create-byan-agent 2.29.2 → 2.38.0

package/install/lib/gdoc-setup.js

@@ -0,0 +1,210 @@
+'use strict';
+
+/**
+ * gdoc-setup -- install-time setup of the byan_publish service-account key.
+ *
+ * BYAN is open source : NO key ships. Each user provides THEIR OWN Google service
+ * account at install time. This module walks the user through creating the SA +
+ * key in the Google Cloud console, imports the downloaded JSON to
+ * ~/.byan/google-sa.json (chmod 0600), and persists the publish config
+ * (GOOGLE_APPLICATION_CREDENTIALS + optional GDOC_TEMPLATE_ID / GDOC_LOGO_PNG_URL)
+ * into ~/.byan/credentials.json via byan-platform-config's writeCredentials. The
+ * byan MCP server then reads them through resolve-config.
+ *
+ * Mirrors the shape of rtk-integration.js : graceful (NEVER throws, ok stays
+ * true so a failed step never breaks the BYAN install), and every side-effecting
+ * dep (prompt / fs / writeCredentials) is injectable, so the whole flow is
+ * unit-tested without touching a real key, the network, or the user HOME.
+ */
+
+const os = require('os');
+const path = require('path');
+const fs = require('fs-extra');
+const chalk = require('chalk');
+const inquirer = require('inquirer');
+const { writeCredentials } = require('byan-platform-config');
+
+const SA_FILENAME = 'google-sa.json';
+
+const SETUP_LINKS = [
+  {
+    step: "Projet Google Cloud (idéalement rattaché à ton org Workspace)",
+    url: 'https://console.cloud.google.com/projectcreate',
+  },
+  {
+    step: 'Activer les APIs Google Docs + Google Drive',
+    url: 'https://console.cloud.google.com/apis/library',
+  },
+  {
+    step: 'Créer un service account',
+    url: 'https://console.cloud.google.com/iam-admin/serviceaccounts',
+  },
+  {
+    step: 'Sur le service account -> Keys -> Add key -> Create new key -> JSON -> télécharger',
+    url: 'https://console.cloud.google.com/iam-admin/serviceaccounts',
+  },
+];
+
+function saDestPath(homedir = os.homedir()) {
+  return path.join(homedir, '.byan', SA_FILENAME);
+}
+
+/**
+ * A plausible service-account key : an object carrying a client_email and a
+ * private_key. Shape-only -- we never validate the key cryptographically.
+ */
+function validateServiceAccount(parsed) {
+  return Boolean(
+    parsed &&
+      typeof parsed === 'object' &&
+      typeof parsed.client_email === 'string' &&
+      parsed.client_email.trim() &&
+      typeof parsed.private_key === 'string' &&
+      parsed.private_key.includes('PRIVATE KEY')
+  );
+}
+
+/**
+ * shouldOfferGdoc() -> offer the setup only when interactive and not opted out
+ * (BYAN_SKIP_GDOC=1). Never prompts in CI / non-TTY.
+ */
+function shouldOfferGdoc({ env = process.env, isTTY = !!(process.stdin && process.stdin.isTTY) } = {}) {
+  if (env && env.BYAN_SKIP_GDOC === '1') return false;
+  return Boolean(isTTY);
+}
+
+function printSetupGuide(log) {
+  log();
+  log(chalk.cyan('Clé service account pour byan_publish (Google Docs headless) :'));
+  log(chalk.gray('  Open source -> tu fournis TA clé ; rien de secret ne ship. ~2 min, une fois.'));
+  SETUP_LINKS.forEach((s, i) => {
+    log(chalk.gray(`  ${i + 1}. ${s.step}`));
+    log(chalk.gray(`     -> ${s.url}`));
+  });
+  log();
+}
+
+/**
+ * setupGdocPublish(deps) -> { ok, configured, ... }. Never throws ; ok stays
+ * true on every path. configured=true only when a valid key was imported and
+ * persisted.
+ *
+ * @param {object} [deps]
+ * @param {Function} [deps.prompt]            inquirer.prompt (injected in tests)
+ * @param {Function} [deps.log]               line sink
+ * @param {string}   [deps.homedir]
