spur-board 0.5.0 → 0.6.1

package/dist/cli.mjs

@@ -1,10 +1,10 @@
-import { R as configSchema, s as OPERATIONS, z as SLACK_BOT_SCOPES } from "./src-VWyX7Nwm.mjs";
-import { a as renderCliError, i as errorExitCode, n as requestTokenEnrollment, o as escapeTerminalControls, r as CliError, t as requestOperation } from "./client-BnkZmz1i.mjs";
-import { i as resolveDaemonAddress, n as loadClientConfig, r as loadEnrollmentConfig, t as configFile } from "./config-UyXnaekw.mjs";
+import { B as SLACK_BOT_SCOPES, R as configSchema, s as OPERATIONS, z as requiredSecretKeys } from "./src-BFgTh55w.mjs";
+import { a as renderCliError, i as errorExitCode, n as requestTokenEnrollment, o as escapeTerminalControls, r as CliError, t as requestOperation } from "./client-Ln76BdDz.mjs";
+import { i as resolveDaemonAddress, n as loadClientConfig, r as loadEnrollmentConfig, t as configFile } from "./config-B_6fA4Au.mjs";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { chmodSync, closeSync, constants, existsSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, readlinkSync, realpathSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { homedir, hostname, userInfo } from "node:os";
-import { dirname, isAbsolute, join, resolve } from "node:path";
+import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { Command, CommanderError } from "@commander-js/extra-typings";
 import { z } from "zod";
 import YAML from "yaml";
@@ -190,12 +190,7 @@ function localSecrets(config, path, ports) {
 	} catch {
 		names = {};
 	}
-	const slackConfigured = Boolean(config.slack.channels.feed || config.slack.channels.orchestrators);
-	const required = [
-		"GITHUB_TOKEN",
-		...config.projects.some((project) => project.tracker.type === "jira") ? ["JIRA_EMAIL", "JIRA_API_TOKEN"] : [],
-		...slackConfigured ? ["SLACK_BOT_TOKEN", "SLACK_APP_TOKEN"] : []
-	];
+	const required = requiredSecretKeys(config);
 	const missing = required.filter((name) => !names[name]);
 	return {
 		...result("secrets", missing.length === 0, `Add ${missing.join(", ")} to the private secrets.env file.`),
@@ -406,8 +401,6 @@ function renderUserUnit(paths) {
 	return [
 		"[Unit]",
 		"Description=spur-board daemon",
-		"After=network-online.target",
-		"Wants=network-online.target",
 		"",
 		"[Service]",
 		"Type=simple",
@@ -618,14 +611,48 @@ async function targetDirectory(path) {
 		throw error;
 	}
 }
-async function checkTarget(home, agent, destination) {
-	const parent = join(home, agent, "skills");
-	await targetDirectory(join(home, agent));
-	await targetDirectory(parent);
-	return targetDirectory(destination);
+async function resolvedParent(path) {
+	let entry;
+	try {
+		entry = await lstat(path);
+	} catch (error) {
+		if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+			const ancestor = await resolvedParent(dirname(path));
+			const parent = join(ancestor.parent, basename(path));
+			return {
+				parent,
+				missing: [...ancestor.missing, parent]
+			};
+		}
+		throw error;
+	}
+	if (!entry.isDirectory() && !entry.isSymbolicLink()) throw new Error(`Skill install parent must be a directory: ${path}`);
+	const canonical = await realpath(path);
+	if (!(await stat(canonical)).isDirectory()) throw new Error(`Skill install parent must be a directory: ${path}`);
+	return {
+		parent: canonical,
+		missing: []
+	};
+}
+async function createMissingParents(paths) {
+	for (const path of paths) {
+		try {
+			await mkdir(path, { mode: 448 });
+		} catch (error) {
+			if (!(error instanceof Error && "code" in error && error.code === "EEXIST")) throw error;
+		}
+		const entry = await lstat(path);
+		if (!entry.isDirectory() || entry.isSymbolicLink() || await realpath(path) !== path) throw new Error(`Skill install parent must be a directory, not a new symlink: ${path}`);
+	}
 }
-async function withInstallLock(home, action) {
-	const fd = openSync(join(home, ".spur-board-skills-install.lock"), constants.O_CREAT | constants.O_RDWR | constants.O_NOFOLLOW, 384);
+async function withInstallLock(home, env, action) {
+	const configured = env["XDG_STATE_HOME"];
+	const stateDir = join(configured && isAbsolute(configured) ? configured : join(home, ".local", "state"), "spur-board");
+	await mkdir(stateDir, {
+		recursive: true,
+		mode: 448
+	});
+	const fd = openSync(join(stateDir, "skills-install.lock"), constants.O_CREAT | constants.O_RDWR | constants.O_NOFOLLOW, 384);
 	try {
 		await new Promise((resolveLock, reject) => {
 			const child = spawn("flock", [
@@ -707,88 +734,96 @@ async function recoverSkill(parent, destination, name) {
 		await rm(owner);
 	}
 }
-async function installIntoHome(home, packageRoot, version, options) {
-	for (const agent of agents) for (const skill of skills) await checkTarget(home, agent, join(home, agent, "skills", skill.name));
+async function installIntoHome(home, packageRoot, version, options, env) {
+	const targets = await Promise.all(agents.map(async (agent) => {
+		const configured = agent === ".codex" ? env["CODEX_HOME"] : void 0;
+		return {
+			agent,
+			...await resolvedParent(join(configured ? resolve(configured) : join(home, agent), "skills"))
+		};
+	}));
+	for (const { parent } of targets) for (const skill of skills) await targetDirectory(join(parent, skill.name));
 	const installedAt = (options.now ?? (() => /* @__PURE__ */ new Date()))().toISOString();
+	for (const { parent, missing } of targets) {
+		await createMissingParents(missing);
+		if (await realpath(parent) !== parent) throw new Error(`Skill install parent changed after preflight: ${parent}`);
+	}
 	const results = [];
-	for (const agent of agents) {
-		const parent = join(home, agent, "skills");
-		for (const skill of skills) {
-			const destination = join(parent, skill.name);
-			await recoverSkill(parent, destination, skill.name);
-			const changed = !await currentVersion(destination, version);
