@sideboard-ai/core 0.1.202 → 0.1.203

package/dist/index.cjs

@@ -929,6 +929,9 @@ function normalizeVault(raw) {
   if (typeof raw.abletimeAccessToken === "string" && raw.abletimeAccessToken.trim()) {
     out.abletimeAccessToken = raw.abletimeAccessToken.trim();
   }
+  if (typeof raw.abletimeRefreshToken === "string" && raw.abletimeRefreshToken.trim()) {
+    out.abletimeRefreshToken = raw.abletimeRefreshToken.trim();
+  }
   if (typeof raw.vercelToken === "string" && raw.vercelToken.trim()) {
     out.vercelToken = raw.vercelToken.trim();
   }
@@ -1134,6 +1137,7 @@ function emptyPublicIntegrations() {
     hasSlackAppToken: false,
     hasGithubPat: false,
     hasAbleTimeToken: false,
+    hasAbleTimeOAuth: false,
     hasVercelToken: false,
     hasSupabaseToken: false,
     hasPosthogToken: false,
@@ -1158,6 +1162,7 @@ function toPublicAppSettings(settings) {
   const slackAppToken = integrations.slackAppToken;
   const githubPat = integrations.githubPat;
   const abletimeAccessToken = integrations.abletimeAccessToken;
+  const abletimeRefreshToken = integrations.abletimeRefreshToken;
   const vercelToken = integrations.vercelToken;
   const supabaseAccessToken = integrations.supabaseAccessToken;
   const posthogPersonalApiKey = integrations.posthogPersonalApiKey;
@@ -1170,6 +1175,7 @@ function toPublicAppSettings(settings) {
   delete integrations.slackAppToken;
   delete integrations.githubPat;
   delete integrations.abletimeAccessToken;
+  delete integrations.abletimeRefreshToken;
   delete integrations.vercelToken;
   delete integrations.supabaseAccessToken;
   delete integrations.posthogPersonalApiKey;
@@ -1184,7 +1190,8 @@ function toPublicAppSettings(settings) {
       hasSlackClientSecret: Boolean(slackClientSecret?.trim()),
       hasSlackAppToken: Boolean(slackAppToken?.trim()),
       hasGithubPat: Boolean(githubPat?.trim()),
-      hasAbleTimeToken: Boolean(abletimeAccessToken?.trim()),
+      hasAbleTimeToken: Boolean(abletimeAccessToken?.trim() || abletimeRefreshToken?.trim()),
+      hasAbleTimeOAuth: Boolean(abletimeRefreshToken?.trim()),
       hasVercelToken: Boolean(vercelToken?.trim()),
       hasSupabaseToken: Boolean(supabaseAccessToken?.trim()),
       hasPosthogToken: Boolean(posthogPersonalApiKey?.trim()),
@@ -1322,6 +1329,16 @@ function normalizeIntegrations(raw) {
     const token = source.abletimeAccessToken.trim();
     if (token) out.abletimeAccessToken = token;
   }
+  if (typeof source.abletimeRefreshToken === "string") {
+    const token = source.abletimeRefreshToken.trim();
+    if (token) out.abletimeRefreshToken = token;
+  }
+  if (typeof source.abletimeTokenExpiresAt === "number" && Number.isFinite(source.abletimeTokenExpiresAt)) {
+    out.abletimeTokenExpiresAt = source.abletimeTokenExpiresAt;
+  } else if (typeof source.abletimeTokenExpiresAt === "string") {
+    const n = Number(source.abletimeTokenExpiresAt);
+    if (Number.isFinite(n)) out.abletimeTokenExpiresAt = n;
+  }
   if (typeof source.abletimeHost === "string") {
     const host = source.abletimeHost.trim();
     if (host) out.abletimeHost = host;
@@ -1599,7 +1616,7 @@ function readSettingsFile() {
 }
 function diskHoldsSecrets(disk) {
   return Boolean(
-    disk.integrations.linearApiKey || disk.integrations.linearAccessToken || disk.integrations.linearRefreshToken || disk.integrations.linearClientSecret || disk.integrations.slackClientSecret || disk.integrations.slackAppToken || disk.integrations.githubPat || disk.integrations.abletimeAccessToken || disk.integrations.vercelToken || disk.integrations.supabaseAccessToken || disk.integrations.posthogPersonalApiKey || disk.integrations.sentryAuthToken || Object.keys(disk.environment).length > 0
+    disk.integrations.linearApiKey || disk.integrations.linearAccessToken || disk.integrations.linearRefreshToken || disk.integrations.linearClientSecret || disk.integrations.slackClientSecret || disk.integrations.slackAppToken || disk.integrations.githubPat || disk.integrations.abletimeAccessToken || disk.integrations.abletimeRefreshToken || disk.integrations.vercelToken || disk.integrations.supabaseAccessToken || disk.integrations.posthogPersonalApiKey || disk.integrations.sentryAuthToken || Object.keys(disk.environment).length > 0
   );
 }
 function mergeVault(disk) {
@@ -1630,6 +1647,9 @@ function mergeVault(disk) {
   if (vault.abletimeAccessToken && !integrations.abletimeAccessToken) {
     integrations.abletimeAccessToken = vault.abletimeAccessToken;
   }
+  if (vault.abletimeRefreshToken && !integrations.abletimeRefreshToken) {
+    integrations.abletimeRefreshToken = vault.abletimeRefreshToken;
+  }
   if (vault.vercelToken && !integrations.vercelToken) {
     integrations.vercelToken = vault.vercelToken;
   }
@@ -1654,6 +1674,7 @@ function persistSplit(settings) {
   const slackAppToken = integrations.slackAppToken;
   const githubPat = integrations.githubPat;
   const abletimeAccessToken = integrations.abletimeAccessToken;
+  const abletimeRefreshToken = integrations.abletimeRefreshToken;
   const vercelToken = integrations.vercelToken;
   const supabaseAccessToken = integrations.supabaseAccessToken;
   const posthogPersonalApiKey = integrations.posthogPersonalApiKey;
@@ -1666,6 +1687,7 @@ function persistSplit(settings) {
   delete integrations.slackAppToken;
   delete integrations.githubPat;
   delete integrations.abletimeAccessToken;
+  delete integrations.abletimeRefreshToken;
   delete integrations.vercelToken;
   delete integrations.supabaseAccessToken;
   delete integrations.posthogPersonalApiKey;
@@ -1684,6 +1706,7 @@ function persistSplit(settings) {
     slackAppToken,
     githubPat,
     abletimeAccessToken,
+    abletimeRefreshToken,
     vercelToken,
     supabaseAccessToken,
     posthogPersonalApiKey,
@@ -1870,6 +1893,8 @@ function updateIntegrationsSettings(patch) {
   if ("abletimeAccessToken" in patch) {
     if (patch.abletimeAccessToken == null || patch.abletimeAccessToken.trim() === "") {
       delete integrations.abletimeAccessToken;
+      delete integrations.abletimeRefreshToken;
+      delete integrations.abletimeTokenExpiresAt;
       delete integrations.abletimeViewerName;
     } else {
       integrations.abletimeAccessToken = patch.abletimeAccessToken.trim();
@@ -2220,7 +2245,9 @@ function disconnectLinearConnection() {
   return saveAppSettings({ ...current, integrations });
 }
 function isAbleTimeConnected(settings = loadAppSettings()) {
-  return Boolean(settings.integrations.abletimeAccessToken?.trim());
+  return Boolean(
+    settings.integrations.abletimeAccessToken?.trim() || settings.integrations.abletimeRefreshToken?.trim()
+  );
 }
 function getAbleTimeAccessToken(settings = loadAppSettings()) {
   const token = settings.integrations.abletimeAccessToken?.trim();
@@ -2233,6 +2260,12 @@ function saveAbleTimeConnection(input) {
   const current = loadAppSettings();
   const integrations = { ...current.integrations };
   integrations.abletimeAccessToken = input.accessToken.trim();
+  if (input.refreshToken?.trim()) {
+    integrations.abletimeRefreshToken = input.refreshToken.trim();
+  }
+  if (typeof input.expiresIn === "number" && Number.isFinite(input.expiresIn)) {
+    integrations.abletimeTokenExpiresAt = Date.now() + Math.max(0, input.expiresIn) * 1e3;
+  }
   if (input.host?.trim()) {
     integrations.abletimeHost = input.host.trim();
   }
@@ -2245,6 +2278,8 @@ function disconnectAbleTimeConnection() {
   const current = loadAppSettings();
   const integrations = { ...current.integrations };
   delete integrations.abletimeAccessToken;
+  delete integrations.abletimeRefreshToken;
+  delete integrations.abletimeTokenExpiresAt;
   delete integrations.abletimeViewerName;
   return saveAppSettings({ ...current, integrations });
 }
@@ -17459,6 +17494,645 @@ var init_detect = __esm({
   }
 });
 
