@open-everywhere/create 0.8.1 → 0.9.0

package/README.md

@@ -91,7 +91,8 @@ This CLI starts on Node 18 or newer, so `--check` can report an old Node. The ap
 Node 24, so a scaffold on an older Node exits non-zero and writes nothing.
 
 The scaffolded app sends anonymous usage telemetry when it runs, ON by default. Its `README.md`
-says how to turn it off (`OE_TELEMETRY=off` on the deployment), and the full disclosure is
+says how to turn it off (`telemetry: { enabled: false }` in `agent/settings/settings.ts`, or
+`DO_NOT_TRACK=1` on the deployment), and the full disclosure is
 [Telemetry](https://github.com/open-everywhere/open-everywhere/blob/main/docs/deploy/telemetry.md).
 This CLI itself sends none.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-everywhere/create",
-  "version": "0.8.1",
+  "version": "0.9.0",
   "license": "Apache-2.0",
   "type": "module",
   "description": "npx scaffold and setup check for Open Everywhere — one step engine, reported by --check for an agent-led setup.",
@@ -46,8 +46,8 @@
     "test:env-pipe": "tsx scripts/env-pipe-test.ts"
   },
   "dependencies": {
-    "@open-everywhere/core": "0.8.1",
-    "@open-everywhere/provider-slack": "0.8.1",
+    "@open-everywhere/core": "0.9.0",
+    "@open-everywhere/provider-slack": "0.9.0",
     "tsx": "^4.23.9"
   },
   "devDependencies": {

package/src/app-memory.ts

@@ -0,0 +1,25 @@
+// The app's `memory.provider` setting, read from its own settings file (OPE-2650). The selector was
+// the OE_MEMORY_PROVIDER variable, so the database step read it from the env. It is a setting now,
+// and this CLI cannot register the app's settings, so the step reads the one value where the app
+// declares it: `agent/settings/settings.ts`, the `SETTINGS_OVERRIDES` export.
+//
+// FAIL-SOFT, the same rule as `app-naming.ts`: no file, no dependencies or a throw reads as "no
+// selector declared", which is the shipped value, so `DATABASE_URL` decides. A DYNAMIC import at
+// check time keeps the CLI's static graph free of the runtime (scripts/boot-free-test.ts).
+
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { pathToFileURL } from "node:url";
+
+/** The app's `memory.provider`, trimmed, or `""` when it declares none. Never throws. */
+export async function readAppMemoryProvider(cwd: string): Promise<string> {
+  const file = join(cwd, "agent", "settings", "settings.ts");
+  if (!existsSync(file)) return "";
+  try {
+    const mod = (await import(pathToFileURL(file).href)) as { SETTINGS_OVERRIDES?: { memory?: Record<string, unknown> } };
+    const provider = mod.SETTINGS_OVERRIDES?.memory?.["provider"];
+    return typeof provider === "string" ? provider.trim() : "";
+  } catch {
+    return "";
+  }
+}

package/src/steps/build-deploy.ts

@@ -69,7 +69,7 @@ export const buildDeployStep: SetupStep = {
         "`npm run build` (= `oe build`, then `eve build`) — must be green.",
         vercel
           ? "Deploy is a SEPARATE, explicit step: `npx vercel deploy --prod` (confirm the scope and team first). A `git push` does NOT deploy."
-          : "Deploy is a SEPARATE, explicit step: on your server, put the contract's environment in `.env` (with `OE_EGRESS_PROXY_TOKEN`), then run `docker compose up --build`. The app's `Dockerfile` builds the image, and `docker-compose.yml` puts it behind the egress proxy with Postgres. This stack runs the `justbash` sandbox backend: the agent's shell shares the app process's filesystem and environment. That is development grade, and it does not meet the contract's `sandbox-backend` requirement. See https://github.com/open-everywhere/open-everywhere/blob/main/docs/deploy/contract.md.",
+          : "Deploy is a SEPARATE, explicit step: on your server, put the contract's environment in `.env` (with `OE_EGRESS_PROXY_TOKEN`), declare `egress: { proxyUrl: \"http://oe-egress-proxy:8080\", denialLog: \"/var/log/oe-egress/denied.log\" }` in `agent/settings/settings.ts`, then run `docker compose up --build`. The app's `Dockerfile` builds the image, and `docker-compose.yml` puts it behind the egress proxy with Postgres. This stack runs the `justbash` sandbox backend: the agent's shell shares the app process's filesystem and environment. That is development grade, and it does not meet the contract's `sandbox-backend` requirement. See https://github.com/open-everywhere/open-everywhere/blob/main/docs/deploy/contract.md.",
         "Then re-run `npx @open-everywhere/create --check --host https://<host>`: it probes the deployed Slack route.",
         "The probe passes on the route's own `401 unauthorized`, which proves the function booted and the route is mounted. It does NOT prove the deployment holds SLACK_SIGNING_SECRET: the route answers the same without it. Only Event Subscriptions showing **Verified** in the Slack console proves that.",
       ],

package/src/steps/database.ts

@@ -21,11 +21,12 @@ import { routeOf, type SetupRoute, type SetupStep, type StepContext } from "../e
 import { resolveOperationalSelection } from "@open-everywhere/core/agent/operational/selection.js";
 import { resolveMemoryProviderId } from "@open-everywhere/core/agent/memory/backing-selection.js";
 import { OWNER_URL_ENV, RUNTIME_ROLE_NAME } from "@open-everywhere/core/agent/ops/two-role.js";
+import { readAppMemoryProvider } from "../app-memory.js";
 
-/** Which stores this env resolves to postgres, by the runtime's own two rules. */
-function postgresResolution(env: NodeJS.ProcessEnv): { operational: boolean; memory: boolean } {
+/** Which stores this env and the app's `memory.provider` resolve to postgres, by the runtime's own two rules. */
+function postgresResolution(env: NodeJS.ProcessEnv, memoryProvider: string): { operational: boolean; memory: boolean } {
   const op = resolveOperationalSelection(env);
-  return { operational: op.id === "postgres" && op.floor === "none", memory: resolveMemoryProviderId(env) === "postgres" };
+  return { operational: op.id === "postgres" && op.floor === "none", memory: resolveMemoryProviderId(env, memoryProvider) === "postgres" };
 }
 