-			if (changed) {
-				await mkdir(parent, { recursive: true });
-				await checkTarget(home, agent, destination);
-				const stageId = randomUUID();
-				const staged = join(parent, `.${skill.name}-stage-${stageId}`);
-				const owner = `${staged}.owner`;
-				await writeFile(owner, `spur-board stage ${stageId}\n`, {
-					flag: "wx",
-					mode: 384
-				});
-				let stagedCreated = false;
-				try {
-					await mkdir(staged, { mode: 448 });
-					stagedCreated = true;
-					const source = join(packageRoot, "skills", skill.source);
-					if (options.copySkill) await options.copySkill(source, staged);
-					else await cp(source, staged, { recursive: true });
-					const stamp = {
-						version,
-						installedAt
-					};
-					await writeFile(join(staged, stampName), `${JSON.stringify(stamp, null, 2)}\n`);
-					if (await checkTarget(home, agent, destination)) {
-						const backupId = randomUUID();
-						const backup = join(parent, `.${skill.name}-backup-${backupId}`);
-						const backupOwner = `${backup}.owner`;
-						const original = await lstat(destination, { bigint: true });
-						await writeFile(backupOwner, `spur-board backup ${backupId} ${`${String(original.dev)}:${String(original.ino)}`}\n`, {
-							flag: "wx",
-							mode: 384
-						});
-						let backupContainsSkill = false;
+	for (const { agent, parent } of targets) for (const skill of skills) {
+		const destination = join(parent, skill.name);
+		await recoverSkill(parent, destination, skill.name);
+		const changed = !await currentVersion(destination, version);
+		if (changed) {
+			await targetDirectory(destination);
+			const stageId = randomUUID();
+			const staged = join(parent, `.${skill.name}-stage-${stageId}`);
+			const owner = `${staged}.owner`;
+			await writeFile(owner, `spur-board stage ${stageId}\n`, {
+				flag: "wx",
+				mode: 384
+			});
+			let stagedCreated = false;
+			try {
+				await mkdir(staged, { mode: 448 });
+				stagedCreated = true;
+				const source = join(packageRoot, "skills", skill.source);
+				if (options.copySkill) await options.copySkill(source, staged);
+				else await cp(source, staged, { recursive: true });
+				const stamp = {
+					version,
+					installedAt
+				};
+				await writeFile(join(staged, stampName), `${JSON.stringify(stamp, null, 2)}\n`);
+				if (await targetDirectory(destination)) {
+					const backupId = randomUUID();
+					const backup = join(parent, `.${skill.name}-backup-${backupId}`);
+					const backupOwner = `${backup}.owner`;
+					const original = await lstat(destination, { bigint: true });
+					await writeFile(backupOwner, `spur-board backup ${backupId} ${`${String(original.dev)}:${String(original.ino)}`}\n`, {
+						flag: "wx",
+						mode: 384
+					});
+					let backupContainsSkill = false;
+					try {
+						if (await targetDirectory(backup)) throw new Error(`Skill backup path already exists: ${backup}`);
+						await rename(destination, backup);
+						backupContainsSkill = true;
 						try {
-							if (await targetDirectory(backup)) throw new Error(`Skill backup path already exists: ${backup}`);
-							await rename(destination, backup);
-							backupContainsSkill = true;
-							try {
-								await rename(staged, destination);
-							} catch (error) {
-								await rename(backup, destination);
-								backupContainsSkill = false;
-								throw error;
-							}
-							await rm(backup, { recursive: true });
+							await rename(staged, destination);
+						} catch (error) {
+							await rename(backup, destination);
 							backupContainsSkill = false;
-						} finally {
-							if (!backupContainsSkill) await rm(backupOwner);
+							throw error;
 						}
-					} else await rename(staged, destination);
-				} finally {
-					if (stagedCreated) await rm(staged, {
-						recursive: true,
-						force: true
-					});
-					await rm(owner);
-				}
+						await rm(backup, { recursive: true });
+						backupContainsSkill = false;
+					} finally {
+						if (!backupContainsSkill) await rm(backupOwner);
+					}
+				} else await rename(staged, destination);
+			} finally {
+				if (stagedCreated) await rm(staged, {
+					recursive: true,
+					force: true
+				});
+				await rm(owner);
 			}
-			results.push({
-				agent: agent === ".claude" ? "claude" : "codex",
-				skill: skill.name,
-				changed
-			});
 		}
+		results.push({
+			agent: agent === ".claude" ? "claude" : "codex",
+			skill: skill.name,
+			changed
+		});
 	}
 	return results;
 }
 async function installSkills(options = {}) {
 	const packageRoot = resolve(options.packageRoot ?? fileURLToPath(new URL("../", import.meta.url)));
 	const home = await realpath(resolve(options.home ?? homedir()));
+	const env = options.env ?? process.env;
 	const version = await packageVersion(packageRoot);
 	await Promise.all(skills.map((skill) => requireSource(join(packageRoot, "skills", skill.source))));
-	return withInstallLock(home, () => installIntoHome(home, packageRoot, version, options));
+	return withInstallLock(home, env, () => installIntoHome(home, packageRoot, version, options, env));
 }
 //#endregion
 //#region src/cli.ts
@@ -973,7 +1008,10 @@ function registerSetupCommands(program, options, io, env) {
 		if (checks.some((check) => check.blocking)) throw new CommanderError(1, "board.error", "Doctor found blocking failures.");
 	});
 	commandFor(program, "skills install").description("Install bundled skills for Claude Code and Codex.").action(async () => {
-		print(await runSetup(() => installSkills(options.setup)));
+		print(await runSetup(() => installSkills({
+			...options.setup,
+			env
+		})));
 	});
 	commandFor(program, "service install").description("Install and start the systemd user service.").action(async () => {
 		print(await runSetup(() => installService(serviceOptions)));

