@sideboard-ai/core 0.1.67 → 0.1.71

package/dist/{chunk-MHR4OGZ4.js → chunk-W7YOTDVO.js}

@@ -1,3 +1,7 @@
+import {
+  chmodOwnerOnly,
+  writePrivateFile
+} from "./chunk-JT7R45JB.js";
 import {
   normalizeThinkingEffort
 } from "./chunk-77WWLBCI.js";
@@ -6,9 +10,196 @@ import {
 } from "./chunk-M37RITA6.js";
 
 // src/store/app-settings.ts
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
-import { homedir } from "os";
+import { randomUUID } from "crypto";
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+import { homedir, hostname } from "os";
+import { join as join2 } from "path";
+
+// src/store/secret-vault.ts
 import { join } from "path";
+
+// src/store/secure-file.ts
+import { execFileSync } from "child_process";
+import { createCipheriv, createDecipheriv, randomBytes } from "crypto";
+import { existsSync, readFileSync } from "fs";
+var KEYCHAIN_SERVICE = "ai.sideboard.app";
+var KEYCHAIN_ACCOUNT = "secret-vault-v1";
+var ALG = "aes-256-gcm";
+var injectedKey = null;
+function setVaultMasterKey(key) {
+  injectedKey = key && key.length === 32 ? Buffer.from(key) : null;
+}
+function persistVaultKeyInKeychain(key) {
+  if (process.platform !== "darwin" || key.length !== 32) return;
+  try {
+    execFileSync(
+      "security",
+      [
+        "add-generic-password",
+        "-s",
+        KEYCHAIN_SERVICE,
+        "-a",
+        KEYCHAIN_ACCOUNT,
+        "-w",
+        key.toString("hex"),
+        "-U"
+      ],
+      { encoding: "utf8", timeout: 8e3, stdio: ["ignore", "pipe", "pipe"] }
+    );
+  } catch {
+  }
+}
+function readKeychainVaultKey() {
+  return keychainKey(false);
+}
+function hexKey(value) {
+  const trimmed = value?.trim() ?? "";
+  if (!/^[0-9a-f]{64}$/i.test(trimmed)) return null;
+  return Buffer.from(trimmed, "hex");
+}
+function keychainKey(create) {
+  if (process.platform !== "darwin") return null;
+  try {
+    const out = execFileSync(
+      "security",
+      ["find-generic-password", "-s", KEYCHAIN_SERVICE, "-a", KEYCHAIN_ACCOUNT, "-w"],
+      { encoding: "utf8", timeout: 5e3, stdio: ["ignore", "pipe", "pipe"] }
+    ).trim();
+    const key2 = hexKey(out);
+    if (key2) return key2;
+  } catch {
+  }
+  if (!create) return null;
+  const key = randomBytes(32);
+  persistVaultKeyInKeychain(key);
+  return key;
+}
+function resolveVaultKey() {
+  if (process.env.SIDEBOARD_SECRET_VAULT === "plain") return null;
+  if (injectedKey) return injectedKey;
+  const fromEnv = hexKey(process.env.SIDEBOARD_VAULT_KEY);
+  if (fromEnv) return fromEnv;
+  if (process.env.VITEST) return null;
+  return keychainKey(true);
+}
+function isEnvelope(value) {
+  if (!value || typeof value !== "object") return false;
+  const o = value;
+  return o.v === 1 && o.alg === ALG && typeof o.iv === "string" && typeof o.tag === "string" && typeof o.data === "string";
+}
+function encryptJson(value, key) {
+  const iv = randomBytes(12);
+  const cipher = createCipheriv(ALG, key, iv);
+  const plaintext = Buffer.from(`${JSON.stringify(value)}
+`, "utf8");
+  const data = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  return {
+    v: 1,
+    alg: ALG,
+    iv: iv.toString("base64"),
+    tag: tag.toString("base64"),
+    data: data.toString("base64")
+  };
+}
+function decryptEnvelope(envelope, key) {
+  const decipher = createDecipheriv(ALG, key, Buffer.from(envelope.iv, "base64"));
+  decipher.setAuthTag(Buffer.from(envelope.tag, "base64"));
+  const plaintext = Buffer.concat([
+    decipher.update(Buffer.from(envelope.data, "base64")),
+    decipher.final()
+  ]);
+  return JSON.parse(plaintext.toString("utf8"));
+}
+function readSecureJson(path) {
+  if (!existsSync(path)) return null;
+  chmodOwnerOnly(path);
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    return null;
+  }
+  if (!isEnvelope(parsed)) return parsed;
+  const key = resolveVaultKey();
+  if (!key) {
+    throw new Error(
+      "Encrypted Sideboard secrets need a vault key (desktop Keychain / safeStorage, or SIDEBOARD_VAULT_KEY)."
