@teamvibe/poller 0.8.7 → 0.8.9-rc.1

package/README.md

@@ -99,3 +99,8 @@ The poller authenticates with the TeamVibe API using your token, then continuous
 ## Subscription usage freshness
 
 Passive usage percentages remain usable lower bounds until each window's `resetAt`. Without a reset time, passive windows expire five minutes after observation. Probe windows retain their 60-second TTL. Reset windows are ignored; known accounts still rank before unknown accounts. A window at the account's threshold defers selection until its expiry (reset for passive windows, TTL fallback without a reset).
+
+## Channel Git credentials
+
+See [Agent Git credentials](docs/git-credentials.md) for multi-host channel bindings,
+provider CLI environment variables, helper matching and session file lifetime.

package/bin/tv-git-credential.mjs

@@ -16,15 +16,20 @@ if (process.argv[2] === 'get') {
       if (separator > 0) request[line.slice(0, separator)] = line.slice(separator + 1)
     }
     const file = process.env.TV_GIT_TOKEN_FILE
-    const credential = JSON.parse(readFileSync(file, 'utf8'))
-    if (request.protocol !== 'https' || request.host !== credential.host ||
-        credential.host !== 'github.com' || typeof credential.token !== 'string' ||
+    const stored = JSON.parse(readFileSync(file, 'utf8'))
+    const bindings = Array.isArray(stored) ? stored : [stored]
+    if (request.protocol !== 'https' || typeof request.host !== 'string' || request.host !== request.host.toLowerCase()) process.exit(0)
+    const credential = bindings.find(binding => binding?.host === request.host)
+    if (!credential ||
+        typeof credential.token !== 'string' ||
         !credential.token || /[\r\n\0]/.test(credential.token) ||
-        !['github_token', 'github_app'].includes(credential.kind)) process.exit(0)
+        !['github_token', 'github_app', 'gitlab_token'].includes(credential.kind)) process.exit(0)
+    const username = credential.username ?? (credential.kind === 'gitlab_token' ? 'oauth2' : 'x-access-token')
+    if (!['x-access-token', 'oauth2'].includes(username)) process.exit(0)
     if (credential.expiresAt !== undefined) {
       const expiry = Date.parse(credential.expiresAt)
       if (!Number.isFinite(expiry) || expiry <= Date.now()) {
-        const diagnostic = `git_credential_expired kind=${credential.kind}\n`
+        const diagnostic = `git_credential_expired kind=${credential.kind}${Array.isArray(stored) ? ` host=${credential.host}` : ''}\n`
         process.stderr.write(diagnostic)
         // Value-free spool lets the poller report detached-task expiry through
         // its usual error queue even after the launching agent has exited.
@@ -32,7 +37,7 @@ if (process.argv[2] === 'get') {
         process.exit(0)
       }
     }
-    process.stdout.write(`username=x-access-token\npassword=${credential.token}\n`)
+    process.stdout.write(`username=${username}\npassword=${credential.token}\n`)
   } catch {
     // No output and success means Git proceeds to its prompt-disabled failure.
   }

package/dist/brain-manager.js

@@ -29,7 +29,7 @@ if (config.PERSISTENT_STORAGE_PATH) {
     }
 }
 const gitCredentialContext = new AsyncLocalStorage();
-const githubBrains = new Set();
+const httpsBrains = new Set();
 async function gitExec(command, options) {
     const context = gitCredentialContext.getStore();
     const run = async (credential) => {
@@ -86,7 +86,7 @@ async function gitExec(command, options) {
     }
 }
 async function withGitCredential(brainId, workspaceId, fn) {
-    if (!workspaceId || !githubBrains.has(brainId) || !config.TEAMVIBE_API_URL || !config.TEAMVIBE_POLLER_TOKEN)
+    if (!workspaceId || !httpsBrains.has(brainId) || !config.TEAMVIBE_API_URL || !config.TEAMVIBE_POLLER_TOKEN)
         return fn();
     const credential = await connectionsClient.get('brain', brainId);
     return gitCredentialContext.run({ brainId, credential }, fn);
@@ -253,8 +253,8 @@ export async function getBrainPath(brain, channelId, workspaceId) {
         return config.DEFAULT_BRAIN_PATH;
     }
     const brainDir = resolveBrainDir(workspaceId, brain.brainId);
-    if (/^https:\/\/github\.com\//i.test(brain.gitRepoUrl))
-        githubBrains.add(brain.brainId);
+    if (/^https:\/\//i.test(brain.gitRepoUrl))
+        httpsBrains.add(brain.brainId);
     return withBrainLock(brainLockKey(brainDir, brain.brainId, workspaceId), () => withGitCredential(brain.brainId, workspaceId, () => getWorkspaceBrainPath(brain, workspaceId)));
 }
 async function getWorkspaceBrainPath(brain, workspaceId) {

