@teamvibe/poller 0.8.8 → 0.8.9-rc.2

package/README.md

@@ -99,3 +99,43 @@ The poller authenticates with the TeamVibe API using your token, then continuous
 ## Subscription usage freshness
 
 Passive usage percentages remain usable lower bounds until each window's `resetAt`. Without a reset time, passive windows expire five minutes after observation. Probe windows retain their 60-second TTL. Reset windows are ignored; known accounts still rank before unknown accounts. A window at the account's threshold defers selection until its expiry (reset for passive windows, TTL fallback without a reset).
+
+### Brain inventory event (#517)
+
+The existing `/events` queue carries `brain.inventory` alongside session, pool,
+maintenance and poller events. Collection runs after pull, before Claude starts,
+for normal **and maintenance** sessions. Per workspace/brain, unchanged snapshots
+are suppressed for 10 minutes; changes to inventory, HEAD, or poller version emit
+immediately. Collection failures log a generic warning and never block the agent.
+
+`metadata` is additive and versioned:
+
+```ts
+{
+  schemaVersion: 1,
+  workspaceId, brainId, repo, commit, pollerVersion,
+  skills: [{ name, path, discovered, state, description?, source?, ref?, sha?, contentHash? }],
+  mcpServers: [{ name, type, requiredEnv: string[], missingEnv: string[] }],
+  locks: { skillsLockJson: boolean, skillsLockYaml: boolean },
+  inventoryHash
+}
+```
+
+Only flat `.claude/skills/<name>/SKILL.md` directories are discovered. Nested skills
+are reported as `not-discovered`; missing or invalid YAML frontmatter is `invalid`.
+A lock entry makes a valid flat skill `vendored`; other valid flat skills are `own`.
+Both `skills-lock.json` and `.claude/skills/skills.lock.yaml` are optional; wrapper
+YAML provenance takes precedence over JSON. `contentHash` hashes actual skill files.
+MCP `${VAR}` and `${VAR:-default}` placeholders in `env` and `headers` produce names
+only, compared with defined keys in the resolved spawn environment. No commands,
+URLs, headers, literal credentials, or environment values from `.mcp.json` are sent.
+Symlinked files/directories are not followed. Git repository URL credentials and
+query strings are removed from event attribution.
+
+See [#517](https://github.com/teamvibeai/teamvibe.ai/issues/517). Read-only v1;
+updates/additions and scheduled skill maintenance actions are follow-up work.
+
+## Channel Git credentials
+
+See [Agent Git credentials](docs/git-credentials.md) for multi-host channel bindings,
+provider CLI environment variables, helper matching and session file lifetime.

package/bin/tv-git-credential.mjs

@@ -16,15 +16,20 @@ if (process.argv[2] === 'get') {
       if (separator > 0) request[line.slice(0, separator)] = line.slice(separator + 1)
     }
     const file = process.env.TV_GIT_TOKEN_FILE
-    const credential = JSON.parse(readFileSync(file, 'utf8'))
-    if (request.protocol !== 'https' || request.host !== credential.host ||
-        credential.host !== 'github.com' || typeof credential.token !== 'string' ||
+    const stored = JSON.parse(readFileSync(file, 'utf8'))
+    const bindings = Array.isArray(stored) ? stored : [stored]
+    if (request.protocol !== 'https' || typeof request.host !== 'string' || request.host !== request.host.toLowerCase()) process.exit(0)
+    const credential = bindings.find(binding => binding?.host === request.host)
+    if (!credential ||
+        typeof credential.token !== 'string' ||
         !credential.token || /[\r\n\0]/.test(credential.token) ||
-        !['github_token', 'github_app'].includes(credential.kind)) process.exit(0)
+        !['github_token', 'github_app', 'gitlab_token'].includes(credential.kind)) process.exit(0)
+    const username = credential.username ?? (credential.kind === 'gitlab_token' ? 'oauth2' : 'x-access-token')
+    if (!['x-access-token', 'oauth2'].includes(username)) process.exit(0)
     if (credential.expiresAt !== undefined) {
       const expiry = Date.parse(credential.expiresAt)
       if (!Number.isFinite(expiry) || expiry <= Date.now()) {
-        const diagnostic = `git_credential_expired kind=${credential.kind}\n`
+        const diagnostic = `git_credential_expired kind=${credential.kind}${Array.isArray(stored) ? ` host=${credential.host}` : ''}\n`
         process.stderr.write(diagnostic)
         // Value-free spool lets the poller report detached-task expiry through
         // its usual error queue even after the launching agent has exited.
@@ -32,7 +37,7 @@ if (process.argv[2] === 'get') {
         process.exit(0)
       }
     }
-    process.stdout.write(`username=x-access-token\npassword=${credential.token}\n`)
+    process.stdout.write(`username=${username}\npassword=${credential.token}\n`)
   } catch {
     // No output and success means Git proceeds to its prompt-disabled failure.
   }