+    );
+  }
+  return decryptEnvelope(parsed, key);
+}
+function writeSecureJson(path, value) {
+  const key = resolveVaultKey();
+  const body = key ? encryptJson(value, key) : value;
+  writePrivateFile(path, `${JSON.stringify(body, null, 2)}
+`);
+}
+function isSecureFileEncrypted(path) {
+  if (!existsSync(path)) return false;
+  try {
+    return isEnvelope(JSON.parse(readFileSync(path, "utf8")));
+  } catch {
+    return false;
+  }
+}
+function secureFileUnlocksWith(path, key) {
+  if (!existsSync(path) || key.length !== 32) return true;
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf8"));
+    if (!isEnvelope(parsed)) return true;
+    decryptEnvelope(parsed, key);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// src/store/secret-vault.ts
+function secretVaultPath() {
+  return join(appDataDir(), "secrets.json");
+}
+function loadSecretVault() {
+  const parsed = readSecureJson(secretVaultPath());
+  if (!parsed || typeof parsed !== "object") return {};
+  return normalizeVault(parsed);
+}
+function saveSecretVault(vault) {
+  writeSecureJson(secretVaultPath(), normalizeVault(vault));
+}
+function normalizeVault(raw) {
+  const out = {};
+  if (typeof raw.linearApiKey === "string" && raw.linearApiKey.trim()) {
+    out.linearApiKey = raw.linearApiKey.trim();
+  }
+  if (typeof raw.linearAccessToken === "string" && raw.linearAccessToken.trim()) {
+    out.linearAccessToken = raw.linearAccessToken.trim();
+  }
+  if (typeof raw.linearRefreshToken === "string" && raw.linearRefreshToken.trim()) {
+    out.linearRefreshToken = raw.linearRefreshToken.trim();
+  }
+  if (typeof raw.linearClientSecret === "string" && raw.linearClientSecret.trim()) {
+    out.linearClientSecret = raw.linearClientSecret.trim();
+  }
+  if (typeof raw.slackClientSecret === "string" && raw.slackClientSecret.trim()) {
+    out.slackClientSecret = raw.slackClientSecret.trim();
+  }
+  if (typeof raw.slackAppToken === "string" && raw.slackAppToken.trim()) {
+    out.slackAppToken = raw.slackAppToken.trim();
+  }
+  if (raw.environment && typeof raw.environment === "object") {
+    const environment = {};
+    for (const [key, value] of Object.entries(raw.environment)) {
+      const k = key.trim();
+      const v = typeof value === "string" ? value.trim() : "";
+      if (k && v) environment[k] = v;
+    }
+    if (Object.keys(environment).length > 0) out.environment = environment;
+  }
+  return out;
+}
+
+// src/store/app-settings.ts
 var HARNESS_ENV_KEYS = {
   claude: "ANTHROPIC_API_KEY",
   codex: "CODEX_API_KEY",
@@ -23,11 +214,45 @@ var DEFAULT_AGENTS = /* @__PURE__ */ new Set([
   "brightsy",
   "cursor"
 ]);
+function hasLinearOAuth(integrations) {
+  return Boolean(
+    integrations.linearAccessToken?.trim() || integrations.linearRefreshToken?.trim()
+  );
+}
+function hasLinearCredentials(integrations) {
+  return Boolean(integrations.linearApiKey?.trim()) || hasLinearOAuth(integrations);
+}
+function toPublicAppSettings(settings) {
+  const environment = {};
+  for (const key of Object.keys(settings.environment)) {
+    if (key.trim()) environment[key] = "";
+  }
+  const integrations = { ...settings.integrations };
+  const slackClientSecret = integrations.slackClientSecret;
+  const slackAppToken = integrations.slackAppToken;
+  delete integrations.linearApiKey;
+  delete integrations.linearAccessToken;
+  delete integrations.linearRefreshToken;
+  delete integrations.linearClientSecret;