package/dist/claude-spawner.d.ts

@@ -9,7 +9,7 @@ import { type ClaudeRateLimitInfo } from './claude-rate-limit.js';
 import { type ClaudeQuotaFailure } from './claude-quota.js';
 import { type PoolRuntimeOptions, type PoolAttempt } from './subscription-runtime.js';
 import type { SubscriptionAccount } from './subscription-pool-client.js';
-import { type GitCredential } from './connections-client.js';
+import { type GitCredential, type GitCredentialSet } from './connections-client.js';
 export declare function progressNotificationMarks(estimateMinutes: number): number[];
 export declare function computeCompactionKillDeadline(previousActivityTime: number, now: number, idleKillMs: number, graceMs: number): number;
 export interface ContextHintParams {
@@ -28,6 +28,8 @@ export interface SpawnResult {
     poolAttempts?: readonly PoolAttempt[];
     quota?: ClaudeQuotaFailure;
     rateLimitInfo?: ClaudeRateLimitInfo;
+    /** Rejections anywhere in this attempt survive a later allowed stream event. */
+    rateLimitRejections?: readonly ClaudeRateLimitInfo[];
     /** Actual ID passed to this CLI attempt, including a failed first turn. */
     attemptedSessionId?: string;
     success: boolean;
@@ -177,7 +179,7 @@ export interface BuildSpawnEnvParams {
     inboxThreadId: string;
     brainPath: string;
     subscriptionAccount?: SubscriptionAccount;
-    gitCredential?: GitCredential;
+    gitCredential?: GitCredential | GitCredentialSet;
     gitTokenFile?: string;
 }
 /**