+ * @param {object}   [deps.fsImpl]            fs-extra-like (readJson/ensureDir/writeFile/chmod)
+ * @param {Function} [deps.persist]           writeCredentials (injected in tests)
+ * @param {boolean}  [deps.quiet]
+ */
+async function setupGdocPublish(deps = {}) {
+  const prompt = deps.prompt || inquirer.prompt;
+  const homedir = deps.homedir || os.homedir();
+  const fsImpl = deps.fsImpl || fs;
+  const persist = deps.persist || writeCredentials;
+  const log = deps.quiet ? () => {} : deps.log || ((...a) => console.log(...a));
+
+  try {
+    printSetupGuide(log);
+
+    const { hasKey } = await prompt([
+      {
+        type: 'confirm',
+        name: 'hasKey',
+        message: 'Tu as téléchargé le JSON de la clé service account ?',
+        default: false,
+      },
+    ]);
+    if (!hasKey) {
+      return {
+        ok: true,
+        configured: false,
+        skipReason: "Setup reporté -- relance `npm run setup-gdoc` une fois le JSON téléchargé.",
+      };
+    }
+
+    const { jsonPath } = await prompt([
+      {
+        type: 'input',
+        name: 'jsonPath',
+        message: 'Chemin local vers le JSON de la clé SA :',
+        validate: (v) => (v && v.trim().length > 0) || 'Chemin requis',
+      },
+    ]);
+
+    let parsed;
+    try {
+      parsed = await fsImpl.readJson(path.resolve(jsonPath.trim()));
+    } catch (e) {
+      return { ok: true, configured: false, skipReason: `JSON illisible : ${e.message}` };
+    }
+    if (!validateServiceAccount(parsed)) {
+      return {
+        ok: true,
+        configured: false,
+        skipReason:
+          'Ce fichier ne ressemble pas à une clé service account (client_email + private_key requis).',
+      };
+    }
+
+    // Store the key OUTSIDE any repo, in ~/.byan/, at 0600 (created restrictively).
+    const dir = path.join(homedir, '.byan');
+    const dest = saDestPath(homedir);
+    await fsImpl.ensureDir(dir);
+    try {
+      await fsImpl.chmod(dir, 0o700);
+    } catch {
+      // POSIX modes unsupported -> proceed without the dir tightening.
+    }
+    await fsImpl.writeFile(dest, JSON.stringify(parsed, null, 2) + '\n', { mode: 0o600 });
+    try {
+      await fsImpl.chmod(dest, 0o600);
+    } catch {
+      // see above
+    }
+
+    const { templateId } = await prompt([
+      {
+        type: 'input',
+        name: 'templateId',
+        message: 'ID d\'un Google Doc template brandé (optionnel, Entrée pour passer) :',
+        default: '',
+      },
+    ]);
+    const { logoUrl } = await prompt([
+      {
+        type: 'input',
+        name: 'logoUrl',
+        message: 'URL PNG du logo (optionnel, Entrée pour passer) :',
+        default: '',
+      },
+    ]);
+
+    const values = { GOOGLE_APPLICATION_CREDENTIALS: dest };
+    if (templateId && templateId.trim()) values.GDOC_TEMPLATE_ID = templateId.trim();
+    if (logoUrl && logoUrl.trim()) values.GDOC_LOGO_PNG_URL = logoUrl.trim();
+
+    const res = await persist(values, { homedir });
+    log(chalk.green(`  clé SA -> ${dest} (0600)`));
+    log(chalk.gray(`  persisté dans ~/.byan/credentials.json : ${(res.written || []).join(', ')}`));
+    return {
+      ok: true,
+      configured: true,
+      path: dest,
+      persisted: res.written || [],
+      clientEmail: parsed.client_email,
+    };
+  } catch (err) {
+    return { ok: true, configured: false, skipReason: `setup gdoc échoué : ${err.message}` };
+  }
+}
+
+module.exports = {
+  setupGdocPublish,
+  shouldOfferGdoc,
+  validateServiceAccount,
+  printSetupGuide,
+  saDestPath,
+  SETUP_LINKS,
+  SA_FILENAME,
+};

