *
  * This is the axis the manifest's `auth:` block selects, and it is deliberately
  * independent of `../transports/` — which is why iCloud can speak IMAP with a
@@ -15,6 +16,7 @@
 export { credentialResolver, type ResolvedCredential } from './resolve.ts';
 export { requestAuthorizer } from './authorize.ts';
 export { basicCredential } from './basic/index.ts';
+export { bearerToken, bearerTokenAsStored } from './token.ts';
 export {
   CredentialOAuthProvider,
   clearUpstreamTokens,

package/src/connectivity/auth/token.ts

@@ -0,0 +1,93 @@
+import { type ProviderManifest } from '#connectivity';
+import type { ProviderRegistry } from '#registry';
+import type { SecretStore } from '#secrets';
+import { credentialResolver } from './resolve.ts';
+import { CredentialOAuthProvider } from './oauth-authcode/provider.ts';
+
+/**
+ * The bearer token for one connection, whichever way the provider came by it.
+ *
+ * An mcp connector sends `Authorization: Bearer <token>` and nothing else, so
+ * it takes a token rather than a `Request` to authorise — the same shape
+ * `basicCredential` has for IMAP and DAV, and for the same reason: a transport
+ * that has no `Request` to hand an authorizer gets its credential as a bound
+ * closure instead.
+ *
+ * What lives here that does not live in `./bearer/` is the *dispatch*. Two
+ * unrelated arrangements produce a bearer token — an OAuth access token
+ * exchanged on every use, and a long-lived one the operator pasted — and the
+ * caller does not care which, only the manifest does. Putting that choice in
+ * the bearer folder would make the folder that owns one method know about
+ * another; putting it in `oauth-authcode/` would make the OAuth folder answer
+ * for a token no OAuth flow ever produced.
+ *
+ * Before this existed, every caller asked `CredentialOAuthProvider` for the
+ * token, and a manifest declaring `bearer` got `null` back rather than an
+ * error: the provider's tokens ref is `<provider>/<connection>`, byte-identical
+ * to the ref a pasted token derives, so it read the token, failed to parse it
+ * as a JSON blob, and returned undefined by design. The connection then went
+ * upstream with no `Authorization` header at all.
+ */
+
+/** One manifest, dressed as a registry, so the resolver needs no lookup. */
+const only = (manifest: ProviderManifest): ProviderRegistry =>
+  ({ manifest: () => manifest }) as unknown as ProviderRegistry;
+
+/**
+ * Throws where the manifest declares a credential and none is stored:
+ * `credentialResolver` already says which ref is empty and which command fills
+ * it, which beats a `null` that reaches the server as a missing header.
+ */
+export async function bearerToken(
+  manifest: ProviderManifest,
+  connectionId: string,
+  secrets: SecretStore,
+): Promise<string | null> {
+  const resolved = await credentialResolver(only(manifest), secrets)(manifest.id, connectionId);
+
+  switch (resolved.kind) {
+    case 'none':
+      return null;
+    case 'oauth':
+      return resolved.accessToken;
+    case 'bearer':
+      return resolved.token;
+    default:
+      // Unreachable: `defineProvider` refuses every other kind on an mcp
+      // connector. Kept so the guard and this switch cannot drift apart
+      // silently — if one is ever relaxed, the other says so.
+      throw new Error(
+        `Provider "${manifest.id}" resolves to a "${resolved.kind}" credential, which cannot be sent as a bearer token.`,
+      );
+  }
+}
+
+/**
+ * The same token, read exactly as stored, without the refresh machinery.
+ *
+ * For `connect`: it has just written the token and wants that one, not a
+ * refreshed one. Going through `bearerToken` there would populate the process's
+ * access-token cache under the provisional connection id — `linear.pending`,
+ * a key naming a connection that will not exist a moment later — and could
+ * spend a network round trip re-exchanging a token written seconds ago.
+ *
+ * Identical to `bearerToken` for every non-OAuth kind, because a stored token
+ * has no other reading.
+ */
+export async function bearerTokenAsStored(
+  manifest: ProviderManifest,
+  connectionId: string,
+  secrets: SecretStore,
+): Promise<string | null> {
+  if (manifest.auth.kind !== 'oauth') return bearerToken(manifest, connectionId, secrets);
+
+  const provider = new CredentialOAuthProvider({
+    manifest,
+    connectionId,
+    credentials: secrets,
+    scopes: manifest.auth.scopes,
+  });
+
+  const tokens = (await provider.tokens()) as { access_token?: string } | undefined;
+  return tokens?.access_token ?? null;
+}

