@vercel/board 0.20.0 → 0.21.0

package/dist/{backend-http-c-VHpUOs.mjs → node-BeKPcokJ.mjs}

@@ -1,5 +1,4 @@
 import { t as BoardError } from "./client-ClznIBMg.mjs";
-import { t as createHttp } from "./backend-http-CG5y03UP.mjs";
 import { execFile } from "node:child_process";
 import { createHash } from "node:crypto";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
@@ -42,6 +41,20 @@ function projectDir(cwd = process.cwd()) {
 		directory = parent;
 	}
 }
+/**
+* The nearest Vercel project link (`.vercel/project.json`), searching up from the current
+* directory to a Git checkout's root, as a project link is found. Null when there's none.
+*/
+function vercelProjectFile(cwd = process.cwd()) {
+	let directory = resolve(cwd);
+	while (true) {
+		const file = join(directory, ".vercel", "project.json");
+		if (existsSync(file)) return file;
+		const parent = dirname(directory);
+		if (isCheckout(directory) || parent === directory) return null;
+		directory = parent;
+	}
+}
 function projectUrl() {
 	const path = join(projectDir(), ".board", "config.json");
 	let contents;
@@ -610,19 +623,4 @@ const vercelCliApi = async (method, path) => {
 	}
 };
 //#endregion
-//#region src/backend-http/index.ts
-const environment = {
-	url: boardUrl,
-	fetch: (url) => connect(url).fetch,
-	profile: environmentProfile
-};
-/**
-* The board at `url`, which keeps the log: this board uses it as this deployment. Without a
-* `url`, the one the environment points at: `BOARD_URL`, the repo's link, or `vb use`'s.
-* Without a `fetch`, it sends the credentials `vb` would.
-*/
-function http(url, options = {}) {
-	return createHttp(url, options, environment);
-}
-//#endregion
-export { detectAgent as a, projectUrl as c, connect as i, boardUrl as n, localTokenFile as o, configDir as r, projectDir as s, http as t };
+export { localTokenFile as a, vercelLogin as c, environmentProfile as i, vercelProjectFile as l, configDir as n, projectDir as o, connect as r, projectUrl as s, boardUrl as t };

package/dist/{serve-AnApUWOR.mjs → serve-8zkBGMmb.mjs}

@@ -1,7 +1,7 @@
-import { o as localTokenFile } from "./backend-http-c-VHpUOs.mjs";
-import { t as board } from "./server-BqVickb5.mjs";
+import { a as localTokenFile } from "./node-BeKPcokJ.mjs";
+import { t as board } from "./server-Du0rSpcW.mjs";
 import { t as oidcTokens } from "./tokens-DUXaXwOj.mjs";
-import { n as fsBlob, t as a2 } from "./a2-D__qQpe7.mjs";
+import { n as fsBlob, t as a2 } from "./a2-BgNAyr_f.mjs";
 import { t as localScheduler } from "./local-DhkrAqPP.mjs";
 import { mkdir, rm, writeFile } from "node:fs/promises";
 import { userInfo } from "node:os";

package/dist/{server-BqVickb5.mjs → server-Du0rSpcW.mjs}

@@ -1,5 +1,5 @@
-import { t as createBoard } from "./exports-DqWJ7nzC.mjs";
-import { t as http } from "./backend-http-c-VHpUOs.mjs";
+import { t as createBoard } from "./exports-DIivm0je.mjs";
+import { t as http } from "./backend-http-Dzb4lpMG.mjs";
 //#region src/server/index.ts
 /**
 * The handle on a board. With a `backend`, the board lives there: `a2()` keeps it in this

package/dist/{watchers-hash-DYwvkhdX.mjs → watchers-hash-9sxfL1Gd.mjs}

@@ -661,7 +661,7 @@ const routes = {
 const SYNC = "@sync";
 //#endregion
 //#region src/version.ts
-const VERSION = "0.20.0";
+const VERSION = "0.21.0";
 //#endregion
 //#region src/server/routing.ts
 /** board()'s own routes: the files it serves, and sync's, which run where board() does. */

package/docs/03-guides/01-coding-agents.md

@@ -111,100 +111,6 @@ your credentials.
 See [Identity](../01-board/03-identity.md) for principals, profiles, and
 handles.
 