+// src/integrations/abletime-oauth.ts
+var abletime_oauth_exports = {};
+__export(abletime_oauth_exports, {
+  ABLETIME_OAUTH_CANCELLED: () => ABLETIME_OAUTH_CANCELLED,
+  ABLETIME_OAUTH_PORT: () => ABLETIME_OAUTH_PORT,
+  ABLETIME_OAUTH_REDIRECT: () => ABLETIME_OAUTH_REDIRECT,
+  ABLETIME_OAUTH_RESOURCE: () => ABLETIME_OAUTH_RESOURCE,
+  AbleTimeOAuthCancelledError: () => AbleTimeOAuthCancelledError,
+  BAKED_ABLETIME_OAUTH_CLIENT_ID: () => BAKED_ABLETIME_OAUTH_CLIENT_ID,
+  ableTimeOAuthAuthorizeUrl: () => ableTimeOAuthAuthorizeUrl,
+  ableTimeOAuthClientId: () => ableTimeOAuthClientId,
+  ableTimeOAuthResource: () => ableTimeOAuthResource,
+  createAbleTimePkce: () => createAbleTimePkce,
+  ensureAbleTimeAccessToken: () => ensureAbleTimeAccessToken,
+  hasBakedAbleTimeOAuth: () => hasBakedAbleTimeOAuth,
+  isAbleTimeOAuthCancelled: () => isAbleTimeOAuthCancelled,
+  startAbleTimeOAuth: () => startAbleTimeOAuth
+});
+function hasBakedAbleTimeOAuth() {
+  return Boolean(BAKED_ABLETIME_OAUTH_CLIENT_ID.trim());
+}
+function ableTimeOAuthClientId() {
+  return process.env.SIDEBOARD_ABLETIME_OAUTH_CLIENT_ID?.trim() || BAKED_ABLETIME_OAUTH_CLIENT_ID.trim();
+}
+function ableTimeOAuthResource(host) {
+  return `${normalizeAbleTimeHost(host)}/api/public/v2/mcp`;
+}
+function createAbleTimePkce() {
+  const verifier = (0, import_node_crypto10.randomBytes)(32).toString("base64url");
+  const challenge = (0, import_node_crypto10.createHash)("sha256").update(verifier).digest("base64url");
+  return { verifier, challenge };
+}
+function ableTimeOAuthAuthorizeUrl(clientId, state, codeChallenge, host) {
+  const base = normalizeAbleTimeHost(host);
+  const params = new URLSearchParams({
+    response_type: "code",
+    client_id: clientId,
+    redirect_uri: ABLETIME_OAUTH_REDIRECT,
+    code_challenge: codeChallenge,
+    code_challenge_method: "S256",
+    state,
+    resource: ableTimeOAuthResource(host)
+  });
+  return `${base}/oauth/authorize?${params.toString()}`;
+}
+function htmlPage(title, body) {
+  return `<!doctype html><html><head><meta charset="utf-8"><title>${title}</title>
+<style>body{font-family:ui-sans-serif,system-ui,sans-serif;padding:48px 24px;max-width:36rem;margin:0 auto;color:#1a1a1a}
+h1{font-size:1.25rem}p{line-height:1.5;color:#444}</style></head><body>${body}</body></html>`;
+}
+async function exchangeAbleTimeToken(body, host) {
+  const url = `${normalizeAbleTimeHost(host)}/api/oauth/token`;
+  const res = await httpFetch(url, {
+    method: "POST",
+    headers: {
+      Accept: "application/json",
+      "Content-Type": "application/x-www-form-urlencoded"
+    },
+    body
+  });
+  const data = await res.json().catch(() => ({}));
+  if (!res.ok || data.error || !data.access_token?.trim()) {
+    const detail = data.error_description || data.error || `HTTP ${res.status}`;
+    throw new Error(`AbleTime OAuth token exchange failed: ${detail}`);
+  }
+  return data;
+}
+function persistAbleTimeTokens(data, input) {
+  return saveAbleTimeConnection({
+    accessToken: data.access_token.trim(),
+    refreshToken: data.refresh_token?.trim(),
+    expiresIn: data.expires_in,
+    host: input?.host,
+    viewerName: input?.viewerName
+  });
+}
+async function refreshAbleTimeAccessToken(refreshToken) {
+  const host = getAbleTimeHost();
+  const body = new URLSearchParams({
+    grant_type: "refresh_token",
+    refresh_token: refreshToken,
+    client_id: ableTimeOAuthClientId(),
+    resource: ableTimeOAuthResource(host)
+  });
+  try {
+    const data = await exchangeAbleTimeToken(body, host);
+    persistAbleTimeTokens(data, { host });
+    return data.access_token.trim();
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    if (/invalid_grant|invalid_token|unauthorized/i.test(message)) {
+      disconnectAbleTimeConnection();
+      throw new Error("AbleTime sign-in expired \u2014 connect again in Account settings");
+    }
+    throw err;
+  }
+}
+async function ensureAbleTimeAccessToken() {
+  const settings = loadAppSettings();
+  const access = settings.integrations.abletimeAccessToken?.trim() || "";
+  const refresh = settings.integrations.abletimeRefreshToken?.trim() || "";
+  const expiresAt = settings.integrations.abletimeTokenExpiresAt ?? 0;
+  if (access && (!refresh || Date.now() < expiresAt - REFRESH_SKEW_MS2)) {
+    return access;
+  }
+  if (refresh) {
+    if (!refreshInFlight) {
+      refreshInFlight = refreshAbleTimeAccessToken(refresh).finally(() => {
+        refreshInFlight = null;
+      });
+    }
+    return refreshInFlight;
+  }
+  return access || null;
+}
+function isAbleTimeOAuthCancelled(err) {
+  if (err instanceof AbleTimeOAuthCancelledError) return true;
+  const message = err instanceof Error ? err.message : String(err);
+  return message.includes(ABLETIME_OAUTH_CANCELLED);
+}
+async function startAbleTimeOAuth(opts) {
+  if (opts?.signal?.aborted) {
+    throw new AbleTimeOAuthCancelledError();
+  }
+  const clientId = ableTimeOAuthClientId();
+  if (!clientId) {
+    throw new Error(
+      `AbleTime browser sign-in needs a Client ID Metadata Document URL. Host ${BAKED_ABLETIME_OAUTH_CLIENT_ID} (see site/oauth/abletime-client.json), or set SIDEBOARD_ABLETIME_OAUTH_CLIENT_ID.`
+    );
+  }
+  const host = opts?.host?.trim() || void 0;
+  const state = (0, import_node_crypto10.randomBytes)(16).toString("hex");
+  const pkce = createAbleTimePkce();
+  const authorizeUrl = ableTimeOAuthAuthorizeUrl(clientId, state, pkce.challenge, host);
+  const timeoutMs = opts?.timeoutMs ?? 5 * 6e4;
+  const code = await new Promise((resolve, reject) => {
+    let settled = false;
+    const finish = (err, value) => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      if (err) reject(err);
+      else resolve(value);
+    };
+    const server = (0, import_node_http.createServer)((req, res) => {
+      try {
+        const url = new URL(req.url || "/", `http://127.0.0.1:${ABLETIME_OAUTH_PORT}`);
+        if (url.pathname !== "/callback") {
+          res.writeHead(404);
+          res.end("Not found");
+          return;
+        }
+        const err = url.searchParams.get("error");
+        const gotState = url.searchParams.get("state");
+        const gotCode = url.searchParams.get("code");
+        if (err) {
+          res.writeHead(400, { "Content-Type": "text/html" });
+          res.end(htmlPage("AbleTime", `<h1>Authorization cancelled</h1><p>${err}</p>`));
+          finish(new AbleTimeOAuthCancelledError(`AbleTime OAuth: ${err}`));
+          return;
+        }
+        if (gotState !== state || !gotCode) {
+          res.writeHead(400, { "Content-Type": "text/html" });
+          res.end(htmlPage("AbleTime", "<h1>Invalid callback</h1><p>State or code missing.</p>"));
+          finish(new Error("AbleTime OAuth callback was invalid"));
+          return;
+        }
+        res.writeHead(200, { "Content-Type": "text/html" });
+        res.end(
+          htmlPage(
+            "AbleTime connected",
+            "<h1>AbleTime connected</h1><p>You can close this tab and return to Sideboard.</p>"
+          )
+        );
+        finish(void 0, gotCode);
+      } catch (e) {
+        finish(e instanceof Error ? e : new Error(String(e)));
+      }
+    });
+    const timer = setTimeout(() => {
+      finish(new Error("AbleTime sign-in timed out \u2014 try again"));
+    }, timeoutMs);
+    const onAbort = () => finish(new AbleTimeOAuthCancelledError());
+    const cleanup = () => {
+      clearTimeout(timer);
+      opts?.signal?.removeEventListener("abort", onAbort);
+      server.close();
+    };
+    opts?.signal?.addEventListener("abort", onAbort, { once: true });
+    if (opts?.signal?.aborted) {
+      onAbort();
+      return;
+    }
+    server.on("error", (e) => {
+      finish(
+        e instanceof Error && e.code === "EADDRINUSE" ? new Error(
+          `Port ${ABLETIME_OAUTH_PORT} is in use. Close whatever is bound there, or paste an AbleTime token instead.`
+        ) : e instanceof Error ? e : new Error(String(e))
+      );
+    });
+    server.listen(ABLETIME_OAUTH_PORT, "127.0.0.1", () => {
+      void Promise.resolve(opts?.openUrl?.(authorizeUrl)).catch((e) => {
+        finish(e instanceof Error ? e : new Error(String(e)));
+      });
+    });
+  });
+  const body = new URLSearchParams({
+    grant_type: "authorization_code",
+    code,
+    redirect_uri: ABLETIME_OAUTH_REDIRECT,
+    client_id: clientId,
+    code_verifier: pkce.verifier,
+    resource: ableTimeOAuthResource(host)
+  });
+  const data = await exchangeAbleTimeToken(body, host);
+  persistAbleTimeTokens(data, { host });
+  const token = data.access_token.trim();
+  try {
+    const { getAbleTimeOrientation: getAbleTimeOrientation2 } = await Promise.resolve().then(() => (init_abletime(), abletime_exports));
+    const orientation = await getAbleTimeOrientation2({ token, host });
+    return saveAbleTimeConnection({
+      accessToken: token,
+      refreshToken: data.refresh_token?.trim(),
+      expiresIn: data.expires_in,
+      host,
+      viewerName: orientation.viewer.name
+    });
+  } catch {
+    return loadAppSettings();
+  }
+}
+var import_node_crypto10, import_node_http, ABLETIME_OAUTH_PORT, ABLETIME_OAUTH_REDIRECT, BAKED_ABLETIME_OAUTH_CLIENT_ID, ABLETIME_OAUTH_RESOURCE, REFRESH_SKEW_MS2, refreshInFlight, ABLETIME_OAUTH_CANCELLED, AbleTimeOAuthCancelledError;
+var init_abletime_oauth = __esm({
+  "src/integrations/abletime-oauth.ts"() {
+    "use strict";
+    import_node_crypto10 = require("crypto");
+    import_node_http = require("http");
+    init_fetch();
+    init_app_settings();
+    init_abletime_mcp();
+    ABLETIME_OAUTH_PORT = 19849;
+    ABLETIME_OAUTH_REDIRECT = `http://127.0.0.1:${ABLETIME_OAUTH_PORT}/callback`;
+    BAKED_ABLETIME_OAUTH_CLIENT_ID = "https://www.sideboard.cloud/oauth/abletime-client.json";
+    ABLETIME_OAUTH_RESOURCE = `${DEFAULT_ABLETIME_HOST}/api/public/v2/mcp`;
+    REFRESH_SKEW_MS2 = 5 * 6e4;
+    refreshInFlight = null;
+    ABLETIME_OAUTH_CANCELLED = "AbleTime sign-in cancelled";
+    AbleTimeOAuthCancelledError = class extends Error {
+      constructor(message = ABLETIME_OAUTH_CANCELLED) {
+        super(message);
+        this.name = "AbleTimeOAuthCancelledError";
+      }
+    };
+  }
+});
+
+// src/integrations/abletime-rest.ts
+var abletime_rest_exports = {};
+__export(abletime_rest_exports, {
+  ABLETIME_REST_PREFIX: () => ABLETIME_REST_PREFIX,
+  ableTimeDocFromText: () => ableTimeDocFromText,
+  abletimeRestUrl: () => abletimeRestUrl,
+  callAbleTimeRestTool: () => callAbleTimeRestTool,
+  looksLikeAbleTimeUlid: () => looksLikeAbleTimeUlid,
+  textFromAbleTimeDoc: () => textFromAbleTimeDoc
+});
+function asRecord5(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function asString(value) {
