@lanes-sh/link 0.1.2 → 0.2.1

package/README.md

@@ -1,5 +1,9 @@
 # Lanes Link
 
+[![npm version](https://img.shields.io/npm/v/%40lanes-sh%2Flink?style=flat-square&color=black&label=npm)](https://www.npmjs.com/package/@lanes-sh/link)
+[![license Apache-2.0](https://img.shields.io/github/license/lanes-sh/link?style=flat-square&color=black)](LICENSE)
+[![ci](https://img.shields.io/github/actions/workflow/status/lanes-sh/link/ci.yml?branch=main&style=flat-square&label=ci)](https://github.com/lanes-sh/link/actions/workflows/ci.yml)
+
 **One secure endpoint between your AI agents and all your connections, memory, skills, and secrets.**
 
 Connect your mail, calendar, files, and notes once, and add the memory and skills that only you
@@ -93,13 +97,17 @@ One command per account. Run it again to add a second mailbox, a second calendar
 | iCloud Drive | `lanes link connect icloud_drive` |
 | Notion | `lanes link connect notion` |
 | Linear | `lanes link connect linear` |
+| GitHub | `lanes link connect github` |
+| Slack | `lanes link connect slack` |
 | Gmail (Google MCP) | `lanes link connect gmail_mcp` |
 | Drive (Google MCP) | `lanes link connect drive_mcp` |
 
-Two things worth knowing up front: `lanes link connect icloud` sets up Mail, Calendar, and Contacts
-together, because one app-specific password covers all three. And Google needs no OAuth client of
-your own: `lanes link connect gmail` authorises against the one Lanes operates, so there is no
-Cloud console to visit. Add `--own-client` if you would rather register your own.
+Three things worth knowing up front. `lanes link connect icloud` sets up Mail, Calendar, and
+Contacts together, because one app-specific password covers all three. Google needs no OAuth client
+of your own: `lanes link connect gmail` authorises against the one Lanes operates, so there is no
+Cloud console to visit — add `--own-client` if you would rather register your own. And GitHub and
+Slack take a token you paste rather than a browser sign-in, because neither will register a client
+for us; for Slack that means creating a Slack app once, which is the one console visit left here.
 
 Full guide — what each one gives your agent, what it needs, and adding your own:
 **[docs/connect.md](docs/connect.md)**.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lanes-sh/link",
-  "version": "0.1.2",
+  "version": "0.2.1",
   "description": "A self-hostable MCP gateway for all your connections, memory, skills, and secrets",
   "license": "Apache-2.0",
   "homepage": "https://lanes.sh/link",

package/src/cli/commands/connect/authorise.ts

@@ -21,7 +21,14 @@ import { ensureOAuthApp } from './setup.ts';
  * nothing and the manifest has to name its endpoints.
  */
 
-export function oauthProviderFor(
+/**
+ * No longer exported. `#cli` used to reach for this to answer "what token does
+ * this manifest authenticate with", which is a question the auth component
+ * owns — and answering it here is what let a `bearer` manifest slip through
+ * returning null. `bearerTokenAsStored` is the answer now; this builds the
+ * provider for the browser flow below, which is the one thing it is for.
+ */
+function oauthProviderFor(
   manifest: ProviderManifest,
   connectionId: string,
   credentials: SecretStore,

package/src/cli/commands/connect/index.ts

@@ -1,4 +1,5 @@
 import { createMcpConnector } from '#connectivity/transports';
+import { bearerTokenAsStored } from '#connectivity/auth/index.ts';
 import type { DiscoveredCapability } from '#connectivity';
 import { credentialRefForConnection, WRITE_BUNDLE } from '#connectivity';
 import { ConfigDocument, ensureSetupConnection, repaired } from '../../config-edit.ts';
@@ -6,7 +7,7 @@ import { emit, print, progress, style } from '../../output.ts';
 import { nonInteractivePrompter, terminalPrompter, type Prompter } from '../../prompt.ts';
 import { openRuntime, type GlobalFlags } from '../../runtime.ts';
 import { credentialApp, matchesRule, moveCredential, siblingAccountId } from './accounts.ts';
-import { authorise, oauthProviderFor } from './authorise.ts';
+import { authorise } from './authorise.ts';
 import { preflight } from './requirements.ts';
 import { ALREADY, NOTHING, renderOutcome, type ConnectOutcome } from './outcome.ts';
 import { nextAfterEdit, publishRuntimeEdit } from '#cli/publish.ts';
@@ -266,17 +267,15 @@ async function runConnect(target: string, options: ConnectOptions): Promise<Conn
 
       // MCP is the one kind that does not use the runtime's connector here: it
       // wants the token exactly as just written, without the refresh machinery
-      // that `resolveUpstreamToken` wraps around it. Every other kind carries
-      // whatever credential it needs from the factory.
+      // that `bearerToken` wraps around it. Every other kind carries whatever
+      // credential it needs from the factory.
       const connector =
         manifest.connector.kind === 'mcp'
           ? createMcpConnector({
               endpoint: manifest.connector.endpoint,
-              accessToken: async () => {
-                const provider = oauthProviderFor(manifest, connectionId, runtime.credentials);
-                const tokens = (await provider.tokens()) as { access_token?: string } | undefined;
-                return tokens?.access_token ?? null;
-              },
+              ...(manifest.connector.headers ? { headers: manifest.connector.headers } : {}),
+              accessToken: () =>
+                bearerTokenAsStored(manifest, connectionId, runtime.credentials),
             })
           : runtime.connectorFor(providerId, connectionId);
 

package/src/cli/commands/connect/settle.ts

@@ -1,4 +1,5 @@
 import { createMcpConnector } from '#connectivity/transports';
+import { bearerTokenAsStored } from '#connectivity/auth/index.ts';
 import type { SecretStore } from '#secrets';
 import type { Config } from '#profile';
 import type { AnyConnector, ProviderManifest } from '#connectivity';
@@ -6,7 +7,6 @@ import { idFromAccount, resolveAccount } from '../../identity.ts';
 import { style } from '../../output.ts';
 import { terminalPrompter, type Prompter } from '../../prompt.ts';
 import { accountSiblings } from './accounts.ts';
-import { oauthProviderFor } from './authorise.ts';
 
