spur-board 0.3.0 → 0.4.1

package/dist/cli.mjs

@@ -1,6 +1,6 @@
-import { F as configSchema, I as SLACK_BOT_SCOPES, s as OPERATIONS } from "./src-BDNEze3S.mjs";
-import { a as renderCliError, i as errorExitCode, n as requestTokenEnrollment, o as escapeTerminalControls, r as CliError, t as requestOperation } from "./client-C81xon5D.mjs";
-import { n as loadEnrollmentConfig, t as loadClientConfig } from "./config-D8AEf8vU.mjs";
+import { I as configSchema, L as SLACK_BOT_SCOPES, s as OPERATIONS } from "./src-BEo3mvRC.mjs";
+import { a as renderCliError, i as errorExitCode, n as requestTokenEnrollment, o as escapeTerminalControls, r as CliError, t as requestOperation } from "./client-CHohYNxa.mjs";
+import { i as resolveDaemonAddress, n as loadClientConfig, r as loadEnrollmentConfig, t as configFile } from "./config-BuxxS_er.mjs";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { chmodSync, closeSync, constants, existsSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, readlinkSync, realpathSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { homedir, hostname, userInfo } from "node:os";
@@ -140,12 +140,6 @@ function warning(id, fix) {
 		fix
 	};
 }
-function configFile(env, home) {
-	const boardHome = env["BOARD_HOME"];
-	if (boardHome) return join(resolve(boardHome), "config.yaml");
-	const xdg = env["XDG_CONFIG_HOME"];
-	return join(xdg && isAbsolute(xdg) ? xdg : join(home, ".config"), "spur-board", "config.yaml");
-}
 function unitFile(env, home) {
 	const xdg = env["XDG_CONFIG_HOME"];
 	return join(xdg && isAbsolute(xdg) ? xdg : join(home, ".config"), "systemd", "user", "spur-board.service");
@@ -334,8 +328,8 @@ async function runDoctor(options = {}) {
 	checks.push(stale.length > 0 || unknownStarts ? warning("sessions.stale", `Restart sessions started before the last skill install${staleIds.length ? `: ${staleIds.join(", ")}` : ""}; verify sessions whose start time is unavailable.`) : result("sessions.stale", true, "Restart older sessions."));
 	let remote = null;
 	try {
-		const base = env["BOARD_DAEMON_URL"] || `http://127.0.0.1:${String(config.http.port)}`;
-		const response = await ports.fetcher(new URL("/v1/doctor", base), { signal: AbortSignal.timeout(8e3) });
+		const address = resolveDaemonAddress(env, home, config.http.port);
+		const response = await ports.fetcher(new URL("/v1/doctor", address), { signal: AbortSignal.timeout(8e3) });
 		if (response.ok) remote = remoteChecks(await response.json());
 	} catch {}
 	checks.push(result("daemon.available", remote !== null, "Start or restart the user service."));
@@ -1032,7 +1026,7 @@ function createProgram(options = {}) {
 			const key = op.kind === "mutation" ? keyOption || randomUUID() : void 0;
 			if (key) io.stderr(`key: ${escapeTerminalControls(key)}\n`);
 			try {
-				const result = await requestOperation(op, input, key, config);
+				const result = await (options.sendOperation ?? requestOperation)(op, input, key, config);
 				io.stdout(`${json || !io.isTTY ? JSON.stringify(result) : formatHuman(result)}\n`);
 			} catch (error) {
 				if (error instanceof CliError) {

package/dist/{client-C81xon5D.mjs → client-CHohYNxa.mjs}

@@ -1,4 +1,4 @@
-import { M as errorContextSchema, N as errorEnvelopeSchema, P as successEnvelopeSchema, j as ERRORS, l as renderJsonError } from "./src-BDNEze3S.mjs";
+import { M as errorContextSchema, N as errorEnvelopeSchema, P as successEnvelopeSchema, j as ERRORS, l as renderJsonError } from "./src-BEo3mvRC.mjs";
 import { randomUUID } from "node:crypto";
 import { z } from "zod";
 import { request } from "node:http";

package/dist/client.mjs

@@ -1,2 +1,2 @@
-import { n as requestTokenEnrollment, t as requestOperation } from "./client-C81xon5D.mjs";
+import { n as requestTokenEnrollment, t as requestOperation } from "./client-CHohYNxa.mjs";