package/dist/brain-inventory-emitter.d.ts

@@ -0,0 +1,13 @@
+export declare function shouldEmitInventory(previous: {
+    hash: string;
+    at: number;
+} | undefined, hash: string, now: number): boolean;
+/** Best effort telemetry; a malformed brain or unavailable git must never block Claude. */
+export declare function emitBrainInventory(params: {
+    brainPath: string;
+    brainId: string;
+    workspaceId: string;
+    channelId: string;
+    repo: string;
+    envNames: string[];
+}): Promise<void>;

package/dist/brain-inventory-emitter.js

@@ -0,0 +1,57 @@
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { collectBrainInventory } from './brain-inventory.js';
+import { emitEvent } from './event-queue.js';
+import { POLLER_VERSION } from './config.js';
+import { logger } from './logger.js';
+const exec = promisify(execFile);
+const lastEmitted = new Map();
+const INTERVAL_MS = 10 * 60_000;
+export function shouldEmitInventory(previous, hash, now) {
+    return !previous || previous.hash !== hash || now - previous.at >= INTERVAL_MS;
+}
+/** Best effort telemetry; a malformed brain or unavailable git must never block Claude. */
+export async function emitBrainInventory(params) {
+    try {
+        const inventory = await collectBrainInventory(params.brainPath, params.envNames);
+        const { stdout } = await exec('git', [
+            '-C',
+            params.brainPath,
+            'rev-parse',
+            'HEAD',
+        ]);
+        const commit = stdout.trim();
+        // Include HEAD in throttling so an unrelated commit is still reflected in attribution.
+        const hash = `${inventory.inventoryHash}:${commit}:${POLLER_VERSION}`;
+        const key = `${params.workspaceId}:${params.brainId}`;
+        const now = Date.now();
+        if (!shouldEmitInventory(lastEmitted.get(key), hash, now))
+            return;
+        let repo = params.repo;
+        try {
+            const url = new URL(repo);
+            url.username = '';
+            url.password = '';
+            url.search = '';
+            url.hash = '';
+            repo = url.toString();
+        }
+        catch {
+            /* SSH remotes carry no HTTP credentials. */
+        }
+        emitEvent('brain.inventory', params.channelId, {
+            schemaVersion: 1,
+            workspaceId: params.workspaceId,
+            brainId: params.brainId,
+            repo,
+            commit,
+            pollerVersion: POLLER_VERSION,
+            ...inventory,
+        });
+        lastEmitted.set(key, { hash, at: now });
+    }
+    catch {
+        // Do not echo parser exceptions: they can contain raw MCP credential values.
+        logger.warn('[BrainInventory] Could not collect inventory');
+    }
+}

package/dist/brain-inventory.d.ts

@@ -0,0 +1,28 @@
+export interface InventorySkill {
+    name: string;
+    path: string;
+    discovered: boolean;
+    state: 'own' | 'vendored' | 'not-discovered' | 'invalid';
+    target?: string;
+    description?: string;
+    source?: string;
+    ref?: string;
+    sha?: string;
+    contentHash: string;
+}
+export interface InventoryMcpServer {
+    name: string;
+    type: 'stdio' | 'http';
+    requiredEnv: string[];
+    missingEnv: string[];
+}
+/** Read-only, deterministic collection. Receives env NAMES; never accepts env values. */
+export declare function collectBrainInventory(brainPath: string, envNames: readonly string[]): Promise<{
+    inventoryHash: string;
+    skills: InventorySkill[];
+    mcpServers: InventoryMcpServer[];
+    locks: {
+        skillsLockJson: boolean;
+        skillsLockYaml: boolean;
+    };
+}>;

