create-byan-agent 2.25.0 → 2.27.0

package/install/lib/platforms/claude-code.js

@@ -73,7 +73,7 @@ async function install(projectRoot, agents, config, options = {}) {
   
   if (useAgent) {
     logger.info('Using agent Claude for native MCP integration...');
-    return await installViaCopilotAgent(projectRoot, agents, config);
+    return await installViaClaudeAgent(projectRoot, agents, config);
   } else {
     logger.info('Using direct MCP configuration...');
     return await installDirectMCP(projectRoot, agents, config);
@@ -88,7 +88,7 @@ async function install(projectRoot, agents, config, options = {}) {
  * @param {Object} config
  * @returns {Promise<{success: boolean, installed: number, method: string}>}
  */
-async function installViaCopilotAgent(projectRoot, agents, config) {
+async function installViaClaudeAgent(projectRoot, agents, config) {
   const agentLauncher = require('../yanstaller/agent-launcher');
   
   // Check if native launch is available

package/install/lib/platforms/index.js

@@ -7,8 +7,6 @@
  */
 
 module.exports = {
-  'copilot-cli': require('./copilot-cli'),
-  'vscode': require('./vscode'),
   'claude': require('./claude-code'),
   'codex': require('./codex')
 };

package/install/lib/project-agents-generator.js

@@ -175,15 +175,15 @@ async function generateProjectAgentsDoc(phase2Results, genericAnswers, domainAns
   lines.push('### Activate Core Agents');
   lines.push('');
   lines.push('```bash');
-  lines.push('copilot');
-  lines.push('# Then type: /agent');
+  lines.push('claude');
+  lines.push('# Then type: @hermes');
   lines.push('# Select the agent you need');
   lines.push('```');
   lines.push('');
   lines.push('### Create Custom Agents');
   lines.push('');
   lines.push('```bash');
-  lines.push('copilot --agent=byan');
+  lines.push('claude --agent=byan');
   lines.push('# Select: 1. Create New Agent');
   lines.push('# Follow the interview process');
   lines.push('```');

package/install/lib/staging-consent.js

@@ -25,7 +25,7 @@ const CONSENT_NOTICE = [
   chalk.yellow.bold('BYAN memory-sync — consent requis'),
   '',
   'Si vous activez cette option, apres chaque interaction avec',
-  'Claude Code ou Copilot CLI, BYAN envoie automatiquement a votre',
+  'Claude Code, BYAN envoie automatiquement a votre',
   'instance byan_web les elements suivants :',
   '',
   '  - messages utilisateur (prompts)',
@@ -125,12 +125,12 @@ async function setupStagingConsent(projectRoot, options = {}) {
       console.log(chalk.green('  OK memory-sync ENABLED in ' + path.relative(projectRoot, target)));
       console.log(
         chalk.gray(
-          '     a chaque fin de turn, votre hook Stop (Claude) et votre'
+          '     a chaque fin de turn, votre hook Stop (Claude) enverra'
         )
       );
       console.log(
         chalk.gray(
-          '     extension Copilot staging enverront les memoires a byan_web.'
+          '     les memoires de la session a byan_web.'
         )
       );
     } else {

package/install/lib/subagent-generator.js

@@ -1,9 +1,9 @@
 /**
  * BMAD subagent generator (AW2).
  *
- * Reads a BYAN Copilot agent stub (.github/agents/<name>.md — YAML
- * frontmatter + XML persona block) and emits a Claude Code native
- * subagent file at .claude/agents/bmad-<slug>.md with :
+ * Reads a BYAN agent stub (YAML frontmatter + XML persona block) and
+ * emits a Claude Code native subagent file at .claude/agents/bmad-<slug>.md
+ * with :
  *   - frontmatter : name, description, model, color
  *   - body : system prompt derived from <persona> + <rules> + <menu>
  *