 export { requestOperation, requestTokenEnrollment };

package/dist/{config-D8AEf8vU.mjs → config-BuxxS_er.mjs}

@@ -1,13 +1,32 @@
-import { r as CliError } from "./client-C81xon5D.mjs";
+import { I as configSchema } from "./src-BEo3mvRC.mjs";
+import { r as CliError } from "./client-CHohYNxa.mjs";
 import { closeSync, constants, fstatSync, lstatSync, openSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { homedir } from "node:os";
-import { dirname, isAbsolute, join, relative, sep } from "node:path";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import YAML from "yaml";
 //#region src/config.ts
 const CONNECT_TIMEOUT_MS = 2e3;
 const RESPONSE_TIMEOUT_MS = 3e4;
-function daemonAddress(env) {
+function configFile(env, home) {
+	const boardHome = env["BOARD_HOME"];
+	if (boardHome) return join(resolve(boardHome), "config.yaml");
+	const xdg = env["XDG_CONFIG_HOME"];
+	return join(xdg && isAbsolute(xdg) ? xdg : join(home, ".config"), "spur-board", "config.yaml");
+}
+function resolveDaemonAddress(env = process.env, home = homedir(), configuredPort) {
 	const rawAddress = env["BOARD_DAEMON_URL"];
-	if (!rawAddress) throw new CliError("config", { environmentVariable: "BOARD_DAEMON_URL" });
+	if (rawAddress === void 0) {
+		let port = configuredPort ?? 4311;
+		if (configuredPort === void 0) try {
+			const parsed = YAML.parseDocument(readFileSync(configFile(env, home), "utf8"));
+			if (parsed.errors.length === 0) {
+				const config = configSchema.safeParse(parsed.toJS());
+				if (config.success) port = config.data.http.port;
+			}
+		} catch {}
+		if (port === 0) throw new CliError("config", void 0, void 0, "http.port: 0 assigns a runtime port that clients cannot discover. Set BOARD_DAEMON_URL to the daemon listening address.");
+		return new URL(`http://127.0.0.1:${String(port)}`);
+	}
 	let address;
 	try {
 		address = new URL(rawAddress);
@@ -66,7 +85,7 @@ function loadClientConfig(env = process.env, paths = {
 	cwd: process.cwd(),
 	home: homedir()
 }) {
-	const address = daemonAddress(env);
+	const address = resolveDaemonAddress(env, paths.home);
 	const session = env["SPUR_SESSION"] || void 0;
 	const token = session ? void 0 : env["BOARD_TOKEN"] === void 0 ? findTokenFile(paths.cwd, paths.home) : env["BOARD_TOKEN"];
 	if (!session && !token) throw new CliError("config", { environmentVariable: "BOARD_TOKEN" });
@@ -81,7 +100,7 @@ function loadClientConfig(env = process.env, paths = {
 /** Enrollment sends only a hash and works before any operator credential exists. */
 function loadEnrollmentConfig(env = process.env) {
 	return {
-		address: daemonAddress(env),
+		address: resolveDaemonAddress(env),
 		session: void 0,
 		token: void 0,
 		connectTimeoutMs: CONNECT_TIMEOUT_MS,
@@ -89,4 +108,4 @@ function loadEnrollmentConfig(env = process.env) {
 	};
 }
 //#endregion
-export { loadEnrollmentConfig as n, loadClientConfig as t };
+export { resolveDaemonAddress as i, loadClientConfig as n, loadEnrollmentConfig as r, configFile as t };

package/dist/daemon.mjs

@@ -1,4 +1,4 @@
-import { A as taskKeySchema, C as sessionFactsSchema, D as errorCodeOf, E as encodeActorId, F as configSchema, I as SLACK_BOT_SCOPES, O as parseActorId, P as successEnvelopeSchema, S as prRefSchema, T as actorIdSchema, _ as EVENT_KINDS, a as buildCatalogSnapshot, b as SESSION_STATUSES, c as renderHttpProblem, d as SPACE_IDS, f as conversationRefSchema, g as userIdSchema, h as messageRefSchema, i as sourceCursorSchema, k as parseRef$1, m as interactionRefSchema, n as batchSchema, o as roleCanUseOperation, p as inboundEventSchema, r as entityRefSchema, s as OPERATIONS, t as AdapterError, v as eventPayloadSchemas, w as ticketFactsSchema, x as prFactsSchema, y as SESSION_HEALTH_STATES } from "./src-BDNEze3S.mjs";