package/dist/claude-spawner.js

@@ -1,3 +1,4 @@
+import { END_OF_TURN_NO_FURTHER_RESPONSE_SENTINEL } from './end-of-turn-sentinel.js';
 import { createSessionInstance, writeSessionOwner } from './session-instance.js';
 import { buildGitCredentialEnv } from './git-credential-env.js';
 import { createGitCredentialSession, finishGitCredentialSession, setGitCredentialSessionPid } from './git-credential-session.js';
@@ -20,7 +21,7 @@ import { fetchSecretsForSpawn, buildSecretsReminder } from './secrets-client.js'
 import { fetchConfigForSpawn } from './config-client.js';
 import { parseClaudeRateLimitInfo } from './claude-rate-limit.js';
 import { parseClaudeQuotaFailure } from './claude-quota.js';
-import { abortLocalProbe, accountPin, preparePool, fetchRuntimePool, validateAccount, poolDeferredError, PoolDeferredError } from './subscription-runtime.js';
+import { abortLocalProbe, accountPin, preparePool, fetchRuntimePool, validateAccount, subscriptionUsageStore, poolDeferredError, PoolDeferredError } from './subscription-runtime.js';
 import { selectPoolForResolvedModel } from './subscription-pool.js';
 import { isQuotaPaused, QuotaPausedError } from './quota-pause.js';
 import { redactStartupText } from './startup-auth.js';
@@ -794,10 +795,10 @@ function resolveTypingStatusDetail(event, assistantText) {
     if (assistantCalledTool(event, 'mcp__slack__send_message'))
         return null;
     const text = assistantText ?? extractAssistantText(event);
-    if (text) {
-        // Collapse newlines/whitespace runs so a multi-line narration doesn't
-        // land a literal `\n` in the one-line status surface.
-        return { text: oneLineStatus(text), source: 'comment' };
+    // tv#589: the silence marker is control text, including inside narration.
+    const narration = text?.split(END_OF_TURN_NO_FURTHER_RESPONSE_SENTINEL).join('').replace(/\s+/g, ' ').trim();
+    if (narration) {
+        return { text: oneLineStatus(narration), source: 'comment' };
     }
     for (const block of event.message.content) {
         if (block?.type !== 'tool_use' || typeof block.name !== 'string')
@@ -809,6 +810,9 @@ function resolveTypingStatusDetail(event, assistantText) {
             return { text: oneLineStatus(status), source: `tool:${safeToolName}` };
         }
     }
+    // A sentinel-only event keeps the current status when no tool status applies.
+    if (text?.includes(END_OF_TURN_NO_FURTHER_RESPONSE_SENTINEL))
+        return null;
     return { text: 'Thinking...', source: 'default' };
 }
 export function resolveTypingStatus(event, assistantText) {
@@ -911,6 +915,14 @@ async function runClaudeCode(msg, sessionLog, cwd, directory, sessionId, isFirst
     });
     if (runtime?.account)
         await validateAccount(runtime.account, runtime.resolved);
+    if (runtime?.account && !runtime.shouldStop()) {
+        const store = subscriptionUsageStore();
+        const attemptAt = Date.now();
+        const windows = await store.beginVerification(runtime.account, runtime.resolved.model, attemptAt);
+        if (windows === undefined)
+            throw await poolDeferredError('usage', { kind: 'ready', accounts: [runtime.account] }, runtime.resolved, store);
+        runtime.verificationAttemptAt = windows.length ? attemptAt : undefined;
+    }
     return new Promise((resolve) => {
         // Preparation above awaits remote config/context. Another thread may
         // have exhausted the shared account meanwhile. No awaits before spawn.
@@ -1083,6 +1095,16 @@ async function runClaudeCode(msg, sessionLog, cwd, directory, sessionId, isFirst
         // Retain CLI error/result evidence, not the full parsed assistant/tool stream.
         const failureEvents = [];
         let rateLimitInfo;
+        const rateLimitRejections = new Map();
+        const captureRateLimit = (value) => {
+            rateLimitInfo = parseClaudeRateLimitInfo(value);
+            if (!runtime?.account || rateLimitInfo?.status !== 'rejected')
+                return;
+            for (const w of normalizePassiveUsage(rateLimitInfo, Date.now()).windows) {
+                if (w.status === 'rejected')
+                    rateLimitRejections.set(`${w.window}:${w.scope}`, rateLimitInfo);
+            }
+        };
         let metrics;
         let lastAssistant;
         // teamvibe.ai#284 (poller-brain#235): end-of-turn guard state — tracked
@@ -1143,7 +1165,7 @@ async function runClaudeCode(msg, sessionLog, cwd, directory, sessionId, isFirst
                     // (including metadata keys) to logs, telemetry, typing, or Slack.
                     const event = safeEvent(rawEvent);
                     if (rawEvent?.type === 'rate_limit_event') {
-                        rateLimitInfo = parseClaudeRateLimitInfo(event.rate_limit_info);
+                        captureRateLimit(event.rate_limit_info);
                     }
                     if (rawEvent?.type === 'result' || rawEvent?.type === 'error' || (rawEvent?.type === 'assistant' && rawEvent.error)) {
                         failureEvents.push(rawEvent);
@@ -1367,7 +1389,7 @@ async function runClaudeCode(msg, sessionLog, cwd, directory, sessionId, isFirst
                     const rawEvent = JSON.parse(stdoutBuffer);
                     const event = safeEvent(rawEvent);
                     if (event?.type === 'rate_limit_event') {
-                        rateLimitInfo = parseClaudeRateLimitInfo(event.rate_limit_info);
+                        captureRateLimit(event.rate_limit_info);
                     }
                     failureEvents.push(rawEvent);
                     if (event?.type === 'assistant') {
@@ -1386,6 +1408,7 @@ async function runClaudeCode(msg, sessionLog, cwd, directory, sessionId, isFirst
                 attemptedSessionId: sessionId,
                 ...(quota ? { quota } : {}),
                 ...(rateLimitInfo ? { rateLimitInfo } : {}),
+                ...(rateLimitRejections.size ? { rateLimitRejections: [...rateLimitRejections.values()] } : {}),
                 output: redactOutput(stdout),
                 exitCode: code,
                 metrics,
@@ -1610,7 +1633,7 @@ export async function spawnPoolClaudeCode(msg, sessionLog, selectedDirectory, se
         const modelNormalizedFrom = scoped?.model === resolved.model && scoped?.modelSource === resolved.modelSource
             ? scoped?.modelNormalizedFrom : undefined;
         const runtime = poolRuntime ? {
-            resolved, modelNormalizedFrom, claudeConfigDir, account: prepared?.account,
+            resolved, modelNormalizedFrom, claudeConfigDir, account: prepared?.account, verificationAttemptAt: undefined,
             shouldStop: poolRuntime.shouldStop,
             resumePending: fetchedPool?.kind !== 'no_accounts_configured' && poolRuntime.pin?.resumePending === true,
             onSpawn: () => {
@@ -1649,10 +1672,12 @@ export async function spawnPoolClaudeCode(msg, sessionLog, selectedDirectory, se
             if (!runtime?.resumePending)
                 sawSendMessageCall = false;
             const spawned = await runClaudeCode(msg, sessionLog, effectiveCwd, directory, id, runtime?.resumePending ? false : first, lastMessageTs, onMessageSent, typingIndicator, runtime, gitDelivery);
+            const rejected = spawned.rateLimitRejections?.find(rejectedForModel);
             const result = prepared?.account
-                ? { ...spawned, quota: quotaForModel(spawned.quota), success: rejectedForModel(spawned.rateLimitInfo) ? false : spawned.success } : spawned;
+                ? { ...spawned, ...(rejected ? { rateLimitInfo: rejected } : {}), quota: quotaForModel(spawned.quota), success: rejected || rejectedForModel(spawned.rateLimitInfo) ? false : spawned.success } : spawned;
             sawSendMessageCall ||= result.sawSendMessageCall === true;
             if (prepared?.account) {
+                const observedAt = Date.now();
                 if (poolAttempts.length >= 1000)
                     poolAttempts.shift();
                 const selection = prepared.selection;
@@ -1664,7 +1689,8 @@ export async function spawnPoolClaudeCode(msg, sessionLog, selectedDirectory, se
                     accountId: prepared.account.accountId,
                     credentialVersion: prepared.account.credentialVersion,
                     accountLabel: prepared.account.label ?? prepared.account.accountId,
-                    observedAt: Date.now(),
+                    observedAt,
+                    verificationAttemptAt: runtime?.verificationAttemptAt,
                     rateLimitInfo: result.rateLimitInfo,
                     sessionId: id,
                     model: resolved.model ?? result.metrics?.model,
@@ -1675,13 +1701,19 @@ export async function spawnPoolClaudeCode(msg, sessionLog, selectedDirectory, se
                     metrics: result.metrics,
                 });
                 emitEvent('pool.account_attempted', msg.teamvibe.channelId, { workspaceId: msg.teamvibe.workspaceId, threadId: msg.thread_id, ...poolRunTelemetry(poolAttempts, poolRuntime?.quotaDeferEpisodes) });
+                // Retain every rejected scope before completion can clear a verified
+                // hold or return early. A failed write must not skip another scope.
+                const rejectionOutcomes = await Promise.allSettled((result.rateLimitRejections ?? []).map(info => logPoolUsageWrite(sessionLog, prepared.account, info, () => prepared.store.recordPassive(prepared.account, info, observedAt, { expireFutureObservations: true }))));
                 if (result.success && id && poolRuntime) {
-                    // Complete the inbox before any fallible post-inference store writes.
-                    // The loop retains bookkeeping independently of the original prompt.
+                    // Complete the inbox even if rejection bookkeeping failed. The loop
+                    // retains completion independently of the original prompt.
                     const bookkeepingComplete = await poolRuntime.complete(id, { ...accountPin(prepared.account, resolved), effectiveCwd, claudeConfigDir, resumePending: false }, poolAttempts, result.rateLimitInfo);
                     if (bookkeepingComplete !== false)
                         await emitCandidateUsage(msg, [prepared.account], prepared.store);
                     retainWorktree = false;
+                    const failed = rejectionOutcomes.find((outcome) => outcome.status === 'rejected');
+                    if (failed)
+                        throw new PoolDeferredError('infrastructure', { error: failed.reason });
                     return result;
                 }
                 if ((result.quota || rejectedForModel(result.rateLimitInfo)) && !result.killedByPoller) {
@@ -1692,15 +1724,17 @@ export async function spawnPoolClaudeCode(msg, sessionLog, selectedDirectory, se
                 // retaining the attempt. Selection waits for all writes before switching.
                 const writes = [];
                 if (result.quota && !result.killedByPoller)
-                    writes.push(logPoolUsageWrite(sessionLog, prepared.account, result.quota.window ? { rateLimitType: result.quota.window } : undefined, () => prepared.store.recordQuota(prepared.account, result.quota, Date.now(), { expireFutureObservations: true }), 'quota'));
-                if (result.rateLimitInfo)
-                    writes.push(logPoolUsageWrite(sessionLog, prepared.account, result.rateLimitInfo, () => prepared.store.recordPassive(prepared.account, result.rateLimitInfo, Date.now(), { expireFutureObservations: true })));
+                    writes.push(logPoolUsageWrite(sessionLog, prepared.account, result.quota.window ? { rateLimitType: result.quota.window } : undefined, () => prepared.store.recordQuota(prepared.account, result.quota, observedAt, { expireFutureObservations: true }), 'quota'));
+                if (!result.rateLimitRejections?.length && result.rateLimitInfo)
+                    writes.push(logPoolUsageWrite(sessionLog, prepared.account, result.rateLimitInfo, () => prepared.store.recordPassive(prepared.account, result.rateLimitInfo, observedAt, { expireFutureObservations: true })));
                 if (id && poolRuntime)
                     writes.push(poolRuntime.persist(id, { ...accountPin(prepared.account, resolved), effectiveCwd, claudeConfigDir, resumePending: runtime?.resumePending, sawSendMessageCall }, poolAttempts));
-                const outcomes = await Promise.allSettled(writes);
+                const outcomes = [...rejectionOutcomes, ...await Promise.allSettled(writes)];
                 const failed = outcomes.find((outcome) => outcome.status === 'rejected');
                 if (failed)
                     throw new PoolDeferredError('infrastructure', { error: failed.reason });
+                if (runtime?.verificationAttemptAt !== undefined && !result.killedByPoller && result.exitCode !== null)
+                    await prepared.store.completeVerification(prepared.account, runtime.verificationAttemptAt, observedAt);
             }
             return result;
         };