package/install/lib/mcp-extensions/gdrive.js

@@ -16,6 +16,17 @@
  *
  * No credential ever touches the project tree. The .mcp.json entry only
  * declares command/args — every secret stays in ~/.google-mcp/.
+ *
+ * DURABLE + MUTUALIZED AUTH (the design choice): we guide the user to an OAuth
+ * consent screen in "Internal" mode (Workspace-org only). "External + Testing"
+ * expires the refresh token in ~7 days for scopes beyond openid/email/profile
+ * (all of gw's Drive/Docs/... scopes qualify) ; "Internal" does not, and skips
+ * Google app verification (source: developers.google.com/identity/protocols/oauth2).
+ * This OAuth client is THE single Google credential of byan — the claude.ai Drive
+ * connector becomes redundant. NOTE: this package (pm990320/google-workspace-mcp)
+ * does NOT support service accounts (README: "Service account authentication is
+ * not currently supported"), so a service-account JSON is not an option here ;
+ * "Internal" is the durable path that keeps the package's 95+ tools.
  */
 
 'use strict';
@@ -33,7 +44,7 @@ const CREDENTIALS_PATH = path.join(CONFIG_DIR, 'credentials.json');
 
 const SETUP_LINKS = [
   {
-    step: 'Créer un projet Google Cloud',
+    step: 'Créer un projet Google Cloud RATTACHÉ à ton organisation Workspace (ex : acadenice.fr) — pas un compte Gmail perso',
     url: 'https://console.cloud.google.com/projectcreate',
   },
   {
@@ -41,7 +52,7 @@ const SETUP_LINKS = [
     url: 'https://console.cloud.google.com/apis/library',
   },
   {
-    step: 'Configurer l\'écran de consentement OAuth (External, mode Test)',
+    step: 'Écran de consentement OAuth : User type = "Internal" (durable : pas d\'expiration 7 j, pas de vérification Google)',
     url: 'https://console.cloud.google.com/apis/credentials/consent',
   },
   {
@@ -93,6 +104,16 @@ function printSetupGuide(log) {
   log(chalk.gray(`  6. Renommer ce fichier en : credentials.json`));
   log(chalk.gray(`  7. Le placer dans : ${CREDENTIALS_PATH}`));
   log();
+  // The single thing that makes the credential durable. "External + Testing"
+  // expires the refresh token in ~7 days for scopes beyond openid/email/profile
+  // (all gw scopes qualify) ; "Internal" does not, and skips Google app
+  // verification. Source: developers.google.com/identity/protocols/oauth2.
+  log(chalk.yellow('  Durabilité — LE point qui compte :'));
+  log(chalk.yellow('    Écran de consentement en "Internal" → credential pérenne (token qui ne meurt pas).'));
+  log(chalk.yellow('    "External + Testing" → refresh token expiré sous ~7 jours (scopes hors openid/email/profile, donc tous ceux de gw). À éviter.'));
+  log(chalk.gray('    Limite "Internal" : seuls les comptes de ton org Workspace peuvent autoriser, et il faut UN login navigateur au premier setup.'));
+  log(chalk.gray('    Ce client OAuth devient LE credential Google unique de byan (le connecteur claude.ai Drive devient redondant).'));
+  log();
 }
 
 async function importCredentialsFromPath(srcPath, log) {
@@ -174,6 +195,8 @@ async function setup({ quiet } = {}) {
       },
     ]);
     if (reuse) {
+      log(chalk.gray('  Rappel durabilité : si ce client OAuth est en "External + Testing", son token meurt sous ~7 j (scopes Workspace gw concernés).'));
+      log(chalk.gray('  Pour un credential pérenne, l\'écran de consentement doit être en "Internal" (org Workspace).'));
       return { configured: true, message: 'reused existing credentials' };
     }
   } else {
@@ -250,7 +273,9 @@ module.exports = {
   buildMcpEntry,
   // exposed for tests
   buildEntry,
+  printSetupGuide,
   CONFIG_DIR,
   CREDENTIALS_PATH,
   PACKAGE_NAME,
+  SETUP_LINKS,
 };

package/install/lib/platforms/claude-code.js

@@ -11,9 +11,19 @@ const path = require('path');
 const os = require('os');
 const fileUtils = require('../utils/file-utils');
 const logger = require('../utils/logger');
+// Single source of truth for the byan + byan-channel entry shape: the same pure
+// merge the canonical .mcp.json writer uses (READ-MERGE-WRITE, relative paths,
+// no secret, byan-channel inert). installDirectMCP delegates to it instead of
+// hand-building a divergent entry with an absolute path that overwrote siblings.
+const { mcpConfig } = require('byan-platform-config');
 