package/install/lib/yanstaller/agent-launcher.js

@@ -13,7 +13,7 @@ const logger = require('../utils/logger');
 /**
  * @typedef {Object} LaunchOptions
  * @property {string} agent - Agent name (e.g., 'claude', 'marc')
- * @property {string} platform - Platform ID (e.g., 'copilot-cli', 'claude')
+ * @property {string} platform - Platform ID (e.g., 'claude', 'codex')
  * @property {string} [prompt] - Initial prompt/action
  * @property {string} [model] - Model to use
  * @property {Object} [config] - Additional config
@@ -31,32 +31,6 @@ const logger = require('../utils/logger');
  * Platform-specific launch configurations
  */
 const LAUNCH_CONFIGS = {
-  'copilot-cli': {
-    command: 'gh',
-    args: (agent, options) => {
-      const args = ['copilot'];
-      
-      // Use @agent syntax if available
-      if (agent) {
-        args.push(`@bmad-agent-${agent}`);
-      }
-      
-      if (options.prompt) {
-        args.push(options.prompt);
-      }
-      
-      return args;
-    },
-    checkAvailable: () => {
-      try {
-        execSync('which gh', { stdio: 'ignore' });
-        return true;
-      } catch {
-        return false;
-      }
-    }
-  },
-  
   'claude': {
     command: 'claude',
     args: (agent, options = {}) => {

package/install/lib/yanstaller/detector.js

@@ -25,7 +25,7 @@ const platforms = require('../platforms');
 
 /**
  * @typedef {Object} PlatformInfo
- * @property {string} name - 'copilot-cli' | 'vscode' | 'claude' | 'codex'
+ * @property {string} name - 'claude' | 'codex'
  * @property {boolean} detected
  * @property {string} [path] - Installation path if detected
  * @property {string} [version] - Version if detected
@@ -50,7 +50,7 @@ async function detect() {
   ]);
   
   // Platform detection with timeout protection
-  const platformNames = ['copilot-cli', 'vscode', 'claude', 'codex'];
+  const platformNames = ['claude', 'codex'];
   const platformsInfo = await Promise.all(
     platformNames.map(name => detectPlatform(name))
   );
@@ -63,7 +63,7 @@ async function detect() {
       .map(p => `${p.name}: ${p.error}`)
       .join(', ');
     if (errors) {
-      logger.warn(`0/4 platforms detected. Errors: [${errors}]`);
+      logger.warn(`0/${platformNames.length} platforms detected. Errors: [${errors}]`);
     }
   }
   
@@ -95,7 +95,7 @@ function isNodeVersionValid(currentVersion, requiredVersion) {
  * 
  * Non-blocking: errors are caught and returned in result.
  * 
- * @param {string} platformName - 'copilot-cli' | 'vscode' | 'claude' | 'codex'
+ * @param {string} platformName - 'claude' | 'codex'
  * @returns {Promise<PlatformInfo>}
  */
 async function detectPlatform(platformName) {

package/install/lib/yanstaller/installer.js

@@ -113,8 +113,6 @@ async function copyAgentFile(agentName, targetPath) {
  */
 async function generateStub(agentName, platform, targetPath) {
   // TODO: Generate stub based on platform
-  // - Copilot CLI: .github/agents/{agentName}.md with YAML frontmatter
-  // - VSCode: Same as Copilot CLI
   // - Claude Code: MCP config JSON
   // - Codex: .codex/prompts/{agentName}.md
 }

package/install/lib/yanstaller/interviewer.js

@@ -40,7 +40,7 @@ async function ask(recommendation) {
     language: 'English',
     mode: recommendation.mode,
     agents: recommendation.agents,
-    targetPlatforms: ['copilot-cli'],
+    targetPlatforms: ['claude'],
     createSampleAgent: false
   };
 }

package/install/lib/yanstaller/platform-selector.js

@@ -14,7 +14,7 @@ const platforms = require('../platforms');
 /**
  * @typedef {Object} PlatformChoice
  * @property {string} name - Display name
- * @property {string} id - Platform ID ('copilot-cli' | 'vscode' | 'claude' | 'codex')
+ * @property {string} id - Platform ID ('claude' | 'codex')
  * @property {boolean} detected - Is platform installed?
  * @property {string} [path] - Installation path if detected
  * @property {boolean} native - Native integration available?
@@ -29,12 +29,6 @@ const platforms = require('../platforms');
  */
 
