spur-board 0.4.0 → 0.5.0

package/dist/cli.mjs

@@ -1,6 +1,6 @@
-import { F as configSchema, I as SLACK_BOT_SCOPES, s as OPERATIONS } from "./src-Cf78bzK5.mjs";
-import { a as renderCliError, i as errorExitCode, n as requestTokenEnrollment, o as escapeTerminalControls, r as CliError, t as requestOperation } from "./client-sGJ4fzQ4.mjs";
-import { n as loadEnrollmentConfig, t as loadClientConfig } from "./config-DPXFxZQy.mjs";
+import { R as configSchema, s as OPERATIONS, z as SLACK_BOT_SCOPES } from "./src-VWyX7Nwm.mjs";
+import { a as renderCliError, i as errorExitCode, n as requestTokenEnrollment, o as escapeTerminalControls, r as CliError, t as requestOperation } from "./client-BnkZmz1i.mjs";
+import { i as resolveDaemonAddress, n as loadClientConfig, r as loadEnrollmentConfig, t as configFile } from "./config-UyXnaekw.mjs";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { chmodSync, closeSync, constants, existsSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, readlinkSync, realpathSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { homedir, hostname, userInfo } from "node:os";
@@ -13,6 +13,23 @@ import { parseEnv } from "node:util";
 import { access, cp, lstat, mkdir, readFile, readdir, realpath, rename, rm, stat, writeFile } from "node:fs/promises";
 import { fileURLToPath } from "node:url";
 //#region src/manifest.ts
+function loadSlackManifestDefaults(env, home) {
+	let contents;
+	try {
+		contents = readFileSync(configFile(env, home), "utf8");
+	} catch (error) {
+		if (error !== null && typeof error === "object" && "code" in error && error.code === "ENOENT") return {};
+		throw new CliError("config", void 0, void 0, "Read config.yaml before generating a manifest.");
+	}
+	const document = YAML.parseDocument(contents);
+	if (document.errors.length > 0) throw new CliError("config", void 0, void 0, "Fix the YAML in config.yaml.");
+	const parsed = configSchema.safeParse(document.toJS());
+	if (!parsed.success) throw new CliError("config", void 0, void 0, `Fix ${parsed.error.issues[0]?.path.map(String).join(".") || "config.yaml"} in config.yaml.`);
+	return {
+		appName: parsed.data.slack.appName,
+		command: parsed.data.slack.command
+	};
+}
 function renderSlackManifest(options = {}) {
 	const appName = (options.appName ?? "spur-board").trim();
 	const command = options.command ?? "/board";
@@ -140,12 +157,6 @@ function warning(id, fix) {
 		fix
 	};
 }
-function configFile(env, home) {
-	const boardHome = env["BOARD_HOME"];
-	if (boardHome) return join(resolve(boardHome), "config.yaml");
-	const xdg = env["XDG_CONFIG_HOME"];
-	return join(xdg && isAbsolute(xdg) ? xdg : join(home, ".config"), "spur-board", "config.yaml");
-}
 function unitFile(env, home) {
 	const xdg = env["XDG_CONFIG_HOME"];
 	return join(xdg && isAbsolute(xdg) ? xdg : join(home, ".config"), "systemd", "user", "spur-board.service");
@@ -334,8 +345,8 @@ async function runDoctor(options = {}) {
 	checks.push(stale.length > 0 || unknownStarts ? warning("sessions.stale", `Restart sessions started before the last skill install${staleIds.length ? `: ${staleIds.join(", ")}` : ""}; verify sessions whose start time is unavailable.`) : result("sessions.stale", true, "Restart older sessions."));
 	let remote = null;
 	try {
-		const base = env["BOARD_DAEMON_URL"] || `http://127.0.0.1:${String(config.http.port)}`;
-		const response = await ports.fetcher(new URL("/v1/doctor", base), { signal: AbortSignal.timeout(8e3) });
+		const address = resolveDaemonAddress(env, home, config.http.port);
+		const response = await ports.fetcher(new URL("/v1/doctor", address), { signal: AbortSignal.timeout(8e3) });
 		if (response.ok) remote = remoteChecks(await response.json());
 	} catch {}
 	checks.push(result("daemon.available", remote !== null, "Start or restart the user service."));
@@ -994,7 +1005,9 @@ function registerSetupCommands(program, options, io, env) {
 		const appName = manifest.opts()["appName"];
 		const command = manifest.opts()["command"];
 		if (appName !== void 0 && typeof appName !== "string" || command !== void 0 && typeof command !== "string") throw new CliError("usage");
+		const defaults = appName === void 0 || command === void 0 ? loadSlackManifestDefaults(env, options.home ?? homedir()) : {};
 		io.stdout(renderSlackManifest({
+			...defaults,
 			...appName === void 0 ? {} : { appName },
 			...command === void 0 ? {} : { command }
 		}));
@@ -1032,7 +1045,7 @@ function createProgram(options = {}) {
 			const key = op.kind === "mutation" ? keyOption || randomUUID() : void 0;
 			if (key) io.stderr(`key: ${escapeTerminalControls(key)}\n`);
 			try {
-				const result = await requestOperation(op, input, key, config);
+				const result = await (options.sendOperation ?? requestOperation)(op, input, key, config);
 				io.stdout(`${json || !io.isTTY ? JSON.stringify(result) : formatHuman(result)}\n`);
 			} catch (error) {
 				if (error instanceof CliError) {