 /** The next action for an unsatisfied database step, per route. */
@@ -40,10 +41,12 @@ function nextFor(route: SetupRoute): string {
 export const databaseStep: SetupStep = {
   id: "database",
   title: "Database (Postgres)",
-  check(ctx: StepContext) {
+  async check(ctx: StepContext) {
     const env = mergedEnv(ctx.cwd, ctx.env) as NodeJS.ProcessEnv;
     const route = routeOf(ctx);
-    const resolved = postgresResolution(env);
+    // The memory selector is the app's `memory.provider` setting since OPE-2650, not an env var.
+    const memoryProvider = await readAppMemoryProvider(ctx.cwd);
+    const resolved = postgresResolution(env, memoryProvider);
     if (isSet(env.DATABASE_URL) && resolved.operational && resolved.memory) {
       return {
         satisfied: true,
@@ -54,7 +57,7 @@ export const databaseStep: SetupStep = {
     }
     const pointedAway = [
       ...(resolved.operational || !isSet(env.OE_OPERATIONAL_PROVIDER) ? [] : ["OE_OPERATIONAL_PROVIDER"]),
-      ...(resolved.memory || !isSet(env.OE_MEMORY_PROVIDER) ? [] : ["OE_MEMORY_PROVIDER"]),
+      ...(resolved.memory || memoryProvider === "" ? [] : ["memory.provider in agent/settings/settings.ts"]),
     ];
     return {
       satisfied: false,

package/src/steps/env-checklist.ts

@@ -62,10 +62,10 @@ export const envChecklistStep: SetupStep = {
         "Both routes need two values: DATABASE_URL and OE_CREDENTIAL_ENCRYPTION_KEY. DATABASE_URL resolves BOTH stores to postgres on its own (OPE-2230), so there is no provider selector to set — a selector pointing away from postgres is the only thing that breaks it.",
         "Mint OE_CREDENTIAL_ENCRYPTION_KEY with the ops tool `scaffold_credential_key`: it writes a base64 32-byte AES-256 key into .env.local and never prints it. The encrypted credential store fails closed on every read and write without it.",
         route === "docker"
-          ? "The Docker route also needs a model route: AI_GATEWAY_API_KEY. There is no OIDC off Vercel. Running a different model backend is an adapter swap in app code, not an env setting — https://github.com/open-everywhere/open-everywhere/blob/main/docs/extending/adapter-model.md."
+          ? "The Docker route also needs a model route: AI_GATEWAY_API_KEY, an operator secret (OPE-2650) — store it with `npx oe secret set AI_GATEWAY_API_KEY`. There is no OIDC off Vercel. Running a different model backend is an adapter swap in app code, not an env setting — https://github.com/open-everywhere/open-everywhere/blob/main/docs/extending/adapter-model.md."
           : "The Vercel route needs NO AI_GATEWAY_API_KEY: a deployed project authenticates to the AI Gateway with OIDC.",
-        "Each chat surface adds its own names — Slack reads SLACK_BOT_TOKEN and SLACK_SIGNING_SECRET from the environment.",
-        "Not needed on a deployment: OE_PUBLIC_BASE_URL (only for a custom domain) and OE_INTAKE_PAGE_SIGNING_KEY (the deployment mints it into the credential store).",
+        "Each chat surface adds its own secrets — Slack's SLACK_BOT_TOKEN and SLACK_SIGNING_SECRET are operator secrets (OPE-2650): store them with `npx oe secret set <NAME>`, not in the deployment's environment.",
+        "Not needed on a deployment: OE_PUBLIC_BASE_URL (only for a custom domain) and OE_INTAKE_PAGE_SIGNING_KEY (not an env var since 0.9.0: the deployment mints it into the credential store).",
         "Run `npx @open-everywhere/create --check --json`, or the ops tool `preflight`, for the live verdict per name. Both read .env.local and the shell only.",
         "Set the values on the deployment instead (the Vercel dashboard, say)? Add `--host https://<host>`: the step then also reads the deployment's own verdicts from its public `/eve/v1/oe/status` route.",
       ],

package/src/steps/slack.ts

@@ -4,16 +4,16 @@
 //
 // The manifest itself lives in the Slack bundle (OPE-1603) — @open-everywhere/provider-slack/
 // agent/app-manifest.js — so this step and the ops MCP tool `surface_manifest` print the SAME
-// document. The bundle resolves SLACK_BOT_TOKEN and SLACK_SIGNING_SECRET ENV-FIRST (the block
-// below has the second home), so an operator who sets them by hand puts both in `.env.local` and
-// then on the deployment.
+// document. SLACK_BOT_TOKEN and SLACK_SIGNING_SECRET are OPERATOR SECRETS since OPE-2650: an
+// operator who sets them by hand stores both with `npx oe secret set`, and the env var of the same
+// name is the on-ramp, read only when nothing is stored (the block below has the `/setup` home).
 //
 // REQUIRED ON BOTH ROUTES (OPE-2233). The old `local` exemption is gone with the local goal: a
 // deployment with no chat surface configured answers nobody, whichever route it took.
 //
-// 🔴 THERE ARE TWO HOMES SINCE OPE-2231, AND THIS CHECK READS ONE. The bundle resolves both
-// secrets ENV-FIRST and then from the deployment's own encrypted credential store, which is where
-// a `/setup` run puts them — so a deployment configured that way is CORRECT and this step still
+// 🔴 THE SECRETS LIVE IN THE STORE, AND THIS CHECK READS ONLY THE ON-RAMP. The bundle resolves both
+// as operator secrets (the stored value, else the env var of the same name), then from the value a
+// `/setup` run stored — so a deployment configured either way is CORRECT and this step still
 // reports it unsatisfied, because `.env.local` and the shell are all it can read. That makes the
 // wording load-bearing: the detail says "missing from .env.local and this shell", never a bare
 // "missing", and it names `/setup` and the status endpoint as the places that can see the store.
@@ -40,21 +40,21 @@ export const slackStep: SetupStep = {
       return {
         satisfied: true,
         detail:
-          "SLACK_BOT_TOKEN + SLACK_SIGNING_SECRET set in the environment. 🔴 Setting these two makes the deployment IGNORE anything " +
-          "/setup stored, and CLOSES /setup: the resolver is env-first, so landing that page cannot change which Slack app a working " +
-          "deployment speaks as",
+          "SLACK_BOT_TOKEN + SLACK_SIGNING_SECRET set in the environment — the operator-secret on-ramp. For the deployment, store both with " +
+          "`npx oe secret set`. 🔴 Either home makes the deployment IGNORE anything /setup stored, and CLOSES /setup: the operator " +
+          "secret comes first, so landing that page cannot change which Slack app a working deployment speaks as",
       };
     }
     return {
       satisfied: false,
       detail:
         `missing from .env.local and this shell: ${missing.join(", ")}. This check reads those two homes only — a deployment ` +
-        "configured by /setup keeps both secrets in its own encrypted credential store, and reports unsatisfied here while working " +
-        `correctly. The status endpoint and /setup itself are what can see the store. ${missNote(routeOf(ctx))}`,
+        "that stored both with `npx oe secret set`, or configured by /setup, keeps them in its own encrypted credential store, and " +
+        `reports unsatisfied here while working correctly. The status endpoint, \`npx oe secret list\` and /setup itself are what can see the store. ${missNote(routeOf(ctx))}`,
       next:
         'open https://<host>/setup once the deployment is up (it creates and installs the Slack app from one pasted configuration ' +
         'token, with no env var to set), or create the app from the manifest the ops tool `surface_manifest { surface: "slack" }` ' +
-        "returns, then have the person run `npx oe env set SLACK_BOT_TOKEN` and `npx oe env set SLACK_SIGNING_SECRET` in their own terminal",
+        "returns, then have the person run `npx oe secret set SLACK_BOT_TOKEN` and `npx oe secret set SLACK_SIGNING_SECRET` in their own terminal (value on stdin)",
     };
   },
   guide(ctx: StepContext) {
@@ -85,7 +85,7 @@ export const slackStep: SetupStep = {
             : "upload your own icon, or the project mark"
         }, ${PROJECT_MARK_URL}. Slack's manifest has no icon field, so this step stays by hand.`,
         "Basic Information → App Credentials → copy the Signing Secret = SLACK_SIGNING_SECRET.",
-        "Write both with `npx oe env set SLACK_BOT_TOKEN` and `npx oe env set SLACK_SIGNING_SECRET`, run in your own terminal: each reads the value from a hidden prompt. Never paste a secret into the chat, and never pass one to an ops tool.",
+        "Store both as operator secrets with `npx oe secret set SLACK_BOT_TOKEN` and `npx oe secret set SLACK_SIGNING_SECRET`, run in your own terminal: each reads the value from stdin and writes the deployment's encrypted credential store. For a local run only, `npx oe env set <NAME>` puts the value in .env.local instead. Never paste a secret into the chat, and never pass one to an ops tool.",
         "THE SHORT WAY, once the deployment is up: open https://<host>/setup. It creates the Slack app from this same manifest with one pasted Slack app configuration token, installs it, and keeps every credential in the deployment's own encrypted store — no env var to set. This check cannot see that store, so it still reports this step unsatisfied afterwards; the status endpoint can.",
         "The manifest's URLs say YOUR-DEPLOY-URL until you deploy. Slack cannot verify Event Subscriptions before a deploy that holds SLACK_SIGNING_SECRET is up. After the deploy, paste the manifest again with your host (App Manifest → Save Changes), then retry the verification under Event Subscriptions.",
         "Note two ids for the trust edits: the workspace (team) id T… (the segment after /client/ in the workspace URL at https://app.slack.com), and your own member id U… (your Slack profile → ⋮ More → Copy member ID).",