 const PLATFORM_NAME = 'Claude Code';
-const MCP_SERVER_FILENAME = 'byan-mcp-server.js';
+// Relative path discipline: the byan server entry args[0] is repo-relative
+// (mcpConfig.MCP_SERVER_REL_PATH), NEVER an absolute path. The old
+// MCP_SERVER_FILENAME ('byan-mcp-server.js') was both the wrong filename and
+// joined into an absolute path; both are gone. Kept only as the existence probe
+// target below is the real server file under the relative path.
+const MCP_SERVER_REL_PATH = mcpConfig.MCP_SERVER_REL_PATH;
 
 /**
  * Get config path for current platform
@@ -137,41 +147,40 @@ async function installViaClaudeAgent(projectRoot, agents, config) {
  */
 async function installDirectMCP(projectRoot, agents, config) {
   const configPath = getConfigPath();
-  const mcpServerPath = path.join(projectRoot, MCP_SERVER_FILENAME);
-  
+  // Existence probe against the REAL server file at its repo-relative path
+  // (resolved to absolute only for the fs check). The args written into the
+  // config below stay relative — see mcpConfig.MCP_SERVER_REL_PATH.
+  const mcpServerPath = path.join(projectRoot, MCP_SERVER_REL_PATH);
+
   // Check if MCP server exists
   if (!await fileUtils.exists(mcpServerPath)) {
     logger.warn(`MCP server not found at: ${mcpServerPath}`);
     logger.warn('Run @bmad-agent-claude to generate MCP server first.');
-    
+
     return {
       success: false,
       installed: 0,
       method: 'direct-mcp-failed'
     };
   }
-  
+
   // Backup existing config
   const backupPath = `${configPath}.backup`;
   await fileUtils.copy(configPath, backupPath);
   logger.info(`Backed up config to: ${backupPath}`);
-  
-  // Read and update config
+
+  // READ-MERGE-WRITE through the shared pure merge so this writer is byte-for-byte
+  // identical to the canonical .mcp.json writer: relative server path, no secret,
+  // existing mcpServers.* preserved, and the inert byan-channel entry added.
+  // apiUrl is irrelevant to the entry shape (the server resolves its own config),
+  // but the merge signature accepts it; a localhost placeholder keeps it valid.
   const existingConfig = await fileUtils.readJson(configPath);
-  existingConfig.mcpServers = existingConfig.mcpServers || {};
-  
-  existingConfig.mcpServers.byan = {
-    command: 'node',
-    args: [mcpServerPath],
-    env: {
-      PROJECT_ROOT: projectRoot
-    }
-  };
-  
+  const merged = mcpConfig.mergeByanEntry(existingConfig, { apiUrl: 'http://localhost:3737' });
+
   // Write updated config
-  await fileUtils.writeJson(configPath, existingConfig, { spaces: 2 });
+  await fileUtils.writeJson(configPath, merged, { spaces: 2 });
   logger.info(`Updated MCP config: ${configPath}`);
-  
+
   return {
     success: true,
     installed: agents.length,

package/install/lib/rtk-integration.js

@@ -11,9 +11,10 @@
  *  - We do NOT reimplement per-OS download / checksum / version pinning. We
  *    DELEGATE the install to rtk's own canonical installer (brew / the official
  *    install.sh / cargo), and DELEGATE the Claude Code hook wiring to rtk's own
- *    `rtk init -g`. BYAN maintains only "pick the available installer, run it
- *    bounded + visible, locate the binary, ask rtk to wire its hook" — a tiny
- *    surface, bumped via one constant.
+ *    `rtk init -g --auto-patch` (the `--auto-patch` is what makes it non-
+ *    interactive — see wireHook). BYAN maintains only "pick the available
+ *    installer, run it bounded + visible, locate the binary, ask rtk to wire its
+ *    hook" — a tiny surface, bumped via one constant.
  *  - SUPPLY-CHAIN: we pin to a TAG, never a moving branch. cargo builds the
  *    tagged source (`--tag`), and install.sh is fetched from the IMMUTABLE tag ref.
  *    That script verifies a SHA-256 of the downloaded binary against a published
@@ -38,7 +39,7 @@
  *
  * Mirrors the ENTRY-POINT shape of byan-web-integration.js / byan-leantime-
  * integration.js (one `setup*Integration`); the return contract is { ok, synced,
- * reason, ... } because persistence is owned by rtk's own `rtk init -g`, not by
+ * reason, ... } because persistence is owned by rtk's own `rtk init -g --auto-patch`, not by
  * byan-platform-config.
  */
 