+  delete integrations.slackClientSecret;
+  delete integrations.slackAppToken;
+  return {
+    ...settings,
+    environment,
+    integrations: {
+      ...integrations,
+      hasLinearApiKey: hasLinearCredentials(settings.integrations),
+      hasLinearOAuth: hasLinearOAuth(settings.integrations),
+      hasSlackClientSecret: Boolean(slackClientSecret?.trim()),
+      hasSlackAppToken: Boolean(slackAppToken?.trim())
+    }
+  };
+}
 function appSettingsPath() {
-  return join(appDataDir(), "settings.json");
+  return join2(appDataDir(), "settings.json");
 }
 function claudeUserSettingsPath() {
-  return join(homedir(), ".claude", "settings.json");
+  return join2(homedir(), ".claude", "settings.json");
 }
 function normalizeClaude(raw) {
   if (!raw || typeof raw !== "object") return {};
@@ -86,9 +311,62 @@ function normalizeIntegrations(raw) {
     const key = source.linearApiKey.trim();
     if (key) out.linearApiKey = key;
   }
+  if (typeof source.linearAccessToken === "string") {
+    const token = source.linearAccessToken.trim();
+    if (token) out.linearAccessToken = token;
+  }
+  if (typeof source.linearRefreshToken === "string") {
+    const token = source.linearRefreshToken.trim();
+    if (token) out.linearRefreshToken = token;
+  }
+  if (typeof source.linearTokenExpiresAt === "number" && Number.isFinite(source.linearTokenExpiresAt)) {
+    out.linearTokenExpiresAt = source.linearTokenExpiresAt;
+  } else if (typeof source.linearTokenExpiresAt === "string") {
+    const n = Number(source.linearTokenExpiresAt);
+    if (Number.isFinite(n)) out.linearTokenExpiresAt = n;
+  }
+  if (typeof source.linearClientId === "string") {
+    const id = source.linearClientId.trim();
+    if (id) out.linearClientId = id;
+  }
+  if (typeof source.linearClientSecret === "string") {
+    const secret = source.linearClientSecret.trim();
+    if (secret) out.linearClientSecret = secret;
+  }
+  if (typeof source.linearViewerName === "string") {
+    const name = source.linearViewerName.trim().slice(0, 120);
+    if (name) out.linearViewerName = name;
+  }
+  if (typeof source.linearOrganizationName === "string") {
+    const name = source.linearOrganizationName.trim().slice(0, 120);
+    if (name) out.linearOrganizationName = name;
+  }
   if (typeof source.issueSource === "string" && ISSUE_SOURCES.has(source.issueSource)) {
     out.issueSource = source.issueSource;
   }
+  if (typeof source.slackClientId === "string") {
+    const id = source.slackClientId.trim();
+    if (id) out.slackClientId = id;
+  }
+  if (typeof source.slackClientSecret === "string") {
+    const secret = source.slackClientSecret.trim();
+    if (secret) out.slackClientSecret = secret;
+  }
+  if (typeof source.slackAppToken === "string") {
+    const token = source.slackAppToken.trim();
+    if (token) out.slackAppToken = token;
+  }
+  if (typeof source.slackListenEnabled === "boolean") {
+    out.slackListenEnabled = source.slackListenEnabled;
+  }
+  if (typeof source.slackDeviceId === "string") {
+    const id = source.slackDeviceId.trim();
+    if (id) out.slackDeviceId = id;
+  }
+  if (typeof source.slackDeviceLabel === "string") {
+    const label = source.slackDeviceLabel.trim().slice(0, 64);
+    if (label) out.slackDeviceLabel = label;
+  }
   return out;
 }
 function normalizeDefaults(raw) {
@@ -123,8 +401,10 @@ function normalizeAdvanced(raw) {
   if (typeof source.caffeinateWhileRunning === "boolean") {