package/dist/config.d.ts

@@ -19,6 +19,7 @@ declare const configSchema: z.ZodObject<{
     NETWORK_ERROR_KILL_MS: z.ZodDefault<z.ZodNumber>;
     MAX_CONSECUTIVE_NET_FAILURES: z.ZodDefault<z.ZodNumber>;
     TYPING_COMMENT_MIN_HOLD_MS: z.ZodDefault<z.ZodNumber>;
+    TYPING_STATUS_REQUEST_TIMEOUT_MS: z.ZodDefault<z.ZodNumber>;
     TEAMVIBE_DATA_DIR: z.ZodDefault<z.ZodString>;
     BRAINS_PATH: z.ZodDefault<z.ZodString>;
     DEFAULT_BRAIN_PATH: z.ZodDefault<z.ZodString>;
@@ -63,6 +64,7 @@ declare const configSchema: z.ZodObject<{
     NETWORK_ERROR_KILL_MS: number;
     MAX_CONSECUTIVE_NET_FAILURES: number;
     TYPING_COMMENT_MIN_HOLD_MS: number;
+    TYPING_STATUS_REQUEST_TIMEOUT_MS: number;
     TEAMVIBE_DATA_DIR: string;
     BRAINS_PATH: string;
     DEFAULT_BRAIN_PATH: string;
@@ -113,6 +115,7 @@ declare const configSchema: z.ZodObject<{
     NETWORK_ERROR_KILL_MS?: number | undefined;
     MAX_CONSECUTIVE_NET_FAILURES?: number | undefined;
     TYPING_COMMENT_MIN_HOLD_MS?: number | undefined;
+    TYPING_STATUS_REQUEST_TIMEOUT_MS?: number | undefined;
     TEAMVIBE_DATA_DIR?: string | undefined;
     BRAINS_PATH?: string | undefined;
     DEFAULT_BRAIN_PATH?: string | undefined;
@@ -160,6 +163,7 @@ export declare const config: {
     NETWORK_ERROR_KILL_MS: number;
     MAX_CONSECUTIVE_NET_FAILURES: number;
     TYPING_COMMENT_MIN_HOLD_MS: number;
+    TYPING_STATUS_REQUEST_TIMEOUT_MS: number;
     TEAMVIBE_DATA_DIR: string;
     BRAINS_PATH: string;
     DEFAULT_BRAIN_PATH: string;