@@ -187,18 +188,27 @@ function doctor({ run = execSync, has = commandExists, resolve = resolveBinary,
     bin: s.bin,
     pinned: RTK_VERSION,
     repo: RTK_REPO,
-    hookCommand: 'rtk init -g',
+    hookCommand: 'rtk init -g --auto-patch',
   };
 }
 
 // Delegate the Claude Code hook wiring to rtk's OWN command (idempotent). This is
 // the maintainability win: no manual settings.json merge to keep in sync. Wires
 // via the resolved `bin` so an off-PATH install still gets its hook.
+//
+// `--auto-patch` is REQUIRED: bare `rtk init -g` PROMPTS before patching
+// settings.json, and we run it non-interactively (stdio:'pipe', no TTY) — so the
+// prompt gets no answer and rtk silently writes only the instruction layer
+// (RTK.md + @RTK.md) WITHOUT the PreToolUse hook. `--auto-patch` patches
+// settings.json non-interactively, so the transparent command-rewriting hook is
+// actually installed. (Verified live: `rtk init --show` reports "Hook: not found"
+// after bare `-g` piped, "Hook: ... configured" after `-g --auto-patch`.)
 function wireHook({ run, log, installedVia, version, bin = 'rtk', env = process.env, platform = process.platform }) {
   const offPath = bin !== 'rtk';
+  const initCmd = `${bin} init -g --auto-patch`;
   try {
-    run(`${bin} init -g`, { stdio: 'pipe' });
-    log(`rtk: ready (${installedVia}, v${version || '?'}) — hook wired via '${bin} init -g'. Restart Claude Code to activate.`);
+    run(initCmd, { stdio: 'pipe' });
+    log(`rtk: ready (${installedVia}, v${version || '?'}) — hook wired via '${initCmd}'. Restart Claude Code to activate.`);
     const r = { ok: true, synced: true, reason: 'wired', installed: true, installedVia, version, hook: true, bin };
     if (offPath) {
       r.pathHint = pathHintFor(bin, { env, platform });
@@ -206,7 +216,7 @@ function wireHook({ run, log, installedVia, version, bin = 'rtk', env = process.
     }
     return r;
   } catch (err) {
-    log(`rtk: installed (${installedVia}) but '${bin} init -g' failed (${oneLine(err)}) — run it manually, BYAN unaffected.`);
+    log(`rtk: installed (${installedVia}) but '${initCmd}' failed (${oneLine(err)}) — run it manually, BYAN unaffected.`);
     const r = { ok: true, synced: false, reason: 'hook-failed', installed: true, installedVia, version, hook: false, bin };
     if (offPath) r.pathHint = pathHintFor(bin, { env, platform });
     return r;

package/install/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-byan-agent",
-  "version": "2.29.2",
+  "version": "2.37.1",
   "description": "BYAN - Intelligent AI agent installer with multi-platform native support (Claude Code, Codex/OpenCode)",
   "bin": {
     "create-byan-agent": "bin/create-byan-agent-v2.js"

package/install/packages/platform-config/lib/credentials.js

@@ -18,7 +18,19 @@ const path = require('path');
 const fs = require('fs-extra');
 
 // Keys the credentials file understands. Any other key passed in is ignored.
-const KNOWN_KEYS = ['BYAN_API_URL', 'BYAN_API_TOKEN', 'LEANTIME_API_URL', 'LEANTIME_API_TOKEN'];
+// The Google Docs publish keys (byan_publish) live here too so a per-user
+// service-account setup persists alongside the byan_web / Leantime config; the
+// MCP server reads them via resolve-config. GOOGLE_APPLICATION_CREDENTIALS is a
+// PATH to the SA JSON (not the key itself) -- the key file stays separate, 0600.
+const KNOWN_KEYS = [
+  'BYAN_API_URL',
+  'BYAN_API_TOKEN',
+  'LEANTIME_API_URL',
+  'LEANTIME_API_TOKEN',
+  'GOOGLE_APPLICATION_CREDENTIALS',
+  'GDOC_TEMPLATE_ID',
+  'GDOC_LOGO_PNG_URL',
+];
 