 const PLATFORM_INFO = {
-  'copilot-cli': {
-    displayName: 'GitHub Copilot CLI',
-    native: true,
-    specialist: 'marc',
-    icon: '🤖'
-  },
   'claude': {
     displayName: 'Claude Code',
     native: true,
@@ -46,12 +40,6 @@ const PLATFORM_INFO = {
     native: true, // NOW NATIVE!
     specialist: 'codex',
     icon: '📝'
-  },
-  'vscode': {
-    displayName: 'VS Code',
-    native: false,
-    specialist: null,
-    icon: '💻'
   }
 };
 

package/install/package.json

@@ -1,7 +1,7 @@
 {
   "name": "create-byan-agent",
-  "version": "2.19.0",
-  "description": "BYAN v2.2.2 - Intelligent AI agent installer with multi-platform native support (GitHub Copilot CLI, Claude Code, Codex/OpenCode)",
+  "version": "2.27.0",
+  "description": "BYAN - Intelligent AI agent installer with multi-platform native support (Claude Code, Codex/OpenCode)",
   "bin": {
     "create-byan-agent": "bin/create-byan-agent-v2.js"
   },

package/install/packages/platform-config/README.md

@@ -22,6 +22,7 @@ const {
   tokenPrompt,
   validate,
   urlUtils,
+  credentials,
 } = require('byan-platform-config');
 ```
 
@@ -92,6 +93,27 @@ urlUtils.buildAuthHeader('byan_abc');       // → { Authorization: 'ApiKey byan
 urlUtils.buildAuthHeader('eyJ...');         // → { Authorization: 'Bearer eyJ...' }
 ```
 