package/dist/config.js

@@ -28,6 +28,7 @@ const configSchema = z.object({
     NETWORK_ERROR_KILL_MS: z.coerce.number().default(120000), // Per-session: kill stuck session after 2 min of network errors
     MAX_CONSECUTIVE_NET_FAILURES: z.coerce.number().default(5), // Poll loop: DNS flush at N, exit(1) at 2×N consecutive failures
     TYPING_COMMENT_MIN_HOLD_MS: z.coerce.number().default(4500), // Minimum time to display agent narration before a canned status
+    TYPING_STATUS_REQUEST_TIMEOUT_MS: z.coerce.number().int().positive().default(10_000), // Abort stalled Slack status requests
     // Paths
     TEAMVIBE_DATA_DIR: z.string().default(DEFAULT_DATA_DIR),
     BRAINS_PATH: z.string().default(''),

package/dist/connections-client.d.ts

@@ -1,13 +1,24 @@
+export type GitCredentialKind = 'github_token' | 'github_app' | 'gitlab_token';
 export type GitCredential = {
     source: 'platform';
-    host: 'github.com';
-    username: 'x-access-token';
+    host: string;
+    username: 'x-access-token' | 'oauth2';
     token: string;
     connectionId: string;
     credentialVersion: string;
     bindingVersion: number;
     expiresAt?: string;
-    kind?: 'github_token' | 'github_app';
+    kind: GitCredentialKind;
+} | {
+    source: 'none';
+    legacyAllowed?: boolean;
+};
+export type PlatformCredential = Omit<Extract<GitCredential, {
+    source: 'platform';
+}>, 'source'>;
+export type GitCredentialSet = {
+    source: 'platform';
+    bindings: PlatformCredential[];
 } | {
     source: 'none';
     legacyAllowed?: boolean;
@@ -59,7 +70,8 @@ export declare class ConnectionsClient {
     recordBrainSource(brainId: string, source: 'platform' | 'legacy'): void;
     get legacyGitBrains(): number;
     private noticeLegacyServer;
-    get(scope: Scope, id: string, force?: boolean): Promise<GitCredential>;
+    get(scope: 'brain', id: string, force?: boolean): Promise<GitCredential>;
+    get(scope: Scope, id: string, force?: boolean): Promise<GitCredential | GitCredentialSet>;
 }
 export declare const connectionsClient: ConnectionsClient;
 export declare function refreshConnectionTuples(pollerId: string): Promise<void>;