 /**
  * Settle which connection this is, and whose account it belongs to.
@@ -49,12 +49,10 @@ export async function settleIdentity(input: {
   }
 
   if (!account) {
+    const token = () => bearerTokenAsStored(manifest, provisionalId, runtime.credentials);
+
     account = await resolveAccount(manifest, {
-      accessToken: async () => {
-        const provider = oauthProviderFor(manifest, provisionalId, runtime.credentials);
-        const tokens = (await provider.tokens()) as { access_token?: string } | undefined;
-        return tokens?.access_token ?? null;
-      },
+      accessToken: token,
       // A protocol that authenticates by username has nothing to GET and no
       // tool to call — it knows, once the server has accepted the login.
       identify: async () =>
@@ -62,13 +60,18 @@ export async function settleIdentity(input: {
       ...(manifest.connector.kind === 'mcp'
         ? {
             callTool: async (name: string, args: Record<string, unknown>) => {
+              // Cast for the same reason `endpoint` already was: the
+              // narrowing that reached this branch does not survive into the
+              // closure. Named field by field rather than spread, so a future
+              // connector field does not silently become a transport option.
+              const mcp = manifest.connector as {
+                endpoint: string;
+                headers?: Record<string, string>;
+              };
               const connector = createMcpConnector({
-                endpoint: (manifest.connector as { endpoint: string }).endpoint,
-                accessToken: async () => {
-                  const provider = oauthProviderFor(manifest, provisionalId, runtime.credentials);
-                  const tokens = (await provider.tokens()) as { access_token?: string } | undefined;
-                  return tokens?.access_token ?? null;
-                },
+                endpoint: mcp.endpoint,
+                ...(mcp.headers ? { headers: mcp.headers } : {}),
+                accessToken: token,
               });
               return connector.invoke({ name, inputSchema: {}, description: '' } as never, args, {
                 manifest,

package/src/cli/commands/operate/inspect.ts

@@ -10,6 +10,7 @@ import {
   toPolicyDocument,
 } from '#registry';
 import { announce, emit, fail, ok, print, warn } from '../../output.ts';
+import { staleNudge } from '../../release.ts';
 import { capabilityDiff, discoveryProbe } from '../../runtime/discovery.ts';
 import { openRuntime, resolveProfile, type GlobalFlags } from '../../runtime.ts';
 
@@ -189,6 +190,12 @@ export async function doctor(flags: DoctorFlags): Promise<void> {
       });
     }
 
+    // Every finding above is about this profile; this one is about the binary
+    // reading it. Silent when the registry cannot be reached — `doctor` is
+    // expected to work on a plane, and "could not check" is not a finding.
+    const stale = await staleNudge();
+    if (stale !== null) warnings.push({ kind: 'stale_release', message: stale });
+
     await reportCapabilityDrift(runtime, (message) =>
       warnings.push({ kind: 'capability_drift', message }),
     );

package/src/cli/commands/operate/serve.ts

@@ -1,6 +1,7 @@
 import { startEndpoint } from '#server/endpoint.ts';
 import { streamLogger } from '#server/logging.ts';
 import { announce, ok, print, style, warn } from '../../output.ts';
+import { staleNudge } from '../../release.ts';
 import { resolveProfile, type GlobalFlags } from '../../runtime.ts';
 
 /** `lanes link start` — reconcile, then serve every profile on one endpoint. */
@@ -41,6 +42,12 @@ export async function start(
 
   print(ok(`serving ${style.bold(endpoint.url)}`));
   print(style.dim(`      profiles: ${endpoint.profiles.join(', ')}`));
+
+  // Last, not first: the endpoint is what someone ran this for, and a version
+  // note in front of it would be the first thing they read and the least useful.
+  const stale = await staleNudge();
+  if (stale !== null) print(warn(stale));
+
   print(style.dim('Ctrl-C to stop.'));
 