package/dist/brain-inventory.js

@@ -0,0 +1,209 @@
+import { createHash } from 'node:crypto';
+import { readdir, readFile, lstat, realpath } from 'node:fs/promises';
+import { join, posix, relative as relativePath, isAbsolute, sep, } from 'node:path';
+import { parse } from 'yaml';
+const hash = (value) => createHash('sha256').update(value).digest('hex');
+const object = (value) => value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+async function optionalFile(path) {
+    try {
+        if (!(await lstat(path)).isFile())
+            return undefined; // Never follow symlinks out of the brain.
+        return await readFile(path, 'utf8');
+    }
+    catch (error) {
+        if (['ENOENT', 'ENOTDIR'].includes(error.code ?? ''))
+            return undefined;
+        throw error;
+    }
+}
+function document(text, yaml = false) {
+    try {
+        return object(text === undefined
+            ? undefined
+            : yaml
+                ? parse(text, { maxAliasCount: 0 })
+                : JSON.parse(text));
+    }
+    catch {
+        return {};
+    } // Bad optional locks/config must not prevent the remaining inventory.
+}
+async function entries(path) {
+    try {
+        return (await readdir(path, { withFileTypes: true })).sort((a, b) => a.name.localeCompare(b.name, 'en'));
+    }
+    catch (error) {
+        if (['ENOENT', 'ENOTDIR'].includes(error.code ?? ''))
+            return [];
+        throw error;
+    }
+}
+async function directoryHash(path) {
+    const parts = [];
+    for (const entry of await entries(path)) {
+        if (['.git', 'node_modules'].includes(entry.name))
+            continue;
+        if (entry.isFile())
+            parts.push(`${entry.name}\0${hash(await readFile(join(path, entry.name)))}`);
+        if (entry.isDirectory())
+            parts.push(`${entry.name}/\0${await directoryHash(join(path, entry.name))}`);
+    }
+    return hash(parts.join('\n'));
+}
+/** Read-only, deterministic collection. Receives env NAMES; never accepts env values. */
+export async function collectBrainInventory(brainPath, envNames) {
+    const brainRoot = await realpath(brainPath);
+    const skillsPath = join(brainRoot, '.claude/skills');
+    const [jsonText, yamlText, mcpText] = await Promise.all([
+        optionalFile(join(brainPath, 'skills-lock.json')),
+        optionalFile(join(skillsPath, 'skills.lock.yaml')),
+        optionalFile(join(brainPath, '.mcp.json')),
+    ]);
+    const jsonLocks = object(document(jsonText)['skills']);
+    const yamlLocks = object(document(yamlText, true)['skills']);
+    const skills = [];
+    async function walk(path, relative, depth, ancestors) {
+        for (const entry of await entries(path)) {
+            if ((!entry.isDirectory() && !entry.isSymbolicLink()) ||
+                ['.git', 'node_modules'].includes(entry.name))
+                continue;
+            let child = join(path, entry.name);
+            const skillPath = posix.join(relative, entry.name);
+            let target;
+            const invalidLink = () => skills.push({
+                name: entry.name,
+                path: skillPath,
+                discovered: false,
+                state: 'invalid',
+                contentHash: hash(''), // No target files are read for unsafe or dangling links.
+            });
+            if (entry.isSymbolicLink()) {
+                try {
+                    child = await realpath(child);
+                    const resolved = relativePath(brainRoot, child);
+                    if (resolved === '..' ||
+                        resolved.startsWith(`..${sep}`) ||
+                        isAbsolute(resolved) ||
+                        ancestors.has(child)) {
+                        invalidLink();
+                        continue;
+                    }
+                    if (!(await lstat(child)).isDirectory()) {
+                        invalidLink();
+                        continue;
+                    }
+                    target = resolved.split(sep).join('/');
+                }
+                catch (error) {
+                    if (!['ENOENT', 'ENOTDIR', 'ELOOP'].includes(error.code ?? ''))
+                        throw error;
+                    invalidLink();
+                    continue;
+                }
+            }
+            const text = await optionalFile(join(child, 'SKILL.md'));
+            if (text !== undefined) {
+                const match = text.match(/^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/);
+                let front = {};
+                try {
+                    if (match)
+                        front = object(parse(match[1], { maxAliasCount: 0 }));
+                }
+                catch {
+                    /* invalid */
+                }
+                const valid = (front['name'] === undefined || front['name'] === entry.name) &&
+                    typeof front['description'] === 'string' &&
+                    !!front['description'].trim();
+                const flat = depth === 0;
+                const provenance = flat
+                    ? {
+                        ...object(jsonLocks[entry.name]),
+                        ...object(yamlLocks[entry.name]),
+                    }
+                    : {};
+                const vendored = flat &&
+                    (target !== undefined ||
+                        Object.hasOwn(jsonLocks, entry.name) ||
+                        Object.hasOwn(yamlLocks, entry.name));
+                const skill = {
+                    name: entry.name,
+                    path: skillPath,
+                    discovered: flat && valid,
+                    state: !valid
+                        ? 'invalid'
+                        : !flat
+                            ? 'not-discovered'
+                            : vendored
+                                ? 'vendored'
+                                : 'own',
+                    contentHash: await directoryHash(child),
+                };
+                if (target !== undefined)
+                    skill.target = target;
+                if (typeof front['description'] === 'string')
+                    skill.description = front['description'];
+                for (const key of ['source', 'ref', 'sha']) {
+                    if (typeof provenance[key] === 'string') {
+                        let value = provenance[key];
+                        if (key === 'source') {
+                            try {
+                                const url = new URL(value);
+                                url.username = '';
+                                url.password = '';
+                                url.search = '';
+                                url.hash = '';
+                                value = url.toString();
+                            }
+                            catch {
+                                /* owner/repo or SSH syntax */
+                            }
+                        }
+                        skill[key] = value;
+                    }
+                }
+                skills.push(skill);
+            }
+            else if (target !== undefined) {
+                invalidLink();
+            }
+            await walk(child, skillPath, depth + 1, new Set([...ancestors, child]));
+        }
+    }
+    await walk(skillsPath, '.claude/skills', 0, new Set([brainRoot, skillsPath]));
+    const present = new Set(envNames);
+    const mcpServers = Object.entries(object(document(mcpText)['mcpServers']))
+        .sort(([a], [b]) => a.localeCompare(b, 'en'))
+        .map(([name, raw]) => {
+        const server = object(raw);
+        const names = new Set();
+        // Only env/headers placeholder references are part of the credential contract.
+        for (const value of [
+            ...Object.values(object(server['env'])),
+            ...Object.values(object(server['headers'])),
+        ]) {
+            if (typeof value !== 'string')
+                continue;
+            for (const match of value.matchAll(/\$\{([A-Za-z_][A-Za-z0-9_]*)(?::-[^}]*)?\}/g))
+                names.add(match[1]);
+        }
+        const requiredEnv = [...names].sort();
+        return {
+            name,
+            type: server['type'] === 'http' || server['type'] === 'sse' || server['url']
+                ? 'http'
+                : 'stdio',
+            requiredEnv,
+            missingEnv: requiredEnv.filter((name) => !present.has(name)),
+        };
+    });
+    const inventory = {
+        skills,
+        mcpServers,
+        locks: {
+            skillsLockJson: jsonText !== undefined,
+            skillsLockYaml: yamlText !== undefined,
+        },
+    };
+    return { ...inventory, inventoryHash: hash(JSON.stringify(inventory)) };
+}