package/src/steps/verify.ts

@@ -22,7 +22,17 @@ import { envChecklistStep } from "./env-checklist.js";
  * both stores to postgres on its own, so naming them here would send an operator to set two
  * variables that change nothing — the exact fix list that ticket removed.
  */
-const DEPLOYMENT_ENV_NAMES = ["DATABASE_URL", "OE_CREDENTIAL_ENCRYPTION_KEY", "SLACK_BOT_TOKEN", "SLACK_SIGNING_SECRET"] as const;
+const DEPLOYMENT_ENV_NAMES = ["DATABASE_URL", "OE_CREDENTIAL_ENCRYPTION_KEY"] as const;
+
+/**
+ * What the deployment's encrypted credential STORE must hold. The Slack pair is an operator secret
+ * since OPE-2650: `npx oe secret set <NAME>` writes it, with the same DATABASE_URL and key the
+ * deployment reads, so it needs no env push. A `/setup` run is the other way to put both there.
+ */
+const DEPLOYMENT_SECRET_NAMES = ["SLACK_BOT_TOKEN", "SLACK_SIGNING_SECRET"] as const;
+
+/** The one command that stores each operator secret, value on stdin. */
+const secretSetCommands = (names: readonly string[]): string => names.map((n) => `\`npx oe secret set ${n}\``).join(" and ");
 
 /**
  * The go/no-go rule, split out from `check()` so it can be tested on its own. That split is
@@ -97,6 +107,7 @@ export const verifyStep: SetupStep = {
       next:
         "set the deployment's OWN environment — this check never reads it: " +
         `${DEPLOYMENT_ENV_NAMES.join(", ")} (${routeOf(ctx) === "docker" ? "the container's environment" : "the Vercel project's Production environment"}). ` +
+        `Store the Slack operator secrets in its credential store (${secretSetCommands(DEPLOYMENT_SECRET_NAMES)}, value on stdin), or run /setup. ` +
         "Then confirm the Slack app's Event Subscriptions shows the request URL as Verified (that proves SLACK_SIGNING_SECRET on the deployment; this check cannot), and send the app a direct message",
     };
   },
@@ -106,11 +117,12 @@ export const verifyStep: SetupStep = {
       summary: "Before going live, run a real task in a pilot channel and walk the setup runbook's safety checklist (access bundles, egress enforcement, spend caps).",
       instructions: [
         `🔴 THIS CHECK NEVER READS THE DEPLOYMENT'S OWN ENVIRONMENT. Every step above reads .env.local and your shell. \`.env.local\` is gitignored and never ships, so the deployment reads only what you set ON it: ${DEPLOYMENT_ENV_NAMES.join(", ")}. A full house here says nothing about any of them.`,
+        `The Slack bot token and signing secret are operator secrets (OPE-2650): store them in the deployment's credential store with ${secretSetCommands(DEPLOYMENT_SECRET_NAMES)}, run in your own terminal with the same DATABASE_URL and OE_CREDENTIAL_ENCRYPTION_KEY in .env.local. No env push is needed for them.`,
         vercel
           ? "Set each one for Production without printing it: `npm run -s env:pipe -- <NAME> | npx vercel env add <NAME> production`. Always pipe it straight into `vercel env add`; never run `env:pipe` bare, because a shell that is not a terminal prints the value. The Neon integration already set DATABASE_URL there, and it selects postgres for both stores on its own — no provider selector to push. A variable added after a deploy reaches the functions only on the NEXT deploy."
           : "Set each one in the container's environment (a compose file, your orchestrator's secret store — not a tracked file). DATABASE_URL selects postgres for both stores on its own. A variable added after the container starts reaches the app only on the next start.",
         "Mint OE_CREDENTIAL_ENCRYPTION_KEY with the ops tool `scaffold_credential_key`, which writes it to .env.local and never prints it. Without it the encrypted credential store fails closed on every read and write.",
-        "Not needed on a deployment: the two store selectors (DATABASE_URL resolves both), OE_PUBLIC_BASE_URL (only for a custom domain) and OE_INTAKE_PAGE_SIGNING_KEY (the deployment mints it into the credential store). On the Vercel route, AI_GATEWAY_API_KEY is not needed either — OIDC covers it.",
+        "Not needed on a deployment: the two store selectors (DATABASE_URL resolves both), OE_PUBLIC_BASE_URL (only for a custom domain) and OE_INTAKE_PAGE_SIGNING_KEY (not an env var since 0.9.0: the deployment mints it into the credential store). On the Vercel route, AI_GATEWAY_API_KEY is not needed either — OIDC covers it. On the Docker route it is an operator secret: `npx oe secret set AI_GATEWAY_API_KEY`.",
         "Send the app a direct message in Slack, then @mention it in a channel you invited it to.",
         "Safety checklist: https://github.com/open-everywhere/open-everywhere/blob/main/docs/deploy/setup-runbook.md#safety-checklist-the-anti-footgun-list",
       ],

package/template/.env.example

@@ -10,7 +10,8 @@
 # A deployed VERCEL project authenticates to the gateway with OIDC and needs no key. Everything
 # else does: a local run, and the DOCKER route, where there is no OIDC. Running a different model
 # backend instead is an adapter swap in app code, not an env setting (docs/extending/adapter-model.md).
-# Create a key at: Vercel dashboard -> AI Gateway -> API Keys.
+# Create a key at: Vercel dashboard -> AI Gateway -> API Keys. For a local run, set it here. For a
+# deployment, store it as an operator secret: `npx oe secret set AI_GATEWAY_API_KEY` (value on stdin).
 AI_GATEWAY_API_KEY=
 
