@noir-ai/daemon 1.0.0-beta.1 → 1.2.0-beta.1

package/dist/index.js

@@ -1,3 +1,372 @@
+// src/clickup-write.ts
+var CLICKUP_BASE = "https://api.clickup.com/api/v2";
+var ID_PATTERN = /^[A-Za-z0-9_-]+$/;
+function assertId(value, field) {
+  if (typeof value !== "string" || !ID_PATTERN.test(value)) {
+    throw new InvalidOp(`invalid ${field}: ${JSON.stringify(value)} (must match ${ID_PATTERN})`);
+  }
+  return value;
+}
+var InvalidOp = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "InvalidOp";
+  }
+};
+var OP_ALIASES = {
+  "task:set-status": "status",
+  "task:create-subtask": "subtask",
+  "task:comment": "comment",
+  "task:batch-create": "batch"
+};
+function normalizeOp(op) {
+  const resolved = OP_ALIASES[op] ?? op;
+  if (resolved !== "status" && resolved !== "subtask" && resolved !== "comment" && resolved !== "batch") {
+    throw new InvalidOp(`unknown op: ${JSON.stringify(op)}`);
+  }
+  return resolved;
+}
+function resolveBinding(payload, binding) {
+  const listId = (typeof payload.listId === "string" ? payload.listId : void 0) ?? binding.listId;
+  const teamId = (typeof payload.teamId === "string" ? payload.teamId : void 0) ?? binding.teamId;
+  const resolved = {};
+  if (listId !== void 0) resolved.listId = assertId(listId, "listId");
+  if (teamId !== void 0) resolved.teamId = assertId(teamId, "teamId");
+  return resolved;
+}
+function buildStatus(payload) {
+  const taskId = assertId(String(payload.taskId ?? ""), "taskId");
+  const status = payload.status;
+  if (typeof status !== "string" || status.length === 0) {
+    throw new InvalidOp("status op requires payload.status (non-empty string)");
+  }
+  return {
+    method: "PUT",
+    url: `${CLICKUP_BASE}/task/${taskId}`,
+    body: { status },
+    target: `task/${taskId}`
+  };
+}
+function buildSubtask(payload, binding) {
+  const resolved = resolveBinding(payload, binding);
+  if (!resolved.listId)
+    throw new InvalidOp(
+      "subtask op requires a listId (payload.listId or integrations.clickup.listId)"
+    );
+  const parentTaskId = assertId(String(payload.parentTaskId ?? ""), "parentTaskId");
+  const name = payload.name;
+  if (typeof name !== "string" || name.length === 0) {
+    throw new InvalidOp("subtask op requires payload.name (non-empty string)");
+  }
+  const create = {
+    method: "POST",
+    url: `${CLICKUP_BASE}/list/${resolved.listId}/task`,
+    body: { name, parent: parentTaskId },
+    target: `list/${resolved.listId}/task (parent ${parentTaskId})`
+  };
+  const reqs = [create];
+  const status = typeof payload.status === "string" && payload.status.length > 0 ? payload.status : void 0;
+  if (status !== void 0) {
+    reqs.push({
+      method: "PUT",
+      url: `${CLICKUP_BASE}/task/__sub_id__`,
+      body: { status },
+      target: `task/<new subtask> (status)`
+    });
+  }
+  return reqs;
+}
+function buildComment(payload) {
+  const taskId = assertId(String(payload.taskId ?? ""), "taskId");
+  const commentText = payload.commentText;
+  if (typeof commentText !== "string" || commentText.length === 0) {
+    throw new InvalidOp("comment op requires payload.commentText (non-empty string)");
+  }
+  const notifyAll = typeof payload.notifyAll === "boolean" ? payload.notifyAll : false;
+  const body = { comment_text: commentText, notify_all: notifyAll };
+  if (payload.assigneeId !== void 0 && payload.assigneeId !== null) {
+    const assignee = typeof payload.assigneeId === "number" ? payload.assigneeId : Number(payload.assigneeId);
+    if (!Number.isFinite(assignee))
+      throw new InvalidOp("comment op payload.assigneeId must be a number");
+    body.assignee = assignee;
+  }
+  return {
+    method: "POST",
+    url: `${CLICKUP_BASE}/task/${taskId}/comment`,
+    body,
+    target: `task/${taskId}/comment`
+  };
+}
+function parseH2Tasks(markdown) {