package/dist/{client-sGJ4fzQ4.mjs → client-BnkZmz1i.mjs}

@@ -1,4 +1,4 @@
-import { M as errorContextSchema, N as errorEnvelopeSchema, P as successEnvelopeSchema, j as ERRORS, l as renderJsonError } from "./src-Cf78bzK5.mjs";
+import { M as errorContextSchema, N as errorEnvelopeSchema, P as successEnvelopeSchema, j as ERRORS, l as renderJsonError } from "./src-VWyX7Nwm.mjs";
 import { randomUUID } from "node:crypto";
 import { z } from "zod";
 import { request } from "node:http";

package/dist/client.mjs

@@ -1,2 +1,2 @@
-import { n as requestTokenEnrollment, t as requestOperation } from "./client-sGJ4fzQ4.mjs";
+import { n as requestTokenEnrollment, t as requestOperation } from "./client-BnkZmz1i.mjs";
 export { requestOperation, requestTokenEnrollment };

package/dist/{config-DPXFxZQy.mjs → config-UyXnaekw.mjs}

@@ -1,13 +1,32 @@
-import { r as CliError } from "./client-sGJ4fzQ4.mjs";
+import { R as configSchema } from "./src-VWyX7Nwm.mjs";
+import { r as CliError } from "./client-BnkZmz1i.mjs";
 import { closeSync, constants, fstatSync, lstatSync, openSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { homedir } from "node:os";
-import { dirname, isAbsolute, join, relative, sep } from "node:path";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import YAML from "yaml";
 //#region src/config.ts
 const CONNECT_TIMEOUT_MS = 2e3;
 const RESPONSE_TIMEOUT_MS = 3e4;
-function daemonAddress(env) {
+function configFile(env, home) {
+	const boardHome = env["BOARD_HOME"];
+	if (boardHome) return join(resolve(boardHome), "config.yaml");
+	const xdg = env["XDG_CONFIG_HOME"];
+	return join(xdg && isAbsolute(xdg) ? xdg : join(home, ".config"), "spur-board", "config.yaml");
+}
+function resolveDaemonAddress(env = process.env, home = homedir(), configuredPort) {
 	const rawAddress = env["BOARD_DAEMON_URL"];
-	if (!rawAddress) throw new CliError("config", { environmentVariable: "BOARD_DAEMON_URL" });
+	if (rawAddress === void 0) {
+		let port = configuredPort ?? 4311;
+		if (configuredPort === void 0) try {
+			const parsed = YAML.parseDocument(readFileSync(configFile(env, home), "utf8"));
+			if (parsed.errors.length === 0) {
+				const config = configSchema.safeParse(parsed.toJS());
+				if (config.success) port = config.data.http.port;
+			}
+		} catch {}
+		if (port === 0) throw new CliError("config", void 0, void 0, "http.port: 0 assigns a runtime port that clients cannot discover. Set BOARD_DAEMON_URL to the daemon listening address.");
+		return new URL(`http://127.0.0.1:${String(port)}`);
+	}
 	let address;
 	try {
 		address = new URL(rawAddress);
@@ -66,7 +85,7 @@ function loadClientConfig(env = process.env, paths = {
 	cwd: process.cwd(),
 	home: homedir()
 }) {
-	const address = daemonAddress(env);
+	const address = resolveDaemonAddress(env, paths.home);
 	const session = env["SPUR_SESSION"] || void 0;
 	const token = session ? void 0 : env["BOARD_TOKEN"] === void 0 ? findTokenFile(paths.cwd, paths.home) : env["BOARD_TOKEN"];
 	if (!session && !token) throw new CliError("config", { environmentVariable: "BOARD_TOKEN" });
@@ -81,7 +100,7 @@ function loadClientConfig(env = process.env, paths = {
 /** Enrollment sends only a hash and works before any operator credential exists. */
 function loadEnrollmentConfig(env = process.env) {
 	return {
-		address: daemonAddress(env),
+		address: resolveDaemonAddress(env),
 		session: void 0,
 		token: void 0,
 		connectTimeoutMs: CONNECT_TIMEOUT_MS,
@@ -89,4 +108,4 @@ function loadEnrollmentConfig(env = process.env) {
 	};
 }
 //#endregion
-export { loadEnrollmentConfig as n, loadClientConfig as t };
+export { resolveDaemonAddress as i, loadClientConfig as n, loadEnrollmentConfig as r, configFile as t };