     out.caffeinateWhileRunning = source.caffeinateWhileRunning;
   }
-  if (typeof source.caffeinateWhileCloudConnect === "boolean") {
-    out.caffeinateWhileCloudConnect = source.caffeinateWhileCloudConnect;
+  if (typeof source.caffeinateWhileSlackListen === "boolean") {
+    out.caffeinateWhileSlackListen = source.caffeinateWhileSlackListen;
+  } else if (typeof source.caffeinateWhileCloudConnect === "boolean") {
+    out.caffeinateWhileSlackListen = source.caffeinateWhileCloudConnect;
   }
   if (typeof source.deleteBranchOnPurge === "boolean") {
     out.deleteBranchOnPurge = source.deleteBranchOnPurge;
@@ -223,23 +503,84 @@ var EMPTY_SETTINGS = {
   defaults: {},
   advanced: {}
 };
-function loadAppSettings() {
+function readSettingsFile() {
   const path = appSettingsPath();
-  if (!existsSync(path)) {
-    return { ...EMPTY_SETTINGS };
-  }
+  if (!existsSync2(path)) return { ...EMPTY_SETTINGS };
   try {
-    const parsed = JSON.parse(readFileSync(path, "utf8"));
+    chmodOwnerOnly(path);
+    const parsed = JSON.parse(readFileSync2(path, "utf8"));
     return normalizeSettings(parsed);
   } catch {
     return { ...EMPTY_SETTINGS };
   }
 }
+function diskHoldsSecrets(disk) {
+  return Boolean(
+    disk.integrations.linearApiKey || disk.integrations.linearAccessToken || disk.integrations.linearRefreshToken || disk.integrations.linearClientSecret || disk.integrations.slackClientSecret || disk.integrations.slackAppToken || Object.keys(disk.environment).length > 0
+  );
+}
+function mergeVault(disk) {
+  const vault = loadSecretVault();
+  const environment = { ...vault.environment ?? {}, ...disk.environment };
+  const integrations = { ...disk.integrations };
+  if (vault.linearApiKey && !integrations.linearApiKey) {
+    integrations.linearApiKey = vault.linearApiKey;
+  }
+  if (vault.linearAccessToken && !integrations.linearAccessToken) {
+    integrations.linearAccessToken = vault.linearAccessToken;
+  }
+  if (vault.linearRefreshToken && !integrations.linearRefreshToken) {
+    integrations.linearRefreshToken = vault.linearRefreshToken;
+  }
+  if (vault.linearClientSecret && !integrations.linearClientSecret) {
+    integrations.linearClientSecret = vault.linearClientSecret;
+  }
+  if (vault.slackClientSecret && !integrations.slackClientSecret) {
+    integrations.slackClientSecret = vault.slackClientSecret;
+  }
+  if (vault.slackAppToken && !integrations.slackAppToken) {
+    integrations.slackAppToken = vault.slackAppToken;
+  }
+  return { ...disk, environment, integrations };
+}
+function persistSplit(settings) {
+  const integrations = { ...settings.integrations };
+  const linearApiKey = integrations.linearApiKey;
+  const linearAccessToken = integrations.linearAccessToken;
+  const linearRefreshToken = integrations.linearRefreshToken;
+  const linearClientSecret = integrations.linearClientSecret;
+  const slackClientSecret = integrations.slackClientSecret;
+  const slackAppToken = integrations.slackAppToken;
+  delete integrations.linearApiKey;
+  delete integrations.linearAccessToken;
+  delete integrations.linearRefreshToken;
+  delete integrations.linearClientSecret;
+  delete integrations.slackClientSecret;
+  delete integrations.slackAppToken;
+  writePrivateFile(
+    appSettingsPath(),
+    `${JSON.stringify({ ...settings, environment: {}, integrations }, null, 2)}
+`
+  );
+  saveSecretVault({
+    linearApiKey,
+    linearAccessToken,
+    linearRefreshToken,