 # --- The operational store, memory and the credential store ---
@@ -23,10 +24,10 @@ AI_GATEWAY_API_KEY=
 # database under .open-everywhere-data/.
 DATABASE_URL=
 # 🔴 NOT REQUIRED (OPE-2230). A present DATABASE_URL resolves BOTH stores to postgres on its own, so
-# there is no selector to set and nothing to push to the deployment. These two are an OVERRIDE only
-# — and a selector pointing AWAY from postgres is the one thing that breaks the resolution.
+# there is no selector to set and nothing to push to the deployment. This one is an OVERRIDE only
+# — and a selector pointing AWAY from postgres is the one thing that breaks the resolution. The
+# memory selector is the `memory.provider` setting in agent/settings/settings.ts (0.9.0).
 # OE_OPERATIONAL_PROVIDER=postgres
-# OE_MEMORY_PROVIDER=postgres
 # A base64-encoded 32-byte AES-256 key that encrypts stored credentials. The deployment and the
 # operator tools need the same value. This command appends a fresh one to .env.local without printing it:
 #   node -e "console.log('OE_CREDENTIAL_ENCRYPTION_KEY=' + require('crypto').randomBytes(32).toString('base64'))" >> .env.local
@@ -35,30 +36,32 @@ DATABASE_URL=
 # OE_PUBLIC_BASE_URL=https://agent.example.com
 #
 # After DATABASE_URL and the key are set, `npx oe secret set <NAME>` (value on stdin) stores a secret
-# whose credential names `broker: "db"` in the encrypted store. The Slack variables and
-# GITHUB_WEBHOOK_SECRET below are read from the ENVIRONMENT only, so they stay environment variables.
+# in the encrypted store. The surface credentials below (the Slack, GitHub, Discord and Linear tokens
+# and signing secrets) and AI_GATEWAY_API_KEY are OPERATOR SECRETS: a stored value wins, and the
+# variable of the same name here is read only when nothing is stored. For a deployment, store them;
+# a line here only reaches a local run.
 
 # --- Telemetry (https://github.com/open-everywhere/open-everywhere/blob/main/docs/deploy/telemetry.md) ---
 # The deployed app sends ANONYMOUS USAGE TELEMETRY, ON BY DEFAULT: event names, enums, coarse
 # buckets, public model ids and the app version, with a random per-install id (service.instance.id).
 # Never message or memory content, org names, workspace, channel, user or session ids, or env
-# values. The page above lists every event. To turn it
-# off, set this ON THE DEPLOYMENT (the Vercel project or the container's environment): a value here
-# only reaches a local run, because .env.local never ships. DO_NOT_TRACK=1 does the same.
-# OE_TELEMETRY=off
+# values. The page above lists every event. To turn it off, declare
+# `telemetry: { enabled: false }` in agent/settings/settings.ts and deploy: the setting ships with the
+# app. DO_NOT_TRACK=1 in the deployment's environment does the same. OE_TELEMETRY is gone (0.9.0).
 
 # --- Slack (https://github.com/open-everywhere/open-everywhere/blob/main/docs/deploy/surfaces/slack.md) ---
+# Both are operator secrets: `npx oe secret set SLACK_BOT_TOKEN` and `npx oe secret set SLACK_SIGNING_SECRET`.
 # Slack app -> OAuth & Permissions -> Bot User OAuth Token (xoxb-…).
 SLACK_BOT_TOKEN=
 # Slack app -> Basic Information -> Signing Secret. Verifies every inbound event.
 SLACK_SIGNING_SECRET=
 
 # --- GitHub (https://github.com/open-everywhere/open-everywhere/blob/main/docs/deploy/surfaces/github.md) ---
-# The GitHub App that receives webhooks and replies as the app.
-# GITHUB_APP_ID=
-# GITHUB_APP_PRIVATE_KEY=
-# GITHUB_APP_SLUG=
-# Verifies inbound deliveries. If it is unset, the route refuses every delivery.
+# The GitHub App that receives webhooks and replies as the app. Which App it is (`github.appId`,
+# `github.appSlug`, `github.conversation`) is in agent/settings/settings.ts.
+# GITHUB_APP_PRIVATE_KEY=   (an operator secret: `npx oe secret set GITHUB_APP_PRIVATE_KEY`)
+# Verifies inbound deliveries. If it is unset, the route refuses every delivery. An operator secret:
+# `npx oe secret set GITHUB_WEBHOOK_SECRET`.
 # GITHUB_WEBHOOK_SECRET=
 
 # --- Notion (https://github.com/open-everywhere/open-everywhere/blob/main/docs/deploy/surfaces/notion.md) ---

package/template/AGENTS.md

@@ -24,8 +24,9 @@ Setup is yours to drive, with the user's consent at every command. Use the
 - **Tell the user about telemetry before the first deploy.** The deployed app sends anonymous usage
   telemetry, and it is ON by default: event names, enums, coarse buckets, public model ids and the
   app version, with a random per-install id (`service.instance.id`). It never sends message or
-  memory content, org names, workspace, channel, user or session ids, or env values. To turn it off, they set `OE_TELEMETRY=off` (or
-  `DO_NOT_TRACK=1`) on the deployment itself. The full list of events is
+  memory content, org names, workspace, channel, user or session ids, or env values. To turn it off, they declare
+  `telemetry: { enabled: false }` in `agent/settings/settings.ts` and deploy, or set `DO_NOT_TRACK=1`
+  on the deployment itself. The full list of events is
   `https://github.com/open-everywhere/open-everywhere/blob/main/docs/deploy/telemetry.md`. Ask which
   they want, and do not decide for them.
 - `npx @open-everywhere/create --check --json` is the status report: every step, with `satisfied`,
@@ -80,6 +81,12 @@ Setup is yours to drive, with the user's consent at every command. Use the
 - Never commit a secret, a token, an `.env` value or a credential. Secrets go in `.env.local`
   (gitignored), and the deployment reads them from its own environment. A credential whose
   `broker` is `"db"` goes in the encrypted credential store instead (`npx oe secret set <NAME>`).
+  The secret values of the Slack, Discord, GitHub and Linear surfaces are operator secrets: the
+  Slack bot token and signing secret, the GitHub App private key and `LINEAR_CLIENT_SECRET`, for
+  example. Store each with `npx oe secret set <NAME>`. An id or a public value (`LINEAR_CLIENT_ID`,
+  `DISCORD_PUBLIC_KEY`) is not an operator secret, so do not move it to the store. The Teams app
+  password and a Linear app slot's `LINEAR_APP_<SLOT>_*` values stay in the environment. Where `agent/access/connector-credentials.ts`
+  names one (the Slack `work-token` and `chat-token` ids), it stamps it `broker: "db"`.
 - Upgrade every `@open-everywhere/*` package together, to one version. Keep `eve` at the exact
   version `@open-everywhere/core` declares as its peer. A `devDependencies` key that still reads
   `create-open-everywhere` is replaced by `@open-everywhere/create`, not bumped: the unscoped name is

package/template/Dockerfile

@@ -13,7 +13,7 @@ WORKDIR /app
 # the eve version, the platform, a random installation id and a salted hash of the git remote URL or
 # of the working directory to telemetry.vercel.com. This image turns it OFF:
 # `EVE_TELEMETRY_DISABLED=1` is eve's switch, and both stages set it. Open Everywhere's own telemetry
-# has its own switch, `OE_TELEMETRY` (see README.md § Telemetry).
+# has its own switch, the `telemetry.enabled` setting (see README.md § Telemetry).
 ENV EVE_TELEMETRY_DISABLED=1
 