+### credentials — global `~/.byan/credentials.json`
+
+The byan MCP server resolves its own config (`BYAN_API_URL`, `BYAN_API_TOKEN`,
+`LEANTIME_API_URL`, `LEANTIME_API_TOKEN`) at boot. `credentials.writeCredentials`
+persists those to a global, per-user, gitignored, chmod-600 file so the config
+is portable across shells (zsh/fish/bash) and OSes (`os.homedir()` resolves `~`
+on Unix and `%USERPROFILE%` on Windows) and reaches Claude Code AND Codex —
+without depending on `.mcp.json` `${...}` expansion.
+
+| Function | Signature | Description |
+| --- | --- | --- |
+| `writeCredentials` | `(values, { homedir? }) -> { path, written }` | merge-write the known keys; created at mode 0600; idempotent; ignores `${...}`/empty |
+| `readCredentials` | `(homedir?) -> object` | `{}` on a missing/invalid file (does not throw) |
+| `credentialsPath` | `(homedir?) -> string` | `<homedir>/.byan/credentials.json` |
+
+**Resolution precedence (server side):** `process.env` (a real value; an
+unexpanded `${...}` is treated as absent) `->` `~/.byan/credentials.json` `->`
+`http://localhost:3737`. A real `BYAN_API_URL` env var therefore still wins
+(prod sidecar / Docker / CI), the global file is the local-dev fallback, and the
+token is kept out of `.mcp.json`.
+
 ## Test
 
 ```bash
@@ -101,7 +123,8 @@ npm test
 ## Design invariants
 
 - READ-MERGE-WRITE on every file operation — unknown keys are preserved.
-- `ensureMcpConfig` keeps `mcpServers.byan.command` and `.args` if already set.
+- `ensureMcpConfig` keeps `mcpServers.byan.command` and `.args` if already set; it writes NO byan config env (the server resolves its own).
+- `writeCredentials` creates the file at mode 0600 (no group/other read window) and is a no-op-safe merge.
 - `validateByanWebReachability` resolves instead of rejecting — errors surface in the result object.
 - `stripApiSuffix` is idempotent and leaves URLs without a `/api` suffix untouched.
 - `buildAuthHeader` returns `{}` (not `{ Authorization: undefined }`) when token is missing.

package/install/packages/platform-config/index.js

@@ -13,4 +13,5 @@ module.exports = {
   tokenPrompt: require('./lib/token-prompt'),
   validate: require('./lib/validate'),
   urlUtils: require('./lib/url-utils'),
+  credentials: require('./lib/credentials'),
 };

package/install/packages/platform-config/lib/credentials.js

@@ -0,0 +1,101 @@
+/**
+ * Global per-user credentials file: ~/.byan/credentials.json.
+ *
+ * The byan MCP server resolves its config (BYAN_API_URL / BYAN_API_TOKEN /
+ * LEANTIME_API_URL / LEANTIME_API_TOKEN) from this file when the matching env
+ * var is absent (see _byan/mcp/byan-mcp-server/lib/resolve-config.js). Writing
+ * it here with Node fs is cross-shell AND cross-OS: os.homedir() resolves ~ on
+ * Unix and %USERPROFILE% on Windows, so a yanstaller install configures the MCP
+ * for every shell (zsh/fish/bash) with no profile editing and no reliance on
+ * the fragile .mcp.json ${} expansion.
+ *
+ * The file holds a secret (the token), so it lives OUTSIDE any repo (under the
+ * user HOME, never committed) and is chmod 600 on Unix.
+ */
+
+const os = require('os');
+const path = require('path');
+const fs = require('fs-extra');
+
+// Keys the credentials file understands. Any other key passed in is ignored.
+const KNOWN_KEYS = ['BYAN_API_URL', 'BYAN_API_TOKEN', 'LEANTIME_API_URL', 'LEANTIME_API_TOKEN'];
+
+function credentialsDir(homedir = os.homedir()) {
+  return path.join(homedir, '.byan');
+}
+
+function credentialsPath(homedir = os.homedir()) {
+  return path.join(credentialsDir(homedir), 'credentials.json');
+}
+
+// A value worth persisting: a non-empty string that is NOT an unexpanded
+// ${..} placeholder (persisting a placeholder would defeat the whole point).
+function usable(v) {
+  return typeof v === 'string' && v.trim().length > 0 && !/^\$\{.+\}$/.test(v.trim());
+}
+
+/**
+ * Read the credentials file. Missing file or invalid JSON yields {} -- never
+ * throws, so a first run or a corrupted file does not break the installer.
+ *
+ * @param {string} [homedir=os.homedir()]
+ * @returns {Promise<object>}
+ */
+async function readCredentials(homedir = os.homedir()) {