+    linearClientSecret,
+    slackClientSecret,
+    slackAppToken,
+    environment: settings.environment
+  });
+}
+function loadAppSettings() {
+  const disk = readSettingsFile();
+  const merged = mergeVault(disk);
+  if (diskHoldsSecrets(disk)) persistSplit(merged);
+  return merged;
+}
 function saveAppSettings(settings) {
   const normalized = normalizeSettings(settings);
-  mkdirSync(appDataDir(), { recursive: true });
-  writeFileSync(appSettingsPath(), `${JSON.stringify(normalized, null, 2)}
-`, "utf8");
+  persistSplit(normalized);
   return normalized;
 }
 function updateAppEnvironment(patch) {
@@ -330,6 +671,20 @@ function updateIntegrationsSettings(patch) {
       integrations.linearApiKey = patch.linearApiKey.trim();
     }
   }
+  if ("linearClientId" in patch) {
+    if (patch.linearClientId == null || patch.linearClientId.trim() === "") {
+      delete integrations.linearClientId;
+    } else {
+      integrations.linearClientId = patch.linearClientId.trim();
+    }
+  }
+  if ("linearClientSecret" in patch) {
+    if (patch.linearClientSecret == null || patch.linearClientSecret.trim() === "") {
+      delete integrations.linearClientSecret;
+    } else {
+      integrations.linearClientSecret = patch.linearClientSecret.trim();
+    }
+  }
   if ("issueSource" in patch) {
     if (patch.issueSource == null) {
       delete integrations.issueSource;
@@ -337,6 +692,48 @@ function updateIntegrationsSettings(patch) {
       integrations.issueSource = patch.issueSource;
     }
   }
+  if ("slackClientId" in patch) {
+    if (patch.slackClientId == null || patch.slackClientId.trim() === "") {
+      delete integrations.slackClientId;
+    } else {
+      integrations.slackClientId = patch.slackClientId.trim();
+    }
+  }
+  if ("slackClientSecret" in patch) {
+    if (patch.slackClientSecret == null || patch.slackClientSecret.trim() === "") {
+      delete integrations.slackClientSecret;
+    } else {
+      integrations.slackClientSecret = patch.slackClientSecret.trim();
+    }
+  }
+  if ("slackAppToken" in patch) {
+    if (patch.slackAppToken == null || patch.slackAppToken.trim() === "") {
+      delete integrations.slackAppToken;
+    } else {
+      integrations.slackAppToken = patch.slackAppToken.trim();
+    }
+  }
+  if ("slackListenEnabled" in patch) {
+    if (patch.slackListenEnabled == null) {
+      delete integrations.slackListenEnabled;
+    } else {
+      integrations.slackListenEnabled = Boolean(patch.slackListenEnabled);
+    }
+  }
+  if ("slackDeviceId" in patch) {
+    if (patch.slackDeviceId == null || patch.slackDeviceId.trim() === "") {
+      delete integrations.slackDeviceId;
+    } else {
+      integrations.slackDeviceId = patch.slackDeviceId.trim();
+    }
+  }
+  if ("slackDeviceLabel" in patch) {
+    if (patch.slackDeviceLabel == null || patch.slackDeviceLabel.trim() === "") {
+      delete integrations.slackDeviceLabel;
+    } else {
+      integrations.slackDeviceLabel = patch.slackDeviceLabel.trim().slice(0, 64);
+    }
+  }
   return saveAppSettings({ ...current, integrations });
 }
 function updateDefaultsSettings(patch) {
@@ -410,7 +807,36 @@ function resolveNewThreadOptions(overrides = {}, settings = loadAppSettings()) {
   };
 }
 function isLinearConnected(settings = loadAppSettings()) {
-  return Boolean(settings.integrations.linearApiKey?.trim());
+  return hasLinearCredentials(settings.integrations);
+}
+function saveLinearOAuth(input) {