+import { A as taskKeySchema, C as sessionFactsSchema, D as errorCodeOf, E as encodeActorId, I as configSchema, L as SLACK_BOT_SCOPES, O as parseActorId, P as successEnvelopeSchema, S as prRefSchema, T as actorIdSchema, _ as EVENT_KINDS, a as buildCatalogSnapshot, b as SESSION_STATUSES, c as renderHttpProblem, d as SPACE_IDS, f as conversationRefSchema, g as userIdSchema, h as messageRefSchema, i as sourceCursorSchema, j as ERRORS, k as parseRef$1, m as interactionRefSchema, n as batchSchema, o as roleCanUseOperation, p as inboundEventSchema, r as entityRefSchema, s as OPERATIONS, t as AdapterError, v as eventPayloadSchemas, w as ticketFactsSchema, x as prFactsSchema, y as SESSION_HEALTH_STATES } from "./src-BEo3mvRC.mjs";
 import { createRequire } from "node:module";
 import { createHash, randomUUID } from "node:crypto";
 import { closeSync, existsSync, fstatSync, ftruncateSync, mkdirSync, openSync, readFileSync, readdirSync, writeSync } from "node:fs";
@@ -7543,9 +7543,8 @@ var ScanNeeded = class extends Error {
 		this.strings = strings;
 	}
 };
-/** Return a rule ID, never a finding message or a copy of the matched text. */
-async function scanSecret(text) {
-	return (await lintSource({
+function lintGatewayText(text) {
+	return lintSource({
 		source: {
 			content: text,
 			filePath: "board.txt",
@@ -7559,7 +7558,59 @@ async function scanSecret(text) {
 				rule: scannerPreset
 			}] }
 		}
-	})).messages[0]?.ruleId ?? null;
+	});
+}
+/** Return a rule ID, never a finding message or a copy of the matched text. */
+async function scanSecret(text) {
+	return (await lintGatewayText(text)).messages[0]?.ruleId ?? null;
+}
+/** Replace each detected span while preserving the rest of a private reply. */
+async function redactSecretMatches(text) {
+	const matches = (await lintGatewayText(text)).messages.map(({ range, ruleId }) => ({
+		start: range[0],
+		end: range[1],
+		ruleId
+	})).sort((a, b) => a.start - b.start || b.end - a.end);
+	const regions = [];
+	for (const match of matches) {
+		if (!Number.isInteger(match.start) || !Number.isInteger(match.end) || match.start < 0 || match.end <= match.start || match.end > text.length) throw new Error("Invalid gateway secret scan range");
+		const previous = regions.at(-1);
+		if (previous !== void 0 && match.start < previous.end) previous.end = Math.max(previous.end, match.end);
+		else regions.push({ ...match });
+	}
+	let safe = "";
+	let offset = 0;
+	for (const { start, end, ruleId } of regions) {
+		safe += `${text.slice(offset, start)}[redacted: ${ruleId}]`;
+		offset = end;
+	}
+	return safe + text.slice(offset);
+}
+function visibleInline(value) {
+	switch (value.kind) {
+		case "text":
+		case "emphasis":
+		case "code": return value.text;
+		case "link": return `${value.text} (${value.url})`;
+		case "mention": return `<@${value.user}>`;
+	}
+}
+/** Scan the exact text the Slack private-reply renderer will display. */
+async function redactPrivateReply(body) {
+	return Promise.all(body.map(async (block) => {
+		if (block.kind === "code_block") return {
+			kind: "code_block",
+			text: await redactSecretMatches(block.text)
+		};
+		const text = block.children.map(visibleInline).join("");
+		return {
+			kind: block.kind,
+			children: [{
+				kind: "text",
+				text: await redactSecretMatches(text)
+			}]
+		};
+	}));
 }
 /** Used by the common outbox insertion point before it issues SQL. */
 function checkGatewayStrings(strings) {
@@ -11192,6 +11243,69 @@ async function conversationsForRecovery(trx, gateway, now) {
 	};
 }
 //#endregion
+//#region ../core/src/app/command-replies.ts
+function line(text) {
+	return {
+		kind: "paragraph",
+		children: [{
+			kind: "text",
+			text
+		}]
+	};
+}
+function quote(text) {
+	return {
+		kind: "quote",
+		children: [{
+			kind: "text",
+			text