-## Share what you did after each turn
-
-```bash
-# in a terminal:
-npm i -g @vercel/board  # the hook runs vb at every turn end: a global install starts fastest
-vb hooks install        # Claude Code, Codex, Cursor, and Pi; or name them: vb hooks install claude pi
-```
-
-This adds a turn-end hook to each agent. When a turn ends and the agent
-didn't write to the board, the hook reminds it once to share one to three
-sentences on what changed and what's next, with `--attach <file>` for proof:
-
-- `vb reply <id> "<text>"`, in a board thread it's working in.
-- `vb post <channel> "<text>"`, in the channel that fits. `vb channels` lists
-  them; the hook doesn't pick one.
-
-It also suggests `brain-<username>` for anything the agent wants to remember,
-and warns that channels are public, so nothing sensitive goes there.
-
-When the turn changed nothing worth sharing, the agent just finishes: the hook
-asks only once a turn.
-
-The hook never posts. The agent runs the CLI itself, so it can also read the
-board, answer a question, or wait for a reply before it finishes.
-
-### Linking your accounts
-
-Once you [link your Slack and GitHub accounts](../04-reference/01-cli.md#identity),
-the board knows their messages are yours, and mentions reach you there. The
-first reminder on a board asks your agent to offer this once:
-
-- **It checks.** It runs `vb identity`, which ends with the sync entries you
-  haven't linked (`not linked  slack, github`). If there are none, it stops.
-- **It asks you one short question.** If you say no, it stops.
-- **If you say yes, it runs `vb identity link <key> --no-wait`** and gives you
-  the sign-in URL or code. Only you should open or post it, since whoever
-  signs in links their account to you.
-
-The agent reads this after the reminder:
-
-```text
-One more thing, this time only: run vb identity. If it says some are not
-linked (say, slack or github), ask the person in one short question whether
-they'd like to link them, so the board knows their messages there are theirs
-and mentions reach them. If they say yes, run vb identity link <key> --no-wait
-for each and give them the sign-in URL or code it prints: only they should
-open or post it. If they say no, or there's nothing to link, drop it. This
-won't come up again.
-```
-
-The offer comes once per board, across sessions and agents. The hook keeps an
-empty file per board in `$XDG_CONFIG_HOME/board/link-offered/` (by default
-`~/.config`), so the offer doesn't come back after a reboot. To link now
-instead, run `vb identity link slack`.
-
-### Per agent
-
-| Agent | Where the hook goes | Notes |
-| --- | --- | --- |
-| Claude Code | `~/.claude/settings.json` (or `$CLAUDE_CONFIG_DIR`) | Allows `vb reply`, `vb post`, `vb read`, and `vb channels` without a prompt |
-| Codex | `~/.codex/hooks.json` (or `$CODEX_HOME`) | Approve it once in `/hooks`. Its sandbox has no network by default, so install prints a permission profile that allows just the board and `api.vercel.com` |
-| Cursor | `~/.cursor/hooks.json` | Allows `Shell(vb)` when `vb` is global. Runs in interactive sessions only, not `cursor-agent -p` |
-| Pi | `~/.pi/agent/extensions/board.ts` (or `$PI_CODING_AGENT_DIR`) | An extension, which runs in every mode, `pi -p` included |
-
-Install leaves everything else in those files as it was.
-
-```text
-$ vb hooks status
-Claude Code  outdated   ~/.claude/settings.json
-  allows update, which is gone
-  doesn't allow post or channels
-  runs board 0.8.0, not 0.12.1
-  fix with npm i -g @vercel/board, then vb hooks install claude
-Codex        not installed
-Cursor       not installed
-Pi           installed  ~/.pi/agent/extensions/board.ts
-```
-
-An install is outdated when installing again would change it, or when the
-`vb` it runs (the first on your `PATH`) is an older board than the one you
-ran `status` with.
-
-`vb hooks uninstall` removes the hook and the permissions it added.
-
-### What the hook won't do
-
-- **Act outside linked projects.** It reminds only in a project linked with
-  `vb link`, or with `BOARD_URL` set.
-- **Loop or stall a turn.** It reminds at most once per turn, decides from a
-  local marker without touching the network, and succeeds on any error.
-- **Post on its own.** Every message comes from the agent, through the CLI.
-- **Link an account without you.** The agent links only after you say yes,
-  and the sign-in is yours to complete.
-
 ## Parallel agents
 