package/dist/daemon.mjs

@@ -1,4 +1,4 @@
-import { A as taskKeySchema, C as sessionFactsSchema, D as errorCodeOf, E as encodeActorId, F as configSchema, I as SLACK_BOT_SCOPES, O as parseActorId, P as successEnvelopeSchema, S as prRefSchema, T as actorIdSchema, _ as EVENT_KINDS, a as buildCatalogSnapshot, b as SESSION_STATUSES, c as renderHttpProblem, d as SPACE_IDS, f as conversationRefSchema, g as userIdSchema, h as messageRefSchema, i as sourceCursorSchema, j as ERRORS, k as parseRef$1, m as interactionRefSchema, n as batchSchema, o as roleCanUseOperation, p as inboundEventSchema, r as entityRefSchema, s as OPERATIONS, t as AdapterError, v as eventPayloadSchemas, w as ticketFactsSchema, x as prFactsSchema, y as SESSION_HEALTH_STATES } from "./src-Cf78bzK5.mjs";
+import { A as taskKeySchema, C as sessionFactsSchema, D as errorCodeOf, E as encodeActorId, L as DEFAULT_SLACK_COMMAND, O as parseActorId, P as successEnvelopeSchema, R as configSchema, S as prRefSchema, T as actorIdSchema, _ as EVENT_KINDS, a as buildCatalogSnapshot, b as SESSION_STATUSES, c as renderHttpProblem, d as SPACE_IDS, f as conversationRefSchema, g as userIdSchema, h as messageRefSchema, i as sourceCursorSchema, j as ERRORS, k as parseRef$1, m as interactionRefSchema, n as batchSchema, o as roleCanUseOperation, p as inboundEventSchema, r as entityRefSchema, s as OPERATIONS, t as AdapterError, v as eventPayloadSchemas, w as ticketFactsSchema, x as prFactsSchema, y as SESSION_HEALTH_STATES, z as SLACK_BOT_SCOPES } from "./src-VWyX7Nwm.mjs";
 import { createRequire } from "node:module";
 import { createHash, randomUUID } from "node:crypto";
 import { closeSync, existsSync, fstatSync, ftruncateSync, mkdirSync, openSync, readFileSync, readdirSync, writeSync } from "node:fs";
@@ -11546,6 +11546,13 @@ function createInbound(input) {
 		await clearItem(trx, item.id, new Date(at));
 	}
 	async function runUser(trx, event, at) {
+		if (event.kind === "command" && event.name !== void 0 && event.name !== config.slack.command) return deny(trx, {
+			event,
+			reason: "Command name does not match the configured command.",
+			actor: "system",
+			gateway: gateway.kind,
+			at
+		});
 		if (event.kind !== "message_deleted" && event.author !== config.operator.slack) return deny(trx, {
 			event,
 			reason: "Only the configured operator may act.",
@@ -11731,7 +11738,7 @@ function createInbound(input) {
 		} catch {}
 	}
 	async function applyUser(event) {
-		if ((event.kind === "command" || event.kind === "action") && event.author === config.operator.slack && (event.kind === "command" || event.sourceSpace !== null)) {
+		if ((event.kind === "command" || event.kind === "action") && event.author === config.operator.slack && (event.kind !== "command" || event.name === void 0 || event.name === config.slack.command) && (event.kind === "command" || event.sourceSpace !== null)) {
 			await dispatchInteraction(event);
 			return;
 		}
@@ -11811,6 +11818,7 @@ function createInbound(input) {
 				const item = await store.db.selectFrom("operator_item").select(["cleared_at", "inbound_event_json"]).where("id", "=", itemId).executeTakeFirst();
 				if (item === void 0 || item.cleared_at !== null || item.inbound_event_json === null) throw new CommandError("retry_not_applicable", "This item has no stored event to retry.");
 				let event = inboundEventSchema.parse(JSON.parse(item.inbound_event_json));
+				if (event.kind === "command" && event.name !== void 0 && event.name !== config.slack.command) throw new CommandError("retry_not_applicable", "This interaction cannot be retried.");
 				if (event.kind === "command" && event.command === void 0) {
 					const command = legacyCommand(event.text);
 					if (command === null) throw new CommandError("retry_not_applicable", "This interaction cannot be retried.");
@@ -14896,7 +14904,7 @@ function createDeliveryGateway(client, channels) {
 function descriptors(commandName) {
 	return OPERATIONS.filter((operation) => operation.kind === "query" && operation.slack?.kind === "slash-command").map((operation) => ({
 		operation,
-		usage: operation.slack?.kind === "slash-command" ? operation.slack.usage.replace(/^\/board\b/, commandName) : ""
+		usage: operation.slack?.kind === "slash-command" ? operation.slack.usage.replace(/^\/\S+/, commandName) : ""
 	}));
 }
 function commandUsage(commandName) {
@@ -15071,7 +15079,7 @@ function normalizeMessage(channel, payload, context) {
 	return events;
 }
 /** Actions and commands share the same stable trigger identity as their Slack retry. */
-function normalizeInteraction(type, payload, channels, root, commandName = "/board") {
+function normalizeInteraction(type, payload, channels, root, commandName = DEFAULT_SLACK_COMMAND) {
 	const body = record$1(payload);
 	if (body === null) return [];
 	const triggerId = string$1(body.trigger_id);
@@ -15080,16 +15088,18 @@ function normalizeInteraction(type, payload, channels, root, commandName = "/boa
 	if (user === void 0) return [];
 	const author = userIdSchema.parse(user);
 	if (type === "slash_commands") {
-		if (body.command !== commandName) return [];
+		const name = string$1(body.command);
+		if (name === void 0) return [];
 		const channel = string$1(body.channel_id);
 		if (channel === void 0) return [];
 		return [{
 			kind: "command",
+			name,
 			dedupeKey: `slack:${triggerId}`,
 			interaction: interactionRef(channel, user, triggerId),
 			author,
 			text: text(body.text) ?? "",
-			command: parseCommand(text(body.text) ?? "", commandName),
+			...name === commandName ? { command: parseCommand(text(body.text) ?? "", commandName) } : {},
 			sourceUrl: sourceUrl(channel),
 			sourceSpace: sourceSpace(channel, channels)
 		}];