+		}]
+	};
+}
+/** A compact Slack view of the same validated catalog output used by CLI and MCP. */
+function commandReply(id, value, input) {
+	if (id === "status.get") {
+		const operation = OPERATIONS.find((entry) => entry.id === "status.get");
+		if (operation === void 0) throw new Error("status.get is missing from the catalog");
+		const status = operation.output.parse(value);
+		return {
+			cliHint: `board ${operation.cli.command}`,
+			body: [
+				line(`Board status: ${String(status.tasks.length)} tasks, ${String(status.items.length)} items needing attention.`),
+				...status.tasks.map((task) => line(`${task.key}: ${task.column} (${task.membership})`)),
+				...status.items.map((item) => line(`${item.key}: ${item.summary}`)),
+				line(`Unlinked: ${String(status.unlinkedPrs.length)} pull requests, ${String(status.unlinkedSessions.length)} sessions.`),
+				...status.sources.map((source) => line(`${source.source}: ${source.blindReason !== null ? `blind (${source.blindReason})` : source.warmingUp ? "warming up" : source.stale ? "stale" : "current"}`)),
+				...status.warmingUp ? [line("Sources are warming up.")] : [],
+				...status.spurUnavailable === null ? [] : [line(status.spurUnavailable)],
+				...status.hostLoad === null ? [] : [line(status.hostLoad)]
+			]
+		};
+	}
+	if (id === "task.get") {
+		const operation = OPERATIONS.find((entry) => entry.id === "task.get");
+		if (operation === void 0) throw new Error("task.get is missing from the catalog");
+		const result = operation.output.parse(value);
+		const request = operation.input.parse(input);
+		return {
+			cliHint: `board ${operation.cli.command} ${request.task}`,
+			body: [
+				line(`Task ${result.task.key}: ${result.task.column} (${result.task.membership})`),
+				...result.blocks.flatMap((block) => [line(`Block ${block.id} (${block.state}, ${block.type}):`), quote(block.reason)]),
+				...result.comments.flatMap((comment) => [line(`Comment ${comment.id} by ${comment.author}:`), quote(comment.text)])
+			]
+		};
+	}
+	const operation = OPERATIONS.find((entry) => entry.id === "task.history");
+	if (operation === void 0) throw new Error("task.history is missing from the catalog");
+	const history = operation.output.parse(value);
+	const request = operation.input.parse(input);
+	return {
+		cliHint: `board ${operation.cli.command} ${request.task}`,
+		body: [line(`Task ${history.task.key} history:`), ...history.events.map((event) => line(`${event.at}: ${event.summary} (${event.kind})`))]
+	};
+}
+//#endregion
 //#region ../core/src/app/inbound.ts
 const resultSchema = z.strictObject({
 	status: z.enum([
@@ -11415,9 +11529,6 @@ function createInbound(input) {
 		});
 		return { status: "applied" };
 	}
-	function queryId(parts) {
-		return parts.length === 1 && parts[0] === "status" ? "status.get" : parts.length === 2 && parts[0] === "task" ? "task.get" : parts.length === 3 && parts[0] === "task" && parts[2] === "history" ? "task.history" : void 0;
-	}
 	async function retryStoredInbound(trx, itemId, at) {
 		const item = await trx.selectFrom("operator_item").selectAll().where("id", "=", itemId).executeTakeFirst();
 		if (item === void 0 || item.cleared_at !== null || item.inbound_event_json === null) throw new CommandError("retry_not_applicable", "This item has no stored event to retry.");
@@ -11468,16 +11579,46 @@ function createInbound(input) {
 			const id = event.actionId.split(":", 1)[0];
 			return OPERATIONS.some((entry) => entry.id === id && entry.slack?.kind === "button") ? id ?? "inbound.action" : "inbound.action";
 		}
-		if (event.kind === "command") return queryId(event.text.trim().split(/\s+/)) ?? "inbound.command";
+		if (event.kind === "command") return interactionOperation(event).id ?? "inbound.command";
 		return `inbound.${event.kind}`;