+  const lines = markdown.split(/\r?\n/);
+  const tasks = [];
+  let cur = null;
+  const desc = [];
+  for (const raw of lines) {
+    const line = raw;
+    const h2 = /^##\s+(.+?)\s*$/.exec(line);
+    if (h2) {
+      const title = h2[1];
+      if (title !== void 0) {
+        if (cur) cur.description = desc.join("\n").trim() || void 0;
+        cur = { name: title.trim() };
+        desc.length = 0;
+        tasks.push(cur);
+        continue;
+      }
+    }
+    if (!cur) {
+      if (line.trim().length === 0) continue;
+      cur = { name: line.trim() };
+      desc.length = 0;
+      tasks.push(cur);
+      continue;
+    }
+    const meta = /^-\s+([A-Za-z_]+)\s*:\s*(.+?)\s*$/.exec(line);
+    if (meta) {
+      const keyRaw = meta[1];
+      const valRaw = meta[2];
+      if (keyRaw !== void 0 && valRaw !== void 0) {
+        const key = keyRaw.toLowerCase();
+        const val = valRaw;
+        if (key === "tag" || key === "tags") {
+          cur.tags = [
+            ...cur.tags ?? [],
+            ...val.split(",").map((t) => t.trim()).filter((t) => t.length > 0)
+          ];
+        } else if (key === "assignee" || key === "assignees") {
+          const ids = val.split(",").map((t) => t.trim()).map((t) => Number(t)).filter((n) => Number.isFinite(n));
+          cur.assignees = [...cur.assignees ?? [], ...ids];
+        } else if (key === "status") {
+          cur.status = val;
+        } else {
+          desc.push(line);
+        }
+      } else {
+        desc.push(line);
+      }
+    } else {
+      desc.push(line);
+    }
+  }
+  if (cur) cur.description = desc.join("\n").trim() || void 0;
+  return tasks.filter((t) => t.name.length > 0);
+}
+function normalizeBatchInput(payload) {
+  if (Array.isArray(payload.tasks)) {
+    return payload.tasks.map((t, i) => {
+      if (typeof t !== "object" || t === null)
+        throw new InvalidOp(`batch payload.tasks[${i}] must be an object`);
+      const obj = t;
+      const name = obj.name;
+      if (typeof name !== "string" || name.length === 0)
+        throw new InvalidOp(`batch payload.tasks[${i}].name required`);
+      const out = { name };
+      if (typeof obj.description === "string") out.description = obj.description;
+      if (Array.isArray(obj.tags)) out.tags = obj.tags.map((s) => String(s));
+      if (Array.isArray(obj.assignees))
+        out.assignees = obj.assignees.map((n) => Number(n)).filter((n) => Number.isFinite(n));
+      if (typeof obj.status === "string") out.status = obj.status;
+      return out;
+    });
+  }
+  if (typeof payload.markdown === "string") {
+    return parseH2Tasks(payload.markdown);
+  }
+  throw new InvalidOp("batch op requires payload.tasks[] OR payload.markdown (H2-per-task)");
+}
+function buildBatch(payload, binding) {
+  const resolved = resolveBinding(payload, binding);
+  if (!resolved.listId)
+    throw new InvalidOp(
+      "batch op requires a listId (payload.listId or integrations.clickup.listId)"
+    );
+  const tasks = normalizeBatchInput(payload);
+  if (tasks.length === 0)
+    throw new InvalidOp("batch op yielded no tasks (empty markdown / tasks[])");
+  return tasks.map((t, i) => {
+    const body = { name: t.name };
+    if (t.description !== void 0) body.description = t.description;
+    if (t.tags !== void 0 && t.tags.length > 0) body.tags = t.tags;
+    if (t.assignees !== void 0 && t.assignees.length > 0) body.assignees = t.assignees;
+    return {
+      method: "POST",
+      url: `${CLICKUP_BASE}/list/${resolved.listId}/task`,
+      body,
+      target: `list/${resolved.listId}/task (#${i + 1} ${t.name.slice(0, 40)})`
+    };
+  });
+}
+function buildRequests(opRaw, payload, binding) {
+  const op = normalizeOp(opRaw);
+  switch (op) {
+    case "status":
+      return { op, requests: [buildStatus(payload)] };
+    case "subtask":