   const shutdown = async (): Promise<void> => {

package/src/cli/commands/update.ts

@@ -0,0 +1,255 @@
+import { homedir } from 'node:os';
+import { join, sep } from 'node:path';
+import { installRoot } from '#profile';
+import { emit, fail, ok, print, printErr, progress, style, warn } from '../output.ts';
+import { PACKAGE, release, type ReleaseState } from '../release.ts';
+import { version } from '../version.ts';
+
+/**
+ * `lanes link update` — install the newer release, or say why it will not.
+ *
+ * There is no build step and no compiled artifact, so updating means exactly
+ * one thing: replace the installed package directory with a newer tarball from
+ * the registry. `bin/lanes` resolves its own symlink chain and execs Bun on the
+ * `src/` inside that directory, so the shipped source *is* the running code and
+ * the symlink on the PATH never has to move.
+ *
+ * Bun is the only installer this drives. `bun install -g @lanes-sh/link` is the
+ * only install documented, `engines.bun` requires it, and the shim refuses to
+ * run without it — so inferring a package manager would be machinery serving a
+ * case nobody is told to create. The case that does exist is handled below
+ * rather than ignored: an `npm i -g` install updated with Bun gets a second
+ * copy somewhere else on the PATH, which this detects and reports instead of
+ * doing quietly.
+ *
+ * Nothing here is control plane — it touches the install, not a profile — so it
+ * resolves no profile and no target, and is the second command after `version`
+ * that prints no `announce` line.
+ */
+
+export interface UpdateFlags {
+  /** Report and exit without installing anything. */
+  readonly check?: boolean | undefined;
+  readonly json?: boolean | undefined;
+}
+
+/**
+ * What `update` would do, and why.
+ *
+ * `'checkout'` is a refusal: `bun link` puts a checkout on the same PATH entry
+ * a published install would occupy, so installing from the registry there would
+ * leave two copies of this CLI and no indication of which one answers. `git
+ * pull` is the update in a checkout, and saying so is more useful than doing
+ * something surprising.
+ */
+export type UpdateAction = 'install' | 'current' | 'ahead' | 'checkout' | 'unknown';
+
+export interface UpdateDecision {
+  readonly action: UpdateAction;
+  /** The argv to run, or `null` when nothing should be run. */
+  readonly install: readonly string[] | null;
+  readonly message: string;
+  /** Something true and unwelcome about this install, if there is anything. */
+  readonly warning: string | null;
+}
+
+export interface UpdateInput {
+  readonly installed: string;
+  readonly latest: string | null;
+  readonly state: ReleaseState;
+  /** Where this CLI is installed — `installRoot()`, not the workspace. */
+  readonly root: string;
+  /** Where Bun keeps global installs, so a copy landing elsewhere is visible. */
+  readonly bunGlobal: string;
+}
+
+/**
+ * The whole decision, as a function of five strings.
+ *
+ * Split from the spawn because the alternative is a command whose only test is
+ * one that replaces the copy of this CLI on the machine running the suite. Every
+ * branch below is reachable from `update.test.ts` with no network and no
+ * subprocess — including the stale branch, which the checkout this is written in
+ * can never reach on its own, being by definition the newest thing there is.
+ */
+export function updatePlan(input: UpdateInput): UpdateDecision {
+  const { installed, latest, state, root, bunGlobal } = input;
+
+  // A published install lives under `node_modules`; a checkout does not. Cheaper
+  // and steadier than looking for `.git`, which a tarball could carry and a
+  // shallow export could lack.
+  const published = root.split(sep).includes('node_modules');
+
+  if (!published) {
+    return {
+      action: 'checkout',
+      install: null,
+      message: `${root} is a checkout, not an install — git pull is the update here`,
+      warning: null,
+    };
+  }
+
+  if (state === 'unknown') {
+    return {
+      action: 'unknown',
+      install: null,
+      message:
+        latest === null
+          ? `could not reach the registry — ${installed} is installed`
+          : `cannot compare ${installed} against ${latest}`,
+      warning: null,
+    };
+  }
+
+  if (state === 'ahead') {
+    return {
+      action: 'ahead',
+      install: null,
+      message: `${installed} is installed, ahead of the published ${latest ?? 'release'}`,
+      warning: null,
+    };
+  }
+
+  if (state === 'current') {
+    return { action: 'current', install: null, message: `${installed} is current`, warning: null };
+  }
+
+  // Installed by npm, updated by Bun: `bun install -g` writes into its own
+  // global prefix and leaves the npm copy where it is, so both are on the PATH
+  // and its order decides which one answers. Worth saying before, not after.
+  const elsewhere = !root.startsWith(bunGlobal + sep);
+
+  return {
+    action: 'install',
+    install: ['install', '-g', PACKAGE],
+    message: `${installed} installed, ${latest} available`,
+    warning: elsewhere
+      ? `this copy is at ${root}, which is not under ${bunGlobal} — ` +
+        'Bun will install a second copy there rather than replace this one, ' +
+        'and your PATH order decides which one answers'
+      : null,
+  };
+}
+
+/** Where Bun keeps global installs, honouring `BUN_INSTALL`. */
+export function bunGlobalRoot(env: Record<string, string | undefined> = process.env): string {
+  return join(env['BUN_INSTALL'] ?? join(homedir(), '.bun'), 'install', 'global');
+}
+
+export async function update(flags: UpdateFlags): Promise<void> {
+  const current = await release();
+  const root = installRoot(import.meta.dir);
+  const decision = updatePlan({
+    installed: current.installed,
+    latest: current.latest,
+    state: current.state,
+    root,
+    bunGlobal: bunGlobalRoot(),
+  });
+
+  // A gate wants a non-zero exit for the one state that needs action. An
+  // unreachable registry is not that state — failing a build because a network
+  // was down would make this the flakiest check in it.
+  if (flags.check === true && decision.action === 'install') process.exitCode = 1;
+
+  const report = {
+    installed: current.installed,
+    latest: current.latest,
+    state: current.state,
+    action: decision.action,
+    root,
+    ...(decision.install !== null ? { install: `bun ${decision.install.join(' ')}` } : {}),
+    ...(decision.warning !== null ? { warning: decision.warning } : {}),
+  };
+
+  if (flags.check === true || decision.action !== 'install') {
+    return emit(flags.json, report, () => {
+      if (decision.action === 'install') {
+        print(warn(decision.message));
+        if (decision.warning !== null) print(style.dim(`      ${decision.warning}`));
+        print(style.dim('      run: lanes link update'));
+        return;
+      }
+
+      // Green for the two states that need nothing. A refusal and an
+      // unreachable registry are neither wrong nor fine, and `ok` would claim
+      // the second of those.
+      if (decision.action === 'current' || decision.action === 'ahead') {
+        print(ok(decision.message));
+        return;
+      }
+
+      print(style.dim(decision.message));
+    });
+  }
+
+  // Stderr, both of them. What this command produces is the version change, and
+  // with `--json` that is a document — a line of prose in front of it corrupts
+  // it for whatever is parsing, which is the whole reason `emit` exists.
+  if (decision.warning !== null) progress(warn(decision.warning));
+  progress(style.dim(`bun ${decision.install!.join(' ')}`));
+
+  const installed = await runInstall(decision.install!, flags.json === true);
+  if (!installed) {
+    printErr(fail('the install did not complete — nothing was changed'));
+    process.exitCode = 1;
+    return;
+  }
+
+  // Read the version back off disk rather than trusting the exit code. `version()`
+  // reads `package.json` from the install root at call time, so this is the one
+  // question worth asking after a successful install: did *this* copy change?
+  // Unchanged after a clean install is the second-copy case above, seen from the
+  // other side.
+  const landed = version();
+
+  return emit(
+    flags.json,
+    {
+      ...report,
+      // The action was `install`; this is what came of it. Inventing a third
+      // action value would describe an outcome as a decision.
+      result: landed === current.installed ? 'unchanged' : 'installed',
+      installed: landed,
+      previous: current.installed,
+    },
+    () => {
+      if (landed === current.installed) {
+        print(warn(`bun reported success, but ${root} is still ${landed}`));
+        print(style.dim('      the copy it installed is somewhere else on your PATH'));
+        print(style.dim('      check with: which -a lanes'));
+        return;
+      }
+
+      print(ok(`${current.installed} → ${style.bold(landed)}`));
+      print(style.dim('      a running endpoint serves the old code until it is restarted'));
+    },
+  );
+}
+
+/**
+ * Hand the install to Bun and let it own the terminal.
+ *
+ * `process.execPath` rather than `Bun.which('bun')`: this process is already
+ * running under the Bun that should do the installing, and a PATH lookup can
+ * find a different one — which would resolve the dependency set with a
+ * different resolver than the one that will run the result.
+ *
+ * Output is inherited rather than captured. Bun prints its own progress and its
+ * own errors, and paraphrasing a package manager's failure is how a report ends
+ * up less useful than the thing it replaced. Its stdout is dropped under
+ * `--json` for the same reason the lines above go to stderr: the document on
+ * stdout has to be the only thing on stdout. Its stderr is kept either way,
+ * because a failure is worth reading in both modes.
+ */
+async function runInstall(argv: readonly string[], json: boolean): Promise<boolean> {
+  try {
+    const child = Bun.spawn([process.execPath, ...argv], {
+      stdout: json ? 'ignore' : 'inherit',
+      stderr: 'inherit',
+    });
+    return (await child.exited) === 0;
+  } catch {
+    return false;
+  }
+}

package/src/cli/main.ts

@@ -38,6 +38,7 @@ import {
   vaultRemove,
   vaultSet,
 } from './commands/owner.ts';
+import { update } from './commands/update.ts';
 import { globalFlags, ownerFlags, parseArgv, text } from './argv.ts';
 import { PROGRAM, USAGE } from './usage.ts';
 import { version } from './version.ts';
@@ -335,6 +336,9 @@ export async function run(argv: readonly string[]): Promise<void> {
       print(version());
       return;
 
