@timqi/pier 0.1.3 → 0.1.4

package/dist/channels/slack.js

@@ -17,8 +17,8 @@ import { ReceiptLedger, Receipts } from "./receipts.js";
 import { SlackDirectory } from "./slack-directory.js";
 import { SlackApi, } from "./slack-api.js";
 import { SlackOutbound } from "./slack-outbound.js";
-import { readThread, slackToolAvailable } from "./slack-tool.js";
 import { SlackPanel } from "./slack-panel.js";
+import { readThread } from "./slack-thread.js";
 import { context, escapeMrkdwn, offeredLabel } from "./slack-render.js";
 const WORKING = "eyes";
 // The envelope is already acked, so this bounds concurrency (sockets,
@@ -90,7 +90,7 @@ export class SlackChannel {
         const config = deps.store.get("slack");
         this.log = deps.log ?? ((m) => logger("slack").warn(m));
         this.chains = new Chains(this.log, MAX_ACTIVE_CHATS);
-        this.directory = deps.directory ?? new SlackDirectory(this.log);
+        this.directory = new SlackDirectory(this.log);
         this.gate = new Gatekeeper(deps.store, "slack", this.log, "channel");
         this.seen = new Dedup(this.log, DEDUP_TTL_MS, DEDUP_MAX);
         this.api = deps.client ?? new SlackApi(config.token, config.appToken, this.log);
@@ -354,10 +354,8 @@ export class SlackChannel {
         }
         return name ?? channel;
     }
-    /** The eager thread read runs whether or not `agentTool` is on: a human
-     *  handing the agent a message is the same act as an upload, which nothing
-     *  gates. `agentTool` only changes the hint, which must not name a tool this
-     *  session does not have. */
+    /** The eager thread read is not gated: a human handing the agent a message
+     *  is the same act as an upload. */
     async sharedBlock(share) {
         const source = share.original_message;
         const ts = share.ts ?? source?.ts;
@@ -386,23 +384,19 @@ export class SlackChannel {
         const thread = parent && parent.replies <= INLINE_REPLY_MAX
             ? await this.sharedThread(parent.channel, parent.ts, parent.replies)
             : { transcript: false, lines: [] };
-        // The coordinates carry the tool's own parameter names; naming the tool is
-        // a lie when the Console has switched agent access off.
-        const how = slackToolAvailable(this.deps.store) ? "read with the slack tool: " : "";
+        // The coordinates in `pier slack`'s own words (skills/pier-slack).
         const hint = parent && !thread.transcript
-            ? `[thread: ${parent.replies} replies — ${how}channel ${parent.channel}, thread_ts ${parent.ts}]`
+            ? `[thread: ${parent.replies} replies — channel ${parent.channel}, thread_ts ${parent.ts}]`
             : "";
         // The transcript opens with the shared message itself.
         return [`[${head}]`, thread.transcript ? "" : body, ...thread.lines, hint]
             .filter(Boolean).join("\n");
     }
-    /** Through the slack tool's own read, so paging and dedup exist once. A read
-     *  that fails or comes back cut says so in the prompt (§5). */
+    /** A read that fails or comes back cut says so in the prompt (§5). */
     async sharedThread(channel, ts, replies) {
-        const deps = { directory: this.directory, log: this.log };
         try {
             // One over the budget, so an undercounting reply_count still reports as cut.
-            const read = await readThread(deps, this.api, channel, ts, undefined, INLINE_REPLY_MAX + 2);
+            const read = await readThread(this.directory, this.api, channel, ts, INLINE_REPLY_MAX + 2);
             if (!read.messages.length)
                 return { transcript: false, lines: [] };
             return {
@@ -410,9 +404,7 @@ export class SlackChannel {
                 lines: [
                     `[thread: ${replies} replies, oldest first — ${read.format}]`,
                     ...read.messages,
-                    ...(read.incomplete || read.truncated
-                        ? [`[thread partly read: ${read.incomplete ?? `cut at ${read.count} lines`}]`]
-                        : []),
+                    ...(read.truncated ? [`[thread partly read: cut at ${read.count} lines]`] : []),
                 ],
             };
         }

package/dist/channels/types.js

@@ -12,7 +12,6 @@ export const defaultChannelConfig = () => ({
     enabled: false,
     token: "",
     appToken: "",
-    agentTool: true,
     requireMention: true,
     requireBind: true,
     topicMode: true,