+  try {
+    const data = await fs.readJson(credentialsPath(homedir));
+    return data && typeof data === 'object' ? data : {};
+  } catch {
+    return {};
+  }
+}
+
+/**
+ * Merge-write the global credentials file. Only the known, usable keys in
+ * `values` are written; existing keys are preserved (idempotent: re-running
+ * with the same values leaves the content unchanged). The directory is created
+ * if absent and the file is chmod 600 on Unix (best-effort: a platform without
+ * POSIX modes, e.g. Windows, swallows the chmod rather than failing the install).
+ *
+ * @param {object} values  subset of KNOWN_KEYS -> string
+ * @param {{ homedir?: string }} [opts]
+ * @returns {Promise<{ path: string, written: string[] }>}
+ */
+async function writeCredentials(values = {}, opts = {}) {
+  const homedir = opts.homedir || os.homedir();
+  const dir = credentialsDir(homedir);
+  const file = credentialsPath(homedir);
+
+  const current = await readCredentials(homedir);
+  const next = { ...current };
+  const written = [];
+  for (const key of KNOWN_KEYS) {
+    if (usable(values[key])) {
+      next[key] = values[key];
+      written.push(key);
+    }
+  }
+
+  await fs.mkdirp(dir);
+  // Create restrictively AT THE SOURCE: the `mode` option makes a NEW file land
+  // at 0600 directly, closing the TOCTOU window where a write-then-chmod would
+  // expose the token at the umask default (0644, group/other-readable) between
+  // the two syscalls. `mode` only applies when the file is created, so the
+  // chmod below still runs to tighten a pre-existing file on overwrite.
+  await fs.writeFile(file, JSON.stringify(next, null, 2) + '\n', { mode: 0o600 });
+  try {
+    await fs.chmod(file, 0o600);
+  } catch {
+    // POSIX modes unsupported (e.g. Windows / exotic FS): the file is still
+    // written, just without the 600 tightening. Do not fail the install.
+  }
+  return { path: file, written };
+}
+
+module.exports = {
+  writeCredentials,
+  readCredentials,
+  credentialsPath,
+  credentialsDir,
+  KNOWN_KEYS,
+};

package/install/packages/platform-config/lib/mcp-config.js

@@ -2,30 +2,34 @@
  * .mcp.json management.
  *
  * READ-MERGE-WRITE semantics : preserves all existing mcpServers.* entries
- * and, if byan entry already exists, preserves its command/args. Only the
- * env.BYAN_API_URL is authoritative from caller.
+ * and, if the byan entry already exists, preserves its command/args. The byan
+ * entry carries NO config env: the MCP server resolves its own config at boot
+ * (env -> ~/.byan/credentials.json -> localhost) via
+ * _byan/mcp/byan-mcp-server/lib/resolve-config.js. This is portable across
+ * shells/OSes and covers Claude Code AND Codex, and does not depend on the
+ * fragile .mcp.json ${} expansion (which silently passed a literal "${...}" to
+ * the server) nor on Claude Code injecting settings.local.json env into MCP
+ * spawns (which proved unreliable).
  *
- * Security: BYAN_API_TOKEN is NEVER written into .mcp.json (which is
- * checked into git). The token lives exclusively in:
- *   - .env (gitignored, for shell tools and Codex CLI)
- *   - .claude/settings.local.json (gitignored, for Claude Code MCP injection)
+ * Security: BYAN_API_TOKEN is NEVER written into .mcp.json (which is checked
+ * into git). The token + URL live in the global, gitignored, chmod-600
+ * ~/.byan/credentials.json (credentials.writeCredentials), and the token also
+ * stays in .env / .claude/settings.local.json (gitignored) for shell tools.
  *
- * Claude Code reads .claude/settings.local.json's "env" block at startup and
- * injects those vars into every MCP server it spawns. So the token reaches
- * the byan MCP server via that channel — no need to declare it in .mcp.json.
- *
- * The `token` parameter on this module's API is kept for backward-compat
- * but is intentionally discarded (with a one-line audit trail in the
- * returned result). Callers that supply a token should instead use
- * envConfig.updateDotenv + envConfig.updateSettingsLocal.
+ * The `apiUrl`/`token` parameters on this module's API are kept for