+  return typeof value === "string" ? value.trim() : "";
+}
+function asList(value) {
+  if (Array.isArray(value)) return value;
+  const record = asRecord5(value);
+  if (!record) return [];
+  for (const key of ["data", "tasks", "projects", "users", "items", "results"]) {
+    if (Array.isArray(record[key])) return record[key];
+  }
+  return [];
+}
+function ableTimeDocFromText(text7) {
+  const trimmed = text7.trim();
+  if (!trimmed) return { type: "doc", content: [] };
+  return {
+    type: "doc",
+    content: [{ type: "paragraph", content: [{ type: "text", text: trimmed }] }]
+  };
+}
+function textFromAbleTimeDoc(value) {
+  if (typeof value === "string") return value.trim();
+  const record = asRecord5(value);
+  if (!record) return "";
+  if (typeof record.text === "string" && record.text.trim()) return record.text.trim();
+  const chunks = [];
+  const walk = (node) => {
+    const rec = asRecord5(node);
+    if (!rec) return;
+    if (typeof rec.text === "string" && rec.text) chunks.push(rec.text);
+    if (Array.isArray(rec.content)) rec.content.forEach(walk);
+  };
+  walk(record);
+  return chunks.join("").trim();
+}
+function abletimeRestUrl(path2, host, query) {
+  const base = `${normalizeAbleTimeHost(host)}${ABLETIME_REST_PREFIX}`;
+  const suffix = path2.startsWith("/") ? path2 : `/${path2}`;
+  const url = new URL(`${base}${suffix}`);
+  for (const [key, value] of Object.entries(query ?? {})) {
+    if (value) url.searchParams.set(key, value);
+  }
+  return url.href;
+}
+function looksLikeAbleTimeUlid(id) {
+  return ULID_RE.test(id.trim());
+}
+async function abletimeRestRequest(path2, opts = {}) {
+  const raw = opts.token ?? getAbleTimeAccessToken();
+  const token = normalizeAbleTimeCredential(raw ?? "");
+  if (!token) {
+    throw new Error("AbleTime is not connected \u2014 paste an API key or personal access token in Account settings");
+  }
+  const host = opts.host ?? (opts.token ? DEFAULT_ABLETIME_HOST : getAbleTimeHost());
+  const url = abletimeRestUrl(path2, host, opts.query);
+  const method = (opts.method ?? "GET").toUpperCase();
+  const res = await httpFetch(url, {
+    method,
+    headers: {
+      Accept: "application/json",
+      Authorization: `Bearer ${token}`,
+      ...opts.body !== void 0 ? { "Content-Type": "application/json" } : {}
+    },
+    ...opts.body !== void 0 ? { body: JSON.stringify(opts.body) } : {}
+  });
+  const text7 = await res.text().catch(() => "");
+  if (!res.ok) {
+    throw new Error(
+      rewriteAbleTimeError(
+        `AbleTime API error ${res.status}${text7 ? `: ${text7.slice(0, 240)}` : ""}`
+      )
+    );
+  }
+  if (!text7.trim()) return null;
+  try {
+    return JSON.parse(text7);
+  } catch {
+    throw new Error(`AbleTime API returned a non-JSON response: ${text7.slice(0, 200)}`);
+  }
+}
+async function restPages(path2, opts, maxPages = 20) {
+  const items = [];
+  let cursor;
+  for (let i = 0; i < maxPages; i += 1) {
+    const raw = await abletimeRestRequest(path2, {
+      ...opts,
+      query: { ...opts.query, ...cursor ? { cursor } : {} }
+    });
+    items.push(...asList(raw));
+    const page = asRecord5(asRecord5(raw)?.page);
+    const next = page ? asString(page.nextCursor) : "";
+    if (!next) break;
+    cursor = next;
+  }
+  return items;
+}
+function userDisplayName(raw) {
+  const rec = asRecord5(raw);
+  if (!rec) return null;
+  const id = asString(rec.userId) || asString(rec.id);
+  const name = [asString(rec.firstName), asString(rec.lastName)].filter(Boolean).join(" ") || asString(rec.username) || asString(rec.email) || asString(rec.name);
+  if (!name) return null;
+  return { id: id || void 0, name };
+}
+function restTaskToRaw(raw, users) {
+  const rec = asRecord5(raw);
+  if (!rec) return null;
+  const id = asString(rec.timeflowTaskId) || asString(rec.taskId) || asString(rec.id);
+  const identifier = asString(rec.taskRef) || asString(rec.reference) || id;
+  const title = asString(rec.title);
+  if (!id && !identifier && !title) return null;
+  const assigned = asString(rec.assignedUserId);
+  const assignee = assigned ? users.get(assigned) : void 0;
+  const comments = asList(rec.comments).map((item) => {
+    const comment = asRecord5(item) ?? {};
+    const user = userDisplayName(comment);
+    return {
+      id: asString(comment.commentId) || asString(comment.id),
+      body: textFromAbleTimeDoc(comment.content) || asString(comment.contentSanitized) || asString(comment.body),
+      createdAt: asString(comment.createdAt) || asString(comment.lastUpdate),
+      user: user?.name || asString(comment.username)
+    };
+  });
+  return {
+    id,
+    taskId: id,
+    timeflowTaskId: id,
+    reference: identifier,
+    taskRef: identifier,
+    title: title || identifier,
+    state: asString(rec.taskState) || asString(rec.state),
+    description: textFromAbleTimeDoc(rec.description) || asString(rec.descriptionSanitized),
+    projectId: asString(rec.projectId),
+    categoryId: asString(rec.projectCategoryId) || asString(rec.categoryId),
+    tags: rec.tags,
+    comments,
+    createdAt: asString(rec.dateCreated) || asString(rec.createdAt),
+    updatedAt: asString(rec.lastUpdate) || asString(rec.updatedAt),
+    ...assignee ? { assignee } : {}
+  };
+}
+function restProjectToRaw(raw) {
+  const rec = asRecord5(raw);
+  if (!rec) return null;
+  const id = asString(rec.projectId) || asString(rec.id);
+  const name = asString(rec.projectName) || asString(rec.name);
+  if (!id && !name) return null;
+  const categories = asList(rec.categories).map((item) => {
+    const cat = asRecord5(item) ?? {};
+    return {
+      id: asString(cat.projectCategoryId) || asString(cat.categoryId) || asString(cat.id),
+      name: asString(cat.categoryName) || asString(cat.name)
+    };
+  });
+  return { id, name, projectId: id, projectName: name, categories };
+}
+async function listUsers(opts) {
+  const users = /* @__PURE__ */ new Map();
+  for (const item of await restPages("/users", opts).catch(() => [])) {
+    const user = userDisplayName(item);
+    const rec = asRecord5(item);
+    const id = user?.id || (rec ? asString(rec.userId) : "");
+    if (user && id) users.set(id, user);
+  }
+  return users;
+}
+async function listProjectsRaw(opts) {
+  const items = await restPages("/projects", { ...opts, query: { expand: "categories" } });
+  return items.map(restProjectToRaw).filter((item) => Boolean(item));
+}
+async function listTasksRaw(opts) {
+  const [users, items] = await Promise.all([
+    listUsers(opts),
+    restPages("/tasks", {
+      ...opts,
+      query: {
+        ...opts.projectId ? { projectId: opts.projectId } : {}
+      }
+    })
+  ]);
+  let tasks = items.map((item) => restTaskToRaw(item, users)).filter((item) => Boolean(item));
+  const needle = opts.query?.trim().toLowerCase();
+  if (needle) {
+    tasks = tasks.filter((task) => {
+      const hay = [task.title, task.reference, task.taskRef, task.id].map((value) => String(value ?? "").toLowerCase()).join(" ");
+      const tags = Array.isArray(task.tags) ? task.tags.join(" ").toLowerCase() : "";
+      return hay.includes(needle) || tags.includes(needle);
+    });
+  }
+  return tasks;
+}
+async function resolveTaskId(id, opts) {
+  const wanted = id.trim();
+  if (!wanted) throw new Error("AbleTime task id is required");
+  if (looksLikeAbleTimeUlid(wanted)) return wanted;
+  const tasks = await listTasksRaw(opts);
+  const match = tasks.find((task) => {
+    const ref = String(task.reference ?? task.taskRef ?? "").toLowerCase();
+    const taskId = String(task.id ?? "").toLowerCase();
+    return ref === wanted.toLowerCase() || taskId === wanted.toLowerCase();
+  });
+  if (!match?.id) throw new Error(`AbleTime task not found: ${id}`);
+  return String(match.id);
+}
+async function getTaskRaw(id, opts) {
+  const taskId = await resolveTaskId(id, opts);
+  const [users, raw] = await Promise.all([
+    listUsers(opts),
+    abletimeRestRequest(`/tasks/${encodeURIComponent(taskId)}`, {
+      ...opts,
+      query: { expand: "comments" }
+    })
+  ]);
+  const task = restTaskToRaw(raw, users);
+  if (!task) throw new Error(`AbleTime task not found: ${id}`);
+  return task;
+}
+function firstStringArg(args, keys) {
+  for (const key of keys) {
+    const value = asString(args[key]);
+    if (value) return value;
+  }
+  return "";
+}
+async function callAbleTimeRestTool(name, args = {}, opts) {
+  const token = normalizeAbleTimeCredential(opts?.token ?? getAbleTimeAccessToken() ?? "");
+  if (ableTimeCredentialKind(token) !== "org") {
+    throw new Error("AbleTime REST transport is for organization API keys (atk_\u2026)");
+  }
+  const requestOpts = { ...opts, token };
+  switch (name) {
+    case "orientation": {
+      const [users, projects, tasks] = await Promise.all([
+        listUsers(requestOpts),
+        listProjectsRaw(requestOpts),
+        listTasksRaw(requestOpts)
+      ]);
+      const viewer = [...users.values()].find((user) => user.name) ?? [...users.values()][0] ?? { name: "AbleTime" };
+      return { viewer, projects, tasks };
+    }
+    case "list_projects":
+      return { data: await listProjectsRaw(requestOpts) };
+    case "list_users":
+      return { data: [...(await listUsers(requestOpts)).values()] };
+    case "list_tasks":
+      return {
+        data: await listTasksRaw({
+          ...requestOpts,
+          projectId: firstStringArg(args, ["project_id", "projectId", "project"])
+        })
+      };
+    case "search_tasks":
+      return {
+        data: await listTasksRaw({
+          ...requestOpts,
+          query: firstStringArg(args, ["query", "q"])
+        })
+      };
+    case "get_task":
+      return await getTaskRaw(firstStringArg(args, ["id", "task_id", "task"]), requestOpts);
+    case "create_task": {
+      const title = firstStringArg(args, ["title"]);
+      if (!title) throw new Error("AbleTime task title is required");
+      const projectId = firstStringArg(args, ["project_id", "projectId", "project"]);
+      if (!projectId) throw new Error("AbleTime project is required");
+      const projects = await listProjectsRaw(requestOpts);
+      const project = projects.find(
+        (item) => String(item.id).toLowerCase() === projectId.toLowerCase() || String(item.name).toLowerCase() === projectId.toLowerCase()
+      ) ?? projects[0];
+      if (!project) throw new Error("AbleTime has no projects to create a task in");
+      const categories = asList(project.categories);
+      const wantedCategory = firstStringArg(args, ["category_id", "categoryId", "category"]);
+      const category = categories.map((item) => asRecord5(item)).find((item) => {
+        if (!item || !wantedCategory) return false;