 	}
+	/** Decode command text only for events stored before parsed selections were added. */
+	function legacyCommand(text) {
+		const parts = text.trim().split(/\s+/).filter(Boolean);
+		if (parts.length === 0 || parts.length === 1 && parts[0] === "status") return {
+			kind: "query",
+			id: "status.get",
+			input: {}
+		};
+		if (parts[0] === "task" && parts[1] !== void 0) {
+			if (parts.length === 2) return {
+				kind: "query",
+				id: "task.get",
+				input: { task: parts[1] }
+			};
+			if (parts.length === 3 && parts[2] === "history") return {
+				kind: "query",
+				id: "task.history",
+				input: { task: parts[1] }
+			};
+		}
+		return null;
+	}
 	function interactionOperation(event) {
 		let id;
 		let operationInput;
 		if (event.kind === "command") {
-			const parts = event.text.trim().split(/\s+/);
-			id = queryId(parts);
-			operationInput = id === "status.get" ? {} : { task: parts[1] };
+			const command = event.command;
+			if (command?.kind === "query") {
+				const operation = OPERATIONS.find((entry) => entry.id === command.id);
+				if (operation?.kind === "query" && operation.slack?.kind === "slash-command") {
+					const parsed = operation.input.safeParse(command.input);
+					if (parsed.success) {
+						id = operation.id;
+						operationInput = parsed.data;
+					}
+				}
+			}
 		} else {
 			const parts = event.actionId.split(":");
 			if (parts.length === 2 && /^I[1-9]\d*$/.test(parts[1] ?? "")) {
@@ -11561,7 +11702,9 @@ function createInbound(input) {
 		}
 		const { id, operationInput } = interactionOperation(event);
 		let response;
-		if (id === void 0) response = "not available yet";
+		let cliHint;
+		if (event.kind === "command" && event.command?.kind === "usage") response = plain(event.command.text);
+		else if (id === void 0) response = plain("not allowed");
 		else try {
 			const value = await dispatchOperation({
 				store,
@@ -11569,13 +11712,22 @@ function createInbound(input) {
 				config,
 				registry
 			}, id, operationInput, "operator", event.dedupeKey);
-			response = JSON.stringify(value);
+			if (event.kind === "command") {
+				const reply = commandReply(id, value, operationInput);
+				response = reply.body;
+				cliHint = reply.cliHint;
+			} else response = plain(JSON.stringify(value));
 		} catch (error) {
 			if (!(error instanceof CommandError)) await recordFailure(event, error, new Date(clock.now()).toISOString());
-			response = error instanceof CommandError && error.code !== "not_implemented" ? error.hint : "not available yet";
+			response = plain(error instanceof CommandError && error.code !== "not_implemented" ? event.kind === "command" ? `${ERRORS[error.code].message} ${ERRORS[error.code].hint}` : error.hint : "not available yet");
 		}
 		try {
-			await gateway.respond(event.interaction, plain(response), { private: true });
+			const safeResponse = event.kind === "command" ? await redactPrivateReply(response) : response;
+			const safeHint = event.kind === "command" && cliHint !== void 0 ? await redactSecretMatches(cliHint) : cliHint;
+			await gateway.respond(event.interaction, safeResponse, {
+				private: true,
+				...safeHint === void 0 ? {} : { cliHint: safeHint }
+			});
 		} catch {}
 	}
 	async function applyUser(event) {
@@ -11658,7 +11810,15 @@ function createInbound(input) {
 			return serial(async () => {
 				const item = await store.db.selectFrom("operator_item").select(["cleared_at", "inbound_event_json"]).where("id", "=", itemId).executeTakeFirst();
 				if (item === void 0 || item.cleared_at !== null || item.inbound_event_json === null) throw new CommandError("retry_not_applicable", "This item has no stored event to retry.");
-				const event = inboundEventSchema.parse(JSON.parse(item.inbound_event_json));