package/dist/connections-client.js

@@ -1,3 +1,4 @@
+import { gitCredentialBindings } from './git-credential-bindings.js';
 import { config } from './config.js';
 import { registerConfiguredToken } from './redact-text.js';
 export class ConnectionFetchError extends Error {
@@ -9,6 +10,22 @@ export class ConnectionFetchError extends Error {
         this.status = status;
     }
 }
+// RFC 1123 hostname: lowercase labels of 1–63 characters, 253 total,
+// with no scheme, port, path, trailing dot or leading/trailing hyphens.
+function isCredentialHost(host) {
+    return typeof host === 'string' && host.length <= 253 && !/[^a-z0-9.-]/.test(host) &&
+        host.split('.').every(label => /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(label));
+}
+function isPlatformCredential(value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    const body = value;
+    return isCredentialHost(body.host) &&
+        ((body.kind === 'github_token' || body.kind === 'github_app') && body.host === 'github.com' && body.username === 'x-access-token' ||
+            body.kind === 'gitlab_token' && body.host !== 'github.com' && body.username === 'oauth2') &&
+        typeof body.token === 'string' && !!body.token && typeof body.connectionId === 'string' &&
+        typeof body.credentialVersion === 'string' && typeof body.bindingVersion === 'number';
+}
 /** Cache keys include consumer scope. Binding tuples arrive at startup and
  * each brains refresh; a changed tuple evicts immediately. */
 export class ConnectionsClient {
@@ -75,8 +92,10 @@ export class ConnectionsClient {
         if (!/^[A-Za-z0-9_-]{1,128}$/.test(id))
             throw new ConnectionFetchError('invalid_request', 400);
         const url = new URL(scope === 'brain' ? `/brains/${encodeURIComponent(id)}/git-credential` : '/connections/git/spawn', this.options.apiUrl);
-        if (scope === 'channel')
+        if (scope === 'channel') {
             url.searchParams.set('channelId', id);
+            url.searchParams.set('format', 'bindings');
+        }
         const response = await (this.options.fetch ?? fetch)(url, { headers: { Authorization: `Bearer ${this.options.pollerToken}`, 'Cache-Control': 'no-store' }, redirect: 'error' });
         if (!response.ok) {
             if (response.status === 405 || response.status === 404 && !(await response.clone().json().catch(() => ({}))).code) {
@@ -87,20 +106,32 @@ export class ConnectionsClient {
             const code = { 400: 'invalid_request', 401: 'unauthorized', 403: 'forbidden', 404: 'connection_unbound', 409: 'connection_disabled', 410: 'connection_deleted' }[response.status] ?? 'credential_store_unavailable';
             throw new ConnectionFetchError(code, response.status);
         }
-        const body = await response.json();
+        const body = await response.json().catch(() => null);
         let value;
-        if (body.source === 'none')
-            value = { source: 'none', ...(body.legacyAllowed === true ? { legacyAllowed: true } : {}) };
-        else if (body.source === 'platform' && body.host === 'github.com' && body.username === 'x-access-token' &&
-            typeof body.token === 'string' && body.token && typeof body.connectionId === 'string' &&
-            typeof body.credentialVersion === 'string' && typeof body.bindingVersion === 'number') {
-            value = body;
-            registerConfiguredToken(body.token);
+        if (body?.['source'] === 'none')
+            value = { source: 'none', ...(body['legacyAllowed'] === true ? { legacyAllowed: true } : {}) };
+        else if (body?.['source'] === 'platform') {
+            if (scope === 'channel') {
+                // Older servers may ignore format=bindings; tolerate their single body.
+                const { source: _, ...single } = body;
+                const bindings = Object.hasOwn(body, 'bindings') ? body['bindings'] : [single];
+                if (!Array.isArray(bindings) || bindings.length === 0 || !bindings.every(isPlatformCredential) ||
+                    new Set(bindings.map(binding => binding.host.toLowerCase())).size !== bindings.length)
+                    throw new ConnectionFetchError('invalid_response', 503);
+                value = { source: 'platform', bindings };
+            }
+            else if (isPlatformCredential(body))
+                value = body;
+            else
+                throw new ConnectionFetchError('invalid_response', 503);
+            for (const binding of gitCredentialBindings(value))
+                registerConfiguredToken(binding.token);
         }
         else
             throw new ConnectionFetchError('invalid_response', 503);
-        const validUntil = value.source === 'platform' && value.expiresAt
-            ? Date.parse(value.expiresAt) - 5 * 60_000 : this.now() + 10 * 60_000;
+        const bindings = gitCredentialBindings(value);
+        const validUntil = bindings.length ? Math.min(...bindings.map(binding => binding.expiresAt
+            ? Date.parse(binding.expiresAt) - 5 * 60_000 : this.now() + 10 * 60_000)) : this.now() + 10 * 60_000;
         if (validUntil > this.now())
             this.entries.set(key, { value, tuple: tuple ?? '', validUntil });
         return value;

package/dist/end-of-turn-sentinel.d.ts

@@ -0,0 +1,2 @@
+/** Claude's end-of-turn marker when no further visible reply is needed. */
+export declare const END_OF_TURN_NO_FURTHER_RESPONSE_SENTINEL = "NO_FURTHER_RESPONSE_NEEDED";

package/dist/end-of-turn-sentinel.js

@@ -0,0 +1,2 @@
+/** Claude's end-of-turn marker when no further visible reply is needed. */
+export const END_OF_TURN_NO_FURTHER_RESPONSE_SENTINEL = 'NO_FURTHER_RESPONSE_NEEDED';

package/dist/git-credential-bindings.d.ts

@@ -0,0 +1,2 @@
+import type { GitCredential, GitCredentialSet, PlatformCredential } from './connections-client.js';
+export declare function gitCredentialBindings(credential: GitCredential | GitCredentialSet): PlatformCredential[];

package/dist/git-credential-bindings.js

@@ -0,0 +1,4 @@
+// Shared single-consumer adapter; preserves the brain credential contract.
+export function gitCredentialBindings(credential) {
+    return credential.source === 'none' ? [] : 'bindings' in credential ? credential.bindings : [credential];
+}

package/dist/git-credential-env.d.ts

@@ -1,3 +1,3 @@
-import type { GitCredential } from './connections-client.js';
+import type { GitCredential, GitCredentialSet } from './connections-client.js';
 export declare const GIT_CREDENTIAL_HELPER: string;
-export declare function buildGitCredentialEnv(base: NodeJS.ProcessEnv, credential: GitCredential, tokenFile?: string): NodeJS.ProcessEnv;
+export declare function buildGitCredentialEnv(base: NodeJS.ProcessEnv, credential: GitCredential | GitCredentialSet, tokenFile?: string): NodeJS.ProcessEnv;