package/src/connectivity/manifest/connector.ts

@@ -17,6 +17,21 @@ import { z } from 'zod';
 export const mcpConnectorSchema = z.object({
   kind: z.literal('mcp'),
   endpoint: z.url(),
+  /**
+   * Sent on every request to this server, discovery included.
+   *
+   * The `http` connector filters what it exposes with `operations` above,
+   * because it reads a document listing everything the API can do. An mcp
+   * server decides that for itself and answers `tools/list` with whatever it
+   * chose — so where a vendor makes the choice configurable, the configuration
+   * is a header they define. GitHub's `X-MCP-Toolsets` is the case in hand: the
+   * default is broad and `all` is broader, and this is the only way to ask for
+   * less.
+   *
+   * Never `Authorization` — that one belongs to `auth:`, and the check in
+   * `./provider.ts` refuses it rather than letting the two disagree silently.
+   */
+  headers: z.record(z.string(), z.string()).optional(),
 });
 
 /**

package/src/connectivity/manifest/provider.ts

@@ -196,6 +196,45 @@ export function defineProvider(input: unknown): ProviderManifest {
     );
   }
 
+  if (manifest.connector.kind === 'mcp') {
+    const auth = manifest.auth;
+
+    // The transport sends exactly one header, `Authorization: Bearer <token>`,
+    // because that is what the MCP specification says a client sends. Every
+    // other token kind puts the secret somewhere the transport has nowhere to
+    // put it: `api_key` in a query string or a named header, `header` under a
+    // name of its own, `basic` in a different scheme entirely. Such a manifest
+    // validates and then connects *unauthenticated* — no error, an empty tool
+    // list, and nothing to read that says why.
+    if (auth.kind !== 'none' && auth.kind !== 'oauth' && auth.kind !== 'bearer') {
+      throw new Error(
+        `Provider "${manifest.id}": an mcp connector authenticates with "Authorization: Bearer", so its auth must be "none", "oauth", or "bearer" — not "${auth.kind}". There is nowhere else on the request for the transport to put a credential.`,
+      );
+    }
+
+    // Same failure, one field further in. `bearer` may rename its header, and
+    // `resolveBearer` honours that — but the mcp transport does not read the
+    // resolved credential at all, only the token, so a renamed header would be
+    // silently ignored and the token sent under `Authorization` regardless.
+    if (auth.kind === 'bearer' && auth.header) {
+      throw new Error(
+        `Provider "${manifest.id}": an mcp connector always sends its token as "Authorization: Bearer", so auth.header ("${auth.header}") cannot be honoured. Remove it, or reach this service with an http connector.`,
+      );
+    }
+
+    // The third spelling of the same collision. Connector headers are for what
+    // the *server* offers as configuration; the credential is the auth block's,
+    // and a manifest setting both would have one quietly overwrite the other
+    // depending on which the transport merged last.
+    for (const name of Object.keys(manifest.connector.headers ?? {})) {
+      if (name.toLowerCase() === 'authorization') {
+        throw new Error(
+          `Provider "${manifest.id}": connector.headers may not set "${name}" — the credential comes from auth, and setting both would leave which one is sent up to merge order.`,
+        );
+      }
+    }
+  }
+
   const names = new Set<string>();
   for (const bundle of manifest.bundles ?? []) {
     if (names.has(bundle.name)) {