 # git: a dependency or the `git` memory backing can need it at build time.

package/template/README.md

@@ -41,9 +41,9 @@ step also reads the deployment's own verdicts, so values set only in the Vercel
 The deployed app sends **anonymous usage telemetry, ON by default**: event names, enums, coarse
 buckets, public model ids and the app version. Each event carries a random per-install id
 (`service.instance.id`). It never sends message or memory content, org names, workspace, channel,
-user or session ids, or env values. **To turn it off, set `OE_TELEMETRY=off`** (or `DO_NOT_TRACK=1`) on the deployment:
-the Vercel project's environment or the container's. `.env.local` alone does not do it, because it
-never ships. Every event and attribute is listed in the
+user or session ids, or env values. **To turn it off, declare `telemetry: { enabled: false }`** in `agent/settings/settings.ts`
+and deploy. Or set `DO_NOT_TRACK=1` on the deployment: the Vercel project's environment or the
+container's. `.env.local` alone does not do it, because it never ships. Every event and attribute is listed in the
 [telemetry disclosure](https://github.com/open-everywhere/open-everywhere/blob/main/docs/deploy/telemetry.md).
 The `@open-everywhere/create` CLI sends none.
 
@@ -116,8 +116,10 @@ Notion and GitHub are in the roster. Each one needs its own setup before it answ
 - **Notion** — create an internal integration, subscribe its webhook to
   `https://<host>/eve/v1/notion`, and put the pages it may act on in a memory domain's `reach`. See the
   [Notion guide](https://github.com/open-everywhere/open-everywhere/blob/main/docs/deploy/surfaces/notion.md).
-- **GitHub** — create a GitHub App, point its webhook at `https://<host>/eve/v1/github`, and set
-  `GITHUB_WEBHOOK_SECRET`. See the
+- **GitHub** — create a GitHub App, point its webhook at `https://<host>/eve/v1/github`, and store
+  its private key and webhook secret as operator secrets (`npx oe secret set GITHUB_APP_PRIVATE_KEY`,
+  `npx oe secret set GITHUB_WEBHOOK_SECRET`), and set `github: { appId, appSlug, conversation: true }`
+  in `agent/settings/settings.ts`. See the
   [GitHub guide](https://github.com/open-everywhere/open-everywhere/blob/main/docs/deploy/surfaces/github.md).
 
 Discord, Microsoft Teams and Linear are installed too. To add one, add it under `providers` in

package/template/agent/access/access-requests.ts

@@ -2,19 +2,20 @@
 // knobs for the widen-slow path: request card → deterministic codemod → bot-PR →
 // ADMIN MERGES IN GITHUB (that merge is the approval; there is no admin card).
 //
-// FAIL-CLOSED: with either env var below unset, the `request_access` tool refuses
-// politely and the flow is simply OFF — nothing else changes. Both values are
-// operator-specific (a private channel id, YOUR fork's repo), so they live in env,
-// never in this committed file (AGENTS.md security rules).
+// FAIL-CLOSED: with `accessRequests.configRepo` or `accessRequests.adminChannel` unset, the
+// `request_access` tool refuses politely and the flow is simply OFF — nothing else changes. Both
+// values are settings (`agent/settings/settings.ts`, OPE-2650), not environment variables: which
+// repository holds this deployment's config and which room hears about each pull request are tracked
+// facts of the deployment, changed by pull request like every other one.
 //
-//   OE_ACCESS_ADMIN_CHANNEL  Slack channel id that hears "PR opened — merge to grant".
-//   OE_ACCESS_CONFIG_REPO    "owner/repo" of THIS deployment's config repo (the one
-//                            the grants overlay lives in). The GitHub App needs write on it.
-//   OE_ACCESS_CONFIG_BASE    Base branch (default "main").
-//   OE_ACCESS_GRANTS_PATH    Overlay path (default "agent/access/grants.generated.ts").
-//   OE_WEBHOOK_HOOKS_PATH    Webhook-declaration overlay path (default
-//                            "agent/webhooks/hooks.generated.ts") — the `declare_webhook` flow (OPE-208)
-//                            rides this same repo/branch/credential, only the file differs.
+//   accessRequests.adminChannel  the channel that hears "PR opened — merge to grant".
+//   accessRequests.configRepo    "owner/repo" of THIS deployment's config repo (the one the grants
+//                                overlay lives in). The GitHub App needs write on it.
+//   accessRequests.configBase    the base branch (shipped "main").
+//
+// The overlay PATHS (`grantsPath`, `hooksPath`, `agentsPath`, `bindingsPath` and the rest) are fields
+// of the object below. Each one is unset here, so core uses its documented default. A fork that moves
+// an overlay sets the field in this file.
 //
 // Two BEHAVIOUR choices are declared below, not in env (OPE-2411): `dryRun` (was OE_ACCESS_DRY_RUN=1,
 // the e2e/test mode where a tap validates and reports, with no branch and no PR) and
@@ -33,13 +34,15 @@ import { loadBaseWebhooks } from "../webhooks/hooks.js";
 import { MCP_SERVERS } from "./mcp-servers.js";
 import { loadBaseDomains, loadBaseSilos, loadDomains } from "../memory/config/domains.js";
 import { loadGroups } from "../identity/groups.js";
+import { getSettings } from "@open-everywhere/core/agent/settings/settings.js";
 
 export function loadAccessRequests(): AccessRequestsConfig | null {
+  // Read on every call, never at module load: the settings register after this module's body runs.
+  const { adminChannel, configRepo, configBase } = getSettings().accessRequests;
   return {
-    adminChannel: process.env.OE_ACCESS_ADMIN_CHANNEL,
-    configRepo: process.env.OE_ACCESS_CONFIG_REPO,
-    configBase: process.env.OE_ACCESS_CONFIG_BASE || undefined,
-    grantsPath: process.env.OE_ACCESS_GRANTS_PATH || undefined,
+    adminChannel: adminChannel || undefined,
+    configRepo: configRepo || undefined,
+    configBase,
     dryRun: false,
     credentialBindingLive: false,
     baseBundles: loadBaseBundles,
@@ -60,7 +63,6 @@ export function loadAccessRequests(): AccessRequestsConfig | null {
     // The `declare_webhook` PR path (OPE-208) rides this SAME config repo, branch and bot
     // credential — only the machine-written file differs. `baseWebhooks` is the code-declared
     // baseline a candidate overlay is validated against before any PR opens.
-    hooksPath: process.env.OE_WEBHOOK_HOOKS_PATH || undefined,
     baseWebhooks: loadBaseWebhooks,
     // The declared MCP servers, so `propose_mcp_server` validates a candidate entry against them (OPE-2420).
     baseMcpServers: () => MCP_SERVERS,
@@ -69,7 +71,6 @@ export function loadAccessRequests(): AccessRequestsConfig | null {
     // the code-declared agents baseline (empty — agents live only in the overlay); `baseDomains` /
     // `baseSilos` are the code-only memory baseline a candidate overlay is validated against (ring ②)
     // before any PR opens. `agentsPath` defaults to "agent/memory/config/agents.generated.ts".
-    agentsPath: process.env.OE_AGENTS_PATH || undefined,
     baseAgents: emptyAgentsFile,
     baseDomains: loadBaseDomains,
     baseSilos: loadBaseSilos,