+      return { op, requests: buildSubtask(payload, binding) };
+    case "comment":
+      return { op, requests: [buildComment(payload)] };
+    case "batch":
+      return { op, requests: buildBatch(payload, binding) };
+  }
+}
+function previewRows(requests) {
+  return requests.map((r) => ({
+    method: r.method,
+    url: r.url,
+    ...r.body !== void 0 ? { body: r.body } : {},
+    auth: "pk_***",
+    target: r.target
+  }));
+}
+function authHeaders(token) {
+  return {
+    "content-type": "application/json",
+    authorization: `pk_${token}`
+  };
+}
+function rateLimitWaitMs(res) {
+  const reset = res.headers.get("X-RateLimit-Reset");
+  if (reset === null) return void 0;
+  const epochSec = Number(reset);
+  if (!Number.isFinite(epochSec)) return void 0;
+  const waitMs = epochSec * 1e3 - Date.now();
+  if (waitMs <= 0) return 0;
+  if (waitMs > 6e4) return 6e4;
+  return waitMs;
+}
+async function sleep(ms) {
+  if (ms <= 0) return;
+  await new Promise((r) => setTimeout(r, ms));
+}
+async function executeOne(req, token, fetchImpl) {
+  const init = {
+    method: req.method,
+    headers: authHeaders(token),
+    ...req.body !== void 0 ? { body: JSON.stringify(req.body) } : {}
+  };
+  let res;
+  try {
+    res = await fetchImpl(req.url, init);
+  } catch (err) {
+    return {
+      target: req.target,
+      method: req.method,
+      url: req.url,
+      httpStatus: 0,
+      success: false,
+      response: {},
+      error: err instanceof Error ? err.message : String(err)
+    };
+  }
+  if (res.status === 429) {
+    const waitMs = rateLimitWaitMs(res) ?? 1e3;
+    await sleep(waitMs);
+    try {
+      res = await fetchImpl(req.url, init);
+    } catch (err) {
+      return {
+        target: req.target,
+        method: req.method,
+        url: req.url,
+        httpStatus: 429,
+        success: false,
+        response: {},
+        rateLimitedWaitMs: waitMs,
+        error: err instanceof Error ? err.message : String(err)
+      };
+    }
+    const final = await toExecResult(req, res);
+    return { ...final, rateLimitedWaitMs: waitMs };
+  }
+  return toExecResult(req, res);
+}
+async function toExecResult(req, res) {
+  const success = res.status >= 200 && res.status < 300;
+  let parsed = {};
+  try {
+    parsed = await res.json();
+  } catch {
+    try {
+      const text = await res.text();
+      parsed = text.length > 0 ? { _raw: text } : {};
+    } catch {
+      parsed = {};
+    }
+  }
+  const result = {
+    target: req.target,
+    method: req.method,
+    url: req.url,
+    httpStatus: res.status,
+    success,
+    response: parsed
+  };
+  if (!success) {
+    const errVal = parsed.err;
+    result.error = typeof errVal === "string" ? errVal : `HTTP ${res.status}`;
+  }
+  return result;
+}
+async function mapWithConcurrency(items, limit, fn) {
+  const results = new Array(items.length);
+  let cursor = 0;
+  const workers = Array.from({ length: Math.min(limit, items.length) }, async () => {
+    while (true) {
+      const i = cursor++;
+      if (i >= items.length) break;
+      const item = items[i];
+      if (item !== void 0) results[i] = await fn(item, i);
+    }
+  });
+  await Promise.all(workers);
+  return results;
+}
+async function executeOp(op, requests, token, fetchImpl) {
+  if (op === "subtask" && requests.length === 2) {
+    const create = requests[0];
+    const statusReq = requests[1];
+    if (!create || !statusReq) {
+      throw new InvalidOp("subtask op expects exactly two rendered requests");
+    }
+    const createRes = await executeOne(create, token, fetchImpl);
+    if (!createRes.success) return [createRes];
+    const newId = typeof createRes.response.id === "string" ? createRes.response.id : void 0;
+    if (!newId) {
+      return [
+        createRes,
+        {
+          target: statusReq.target,