package/dist/cli.js

@@ -1,8 +1,10 @@
 #!/usr/bin/env node
 // What `pier` does when typed. Dispatch only, and no server imports until a
 // command needs them: `pier service install` must not open a database.
-import { execFileSync } from "node:child_process";
+import { execFileSync, spawn } from "node:child_process";
 import { accessSync, constants, realpathSync } from "node:fs";
+import { request } from "node:http";
+import { constants as osConstants } from "node:os";
 import { delimiter, join, resolve } from "node:path";
 import { parseArgs } from "node:util";
 import { fileURLToPath } from "node:url";
@@ -21,6 +23,10 @@ Usage
   pier restart                finish running turns first, then restart the service
   pier reload                 re-read channel config and recycle idle sessions
   pier backup                 snapshot pier.db before a manual update
+  pier vault run [ENV=NAME | NAME]... -- <command> [args...]
+                              run a command with named secrets in its env
+  pier slack <subcommand> ... Slack from a shell, token from the vault (pier slack --help)
+  pier task <command> ...     subagents and scheduled tasks from a shell (pier task --help)
   pier --version | --help
 
 Options for "service install"
@@ -33,13 +39,21 @@ The workbench is behind a password generated on first run and printed once.
 Under systemd that print lands in the journal: journalctl --user -u pier -e
 `;
 const say = (message) => void process.stdout.write(`${message}\n`);
-const fail = (message) => {
-    process.stderr.write(`pier: ${message}\n`);
+/** Every socket route answers from memory and the database, so a Pier that
+ *  takes longer than this is stuck, and an agent's shell must not hang with it. */
+const SOCKET_TIMEOUT_MS = 30_000;
+/** Typed on the binding: only then does a call narrow the code after it. */
+const die = (message) => {
+    process.stderr.write(`${message}\n`);
     process.exit(2);
 };
+const fail = (message) => die(`pier: ${message}`);
+const argv = process.argv.slice(2);
 const parsed = (() => {
     try {
         return parseArgs({
+            // `slack` and `task` own their options; only the name is parsed here.
+            args: argv[0] === "slack" || argv[0] === "task" ? [argv[0]] : argv,
             allowPositionals: true,
             strict: true,
             options: {
@@ -59,7 +73,8 @@ const parsed = (() => {
 })();
 const { values, positionals } = parsed;
 const [command, subcommand, ...extra] = positionals;
-if (extra.length)
+// `vault run` reads process.argv itself: parseArgs cannot say where the `--` was.
+if (command !== "vault" && extra.length)
     fail(`unexpected argument "${extra[0]}"`);
 const allowOnly = (allowed, usage) => {
     const invalid = Object.keys(values).find((key) => !allowed.includes(key));
@@ -100,6 +115,16 @@ else if (command === "update") {
 else if (command === "tools") {
     await tools(subcommand);
 }
+else if (command === "vault") {
+    await vault(subcommand, argv);
+}
+else if (command === "slack") {
+    await slack(argv.slice(1));
+}
+else if (command === "task") {
+    const { runTaskCli } = await import("./tasks/cli.js");
+    process.exitCode = await runTaskCli(argv.slice(1), (params) => askPier("/task", { params }));
+}
 else if (command === "restart" || command === "reload") {
     if (subcommand)
         fail(`unexpected argument "${subcommand}"`);
@@ -196,7 +221,130 @@ async function backup() {
     const path = backupDb(version, PIER_DB);
     process.stdout.write(path ? `backed up ${path}\n` : `no database yet — nothing to back up.\n`);
 }
-function commandPath(name) {
+/** Everything after `--` runs with the named secrets in its env — plain values
+ *  directly, `vt://` records through `vt inject`, which swaps them after the
+ *  operator's approval. Nothing here prints a value. */
+async function vault(action, argv) {
+    const usage = "usage: pier vault run [ENV=NAME | NAME]... -- <command> [args...]";
+    const split = argv.indexOf("--");
+    const cmd = argv.slice(split + 1);
+    if (action !== "run" || split < 2 || !cmd.length)
+        die(usage);
+    // `NAME` alone is `NAME=NAME`: names are env-var shaped so the common case needs no mapping.
+    const wanted = argv.slice(2, split).map((spec) => {
+        const parts = spec.split("=");
+        const [env, name = env] = parts;
+        if (parts.length > 2 || !env || !name || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(env))
+            die(usage);
+        return [env, name];
+    });
+    if (!wanted.length)
+        die(usage);
+    const values = await resolveSecrets([...new Set(wanted.map(([, name]) => name))]);
+    return inject(wanted, values, cmd);
+}
+/** `cmd` with each secret in its env; `approve` records go through `vt inject`,
+ *  which swaps them after approval. Never returns: the child's exit is ours. */
+function inject(wanted, values, cmd) {
+    const env = { ...process.env };
+    const records = [];
+    for (const [envName, name] of wanted) {
+        const hit = values[name];
+        env[envName] = hit.value;
+        if (hit.kind === "record")
+            records.push(envName);
+    }
+    let [file, ...args] = cmd;
+    if (records.length) {
+        if (!findCommand("vt")) {
+            const names = wanted.filter(([envName]) => records.includes(envName)).map(([, name]) => name);