package/template/agent/access/bundles.ts

@@ -65,7 +65,7 @@ const bindings: Binding[] = [
 // The machine-owned overlays: access requests the agent raised and an admin approved by merging a
 // pull request (grants.generated.ts), and agent-authored domains (agents.generated.ts).
 // The app-declared MCP servers (./mcp-servers.ts, OPE-2414): each server's personal credential, granted in
-// every person's OWN DM (the built-in `oe:everyone` group, or the groups the entry names). Never a channel.
+// every INTERNAL person's OWN DM (the built-in `oe:everyone` group, or the groups the entry names). Never a channel.
 bundles.push(...mcpServerBundles(MCP_SERVERS));
 bindings.push(...mcpServerBindings(MCP_SERVERS));
 // The domain rules people asked for from approval cards and an admin merged (./domain-rules.ts, OPE-2456): each

package/template/agent/access/connector-credentials.ts

@@ -1,8 +1,8 @@
 // Connector credential catalogues — HOW each connector authenticates.
 //
 // One catalogue per connector. Each credential names its type, where its secret lives
-// (`secretRef` + `broker`: `env` reads an environment variable by NAME, `db` reads the encrypted
-// credential store), and the endpoints it may be presented to. A bundle grant
+// (`secretRef` + `broker`: `db` reads the encrypted credential store, `env` reads an environment
+// variable by NAME), and the endpoints it may be presented to. A bundle grant
 // (agent/access/bundles.ts) picks a credential by `id`. A credential nobody grants is inert.
 //
 // The secret VALUES never live in this file — only the names they are stored under.
@@ -51,8 +51,10 @@ const catalogues: ConnectorCredentials[] = [
     connector: "slack",
     allows: ["api-key"],
     credentials: [
-      { id: "work-token", type: "api-key", secretRef: "SLACK_BOT_TOKEN", broker: "env", intake: false },
-      { id: "chat-token", type: "api-key", secretRef: "SLACK_BOT_TOKEN", broker: "env", intake: false },
+      // The bot token is an operator secret (`npx oe secret set SLACK_BOT_TOKEN`), so both ids name it
+      // in the credential store, under the same name the Slack surface reads.
+      { id: "work-token", type: "api-key", secretRef: "SLACK_BOT_TOKEN", broker: "db", intake: false },
+      { id: "chat-token", type: "api-key", secretRef: "SLACK_BOT_TOKEN", broker: "db", intake: false },
     ],
   }),
 ];

package/template/agent/access/mcp-servers.ts

@@ -5,9 +5,11 @@
 //   • In a DM, every person reaches the server AS THEMSELVES. Their first call posts a "Connect my
 //     account" card; they sign in with their own account once, and their token reaches only what
 //     that account can see. This needs `connectors.userPrincipal`, which ships on.
-//   • 🔴 "Every person" means every account that can DM the agent, an external one included (a Slack
-//     Connect user, a Discord user who shares a server with the bot). Where external people can DM the
-//     agent, narrow the entry with `people: { groups: [...] }` (agent/identity/groups.ts).
+//   • 🔴 "Every person" means every INTERNAL person: a DM partner the platform or this deployment's
+//     trust declaration confirms as a member (OPE-2415). An external account (a Slack Connect user, a
+//     guest, a Discord user who shares a server with the bot but whom nothing vouches) is not in it. To
+//     give the server to a named external person, list them in a person-group (agent/identity/groups.ts)
+//     and name that group in `people: { groups: [...] }`. To narrow the server, name groups the same way.
 //   • In a channel, nothing changes until an admin grants the server's `workspace-oauth` credential
 //     (the org's own account) on a bundle in bundles.ts. A personal login never reaches a channel.
 //

package/template/agent/memory/config/domains.ts

@@ -51,7 +51,7 @@ import { loadDomainModules } from "./domains/index.js";
 
 const silos: MemorySilo[] = [
   // The workspace's shared brain. Postgres-backed (matches the deploy:
-  // OE_MEMORY_PROVIDER=postgres + Neon DATABASE_URL). Referenced by the `org`
+  // a Neon DATABASE_URL selects postgres, or `memory.provider`). Referenced by the `org`
   // domain below, so every internal channel writes to / reads from one brain.
   defineMemorySilo({ name: "org-brain", provider: "postgres" }),
 

package/template/agent/personal-browser/policy.ts

@@ -20,8 +20,9 @@
 // 🔴 NOTHING HERE IS A SECRET.
 //
 // To turn it on: build and publish the browser image (the manual's Personal browser page says how), set
-// `box.image`, and set `enabled: true`. The watch page also needs the page signing key
-// (OE_INTAKE_PAGE_SIGNING_KEY) and a public URL, which the credential intake page already uses.
+// `box.image`, and set `enabled: true`. The watch page also needs the credential vault
+// (OE_CREDENTIAL_ENCRYPTION_KEY), where its page signing key mints, and a public URL. The credential
+// intake page needs the same two.
 
 import { DEFAULT_PERSONAL_BROWSER_POLICY, registerPersonalBrowserPolicy, type PersonalBrowserPolicy } from "@open-everywhere/core/agent/personal-browser/policy.js";
 

package/template/agent/sandbox/sandbox.ts

@@ -107,7 +107,7 @@ const SNAPSHOT_EXPIRATION_MS = SANDBOX_SETTINGS.snapshotExpirationMs; // 7 days
 //     🔴 Its session egress is NOT behind the oe-egress-proxy sidecar (OPE-2407). eve starts the
 //     session container with no `--network` flag, so it joins the daemon's default bridge network
 //     (a direct WAN route, no proxy env), and eve's docker options expose no network field. eve's
-//     docker firewall takes only "allow-all" / "deny-all". So docker + OE_EGRESS_PROXY_URL REFUSES
+//     docker firewall takes only "allow-all" / "deny-all". So docker + `egress.proxyUrl` REFUSES
 //     TO BOOT (selfHostEgressBootLog's `fatal`): the proxy would record "enforced" for a session it
 //     never sees. Without the proxy, a no-reach session gets "deny-all" (applied) and a session that
 //     needs a host allow-list aborts at session.started (fail-closed).
@@ -231,7 +231,7 @@ function selfHostEnvironment(): SelfHostSandbox {
   // the permission-homeostasis widening loop can see this plane at all. Here because this is the
   // ONE off-Vercel boot path that already resolves the egress posture — the same reason the boot
   // log above lives here — and because starting an interval anywhere the Vercel branch could reach
-  // would put a timer in a lambda. A no-op returning undefined unless OE_EGRESS_DENIAL_LOG names a
+  // would put a timer in a lambda. A no-op returning undefined unless `egress.denialLog` names a
   // readable file (the compose stack mounts one; a bare self-host run does not), and the timer is
   // unref'd, so nothing about this can keep a process alive or take one down.
   startEgressDenialPoller();