+          method: statusReq.method,
+          url: statusReq.url,
+          httpStatus: 0,
+          success: false,
+          response: {},
+          error: "subtask created but no id returned; status follow-up skipped"
+        }
+      ];
+    }
+    createRes.newTaskId = newId;
+    assertId(newId, "subtask-create-response.id");
+    const realStatusReq = {
+      method: statusReq.method,
+      url: statusReq.url.replace("__sub_id__", newId),
+      target: `task/${newId} (status)`,
+      ...statusReq.body !== void 0 ? { body: statusReq.body } : {}
+    };
+    const statusRes = await executeOne(realStatusReq, token, fetchImpl);
+    return [createRes, statusRes];
+  }
+  if (op === "batch") {
+    return mapWithConcurrency(requests, 4, (req) => executeOne(req, token, fetchImpl));
+  }
+  const out = [];
+  for (const req of requests) {
+    out.push(await executeOne(req, token, fetchImpl));
+  }
+  return out;
+}
+
 // src/context-seam.ts
 import { ContextEngine } from "@noir-ai/context";
 function buildContextEngine(store, root, projectId, embedderCfg, storeDegraded) {
@@ -15,15 +384,84 @@ import { createEmbedFn, resolveEmbedderConfig } from "@noir-ai/context";
 import { resolveMemoryConfig } from "@noir-ai/memory";
 import { resolveModelConfig } from "@noir-ai/model";
 
+// src/integration-seam.ts
+import { appendFileSync, mkdirSync } from "fs";
+import { join } from "path";
+import { paths } from "@noir-ai/core";
+import { discoverIntegrations } from "@noir-ai/skills";
+function shortNameOf(name) {
+  return name.replace(/^noir-/, "");
+}
+function buildIntegrationService(root, configIntegrations = {}) {
+  let discovered = [];
+  try {
+    discovered = discoverIntegrations().map(
+      (s) => s.declaration
+    );
+  } catch {
+    discovered = [];
+  }
+  const bindings = /* @__PURE__ */ new Map();
+  for (const declaration of discovered) {
+    const cfg = configIntegrations[declaration.name] ?? configIntegrations[shortNameOf(declaration.name)];
+    const tokenEnv = cfg?.auth?.tokenEnv ?? declaration.auth.tokenEnv;
+    const effectiveRuntime = cfg?.runtime ?? declaration.runtime;
+    const binding = {
+      name: declaration.name,
+      shortName: shortNameOf(declaration.name),
+      declaration,
+      tokenEnv,
+      effectiveRuntime,
+      ...cfg?.teamId !== void 0 ? { teamId: cfg.teamId } : {},
+      ...cfg?.listId !== void 0 ? { listId: cfg.listId } : {},
+      ...cfg?.spaceId !== void 0 ? { spaceId: cfg.spaceId } : {}
+    };
+    bindings.set(binding.name, binding);
+    bindings.set(binding.shortName, binding);
+  }
+  return { root, bindings };
+}
+function findBinding(svc, name) {
+  return svc.bindings.get(name);
+}
+function resolveToken(svc, opts, env = process.env) {
+  const integration = opts.integration;
+  const envVar = opts.envVar;
+  if (integration !== void 0) {
+    const binding = findBinding(svc, integration);
+    if (!binding) return { ok: false, reason: "unknown-integration", integration };
+    const name = binding.tokenEnv;
+    const value = env[name];
+    if (typeof value === "string" && value.length > 0) {
+      return { ok: true, token: value, envVar: name };
+    }
+    return { ok: false, reason: "no-token", envVar: name };
+  }
+  if (envVar !== void 0) {
+    const value = env[envVar];
+    if (typeof value === "string" && value.length > 0) {
+      return { ok: true, token: value, envVar };
+    }
+    return { ok: false, reason: "no-token", envVar };
+  }
+  return { ok: false, reason: "no-token", envVar: "" };
+}
+function writeIntegrationAudit(root, integrationName, entry) {
+  const file = join(paths.auditDir(root), `integration-${shortNameOf(integrationName)}.jsonl`);
+  mkdirSync(paths.auditDir(root), { recursive: true });
+  appendFileSync(file, `${JSON.stringify(entry)}
+`, "utf8");
+}
+