+ * backward-compat but are intentionally NOT written into .mcp.json: callers
+ * persist them via credentials.writeCredentials (and envConfig for .env /
+ * settings.local). mergeByanEntry additionally repairs a stale entry by
+ * stripping any BYAN_API_URL/BYAN_API_TOKEN it carried.
  */
 
 const path = require('path');
 const fs = require('fs-extra');
-const { stripApiSuffix } = require('./url-utils');
 
 const MCP_SERVER_REL_PATH = '_byan/mcp/byan-mcp-server/server.js';
 const TOKEN_PLACEHOLDER = '${BYAN_API_TOKEN}';
+const LEANTIME_URL_PLACEHOLDER = '${LEANTIME_API_URL}';
+const LEANTIME_TOKEN_PLACEHOLDER = '${LEANTIME_API_TOKEN}';
 
 async function readJsonOrEmpty(filePath) {
   if (await fs.pathExists(filePath)) {
@@ -65,24 +69,33 @@ async function readMcpConfig(projectRoot) {
  * @param {{ apiUrl: string, token?: string }} opts — `token` is accepted but discarded
  * @returns {object} new merged config
  */
-function mergeByanEntry(existingConfig, { apiUrl } = {}) {
+function mergeByanEntry(existingConfig, { apiUrl, token } = {}) {
   const cfg = existingConfig && typeof existingConfig === 'object' ? { ...existingConfig } : {};
   cfg.mcpServers = { ...(cfg.mcpServers || {}) };
 
   const existing = cfg.mcpServers.byan || {};
-  const cleanUrl = stripApiSuffix(apiUrl);
 
+  // The MCP server resolves its OWN config (env -> ~/.byan/credentials.json ->
+  // localhost) via _byan/mcp/byan-mcp-server/lib/resolve-config.js, so .mcp.json
+  // carries NO byan config env. `apiUrl`/`token` are accepted for backward-compat
+  // but are intentionally NOT written here: the URL + token are persisted to the
+  // global ~/.byan/credentials.json (credentials.writeCredentials) instead. This
+  // also REPAIRS a stale entry that carried BYAN_API_URL (incl. an unexpanded
+  // ${BYAN_API_URL}) by stripping it. Any other pre-existing env key (e.g. the
+  // Leantime refs) is preserved.
   const env = { ...(existing.env || {}) };
-  env.BYAN_API_URL = cleanUrl;
+  delete env.BYAN_API_URL;
   delete env.BYAN_API_TOKEN;
 
-  cfg.mcpServers.byan = {
+  const entry = {
     command: 'node',
     args: [MCP_SERVER_REL_PATH],
     ...existing,
-    env,
   };
+  if (Object.keys(env).length > 0) entry.env = env;
+  else delete entry.env;
 
+  cfg.mcpServers.byan = entry;
   return cfg;
 }
 
@@ -101,6 +114,58 @@ async function ensureMcpConfig(projectRoot, { apiUrl, token } = {}) {
   return { path: filePath };
 }
 
+/**
+ * Pure merge — no I/O. Adds the Leantime env-var REFERENCES to the byan
+ * server entry so the MCP server receives LEANTIME_API_URL / LEANTIME_API_TOKEN
+ * at spawn time via env-var expansion.
+ *
+ * Security: the values written are the literal expansion placeholders
+ * `${LEANTIME_API_URL}` / `${LEANTIME_API_TOKEN}` — NOT the secret. The real
+ * token lives only in .env / .claude/settings.local.json (gitignored). The
+ * placeholder strings do not match any token shape, so the anti-secret guard
+ * is never tripped.
+ *
+ * Existing env keys (e.g. BYAN_API_URL) are preserved. If the byan entry does
+ * not exist yet, a minimal one is created so the refs are not dropped on a
+ * fresh install.
+ *
+ * @param {object} existingConfig — current parsed config
+ * @returns {object} new merged config
+ */
+function mergeLeantimeRefs(existingConfig) {
+  const cfg = existingConfig && typeof existingConfig === 'object' ? { ...existingConfig } : {};
+  cfg.mcpServers = { ...(cfg.mcpServers || {}) };
+
+  const existing = cfg.mcpServers.byan || {};
+  const env = { ...(existing.env || {}) };
+  env.LEANTIME_API_URL = LEANTIME_URL_PLACEHOLDER;
+  env.LEANTIME_API_TOKEN = LEANTIME_TOKEN_PLACEHOLDER;
+
+  cfg.mcpServers.byan = {
+    command: 'node',
+    args: [MCP_SERVER_REL_PATH],
+    ...existing,
+    env,
+  };
+
+  return cfg;
+}
+
+/**
+ * Ensures the byan entry in .mcp.json carries the Leantime env-var references.
+ * READ-MERGE-WRITE. Idempotent : re-running leaves the refs unchanged.
+ *
+ * @param {string} projectRoot
+ * @returns {Promise<{ path: string }>}
+ */
+async function ensureLeantimeRefs(projectRoot) {
+  const filePath = path.join(projectRoot, '.mcp.json');
+  const current = await readJsonOrEmpty(filePath);