+            die(`vault: vt is required for ${names.join(", ")} (approve level) and was not found`);
+        }
+        // Only the record-carrying variables are swapped; everything else passes through untouched.
+        [file, ...args] = ["vt", "inject", "--only-env", records.join(","), "--", ...cmd];
+    }
+    const child = spawn(file, args, { stdio: "inherit", env });
+    for (const signal of ["SIGINT", "SIGTERM"])
+        process.on(signal, () => child.kill(signal));
+    child.on("error", (err) => die(`vault: ${cmd[0]}: ${err.message}`));
+    child.on("exit", (code, signal) => {
+        // The shell's convention for a signal death, so a caller sees the same number it would without us.
+        process.exit(code ?? 128 + (signal ? osConstants.signals[signal] : 0));
+    });
+    return new Promise(() => { });
+}
+/** One request to the running Pier over its socket, signed with the caller's
+ *  session (`PIER_SESSION_ID`, the harness variable mapped by the shim). Not
+ *  running, silent, unreadable, or an identity or body Pier refuses, is one
+ *  `pier:` line and exit 2 before any route reads the answer. */
+async function askPier(path, body) {
+    const { PIER_SOCK } = await import("./paths.js");
+    const answer = await new Promise((done, reject) => {
+        let responded = false;
+        const req = request({ socketPath: PIER_SOCK, method: "POST", path, headers: { "content-type": "application/json" }, timeout: SOCKET_TIMEOUT_MS }, (res) => {
+            responded = true;
+            let raw = "";
+            const unreadable = () => reject(new Error(`unreadable answer from ${PIER_SOCK} (status ${String(res.statusCode ?? 0)})`));
+            res.on("data", (chunk) => (raw += chunk.toString()));
+            // A connection cut mid-body reports on the response, and `end` never comes.
+            res.on("error", unreadable);
+            res.on("end", () => {
+                try {
+                    done({ status: res.statusCode ?? 0, body: JSON.parse(raw) });
+                }
+                catch {
+                    unreadable();
+                }
+            });
+        });
+        req.on("timeout", () => req.destroy(new Error(`Pier did not answer within ${String(SOCKET_TIMEOUT_MS / 1000)} s`)));
+        // A 413 arrives while the body is still being written; the EPIPE after it is not the news.
+        req.on("error", (err) => responded || reject(err));
+        req.end(JSON.stringify({ ...body, sessionId: process.env.PIER_SESSION_ID }));
+    }).catch((err) => 
+    // A crash leaves the file with nobody behind it: that is "not running" too.
+    err.code === "ENOENT" || err.code === "ECONNREFUSED"
+        ? fail(`Pier is not running (no ${PIER_SOCK})`)
+        : fail(err.message));
+    if (answer.status === 400 || answer.status === 403 || answer.status === 413)
+        fail(answer.body.error ?? `socket answered ${String(answer.status)}`);
+    return answer;
+}
+/** The running Pier's answer for `names`, every name present; any failure is
+ *  one `vault:` line and exit 2, so an agent reads words, not an empty variable. */
+async function resolveSecrets(names) {
+    const { status, body } = await askPier("/resolve", { names });
+    if (status === 404)
+        die(`vault: ${body.error ?? "unknown name"} — file it at ${body.file ?? "the Console (Settings → Vault)"}`);
+    const values = body.values;
+    if (status !== 200 || !values)
+        die(`vault: ${body.error ?? `socket answered ${String(status)}`}`);
+    const missing = names.find((name) => !values[name]);
+    if (missing)
+        die(`vault: no secret named ${missing}`);
+    return values;
+}
+/** `$SLACK_BOT_TOKEN` when set (the re-exec below, or a test); otherwise the
+ *  vault's `SLACK_TOKEN`. An `approve` record is only readable inside `vt
+ *  inject`, so the command re-runs itself under it — the agent never sees
+ *  the vault. Lazy: `--help` and usage errors never touch the socket. */
+async function slack(args) {
+    const token = async () => {
+        const given = process.env.SLACK_BOT_TOKEN;
+        if (given)
+            return given;
+        const values = await resolveSecrets(["SLACK_TOKEN"]);
+        const hit = values.SLACK_TOKEN;
+        if (hit.kind === "plain")
+            return hit.value;
+        // argv[1], not `pier` on PATH: the same build that is running answers.
+        return inject([["SLACK_BOT_TOKEN", "SLACK_TOKEN"]], values, [process.execPath, ...process.execArgv, process.argv[1], "slack", ...args]);
+    };
+    const { runSlackCli } = await import("./channels/slack-cli.js");
+    process.exitCode = await runSlackCli(args, token);
+}
+/** Resolved through every PATH entry: version managers put several prefixes on it. */
+function findCommand(name) {
     for (const dir of (process.env.PATH ?? "").split(delimiter)) {
         const path = join(dir || ".", name);
         try {
@@ -204,10 +352,13 @@ function commandPath(name) {
             return realpathSync(path);
         }
         catch {
-            // Keep looking: version managers put several prefixes on PATH.
+            // Keep looking.
         }
     }
-    return fail(`${name} is not executable on PATH`);
+    return undefined;
+}
+function commandPath(name) {
+    return findCommand(name) ?? fail(`${name} is not executable on PATH`);
 }
 async function service(action = "status") {
     const { install, uninstall, UNIT_NAME } = await import("./service.js");