+				let event = inboundEventSchema.parse(JSON.parse(item.inbound_event_json));
+				if (event.kind === "command" && event.command === void 0) {
+					const command = legacyCommand(event.text);
+					if (command === null) throw new CommandError("retry_not_applicable", "This interaction cannot be retried.");
+					event = {
+						...event,
+						command
+					};
+				}
 				if (event.kind === "action" || event.kind === "command") {
 					const { id, operationInput } = interactionOperation(event);
 					if (id === void 0) throw new CommandError("retry_not_applicable", "This interaction cannot be retried.");
@@ -14433,6 +14593,71 @@ function renderText(body) {
 		return block.kind === "quote" ? value.split("\n").map((line) => `> ${line}`).join("\n") : value;
 	}).filter((value) => value.length > 0).join("\n\n");
 }
+function literal(value) {
+	switch (value.kind) {
+		case "text":
+		case "emphasis":
+		case "code": return value.text;
+		case "link": return `${value.text} (${value.url})`;
+		case "mention": return `<@${value.user}>`;
+	}
+}
+/** Private replies use structured text so quoted data is never parsed as mrkdwn. */
+function renderResponse(body, cliHint) {
+	const pointer = cliHint === void 0 ? "" : `More: ${cliHint} (CLI)`;
+	const suffix = pointer === "" ? "" : `\n\n${pointer}`;
+	let remaining = MAX_PART_TEXT - suffix.length;
+	const maxElements = 40;
+	const shown = [];
+	let truncated = false;
+	for (const block of body) {
+		const value = block.kind === "code_block" ? block.text : block.children.map(literal).join("");
+		if (value.length === 0) continue;
+		if (shown.length >= maxElements || remaining <= 0) {
+			truncated = true;
+			break;
+		}
+		const part = value.slice(0, remaining);
+		shown.push({
+			kind: block.kind === "quote" ? "quote" : "paragraph",
+			children: [{
+				kind: "text",
+				text: part
+			}]
+		});
+		remaining -= part.length + 2;
+		if (part.length < value.length) {
+			truncated = true;
+			break;
+		}
+	}
+	const elements = shown.map((block) => ({
+		type: block.kind === "quote" ? "rich_text_quote" : "rich_text_section",
+		elements: [{
+			type: "text",
+			text: block.children.map(literal).join("")
+		}]
+	}));
+	if (truncated && pointer !== "") elements.push({
+		type: "rich_text_section",
+		elements: [{
+			type: "text",
+			text: pointer
+		}]
+	});
+	const fallback = shown.map((block) => {
+		const value = block.children.map(literal).join("");
+		return block.kind === "quote" ? `Quote: ${value}` : value;
+	}).join("\n\n");
+	const limit = MAX_PART_TEXT - (truncated ? suffix.length : 0);
+	return {
+		text: `${fallback.length <= limit ? fallback : splitText(fallback, limit)?.[0] ?? ""}${truncated ? suffix : ""}`,
+		blocks: [{
+			type: "rich_text",
+			elements
+		}]
+	};
+}
 /** Prefer a paragraph or word boundary; never cut a Slack entity or angle-bracket token. */
 function splitText(text, max = MAX_PART_TEXT) {
 	if (text.length === 0) return [];
@@ -14666,6 +14891,52 @@ function createDeliveryGateway(client, channels) {
 	};
 }
 //#endregion
+//#region ../gateway-slack/src/commands.ts
+/** The catalog's slash bindings are the parser and help text's single source. */
+function descriptors(commandName) {
+	return OPERATIONS.filter((operation) => operation.kind === "query" && operation.slack?.kind === "slash-command").map((operation) => ({
+		operation,
+		usage: operation.slack?.kind === "slash-command" ? operation.slack.usage.replace(/^\/board\b/, commandName) : ""
+	}));
+}
+function commandUsage(commandName) {
+	return `Usage:\n${descriptors(commandName).map(({ usage }) => usage).join("\n")}`;
+}
+function parseCommand(text, commandName) {
+	const usage = () => ({
+		kind: "usage",
+		text: commandUsage(commandName)
+	});
+	const parts = text.trim().split(/\s+/).filter(Boolean);
+	if (parts.length === 0) return {