+  const merged = mergeLeantimeRefs(current);
+  await fs.writeJson(filePath, merged, { spaces: 2 });
+  return { path: filePath };
+}
+
 /**
  * Adds (or replaces) an arbitrary MCP server entry under mcpServers.<name>.
  * Used by mcp-extensions to register third-party MCPs (gdrive, etc.) without
@@ -154,6 +219,7 @@ async function removeMcpEntry(projectRoot, name) {
 
 const SECRET_SHAPES = [
   /^byan_[a-f0-9]{20,}$/i,                  // byan tokens
+  /^lt_[A-Za-z0-9]{20,}$/,                  // Leantime API key
   /^ghp_[A-Za-z0-9]{30,}$/,                 // GitHub PAT
   /^gho_[A-Za-z0-9]{30,}$/,                 // GitHub OAuth
   /^github_pat_[A-Za-z0-9_]{60,}$/,         // GitHub PAT (new format)
@@ -186,9 +252,13 @@ module.exports = {
   ensureMcpConfig,
   readMcpConfig,
   mergeByanEntry,
+  mergeLeantimeRefs,
+  ensureLeantimeRefs,
   addMcpEntry,
   removeMcpEntry,
   looksLikeSecret,
   MCP_SERVER_REL_PATH,
   TOKEN_PLACEHOLDER,
+  LEANTIME_URL_PLACEHOLDER,
+  LEANTIME_TOKEN_PLACEHOLDER,
 };

package/install/packages/platform-config/lib/token-prompt.js

@@ -10,6 +10,11 @@ const chalk = require('chalk');
 
 const DEFAULT_API_URL = 'http://localhost:3737';
 const ENV_KEYS = ['BYAN_API_TOKEN', 'BYAN_API_URL'];
+const LEANTIME_ENV_KEYS = [
+  'LEANTIME_API_URL',
+  'LEANTIME_API_TOKEN',
+  'LEANTIME_ASSIGN_USER_ID',
+];
 
 /**
  * @returns {Promise<{ configured: boolean, apiUrl?: string, token?: string }>}
@@ -54,8 +59,84 @@ async function promptForToken() {
   };
 }
 
+/**
+ * Interactive prompt for an optional Leantime board connection.
+ *
+ * Leantime is a SELF-HOSTED, per-instance board : every user points at THEIR
+ * own instance with THEIR own API key — there is no shared token. The prompt
+ * is opt-in (default no) and, when declined, returns { configured: false }
+ * without touching anything.
+ *
+ * The URL field warns about the wrong-host trap : Leantime serves the HTML app
+ * and the JSON-RPC API on the same domain, so the value must be the BACKEND
+ * host (the one answering /api/jsonrpc), not the UI host. Pointing at the UI
+ * host makes the API return an HTML login page (the non_json failure).
+ *
+ * @returns {Promise<{ configured: boolean, apiUrl?: string, token?: string, assignUserId?: string }>}
+ */
+async function promptForLeantime() {
+  const { wantsLeantime } = await inquirer.prompt([
+    {
+      type: 'confirm',
+      name: 'wantsLeantime',
+      message:
+        'Connect a self-hosted Leantime board for FD -> board sync ? ' +
+        chalk.gray('(optional — your own Leantime instance + API key)'),
+      default: false,
+    },
+  ]);
+
+  if (!wantsLeantime) return { configured: false };
+
+  const answers = await inquirer.prompt([
+    {
+      type: 'input',
+      name: 'apiUrl',
+      message:
+        'Leantime backend URL ' +
+        chalk.yellow('(the host answering /api/jsonrpc, NOT the UI host):'),
+      validate: (v) =>
+        /^https?:\/\//.test(String(v).trim()) ||
+        'Must start with http:// or https://',
+    },
+    {
+      type: 'password',
+      name: 'token',
+      message:
+        'Leantime API key ' +
+        chalk.gray('(Company Settings -> Cle d\'API -> Generate, prefix lt_):'),
+      mask: '*',
+      validate: (v) =>
+        (typeof v === 'string' && v.trim().length > 0) || 'Token cannot be empty',
+    },
+    {
+      type: 'input',
+      name: 'assignUserId',
+      message:
+        'Your Leantime user id ' +
+        chalk.gray('(optional — board shows in your selector + default assignee; Enter to skip):'),
+      default: '',
+      validate: (v) => {
+        const t = String(v).trim();
+        return t === '' || /^\d+$/.test(t) || 'Must be a number (or empty to skip)';
+      },
+    },
+  ]);
+
+  const result = {
+    configured: true,
+    apiUrl: answers.apiUrl.trim(),
+    token: answers.token.trim(),
+  };
+  const assignUserId = String(answers.assignUserId || '').trim();
+  if (assignUserId) result.assignUserId = assignUserId;
+  return result;
+}
+
 module.exports = {
   promptForToken,
+  promptForLeantime,
   ENV_KEYS,
+  LEANTIME_ENV_KEYS,
   DEFAULT_API_URL,
 };