package/dist/{client-BnkZmz1i.mjs → client-Ln76BdDz.mjs}

@@ -1,4 +1,4 @@
-import { M as errorContextSchema, N as errorEnvelopeSchema, P as successEnvelopeSchema, j as ERRORS, l as renderJsonError } from "./src-VWyX7Nwm.mjs";
+import { M as errorContextSchema, N as errorEnvelopeSchema, P as successEnvelopeSchema, j as ERRORS, l as renderJsonError } from "./src-BFgTh55w.mjs";
 import { randomUUID } from "node:crypto";
 import { z } from "zod";
 import { request } from "node:http";

package/dist/client.mjs

@@ -1,2 +1,2 @@
-import { n as requestTokenEnrollment, t as requestOperation } from "./client-BnkZmz1i.mjs";
+import { n as requestTokenEnrollment, t as requestOperation } from "./client-Ln76BdDz.mjs";
 export { requestOperation, requestTokenEnrollment };

package/dist/{config-UyXnaekw.mjs → config-B_6fA4Au.mjs}

@@ -1,5 +1,5 @@
-import { R as configSchema } from "./src-VWyX7Nwm.mjs";
-import { r as CliError } from "./client-BnkZmz1i.mjs";
+import { R as configSchema } from "./src-BFgTh55w.mjs";
+import { r as CliError } from "./client-Ln76BdDz.mjs";
 import { closeSync, constants, fstatSync, lstatSync, openSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";