package/dist/git-credential-env.js

@@ -1,3 +1,4 @@
+import { gitCredentialBindings } from './git-credential-bindings.js';
 import { fileURLToPath } from 'node:url';
 import { registerConfiguredToken } from './redact-text.js';
 // Works from both src/ (tests) and dist/ (published package).
@@ -9,29 +10,41 @@ export function buildGitCredentialEnv(base, credential, tokenFile) {
         // Do not inherit a prior session's helper/file, even on eligible legacy.
         if (key.startsWith('TV_GIT_') || !legacy && (/^GIT_(?:CONFIG|CREDENTIAL|TRACE|SSL|HTTP|SSH)(?:_|$)/.test(key) ||
             ['GIT_ASKPASS', 'GIT_EXEC_PATH', 'GIT_PROXY_COMMAND', 'GIT_DIR', 'GIT_COMMON_DIR', 'GIT_WORK_TREE', 'GIT_NAMESPACE', 'GIT_TEMPLATE_DIR', 'GIT_PROTOCOL', 'GIT_ALLOW_PROTOCOL', 'SSH_ASKPASS'].includes(key) ||
-            ['GITHUB_TOKEN', 'GH_TOKEN', 'GITLAB_TOKEN'].includes(key)))
+            ['GITHUB_TOKEN', 'GH_TOKEN', 'GITLAB_TOKEN', 'GITLAB_HOST'].includes(key)))
             delete env[key];
     }
     if (legacy)
         return env;
     env['GIT_TERMINAL_PROMPT'] = '0';
-    env['GIT_CONFIG_COUNT'] = credential.source === 'platform' ? '3' : '1';
+    const bindings = gitCredentialBindings(credential);
+    env['GIT_CONFIG_COUNT'] = String(1 + 2 * bindings.length);
     env['GIT_CONFIG_KEY_0'] = 'credential.helper';
     env['GIT_CONFIG_VALUE_0'] = '';
     if (credential.source === 'platform') {
         if (!tokenFile)
             throw new Error('Git credential token file required');
-        registerConfiguredToken(credential.token);
         env['TV_GIT_TOKEN_FILE'] = tokenFile;
-        env['GIT_CONFIG_KEY_1'] = `credential.https://${credential.host}.helper`;
         // Strip CLI snapshots before the helper process starts. Git appends only
         // get/store/erase; the token remains exclusively in the private file.
         const helperPath = "'" + GIT_CREDENTIAL_HELPER.replace(/'/g, "'\\''") + "'";
-        env['GIT_CONFIG_VALUE_1'] = `!env -u GITHUB_TOKEN -u GH_TOKEN -u GITLAB_TOKEN ${helperPath}`;
-        env['GIT_CONFIG_KEY_2'] = `credential.https://${credential.host}.useHttpPath`;
-        env['GIT_CONFIG_VALUE_2'] = 'true';
-        env['GH_TOKEN'] = credential.token;
-        env['GITHUB_TOKEN'] = credential.token;
+        for (const [index, binding] of bindings.entries()) {
+            registerConfiguredToken(binding.token);
+            const key = 1 + 2 * index;
+            env[`GIT_CONFIG_KEY_${key}`] = `credential.https://${binding.host}.helper`;
+            env[`GIT_CONFIG_VALUE_${key}`] = `!env -u GITHUB_TOKEN -u GH_TOKEN -u GITLAB_TOKEN ${helperPath}`;
+            env[`GIT_CONFIG_KEY_${key + 1}`] = `credential.https://${binding.host}.useHttpPath`;
+            env[`GIT_CONFIG_VALUE_${key + 1}`] = 'true';
+            if (binding.host === 'github.com') {
+                env['GH_TOKEN'] = binding.token;
+                env['GITHUB_TOKEN'] = binding.token;
+            }
+            else if (binding.kind === 'gitlab_token' && env['GITLAB_TOKEN'] === undefined) {
+                // glab/API env covers the first GitLab host in canonical order;
+                // Git's host-scoped helpers cover every binding.
+                env['GITLAB_TOKEN'] = binding.token;
+                env['GITLAB_HOST'] = binding.host;
+            }
+        }
     }
     return env;
 }

package/dist/git-credential-session.d.ts

@@ -1,6 +1,6 @@
-import type { GitCredential } from './connections-client.js';
+import type { GitCredential, GitCredentialKind, GitCredentialSet, PlatformCredential } from './connections-client.js';
 import { type SessionInstance } from './session-instance.js';
-type PlatformCredential = Extract<GitCredential, {
+type PlatformDelivery = Extract<GitCredential | GitCredentialSet, {
     source: 'platform';
 }>;
 export interface GitCredentialSession extends SessionInstance {
@@ -10,13 +10,13 @@ export interface GitCredentialSession extends SessionInstance {
 }
 export interface AgentGitDelivery {
     instance?: SessionInstance;
-    credential?: GitCredential;
+    credential?: GitCredential | GitCredentialSet;
     session?: GitCredentialSession;
 }
 export declare function gitCredentialRoot(): string;
-export declare function gitCredentialKind(credential: PlatformCredential): 'github_app' | 'github_token';
-export declare function writeGitTokenFile(dir: string, credential: PlatformCredential): void;
-export declare function createGitCredentialSession(credential: PlatformCredential, options: {
+export declare function gitCredentialKind(credential: PlatformCredential): GitCredentialKind;
+export declare function writeGitTokenFile(dir: string, credential: PlatformDelivery): void;
+export declare function createGitCredentialSession(credential: PlatformDelivery, options: {
     root?: string;
     channelId: string;
     threadId: string;