+		kind: "query",
+		id: "status.get",
+		input: {}
+	};
+	for (const { operation, usage: form } of descriptors(commandName)) {
+		const pattern = form.slice(commandName.length).trim().split(/\s+/);
+		if (pattern.length !== parts.length) continue;
+		const input = {};
+		if (!pattern.every((piece, index) => {
+			const value = parts[index];
+			if (value === void 0) return false;
+			if (piece === "<KEY>") {
+				const field = operation.cli.args[0];
+				if (field === void 0) return false;
+				input[field] = value;
+				return true;
+			}
+			return piece === value;
+		}) || !operation.input.safeParse(input).success) continue;
+		return {
+			kind: "query",
+			id: operation.id,
+			input
+		};
+	}
+	return usage();
+}
+//#endregion
 //#region ../gateway-slack/src/normalize.ts
 function record$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
@@ -14800,7 +15071,7 @@ function normalizeMessage(channel, payload, context) {
 	return events;
 }
 /** Actions and commands share the same stable trigger identity as their Slack retry. */
-function normalizeInteraction(type, payload, channels, root) {
+function normalizeInteraction(type, payload, channels, root, commandName = "/board") {
 	const body = record$1(payload);
 	if (body === null) return [];
 	const triggerId = string$1(body.trigger_id);
@@ -14809,6 +15080,7 @@ function normalizeInteraction(type, payload, channels, root) {
 	if (user === void 0) return [];
 	const author = userIdSchema.parse(user);
 	if (type === "slash_commands") {
+		if (body.command !== commandName) return [];
 		const channel = string$1(body.channel_id);
 		if (channel === void 0) return [];
 		return [{
@@ -14817,6 +15089,7 @@ function normalizeInteraction(type, payload, channels, root) {
 			interaction: interactionRef(channel, user, triggerId),
 			author,
 			text: text(body.text) ?? "",
+			command: parseCommand(text(body.text) ?? "", commandName),
 			sourceUrl: sourceUrl(channel),
 			sourceSpace: sourceSpace(channel, channels)
 		}];
@@ -14992,7 +15265,7 @@ function createSocket(api, config, botIdentity) {
 			const threadTs = value(actionMessage?.thread_ts) ?? ts;
 			const root = channel !== void 0 && threadTs !== void 0 && threadTs !== ts ? await rootFor(api, channel, threadTs) : actionMessage;
 			events = normalizeInteraction(type, body, config.channels, root);
-		} else if (type === "slash_commands") events = normalizeInteraction(type, body, config.channels);
+		} else if (type === "slash_commands") events = normalizeInteraction(type, body, config.channels, void 0, config.command);
 		for (const event of events) await emit(event);
 		await envelope.ack?.();
 	}
@@ -15080,14 +15353,19 @@ function createSlackGateway(config) {
 		recover: (request) => recoverThreads(api, request, botIdentity),
 		async respond(interaction, text, options) {
 			const addressed = parseInteractionRef(interaction);
-			const body = renderText(text);
-			if (addressed === null || body.length === 0) return "dropped";
+			const rendered = renderResponse(text, options.cliHint);
+			if (addressed === null || rendered.text.length === 0) return "dropped";
 			try {
-				return (await api.chat.postEphemeral({
+				const payload = {
 					channel: addressed.channel,
 					user: addressed.user,
-					text: body
-				})).ok ? "sent" : "dropped";
+					text: rendered.text,
+					blocks: rendered.blocks,
+					mrkdwn: false,
+					parse: "none",
+					link_names: false
+				};
+				return (await api.chat.postEphemeral(payload)).ok ? "sent" : "dropped";
 			} catch (error) {
 				if (options.private) {
 					const result = apiFailure(error);
@@ -15499,6 +15777,7 @@ function slackSettings(config, secrets) {
 	}
 	return {
 		token,
+		command: config.slack.command,
 		...appToken === void 0 ? {} : { appToken },