package/src/connectivity/transports/factory.ts

@@ -2,7 +2,7 @@ import type { AnyConnector, ProviderDefinition, ProviderManifest } from '#connec
 import type { SecretStore } from '#secrets';
 import type { ProviderRegistry } from '#registry';
 import { basicCredential } from '#connectivity/auth/basic/index.ts';
-import { resolveUpstreamToken } from '#connectivity/auth/oauth-authcode/index.ts';
+import { bearerToken } from '#connectivity/auth/token.ts';
 import { createCompositeConnector } from './composite/index.ts';
 import { createDavConnector } from './dav/index.ts';
 import { createFsConnector } from './fs/index.ts';
@@ -114,7 +114,11 @@ function build(
     case 'mcp':
       return createMcpConnector({
         endpoint: manifest.connector.endpoint,
-        accessToken: () => resolveUpstreamToken(manifest, connectionId, options.credentials),
+        ...(manifest.connector.headers ? { headers: manifest.connector.headers } : {}),
+        // Not `resolveUpstreamToken` directly: that one answers only for OAuth,
+        // and returns null for a provider whose token the operator pasted —
+        // which reaches the server as a missing header rather than an error.
+        accessToken: () => bearerToken(manifest, connectionId, options.credentials),
       });
 
     case 'imap':

package/src/connectivity/transports/mcp/index.ts

@@ -24,6 +24,8 @@ export interface McpConnectorOptions {
   readonly endpoint: string;
   /** Supplies the bearer token for an upstream call; refreshes if needed. */
   readonly accessToken: () => Promise<string | null>;
+  /** Whatever the manifest's connector declares, sent on every request. */
+  readonly headers?: Record<string, string> | undefined;
   readonly fetch?: typeof globalThis.fetch;
 }
 
@@ -127,7 +129,14 @@ export function createMcpConnector(options: McpConnectorOptions): Connector {
 
     const transport = new StreamableHTTPClientTransport(new URL(options.endpoint), {
       requestInit: {
-        headers: token ? { authorization: `Bearer ${token}` } : {},
+        // The declared headers first, so the credential cannot be displaced by
+        // one. `defineProvider` already refuses a declared `Authorization`, and
+        // this order means a manifest loaded some other way fails safe rather
+        // than sending someone else's header in its place.
+        headers: {
+          ...(options.headers ?? {}),
+          ...(token ? { authorization: `Bearer ${token}` } : {}),
+        },
       },
       ...(options.fetch ? { fetch: options.fetch } : {}),
     } as never);