+        return asString(item.id).toLowerCase() === wantedCategory.toLowerCase() || asString(item.name).toLowerCase() === wantedCategory.toLowerCase();
+      }) ?? asRecord5(categories[0]);
+      const created = await abletimeRestRequest("/tasks", {
+        ...requestOpts,
+        method: "POST",
+        body: {
+          projectId: project.id,
+          projectCategoryId: category ? asString(category.id) : void 0,
+          title
+        }
+      });
+      const state = firstStringArg(args, ["state"]);
+      const createdId = asString(asRecord5(created)?.timeflowTaskId);
+      const description = asString(args.description);
+      if (createdId && description) {
+        await abletimeRestRequest(`/tasks/${encodeURIComponent(createdId)}`, {
+          ...requestOpts,
+          method: "PATCH",
+          body: { description: ableTimeDocFromText(description) }
+        }).catch(() => void 0);
+      }
+      if (createdId && state && state !== "todo") {
+        await abletimeRestRequest(`/tasks/${encodeURIComponent(createdId)}/state`, {
+          ...requestOpts,
+          method: "POST",
+          body: { taskState: state }
+        }).catch(() => void 0);
+      }
+      return createdId ? await getTaskRaw(createdId, requestOpts) : restTaskToRaw(created, await listUsers(requestOpts));
+    }
+    case "update_task": {
+      const id = await resolveTaskId(firstStringArg(args, ["id", "task_id", "task"]), requestOpts);
+      const patch = {};
+      const title = firstStringArg(args, ["title"]);
+      if (title) patch.title = title;
+      if (args.description !== void 0) {
+        patch.description = args.description == null || args.description === "" ? null : ableTimeDocFromText(String(args.description));
+      }
+      if (args.tags !== void 0 || args.labels !== void 0) {
+        patch.tags = args.tags ?? args.labels ?? args.tag_names;
+      }
+      if (Object.keys(patch).length > 0) {
+        await abletimeRestRequest(`/tasks/${encodeURIComponent(id)}`, {
+          ...requestOpts,
+          method: "PATCH",
+          body: patch
+        });
+      }
+      return await getTaskRaw(id, requestOpts);
+    }
+    case "set_task_state": {
+      const id = await resolveTaskId(firstStringArg(args, ["id", "task_id", "task"]), requestOpts);
+      const state = firstStringArg(args, ["state", "taskState"]);
+      if (!state) throw new Error("AbleTime task state is required");
+      await abletimeRestRequest(`/tasks/${encodeURIComponent(id)}/state`, {
+        ...requestOpts,
+        method: "POST",
+        body: { taskState: state }
+      });
+      return await getTaskRaw(id, requestOpts);
+    }
+    case "create_comment": {
+      const id = await resolveTaskId(firstStringArg(args, ["id", "task_id", "task"]), requestOpts);
+      const body = firstStringArg(args, ["body", "comment", "text"]);
+      if (!body) throw new Error("AbleTime comment body is required");
+      const created = await abletimeRestRequest(`/tasks/${encodeURIComponent(id)}/comments`, {
+        ...requestOpts,
+        method: "POST",
+        body: { content: ableTimeDocFromText(body) }
+      });
+      const rec = asRecord5(created) ?? {};
+      return {
+        id: asString(rec.commentId) || void 0,
+        body: textFromAbleTimeDoc(rec.content) || body
+      };
+    }
+    case "set_task_dependency":
+      throw new Error(
+        "AbleTime organization API keys cannot set task dependencies on REST yet \u2014 use a personal access token (apt_\u2026) for MCP project-management tools."
+      );
+    default:
+      throw new Error(`AbleTime organization API keys do not support ${name} on REST`);
+  }
+}
+var ABLETIME_REST_PREFIX, ULID_RE;
+var init_abletime_rest = __esm({
+  "src/integrations/abletime-rest.ts"() {
+    "use strict";
+    init_fetch();
+    init_app_settings();
+    init_abletime_mcp();
+    ABLETIME_REST_PREFIX = "/api/public/v2";
+    ULID_RE = /^[0-9A-HJKMNP-TV-Z]{26}$/i;
+  }
+});
+
 // src/integrations/abletime-mcp.ts
 function abletimeToolUsesPm(name) {
   return ABLETIME_PM_TOOL_NAMES.includes(name);
@@ -17472,22 +18146,49 @@ function abletimeMcpUrl(host, opts) {
   const path2 = opts?.pm ? ABLETIME_MCP_PM_PATH : ABLETIME_MCP_PATH;
   return `${normalizeAbleTimeHost(host)}${path2}`;
 }
+function normalizeAbleTimeCredential(raw) {
+  return raw.trim().replace(/^bearer\s+/i, "").trim();
+}
+function ableTimeCredentialKind(raw) {
+  const token = normalizeAbleTimeCredential(raw).toLowerCase();
+  if (token.startsWith(ABLETIME_PAT_PREFIX)) return "pat";
+  if (token.startsWith(ABLETIME_ORG_KEY_PREFIX)) return "org";
+  return "unknown";
+}
+function assertAbleTimeMcpCredential(raw) {
+  const token = normalizeAbleTimeCredential(raw);
+  if (!token) {
+    throw new Error("AbleTime personal access token is required");
+  }
+  if (ableTimeCredentialKind(token) === "org") {
+    throw new Error(ORG_KEY_HINT);
+  }
+  return token;
+}
+function assertAbleTimeCredential(raw) {
+  const token = normalizeAbleTimeCredential(raw);
+  if (!token) {
+    throw new Error("AbleTime API key or personal access token is required");
+  }
+  return token;
+}
 function rewriteAbleTimeError(message) {
-  if (/INTEGRATION_AGENT_ACCESS_DISABLED|agent access/i.test(message)) {
+  if (REWRITE_APPLIED.test(message)) return message;
+  if (/INTEGRATION_AGENT_ACCESS_DISABLED/i.test(message)) {
     return `${message} \u2014 Enable Agent access (MCP) in AbleTime Settings \u2192 Integrations \u2192 API Keys.`;
   }
-  if (/INTEGRATION_PAT_REQUIRED|organization api key/i.test(message)) {
-    return `${message} \u2014 AbleTime MCP needs a personal access token (apt_\u2026), not an organization API key.`;
+  if (/INTEGRATION_PAT_REQUIRED/i.test(message)) {
+    return `${message} \u2014 ${ORG_KEY_HINT}`;
   }
   if (/INTEGRATION_PLAN_REQUIRED/i.test(message)) {
     return `${message} \u2014 AbleTime plan does not include API access.`;
   }
   if (/INTEGRATION_KEY_INVALID|INTEGRATION_KEY_MISSING|401|unauthorized|invalid token/i.test(message)) {
-    return `${message} \u2014 Reconnect AbleTime from Account settings (Profile \u2192 API Access).`;
+    return `${message} \u2014 ${REJECTED_CREDENTIAL_HINT}`;
   }
   return message;
 }
-function asRecord5(value) {
+function asRecord6(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
 function parseSseJson(body) {
@@ -17509,12 +18210,12 @@ function parseSseJson(body) {
   }
 }
 function unwrapToolResult(result) {
-  const record = asRecord5(result);
+  const record = asRecord6(result);
   if (!record) return result;
   const content = record.content;
   if (Array.isArray(content)) {
     const texts = content.map((part) => {
-      const item = asRecord5(part);
+      const item = asRecord6(part);
       if (!item) return "";
       return typeof item.text === "string" ? item.text : "";
     }).filter(Boolean);
@@ -17536,17 +18237,18 @@ function unwrapToolResult(result) {
   return result;
 }
 function textsFromUnknown(value) {
-  const record = asRecord5(value);
+  const record = asRecord6(value);
   if (!record) return "";
   if (typeof record.message === "string") return record.message;
   if (typeof record.error === "string") return record.error;
   return "";
 }
 async function abletimeMcpRequest(method, params, opts) {
-  const token = (opts?.token ?? getAbleTimeAccessToken())?.trim();
-  if (!token) {
+  const rawToken = opts?.token ?? await Promise.resolve().then(() => (init_abletime_oauth(), abletime_oauth_exports)).then((m) => m.ensureAbleTimeAccessToken());
+  if (!rawToken?.trim()) {
     throw new Error("AbleTime is not connected \u2014 paste a personal access token in Account settings");
   }
+  const token = assertAbleTimeMcpCredential(rawToken);
   const url = abletimeMcpUrl(
     opts?.host ?? (opts?.token ? DEFAULT_ABLETIME_HOST : getAbleTimeHost()),
     { pm: opts?.pm }
@@ -17582,7 +18284,7 @@ async function abletimeMcpRequest(method, params, opts) {
       return parseSseJson(body);
     }
   })();
-  const rpc = asRecord5(parsed);
+  const rpc = asRecord6(parsed);
   if (rpc?.error) {
     const detail = typeof rpc.error.message === "string" && rpc.error.message.trim() ? rpc.error.message : `AbleTime MCP error ${rpc.error.code ?? ""}`.trim();
     throw new Error(rewriteAbleTimeError(detail));
@@ -17613,6 +18315,11 @@ async function callAbleTimeTool(name, args = {}, opts) {
   if (!opts?.token && !isAbleTimeConnected()) {
     throw new Error("AbleTime is not connected \u2014 paste a personal access token in Account settings");
   }
+  const rawToken = opts?.token ?? await Promise.resolve().then(() => (init_abletime_oauth(), abletime_oauth_exports)).then((m) => m.ensureAbleTimeAccessToken());
+  if (rawToken && ableTimeCredentialKind(rawToken) === "org") {
+    const { callAbleTimeRestTool: callAbleTimeRestTool2 } = await Promise.resolve().then(() => (init_abletime_rest(), abletime_rest_exports));
+    return callAbleTimeRestTool2(name, args, { ...opts, token: rawToken });
+  }
   const requestOpts = { ...opts, pm: opts?.pm ?? abletimeToolUsesPm(name) };
   const call = () => abletimeMcpRequest("tools/call", { name, arguments: args }, requestOpts).then((result) => {
     return unwrapToolResult(result);
@@ -17628,7 +18335,7 @@ async function callAbleTimeTool(name, args = {}, opts) {
     throw err instanceof Error ? new Error(rewriteAbleTimeError(err.message)) : err;
   }
 }
-var DEFAULT_ABLETIME_HOST, ABLETIME_MCP_PATH, ABLETIME_MCP_PM_PATH, MCP_PROTOCOL_VERSION, ABLETIME_PM_TOOL_NAMES;
+var DEFAULT_ABLETIME_HOST, ABLETIME_MCP_PATH, ABLETIME_MCP_PM_PATH, MCP_PROTOCOL_VERSION, ABLETIME_PM_TOOL_NAMES, ABLETIME_PAT_PREFIX, ABLETIME_ORG_KEY_PREFIX, ORG_KEY_HINT, REJECTED_CREDENTIAL_HINT, REWRITE_APPLIED;
 var init_abletime_mcp = __esm({
   "src/integrations/abletime-mcp.ts"() {
     "use strict";
@@ -17650,6 +18357,11 @@ var init_abletime_mcp = __esm({
       "archive_task",
       "delete_task"
     ];
+    ABLETIME_PAT_PREFIX = "apt_";
+    ABLETIME_ORG_KEY_PREFIX = "atk_";
+    ORG_KEY_HINT = "AbleTime MCP needs a personal access token (apt_\u2026) from Edit Profile \u2192 API Access, not an organization API key (atk_\u2026) from Settings \u2192 Integrations \u2192 API Keys.";
+    REJECTED_CREDENTIAL_HINT = "AbleTime rejected this credential (unknown, revoked, or expired). Use a personal access token (apt_\u2026) from Edit Profile \u2192 API Access \u2014 organization API keys (atk_\u2026) cannot call MCP. Tokens are shown once; rotating replaces the previous one.";
+    REWRITE_APPLIED = /— Enable Agent access \(MCP\)|— AbleTime MCP needs a personal access token|— AbleTime plan does not include API access|— AbleTime rejected this credential/;
   }
 });
 