 // src/lifecycle.ts
-import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "fs";
+import { existsSync, mkdirSync as mkdirSync2, readFileSync, rmSync, writeFileSync } from "fs";
 import { homedir } from "os";
-import { join } from "path";
+import { join as join2 } from "path";
 function noirHome() {
-  return join(homedir(), ".noir");
+  return join2(homedir(), ".noir");
 }
 function daemonJsonPath() {
-  return process.env.NOIR_DAEMON_JSON ?? join(noirHome(), "daemon.json");
+  return process.env.NOIR_DAEMON_JSON ?? join2(noirHome(), "daemon.json");
 }
 function readDaemonRecord() {
   try {
@@ -36,7 +474,7 @@ function readDaemonRecord() {
   }
 }
 function writeDaemonRecord(rec) {
-  mkdirSync(noirHome(), { recursive: true });
+  mkdirSync2(noirHome(), { recursive: true });
   writeFileSync(daemonJsonPath(), `${JSON.stringify(rec)}
 `, "utf8");
 }
@@ -62,7 +500,7 @@ function resolveMemoryConsolidation(modelCfg) {
   const providerKey = modelCfg.tiers.consolidate ?? modelCfg.defaultProvider;
   if (!providerKey) return null;
   const block = modelCfg.providers[providerKey];
-  if (!block || !block.model) return null;
+  if (!block?.model) return null;
   return { provider: providerKey, model: block.model };
 }
 function resolveConsolidationCapability(resolvedMemory, modelCfg) {
@@ -128,7 +566,7 @@ import { z } from "zod";
 
 // src/status.ts
 import { NOIR_VERSION } from "@noir-ai/core";
-function buildStatus(project, ctx) {
+function buildStatus2(project, ctx) {
   const status = {
     noir: NOIR_VERSION,
     project: { id: project.id, name: project.name },
@@ -194,7 +632,7 @@ function createNoirServer(ctx) {
       inputSchema: {}
     },
     async () => {
-      const status = buildStatus(ctx.project, ctx);
+      const status = buildStatus2(ctx.project, ctx);
       return { content: [{ type: "text", text: JSON.stringify(status, null, 2) }] };
     }
   );
@@ -369,7 +807,7 @@ function createNoirServer(ctx) {
           paths: z.array(z.string()).optional().describe('Files/directories to index (repo-relative or absolute); defaults to ["."].')
         }
       },
-      async ({ paths: paths2 }) => {
+      async ({ paths: paths3 }) => {
         if (storeDegraded) {
           return textResult({
             ok: false,
@@ -378,7 +816,7 @@ function createNoirServer(ctx) {
           });
         }
         try {
-          const result = await context.indexPaths(paths2 && paths2.length > 0 ? paths2 : ["."]);
+          const result = await context.indexPaths(paths3 && paths3.length > 0 ? paths3 : ["."]);
           return textResult({ ok: true, ...result });
         } catch (err) {
           return textResult({ ok: false, degraded: true, error: errorMessage(err) });
@@ -541,14 +979,172 @@ function createNoirServer(ctx) {
       );
     }
   }
+  if (ctx.integrations) {
+    const integrations = ctx.integrations;
+    server.registerTool(
+      "integrations_auth",
+      {
+        description: "Resolve an integration token VALUE server-side at call time (kills the non-interactive-shell gotcha). Pass {integration:'noir-clickup'} to resolve tokenEnv from the discovered declaration, or {envVar:'CLICKUP_API_TOKEN'} to name the env var directly. Returns {ok:true,token,envVar} when present, or {ok:false,reason:'no-token',envVar} when absent (the skill then does manual-paste fallback). The token is returned ONLY in this tool result \u2014 never logged, never persisted.",
+        inputSchema: {
+          integration: z.string().optional().describe(
+            "Integration name (e.g. 'noir-clickup' or 'clickup'); resolves tokenEnv from the discovered declaration (config override honored)."
+          ),
+          envVar: z.string().optional().describe(
+            "Env-var name to read directly (e.g. CLICKUP_API_TOKEN). Used when no integration binding applies."