+    case 'update':
+      return update({ check: flags['check'] === true, json });
+
     default:
       throw new Error(`Unknown command "${first}". Run: ${PROGRAM} help`);
   }

package/src/cli/release.ts

@@ -0,0 +1,111 @@
+import { version } from './version.ts';
+
+/**
+ * Whether a newer release than this one has been published.
+ *
+ * `version.ts` answers which release is installed, which stopped being the
+ * whole question when this started shipping from npm: two machines can now sit
+ * a release apart with nothing on either to say so, and the only upgrade
+ * affordance in the tree was a `contract` mismatch telling someone to "Upgrade
+ * lanes-link" without naming a command.
+ *
+ * Every function here degrades to `null` or `'unknown'` rather than throwing. A
+ * version check is never the reason a command fails — `doctor`, `start`, and
+ * `deploy` each print one line from this and must all work on a plane.
+ */
+
+/** The npm package this CLI ships as, and the only thing `update` will install. */
+export const PACKAGE = '@lanes-sh/link';
+
+/**
+ * The dist-tags document, not the packument.
+ *
+ * `registry.npmjs.org/<name>` carries every version ever published with its
+ * full manifest — hundreds of kilobytes to answer a question whose answer is
+ * eighteen bytes. This endpoint returns `{"latest":"0.2.0"}` and nothing else.
+ */
+const DIST_TAGS = `https://registry.npmjs.org/-/package/${encodeURIComponent(PACKAGE)}/dist-tags`;
+
+/**
+ * The same budget `endpointHealth` gives its probe.
+ *
+ * Long enough for a warm connection, short enough that a command which only
+ * mentions staleness in passing does not appear to hang on a captive-portal
+ * network that accepts the connection and then says nothing.
+ */
+const PROBE_TIMEOUT_MS = 700;
+
+export type ReleaseState = 'current' | 'stale' | 'ahead' | 'unknown';
+
+export interface Release {
+  readonly installed: string;
+  /** `null` when the registry could not be reached, or answered something else. */
+  readonly latest: string | null;
+  readonly state: ReleaseState;
+}
+
+/**
+ * How the installed version stands against the published one.
+ *
+ * `'ahead'` is not a mistake: a contributor running from a checkout is usually
+ * a version ahead of the registry, and telling them they are behind would be
+ * both wrong and the thing they see most often.
+ *
+ * Pure, and separate from the fetch, so every branch is testable without a
+ * network — which is the only way the stale path gets covered at all, given the
+ * checkout this is written in is by definition current.
+ */
+export function releaseState(installed: string, latest: string | null): ReleaseState {
+  if (latest === null) return 'unknown';
+
+  try {
+    const order = Bun.semver.order(installed, latest);
+    return order === 0 ? 'current' : order < 0 ? 'stale' : 'ahead';
+  } catch {
+    // `Bun.semver.order` throws on anything it cannot parse rather than
+    // ordering it arbitrarily. A registry that answers with something other
+    // than a version, or a hand-edited `package.json`, is an unknown state and
+    // not a reason to claim either answer.
+    return 'unknown';
+  }
+}
+
+/** What the registry calls `latest`, or `null` if it did not say. */
+export async function latestRelease(): Promise<string | null> {
+  try {
+    const response = await fetch(DIST_TAGS, { signal: AbortSignal.timeout(PROBE_TIMEOUT_MS) });
+    if (!response.ok) return null;
+
+    const body = (await response.json()) as { latest?: unknown };
+    return typeof body.latest === 'string' ? body.latest : null;
+  } catch {
+    return null;
+  }
+}
+
+/** The installed version, the published one, and how they stand. */
+export async function release(): Promise<Release> {
+  const installed = version();
+  const latest = await latestRelease();
+
+  return { installed, latest, state: releaseState(installed, latest) };
+}
+
+/**
+ * The one line `doctor`, `start`, and `deploy` print when this install is behind.
+ *
+ * One string in one place, because three commands saying it three ways is how
+ * two of them end up naming a command that has been renamed. `null` for every
+ * state but `'stale'`: nothing is worth saying about an install that is current,
+ * and an unreachable registry is not news.
+ */
+export function staleLine(current: Release): string | null {
+  if (current.state !== 'stale') return null;
+
+  return `${current.installed} is installed, ${current.latest} is out — run: lanes link update`;
+}
+
+/** `staleLine` over a fresh probe, for a caller that has no `Release` in hand. */
+export async function staleNudge(): Promise<string | null> {
+  return staleLine(await release());
+}

package/src/cli/usage.ts

@@ -90,6 +90,7 @@ ${style.bold('Inspection')}
   ${PROGRAM} audit verify           has anything in the log been altered or removed
   ${PROGRAM} config show
   ${PROGRAM} version                    which release this is — same as lanes --version
+  ${PROGRAM} update [--check] [--json]  install the newer release, or say what is available
 
 ${style.bold('Attachments')}
   ${PROGRAM} attach <file> --connection <provider>.<account>

package/src/connectivity/auth/README.md

@@ -3,7 +3,8 @@
 One folder per method. Each owns both halves of its job: `resolve*` turns the
 stored secret into a `ResolvedCredential`, and `attach*` puts that shape on an
 outbound request. `resolve.ts` and `authorize.ts` are the only files that know
-the whole set.
+the whole set — plus `token.ts`, which answers the narrower question a
+transport asks when it has a token to send and no request to attach it to.
 
 | Folder | `auth.kind` | What is stored |
 |---|---|---|

package/src/connectivity/auth/index.ts

@@ -3,8 +3,9 @@
  *
  * One folder per method, each owning both halves of its job: turning the stored
  * secret into a resolved shape (`resolve*`) and putting that shape on an
- * outbound request (`attach*`). The two dispatchers here are the only files
- * that know the whole set.
+ * outbound request (`attach*`). The dispatchers here are the only files that
+ * know the whole set: `resolve.ts` and `authorize.ts` for anything HTTP-shaped,
+ * and `token.ts` for a transport that takes a bare token instead of a request.
  *
  * This is the axis the manifest's `auth:` block selects, and it is deliberately
  * independent of `../transports/` — which is why iCloud can speak IMAP with a
@@ -15,6 +16,7 @@
 export { credentialResolver, type ResolvedCredential } from './resolve.ts';
 export { requestAuthorizer } from './authorize.ts';
 export { basicCredential } from './basic/index.ts';
+export { bearerToken, bearerTokenAsStored } from './token.ts';
 export {
   CredentialOAuthProvider,
   clearUpstreamTokens,