@@ -17673,16 +18385,16 @@ __export(abletime_exports, {
   updateAbleTimeTask: () => updateAbleTimeTask,
   verifyAbleTimeConnection: () => verifyAbleTimeConnection
 });
-function asRecord6(value) {
+function asRecord7(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
-function asString(value) {
+function asString2(value) {
   return typeof value === "string" ? value.trim() : "";
 }
 function firstString(record, keys) {
   if (!record) return "";
   for (const key of keys) {
-    const value = asString(record[key]);
+    const value = asString2(record[key]);
     if (value) return value;
   }
   return "";
@@ -17690,14 +18402,14 @@ function firstString(record, keys) {
 function firstRecord(record, keys) {
   if (!record) return null;
   for (const key of keys) {
-    const value = asRecord6(record[key]);
+    const value = asRecord7(record[key]);
     if (value) return value;
   }
   return null;
 }
-function asList(value) {
+function asList2(value) {
   if (Array.isArray(value)) return value;
-  const record = asRecord6(value);
+  const record = asRecord7(value);
   if (!record) return [];
   for (const key of ["data", "tasks", "projects", "items", "results", "nodes"]) {
     if (Array.isArray(record[key])) return record[key];
@@ -17709,21 +18421,21 @@ function labelsOf(record) {
   if (!Array.isArray(raw)) return [];
   return raw.map((item) => {
     if (typeof item === "string") return item.trim();
-    const rec = asRecord6(item);
+    const rec = asRecord7(item);
     return rec ? firstString(rec, ["name", "title", "label"]) : "";
   }).filter(Boolean);
 }
 function commentsOf(record) {
   const raw = record.comments ?? record.notes ?? record.discussion;
   const out = [];
-  for (const item of asList(raw)) {
-    const rec = asRecord6(item);
+  for (const item of asList2(raw)) {
+    const rec = asRecord7(item);
     if (!rec) continue;
-    const body = firstString(rec, ["body", "text", "comment", "content", "message"]);
+    const body = firstString(rec, ["body", "text", "comment", "message", "contentSanitized"]) || textFromAbleTimeDoc(rec.content);
     if (!body) continue;
-    const user = firstString(asRecord6(rec.user) ?? asRecord6(rec.author), ["name", "display_name"]) || firstString(rec, ["user_name", "author"]);
+    const user = firstString(asRecord7(rec.user) ?? asRecord7(rec.author), ["name", "display_name", "username"]) || firstString(rec, ["user_name", "author", "username"]);
     const comment = { body };
-    const id = firstString(rec, ["id", "comment_id"]);
+    const id = firstString(rec, ["id", "comment_id", "commentId"]);
     if (id) comment.id = id;
     const url = firstString(rec, ["url", "permalink"]);
     if (url) comment.url = url;
@@ -17747,11 +18459,11 @@ function taskUrl(task, host) {
   return `${base}/tasks/${slug}`;
 }
 function mapAbleTimeTask(raw, host) {
-  const record = asRecord6(raw);
+  const record = asRecord7(raw);
   if (!record) return null;
   const nested = firstRecord(record, ["task", "data"]) ?? record;
-  const id = firstString(nested, ["id", "task_id", "taskId"]);
-  const identifier = firstString(nested, ["reference", "ref", "identifier", "key", "code", "number"]) || id;
+  const id = firstString(nested, ["id", "task_id", "taskId", "timeflowTaskId"]);
+  const identifier = firstString(nested, ["reference", "ref", "identifier", "key", "code", "number", "taskRef"]) || id;
   const title = firstString(nested, ["title", "name"]);
   if (!id && !identifier && !title) return null;
   const resolvedId = id || identifier;
@@ -17762,21 +18474,22 @@ function mapAbleTimeTask(raw, host) {
     identifier: resolvedIdentifier,
     title: title || resolvedIdentifier,
     url,
-    description: firstString(nested, ["description", "body", "details"]) || void 0,
-    state: firstString(nested, ["state", "board_state", "boardState", "status"]) || void 0,
-    projectId: firstString(nested, ["project_id", "projectId"]) || firstString(asRecord6(nested.project), ["id"]) || void 0,
-    categoryId: firstString(nested, ["category_id", "categoryId"]) || firstString(asRecord6(nested.category), ["id"]) || void 0,
+    description: firstString(nested, ["description", "body", "details", "descriptionSanitized"]) || textFromAbleTimeDoc(nested.description) || void 0,
+    state: firstString(nested, ["state", "board_state", "boardState", "status", "taskState"]) || void 0,
+    projectId: firstString(nested, ["project_id", "projectId"]) || firstString(asRecord7(nested.project), ["id"]) || void 0,
+    categoryId: firstString(nested, ["category_id", "categoryId", "projectCategoryId"]) || firstString(asRecord7(nested.category), ["id"]) || void 0,
     assignee: assigneeOf(nested),
     labels: labelsOf(nested),
     comments: commentsOf(nested),
-    createdAt: firstString(nested, ["created_at", "createdAt", "created"]) || void 0,
+    createdAt: firstString(nested, ["created_at", "createdAt", "created", "dateCreated"]) || void 0,
     updatedAt: firstString(nested, [
       "updated_at",
       "updatedAt",
       "modified_at",
       "modifiedAt",
       "last_activity_at",
-      "lastActivityAt"
+      "lastActivityAt",
+      "lastUpdate"
     ]) || void 0
   };
 }
@@ -17807,16 +18520,16 @@ function issueAttachmentForAbleTimeTask(task) {
   };
 }
 function mapProject(raw) {
-  const record = asRecord6(raw);
+  const record = asRecord7(raw);
   if (!record) return null;
-  const id = firstString(record, ["id", "project_id"]);
-  const name = firstString(record, ["name", "title"]);
+  const id = firstString(record, ["id", "project_id", "projectId"]);
+  const name = firstString(record, ["name", "title", "projectName"]);
   if (!id && !name) return null;
-  const categories = asList(record.categories ?? record.category).map((item) => {
-    const rec = asRecord6(item);
+  const categories = asList2(record.categories ?? record.category).map((item) => {
+    const rec = asRecord7(item);
     if (!rec) return null;
-    const categoryId = firstString(rec, ["id", "category_id"]);
-    const categoryName = firstString(rec, ["name", "title"]);
+    const categoryId = firstString(rec, ["id", "category_id", "projectCategoryId", "categoryId"]);
+    const categoryName = firstString(rec, ["name", "title", "categoryName"]);
     if (!categoryId && !categoryName) return null;
     return { id: categoryId || categoryName, name: categoryName || categoryId };
   }).filter((item) => Boolean(item));
@@ -17828,21 +18541,21 @@ function isOpenTask(task) {
 }
 async function getAbleTimeOrientation(opts) {
   const raw = await callAbleTimeTool("orientation", {}, opts);
-  const record = asRecord6(raw);
+  const record = asRecord7(raw);
   const viewerRec = firstRecord(record, ["viewer", "user", "actor", "me", "person"]) ?? record;
   const viewer = {
     id: firstString(viewerRec, ["id", "user_id"]) || void 0,
     name: firstString(viewerRec, ["name", "display_name", "full_name"]) || firstString(record, ["name"]) || void 0
   };
-  const projects = asList(
+  const projects = asList2(
     record?.projects ?? record?.current_projects ?? record?.currentProjects
   ).map(mapProject).filter((item) => Boolean(item));
-  const tasks = asList(record?.tasks ?? record?.active_tasks ?? record?.activeTasks).map((item) => mapAbleTimeTask(item, opts?.host)).filter((item) => Boolean(item));
+  const tasks = asList2(record?.tasks ?? record?.active_tasks ?? record?.activeTasks).map((item) => mapAbleTimeTask(item, opts?.host)).filter((item) => Boolean(item));
   return { viewer, projects, tasks, raw };
 }
 async function listAbleTimeProjects(opts) {
   const raw = await callAbleTimeTool("list_projects", { include_categories: true }, opts);
-  return asList(raw).map(mapProject).filter((item) => Boolean(item));
+  return asList2(raw).map(mapProject).filter((item) => Boolean(item));
 }
 async function listAbleTimeTasks(opts) {
   const args = {};
@@ -17852,14 +18565,14 @@ async function listAbleTimeTasks(opts) {
   }
   if (opts?.query) args.query = opts.query;
   const raw = await callAbleTimeTool("list_tasks", args, opts);
-  const tasks = asList(raw).map((item) => mapAbleTimeTask(item, opts?.host)).filter((item) => Boolean(item));
+  const tasks = asList2(raw).map((item) => mapAbleTimeTask(item, opts?.host)).filter((item) => Boolean(item));
   return opts?.includeClosed ? tasks : tasks.filter(isOpenTask);
 }
 async function searchAbleTimeTasks(query, opts) {
   const q = query.trim();
   if (!q) return [];
   const raw = await callAbleTimeTool("search_tasks", { query: q, q }, opts);
-  return asList(raw).map((item) => mapAbleTimeTask(item, opts?.host)).filter((item) => Boolean(item)).filter(isOpenTask);
+  return asList2(raw).map((item) => mapAbleTimeTask(item, opts?.host)).filter((item) => Boolean(item)).filter(isOpenTask);
 }
 async function getAbleTimeTask(id, opts) {
   const raw = await callAbleTimeTool("get_task", { id, task_id: id }, opts);
@@ -17907,7 +18620,7 @@ async function commentAbleTimeTask(input, opts) {
     { id, task_id: id, task: id, body, comment: body, text: body },
     opts
   );
-  const rec = asRecord6(raw);
+  const rec = asRecord7(raw);
   return {
     id: rec ? firstString(rec, ["id", "comment_id"]) || void 0 : void 0,
     body: rec ? firstString(rec, ["body", "text", "comment"]) || body : body
@@ -18097,8 +18810,7 @@ async function listAbleTimeAssignedIssues(opts) {
   };
 }
 async function verifyAbleTimeConnection(input) {
-  const token = input.token.trim();
-  if (!token) throw new Error("AbleTime personal access token is required");
+  const token = assertAbleTimeCredential(input.token);
   const host = input.host?.trim() || void 0;
   const orientation = await getAbleTimeOrientation({ token, host });
   saveAbleTimeConnection({
@@ -18114,6 +18826,7 @@ var init_abletime = __esm({
     "use strict";
     init_app_settings();
     init_abletime_mcp();
+    init_abletime_rest();
     CLOSED_STATES = /* @__PURE__ */ new Set([
       "done",
       "completed",
@@ -18697,12 +19410,19 @@ function buildQuotaHandoffAttachment(from, limitText, fallbackAgent) {
     ...instructions
   ].join("\n");
   return {
-    id: (0, import_node_crypto10.randomUUID)(),
+    id: (0, import_node_crypto11.randomUUID)(),
     name: orch ? "Orchestration quota handoff.md" : "Quota handoff.md",
     kind: "transcript",
     content: body
   };
 }
+async function isolateQuotaFailover(run2) {
+  try {
+    return await run2();
+  } catch {
+    return true;
+  }
+}
 function createQuotaFailoverChat(from, fallbackAgent, limitText) {
   const handoff = buildQuotaHandoffAttachment(from, limitText, fallbackAgent);
   const tab = createChatTab({
@@ -18721,11 +19441,11 @@ function createQuotaFailoverChat(from, fallbackAgent, limitText) {
   }
   return updateThread(tab.id, patch);
 }
-var import_node_crypto10, QUOTA_CONTINUE_PROMPT, QUOTA_RESUME_PROMPT;
+var import_node_crypto11, QUOTA_CONTINUE_PROMPT, QUOTA_RESUME_PROMPT;
 var init_quota_failover = __esm({
   "src/orchestrator/quota-failover.ts"() {
     "use strict";
-    import_node_crypto10 = require("crypto");
+    import_node_crypto11 = require("crypto");
     init_session_quota();
     init_app_settings();
     init_global_workspace();
@@ -20978,16 +21698,16 @@ function normalizeServiceOrigin(raw, fallback) {
     return fallback;
   }
 }
-function asRecord7(value) {
+function asRecord8(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
-function asString2(value) {
+function asString3(value) {
   return typeof value === "string" ? value.trim() : "";
 }
 function firstString2(record, keys) {
   if (!record) return "";
   for (const key of keys) {
-    const value = asString2(record[key]);
+    const value = asString3(record[key]);
     if (value) return value;
   }
   return "";
@@ -21011,7 +21731,7 @@ async function authorizedGet(url, token) {
   });
   const body = await readJson(res);
   if (!res.ok) {
-    const record = asRecord7(body);
+    const record = asRecord8(body);
     const message = firstString2(record, ["message", "error", "error_description", "detail"]) || (typeof body === "string" ? body.trim().slice(0, 160) : "");
     throw new Error(
       message ? `${res.status}: ${message}` : `Request failed (${res.status})`
@@ -21025,28 +21745,28 @@ async function verifyOptionalService(input) {
   const spec = optionalServiceSpec(input.id);
   try {
     if (input.id === "vercel") {
-      const body2 = asRecord7(await authorizedGet("https://api.vercel.com/v2/user", token));
-      const user = asRecord7(body2?.user) ?? body2;
+      const body2 = asRecord8(await authorizedGet("https://api.vercel.com/v2/user", token));
+      const user = asRecord8(body2?.user) ?? body2;
       const name2 = firstString2(user, ["username", "name", "email"]) || "Vercel user";
       return { viewerName: name2 };
     }
     if (input.id === "supabase") {
       const body2 = await authorizedGet("https://api.supabase.com/v1/organizations", token);
       const list2 = Array.isArray(body2) ? body2 : [];
-      const first2 = asRecord7(list2[0]);
+      const first2 = asRecord8(list2[0]);
       const name2 = firstString2(first2, ["name", "slug"]) || "Supabase";
       return { viewerName: list2.length > 1 ? `${name2} +${list2.length - 1}` : name2 };
     }
     if (input.id === "posthog") {
       const host2 = normalizeServiceOrigin(input.host, spec.defaultHost ?? "https://us.posthog.com");
-      const body2 = asRecord7(await authorizedGet(`${host2}/api/users/@me/`, token));
+      const body2 = asRecord8(await authorizedGet(`${host2}/api/users/@me/`, token));
       const name2 = firstString2(body2, ["email", "distinct_id"]) || [firstString2(body2, ["first_name"]), firstString2(body2, ["last_name"])].filter(Boolean).join(" ") || "PostHog user";
       return { viewerName: name2, host: host2 };
     }
     const host = normalizeServiceOrigin(input.host, spec.defaultHost ?? "https://sentry.io");
     const body = await authorizedGet(`${host}/api/0/organizations/`, token);
     const list = Array.isArray(body) ? body : [];
-    const first = asRecord7(list[0]);
+    const first = asRecord8(list[0]);
     const name = firstString2(first, ["slug", "name"]) || "Sentry";
     return { viewerName: list.length > 1 ? `${name} +${list.length - 1}` : name, host };
   } catch (err) {
@@ -21233,7 +21953,7 @@ var init_optional_services = __esm({
 });
 