package/src/providers/github/index.ts

@@ -0,0 +1,68 @@
+import { defineProvider } from '#connectivity';
+import { GITHUB_REDACT } from './redact.ts';
+
+/**
+ * GitHub, through the server GitHub runs.
+ *
+ * Not OAuth, and not for want of trying. GitHub's remote MCP server does not
+ * offer Dynamic Client Registration — the thing that makes Notion and Linear
+ * cost fifteen lines — so there is no client to register ourselves as. A client
+ * of the operator's own is the documented fallback everywhere else, and it
+ * fails here on a detail: an OAuth App matches its callback URL exactly,
+ * including the port, and `connect` listens on a port the kernel picks. What is
+ * left is the credential GitHub does issue for exactly this — a token you
+ * generate once and paste. See ADR-033.
+ *
+ * The toolsets header is the whole reason `connector.headers` exists. GitHub
+ * serves a different tool list per toolset and `all` is far more than an agent
+ * reasons over; this asks for the ones an agent working in a repository
+ * actually uses. It is one string to change, and `docs/detailed/setup/github.md`
+ * records the read-only variant for someone who wants a narrower connection.
+ */
+export const github = defineProvider({
+  id: 'github',
+  name: 'GitHub',
+  description: 'Repositories, issues, pull requests, and workflow runs, via GitHub\'s official MCP server.',
+  connector: {
+    kind: 'mcp',
+    endpoint: 'https://api.githubcopilot.com/mcp/',
+    headers: { 'X-MCP-Toolsets': 'context,repos,issues,pull_requests,actions,labels' },
+  },
+  auth: { kind: 'bearer' },
+  // GitHub's own MCP server answers `get_me`, so a tool identity would work.
+  // This asks the REST API instead, for one reason: it is a plain GET that
+  // costs no MCP handshake, and `connect` runs it before discovery — so when
+  // the token is wrong, the thing that fails is the cheap call rather than the
+  // expensive one.
+  identity: { kind: 'http', url: 'https://api.github.com/user', field: 'login' },
+  redact: GITHUB_REDACT,
+  setup: {
+    summary:
+      'GitHub issues a fine-grained personal access token for this. There is no OAuth app to register: ' +
+      'GitHub\'s MCP server does not support the dynamic registration Notion and Linear use, and an OAuth ' +
+      'app of your own would need a fixed callback port, which this CLI does not have. You are asked once.',
+    docs: 'docs/detailed/setup/github.md',
+    docs_url: 'https://github.com/settings/personal-access-tokens',
+    steps: [
+      'Open https://github.com/settings/personal-access-tokens and choose "Generate new token".',
+      'Name it "Lanes Link" — the name is how you revoke this one later without touching your other tokens — and set an expiry you are willing to renew.',
+      'Resource owner: yourself, or the organisation whose repositories you want reachable. An organisation may require an owner to approve the token before it works.',
+      'Repository access: only the repositories you want an agent to see. "All repositories" is the setting people regret.',
+      'Permissions, matching the toolsets this connects: Contents (read), Metadata (read, added for you), Issues (read and write), Pull requests (read and write), Actions (read). Add Administration or Workflows only if you know you need them.',
+      'Generate, then copy the token. GitHub shows it once, and it starts with github_pat_.',
+      'When it expires, generate another and run: lanes link connect github --replace.',
+    ],
+    troubleshooting:
+      'GitHub refused the token. The usual causes are an expired token, a repository the token was not granted, ' +
+      'or an organisation token still waiting on an owner\'s approval. Generate a new one at ' +
+      'https://github.com/settings/personal-access-tokens and re-run: lanes link connect github --replace.',
+    prompts: [
+      {
+        key: 'token',
+        label: 'GitHub personal access token',
+        secret: true,
+        scope: 'connection' as const,
+      },
+    ],
+  },
+});