package/src/connectivity/auth/token.ts

@@ -0,0 +1,93 @@
+import { type ProviderManifest } from '#connectivity';
+import type { ProviderRegistry } from '#registry';
+import type { SecretStore } from '#secrets';
+import { credentialResolver } from './resolve.ts';
+import { CredentialOAuthProvider } from './oauth-authcode/provider.ts';
+
+/**
+ * The bearer token for one connection, whichever way the provider came by it.
+ *
+ * An mcp connector sends `Authorization: Bearer <token>` and nothing else, so
+ * it takes a token rather than a `Request` to authorise — the same shape
+ * `basicCredential` has for IMAP and DAV, and for the same reason: a transport
+ * that has no `Request` to hand an authorizer gets its credential as a bound
+ * closure instead.
+ *
+ * What lives here that does not live in `./bearer/` is the *dispatch*. Two
+ * unrelated arrangements produce a bearer token — an OAuth access token
+ * exchanged on every use, and a long-lived one the operator pasted — and the
+ * caller does not care which, only the manifest does. Putting that choice in
+ * the bearer folder would make the folder that owns one method know about
+ * another; putting it in `oauth-authcode/` would make the OAuth folder answer
+ * for a token no OAuth flow ever produced.
+ *
+ * Before this existed, every caller asked `CredentialOAuthProvider` for the
+ * token, and a manifest declaring `bearer` got `null` back rather than an
+ * error: the provider's tokens ref is `<provider>/<connection>`, byte-identical
+ * to the ref a pasted token derives, so it read the token, failed to parse it
+ * as a JSON blob, and returned undefined by design. The connection then went
+ * upstream with no `Authorization` header at all.
+ */
+
+/** One manifest, dressed as a registry, so the resolver needs no lookup. */
+const only = (manifest: ProviderManifest): ProviderRegistry =>
+  ({ manifest: () => manifest }) as unknown as ProviderRegistry;
+
+/**
+ * Throws where the manifest declares a credential and none is stored:
+ * `credentialResolver` already says which ref is empty and which command fills
+ * it, which beats a `null` that reaches the server as a missing header.
+ */
+export async function bearerToken(
+  manifest: ProviderManifest,
+  connectionId: string,
+  secrets: SecretStore,
+): Promise<string | null> {
+  const resolved = await credentialResolver(only(manifest), secrets)(manifest.id, connectionId);
+
+  switch (resolved.kind) {
+    case 'none':
+      return null;
+    case 'oauth':
+      return resolved.accessToken;
+    case 'bearer':
+      return resolved.token;
+    default:
+      // Unreachable: `defineProvider` refuses every other kind on an mcp
+      // connector. Kept so the guard and this switch cannot drift apart
+      // silently — if one is ever relaxed, the other says so.
+      throw new Error(
+        `Provider "${manifest.id}" resolves to a "${resolved.kind}" credential, which cannot be sent as a bearer token.`,
+      );
+  }
+}
+
+/**
+ * The same token, read exactly as stored, without the refresh machinery.
+ *
+ * For `connect`: it has just written the token and wants that one, not a
+ * refreshed one. Going through `bearerToken` there would populate the process's
+ * access-token cache under the provisional connection id — `linear.pending`,
+ * a key naming a connection that will not exist a moment later — and could
+ * spend a network round trip re-exchanging a token written seconds ago.
+ *
+ * Identical to `bearerToken` for every non-OAuth kind, because a stored token
+ * has no other reading.
+ */
+export async function bearerTokenAsStored(
+  manifest: ProviderManifest,
+  connectionId: string,
+  secrets: SecretStore,
+): Promise<string | null> {
+  if (manifest.auth.kind !== 'oauth') return bearerToken(manifest, connectionId, secrets);
+
+  const provider = new CredentialOAuthProvider({
+    manifest,
+    connectionId,
+    credentials: secrets,
+    scopes: manifest.auth.scopes,
+  });
+
+  const tokens = (await provider.tokens()) as { access_token?: string } | undefined;
+  return tokens?.access_token ?? null;
+}

package/src/connectivity/manifest/connector.ts

@@ -17,6 +17,21 @@ import { z } from 'zod';
 export const mcpConnectorSchema = z.object({
   kind: z.literal('mcp'),
   endpoint: z.url(),
+  /**
+   * Sent on every request to this server, discovery included.
+   *
+   * The `http` connector filters what it exposes with `operations` above,
+   * because it reads a document listing everything the API can do. An mcp
+   * server decides that for itself and answers `tools/list` with whatever it
+   * chose — so where a vendor makes the choice configurable, the configuration
+   * is a header they define. GitHub's `X-MCP-Toolsets` is the case in hand: the
+   * default is broad and `all` is broader, and this is the only way to ask for
+   * less.
+   *
+   * Never `Authorization` — that one belongs to `auth:`, and the check in
+   * `./provider.ts` refuses it rather than letting the two disagree silently.
+   */
+  headers: z.record(z.string(), z.string()).optional(),
 });
 
 /**

package/src/connectivity/manifest/provider.ts

@@ -196,6 +196,45 @@ export function defineProvider(input: unknown): ProviderManifest {
     );
   }
 
+  if (manifest.connector.kind === 'mcp') {
+    const auth = manifest.auth;
+
+    // The transport sends exactly one header, `Authorization: Bearer <token>`,
+    // because that is what the MCP specification says a client sends. Every
+    // other token kind puts the secret somewhere the transport has nowhere to
+    // put it: `api_key` in a query string or a named header, `header` under a
+    // name of its own, `basic` in a different scheme entirely. Such a manifest
+    // validates and then connects *unauthenticated* — no error, an empty tool
+    // list, and nothing to read that says why.
+    if (auth.kind !== 'none' && auth.kind !== 'oauth' && auth.kind !== 'bearer') {
+      throw new Error(
+        `Provider "${manifest.id}": an mcp connector authenticates with "Authorization: Bearer", so its auth must be "none", "oauth", or "bearer" — not "${auth.kind}". There is nowhere else on the request for the transport to put a credential.`,
+      );
+    }
+
+    // Same failure, one field further in. `bearer` may rename its header, and
+    // `resolveBearer` honours that — but the mcp transport does not read the
+    // resolved credential at all, only the token, so a renamed header would be
+    // silently ignored and the token sent under `Authorization` regardless.
+    if (auth.kind === 'bearer' && auth.header) {
+      throw new Error(
+        `Provider "${manifest.id}": an mcp connector always sends its token as "Authorization: Bearer", so auth.header ("${auth.header}") cannot be honoured. Remove it, or reach this service with an http connector.`,
+      );
+    }
+
+    // The third spelling of the same collision. Connector headers are for what
+    // the *server* offers as configuration; the credential is the auth block's,
+    // and a manifest setting both would have one quietly overwrite the other
+    // depending on which the transport merged last.
+    for (const name of Object.keys(manifest.connector.headers ?? {})) {
+      if (name.toLowerCase() === 'authorization') {
+        throw new Error(
+          `Provider "${manifest.id}": connector.headers may not set "${name}" — the credential comes from auth, and setting both would leave which one is sent up to merge order.`,
+        );
+      }
+    }
+  }
+
   const names = new Set<string>();
   for (const bundle of manifest.bundles ?? []) {
     if (names.has(bundle.name)) {