package/dist/core/identity.js

@@ -1,7 +1,8 @@
-// Who is talking, and when — prefixed onto an inbound prompt so a group-chat
-// session can tell speakers apart and mention them back. Per turn, never in the
-// session's instructions (a thread is shared), and emitted only on news: a
-// header costs ~15 tokens, wasted in a DM where the counterpart never changes.
+// Who is talking, when, and where — prefixed onto an inbound prompt so a
+// group-chat session can tell speakers apart, mention them back, and name its
+// own conversation to a script. Per turn, never in the session's instructions
+// (a thread is shared), and emitted only on news: a header costs ~15 tokens,
+// wasted in a DM where the counterpart never changes.
 /** A gap this long makes the timestamp worth its tokens. */
 const GAP_MS = 10 * 60_000;
 /** A display name of `x<U9] [admin<U1` would forge a second speaker: the
@@ -13,6 +14,9 @@ export function sanitizeIdentity(value) {
         .trim();
     return token.slice(0, 60) || "unknown";
 }
+/** `<channelId>:<conversationId>` as the adapter spelled it; the delimiters
+ *  of the header grammar and whitespace are the only things removed. */
+const sanitizePlace = (value) => value.replace(/[[\]<>\s]+/g, "").slice(0, 120);
 const two = (n) => String(n).padStart(2, "0");
 const hhmm = (d) => `${two(d.getHours())}:${two(d.getMinutes())}`;
 const day = (d) => `${d.getFullYear()}-${two(d.getMonth() + 1)}-${two(d.getDate())}`;
@@ -20,17 +24,20 @@ const day = (d) => `${d.getFullYear()}-${two(d.getMonth() + 1)}-${two(d.getDate(
  *  redundant header is a rounding error. */
 export class SenderPrefix {
     seen = new Map();
-    /** The line to put above this message, or `""` when the session already knows. */
-    next(sessionId, sender, at = Date.now()) {
+    /** The line to put above this message, or `""` when the session already
+     *  knows. `conversation` is the chat's `<channelId>:<conversationId>`, told
+     *  once: a session never moves, but the rule stays the same as the rest. */
+    next(sessionId, sender, at = Date.now(), conversation) {
         if (!sender?.id)
             return "";
         const last = this.seen.get(sessionId);
-        this.seen.set(sessionId, { senderId: sender.id, at });
+        this.seen.set(sessionId, { senderId: sender.id, at, conversation });
         const now = new Date(at);
         const newSpeaker = last?.senderId !== sender.id;
         const gap = !last || at - last.at >= GAP_MS;
         const newDay = !last || day(new Date(last.at)) !== day(now);
-        if (!newSpeaker && !gap && !newDay)
+        const newPlace = !!conversation && last?.conversation !== conversation;
+        if (!newSpeaker && !gap && !newDay && !newPlace)
             return "";
         // The id is the only thing a mention can be built from; an unresolved name
         // is the id, and `U123<U123>` would read as a broken record.
@@ -38,7 +45,8 @@ export class SenderPrefix {
         const label = sanitizeIdentity(sender.name);
         const who = newSpeaker ? (label === id ? `<${id}>` : `${label}<${id}>`) : "";
         const when = gap || newDay ? `${newDay ? `${day(now)} ` : ""}${hhmm(now)}` : "";
-        return `[${[who, when].filter(Boolean).join(" ")}]`;
+        const where = newPlace ? sanitizePlace(conversation) : "";
+        return `[${[who, when, where].filter(Boolean).join(" ")}]`;
     }
     forget(sessionId) {
         this.seen.delete(sessionId);
@@ -47,17 +55,18 @@ export class SenderPrefix {
 export const withPrefix = (prefix, text) => prefix ? `${prefix}\n${text}` : text;
 // Only the shapes `next()` emits, newline included: a human typing
 // `[14:23] on my way` is body text and must come back untouched.
-const HEADER = /^\[(?:([^\n[\]<>]*)<([^\n[\]<>]+)>)? ?((?:\d{4}-\d{2}-\d{2} )?\d{1,2}:\d{2})?\]\n/;
+const HEADER = /^\[(?:([^\n[\]<>]*)<([^\n[\]<>]+)>)? ?((?:\d{4}-\d{2}-\d{2} )?\d{1,2}:\d{2})? ?([a-z]+:[^\s[\]<>]+)?\]\n/;
 /** Read back a header this module wrote: the prefix is for the model, and a
  *  surface showing a stored message renders the speaker its own way. */
 export function splitSpeaker(text) {
     const m = HEADER.exec(text);
-    if (!m?.[2] && !m?.[3])
+    if (!m?.[2] && !m?.[3] && !m?.[4])
         return { text };
     return {
         ...(m[1] ? { name: m[1] } : {}),
         ...(m[2] ? { id: m[2] } : {}),
         ...(m[3] ? { when: m[3] } : {}),
+        ...(m[4] ? { where: m[4] } : {}),
         text: text.slice(m[0].length),
     };
 }