package/dist/brain-manager.js

@@ -29,7 +29,7 @@ if (config.PERSISTENT_STORAGE_PATH) {
     }
 }
 const gitCredentialContext = new AsyncLocalStorage();
-const githubBrains = new Set();
+const httpsBrains = new Set();
 async function gitExec(command, options) {
     const context = gitCredentialContext.getStore();
     const run = async (credential) => {
@@ -86,7 +86,7 @@ async function gitExec(command, options) {
     }
 }
 async function withGitCredential(brainId, workspaceId, fn) {
-    if (!workspaceId || !githubBrains.has(brainId) || !config.TEAMVIBE_API_URL || !config.TEAMVIBE_POLLER_TOKEN)
+    if (!workspaceId || !httpsBrains.has(brainId) || !config.TEAMVIBE_API_URL || !config.TEAMVIBE_POLLER_TOKEN)
         return fn();
     const credential = await connectionsClient.get('brain', brainId);
     return gitCredentialContext.run({ brainId, credential }, fn);
@@ -253,8 +253,8 @@ export async function getBrainPath(brain, channelId, workspaceId) {
         return config.DEFAULT_BRAIN_PATH;
     }
     const brainDir = resolveBrainDir(workspaceId, brain.brainId);
-    if (/^https:\/\/github\.com\//i.test(brain.gitRepoUrl))
-        githubBrains.add(brain.brainId);
+    if (/^https:\/\//i.test(brain.gitRepoUrl))
+        httpsBrains.add(brain.brainId);
     return withBrainLock(brainLockKey(brainDir, brain.brainId, workspaceId), () => withGitCredential(brain.brainId, workspaceId, () => getWorkspaceBrainPath(brain, workspaceId)));
 }
 async function getWorkspaceBrainPath(brain, workspaceId) {