package/src/connectivity/transports/factory.ts

@@ -2,7 +2,7 @@ import type { AnyConnector, ProviderDefinition, ProviderManifest } from '#connec
 import type { SecretStore } from '#secrets';
 import type { ProviderRegistry } from '#registry';
 import { basicCredential } from '#connectivity/auth/basic/index.ts';
-import { resolveUpstreamToken } from '#connectivity/auth/oauth-authcode/index.ts';
+import { bearerToken } from '#connectivity/auth/token.ts';
 import { createCompositeConnector } from './composite/index.ts';
 import { createDavConnector } from './dav/index.ts';
 import { createFsConnector } from './fs/index.ts';
@@ -114,7 +114,11 @@ function build(
     case 'mcp':
       return createMcpConnector({
         endpoint: manifest.connector.endpoint,
-        accessToken: () => resolveUpstreamToken(manifest, connectionId, options.credentials),
+        ...(manifest.connector.headers ? { headers: manifest.connector.headers } : {}),
+        // Not `resolveUpstreamToken` directly: that one answers only for OAuth,
+        // and returns null for a provider whose token the operator pasted —
+        // which reaches the server as a missing header rather than an error.
+        accessToken: () => bearerToken(manifest, connectionId, options.credentials),
       });
 
     case 'imap':

package/src/connectivity/transports/mcp/index.ts

@@ -24,6 +24,8 @@ export interface McpConnectorOptions {
   readonly endpoint: string;
   /** Supplies the bearer token for an upstream call; refreshes if needed. */
   readonly accessToken: () => Promise<string | null>;
+  /** Whatever the manifest's connector declares, sent on every request. */
+  readonly headers?: Record<string, string> | undefined;
   readonly fetch?: typeof globalThis.fetch;
 }
 
@@ -127,7 +129,14 @@ export function createMcpConnector(options: McpConnectorOptions): Connector {
 
     const transport = new StreamableHTTPClientTransport(new URL(options.endpoint), {
       requestInit: {
-        headers: token ? { authorization: `Bearer ${token}` } : {},
+        // The declared headers first, so the credential cannot be displaced by
+        // one. `defineProvider` already refuses a declared `Authorization`, and
+        // this order means a manifest loaded some other way fails safe rather
+        // than sending someone else's header in its place.
+        headers: {
+          ...(options.headers ?? {}),
+          ...(token ? { authorization: `Bearer ${token}` } : {}),
+        },
       },
       ...(options.fetch ? { fetch: options.fetch } : {}),
     } as never);

package/src/deployments/deploy.ts

@@ -1,5 +1,6 @@
 import { ConfigError, resolveDeployTarget, type DeployConfig } from '#profile';
 import { announce, fail, heading, ok, print, style, warn } from '#cli/output.ts';
+import { staleNudge } from '#cli/release.ts';
 import { confirm, isInteractive } from '#cli/prompt.ts';
 import { openSecretStoreFor, resolveProfile, type GlobalFlags } from '#cli/runtime.ts';
 import { resolveTarget, vaultEnv } from './bootstrap.ts';
@@ -57,6 +58,12 @@ export async function deploy(flags: DeployFlags): Promise<void> {
   // rejected on boot should be rejected here, not after a five-minute build.
   print(ok(`${resolution.profilePath} is valid`));
 
+  // The CLI planning this rollout, not the image it will build. An old one
+  // plans an old rollout, and a build is the most expensive place to find that
+  // out.
+  const stale = await staleNudge();
+  if (stale !== null) print(warn(stale));
+
   const declared = await resolveTarget({
     config,
     profilePath: resolution.profilePath,

package/src/providers/github/index.ts

@@ -0,0 +1,68 @@
+import { defineProvider } from '#connectivity';
+import { GITHUB_REDACT } from './redact.ts';
+
+/**
+ * GitHub, through the server GitHub runs.
+ *
+ * Not OAuth, and not for want of trying. GitHub's remote MCP server does not
+ * offer Dynamic Client Registration — the thing that makes Notion and Linear
+ * cost fifteen lines — so there is no client to register ourselves as. A client
+ * of the operator's own is the documented fallback everywhere else, and it
+ * fails here on a detail: an OAuth App matches its callback URL exactly,
+ * including the port, and `connect` listens on a port the kernel picks. What is
+ * left is the credential GitHub does issue for exactly this — a token you
+ * generate once and paste. See ADR-033.
+ *
+ * The toolsets header is the whole reason `connector.headers` exists. GitHub
+ * serves a different tool list per toolset and `all` is far more than an agent
+ * reasons over; this asks for the ones an agent working in a repository
+ * actually uses. It is one string to change, and `docs/detailed/setup/github.md`
+ * records the read-only variant for someone who wants a narrower connection.
+ */
+export const github = defineProvider({
+  id: 'github',
+  name: 'GitHub',
+  description: 'Repositories, issues, pull requests, and workflow runs, via GitHub\'s official MCP server.',
+  connector: {
+    kind: 'mcp',
+    endpoint: 'https://api.githubcopilot.com/mcp/',
+    headers: { 'X-MCP-Toolsets': 'context,repos,issues,pull_requests,actions,labels' },
+  },
+  auth: { kind: 'bearer' },
+  // GitHub's own MCP server answers `get_me`, so a tool identity would work.
+  // This asks the REST API instead, for one reason: it is a plain GET that
+  // costs no MCP handshake, and `connect` runs it before discovery — so when
+  // the token is wrong, the thing that fails is the cheap call rather than the
+  // expensive one.
+  identity: { kind: 'http', url: 'https://api.github.com/user', field: 'login' },
+  redact: GITHUB_REDACT,
+  setup: {
+    summary:
+      'GitHub issues a fine-grained personal access token for this. There is no OAuth app to register: ' +
+      'GitHub\'s MCP server does not support the dynamic registration Notion and Linear use, and an OAuth ' +
+      'app of your own would need a fixed callback port, which this CLI does not have. You are asked once.',
+    docs: 'docs/detailed/setup/github.md',
+    docs_url: 'https://github.com/settings/personal-access-tokens',
+    steps: [
+      'Open https://github.com/settings/personal-access-tokens and choose "Generate new token".',
+      'Name it "Lanes Link" — the name is how you revoke this one later without touching your other tokens — and set an expiry you are willing to renew.',
+      'Resource owner: yourself, or the organisation whose repositories you want reachable. An organisation may require an owner to approve the token before it works.',
+      'Repository access: only the repositories you want an agent to see. "All repositories" is the setting people regret.',
+      'Permissions, matching the toolsets this connects: Contents (read), Metadata (read, added for you), Issues (read and write), Pull requests (read and write), Actions (read). Add Administration or Workflows only if you know you need them.',
+      'Generate, then copy the token. GitHub shows it once, and it starts with github_pat_.',
+      'When it expires, generate another and run: lanes link connect github --replace.',
+    ],
+    troubleshooting:
+      'GitHub refused the token. The usual causes are an expired token, a repository the token was not granted, ' +
+      'or an organisation token still waiting on an owner\'s approval. Generate a new one at ' +
+      'https://github.com/settings/personal-access-tokens and re-run: lanes link connect github --replace.',
+    prompts: [
+      {
+        key: 'token',
+        label: 'GitHub personal access token',
+        secret: true,
+        scope: 'connection' as const,
+      },
+    ],
+  },
+});