 function credentialsDir(homedir = os.homedir()) {
   return path.join(homedir, '.byan');

package/install/packages/platform-config/lib/mcp-config.js

@@ -27,6 +27,13 @@ const path = require('path');
 const fs = require('fs-extra');
 
 const MCP_SERVER_REL_PATH = '_byan/mcp/byan-mcp-server/server.js';
+// Channel entrypoint: a SEPARATE MCP server (research preview) spawned by Claude
+// Code via --dangerously-load-development-channels. Same relative-path discipline
+// as the main server (relative to projectRoot, never absolute) so the entry is
+// portable across machines/OSes and stays valid when the repo is moved or shipped
+// via npm. The entry is INERT by default: registering it in .mcp.json does NOT
+// enable the channel (that needs the explicit --dangerously-load flag at launch).
+const MCP_CHANNEL_REL_PATH = '_byan/mcp/byan-mcp-server/channel-entry.js';
 const TOKEN_PLACEHOLDER = '${BYAN_API_TOKEN}';
 const LEANTIME_URL_PLACEHOLDER = '${LEANTIME_API_URL}';
 const LEANTIME_TOKEN_PLACEHOLDER = '${LEANTIME_API_TOKEN}';
@@ -87,15 +94,66 @@ function mergeByanEntry(existingConfig, { apiUrl, token } = {}) {
   delete env.BYAN_API_URL;
   delete env.BYAN_API_TOKEN;
 
+  // The canonical RELATIVE path is forced on `args` AFTER ...existing so it always
+  // wins -- this REPAIRS a stale entry that carried an absolute path (a pre-2.37.x
+  // install): relative survives a moved / npm-shipped repo, absolute does not, and
+  // Claude Code spawns the server with cwd=projectRoot so the relative path resolves
+  // identically. `command` is only F1-orthogonal (the interpreter, not a path), so a
+  // user-chosen command is preserved; we default to 'node' only when absent. Other
+  // pre-existing keys are still preserved.
   const entry = {
-    command: 'node',
-    args: [MCP_SERVER_REL_PATH],
     ...existing,
+    command: existing.command || 'node',
+    args: [MCP_SERVER_REL_PATH],
   };
   if (Object.keys(env).length > 0) entry.env = env;
   else delete entry.env;
 
   cfg.mcpServers.byan = entry;
+
+  // The channel entry is written alongside byan from the SAME merge so there is
+  // a single source of truth for the byan MCP registration. It is inert.
+  return mergeChannelEntry(cfg);
+}
+
+/**
+ * Pure merge — no I/O. Adds the `byan-channel` MCP server entry alongside byan.
+ *
+ * This entry is a Claude Code research-preview channel (CC v2.1.80+). It is
+ * INERT by default: present in .mcp.json but only loaded when the user launches
+ * with `claude --dangerously-load-development-channels server:byan-channel`.
+ * Registering it does NOT auto-activate anything — this function writes NO
+ * channelsEnabled / allowedChannelPlugins / --dangerously-load flag.
+ *
+ * Same portability discipline as the byan entry: a RELATIVE path (never
+ * absolute), no secret in env (the channel resolves its own config at boot via
+ * resolve-config.js: env -> ~/.byan/credentials.json -> defaults). An existing
+ * byan-channel entry is preserved (command/args/env) so the merge is idempotent.
+ *
+ * @param {object} existingConfig — current parsed config
+ * @returns {object} new merged config
+ */
+function mergeChannelEntry(existingConfig) {
+  const cfg = existingConfig && typeof existingConfig === 'object' ? { ...existingConfig } : {};
+  cfg.mcpServers = { ...(cfg.mcpServers || {}) };
+
+  const existing = cfg.mcpServers['byan-channel'] || {};
+
+  // The canonical RELATIVE path + the empty (secret-free) env are forced AFTER
+  // ...existing so they always win, normalizing a stale entry (absolute path, or
+  // a stray env) while preserving any other pre-existing key. env stays empty: the
+  // channel resolves BYAN_API_URL/TOKEN itself via resolve-config.js -- writing a
+  // secret here would land it in tracked git, and the channel has no legitimate
+  // env contract of its own (Leantime refs live on the byan entry). `command` is
+  // F1-orthogonal so a user-chosen interpreter is preserved, 'node' only as the
+  // default. Idempotent: re-running yields the same entry.
+  cfg.mcpServers['byan-channel'] = {
+    ...existing,
+    command: existing.command || 'node',
+    args: [MCP_CHANNEL_REL_PATH],
+    env: {},
+  };
+
   return cfg;
 }
 