+          )
+        }
+      },
+      async ({ integration, envVar }) => {
+        if (integration === void 0 && envVar === void 0) {
+          return textResult({
+            ok: false,
+            reason: "invalid-input",
+            error: "pass one of {integration} or {envVar}"
+          });
+        }
+        const resolution = resolveToken(integrations, { integration, envVar });
+        return textResult(resolution);
+      }
+    );
+    const clickupBinding = findBinding(integrations, "noir-clickup");
+    if (clickupBinding && clickupBinding.effectiveRuntime === "gated-write-proxy") {
+      const binding = clickupBinding;
+      const root = integrations.root;
+      server.registerTool(
+        "noir.clickup_write",
+        {
+          description: "ClickUp gated-write-proxy: renders a DRY-RUN preview of the exact HTTP request(s) for an op, and ONLY on explicit {confirm:true} executes them server-side with the pk_ token (NO Bearer). Ops: status (PUT /task/{id}), subtask (POST /list/{list_id}/task + optional PUT status), comment (POST /task/{id}/comment), batch (loop POST /list/{list_id}/task, concurrency 4, 429 backoff on X-RateLimit-Reset). URLs are allowlisted \u2014 a caller-supplied url is ignored (prompt-injection defense). Executed writes are audited to .noir/audit/.",
+          inputSchema: {
+            op: z.enum([
+              "status",
+              "subtask",
+              "comment",
+              "batch",
+              // `task:`-prefixed aliases emitted by the LOCKED noir-clickup
+              // SKILL.md (X-T1+T2); normalized to the short form internally.
+              "task:set-status",
+              "task:create-subtask",
+              "task:comment",
+              "task:batch-create"
+            ]).describe(
+              "Write op. Short form ('status'|'subtask'|'comment'|'batch') or the task:-prefixed form the skill emits."
+            ),
+            // Flat op-specific fields (matches the LOCKED skill's call shape;
+            // the X-T3 `payload` nesting is honored by also accepting a payload
+            // object — the handler reads both).
+            taskId: z.string().optional().describe("status/comment: the ClickUp task id."),
+            status: z.string().optional().describe("status: the new status value; subtask: optional new-subtask status."),
+            parentTaskId: z.string().optional().describe("subtask: the parent task id (same list)."),
+            name: z.string().optional().describe("subtask: the new subtask name."),
+            listId: z.string().optional().describe("subtask/batch: overrides integrations.clickup.listId."),
+            teamId: z.string().optional().describe("Optional team-id override (custom-id reads)."),
+            commentText: z.string().optional().describe("comment: the comment body."),
+            notifyAll: z.boolean().optional().describe("comment: notify_all flag (default false)."),
+            assigneeId: z.number().optional().describe("comment: assignee user id (integer)."),
+            tasks: z.array(z.record(z.string(), z.unknown())).optional().describe(
+              "batch: normalized tasks array ({name,description?,tags?,assignees?,status?})."
+            ),
+            markdown: z.string().optional().describe("batch: H2-per-task markdown (## Title \\n body \\n - tag: x)."),
+            payload: z.record(z.string(), z.unknown()).optional().describe("Alternative: a single payload object with any of the fields above."),
+            confirm: z.boolean().optional().describe(
+              "HARD confirm gate. Unless true, the tool is DRY-RUN (no fetch). Default false."
+            ),
+            dryRun: z.boolean().optional().describe("Force a dry-run preview even if confirm is true (safe default wins).")
+          }
+        },
+        async (input) => {
+          const payloadRaw = {
+            ...input.payload ?? {},
+            ...Object.fromEntries(
+              Object.entries(input).filter(
+                ([k, v]) => k !== "op" && k !== "confirm" && k !== "dryRun" && k !== "payload" && v !== void 0
+              )
+            )
+          };
+          let built;
+          try {
+            built = buildRequests(input.op, payloadRaw, {
+              ...binding.teamId !== void 0 ? { teamId: binding.teamId } : {},
+              ...binding.listId !== void 0 ? { listId: binding.listId } : {}
+            });
+          } catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            return textResult({ ok: false, reason: "invalid-op", op: input.op, error: message });
+          }
+          const execute = input.confirm === true && input.dryRun !== true;
+          if (!execute) {
+            return textResult({
+              ok: true,
+              mode: "dry-run",
+              op: built.op,
+              integration: "noir-clickup",
+              preview: previewRows(built.requests),
+              note: "Pass {confirm:true} to execute. No network call was made."
+            });
+          }
+          const resolution = resolveToken(integrations, { integration: "noir-clickup" });
+          if (!resolution.ok) {
+            return textResult({
+              ok: false,
+              reason: resolution.reason,
+              // `envVar` is present on the no-token branch; the unknown-integration
+              // branch carries `integration` instead. Spread conditionally so the
+              // union narrows cleanly.