package/src/providers/github/redact.ts

@@ -0,0 +1,109 @@
+/**
+ * What survives into the audit log when GitHub is written to.
+ *
+ * The default withholds every value, which is right for a server whose
+ * capabilities we did not author and cannot know the shape of. It is wrong for
+ * the writes: "an issue was edited" without saying which issue, in which
+ * repository, or into what state is a record of nothing.
+ *
+ * The line drawn is the one Gmail and Drive draw. Identifiers and flags are
+ * kept — `owner`, `repo`, the number, the method, the state, the labels and
+ * reviewers, the merge method. The user's own words are withheld: `title`,
+ * `body`, `commit_message`. A log that said which pull request was merged and
+ * by what method has answered the question; one that also quoted the commit
+ * message has started keeping a copy of the work.
+ *
+ * `assignees` and `reviewers` are kept, and that departs from withholding
+ * people the way `drive.permissions.create` keeps `emailAddress`: assigning
+ * somebody *is* the change, so a log that cannot say to whom has failed at its
+ * one question.
+ *
+ * Two caveats worth stating rather than discovering.
+ *
+ * A proxied server's capabilities are discovered, not declared, so the argument
+ * names below come from GitHub's published tool documentation rather than from
+ * a schema in this repository. `cli/tools.test.ts` checks these names for every
+ * `http` provider and cannot check them here — there is nothing local to check
+ * against. A name that is wrong, or that GitHub renames later, fails the way
+ * that test exists to prevent: silently, with the value withheld and the log
+ * reading exactly as it does when redaction is working. `lanes link doctor`
+ * reporting capability drift is the signal that this list wants re-reading.
+ *
+ * Reads are absent on purpose. `search_issues` takes a `query`, which is a
+ * question somebody asked rather than a record of something that happened —
+ * the same ground Gmail withholds `q` on.
+ */
+export const GITHUB_REDACT: Record<string, string[]> = {
+  // `method` is the verb — create, update, close — and without it the entry
+  // says an issue was written to and not what was done to it.
+  issue_write: [
+    'owner',
+    'repo',
+    'issue_number',
+    'method',
+    'state',
+    'state_reason',
+    'labels',
+    'assignees',
+    'milestone',
+    'type',
+    'duplicate_of',
+  ],
+  add_issue_comment: ['owner', 'repo', 'issue_number', 'comment_id', 'reaction'],
+  sub_issue_write: [
+    'owner',
+    'repo',
+    'issue_number',
+    'method',
+    'sub_issue_id',
+    'replace_parent',
+    'after_id',
+    'before_id',
+  ],
+  // No `title`: a branch name says which change this is, and the title is the
+  // author's summary of it.
+  create_pull_request: [
+    'owner',
+    'repo',
+    'head',
+    'base',
+    'draft',
+    'reviewers',
+    'maintainer_can_modify',
+  ],
+  update_pull_request: [
+    'owner',
+    'repo',
+    'pullNumber',
+    'base',
+    'state',
+    'draft',
+    'reviewers',
+    'maintainer_can_modify',
+  ],
+  merge_pull_request: ['owner', 'repo', 'pullNumber', 'merge_method'],
+  // `event` is the one that matters: approving is a different act from
+  // commenting, and this is the only place that distinction is recorded.
+  pull_request_review_write: [
+    'owner',
+    'repo',
+    'pullNumber',
+    'method',
+    'event',
+    'commitID',
+    'threadId',
+  ],
+  add_comment_to_pending_review: [
+    'owner',
+    'repo',
+    'pullNumber',
+    'path',
+    'line',
+    'startLine',
+    'side',
+    'startSide',
+    'subjectType',
+  ],
+  add_reply_to_pull_request_comment: ['owner', 'repo', 'pullNumber', 'commentId', 'reaction'],
+  update_pull_request_branch: ['owner', 'repo', 'pullNumber', 'expectedHeadSha'],
+};

package/src/providers/index.ts

@@ -2,6 +2,7 @@ import type { ProviderDefinition, ProviderManifest } from '#connectivity';
 import { calendar } from './google/calendar/index.ts';
 import { contacts } from './google/contacts/index.ts';
 import { docs } from './google/docs/index.ts';
+import { github } from './github/index.ts';
 import { drive } from './google/drive/index.ts';
 import { driveMcp } from './google/drive-mcp/index.ts';
 import { gmail } from './google/gmail/index.ts';
@@ -14,6 +15,7 @@ import { icloudDrive } from './icloud/drive/index.ts';
 import { icloudMail } from './icloud/mail/index.ts';
 import { linear } from './linear/index.ts';
 import { notion } from './notion/index.ts';
+import { slack } from './slack/index.ts';
 
 /**
  * Every provider, in one list.
@@ -48,6 +50,8 @@ import { notion } from './notion/index.ts';
 export const PROVIDERS: readonly (ProviderManifest | ProviderDefinition)[] = [
   notion,
   linear,
+  github,
+  slack,
   gmail,
   drive,
   sheets,
@@ -88,6 +92,8 @@ export {
   tasks,
 } from './google/index.ts';
 export { icloudCalendar, icloudContacts, icloudDrive, icloudMail } from './icloud/index.ts';
+export { github } from './github/index.ts';
 export { linear } from './linear/index.ts';
 export { notion } from './notion/index.ts';
+export { slack } from './slack/index.ts';
 export { SCOPE_MEANINGS, type ScopeMeaning } from './scopes.ts';