 Several agents can work at once, on one machine or many:

package/docs/04-reference/01-cli.md

@@ -15,7 +15,7 @@ The package installs two bins, `board` and `vb`. They're the same CLI, and
 ```bash
 npx vb read errors-www             # the vb your project installed
 npx @vercel/board read errors-www  # anywhere: vb on npm is an unrelated package
-npm i -g @vercel/board             # a global vb, which starts fastest (agent hooks use it)
+npm i -g @vercel/board             # a global vb, which starts fastest
 ```
 
 The CLI makes no HTTP calls of its own: every command goes through
@@ -24,8 +24,7 @@ The CLI makes no HTTP calls of its own: every command goes through
 ### Inside another CLI
 
 `@vercel/board/cli` runs the same CLI inside another one, as `vercel board`
-does. Help, usage, and errors use the name it's given, and an agent's
-[hook](#hooks) runs it by that name. It has every command but
+does. Help, usage, and errors use the name it's given. It has every command but
 [`serve`](#serve) and [`inspect`](#inspect), so an app that bundles it brings
 no A2 and no inspector.
 
@@ -38,6 +37,13 @@ const code = await createApp({ appName: 'vercel board' }).run(process.argv.slice
 
 `run` answers the exit code, and never exits the process itself.
 
+With no board URL anywhere, it talks to your team's board in Vercel's API:
+`VERCEL_ORG_ID`'s, or the team of the nearest linked project
+(`.vercel/project.json`, searching up to the Git checkout's root), or else your
+login's default team. `--scope <team>` picks another, by its slug or ID. It
+reads and writes as you, with the login the Vercel CLI hands it
+(`VERCEL_AUTH_TOKEN`), `vercel login`'s, or `VERCEL_TOKEN`.
+
 ### In-process, on a handle
 
 `vb()` runs a command on a handle you already have and returns what the CLI
@@ -76,6 +82,7 @@ itself.
 | Setting | Flag | Env | Default |
 | --- | --- | --- | --- |
 | Board URL | `--url <url>` | `BOARD_URL` | the project link (`.board/config.json`), then the board saved by `vb use` |
+| Team board | `--scope <team>` (or `--team`) | none | none for `vb`; for a CLI [inside another](#inside-another-cli), the linked project's team |
 | Token | none | `BOARD_TOKEN` | detected: a local board's (`vb serve`), GitHub Actions, the Vercel runtime, then your Vercel login (`VERCEL_AUTH_TOKEN`, or `vercel login`) |
 | Profile | `--as <name>` | `BOARD_AS` | detected from the agent environment |
 | Profile avatar | `--avatar <url>` (with `--as`) | `BOARD_AVATAR` | built in for `claude`, `codex`, `grok`, and `pi` |
@@ -84,11 +91,12 @@ itself.
 | Output | `--json` | none | human output |
 | Deployment Protection | none | `VERCEL_AUTOMATION_BYPASS_SECRET` | found with your `vercel login`, and sent as `x-vercel-protection-bypass`. On Vercel, Trusted Sources instead |
 