+              ..."envVar" in resolution ? { envVar: resolution.envVar } : {},
+              op: built.op,
+              error: "no token resolved; set the env var or use the manual-paste fallback"
+            });
+          }
+          const token = resolution.token;
+          const op = built.op;
+          let results;
+          try {
+            results = await executeOp(op, built.requests, token, (url, init) => fetch(url, init));
+          } catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            return textResult({ ok: false, reason: "http-error", op, error: message });
+          }
+          let audited = true;
+          for (const r of results) {
+            const entry = {
+              kind: "integration",
+              integration: "noir-clickup",
+              op: normalizeOp(input.op),
+              target: r.target,
+              method: r.method,
+              httpStatus: r.httpStatus,
+              success: r.success,
+              timestamp: Date.now(),
+              ...r.rateLimitedWaitMs !== void 0 ? { rateLimitedWaitMs: r.rateLimitedWaitMs } : {},
+              ...r.error !== void 0 ? { error: r.error } : {}
+            };
+            try {
+              writeIntegrationAudit(root, "noir-clickup", entry);
+            } catch {
+              audited = false;
+            }
+          }
+          const allOk = results.length > 0 && results.every((r) => r.success);
+          return textResult({
+            ok: allOk,
+            mode: "executed",
+            op,
+            integration: "noir-clickup",
+            results,
+            audited
+          });
+        }
+      );
+    }
+  }
   return server;
 }
 
 // src/store-seam.ts
-import { paths } from "@noir-ai/core";
+import { paths as paths2 } from "@noir-ai/core";
 import { openStore } from "@noir-ai/store";
 async function openStoreForDaemon(projectId, root) {
-  const dbPath = paths.storeDb(root, projectId);
+  const dbPath = paths2.storeDb(root, projectId);
   try {
     const store = await openStore({ projectId, root });
     return { store, dbPath, degraded: false };
@@ -599,6 +1195,7 @@ async function startHttpServer(opts) {
     daemonStore.degraded,
     resolvedMemory
   ) : void 0;
+  const integrations = buildIntegrationService(opts.project.root, opts.project.config.integrations);
   const httpServer = createServer(async (req, res) => {
     lastActivity = Date.now();
     if (req.method === "GET" && req.url === "/health") {
@@ -623,7 +1220,8 @@ async function startHttpServer(opts) {
         } : {},
         ...engine ? { engine } : {},
         ...context ? { context } : {},
-        ...memory ? { memory, memoryConsolidation } : {}
+        ...memory ? { memory, memoryConsolidation } : {},
+        ...integrations ? { integrations } : {}
       });
       const transport = new NodeStreamableHTTPServerTransport({ sessionIdGenerator: void 0 });
       await server.connect(transport);
@@ -723,6 +1321,7 @@ async function startStdioServer(ctx) {
     daemonStore.degraded,
     resolvedMemory
   ) : void 0;
+  const integrations = buildIntegrationService(ctx.project.root, ctx.project.config.integrations);
   const server = createNoirServer({
     ...ctx,
     ...daemonStore ? {
@@ -732,28 +1331,39 @@ async function startStdioServer(ctx) {
     } : {},
     ...engine ? { engine } : {},
     ...context ? { context } : {},
-    ...memory ? { memory, memoryConsolidation } : {}
+    ...memory ? { memory, memoryConsolidation } : {},
+    ...integrations ? { integrations } : {}
   });
   const transport = new StdioServerTransport();
   await server.connect(transport);
 }
 export {
+  InvalidOp,
   buildContextEngine,
+  buildIntegrationService,
   buildMemoryEngine,
-  buildStatus,
+  buildRequests,
+  buildStatus2 as buildStatus,
   buildWorkflowEngine,
   clearDaemonRecord,
   createNoirServer,
   daemonJsonPath,
   ensureDaemonRunning,
+  executeOp,
+  findBinding,
   noirHome,
   openStoreForDaemon,
+  parseH2Tasks,
   pidAlive,
+  previewRows,
   readDaemonRecord,
   resolveConsolidationCapability,
   resolveMemoryConsolidation,
+  resolveToken,
+  shortNameOf,
   startHttpServer,
   startStdioServer,
-  writeDaemonRecord
+  writeDaemonRecord,
+  writeIntegrationAudit
 };
 //# sourceMappingURL=index.js.map