 // src/plan/plan-present.ts
-function asRecord8(v) {
+function asRecord9(v) {
   return v != null && typeof v === "object" && !Array.isArray(v) ? v : null;
 }
 function isPresentPlanToolName(name) {
@@ -21245,7 +21965,7 @@ function extractPresentedPlan(parts) {
   for (let i = parts.length - 1; i >= 0; i--) {
     const p = parts[i];
     if (p.type !== "tool" || !isPresentPlanToolName(p.name)) continue;
-    const input = asRecord8(p.input) ?? {};
+    const input = asRecord9(p.input) ?? {};
     const content = typeof input.content === "string" ? input.content : typeof input.plan === "string" ? input.plan : typeof input.markdown === "string" ? input.markdown : "";
     if (!content.trim()) continue;
     const title = typeof input.title === "string" && input.title.trim() ? input.title.trim() : "Plan";
@@ -21928,51 +22648,62 @@ var init_orchestrator = __esm({
         if (plan.action === "wait_reset" && plan.resumeAt) {
           this.haltDrain.add(threadId);
           this.scheduleQuotaResume(threadId, plan.resumeAt);
-          setStatus(threadId, "idle", null);
-          appendMessage(threadId, {
-            role: "agent",
-            text: `Sideboard will auto-retry this chat around ${plan.resumeAt.toLocaleString()} when the session limit resets.`,
-            ts: (/* @__PURE__ */ new Date()).toISOString()
-          });
-          this.emit({
-            type: "quota_failover",
-            threadId,
-            action: "wait_reset",
-            message: plan.reason,
-            resumeAt: plan.resumeAt.toISOString()
-          });
-          this.emit({ type: "status_changed", threadId, status: "idle" });
+          try {
+            setStatus(threadId, "idle", null);
+            appendMessage(threadId, {
+              role: "agent",
+              text: `Sideboard will auto-retry this chat around ${plan.resumeAt.toLocaleString()} when the session limit resets.`,
+              ts: (/* @__PURE__ */ new Date()).toISOString()
+            });
+            this.emit({
+              type: "quota_failover",
+              threadId,
+              action: "wait_reset",
+              message: plan.reason,
+              resumeAt: plan.resumeAt.toISOString()
+            });
+            this.emit({ type: "status_changed", threadId, status: "idle" });
+          } catch {
+          }
           return true;
         }
         if (plan.action === "switch_agent" && plan.fallbackAgent) {
           this.haltDrain.add(threadId);
-          const next = createQuotaFailoverChat(
-            thread,
-            plan.fallbackAgent,
-            plan.limitText
-          );
+          let next;
+          try {
+            next = createQuotaFailoverChat(
+              thread,
+              plan.fallbackAgent,
+              plan.limitText
+            );
+          } catch {
+            return false;
+          }
           this.clearQuotaResumeTimer(threadId);
           try {
             updateThread(threadId, { quotaResumeAt: null });
           } catch {
           }
-          appendMessage(threadId, {
-            role: "agent",
-            text: `Session limit on ${thread.agent}. Sideboard continued on ${plan.fallbackAgent} (Auto) in [${next.title}](sideboard://thread/${next.id}).`,
-            ts: (/* @__PURE__ */ new Date()).toISOString()
-          });
-          this.emit({
-            type: "quota_failover",
-            threadId,
-            action: "switch_agent",
-            toThreadId: next.id,
-            message: plan.reason
-          });
-          this.emit({
-            type: "status_changed",
-            threadId: next.id,
-            status: next.status
-          });
+          try {
+            appendMessage(threadId, {
+              role: "agent",
+              text: `Session limit on ${thread.agent}. Sideboard continued on ${plan.fallbackAgent} (Auto) in [${next.title}](sideboard://thread/${next.id}).`,
+              ts: (/* @__PURE__ */ new Date()).toISOString()
+            });
+            this.emit({
+              type: "quota_failover",
+              threadId,
+              action: "switch_agent",
+              toThreadId: next.id,
+              message: plan.reason
+            });
+            this.emit({
+              type: "status_changed",
+              threadId: next.id,
+              status: next.status
+            });
+          } catch {
+          }
           void this.send(
             next.id,
             QUOTA_CONTINUE_PROMPT(thread.agent, plan.fallbackAgent)
@@ -22703,9 +23434,8 @@ var init_orchestrator = __esm({
               this.maybeEnqueueJobContinue(threadId, chatText, parts);
             } else {
               const blob = [chatText, detail].filter(Boolean).join("\n");
-              const failedOver = await this.maybeHandleOrchestrationQuotaFailover(
-                threadId,
-                blob
+              const failedOver = await isolateQuotaFailover(
+                () => this.maybeHandleOrchestrationQuotaFailover(threadId, blob)
               );
               this.maybeEnqueueCrashContinue(threadId, {
                 detail: detail || failDetail,
@@ -22739,9 +23469,8 @@ var init_orchestrator = __esm({
               this.emit({ type: "status_changed", threadId, status: "error" });
             }
             this.emit({ type: "turn_finished", threadId, exitCode: 1 });
-            const failedOver = await this.maybeHandleOrchestrationQuotaFailover(
-              threadId,
-              message
+            const failedOver = await isolateQuotaFailover(
+              () => this.maybeHandleOrchestrationQuotaFailover(threadId, message)
             );
             this.maybeEnqueueCrashContinue(threadId, {
               detail: message,
@@ -23953,10 +24682,18 @@ var index_exports = {};
 __export(index_exports, {
   ABLETIME_MCP_PATH: () => ABLETIME_MCP_PATH,
   ABLETIME_MCP_PM_PATH: () => ABLETIME_MCP_PM_PATH,
+  ABLETIME_OAUTH_CANCELLED: () => ABLETIME_OAUTH_CANCELLED,
+  ABLETIME_OAUTH_PORT: () => ABLETIME_OAUTH_PORT,
+  ABLETIME_OAUTH_REDIRECT: () => ABLETIME_OAUTH_REDIRECT,
+  ABLETIME_OAUTH_RESOURCE: () => ABLETIME_OAUTH_RESOURCE,
+  ABLETIME_ORG_KEY_PREFIX: () => ABLETIME_ORG_KEY_PREFIX,
+  ABLETIME_PAT_PREFIX: () => ABLETIME_PAT_PREFIX,
   ABLETIME_PM_TOOL_NAMES: () => ABLETIME_PM_TOOL_NAMES,
   AGENT_GIT_ACTIONS: () => AGENT_GIT_ACTIONS,
   AGENT_RUNNER_MAX_OLD_SPACE_MB: () => AGENT_RUNNER_MAX_OLD_SPACE_MB,
   ATTACHMENTS_DIR: () => ATTACHMENTS_DIR,
+  AbleTimeOAuthCancelledError: () => AbleTimeOAuthCancelledError,
+  BAKED_ABLETIME_OAUTH_CLIENT_ID: () => BAKED_ABLETIME_OAUTH_CLIENT_ID,
   BAKED_SLACK_RELAY_URL: () => BAKED_SLACK_RELAY_URL,
   BRIGHTSY_MCP_ALLOWED_TOOLS: () => BRIGHTSY_MCP_ALLOWED_TOOLS,
   BRIGHTSY_SUMMARIZE_CONTEXT_TOOL: () => BRIGHTSY_SUMMARIZE_CONTEXT_TOOL,
@@ -24045,7 +24782,11 @@ __export(index_exports, {
   WORKTREE_GITHUB_MCP_TOOLS: () => WORKTREE_GITHUB_MCP_TOOLS,
   WORKTREE_LINEAR_MCP_TOOLS: () => WORKTREE_LINEAR_MCP_TOOLS,
   WORKTREE_MCP_TOOLS: () => WORKTREE_MCP_TOOLS,
+  ableTimeCredentialKind: () => ableTimeCredentialKind,
   ableTimeDependencyTarget: () => ableTimeDependencyTarget,
+  ableTimeOAuthAuthorizeUrl: () => ableTimeOAuthAuthorizeUrl,
+  ableTimeOAuthClientId: () => ableTimeOAuthClientId,
+  ableTimeOAuthResource: () => ableTimeOAuthResource,
   abletimeMcpRequest: () => abletimeMcpRequest,
   abletimeMcpUrl: () => abletimeMcpUrl,
   abletimeToolUsesPm: () => abletimeToolUsesPm,
@@ -24076,6 +24817,8 @@ __export(index_exports, {
   applyThreadIntoMain: () => applyThreadIntoMain,
   applyTurnUsage: () => applyTurnUsage,
   armSchedules: () => armSchedules,
+  assertAbleTimeCredential: () => assertAbleTimeCredential,
+  assertAbleTimeMcpCredential: () => assertAbleTimeMcpCredential,
   assertOrchestratorCapableAgent: () => assertOrchestratorCapableAgent,
   attachmentFromAbsolutePath: () => attachmentFromAbsolutePath,
   attachmentsFromBuffers: () => attachmentsFromBuffers,
@@ -24155,6 +24898,7 @@ __export(index_exports, {
   countCacheControlBlocks: () => countCacheControlBlocks,
   countUnpushedVsOrigin: () => countUnpushedVsOrigin,
   cowboyModeEnabled: () => cowboyModeEnabled,
+  createAbleTimePkce: () => createAbleTimePkce,
   createAbleTimeTask: () => createAbleTimeTask,
   createChatTab: () => createChatTab,
   createEmptyThread: () => createEmptyThread,
@@ -24194,6 +24938,7 @@ __export(index_exports, {
   encodeBrightsyTarget: () => encodeBrightsyTarget,
   enrichPathWithNpmGlobalBin: () => enrichPathWithNpmGlobalBin,
   enrichWorkspacesWithGithub: () => enrichWorkspacesWithGithub,
+  ensureAbleTimeAccessToken: () => ensureAbleTimeAccessToken,
   ensureAbleTimeTask: () => ensureAbleTimeTask,
   ensureAgentPath: () => ensureAgentPath,
   ensureBrightsyLocalConfigFresh: () => ensureBrightsyLocalConfigFresh,
@@ -24340,6 +25085,7 @@ __export(index_exports, {
   groupHomeBoardWorktrees: () => groupHomeBoardWorktrees,
   handleSlackInbound: () => handleSlackInbound,
   harnessEnvKey: () => harnessEnvKey,
+  hasBakedAbleTimeOAuth: () => hasBakedAbleTimeOAuth,
   hasBakedLinearOAuth: () => hasBakedLinearOAuth,
   hasBakedSlackOAuth: () => hasBakedSlackOAuth,
   hasConductorHook: () => hasConductorHook,
@@ -24364,6 +25110,7 @@ __export(index_exports, {
   invalidateThreadListCache: () => invalidateThreadListCache,
   invalidateThreadRecord: () => invalidateThreadRecord,
   isAbleTimeConnected: () => isAbleTimeConnected,
+  isAbleTimeOAuthCancelled: () => isAbleTimeOAuthCancelled,
   isAskUserToolName: () => isAskUserToolName,
   isBrightsyConnected: () => isBrightsyConnected,
   isBrightsyNdjsonLine: () => isBrightsyNdjsonLine,
@@ -24493,6 +25240,7 @@ __export(index_exports, {
   nextPastedTextName: () => nextPastedTextName,
   nextThinkingEffort: () => nextThinkingEffort,
   nonInteractiveGitProcessEnv: () => nonInteractiveGitProcessEnv,
+  normalizeAbleTimeCredential: () => normalizeAbleTimeCredential,
   normalizeAbleTimeHost: () => normalizeAbleTimeHost,
   normalizeCodeSelection: () => normalizeCodeSelection,
   normalizeLinearRelationType: () => normalizeLinearRelationType,
@@ -24674,6 +25422,7 @@ __export(index_exports, {
   stackMergeReadiness: () => stackMergeReadiness,
   stageAbsolutePathsAsAttachments: () => stageAbsolutePathsAsAttachments,
   stageBuffersAsAttachments: () => stageBuffersAsAttachments,
+  startAbleTimeOAuth: () => startAbleTimeOAuth,
   startDevServer: () => startDevServer,
   startLinearOAuth: () => startLinearOAuth,
   startMcpServer: () => startMcpServer,
@@ -24976,8 +25725,8 @@ function issueActivityKind(issue, sinceIso) {
 }
 