+  const current = loadAppSettings();
+  const integrations = { ...current.integrations };
+  integrations.linearAccessToken = input.accessToken.trim();
+  if (input.refreshToken?.trim()) {
+    integrations.linearRefreshToken = input.refreshToken.trim();
+  }
+  if (typeof input.expiresIn === "number" && Number.isFinite(input.expiresIn)) {
+    integrations.linearTokenExpiresAt = Date.now() + Math.max(0, input.expiresIn) * 1e3;
+  }
+  if (input.viewerName?.trim()) {
+    integrations.linearViewerName = input.viewerName.trim().slice(0, 120);
+  }
+  if (input.organizationName?.trim()) {
+    integrations.linearOrganizationName = input.organizationName.trim().slice(0, 120);
+  }
+  return saveAppSettings({ ...current, integrations });
+}
+function disconnectLinearConnection() {
+  const current = loadAppSettings();
+  const integrations = { ...current.integrations };
+  delete integrations.linearApiKey;
+  delete integrations.linearAccessToken;
+  delete integrations.linearRefreshToken;
+  delete integrations.linearTokenExpiresAt;
+  delete integrations.linearViewerName;
+  delete integrations.linearOrganizationName;
+  return saveAppSettings({ ...current, integrations });
 }
 function getIssueSource(settings = loadAppSettings()) {
   return settings.integrations.issueSource ?? "github";
@@ -427,6 +853,33 @@ function getLinearApiKey(settings = loadAppSettings()) {
 function brightsyCloudConnectEnabled(settings = loadAppSettings()) {
   return Boolean(settings.brightsy.cloudConnectEnabled);
 }
+function slackListenEnabled(settings = loadAppSettings()) {
+  return settings.integrations.slackListenEnabled === true;
+}
+function ensureSlackDeviceIdentity(settings = loadAppSettings()) {
+  let deviceId = settings.integrations.slackDeviceId?.trim() ?? "";
+  let deviceLabel = settings.integrations.slackDeviceLabel?.trim() ?? "";
+  const patch = {};
+  if (!deviceId) {
+    deviceId = randomUUID();
+    patch.slackDeviceId = deviceId;
+  }
+  if (!deviceLabel) {
+    try {
+      deviceLabel = hostname().split(".")[0]?.trim() || "This Mac";
+    } catch {
+      deviceLabel = "This Mac";
+    }
+    patch.slackDeviceLabel = deviceLabel;
+  }
+  if (Object.keys(patch).length > 0) {
+    updateIntegrationsSettings(patch);
+  }
+  return { deviceId, deviceLabel };
+}
+function slackAppLevelToken(settings = loadAppSettings()) {
+  return process.env.SIDEBOARD_SLACK_APP_TOKEN?.trim() || settings.integrations.slackAppToken?.trim() || "";
+}
 function brightsyInjectWorktreeMcpEnabled(settings = loadAppSettings()) {
   return Boolean(settings.brightsy.injectWorktreeMcp);
 }
@@ -450,8 +903,12 @@ function updateAdvancedSettings(patch) {
   if (typeof patch.caffeinateWhileRunning === "boolean") {
     advanced.caffeinateWhileRunning = patch.caffeinateWhileRunning;
   }
-  if (typeof patch.caffeinateWhileCloudConnect === "boolean") {
-    advanced.caffeinateWhileCloudConnect = patch.caffeinateWhileCloudConnect;
+  if (typeof patch.caffeinateWhileSlackListen === "boolean") {
+    advanced.caffeinateWhileSlackListen = patch.caffeinateWhileSlackListen;
+    delete advanced.caffeinateWhileCloudConnect;
+  } else if (typeof patch.caffeinateWhileCloudConnect === "boolean") {
+    advanced.caffeinateWhileSlackListen = patch.caffeinateWhileCloudConnect;
+    delete advanced.caffeinateWhileCloudConnect;
   }
   if (typeof patch.deleteBranchOnPurge === "boolean") {
     advanced.deleteBranchOnPurge = patch.deleteBranchOnPurge;