package/template/claude/skills/quickstart-open-everywhere/SKILL.md

@@ -32,14 +32,35 @@ that repository ships no `env:pipe` script. Everything else is the same.
 - **Never propose a local run as a setup step.** `npm run dev` is the development loop AFTER the
   deploy. A local run has no public HTTPS URL for Slack to reach and keeps its state in a different
   store, so it proves little about the deployment. See "Develop locally" below.
-- **Where each secret lives.** The deployment reads `DATABASE_URL`,
-  `OE_CREDENTIAL_ENCRYPTION_KEY`, `SLACK_BOT_TOKEN`, `SLACK_SIGNING_SECRET` and
-  `GITHUB_WEBHOOK_SECRET` from its **environment**: the Slack bundle and the GitHub webhook check
-  never read the credential store. So these go in `.env.local`, and then into the deployment's own
-  environment. `secret_set { names: [...] }` is for a credential whose `broker` is `"db"` (and
-  `NOTION_WEBHOOK_SECRET`): it moves each named value from `.env.local` into the store, so the user
-  runs `npx oe env set <NAME>` first. It needs `DATABASE_URL` and the key in `.env.local` too.
-  Nothing reads a stored secret back out (`secret_list` returns names only).
+- **Where each secret lives.** The deployment reads `DATABASE_URL` and
+  `OE_CREDENTIAL_ENCRYPTION_KEY` from its **environment**: they open the credential store. Every
+  other secret lives IN the store. The surface credentials (`SLACK_BOT_TOKEN`,
+  `SLACK_SIGNING_SECRET`, `GITHUB_WEBHOOK_SECRET`, `GITHUB_APP_PRIVATE_KEY`, `DISCORD_BOT_TOKEN`, the
+  Linear tokens and secrets, `AI_GATEWAY_API_KEY`) are **operator secrets** since OPE-2650: a stored
+  value wins, and an env var of the same name is only the on-ramp. `secret_set { names: [...] }`
+  moves each named value from `.env.local` into the store, so the user runs `npx oe env set <NAME>`
+  first. It needs `DATABASE_URL` and the key in `.env.local` too. `scaffold_env` marks an operator
+  secret with `operatorSecret: true`. Nothing reads a stored secret back out (`secret_list` returns
+  names only).
+- **A value with no local copy.** Sometimes the deployment holds an operator secret as a host env
+  var, and the user cannot read the value back. On Vercel a SENSITIVE env var reads back empty:
+  `vercel env pull` writes `[SENSITIVE]`. Then `npx oe env set` has no value to take, and
+  `secret_set` has nothing to move. Do not tell the user to set a value they cannot read. The
+  deployment copies it itself. The user runs, in their own terminal,
+  `npx oe secret adopt SLACK_BOT_TOKEN --url https://<deployment>` with a token from the
+  deployment's `OE_CONTROL_INJECT_TOKENS` family on stdin. The command calls the deployment's
+  `POST /control/v1/secrets/adopt` route, and that route answers 404 while the family is empty. If
+  the user holds no token from it, they mint one and store its `<name>:<sha256 hex>` entry with
+  `npx oe secret set OE_CONTROL_INJECT_TOKENS` first, then wait 30 seconds for a running instance
+  to read the new row. An injection token can write operator-secret rows, so treat it as a
+  credential-write secret. The deployment must run 0.9.0 or later. The reply gives each name as
+  `stored`, `already-stored` or `no-env-value`, and never the value. A stored row stays unless the
+  command passes `--overwrite`. Never pass `--overwrite` with `OE_CONTROL_INJECT_TOKENS` after the
+  user stored it to open this door: the env list then replaces their entry. Only operator-secret
+  names are accepted, never `DATABASE_URL` or `OE_CREDENTIAL_ENCRYPTION_KEY`. After a name reports
+  `stored`, tell the user to delete that env var on the host. The control MCP write
+  `adopt_env_secrets { "org": "<org>", "names": ["SLACK_BOT_TOKEN"] }` runs the same code, but its
+  plane answers 404 on a default deployment, so name the command.
 - **If an ops tool answers "the app now runs @open-everywhere/core X; this ops server runs Y"**, the
   server predates an upgrade. Ask the user to restart it (`/mcp`, then reconnect
   `open-everywhere-ops`) and call again. Never work around it: a stale server serves old code. A
@@ -74,13 +95,13 @@ enums, coarse buckets, public model ids and the app version, with a random per-i
 user or session ids, or env values. The full list
 of events is `https://github.com/open-everywhere/open-everywhere/blob/main/docs/deploy/telemetry.md`.
 
-To turn it off, `OE_TELEMETRY=off` (or `DO_NOT_TRACK=1`) must be set on the DEPLOYMENT: a value in
-`.env.local` reaches only a local run. On the Vercel route, at step 9:
-`printf off | npx vercel env add OE_TELEMETRY production`. On the Docker route, put it in the
-container's environment. Every boot prints a line that says whether telemetry is on.
+To turn it off, declare `telemetry: { enabled: false }` in `agent/settings/settings.ts`, commit it,
+and deploy: the setting ships with the app, on both routes. `DO_NOT_TRACK=1` in the deployment's
+own environment also turns it off. The `OE_TELEMETRY` variable is gone (0.9.0) and does nothing.
+The deployed app prints a line that says whether telemetry is on, before it sends anything.
 
 eve's own CLI telemetry is separate: Open Everywhere sets `EVE_TELEMETRY_DISABLED=1` where it
-starts eve (its npm scripts and `Dockerfile`), and `OE_TELEMETRY` does not change it. For an `eve`
+starts eve (its npm scripts and `Dockerfile`), and `telemetry.enabled` does not change it. For an `eve`
 command run by hand, or an app scaffolded before 0.8.0, read the eve section of the page above.
 