package/dist/claude-spawner.d.ts

@@ -9,7 +9,7 @@ import { type ClaudeRateLimitInfo } from './claude-rate-limit.js';
 import { type ClaudeQuotaFailure } from './claude-quota.js';
 import { type PoolRuntimeOptions, type PoolAttempt } from './subscription-runtime.js';
 import type { SubscriptionAccount } from './subscription-pool-client.js';
-import { type GitCredential } from './connections-client.js';
+import { type GitCredential, type GitCredentialSet } from './connections-client.js';
 export declare function progressNotificationMarks(estimateMinutes: number): number[];
 export declare function computeCompactionKillDeadline(previousActivityTime: number, now: number, idleKillMs: number, graceMs: number): number;
 export interface ContextHintParams {
@@ -179,7 +179,7 @@ export interface BuildSpawnEnvParams {
     inboxThreadId: string;
     brainPath: string;
     subscriptionAccount?: SubscriptionAccount;
-    gitCredential?: GitCredential;
+    gitCredential?: GitCredential | GitCredentialSet;
     gitTokenFile?: string;
 }
 /**

package/dist/claude-spawner.js

@@ -1,3 +1,5 @@
+import { emitBrainInventory } from './brain-inventory-emitter.js';
+import { END_OF_TURN_NO_FURTHER_RESPONSE_SENTINEL } from './end-of-turn-sentinel.js';
 import { createSessionInstance, writeSessionOwner } from './session-instance.js';
 import { buildGitCredentialEnv } from './git-credential-env.js';
 import { createGitCredentialSession, finishGitCredentialSession, setGitCredentialSessionPid } from './git-credential-session.js';
@@ -794,10 +796,10 @@ function resolveTypingStatusDetail(event, assistantText) {
     if (assistantCalledTool(event, 'mcp__slack__send_message'))
         return null;
     const text = assistantText ?? extractAssistantText(event);
-    if (text) {
-        // Collapse newlines/whitespace runs so a multi-line narration doesn't
-        // land a literal `\n` in the one-line status surface.
-        return { text: oneLineStatus(text), source: 'comment' };
+    // tv#589: the silence marker is control text, including inside narration.
+    const narration = text?.split(END_OF_TURN_NO_FURTHER_RESPONSE_SENTINEL).join('').replace(/\s+/g, ' ').trim();
+    if (narration) {
+        return { text: oneLineStatus(narration), source: 'comment' };
     }
     for (const block of event.message.content) {
         if (block?.type !== 'tool_use' || typeof block.name !== 'string')
@@ -809,6 +811,9 @@ function resolveTypingStatusDetail(event, assistantText) {
             return { text: oneLineStatus(status), source: `tool:${safeToolName}` };
         }
     }
+    // A sentinel-only event keeps the current status when no tool status applies.
+    if (text?.includes(END_OF_TURN_NO_FURTHER_RESPONSE_SENTINEL))
+        return null;
     return { text: 'Thinking...', source: 'default' };
 }
 export function resolveTypingStatus(event, assistantText) {
@@ -909,6 +914,40 @@ async function runClaudeCode(msg, sessionLog, cwd, directory, sessionId, isFirst
         workspaceId: msg.teamvibe.workspaceId,
         channelId: msg.teamvibe.channelId,
     });
+    // Prepend persistent bin dir to PATH if configured
+    const envPath = config.PERSISTENT_STORAGE_PATH
+        ? `${config.PERSISTENT_STORAGE_PATH}/bin:${process.env['PATH'] || ''}`
+        : process.env['PATH'];
+    if (runtime?.account)
+        poolInfo(sessionLog, `token target account=${poolLabel(runtime.account)} session=${JSON.stringify(sessionId ?? 'new')} credential=selected account token`);
+    const spawnEnv = buildSpawnEnv({