package/src/providers/github/redact.ts

@@ -0,0 +1,109 @@
+/**
+ * What survives into the audit log when GitHub is written to.
+ *
+ * The default withholds every value, which is right for a server whose
+ * capabilities we did not author and cannot know the shape of. It is wrong for
+ * the writes: "an issue was edited" without saying which issue, in which
+ * repository, or into what state is a record of nothing.
+ *
+ * The line drawn is the one Gmail and Drive draw. Identifiers and flags are
+ * kept — `owner`, `repo`, the number, the method, the state, the labels and
+ * reviewers, the merge method. The user's own words are withheld: `title`,
+ * `body`, `commit_message`. A log that said which pull request was merged and
+ * by what method has answered the question; one that also quoted the commit
+ * message has started keeping a copy of the work.
+ *
+ * `assignees` and `reviewers` are kept, and that departs from withholding
+ * people the way `drive.permissions.create` keeps `emailAddress`: assigning
+ * somebody *is* the change, so a log that cannot say to whom has failed at its
+ * one question.
+ *
+ * Two caveats worth stating rather than discovering.
+ *
+ * A proxied server's capabilities are discovered, not declared, so the argument
+ * names below come from GitHub's published tool documentation rather than from
+ * a schema in this repository. `cli/tools.test.ts` checks these names for every
+ * `http` provider and cannot check them here — there is nothing local to check
+ * against. A name that is wrong, or that GitHub renames later, fails the way
+ * that test exists to prevent: silently, with the value withheld and the log
+ * reading exactly as it does when redaction is working. `lanes link doctor`
+ * reporting capability drift is the signal that this list wants re-reading.
+ *
+ * Reads are absent on purpose. `search_issues` takes a `query`, which is a
+ * question somebody asked rather than a record of something that happened —
+ * the same ground Gmail withholds `q` on.
+ */
+export const GITHUB_REDACT: Record<string, string[]> = {
+  // `method` is the verb — create, update, close — and without it the entry
+  // says an issue was written to and not what was done to it.
+  issue_write: [
+    'owner',
+    'repo',
+    'issue_number',
+    'method',
+    'state',
+    'state_reason',
+    'labels',
+    'assignees',
+    'milestone',
+    'type',
+    'duplicate_of',
+  ],
+  add_issue_comment: ['owner', 'repo', 'issue_number', 'comment_id', 'reaction'],
+  sub_issue_write: [
+    'owner',
+    'repo',
+    'issue_number',
+    'method',
+    'sub_issue_id',
+    'replace_parent',
+    'after_id',
+    'before_id',
+  ],
+  // No `title`: a branch name says which change this is, and the title is the
+  // author's summary of it.
+  create_pull_request: [
+    'owner',
+    'repo',
+    'head',
+    'base',
+    'draft',
+    'reviewers',
+    'maintainer_can_modify',
+  ],
+  update_pull_request: [
+    'owner',
+    'repo',
+    'pullNumber',
+    'base',
+    'state',
+    'draft',
+    'reviewers',
+    'maintainer_can_modify',
+  ],
+  merge_pull_request: ['owner', 'repo', 'pullNumber', 'merge_method'],
+  // `event` is the one that matters: approving is a different act from
+  // commenting, and this is the only place that distinction is recorded.
+  pull_request_review_write: [
+    'owner',
+    'repo',
+    'pullNumber',
+    'method',
+    'event',
+    'commitID',
+    'threadId',
+  ],
+  add_comment_to_pending_review: [
+    'owner',
+    'repo',
+    'pullNumber',
+    'path',
+    'line',
+    'startLine',
+    'side',
+    'startSide',
+    'subjectType',
+  ],
+  add_reply_to_pull_request_comment: ['owner', 'repo', 'pullNumber', 'commentId', 'reaction'],
+  update_pull_request_branch: ['owner', 'repo', 'pullNumber', 'expectedHeadSha'],
+};

package/src/providers/index.ts

@@ -2,6 +2,7 @@ import type { ProviderDefinition, ProviderManifest } from '#connectivity';
 import { calendar } from './google/calendar/index.ts';
 import { contacts } from './google/contacts/index.ts';
 import { docs } from './google/docs/index.ts';
+import { github } from './github/index.ts';
 import { drive } from './google/drive/index.ts';
 import { driveMcp } from './google/drive-mcp/index.ts';
 import { gmail } from './google/gmail/index.ts';
@@ -14,6 +15,7 @@ import { icloudDrive } from './icloud/drive/index.ts';
 import { icloudMail } from './icloud/mail/index.ts';
 import { linear } from './linear/index.ts';
 import { notion } from './notion/index.ts';
+import { slack } from './slack/index.ts';
 