 // src/integrations/linear-oauth.ts
-var import_node_crypto11 = require("crypto");
-var import_node_http = require("http");
+var import_node_crypto12 = require("crypto");
+var import_node_http2 = require("http");
 init_app_settings();
 init_fetch();
 
@@ -24995,7 +25744,7 @@ var LINEAR_TOKEN = "https://api.linear.app/oauth/token";
 var LINEAR_REVOKE = "https://api.linear.app/oauth/revoke";
 var LINEAR_GRAPHQL = "https://api.linear.app/graphql";
 var LINEAR_OAUTH_SCOPES = "read,write";
-var REFRESH_SKEW_MS2 = 5 * 6e4;
+var REFRESH_SKEW_MS3 = 5 * 6e4;
 function linearOAuthCredentials() {
   const settings = loadAppSettings();
   const clientId = process.env.SIDEBOARD_LINEAR_CLIENT_ID?.trim() || settings.integrations.linearClientId?.trim() || BAKED_LINEAR_CLIENT_ID.trim();
@@ -25008,8 +25757,8 @@ function linearOAuthCredentials() {
   return { clientId, clientSecret };
 }
 function createLinearPkce() {
-  const verifier = (0, import_node_crypto11.randomBytes)(32).toString("base64url");
-  const challenge = (0, import_node_crypto11.createHash)("sha256").update(verifier).digest("base64url");
+  const verifier = (0, import_node_crypto12.randomBytes)(32).toString("base64url");
+  const challenge = (0, import_node_crypto12.createHash)("sha256").update(verifier).digest("base64url");
   return { verifier, challenge };
 }
 function linearOAuthAuthorizeUrl(clientId, state, codeChallenge) {
@@ -25033,7 +25782,7 @@ function linearAuthorizationHeader(token) {
   if (t.startsWith("lin_api_")) return t;
   return `Bearer ${t}`;
 }
-function htmlPage(title, body) {
+function htmlPage2(title, body) {
   return `<!doctype html><html><head><meta charset="utf-8"><title>${title}</title>
 <style>body{font-family:ui-sans-serif,system-ui,sans-serif;padding:48px 24px;max-width:36rem;margin:0 auto;color:#1a1a1a}
 h1{font-size:1.25rem}p{line-height:1.5;color:#444}</style></head><body>${body}</body></html>`;
@@ -25079,7 +25828,7 @@ async function fetchLinearViewer(accessToken) {
     organizationName: viewer?.organization?.name?.trim() || void 0
   };
 }
-var refreshInFlight = null;
+var refreshInFlight2 = null;
 async function refreshLinearAccessToken(refreshToken) {
   const { clientId, clientSecret } = linearOAuthCredentials();
   const body = new URLSearchParams({
@@ -25106,16 +25855,16 @@ async function getLinearAuthToken(settings = loadAppSettings()) {
   const refresh = settings.integrations.linearRefreshToken?.trim() || "";
   const expiresAt = settings.integrations.linearTokenExpiresAt ?? 0;
   const apiKey = settings.integrations.linearApiKey?.trim() || "";
-  if (access && (!refresh || Date.now() < expiresAt - REFRESH_SKEW_MS2)) {
+  if (access && (!refresh || Date.now() < expiresAt - REFRESH_SKEW_MS3)) {
     return access;
   }
   if (refresh) {
-    if (!refreshInFlight) {
-      refreshInFlight = refreshLinearAccessToken(refresh).finally(() => {
-        refreshInFlight = null;
+    if (!refreshInFlight2) {
+      refreshInFlight2 = refreshLinearAccessToken(refresh).finally(() => {
+        refreshInFlight2 = null;
       });
     }
-    return refreshInFlight.catch((err) => {
+    return refreshInFlight2.catch((err) => {
       if (apiKey) return apiKey;
       throw err;
     });
@@ -25140,7 +25889,7 @@ async function startLinearOAuth(opts) {
     throw new LinearOAuthCancelledError();
   }
   const { clientId, clientSecret } = linearOAuthCredentials();
-  const state = (0, import_node_crypto11.randomBytes)(16).toString("hex");
+  const state = (0, import_node_crypto12.randomBytes)(16).toString("hex");
   const pkce = createLinearPkce();
   const authorizeUrl = linearOAuthAuthorizeUrl(clientId, state, pkce.challenge);
   const timeoutMs = opts?.timeoutMs ?? 5 * 6e4;
@@ -25153,7 +25902,7 @@ async function startLinearOAuth(opts) {
       if (err) reject(err);
       else resolve(value);
     };
-    const server = (0, import_node_http.createServer)((req, res) => {
+    const server = (0, import_node_http2.createServer)((req, res) => {
       try {
         const url = new URL(req.url || "/", `http://127.0.0.1:${LINEAR_OAUTH_PORT}`);
         if (url.pathname !== "/callback") {
@@ -25166,19 +25915,19 @@ async function startLinearOAuth(opts) {
         const gotCode = url.searchParams.get("code");
         if (err) {
           res.writeHead(400, { "Content-Type": "text/html" });
-          res.end(htmlPage("Linear", `<h1>Authorization cancelled</h1><p>${err}</p>`));
+          res.end(htmlPage2("Linear", `<h1>Authorization cancelled</h1><p>${err}</p>`));
           finish(new LinearOAuthCancelledError(`Linear OAuth: ${err}`));
           return;
         }
         if (gotState !== state || !gotCode) {
           res.writeHead(400, { "Content-Type": "text/html" });
-          res.end(htmlPage("Linear", "<h1>Invalid callback</h1><p>State or code missing.</p>"));
+          res.end(htmlPage2("Linear", "<h1>Invalid callback</h1><p>State or code missing.</p>"));
           finish(new Error("Linear OAuth callback was invalid"));
           return;
         }
         res.writeHead(200, { "Content-Type": "text/html" });
         res.end(
-          htmlPage(
+          htmlPage2(
             "Linear connected",
             "<h1>Linear connected</h1><p>You can close this tab and return to Sideboard.</p>"
           )
@@ -26591,6 +27340,7 @@ async function createGitHubIssue(input, opts) {
 // src/index.ts
 init_abletime();
 init_abletime_mcp();
+init_abletime_oauth();
 