@@ -141,14 +199,20 @@ function mergeLeantimeRefs(existingConfig) {
   env.LEANTIME_API_URL = LEANTIME_URL_PLACEHOLDER;
   env.LEANTIME_API_TOKEN = LEANTIME_TOKEN_PLACEHOLDER;
 
+  // Same discipline as mergeByanEntry: args forced to the canonical RELATIVE path
+  // (normalizes a stale absolute one), command preserved (F1-orthogonal), env
+  // carries the merged Leantime refs.
   cfg.mcpServers.byan = {
-    command: 'node',
-    args: [MCP_SERVER_REL_PATH],
     ...existing,
+    command: existing.command || 'node',
+    args: [MCP_SERVER_REL_PATH],
     env,
   };
 
-  return cfg;
+  // Keep the channel entry coherent with the byan entry: ensureLeantimeRefs runs
+  // after ensureMcpConfig in the installer, but routing through mergeChannelEntry
+  // here makes the byan-channel registration robust to call order (idempotent).
+  return mergeChannelEntry(cfg);
 }
 
 /**
@@ -252,12 +316,14 @@ module.exports = {
   ensureMcpConfig,
   readMcpConfig,
   mergeByanEntry,
+  mergeChannelEntry,
   mergeLeantimeRefs,
   ensureLeantimeRefs,
   addMcpEntry,
   removeMcpEntry,
   looksLikeSecret,
   MCP_SERVER_REL_PATH,
+  MCP_CHANNEL_REL_PATH,
   TOKEN_PLACEHOLDER,
   LEANTIME_URL_PLACEHOLDER,
   LEANTIME_TOKEN_PLACEHOLDER,

package/install/setup-gdoc.js

@@ -0,0 +1,41 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * setup-gdoc -- explicit opt-in setup for the byan_publish service-account key.
+ *
+ * Run on demand: `npm run setup-gdoc` (or `node install/setup-gdoc.js`). Walks
+ * the user through creating a Google service account + key, imports the JSON to
+ * ~/.byan/google-sa.json (0600), and persists the publish config into
+ * ~/.byan/credentials.json. It NEVER throws and exits 0 : the SA setup is
+ * optional and must not fail the surrounding flow. The real logic lives in
+ * lib/gdoc-setup.js and is unit-tested.
+ */
+
+const chalk = require('chalk');
+const { setupGdocPublish } = require('./lib/gdoc-setup');
+
+async function main() {
+  console.log(chalk.cyan('\nbyan_publish -- clé service account (Google Docs headless)'));
+  console.log(chalk.gray('  Open source : tu fournis ta clé ; rien de secret ne ship.\n'));
+
+  const result = await setupGdocPublish({ log: (...a) => console.log(...a) });
+
+  if (result.configured) {
+    console.log(chalk.green(`\n  Configuré. Clé : ${result.path}`));
+    console.log(chalk.gray('  Installe aussi googleapis dans le MCP server : (cd _byan/mcp/byan-mcp-server && npm install googleapis google-auth-library)'));
+  } else {
+    console.log(chalk.yellow(`\n  Non configuré (${result.skipReason || 'ignoré'}). BYAN reste fonctionnel.`));
+  }
+  process.exit(0);
+}
+
+if (require.main === module) {
+  main().catch((err) => {
+    // Last-resort guard : an optional setup must not crash with a non-zero exit.
+    console.log(chalk.yellow(`  setup-gdoc ignoré : ${err.message}`));
+    process.exit(0);
+  });
+}
+
+module.exports = { main };