package/dist/mcp.mjs

@@ -1,6 +1,6 @@
-import { j as ERRORS, s as OPERATIONS, u as renderMcpError } from "./src-Cf78bzK5.mjs";
-import { r as CliError, t as requestOperation } from "./client-sGJ4fzQ4.mjs";
-import { t as loadClientConfig } from "./config-DPXFxZQy.mjs";
+import { j as ERRORS, s as OPERATIONS, u as renderMcpError } from "./src-VWyX7Nwm.mjs";
+import { r as CliError, t as requestOperation } from "./client-BnkZmz1i.mjs";
+import { n as loadClientConfig } from "./config-UyXnaekw.mjs";
 import { randomUUID } from "node:crypto";
 import { readFileSync } from "node:fs";
 import { z } from "zod";

package/dist/{src-Cf78bzK5.mjs → src-VWyX7Nwm.mjs}

@@ -110,6 +110,9 @@ const SLACK_BOT_SCOPES = [
 ];
 //#endregion
 //#region ../contracts/src/config.ts
+const DEFAULT_HTTP_PORT = 4311;
+const DEFAULT_SLACK_APP_NAME = "spur-board";
+const DEFAULT_SLACK_COMMAND = "/board";
 const WEEKDAYS = [
 	"monday",
 	"tuesday",
@@ -246,7 +249,8 @@ const configSchema = z.strictObject({
 	}),
 	operator: z.strictObject({ slack: nonEmpty }),
 	slack: z.strictObject({
-		command: z.string().regex(/^\/[a-z0-9_-]+$/, "Expected a slash command such as /board").default("/board"),
+		appName: z.string().trim().min(1).default(DEFAULT_SLACK_APP_NAME),
+		command: z.string().regex(/^\/[a-z0-9_-]+$/, "Expected a slash command such as /board").default(DEFAULT_SLACK_COMMAND),
 		appId: z.string().regex(/^A[A-Z0-9]+$/, "Expected a Slack app ID").optional(),
 		channels: z.strictObject({
 			orchestrators: nonEmpty.optional(),
@@ -276,7 +280,7 @@ const configSchema = z.strictObject({
 			message: "Final unanswered pause must exceed the second retry pause"
 		});
 	}).prefault({}),
-	http: z.strictObject({ port: z.int().min(0).max(65535).default(4311).describe("Local HTTP API port (0 assigns a free port).") }).prefault({}),
+	http: z.strictObject({ port: z.int().min(0).max(65535).default(DEFAULT_HTTP_PORT).describe("Local HTTP API port (0 assigns a free port).") }).prefault({}),
 	adapters: z.strictObject({
 		spur: spurAdapterSection,
 		github: adapterSection(6e4),
@@ -1113,6 +1117,7 @@ const actionEventSchema = z.strictObject({
 /** `text` is the command's argument text. */
 const commandEventSchema = z.strictObject({
 	kind: z.literal("command"),
+	name: z.string().min(1).optional(),
 	dedupeKey,
 	interaction: interactionRefSchema,
 	author: userIdSchema,
@@ -2630,4 +2635,4 @@ var AdapterError = class extends Error {
 	}
 };
 //#endregion
-export { taskKeySchema as A, sessionFactsSchema as C, errorCodeOf as D, encodeActorId as E, configSchema as F, SLACK_BOT_SCOPES as I, errorContextSchema as M, errorEnvelopeSchema as N, parseActorId as O, successEnvelopeSchema as P, prRefSchema as S, actorIdSchema as T, EVENT_KINDS as _, buildCatalogSnapshot as a, SESSION_STATUSES as b, renderHttpProblem as c, SPACE_IDS as d, conversationRefSchema as f, userIdSchema as g, messageRefSchema as h, sourceCursorSchema as i, ERRORS as j, parseRef as k, renderJsonError as l, interactionRefSchema as m, batchSchema as n, roleCanUseOperation as o, inboundEventSchema as p, entityRefSchema as r, OPERATIONS as s, AdapterError as t, renderMcpError as u, eventPayloadSchemas as v, ticketFactsSchema as w, prFactsSchema as x, SESSION_HEALTH_STATES as y };