 // src/integrations/issues.ts
 init_worktree();
@@ -26993,7 +27743,7 @@ function buildPathRefAttachment(input) {
 init_stage_files();
 
 // src/composer/pasted-text.ts
-var import_node_crypto12 = require("crypto");
+var import_node_crypto13 = require("crypto");
 var PASTE_ATTACH_MIN_CHARS = 1200;
 var PASTE_ATTACH_MIN_LINES = 15;
 var PASTED_NAME_RE = /^Pasted text #(\d+)\.txt$/i;
@@ -27020,7 +27770,7 @@ function nextPastedTextName(existing) {
 }
 function buildPastedTextAttachment(text7, opts) {
   return {
-    id: opts?.id ?? (0, import_node_crypto12.randomUUID)(),
+    id: opts?.id ?? (0, import_node_crypto13.randomUUID)(),
     name: opts?.name ?? "Pasted text #1.txt",
     kind: "file",
     path: opts?.path,
@@ -27051,7 +27801,7 @@ function planQuestionsSignature(questions) {
     return `${q.question}${opts}`;
   }).join("");
 }
-function asRecord9(v) {
+function asRecord10(v) {
   return v != null && typeof v === "object" && !Array.isArray(v) ? v : null;
 }
 function parseOptions(raw) {
@@ -27062,7 +27812,7 @@ function parseOptions(raw) {
       out.push({ label: item.trim() });
       continue;
     }
-    const o = asRecord9(item);
+    const o = asRecord10(item);
     if (!o) continue;
     const label = typeof o.label === "string" ? o.label.trim() : typeof o.text === "string" ? o.text.trim() : typeof o.title === "string" ? o.title.trim() : "";
     if (!label) continue;
@@ -27072,7 +27822,7 @@ function parseOptions(raw) {
   return out;
 }
 function parseOneQuestion(raw) {
-  const o = asRecord9(raw);
+  const o = asRecord10(raw);
   if (!o) return null;
   const question = typeof o.question === "string" ? o.question.trim() : typeof o.text === "string" ? o.text.trim() : typeof o.prompt === "string" ? o.prompt.trim() : "";
   if (!question) return null;
@@ -27083,7 +27833,7 @@ function parseOneQuestion(raw) {
   return { question, header, multiSelect, options };
 }
 function parsePlanQuestionsInput(input) {
-  const root = asRecord9(input);
+  const root = asRecord10(input);
   if (!root) return [];
   const list = Array.isArray(root.questions) ? root.questions : Array.isArray(root.question) ? root.question : root.question || root.prompt ? [root] : [];
   const out = [];
@@ -27174,7 +27924,7 @@ init_orphan_cleanup();
 var import_mcp = require("@modelcontextprotocol/sdk/server/mcp.js");
 var import_stdio = require("@modelcontextprotocol/sdk/server/stdio.js");
 var import_zod9 = require("zod");
-var import_node_crypto14 = require("crypto");
+var import_node_crypto15 = require("crypto");
 var import_node_path53 = require("path");
 init_orchestrator();
 init_worktree();
@@ -28901,7 +29651,7 @@ init_worktree();
 init_paths();
 
 // src/board/board-pins.ts
-var import_node_crypto13 = require("crypto");
+var import_node_crypto14 = require("crypto");
 var import_node_fs55 = require("fs");
 var import_node_path51 = require("path");
 init_paths();
@@ -28933,7 +29683,7 @@ function addBoardPin(input) {
   const ref = input.ref.trim();
   if (!ref) throw new Error("Board item needs a ref");
   const pin = {
-    id: (0, import_node_crypto13.randomUUID)(),
+    id: (0, import_node_crypto14.randomUUID)(),
     kind: input.kind,
     ref,
     repoPath: input.repoPath.trim(),
@@ -29767,7 +30517,7 @@ async function startMcpServer() {
           const ident = issue?.identifier ?? ref.trim();
           const attachments = issue ? [
             {
-              id: (0, import_node_crypto14.randomUUID)(),
+              id: (0, import_node_crypto15.randomUUID)(),
               name: issue.identifier,
               kind: "issue",
               content: [
@@ -30722,7 +31472,7 @@ init_orch_mcp_isolation();
 init_workspaces2();
 
 // src/slack/oauth.ts
-var import_node_crypto15 = require("crypto");
+var import_node_crypto16 = require("crypto");
 init_app_settings();
 init_workspaces2();
 
@@ -30946,7 +31696,7 @@ async function startSlackOAuth(opts) {
     throw new SlackOAuthCancelledError();
   }
   const { clientId } = slackOAuthCredentials();
-  const state = (0, import_node_crypto15.randomBytes)(16).toString("hex");
+  const state = (0, import_node_crypto16.randomBytes)(16).toString("hex");
   const authorizeUrl = slackOAuthAuthorizeUrl(clientId, state);
   const timeoutMs = opts?.timeoutMs ?? 5 * 6e4;
   const pollIntervalMs = opts?.pollIntervalMs ?? 400;
@@ -31228,7 +31978,7 @@ init_workspaces2();
 init_reply_target();
 
 // src/slack/relay-protocol.ts
-var import_node_crypto16 = require("crypto");
+var import_node_crypto17 = require("crypto");
 var SLACK_RELAY_PING_INTERVAL_MS = 2e4;
 var SLACK_RELAY_PONG_TIMEOUT_MS = 15e3;
 function slackRelaySessionKey(teamId, userId, deviceId) {
@@ -31238,7 +31988,7 @@ function slackRelayUserKey(teamId, userId) {
   return `${teamId.trim()}:${userId.trim()}`;
 }
 function newSlackRelayEventId() {
-  return (0, import_node_crypto16.randomBytes)(12).toString("hex");
+  return (0, import_node_crypto17.randomBytes)(12).toString("hex");
 }
 function parseSlackRelayClientMessage(raw) {
   try {
@@ -31311,7 +32061,7 @@ function parseSlackRelayServerMessage(raw) {
 
 // src/slack/public-dns.ts
 var import_node_dns = require("dns");
-var import_node_http2 = require("http");
+var import_node_http3 = require("http");
 var import_node_https = require("https");
 var PUBLIC_DNS = ["1.1.1.1", "8.8.8.8"];
 function finishLookup(options, callback, address, family) {
@@ -32355,7 +33105,7 @@ var SlackRelayHub = class {
 };
 
 // src/slack/relay-server.ts
-var import_node_http3 = require("http");
+var import_node_http4 = require("http");
 var import_ws3 = require("ws");
 
 // src/slack/relay-static.ts
@@ -32527,7 +33277,7 @@ async function startSlackRelayServer(opts) {
     sendJson(res, 200, { ok: true, ...value.payload });
     return true;
   };
-  const httpServer = (0, import_node_http3.createServer)((req, res) => {
+  const httpServer = (0, import_node_http4.createServer)((req, res) => {
     void (async () => {
       const reqUrl = req.url || "/";
       if (await handleCallback(reqUrl, res)) return;
@@ -32664,10 +33414,18 @@ init_outbound_watch();
 0 && (module.exports = {
   ABLETIME_MCP_PATH,
   ABLETIME_MCP_PM_PATH,
+  ABLETIME_OAUTH_CANCELLED,
+  ABLETIME_OAUTH_PORT,
+  ABLETIME_OAUTH_REDIRECT,
+  ABLETIME_OAUTH_RESOURCE,
+  ABLETIME_ORG_KEY_PREFIX,
+  ABLETIME_PAT_PREFIX,
   ABLETIME_PM_TOOL_NAMES,
   AGENT_GIT_ACTIONS,
   AGENT_RUNNER_MAX_OLD_SPACE_MB,
   ATTACHMENTS_DIR,
+  AbleTimeOAuthCancelledError,
+  BAKED_ABLETIME_OAUTH_CLIENT_ID,
   BAKED_SLACK_RELAY_URL,
   BRIGHTSY_MCP_ALLOWED_TOOLS,
   BRIGHTSY_SUMMARIZE_CONTEXT_TOOL,
@@ -32756,7 +33514,11 @@ init_outbound_watch();
   WORKTREE_GITHUB_MCP_TOOLS,
   WORKTREE_LINEAR_MCP_TOOLS,
   WORKTREE_MCP_TOOLS,
+  ableTimeCredentialKind,
   ableTimeDependencyTarget,
+  ableTimeOAuthAuthorizeUrl,
+  ableTimeOAuthClientId,
+  ableTimeOAuthResource,
   abletimeMcpRequest,
   abletimeMcpUrl,
   abletimeToolUsesPm,
@@ -32787,6 +33549,8 @@ init_outbound_watch();
   applyThreadIntoMain,
   applyTurnUsage,
   armSchedules,
+  assertAbleTimeCredential,
+  assertAbleTimeMcpCredential,
   assertOrchestratorCapableAgent,
   attachmentFromAbsolutePath,
   attachmentsFromBuffers,
@@ -32866,6 +33630,7 @@ init_outbound_watch();
   countCacheControlBlocks,
   countUnpushedVsOrigin,
   cowboyModeEnabled,
+  createAbleTimePkce,
   createAbleTimeTask,
   createChatTab,
   createEmptyThread,
@@ -32905,6 +33670,7 @@ init_outbound_watch();
   encodeBrightsyTarget,
   enrichPathWithNpmGlobalBin,
   enrichWorkspacesWithGithub,
+  ensureAbleTimeAccessToken,
   ensureAbleTimeTask,
   ensureAgentPath,
   ensureBrightsyLocalConfigFresh,
@@ -33051,6 +33817,7 @@ init_outbound_watch();
   groupHomeBoardWorktrees,
   handleSlackInbound,
   harnessEnvKey,
+  hasBakedAbleTimeOAuth,
   hasBakedLinearOAuth,
   hasBakedSlackOAuth,
   hasConductorHook,
@@ -33075,6 +33842,7 @@ init_outbound_watch();
   invalidateThreadListCache,
   invalidateThreadRecord,
   isAbleTimeConnected,
+  isAbleTimeOAuthCancelled,
   isAskUserToolName,
   isBrightsyConnected,
   isBrightsyNdjsonLine,
@@ -33204,6 +33972,7 @@ init_outbound_watch();
   nextPastedTextName,
   nextThinkingEffort,
   nonInteractiveGitProcessEnv,
+  normalizeAbleTimeCredential,
   normalizeAbleTimeHost,
   normalizeCodeSelection,
   normalizeLinearRelationType,
@@ -33385,6 +34154,7 @@ init_outbound_watch();
   stackMergeReadiness,
   stageAbsolutePathsAsAttachments,
   stageBuffersAsAttachments,
+  startAbleTimeOAuth,
   startDevServer,
   startLinearOAuth,
   startMcpServer,