 /**
  * Every provider, in one list.
@@ -48,6 +50,8 @@ import { notion } from './notion/index.ts';
 export const PROVIDERS: readonly (ProviderManifest | ProviderDefinition)[] = [
   notion,
   linear,
+  github,
+  slack,
   gmail,
   drive,
   sheets,
@@ -88,6 +92,8 @@ export {
   tasks,
 } from './google/index.ts';
 export { icloudCalendar, icloudContacts, icloudDrive, icloudMail } from './icloud/index.ts';
+export { github } from './github/index.ts';
 export { linear } from './linear/index.ts';
 export { notion } from './notion/index.ts';
+export { slack } from './slack/index.ts';
 export { SCOPE_MEANINGS, type ScopeMeaning } from './scopes.ts';

package/src/providers/slack/index.ts

@@ -0,0 +1,75 @@
+import { defineProvider } from '#connectivity';
+import { SLACK_REDACT } from './redact.ts';
+
+/**
+ * Slack, through the server Slack runs.
+ *
+ * The only provider here whose vendor has closed every door but one. Slack's
+ * MCP server does not offer Dynamic Client Registration — their documentation
+ * says so outright — and a client of your own cannot work either: Slack
+ * requires an HTTPS redirect URI, and `connect` listens on `http://127.0.0.1`
+ * on a port the kernel picks. There is no proxy, tunnel, or flag that makes a
+ * loopback listener HTTPS. A broker would answer it and `defineProvider`
+ * refuses one on an mcp connector, because the SDK owns that exchange.
+ *
+ * What is left is the user token the Slack app mints when you install it, sent
+ * as `Authorization: Bearer`. Slack supports that path deliberately; it is the
+ * arrangement their own docs describe for a client that cannot register. See
+ * ADR-033.
+ *
+ * Unlike GitHub, this does cost a console visit — creating a Slack app is the
+ * only way to get a user token at all, and no amount of implementation work on
+ * this side removes it. The setup block is therefore longer than any other here
+ * except Google's, and that is the honest shape of it.
+ */
+export const slack = defineProvider({
+  id: 'slack',
+  name: 'Slack',
+  description: 'Messages, threads, channels, files, and canvases, via Slack\'s official MCP server.',
+  connector: { kind: 'mcp', endpoint: 'https://mcp.slack.com/mcp' },
+  auth: { kind: 'bearer' },
+  /**
+   * The person, not the workspace, and the distinction is load-bearing.
+   *
+   * `settleIdentity` matches a resolved account against existing connections
+   * to decide whether this is a reconnect or a new account. Labelled by
+   * workspace, a second person's token in the same workspace would look like a
+   * reconnect of the first and overwrite their credential. `auth.test` returns
+   * both; `user` is the one that is unique per token.
+   *
+   * Slack answers a bad token with HTTP 200 and `{ok: false}`, so a wrong token
+   * reaches `connect`'s "which account is this?" fallback rather than a clear
+   * refusal. Discovery fails loudly one step later, which is where the real
+   * error is.
+   */
+  identity: { kind: 'http', url: 'https://slack.com/api/auth.test', field: 'user' },
+  redact: SLACK_REDACT,
+  setup: {
+    summary:
+      'Slack needs an app of its own — there is no personal access token and no way to register ' +
+      'automatically, because Slack requires an HTTPS callback and this CLI listens on localhost. ' +
+      'You create the app once, install it to your workspace, and paste the user token it mints.',
+    docs: 'docs/detailed/setup/slack.md',
+    docs_url: 'https://api.slack.com/apps',
+    steps: [
+      'Open https://api.slack.com/apps and choose "Create New App" → "From scratch". Name it "Lanes Link" and pick the workspace.',
+      'Open "OAuth & Permissions" and scroll to "Scopes". Add these under USER TOKEN SCOPES — not Bot Token Scopes; the MCP server reads the user token: search:read.public, search:read.private, search:read.im, search:read.mpim, search:read.users, search:read.files, channels:history, groups:history, im:history, mpim:history, channels:read, groups:read, mpim:read, users:read, chat:write, files:read.',
+      'For reactions, canvases, or creating channels, add reactions:write, canvases:read, canvases:write, or channels:write as well. Those tools are listed either way and fail at call time without the scope.',
+      'Scroll up and choose "Install to Workspace", then approve. A Slack admin may have to approve it for you.',
+      'Copy the "User OAuth Token" from the same page. It starts with xoxp- — not the bot token, which starts with xoxb- and will not work here.',
+      'The token does not expire unless you enable token rotation on the app. If you rotate or reinstall, run: lanes link connect slack --replace.',
+    ],
+    troubleshooting:
+      'Slack refused the token. The usual causes are a bot token (xoxb-) pasted where the user token (xoxp-) belongs, ' +
+      'a scope missing from USER TOKEN SCOPES, or an app that was reinstalled since — reinstalling mints a new token. ' +
+      'Copy the User OAuth Token from https://api.slack.com/apps and re-run: lanes link connect slack --replace.',
+    prompts: [
+      {
+        key: 'token',
+        label: 'Slack user OAuth token (xoxp-…)',
+        secret: true,
+        scope: 'connection' as const,
+      },
+    ],
+  },
+});