 		channels: {
 			orchestrators,

package/dist/mcp.mjs

@@ -1,6 +1,6 @@
-import { j as ERRORS, s as OPERATIONS, u as renderMcpError } from "./src-BDNEze3S.mjs";
-import { r as CliError, t as requestOperation } from "./client-C81xon5D.mjs";
-import { t as loadClientConfig } from "./config-D8AEf8vU.mjs";
+import { j as ERRORS, s as OPERATIONS, u as renderMcpError } from "./src-BEo3mvRC.mjs";
+import { r as CliError, t as requestOperation } from "./client-CHohYNxa.mjs";
+import { n as loadClientConfig } from "./config-BuxxS_er.mjs";
 import { randomUUID } from "node:crypto";
 import { readFileSync } from "node:fs";
 import { z } from "zod";

package/dist/{src-BDNEze3S.mjs → src-BEo3mvRC.mjs}

@@ -110,6 +110,7 @@ const SLACK_BOT_SCOPES = [
 ];
 //#endregion
 //#region ../contracts/src/config.ts
+const DEFAULT_HTTP_PORT = 4311;
 const WEEKDAYS = [
 	"monday",
 	"tuesday",
@@ -276,7 +277,7 @@ const configSchema = z.strictObject({
 			message: "Final unanswered pause must exceed the second retry pause"
 		});
 	}).prefault({}),
-	http: z.strictObject({ port: z.int().min(0).max(65535).default(4311).describe("Local HTTP API port (0 assigns a free port).") }).prefault({}),
+	http: z.strictObject({ port: z.int().min(0).max(65535).default(DEFAULT_HTTP_PORT).describe("Local HTTP API port (0 assigns a free port).") }).prefault({}),
 	adapters: z.strictObject({
 		spur: spurAdapterSection,
 		github: adapterSection(6e4),
@@ -1117,6 +1118,18 @@ const commandEventSchema = z.strictObject({
 	interaction: interactionRefSchema,
 	author: userIdSchema,
 	text: text$1,
+	command: z.discriminatedUnion("kind", [z.strictObject({
+		kind: z.literal("query"),
+		id: z.enum([
+			"status.get",
+			"task.get",
+			"task.history"
+		]),
+		input: z.unknown()
+	}), z.strictObject({
+		kind: z.literal("usage"),
+		text: z.string().min(1)
+	})]).optional(),
 	sourceUrl,
 	sourceSpace: sourceSpace.optional()
 });
@@ -2618,4 +2631,4 @@ var AdapterError = class extends Error {
 	}
 };
 //#endregion
-export { taskKeySchema as A, sessionFactsSchema as C, errorCodeOf as D, encodeActorId as E, configSchema as F, SLACK_BOT_SCOPES as I, errorContextSchema as M, errorEnvelopeSchema as N, parseActorId as O, successEnvelopeSchema as P, prRefSchema as S, actorIdSchema as T, EVENT_KINDS as _, buildCatalogSnapshot as a, SESSION_STATUSES as b, renderHttpProblem as c, SPACE_IDS as d, conversationRefSchema as f, userIdSchema as g, messageRefSchema as h, sourceCursorSchema as i, ERRORS as j, parseRef as k, renderJsonError as l, interactionRefSchema as m, batchSchema as n, roleCanUseOperation as o, inboundEventSchema as p, entityRefSchema as r, OPERATIONS as s, AdapterError as t, renderMcpError as u, eventPayloadSchemas as v, ticketFactsSchema as w, prFactsSchema as x, SESSION_HEALTH_STATES as y };
+export { taskKeySchema as A, sessionFactsSchema as C, errorCodeOf as D, encodeActorId as E, DEFAULT_HTTP_PORT as F, configSchema as I, SLACK_BOT_SCOPES as L, errorContextSchema as M, errorEnvelopeSchema as N, parseActorId as O, successEnvelopeSchema as P, prRefSchema as S, actorIdSchema as T, EVENT_KINDS as _, buildCatalogSnapshot as a, SESSION_STATUSES as b, renderHttpProblem as c, SPACE_IDS as d, conversationRefSchema as f, userIdSchema as g, messageRefSchema as h, sourceCursorSchema as i, ERRORS as j, parseRef as k, renderJsonError as l, interactionRefSchema as m, batchSchema as n, roleCanUseOperation as o, inboundEventSchema as p, entityRefSchema as r, OPERATIONS as s, AdapterError as t, renderMcpError as u, eventPayloadSchemas as v, ticketFactsSchema as w, prFactsSchema as x, SESSION_HEALTH_STATES as y };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "spur-board",
-  "version": "0.3.0",
+  "version": "0.4.1",
   "license": "MIT",
   "engines": {
     "node": "^24.12.0 || ^26.0.0"