package/install/setup-rtk.js

@@ -6,7 +6,7 @@
  *
  * Run on demand: `npm run setup-rtk` (or `node install/setup-rtk.js`). It delegates
  * the install to rtk's own canonical installer (brew / cargo / official script) and
- * the Claude Code hook wiring to rtk's own `rtk init -g`. It NEVER throws: a missing
+ * the Claude Code hook wiring to rtk's own `rtk init -g --auto-patch`. It NEVER throws: a missing
  * installer or a failed step is reported and exits 0 (RTK is optional; BYAN works
  * without it). The real logic lives in lib/rtk-integration.js and is unit-tested.
  */

package/install/templates/.claude/CLAUDE.md

@@ -62,8 +62,9 @@ Doctrine d'equipe complete (template role-in-team, analogie orchestre, principes
 - Doctrine d'equipe: voir @.claude/rules/team-doctrine.md
 - Methodologie: voir @.claude/rules/merise-agile.md
 - Systeme de confiance epistemique: voir @.claude/rules/elo-trust.md
-- Protocol fact-check scientifique: voir @.claude/rules/fact-check.md
-- Mode strict anti-downgrade: voir @.claude/rules/strict-mode.md
+- Protocol fact-check scientifique: voir .claude/rules/fact-check.md (charge a la demande via le skill byan-fact-check)
+- Mode strict anti-downgrade: voir .claude/rules/strict-mode.md (charge a la demande via le skill byan-strict)
+- Architecture portable (noyau portable, projection native): voir .claude/rules/portable-core.md (charge a la demande)
 - Systeme API byan_web: voir @.claude/rules/byan-api.md
 
 ## API byan_web
@@ -109,7 +110,7 @@ Protocole : lock du scope -> build complet -> self-verify >= 3 passes -> complet
 - Filet final : `.githooks/pre-commit` bloque le commit si une session strict est engagee mais non completee
 - Persistance : sessions poussees vers l'API byan_web (autorite ; local = miroir/fallback offline) via `lib/strict-sync.js` ; migration `033` + `routes/strict-sessions.js` cote byan_web
 
-Detail complet : voir @.claude/rules/strict-mode.md
+Detail complet (hors contexte par defaut, charge a la demande via le skill byan-strict) : voir .claude/rules/strict-mode.md
 
 <!-- BYAN-AUTOBENCH:BEGIN (Generated by byan-sync-rules from _byan/_config/autobench.yaml. Do not hand-edit.) -->
 ## BYAN Auto-Benchmark
@@ -120,5 +121,16 @@ both gates hold (>= 2 non-substitutable options diverging on >= 1 weighted
 criterion). Emit the marker verbatim before the table:
 `<!-- BYAN-BENCH:done g1=<#options> g2=<#divergent-criteria> scope=<internal|external> conf=<assertive|lean> -->`.
 A confirm, a destructive prompt, or an obvious default is not a fork — emit
-`<!-- BYAN-BENCH:skip reason=.. -->` instead. Full doctrine: see @.claude/rules/benchmark.md
+`<!-- BYAN-BENCH:skip reason=.. -->` instead. Full doctrine (loaded on demand): see .claude/rules/benchmark.md
 <!-- BYAN-AUTOBENCH:END -->
+
+## Compact instructions
+
+Quand tu compactes cette conversation, PRESERVE en priorite :
+- le contrat de livraison par defaut (F1) : grade=PROD, scope=MAXIMAL, etalon de cout=AI-2026 (temps-agent x10, jamais temps-humain-a-la-main). Pas de proposition d'MVP/livrable-court/decoupage-pour-ne-pas-bloquer-le-lourd sauf opt-out explicite du message courant. Source : `_byan/_config/delivery-default.json` ; reinjecte chaque tour par `inject-delivery-default`.
+- l'etat FD BYAN actif s'il existe : phase courante, feature_name, le backlog avec le statut par item, le dernier verdict review/validate (source : `_byan-output/fd-state.json`).
+- la session Strict Mode active s'il y en a une : scope_hash, criteres d'acceptation, nombre de passes, completion (source : `.byan-strict/state.json` + API byan_web).
+- l'identite BYAN : le noyau immuable du soul + la voix tao (registre, signatures, tutoiement, zero emoji). `inject-tao` la reinjecte au SessionStart, mais garde la voix active dans le resume aussi.
+- les derniers commits et tout travail non committe en cours.
+
+Jette : les sorties d'outils deja exploitees, les dumps de fichiers verbeux, les sous-etapes resolues. Garde les decisions et les fils non resolus (recall d'abord, precision ensuite).