package/dist/core/reply.js

@@ -24,10 +24,13 @@ conventions:
   including humans talking to each other: stay silent rather than acknowledge
   what was not addressed to you.
 
-A message may start with \`[name<id> time]\` — the sender, added by Pier, not
-typed by them. It appears only on a change — new speaker, a ~10-minute gap, a
-new day — so the last one still applies; a gap alone shows as time only, like
-\`[14:23]\`. Use that \`id\` to mention someone; never ask for their own.
+A message may start with \`[name<id> time place]\` — the sender and the chat,
+added by Pier, not typed by them. It appears only on a change — new speaker, a
+~10-minute gap, a new day — so the last one still applies; a gap alone shows as
+time only, like \`[14:23]\`. Use that \`id\` to mention someone; never ask for
+their own. \`place\` is \`<platform>:<conversation>\` (Slack:
+\`slack:<channel>/<thread_ts>\`), said once per session: the channel and thread a
+script takes.
 `;
 /** Deployment facts an agent cannot discover: a guessed path is wrong wherever
  *  `PIER_HOME` moved and fails as "nothing is configured"; GPT models carry
@@ -56,14 +59,7 @@ export function originLabel(origin) {
     if (origin.kind !== "task-message") {
         return origin.kind === "task-delegation" ? "\u25b6 delegated task" : "\u21a9 task callback";
     }
-    const kinds = {
-        steer: "\u270e steer",
-        follow_up: "\uff0b follow-up",
-        progress: "\u25c7 progress",
-        decision: "\u2753 decision needed",
-        reply: "\u21a9 reply",
-    };
-    return `from a subagent \u00b7 ${kinds[origin.messageKind] ?? origin.messageKind}`;
+    return `from a supervisor \u00b7 ${origin.messageKind === "steer" ? "\u270e steer" : "\uff0b follow-up"}`;
 }
 /** Is a turn coming once this note is posted? On IM the note is the only
  *  message that turn has to wear the 👀; an error note reports a turn that
@@ -130,7 +126,12 @@ const MAX_SUGGESTIONS = 5;
 /** A deliberate non-answer. Stripped here so an adapter needs no new concept:
  *  an empty turn already posts nothing and retires its per-turn UI. The reason
  *  stays in the transcript, auditable without being broadcast. */
-const SILENT = /<silent>([\s\S]*?)<\/silent>/gi;
+// A model has been seen emitting `<s<U+200B>ilent>`: zero-width characters inside
+// the tag, which would post the literal tag to a channel instead of silence.
+const ZW = String.raw `[\u200B-\u200D\u2060\uFEFF]*`;
+const tag = (literal) => literal.split("").join(ZW);
+const SILENT = new RegExp(`${tag("<silent>")}([\\s\\S]*?)${tag("</silent>")}`, "gi");
+const SILENT_TAG = new RegExp(`<(\\/?)${tag("silent>")}`, "gi");
 /** Why the agent stayed quiet; hidden from the chat, shown on the workbench,
  *  where a silent turn must not look like a broken one. */
 export function silentReason(markdown) {
@@ -193,8 +194,8 @@ export function stableBlockEnd(markdown, from = 0) {
         else if (open && run[0] === open[0] && run.length >= open.length && !fence?.[2]?.trim())
             open = "";
         if (!open && (!run || silent)) {
-            for (const tag of line.matchAll(/<(\/?)silent>/gi))
-                silent = !tag[1];
+            for (const t of line.matchAll(SILENT_TAG))
+                silent = !t[1];
         }
         pending = -1;
         prev = line;