+export { taskKeySchema as A, sessionFactsSchema as C, errorCodeOf as D, encodeActorId as E, DEFAULT_HTTP_PORT as F, DEFAULT_SLACK_APP_NAME as I, DEFAULT_SLACK_COMMAND as L, errorContextSchema as M, errorEnvelopeSchema as N, parseActorId as O, successEnvelopeSchema as P, configSchema as R, prRefSchema as S, actorIdSchema as T, EVENT_KINDS as _, buildCatalogSnapshot as a, SESSION_STATUSES as b, renderHttpProblem as c, SPACE_IDS as d, conversationRefSchema as f, userIdSchema as g, messageRefSchema as h, sourceCursorSchema as i, ERRORS as j, parseRef as k, renderJsonError as l, interactionRefSchema as m, batchSchema as n, roleCanUseOperation as o, inboundEventSchema as p, entityRefSchema as r, OPERATIONS as s, AdapterError as t, renderMcpError as u, eventPayloadSchemas as v, ticketFactsSchema as w, prFactsSchema as x, SESSION_HEALTH_STATES as y, SLACK_BOT_SCOPES as z };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "spur-board",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "license": "MIT",
   "engines": {
     "node": "^24.12.0 || ^26.0.0"

package/skills/setup/references/slack.md

@@ -4,6 +4,6 @@ Use this when the orchestrators or feed channel is not configured, or the app-le
 
 1. Check the bot's current channel membership. List the private channels it can see and ask the operator, one choice at a time, which should serve orchestrators and feed. An empty list does not prove no channels exist: the bot sees only private channels to which it was invited. Store channel IDs in config, never guessed names.
 2. If no channel fits, ask for an operator-chosen prefix and suggest available names using it. The operator creates or invites the app to channels; ask before any app or channel change.
-3. Check whether an app and slash command already exist. If either is missing, use `board slack manifest --app-name <name> --command <slash-command>` to prepare a manifest with operator-chosen names. The operator creates the Slack app; do not claim the manifest creates it.
-4. The manifest cannot create the app-level token with `connections:write`. Guide the operator through creating that token in Slack, then use the private entry procedure in [secret files](secrets.md). Never ask for a token value in chat.
+3. Check whether an app and slash command already exist. If either is missing, use `board slack manifest --app-name <name> --command <slash-command>` to prepare a manifest with operator-chosen names. The operator creates the Slack app; do not claim the manifest creates it. Set `slack.appName` and `slack.command` in config to the selected names.
+4. The manifest cannot create the app-level token with `connections:write`. In the Slack app settings, open **Basic Information → App-Level Tokens** and create a token with that scope. Then use the private entry procedure in [secret files](secrets.md). Never ask for a token value in chat.
 5. Check channel membership and command configuration with online doctor. If a check fails, apply its reported fix after inspecting state.