package/dist/daemon.mjs

@@ -1,4 +1,4 @@
-import { A as taskKeySchema, C as sessionFactsSchema, D as errorCodeOf, E as encodeActorId, L as DEFAULT_SLACK_COMMAND, O as parseActorId, P as successEnvelopeSchema, R as configSchema, S as prRefSchema, T as actorIdSchema, _ as EVENT_KINDS, a as buildCatalogSnapshot, b as SESSION_STATUSES, c as renderHttpProblem, d as SPACE_IDS, f as conversationRefSchema, g as userIdSchema, h as messageRefSchema, i as sourceCursorSchema, j as ERRORS, k as parseRef$1, m as interactionRefSchema, n as batchSchema, o as roleCanUseOperation, p as inboundEventSchema, r as entityRefSchema, s as OPERATIONS, t as AdapterError, v as eventPayloadSchemas, w as ticketFactsSchema, x as prFactsSchema, y as SESSION_HEALTH_STATES, z as SLACK_BOT_SCOPES } from "./src-VWyX7Nwm.mjs";
+import { A as taskKeySchema, B as SLACK_BOT_SCOPES, C as sessionFactsSchema, D as errorCodeOf, E as encodeActorId, L as DEFAULT_SLACK_COMMAND, O as parseActorId, P as successEnvelopeSchema, R as configSchema, S as prRefSchema, T as actorIdSchema, _ as EVENT_KINDS, a as buildCatalogSnapshot, b as SESSION_STATUSES, c as renderHttpProblem, d as SPACE_IDS, f as conversationRefSchema, g as userIdSchema, h as messageRefSchema, i as sourceCursorSchema, j as ERRORS, k as parseRef$1, m as interactionRefSchema, n as batchSchema, o as roleCanUseOperation, p as inboundEventSchema, r as entityRefSchema, s as OPERATIONS, t as AdapterError, v as eventPayloadSchemas, w as ticketFactsSchema, x as prFactsSchema, y as SESSION_HEALTH_STATES, z as requiredSecretKeys } from "./src-BFgTh55w.mjs";
 import { createRequire } from "node:module";
 import { createHash, randomUUID } from "node:crypto";
 import { closeSync, existsSync, fstatSync, ftruncateSync, mkdirSync, openSync, readFileSync, readdirSync, writeSync } from "node:fs";
@@ -12736,6 +12736,11 @@ function retryAt(headers, now) {
 }
 //#endregion
 //#region ../adapters/src/github/client.ts
+function teamNameScopeDenied(error, query) {
+	if (error.type !== "INSUFFICIENT_SCOPES" || !query.includes("... on Team { name }")) return false;
+	if (error.path !== void 0) return error.path.includes("reviewRequests") && error.path.includes("requestedReviewer") && error.path.at(-1) === "name";
+	return /\bname\b/i.test(error.message) && /\bread:(?:org|discussion)\b/i.test(error.message);
+}
 function record$2(value) {
 	if (value === null || typeof value !== "object" || Array.isArray(value)) throw new AdapterError("transient", "Malformed GitHub response");
 	return value;
@@ -12824,6 +12829,8 @@ var GithubClient = class {
 			status: 429,
 			headers: response.headers
 		}, Date.now());
+		if (errors.some((error) => teamNameScopeDenied(error, query))) throw new AdapterError("auth", "GitHub token needs read:org for team review requests");
+		if (errors.some((error) => error.type === "INSUFFICIENT_SCOPES")) throw new AdapterError("auth", "GitHub token lacks a required GraphQL read scope");
 		const data = record$2(wire.data);
 		const rate = record$2(data.rateLimit);
 		const remaining = rate.remaining;
@@ -13056,6 +13063,12 @@ function githubSources(config, options) {
 function scoped(errors, root) {
 	return errors.filter((error) => error.path?.[0] === root);
 }
+function checkAccessDenied(errors) {
+	return errors.some((error) => error.type === "FORBIDDEN" && error.path?.includes("statusCheckRollup") === true && error.path.includes("contexts"));
+}
+function requireCheckAccess(errors) {
+	if (checkAccessDenied(errors)) throw new AdapterError("auth", "GitHub token lacks Checks read permission");
+}
 function rejectUnscoped(errors, roots) {
 	if (errors.some((error) => error.path === void 0 || !roots.includes(String(error.path[0])))) throw new AdapterError("transient", "Unscoped GitHub GraphQL error");