+        spawnSecretsEnv: spawnSecrets.env.unwrap(),
+        processEnv: process.env,
+        envPath,
+        claudeConfigDir: runtime?.claudeConfigDir ?? getBaseBrainPath(),
+        persistentStoragePath: config.PERSISTENT_STORAGE_PATH,
+        slackContext,
+        teamvibeApiUrl: config.TEAMVIBE_API_URL,
+        teamvibePollerToken: config.TEAMVIBE_POLLER_TOKEN || '',
+        teamvibeWorkspaceId: msg.teamvibe.workspaceId,
+        teamvibeChannelId: msg.teamvibe.channelId,
+        teamvibeBotId: msg.teamvibe.botId,
+        teamvibePollerId: getPollerId() || '',
+        inboxThreadId: msg.thread_id,
+        brainPath: directory.path,
+        subscriptionAccount: runtime?.account,
+        gitCredential,
+        gitTokenFile: gitDelivery.session?.tokenFile,
+    });
+    // Ordinary and maintenance sessions pass here after pull and all credential overlays.
+    // Only defined names from the final spawn environment cross the collector boundary.
+    if (directory.brainId && msg.teamvibe.brain?.gitRepoUrl) {
+        await emitBrainInventory({
+            brainPath: cwd, brainId: directory.brainId, workspaceId: directory.workspaceId,
+            channelId: msg.teamvibe.channelId, repo: msg.teamvibe.brain.gitRepoUrl,
+            envNames: Object.keys(spawnEnv).filter(name => spawnEnv[name] !== undefined),
+        });
+    }
     if (runtime?.account)
         await validateAccount(runtime.account, runtime.resolved);
     if (runtime?.account && !runtime.shouldStop()) {
@@ -1005,31 +1044,6 @@ async function runClaudeCode(msg, sessionLog, cwd, directory, sessionId, isFirst
             const imageCount = (msg.inlineImages ?? []).filter((img) => img.data || img.url).length;
             sessionLog.info(`Inline image content: ${imageCount} image(s) sent via stream-json stdin (not logged)`);
         }
-        // Prepend persistent bin dir to PATH if configured
-        const envPath = config.PERSISTENT_STORAGE_PATH
-            ? `${config.PERSISTENT_STORAGE_PATH}/bin:${process.env['PATH'] || ''}`
-            : process.env['PATH'];
-        if (runtime?.account)
-            poolInfo(sessionLog, `token target account=${poolLabel(runtime.account)} session=${JSON.stringify(sessionId ?? 'new')} credential=selected account token`);
-        const spawnEnv = buildSpawnEnv({
-            spawnSecretsEnv: spawnSecrets.env.unwrap(),
-            processEnv: process.env,
-            envPath,
-            claudeConfigDir: runtime?.claudeConfigDir ?? getBaseBrainPath(),
-            persistentStoragePath: config.PERSISTENT_STORAGE_PATH,
-            slackContext,
-            teamvibeApiUrl: config.TEAMVIBE_API_URL,
-            teamvibePollerToken: config.TEAMVIBE_POLLER_TOKEN || '',
-            teamvibeWorkspaceId: msg.teamvibe.workspaceId,
-            teamvibeChannelId: msg.teamvibe.channelId,
-            teamvibeBotId: msg.teamvibe.botId,
-            teamvibePollerId: getPollerId() || '',
-            inboxThreadId: msg.thread_id,
-            brainPath: directory.path,
-            subscriptionAccount: runtime?.account,
-            gitCredential,
-            gitTokenFile: gitDelivery.session?.tokenFile,
-        });
         // Capture the actual credentials for this attempt, including pool selection
         // and secrets overlays, regardless of whether alias exposure is enabled.
         const outputTokens = [spawnEnv['CLAUDE_CODE_OAUTH_TOKEN'], spawnEnv['TEAMVIBE_CLAUDE_OAUTH_TOKEN'], spawnEnv['GH_TOKEN'], spawnEnv['GITHUB_TOKEN']]