package/dist/core/router.js

@@ -567,7 +567,10 @@ export class Router {
             this.refuseDraining(msg.key);
         this.spokenTo?.(session.id);
         const { action, text } = decide(msg, session.state);
-        const prompt = withPrefix(this.senders.next(session.id, msg.sender), text);
+        // A chat is named so the agent can hand it to a script (skills/pier-slack);
+        // an alias names nothing a shell could reach.
+        const where = isAlias(msg.key) ? undefined : keyOf(msg.key);
+        const prompt = withPrefix(this.senders.next(session.id, msg.sender, Date.now(), where), text);
         log.debug(`${action} ${keyOf(msg.key)} → session ${session.id} (${String(prompt.length)} chars)`);
         // A rejected call surfaces on the event stream, never as a throw across the seam.
         session[action](prompt).catch((err) => {

package/dist/db.js

@@ -272,6 +272,34 @@ const MIGRATIONS = [
   -- Every row goes so the next scan re-reads each transcript and fills the table above.
   DELETE FROM session_index;
   `,
+    // 23 — the vault: named secrets `pier vault run` injects into one command.
+    `
+  -- name is an env-var name (^[A-Z][A-Z0-9_]{0,63}$). value is a sealed
+  -- envelope (auto) or a vt:// record (approve): the shape is the level.
+  CREATE TABLE vault (
+    name TEXT PRIMARY KEY,
+    value TEXT NOT NULL,
+    updated_at INTEGER NOT NULL
+  );
+  `,
+    // 24 — channel credentials move into the vault under fixed names (channels/config.ts).
+    `
+  -- The blob moves verbatim: same DEK, no decrypt, so this runs locked like
+  -- every migration. A name filed in the vault first wins (DO NOTHING); the
+  -- channel copy is dropped either way.
+  WITH moved(platform, path, name) AS (VALUES
+    ('telegram', '$.token', 'TELEGRAM_TOKEN'),
+    ('slack', '$.token', 'SLACK_TOKEN'), ('slack', '$.appToken', 'SLACK_APP_TOKEN'),
+    ('lark', '$.token', 'LARK_APP_ID'), ('lark', '$.appToken', 'LARK_APP_SECRET'))
+  INSERT INTO vault(name, value, updated_at)
+    SELECT moved.name, json_extract(channels.json, moved.path), CAST(strftime('%s', 'now') AS INTEGER) * 1000
+    FROM moved JOIN channels ON channels.platform = moved.platform
+    WHERE json_extract(channels.json, moved.path) <> ''
+    ON CONFLICT(name) DO NOTHING;
+  UPDATE channels SET json = json_remove(json, '$.token', '$.appToken');
+  `,
+    // 25 — the mid-run decision channel is gone; a control message is steer or follow_up.
+    `DELETE FROM task_messages WHERE json_extract(json, '$.kind') IN ('progress', 'decision', 'reply');`,
 ];
 /** `BEGIN IMMEDIATE`: taking the write lock up front turns a race with another
  *  Pier process into a wait, where deferred would be SQLITE_BUSY halfway through. */