package/src/providers/slack/index.ts

@@ -0,0 +1,75 @@
+import { defineProvider } from '#connectivity';
+import { SLACK_REDACT } from './redact.ts';
+
+/**
+ * Slack, through the server Slack runs.
+ *
+ * The only provider here whose vendor has closed every door but one. Slack's
+ * MCP server does not offer Dynamic Client Registration — their documentation
+ * says so outright — and a client of your own cannot work either: Slack
+ * requires an HTTPS redirect URI, and `connect` listens on `http://127.0.0.1`
+ * on a port the kernel picks. There is no proxy, tunnel, or flag that makes a
+ * loopback listener HTTPS. A broker would answer it and `defineProvider`
+ * refuses one on an mcp connector, because the SDK owns that exchange.
+ *
+ * What is left is the user token the Slack app mints when you install it, sent
+ * as `Authorization: Bearer`. Slack supports that path deliberately; it is the
+ * arrangement their own docs describe for a client that cannot register. See
+ * ADR-033.
+ *
+ * Unlike GitHub, this does cost a console visit — creating a Slack app is the
+ * only way to get a user token at all, and no amount of implementation work on
+ * this side removes it. The setup block is therefore longer than any other here
+ * except Google's, and that is the honest shape of it.
+ */
+export const slack = defineProvider({
+  id: 'slack',
+  name: 'Slack',
+  description: 'Messages, threads, channels, files, and canvases, via Slack\'s official MCP server.',
+  connector: { kind: 'mcp', endpoint: 'https://mcp.slack.com/mcp' },
+  auth: { kind: 'bearer' },
+  /**
+   * The person, not the workspace, and the distinction is load-bearing.
+   *
+   * `settleIdentity` matches a resolved account against existing connections
+   * to decide whether this is a reconnect or a new account. Labelled by
+   * workspace, a second person's token in the same workspace would look like a
+   * reconnect of the first and overwrite their credential. `auth.test` returns
+   * both; `user` is the one that is unique per token.
+   *
+   * Slack answers a bad token with HTTP 200 and `{ok: false}`, so a wrong token
+   * reaches `connect`'s "which account is this?" fallback rather than a clear
+   * refusal. Discovery fails loudly one step later, which is where the real
+   * error is.
+   */
+  identity: { kind: 'http', url: 'https://slack.com/api/auth.test', field: 'user' },
+  redact: SLACK_REDACT,
+  setup: {
+    summary:
+      'Slack needs an app of its own — there is no personal access token and no way to register ' +
+      'automatically, because Slack requires an HTTPS callback and this CLI listens on localhost. ' +
+      'You create the app once, install it to your workspace, and paste the user token it mints.',
+    docs: 'docs/detailed/setup/slack.md',
+    docs_url: 'https://api.slack.com/apps',
+    steps: [
+      'Open https://api.slack.com/apps and choose "Create New App" → "From scratch". Name it "Lanes Link" and pick the workspace.',
+      'Open "OAuth & Permissions" and scroll to "Scopes". Add these under USER TOKEN SCOPES — not Bot Token Scopes; the MCP server reads the user token: search:read.public, search:read.private, search:read.im, search:read.mpim, search:read.users, search:read.files, channels:history, groups:history, im:history, mpim:history, channels:read, groups:read, mpim:read, users:read, chat:write, files:read.',
+      'For reactions, canvases, or creating channels, add reactions:write, canvases:read, canvases:write, or channels:write as well. Those tools are listed either way and fail at call time without the scope.',
+      'Scroll up and choose "Install to Workspace", then approve. A Slack admin may have to approve it for you.',
+      'Copy the "User OAuth Token" from the same page. It starts with xoxp- — not the bot token, which starts with xoxb- and will not work here.',
+      'The token does not expire unless you enable token rotation on the app. If you rotate or reinstall, run: lanes link connect slack --replace.',
+    ],
+    troubleshooting:
+      'Slack refused the token. The usual causes are a bot token (xoxb-) pasted where the user token (xoxp-) belongs, ' +
+      'a scope missing from USER TOKEN SCOPES, or an app that was reinstalled since — reinstalling mints a new token. ' +
+      'Copy the User OAuth Token from https://api.slack.com/apps and re-run: lanes link connect slack --replace.',
+    prompts: [
+      {
+        key: 'token',
+        label: 'Slack user OAuth token (xoxp-…)',
+        secret: true,
+        scope: 'connection' as const,
+      },
+    ],
+  },
+});

package/src/providers/slack/redact.ts

@@ -0,0 +1,50 @@
+/**
+ * What survives into the audit log when Slack is written to.
+ *
+ * The line is the one Gmail draws for mail, because it is the same object: a
+ * message someone wrote. Where it went is recorded, what it said is not.
+ * `channel_id` is an identifier, `thread_ts` says which conversation, and
+ * `message` is the whole of the content — a log that quoted it would be a
+ * second copy of everybody's Slack, held somewhere nobody expects one.
+ *
+ * Keys are the *shortened* names. `shortenName` strips a redundant provider
+ * prefix, so the upstream `slack_send_message` is `send_message` here, in
+ * policy, and in the audit log. Keying this block on the upstream name would
+ * match nothing and withhold everything, silently.
+ *
+ * The same caveat as GitHub's, and it is worth repeating rather than
+ * cross-referencing: a proxied server's capabilities are discovered, not
+ * declared, so `cli/tools.test.ts` cannot check these names against a local
+ * schema the way it does for every `http` provider. They were read off the
+ * tool schemas Slack's server actually publishes rather than guessed, but a
+ * rename upstream fails the way that test exists to prevent — the value is
+ * withheld and the log reads exactly as it does when redaction is working.
+ * `lanes link doctor` reporting capability drift is the signal to re-read this.
+ *
+ * Some entries name tools the default scope set cannot call. That is
+ * deliberate: Slack lists every tool regardless of scope and refuses at call
+ * time, so someone who later adds `reactions:write` or `canvases:write` finds
+ * the log already correct rather than discovering it is not.
+ */
+export const SLACK_REDACT: Record<string, string[]> = {
+  // Everything except the message. `reply_broadcast` is kept because "replied
+  // in a thread" and "replied in a thread and pushed it to the channel" are
+  // different acts, and only this argument distinguishes them.
+  send_message: ['channel_id', 'thread_ts', 'reply_broadcast', 'unfurl_app_links', 'draft_id'],
+  send_message_draft: ['channel_id', 'thread_ts'],
+  schedule_message: ['channel_id', 'post_at', 'thread_ts', 'reply_broadcast'],
+  // The emoji is kept. It is a name from a fixed vocabulary rather than
+  // something anyone typed — the same reading that lets Gmail keep label ids —
+  // and an entry saying a message was reacted to without saying how records
+  // nothing anyone would look for.
+  add_reaction: ['channel_id', 'message_ts', 'emoji'],
+  // Nothing. A canvas has no identifier until Slack answers with one, so both
+  // arguments are the document: `title` is the author's words and `content` is
+  // the whole of it. This is `gmail.send_message`'s position, reached the same
+  // way — there is no identifier here to keep, so keeping anything would mean
+  // keeping content.
+  create_canvas: [],
+  // `sections` is withheld along with `content`: each entry carries its own
+  // markdown, so keeping the array would keep the document a second time.
+  update_canvas: ['canvas_id', 'action', 'section_id'],
+};