 }
@@ -13097,6 +13110,7 @@ async function fullPr(client, pr, owner, name, number, signal, budget) {
 			}, signal);
 			budget(response.budget);
 			rejectUnscoped(response.errors, ["repository"]);
+			requireCheckAccess(response.errors);
 			if (response.errors.length > 0) return void 0;
 			const pagePr = record$2(nested(response.data, "repository", "pullRequest"));
 			const page = field === "contexts" ? contexts(pagePr) : record$2(pagePr[field]);
@@ -13154,6 +13168,7 @@ async function pollRepository({ id, repo, login, prefixes, client, ctx }) {
 	const found = discover(nodes, ctx.cursor, login);
 	const bootstrapCursor = bootstrap && discoveryOk ? latestUpdatedAt(connectionNodes(nested(response.data, "repository", "mergedBaseline")), found.cursor) ?? sourceCursorSchema.parse("1970-01-01T00:00:00.000Z") : void 0;
 	const process = async (number, wire, errors, ref) => {
+		requireCheckAccess(errors);
 		const error = errors[0];
 		if (error !== void 0) {
 			const direct = error.path === void 0 || error.path.length <= 2;
@@ -13457,6 +13472,7 @@ function createGithubIssuesAdapter(options) {
 //#endregion
 //#region ../adapters/src/jira/jira.ts
 const SEARCH_PAGE_LIMIT = 20;
+const MAX_GET_SEARCH_URL_LENGTH = 2e3;
 const OUTSIDE_BATCH_SIZE = 50;
 const FALLBACK_REQUEST_LIMIT = 100;
 const SPRINT_SCHEMA = "com.pyxis.greenhopper.jira:gh-sprint";
@@ -13571,6 +13587,7 @@ function createJiraAdapter(options) {
 			if (signal.aborted) throw new AdapterError("transient", "Jira poll aborted");
 			throw new AdapterError("transient", "Jira request failed");
 		}
+		if (response.status === 414 && options.searchMethod === "GET") throw new AdapterError("config", "Jira GET search URL is too long");
 		if (!response.ok) throw new JiraHttpError(response.status, classifyHttpFailure({
 			status: response.status,
 			headers: response.headers
@@ -13612,19 +13629,28 @@ function createJiraAdapter(options) {
 		const seen = /* @__PURE__ */ new Set();
 		for (let page = 0; page < SEARCH_PAGE_LIMIT; page += 1) {
 			beforePage?.();
-			const result = object$1(await request(tracker.baseUrl, "/rest/api/3/search/jql", signal, {
+			const fields = [
+				"summary",
+				"status",
+				"assignee",
+				"labels",
+				"updated",
+				...sprintField === null ? [] : [sprintField]
+			];
+			const body = {
 				jql,
 				maxResults: 100,
-				fields: [
-					"summary",
-					"status",
-					"assignee",
-					"labels",
-					"updated",
-					...sprintField === null ? [] : [sprintField]
-				],
+				fields,
 				...token === void 0 ? {} : { nextPageToken: token }
-			}));
+			};
+			const path = options.searchMethod === "GET" ? `/rest/api/3/search/jql?${new URLSearchParams({
+				jql,
+				maxResults: "100",
+				fields: fields.join(","),
+				...token === void 0 ? {} : { nextPageToken: token }
+			}).toString()}` : "/rest/api/3/search/jql";
+			if (options.searchMethod === "GET" && new URL(path, tracker.baseUrl).href.length > MAX_GET_SEARCH_URL_LENGTH) throw new AdapterError("config", `Jira GET search URL is too long (over ${String(MAX_GET_SEARCH_URL_LENGTH)} characters)`);
+			const result = object$1(await request(tracker.baseUrl, path, signal, options.searchMethod === "GET" ? void 0 : body));
 			issues.push(...array(result["issues"]));
 			const next = result["nextPageToken"];
 			if (next == null || next === "") {
@@ -13878,9 +13904,15 @@ function applyEntityOutcomes(input) {
 function startRunner(options) {
 	const startedAt = (options.now ?? Date.now)();
 	const sources = options.entries.map((entry) => runSource(entry, options, startedAt));
-	return { async stop() {
-		await Promise.all(sources.map((source) => source.stop()));
-	} };
+	return {