package/dist/git-credential-session.js

@@ -1,3 +1,4 @@
+import { gitCredentialBindings } from './git-credential-bindings.js';
 import { execFileSync } from 'node:child_process';
 import { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs';
 import { randomUUID } from 'node:crypto';
@@ -47,8 +48,13 @@ export function gitCredentialKind(credential) {
     return credential.kind ?? (credential.expiresAt ? 'github_app' : 'github_token');
 }
 export function writeGitTokenFile(dir, credential) {
-    registerConfiguredToken(credential.token);
-    atomicWrite(join(dir, 'git-token'), JSON.stringify({ host: credential.host, token: credential.token, expiresAt: credential.expiresAt, kind: gitCredentialKind(credential) }));
+    const entries = gitCredentialBindings(credential).map(binding => {
+        registerConfiguredToken(binding.token);
+        return { host: binding.host, username: binding.username, token: binding.token, expiresAt: binding.expiresAt, kind: gitCredentialKind(binding) };
+    });
+    // Channel sets use an ordered array; single brain credentials keep their
+    // existing file shape. The helper reads either format on every invocation.
+    atomicWrite(join(dir, 'git-token'), JSON.stringify('bindings' in credential ? entries : entries[0]));
 }
 export function createGitCredentialSession(credential, options) {
     const root = options.root ?? gitCredentialRoot();
@@ -60,7 +66,9 @@ export function createGitCredentialSession(credential, options) {
         const instance = options.instance ?? createSessionInstance();
         writeSessionOwner(join(dir, 'owner.json'), instance);
         writeGitTokenFile(dir, credential);
-        const metadata = { ...instance, ownerPid: process.pid, ownerIdentity, active: true, channelId: options.channelId, threadId: options.threadId, connectionId: credential.connectionId, kind: gitCredentialKind(credential) };
+        const metadata = { ...instance, ownerPid: process.pid, ownerIdentity, active: true, channelId: options.channelId, threadId: options.threadId, ...('bindings' in credential
+                ? { bindings: credential.bindings.map(binding => ({ connectionId: binding.connectionId, kind: gitCredentialKind(binding), host: binding.host })) }
+                : { connectionId: credential.connectionId, kind: gitCredentialKind(credential) }) };
         atomicWrite(join(dir, 'session.json'), JSON.stringify(metadata));
         const tasksFile = join(dir, 'bg-tasks');
         writeFileSync(tasksFile, '', { mode: 0o600, flag: 'wx' });
@@ -187,7 +195,19 @@ function sweepSession(dir) {
         reportSessionOwnerMismatch(expected, current);
     const events = join(dir, 'git-credential-events');
     if (metadata && matches && existsSync(events)) {
-        if (!metadata.expiryReported) {
+        if (metadata.bindings) {
+            const diagnostics = new Set(readFileSync(events, 'utf8').split('\n'));
+            const expiredHosts = new Set(metadata.expiredHosts);
+            for (const binding of metadata.bindings) {
+                if (!expiredHosts.has(binding.host) && diagnostics.has(`git_credential_expired kind=${binding.kind} host=${binding.host}`)) {
+                    emitError('session', `git_credential_expired kind=${binding.kind} host=${binding.host}`, { channelId: metadata.channelId, context: { code: 'git_credential_expired', ...binding, threadId: metadata.threadId } });
+                    expiredHosts.add(binding.host);
+                }
+            }
+            metadata.expiredHosts = [...expiredHosts];
+            atomicWrite(path, JSON.stringify(metadata));
+        }
+        else if (!metadata.expiryReported) {
             emitError('session', `git_credential_expired kind=${metadata.kind}`, { channelId: metadata.channelId, context: { code: 'git_credential_expired', kind: metadata.kind, connectionId: metadata.connectionId, threadId: metadata.threadId } });
             metadata.expiryReported = true;
             atomicWrite(path, JSON.stringify(metadata));

package/dist/inbox-watcher.d.ts

@@ -27,8 +27,8 @@ export interface InboxWatcherDeps {
  * threads (see modules-teamvibe/hooks/slack-events.ts). Synthetic threadIds
  * used elsewhere (`maintenance_<brainId>_<ts>`, and
  * `scheduled:<scheduleId>:<ts>` from
- * modules-teamvibe/src/functions/scheduler.ts:86) never sit idle waiting on
- * a background-task drop, so they're skipped rather than guessed at.
+ * modules-teamvibe/src/functions/scheduler.ts) carry no Slack destination;
+ * scheduler recovery needs the poller-owned routing record exclusively.
  * `scheduled:*:*` has the same 3-colon-segment shape as a real Slack
  * threadId, so it's rejected explicitly rather than by segment count alone
  * — otherwise a leftover unprocessed file in a stale scheduled-session inbox