package/src/providers/slack/redact.ts

@@ -0,0 +1,50 @@
+/**
+ * What survives into the audit log when Slack is written to.
+ *
+ * The line is the one Gmail draws for mail, because it is the same object: a
+ * message someone wrote. Where it went is recorded, what it said is not.
+ * `channel_id` is an identifier, `thread_ts` says which conversation, and
+ * `message` is the whole of the content — a log that quoted it would be a
+ * second copy of everybody's Slack, held somewhere nobody expects one.
+ *
+ * Keys are the *shortened* names. `shortenName` strips a redundant provider
+ * prefix, so the upstream `slack_send_message` is `send_message` here, in
+ * policy, and in the audit log. Keying this block on the upstream name would
+ * match nothing and withhold everything, silently.
+ *
+ * The same caveat as GitHub's, and it is worth repeating rather than
+ * cross-referencing: a proxied server's capabilities are discovered, not
+ * declared, so `cli/tools.test.ts` cannot check these names against a local
+ * schema the way it does for every `http` provider. They were read off the
+ * tool schemas Slack's server actually publishes rather than guessed, but a
+ * rename upstream fails the way that test exists to prevent — the value is
+ * withheld and the log reads exactly as it does when redaction is working.
+ * `lanes link doctor` reporting capability drift is the signal to re-read this.
+ *
+ * Some entries name tools the default scope set cannot call. That is
+ * deliberate: Slack lists every tool regardless of scope and refuses at call
+ * time, so someone who later adds `reactions:write` or `canvases:write` finds
+ * the log already correct rather than discovering it is not.
+ */
+export const SLACK_REDACT: Record<string, string[]> = {
+  // Everything except the message. `reply_broadcast` is kept because "replied
+  // in a thread" and "replied in a thread and pushed it to the channel" are
+  // different acts, and only this argument distinguishes them.
+  send_message: ['channel_id', 'thread_ts', 'reply_broadcast', 'unfurl_app_links', 'draft_id'],
+  send_message_draft: ['channel_id', 'thread_ts'],
+  schedule_message: ['channel_id', 'post_at', 'thread_ts', 'reply_broadcast'],
+  // The emoji is kept. It is a name from a fixed vocabulary rather than
+  // something anyone typed — the same reading that lets Gmail keep label ids —
+  // and an entry saying a message was reacted to without saying how records
+  // nothing anyone would look for.
+  add_reaction: ['channel_id', 'message_ts', 'emoji'],
+  // Nothing. A canvas has no identifier until Slack answers with one, so both
+  // arguments are the document: `title` is the author's words and `content` is
+  // the whole of it. This is `gmail.send_message`'s position, reached the same
+  // way — there is no identifier here to keep, so keeping anything would mean
+  // keeping content.
+  create_canvas: [],
+  // `sections` is withheld along with `content`: each entry carries its own
+  // markdown, so keeping the array would keep the document a second time.
+  update_canvas: ['canvas_id', 'action', 'section_id'],
+};