+		firstAttempts: Promise.all(sources.map(async (source) => ({
+			source: source.id,
+			outcome: await source.firstAttempt
+		}))),
+		async stop() {
+			await Promise.all(sources.map((source) => source.stop()));
+		}
+	};
 }
 function runSource(entry, options, runnerStartMs) {
 	const { adapter, reserveRemaining } = entry;
@@ -13954,7 +13986,7 @@ function runSource(entry, options, runnerStartMs) {
 		if (stopping) return;
 		pollTimer = setTimeout(() => {
 			pollTimer = void 0;
-			current = poll();
+			current = poll().then(() => void 0);
 		}, delayMs);
 	}
 	async function poll() {
@@ -14050,22 +14082,28 @@ function runSource(entry, options, runnerStartMs) {
 			now: now()
 		});
 		failures = delay.failures;
-		armDeadline();
+		if (!options.oneShot) armDeadline();
 		await report();
-		schedule(delay.delayMs);
+		if (!options.oneShot) schedule(delay.delayMs);
+		return outcome;
 	}
-	armDeadline();
-	current = poll();
-	return { async stop() {
-		stopping = true;
-		clearTimeout(pollTimer);
-		clearTimeout(deadlineTimer);
-		clearTimeout(hardBoundTimer);
-		pollTimer = deadlineTimer = hardBoundTimer = void 0;
-		controller?.abort();
-		await current;
-		await reports;
-	} };
+	if (!options.oneShot) armDeadline();
+	const firstAttempt = poll();
+	current = firstAttempt.then(() => void 0);
+	return {
+		id: source,
+		firstAttempt,
+		async stop() {
+			stopping = true;
+			clearTimeout(pollTimer);
+			clearTimeout(deadlineTimer);
+			clearTimeout(hardBoundTimer);
+			pollTimer = deadlineTimer = hardBoundTimer = void 0;
+			controller?.abort();
+			await current;
+			await reports;
+		}
+	};
 }
 /**
 * Settles with `work`, or with undefined as soon as `signal` aborts, so `stop()` never waits
@@ -14325,7 +14363,8 @@ function startAdapters(config, core, options = {}) {
 			},
 			intervalMs: config.adapters.jira.intervalMs,
 			...options.fetch === void 0 ? {} : { fetch: options.fetch },
-			warn: options.warn ?? (() => void 0)
+			warn: options.warn ?? (() => void 0),
+			...options.jiraSearchMethod === void 0 ? {} : { searchMethod: options.jiraSearchMethod }
 		}) : blindSource(id, config.adapters.jira.intervalMs, "Jira credential is missing") });
 	} else {
 		const id = `github-issues:${project.id}:${project.tracker.repo.toLowerCase()}`;
@@ -14362,12 +14401,16 @@ function startAdapters(config, core, options = {}) {
 		}) }],
 		core,
 		config,
-		...options.now === void 0 ? {} : { now: options.now }
+		...options.now === void 0 ? {} : { now: options.now },
+		...options.oneShot === void 0 ? {} : { oneShot: options.oneShot }
 	});
-	return { async stop() {
-		await runner.stop();
-		await Promise.allSettled([...notices]);
-	} };
+	return {
+		firstAttempts: runner.firstAttempts,
+		async stop() {
+			await runner.stop();
+			await Promise.allSettled([...notices]);
+		}
+	};
 }
 //#endregion
 //#region ../gateway-slack/src/api.ts
@@ -15518,11 +15561,7 @@ async function runDaemonDoctor(ctx, productVersion, fetcher = fetch) {
 	const checks = [];
 	const jiraTrackers = config.projects.flatMap((project) => project.tracker.type === "jira" ? [project.tracker] : []);
 	const slackConfigured = Boolean(config.slack.channels.feed || config.slack.channels.orchestrators);
-	const missing = [
-		"GITHUB_TOKEN",
-		...jiraTrackers.length > 0 ? ["JIRA_EMAIL", "JIRA_API_TOKEN"] : [],
-		...slackConfigured ? ["SLACK_BOT_TOKEN", "SLACK_APP_TOKEN"] : []
-	].filter((name) => !secrets[name]);
+	const missing = requiredSecretKeys(config).filter((name) => !secrets[name]);
 	checks.push(check("secrets", missing.length === 0, `Add ${missing.join(", ")} to the private secrets.env file.`));
 	const jiraEmail = secrets["JIRA_EMAIL"];
 	const jiraToken = secrets["JIRA_API_TOKEN"];