package/dist/main.js

@@ -17,10 +17,6 @@ import { createControl } from "./channels/control.js";
 import { ConversationStore, resolveConversation } from "./channels/conversations.js";
 import { registerChannelRoutes } from "./channels/routes.js";
 import { ChannelRuntime } from "./channels/runtime.js";
-import { SlackApi } from "./channels/slack-api.js";
-import { SlackDirectory } from "./channels/slack-directory.js";
-import { handleSlackTool, slackToolAvailable, slackToolSpec } from "./channels/slack-tool.js";
-import { parseConversation as parseSlackConversation } from "./channels/slack.js";
 import { EventHub } from "./core/hub.js";
 import { splitSpeaker } from "./core/identity.js";
 import { pierDb } from "./db.js";
@@ -33,19 +29,21 @@ import { logger } from "./log.js";
 import { registerTaskRoutes } from "./tasks/routes.js";
 import { TaskService } from "./tasks/service.js";
 import { TaskStore } from "./tasks/store.js";
-import { taskToolSpec } from "./tasks/tool.js";
 import { PIER_HOME, pierPath, resolveAgentDir } from "./paths.js";
-import { CUSTOM_TOOL_RULES, MANAGED, ManagedTools, normalizeCustomTools, prependPath } from "./tools.js";
+import { CUSTOM_TOOL_RULES, MANAGED, ManagedTools, normalizeCustomTools, prependPath, writePierShim } from "./tools.js";
 import { toolsTask } from "./tools-task.js";
 import { Secrets } from "./secrets.js";
 import { startUpdate, unitPath, updaterProblem } from "./service.js";
 import { SettingsStore } from "./settings.js";
 import { currentVersion, startAutoUpdate, UpdateCheck } from "./update.js";
+import { Vault } from "./vault.js";
+import { servePier } from "./socket.js";
 import { AuthStore, registerAuthRoutes, requireAuth } from "./web/auth.js";
 import { registerConfigShareRoute, registerConfigSyncRoutes } from "./web/config-sync.js";
 import { PushStore, registerPushRoutes } from "./web/push.js";
 import { SessionStateStore } from "./web/session-state.js";
 import { createServer } from "./web/server.js";
+import { registerVaultRoutes } from "./web/vault.js";
 const log = logger("pier");
 // Before any SDK call resolves a path, so everything Pi derives from its agent
 // dir lands under PIER_HOME. PIER_AGENT_DIR marks the value as ours: a second
@@ -54,6 +52,7 @@ const log = logger("pier");
 process.env.PI_CODING_AGENT_DIR = resolveAgentDir(process.env);
 process.env.PIER_AGENT_DIR = process.env.PI_CODING_AGENT_DIR;
 prependPath(process.env);
+writePierShim();
 // Before the database and before task recovery, which would mark the running
 // instance's queued and active runs interrupted; the port is discovered far too
 // late, and a second Pier on another port would never notice at all.
@@ -77,12 +76,11 @@ const settings = new SettingsStore(db);
 // Unlocked below: vt mode waits on a human approval, and nothing that needs a
 // token may run before the key arrives.
 const secrets = new Secrets();
+const vault = new Vault(secrets, db);
 let tasks;
 const conversations = new ConversationStore(db);
 let resolveIm;
 let channelStore;
-// Shared by the adapter and the tool: one display-name lookup per process.
-const slackDirectory = new SlackDirectory((m) => logger("slack").warn(m));
 let readyForConfigReload = false;
 const piConfig = new PiConfigStore();
 // Before anything reads settings.json: a first boot gets Pier's seed file.
@@ -92,28 +90,7 @@ const configSync = new ConfigSync({
     reload: () => readyForConfigReload ? reloadInstance() : Promise.resolve(),
 });
 const skillsDir = fileURLToPath(new URL("../skills", import.meta.url));
-const agentTools = [
-    taskToolSpec((params, callerSessionId) => tasks.tool(params, callerSessionId)),
-    slackToolSpec((params, callerSessionId) => handleSlackTool({
-        store: channelStore,
-        directory: slackDirectory,
-        // Per call: the Console can change the token underneath us.
-        client: () => {
-            const config = channelStore.get("slack");
-            return config.token ? new SlackApi(config.token, config.appToken) : null;
-        },