 ## Status, at every step
@@ -170,6 +191,8 @@ settings or the store.
    creates and installs the app, then runs `npx oe env set SLACK_BOT_TOKEN` and
    `npx oe env set SLACK_SIGNING_SECRET` in their own terminal. Confirm with
    `scaffold_env { secretNames: ["SLACK_BOT_TOKEN", "SLACK_SIGNING_SECRET"] }`: both read `present: true`.
+   Both are operator secrets, so then call `secret_set { names: ["SLACK_BOT_TOKEN", "SLACK_SIGNING_SECRET"] }`:
+   it moves them into the deployment's credential store, and they need no env push.
    **App icon.** With no `identity.name` set, the agent presents as the project, so its default
    avatar is the project mark. Unless the user set `identity.name` and chose their own icon, tell
    them to upload
@@ -189,10 +212,11 @@ settings or the store.
 8. **Build.** `npm run build`. It must pass. Then `npm run check:model-config`, and read it as
    "Check the model config" above says. A `✗` line stops the route here.
 9. **Deployment env.** `.env.local` never ships, so the deployment reads only what you set ON it.
-   The names are `OE_CREDENTIAL_ENCRYPTION_KEY`, `SLACK_BOT_TOKEN` and `SLACK_SIGNING_SECRET`. The
-   Neon integration already set `DATABASE_URL` there, and that one value resolves both stores — so
-   there is no `OE_OPERATIONAL_PROVIDER` or `OE_MEMORY_PROVIDER` to push. Add `OE_TELEMETRY` (value
-   `off`) only when the user chose to turn telemetry off (see the telemetry section above).
+   The name is `OE_CREDENTIAL_ENCRYPTION_KEY`. The Slack pair is not on this list: step 5 stored it
+   in the credential store with `secret_set`. The Neon integration already set `DATABASE_URL` there, and that one value resolves both stores — so
+   there is no `OE_OPERATIONAL_PROVIDER` to push, and `memory.provider` is a setting in Git. When the
+   user chose to turn telemetry off, commit `telemetry: { enabled: false }` before the deploy (see
+   the telemetry section above); there is no variable to push for it.
    Confirm each command first, and **never let a value reach your own output.**
    - **In a scaffolded app:** `npm run -s env:pipe -- <NAME> | npx vercel env add <NAME> production`.
      Always pipe `env:pipe` straight into `vercel env add`, as written. Never run it bare: your
@@ -228,7 +252,9 @@ Then:
    set no provider selector. The compose stack of step 6 also carries a Postgres of its own.
 3. **Key.** `scaffold_credential_key`.
 4. **Model route.** There is no OIDC off Vercel, so the user supplies `AI_GATEWAY_API_KEY` (Vercel
-   → AI Gateway → API Keys issues one for any host) with `npx oe env set AI_GATEWAY_API_KEY`. Running a different model backend instead is
+   → AI Gateway → API Keys issues one for any host) with `npx oe env set AI_GATEWAY_API_KEY`. It is
+   an operator secret: once Postgres is reachable from this machine, `secret_set { names: ["AI_GATEWAY_API_KEY"] }`
+   stores it, and the container's `.env` line is only the on-ramp. Running a different model backend instead is
    an **adapter swap in app code**
    (`https://github.com/open-everywhere/open-everywhere/blob/main/docs/extending/adapter-model.md`),
    which `--check` cannot see: that step stays `missing` on the Docker route either way, so read it
@@ -289,9 +315,10 @@ person in chat cannot add one.
    posts a "Connect my account" card, and they sign in with their own account once. A channel
    gets nothing until an admin grants the server's `workspace-oauth` credential (the org's own
    account) on a bundle in `agent/access/bundles.ts`.
-5. Say who "each person" is: every account that can DM the agent, an external one included (a
-   Slack Connect user, a Discord user who shares a server with the bot). If external people can
-   DM the agent, offer to narrow the entry with `people: { groups: ["<group>"] }`.
+5. Say who "each person" is: every INTERNAL person who can DM the agent. An external account (a
+   Slack Connect user, a Slack guest, a Discord user whom the deployment does not vouch) does not
+   get the server. To give it to a named external person, or to narrow it, offer
+   `people: { groups: ["<group>"] }` with a group that lists those people.
 
 With no server declared, nothing changes: the build writes no connection for one, and only the
 shipped connections (Notion) stay mounted.
@@ -310,15 +337,21 @@ back to a page on this computer, so the user copies nothing.
    this computer. GitHub opens with the App filled in. They check the name (GitHub App names are
    unique, so they change it if GitHub says it is taken) and confirm.
 3. Call `surface_app_create { surface: "github", action: "status" }`. `state: "done"` lists the
-   env names written to `.env.local` and the App's install link. Keep the link for step 5.
-4. On the Vercel route, push each name in `written` exactly as in step 9, then redeploy. On the
-   Docker route, add each one to the server's `.env` (Docker step 6), then restart the stack.
+   secret names written to `.env.local`, the App's public values as `settings`, and the App's
+   install link. Keep the link for step 5.
+4. Write each entry of `settings` into the `github` group of `agent/settings/settings.ts`, for
+   example `github: { appId: "123", appSlug: "acme-agent", appClientId: "Iv1.…", botUserId: "456",
+   conversation: true }`. Keep every other `github` key the file already sets. These are public
+   values, so they go in Git. `conversation` is `true` only for the default App: it lets @mentions
+   start a conversation. Then store each name in `written` (`GITHUB_APP_PRIVATE_KEY`,
+   `GITHUB_WEBHOOK_SECRET`) with `secret_set`, because they are operator secrets, and redeploy with
+   the settings change. On the Docker route, the redeploy is a restart of the stack.
 5. Only after that redeploy or restart, ask the user to open the install link and install the App
    on the repositories the agent works in. The install sends one `installation` delivery, and the
    deployment learns the installation from it. Before the redeploy the deployment does not hold the
    App's webhook secret, so it refuses that delivery and never learns the installation.
 
-The tool never returns a value, and it refuses to overwrite names `.env.local` already holds.
+The tool never returns a secret, and it refuses to overwrite names `.env.local` already holds.
 
 ## Develop locally
 

package/template/docker-compose.yml

@@ -64,11 +64,16 @@ services:
       # the session's allow list. justbash shares this process's filesystem: development-grade
       # isolation. The app refuses to boot here on `"docker"`: eve starts docker session containers
       # on the daemon's default network, outside this proxy.
-      OE_EGRESS_PROXY_URL: "http://oe-egress-proxy:8080"    # the control endpoint for the policy push
+      # 🔴 THE APP'S EGRESS WIRING IS SETTINGS, NOT ENV (0.9.0, OPE-2650). Declare it in
+      # agent/settings/settings.ts, or the app runs without the proxy and a session that needs a host
+      # aborts (fail-closed):
+      #   egress: { proxyUrl: "http://oe-egress-proxy:8080", denialLog: "/var/log/oe-egress/denied.log" }
+      # The token below is the operator secret OE_EGRESS_PROXY_TOKEN. The app reads it from this
+      # environment as the secret's migration on-ramp (with a one-time notice), or from the db
+      # credential store after `oe secret set OE_EGRESS_PROXY_TOKEN`. The proxy reads its own copy above.
       OE_EGRESS_PROXY_TOKEN: "${OE_EGRESS_PROXY_TOKEN:?set OE_EGRESS_PROXY_TOKEN in .env — the app's policy push is rejected without it (same value as the proxy)}"
-      # The proxy's denial log: a refused host becomes an `egress.denied` audit row. Unset it to turn
-      # the reader off.
-      OE_EGRESS_DENIAL_LOG: "${OE_EGRESS_DENIAL_LOG:-/var/log/oe-egress/denied.log}"
+      # `egress.denialLog` (above) reads the proxy's denial log: a refused host becomes an
+      # `egress.denied` audit row. Leave it out of the settings to turn the reader off.
       # Tier B: trust the MITM CA for git, npm and curl (no effect on Tier A).
       NODE_EXTRA_CA_CERTS: "/opt/oe-egress/ca/oe-egress-ca.crt"
       GIT_SSL_CAINFO: "/opt/oe-egress/ca/oe-egress-ca.crt"

package/template/scripts/ops-mcp.ts

@@ -42,6 +42,7 @@ registerGithubOps();
 // Added a surface to roster.config.ts? Register its ops arm too:
 //   import { registerTeamsOps } from "@open-everywhere/provider-teams/agent/ops.js";
 //   import { registerDiscordOps } from "@open-everywhere/provider-discord/agent/ops.js";
+//   import { registerLinearOps } from "@open-everywhere/provider-linear/agent/ops.js";
 registerSurfaceTrustPreflight();
 
 const server = buildOpsServer();