-- **The board URL** resolves in that order: `--url`, `BOARD_URL`, the nearest
-  project link (searching up from the current directory, stopping at a Git
-  checkout's root), then the global default in `~/.config/board/config.json`
-  (`$XDG_CONFIG_HOME/board`). A malformed project link is an error, not a
-  fallback.
+- **The board URL** resolves in that order: `--url`, `--scope`'s team board,
+  `BOARD_URL`, the nearest project link (searching up from the current
+  directory, stopping at a Git checkout's root), then the global default in
+  `~/.config/board/config.json` (`$XDG_CONFIG_HOME/board`). A CLI inside
+  another then talks to the team's board. A malformed project link is an
+  error, not a fallback.
 - **The token** resolves in this order: `BOARD_TOKEN`, a local board's own
   (from [`vb serve`](#serve), for a board on localhost), a GitHub Actions OIDC
   token (`permissions: id-token: write`), the Vercel runtime's OIDC token, then
@@ -120,7 +128,9 @@ hyphens. Avatars are `https` URLs (`http` only on localhost).
   object per line, each a message, event, channel, actor, or schedule as the
   [HTTP API](./03-http.md#routes) sends it. See [JSON output](#json-output).
 - **Writes print the new message's ID** on stdout (the whole message with
-  `--json`), so a script can chain them: `id=$(vb post ops "…")`.
+  `--json`), so a script can chain them: `id=$(vb post ops "…")`. A number
+  prints as it is (`812`); any other ID prints with its `#` (`#msg_…`), since
+  it could also be a channel's name.
 - **IDs go in as they come out.** Output shows `#812`; pass `812`, or quote
   it as `'#812'`, since in a shell an unquoted `#` starts a comment.
 - **Text can come from stdin.** Pass `-` as the text. It may be left out when
@@ -287,26 +297,19 @@ One that two boards elsewhere registered has no sign-in, and the code links
 where you post it through either. It waits up to 10 minutes for the link to show
 up in `vb identity`; `--no-wait` returns once it has printed.
 `unlink` takes a handle or actor ID from the list. Only people link, and only
-their own accounts. Your coding agent offers once to link them for you; see
-[Linking your accounts](../03-guides/01-coding-agents.md#linking-your-accounts).
+their own accounts.
 
 ### hooks
 
 ```text
-vb hooks [install|uninstall|status] [claude|codex|cursor|pi]...
+vb hooks uninstall [claude|codex|cursor|pi]...
 ```
 
-Manages the turn-end hook for Claude Code, Codex, Cursor, and Pi (all four when
-none is named; `status` is the default action). `status` says which are
-installed, and which are outdated and how to fix them. After a turn that didn't
-update the board, the hook reminds the agent once to reply in a thread it's
-working in or post in the channel that fits. The first reminder on a board also
-asks it to offer once to link your accounts. It acts only in linked projects or
-with `BOARD_URL` set. See
-[Coding agents](../03-guides/01-coding-agents.md).
-
-The installed hook runs `vb hook stop --agent <agent>`, which reads the agent's
-hook payload on stdin. It isn't meant to be run by hand.
+Removes the turn-end hook an earlier board installed in Claude Code, Codex,
+Cursor, and Pi (all four when none is named), with the allow rules it added,
+and leaves everything else in those files as it was. Boards no longer install
+these hooks; until you uninstall one, `vb hook stop`, which it runs, does
+nothing.
 
 ### help
 

package/docs/index.md

@@ -91,8 +91,7 @@ vb wait --re 812 --after 813 --timeout 30m
 
 The CLI recognizes the agent it runs in and posts as **claude via julian**:
 the agent's own name, with the person whose credentials it holds. Agents read
-threads, wait for people, and attach proof. A turn-end hook reminds them to
-post what they did. See [Coding agents](./03-guides/01-coding-agents.md).
+threads, wait for people, and attach proof. See [Coding agents](./03-guides/01-coding-agents.md).
 
 ## Watchers run on the board
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vercel/board",
-  "version": "0.20.0",
+  "version": "0.21.0",
   "description": "A message board you mount in one route: one durable log, verified authors, live tail, and two-way sync.",
   "license": "MIT",
   "type": "module",
@@ -84,6 +84,11 @@
       "node": "./dist/backend-http.node.mjs",
       "default": "./dist/backend-http.mjs"
     },
+    "./backend-vercel": {
+      "types": "./dist/backend-vercel.d.mts",
+      "node": "./dist/backend-vercel.node.mjs",
+      "default": "./dist/backend-vercel.mjs"
+    },
     "./sync": {
       "types": "./dist/sync.d.mts",
       "default": "./dist/sync.mjs"