-        // Per call: the mapping is durable, the session is not.
-        here: (sessionId) => {
-            const key = router.conversationOf(sessionId);
-            if (key?.channelId !== "slack")
-                return null;
-            const { channel, threadTs } = parseSlackConversation(key.conversationId);
-            return channel && threadTs ? { channel, threadTs } : null;
-        },
-        log: (m) => logger("slack.tool").warn(m),
-    }, params, callerSessionId), () => slackToolAvailable(channelStore)),
-];
-const factory = new PiAgentFactory(agentTools, 
+const factory = new PiAgentFactory(
 // Getters, read per session open: a Console change reaches the next session
 // without a restart.
 () => surfacePrompt({ boardsDir: defaultBoardsDir(), publicUrl: settings.get().publicUrl }), 
@@ -142,10 +119,10 @@ const toolsUpdate = toolsTask(tasks);
 const reconciled = await toolsUpdate.reconcile();
 if ("problem" in reconciled)
     log.error(`tools cannot be managed: ${reconciled.problem}`);
-const packages = new PiPackageStore(piConfig, { version: currentVersion(), settings, tools: agentTools }, [skillsDir]);
+const packages = new PiPackageStore(piConfig, { version: currentVersion(), settings }, [skillsDir]);
 // At boot, not lazily: the answer waits for the next Console open (update.ts).
 packages.watchUpdates();
-channelStore = new ChannelStore(db, secrets);
+channelStore = new ChannelStore(db, vault);
 const control = createControl({ router, factory, conversations, store: channelStore });
 const channels = new ChannelRuntime(channelStore, router, control);
 resolveIm = resolveConversation(conversations, factory, control.launchFor, (message) => logger("channels").warn(message));
@@ -272,6 +249,7 @@ registerConfigSyncRoutes(app, {
 });
 registerTaskRoutes(app, tasks, { factory, router });
 registerChannelRoutes(app, channelStore, channels);
+registerVaultRoutes(app, { vault, doctor: () => secrets.doctor() });
 registerBoardRoutes(app);
 const sessionState = new SessionStateStore(db);
 registerPushRoutes(app, {
@@ -316,6 +294,15 @@ app.route("/", createServer({
 }));
 const port = Number(process.env.PORT ?? 3141);
 const hostname = process.env.HOST ?? "127.0.0.1";
+servePier({
+    vault,
+    // The deep link an agent's "no secret named X" error carries; loopback when
+    // no public URL is set, since nothing in the process can discover one.
+    fileUrl: (name) => `${settings.get().publicUrl || `http://127.0.0.1:${String(port)}`}/#/settings/vault?name=${name}`,
+    task: (params, callerSessionId) => tasks.handle(params, callerSessionId),
+    // Live in the router, or on disk: the same two places a callback target is looked for.
+    knows: async (id) => router.stateOf(id) !== undefined || (await factory.find(id)) !== undefined,
+});
 // Every command a turn runs inherits this env: `NODE_ENV=production` makes an
 // agent's `npm install` skip devDependencies, and PORT/HOST would aim its dev
 // server at Pier's socket.

package/dist/paths.js

@@ -12,6 +12,9 @@ export const PIER_DB = pierPath("db", "pier.db");
 /** At the root of PIER_HOME: the claim is the whole instance directory, not the
  *  database (lock.ts). */
 export const PIER_LOCK = pierPath("pier.lock");
+/** Where the `pier` CLI reaches the running Pier; the CLI needs the name
+ *  without opening the database (socket.ts). */
+export const PIER_SOCK = pierPath("pier.sock");
 /** `PI_CODING_AGENT_DIR` is an operator override — unless it equals
  *  `PIER_AGENT_DIR`, the value Pier itself set: then a Pier spawned from inside
  *  another inherited it, and a leak is not an instruction. */

package/dist/secrets.js

@@ -146,7 +146,8 @@ function open(key, sealed, aad) {
     decipher.setAuthTag(tag);
     return Buffer.concat([decipher.update(ct), decipher.final()]);
 }
-const vtCli = {
+/** The real vt; vault.ts creates its `approve` records through the same client. */
+export const vtCli = {
     read: (record) => run("vt", ["read", record]),
     create: async (plaintext) => {
         const out = await run("vt", ["create"], plaintext);