package/dist/config.d.ts

@@ -19,6 +19,7 @@ declare const configSchema: z.ZodObject<{
     NETWORK_ERROR_KILL_MS: z.ZodDefault<z.ZodNumber>;
     MAX_CONSECUTIVE_NET_FAILURES: z.ZodDefault<z.ZodNumber>;
     TYPING_COMMENT_MIN_HOLD_MS: z.ZodDefault<z.ZodNumber>;
+    TYPING_STATUS_REQUEST_TIMEOUT_MS: z.ZodDefault<z.ZodNumber>;
     TEAMVIBE_DATA_DIR: z.ZodDefault<z.ZodString>;
     BRAINS_PATH: z.ZodDefault<z.ZodString>;
     DEFAULT_BRAIN_PATH: z.ZodDefault<z.ZodString>;
@@ -63,6 +64,7 @@ declare const configSchema: z.ZodObject<{
     NETWORK_ERROR_KILL_MS: number;
     MAX_CONSECUTIVE_NET_FAILURES: number;
     TYPING_COMMENT_MIN_HOLD_MS: number;
+    TYPING_STATUS_REQUEST_TIMEOUT_MS: number;
     TEAMVIBE_DATA_DIR: string;
     BRAINS_PATH: string;
     DEFAULT_BRAIN_PATH: string;
@@ -113,6 +115,7 @@ declare const configSchema: z.ZodObject<{
     NETWORK_ERROR_KILL_MS?: number | undefined;
     MAX_CONSECUTIVE_NET_FAILURES?: number | undefined;
     TYPING_COMMENT_MIN_HOLD_MS?: number | undefined;
+    TYPING_STATUS_REQUEST_TIMEOUT_MS?: number | undefined;
     TEAMVIBE_DATA_DIR?: string | undefined;
     BRAINS_PATH?: string | undefined;
     DEFAULT_BRAIN_PATH?: string | undefined;
@@ -160,6 +163,7 @@ export declare const config: {
     NETWORK_ERROR_KILL_MS: number;
     MAX_CONSECUTIVE_NET_FAILURES: number;
     TYPING_COMMENT_MIN_HOLD_MS: number;
+    TYPING_STATUS_REQUEST_TIMEOUT_MS: number;
     TEAMVIBE_DATA_DIR: string;
     BRAINS_PATH: string;
     DEFAULT_BRAIN_PATH: string;

package/dist/config.js

@@ -28,6 +28,7 @@ const configSchema = z.object({
     NETWORK_ERROR_KILL_MS: z.coerce.number().default(120000), // Per-session: kill stuck session after 2 min of network errors
     MAX_CONSECUTIVE_NET_FAILURES: z.coerce.number().default(5), // Poll loop: DNS flush at N, exit(1) at 2×N consecutive failures
     TYPING_COMMENT_MIN_HOLD_MS: z.coerce.number().default(4500), // Minimum time to display agent narration before a canned status
+    TYPING_STATUS_REQUEST_TIMEOUT_MS: z.coerce.number().int().positive().default(10_000), // Abort stalled Slack status requests
     // Paths
     TEAMVIBE_DATA_DIR: z.string().default(DEFAULT_DATA_DIR),
     BRAINS_PATH: z.string().default(''),

package/dist/connections-client.d.ts

@@ -1,13 +1,24 @@
+export type GitCredentialKind = 'github_token' | 'github_app' | 'gitlab_token';
 export type GitCredential = {
     source: 'platform';
-    host: 'github.com';
-    username: 'x-access-token';
+    host: string;
+    username: 'x-access-token' | 'oauth2';
     token: string;
     connectionId: string;
     credentialVersion: string;
     bindingVersion: number;
     expiresAt?: string;
-    kind?: 'github_token' | 'github_app';
+    kind: GitCredentialKind;
+} | {
+    source: 'none';
+    legacyAllowed?: boolean;
+};
+export type PlatformCredential = Omit<Extract<GitCredential, {
+    source: 'platform';
+}>, 'source'>;
+export type GitCredentialSet = {
+    source: 'platform';
+    bindings: PlatformCredential[];
 } | {
     source: 'none';
     legacyAllowed?: boolean;
@@ -59,7 +70,8 @@ export declare class ConnectionsClient {
     recordBrainSource(brainId: string, source: 'platform' | 'legacy'): void;
     get legacyGitBrains(): number;
     private noticeLegacyServer;
-    get(scope: Scope, id: string, force?: boolean): Promise<GitCredential>;
+    get(scope: 'brain', id: string, force?: boolean): Promise<GitCredential>;
+    get(scope: Scope, id: string, force?: boolean): Promise<GitCredential | GitCredentialSet>;
 }
 export declare const connectionsClient: ConnectionsClient;
 export declare function refreshConnectionTuples(pollerId: string): Promise<void>;