@@ -494,8 +951,11 @@ function autoRunAfterSetupEnabled(settings = loadAppSettings()) {
 function caffeinateWhileRunningEnabled(settings = loadAppSettings()) {
   return Boolean(settings.advanced.caffeinateWhileRunning);
 }
+function caffeinateWhileSlackListenEnabled(settings = loadAppSettings()) {
+  return Boolean(settings.advanced.caffeinateWhileSlackListen);
+}
 function caffeinateWhileCloudConnectEnabled(settings = loadAppSettings()) {
-  return Boolean(settings.advanced.caffeinateWhileCloudConnect);
+  return caffeinateWhileSlackListenEnabled(settings);
 }
 function deleteBranchOnPurgeEnabled(settings = loadAppSettings()) {
   return Boolean(settings.advanced.deleteBranchOnPurge);
@@ -589,7 +1049,16 @@ function harnessEnvKey(harness) {
 }
 
 export {
+  setVaultMasterKey,
+  persistVaultKeyInKeychain,
+  readKeychainVaultKey,
+  resolveVaultKey,
+  readSecureJson,
+  writeSecureJson,
+  isSecureFileEncrypted,
+  secureFileUnlocksWith,
   HARNESS_ENV_KEYS,
+  toPublicAppSettings,
   appSettingsPath,
   claudeUserSettingsPath,
   loadAppSettings,
@@ -608,16 +1077,22 @@ export {
   resolveThreadDefaults,
   resolveNewThreadOptions,
   isLinearConnected,
+  saveLinearOAuth,
+  disconnectLinearConnection,
   getIssueSource,
   resolveEffectiveIssueSource,
   getLinearApiKey,
   brightsyCloudConnectEnabled,
+  slackListenEnabled,
+  ensureSlackDeviceIdentity,
+  slackAppLevelToken,
   brightsyInjectWorktreeMcpEnabled,
   brightsyCloudConnectAgent,
   updateAdvancedSettings,
   autoRenameBranchEnabled,
   autoRunAfterSetupEnabled,
   caffeinateWhileRunningEnabled,
+  caffeinateWhileSlackListenEnabled,
   caffeinateWhileCloudConnectEnabled,
   deleteBranchOnPurgeEnabled,
   autoArchiveOnMergeEnabled,

package/dist/{connected-teams-RUNMOCG5.js → connected-teams-35EIRJCP.js}

@@ -9,8 +9,8 @@ import {
   ensureConnectedBrightsyTeamTokens,
   getConnectedBrightsyTeamsRaw,
   listConnectedBrightsyTeams
-} from "./chunk-M5V4QIWF.js";
-import "./chunk-FGDJOJ2L.js";
+} from "./chunk-VROPG6QF.js";
+import "./chunk-AE5VBOFE.js";
 import "./chunk-7MV3RXSC.js";
 export {
   applyConnectedTeamToCli,

package/dist/{connected-teams-OMDHTL6A.js → connected-teams-ZRS53OAT.js}

@@ -7,9 +7,9 @@ import {
   ensureConnectedBrightsyTeamTokens,
   getConnectedBrightsyTeamsRaw,
   listConnectedBrightsyTeams
-} from "./chunk-DB3I75FI.js";
+} from "./chunk-BTL7EMGT.js";
 import "./chunk-M37RITA6.js";
-import "./chunk-4UIYN56C.js";
+import "./chunk-D4DPQ552.js";
 export {
   applyConnectedTeamToCli,
   brightsyMcpServerName,

package/dist/{coordinator-prompt-6HMTOX4G.js → coordinator-prompt-2J4PIMUF.js}

@@ -2,22 +2,25 @@
 
 import {
   COORDINATOR_TOOL_PLAYBOOK,
+  SLACK_REPLY_FORMATTING,
   coordinatorGreenfieldPlaybook,
   coordinatorSystemPrompt,
   coordinatorTurnReminder,
   enrichWorkspacesWithGithub,
   ensureGlobalCoordinatorCwd,
   formatWorkspaceInventory
-} from "./chunk-57WWNMFP.js";
-import "./chunk-LW5CMQGZ.js";
+} from "./chunk-7NCIHRAU.js";
+import "./chunk-OE7YBB5X.js";
 import "./chunk-B3SJXYIJ.js";
 import "./chunk-7FD7COKE.js";
-import "./chunk-FGDJOJ2L.js";
-import "./chunk-BPOTVI5J.js";
+import "./chunk-AE5VBOFE.js";
+import "./chunk-PTJJIQK7.js";
+import "./chunk-NSTQ6QKD.js";
 import "./chunk-KGZBYWZ3.js";
 import "./chunk-7MV3RXSC.js";
 export {
   COORDINATOR_TOOL_PLAYBOOK,
+  SLACK_REPLY_FORMATTING,
   coordinatorGreenfieldPlaybook,
   coordinatorSystemPrompt,
   coordinatorTurnReminder,