package/dist/mcp.mjs

@@ -1,6 +1,6 @@
-import { j as ERRORS, s as OPERATIONS, u as renderMcpError } from "./src-VWyX7Nwm.mjs";
-import { r as CliError, t as requestOperation } from "./client-BnkZmz1i.mjs";
-import { n as loadClientConfig } from "./config-UyXnaekw.mjs";
+import { j as ERRORS, s as OPERATIONS, u as renderMcpError } from "./src-BFgTh55w.mjs";
+import { r as CliError, t as requestOperation } from "./client-Ln76BdDz.mjs";
+import { n as loadClientConfig } from "./config-B_6fA4Au.mjs";
 import { randomUUID } from "node:crypto";
 import { readFileSync } from "node:fs";
 import { z } from "zod";

package/dist/{src-VWyX7Nwm.mjs → src-BFgTh55w.mjs}

@@ -303,6 +303,49 @@ const configSchema = z.strictObject({
 		}).prefault({})
 	}).prefault({})
 });
+/** Recognized names in the private secrets.env file; values never belong in config.yaml. */
+const SECRET_ENV_KEYS = [
+	{
+		name: "GITHUB_TOKEN",
+		requiredWhen: "always",
+		purpose: "Read GitHub repositories and check runs."
+	},
+	{
+		name: "JIRA_EMAIL",
+		requiredWhen: "jira",
+		purpose: "Jira account email."
+	},
+	{
+		name: "JIRA_API_TOKEN",
+		requiredWhen: "jira",
+		purpose: "Jira API token."
+	},
+	{
+		name: "SLACK_BOT_TOKEN",
+		requiredWhen: "slack",
+		purpose: "Slack bot Web API token."
+	},
+	{
+		name: "SLACK_APP_TOKEN",
+		requiredWhen: "slack",
+		purpose: "Slack app-level Socket Mode token."
+	},
+	{
+		name: "SLACK_APP_CONFIG_TOKEN",
+		requiredWhen: "optional",
+		purpose: "Verify the installed slash command through the Slack app manifest API."
+	},
+	{
+		name: "SLACK_API_URL",
+		requiredWhen: "optional",
+		purpose: "Override the Slack API URL for local testing."
+	}
+];
+function requiredSecretKeys(config) {
+	const jira = config.projects.some((project) => project.tracker.type === "jira");
+	const slack = Boolean(config.slack.channels.feed || config.slack.channels.orchestrators);
+	return SECRET_ENV_KEYS.filter(({ requiredWhen }) => requiredWhen === "always" || requiredWhen === "jira" && jira || requiredWhen === "slack" && slack).map(({ name }) => name);
+}
 //#endregion
 //#region ../contracts/src/errors.ts
 /**
@@ -485,7 +528,7 @@ const ERRORS = {
 		status: null,
 		exit: EXIT_CODES.notApplied,
 		message: "The daemon is not running or cannot be reached; nothing was applied.",
-		hint: "Ask in your own session; the operator can run `board service start`. Retry the same command with its existing idempotency key if it has one once the daemon is available.",
+		hint: "Ask in your own session; the operator can check `board service status`, then run `board service restart`, or `board service install` if the service was never installed. Retry the same command with its existing idempotency key if it has one once the daemon is available.",
 		recovery: retry("Ask in your own session, then retry the same command with its existing idempotency key if it has one.", "After the daemon is available; wait briefly between retries.")
 	}),
 	config: spec("config", {
@@ -2635,4 +2678,4 @@ var AdapterError = class extends Error {
 	}
 };
 //#endregion
-export { taskKeySchema as A, sessionFactsSchema as C, errorCodeOf as D, encodeActorId as E, DEFAULT_HTTP_PORT as F, DEFAULT_SLACK_APP_NAME as I, DEFAULT_SLACK_COMMAND as L, errorContextSchema as M, errorEnvelopeSchema as N, parseActorId as O, successEnvelopeSchema as P, configSchema as R, prRefSchema as S, actorIdSchema as T, EVENT_KINDS as _, buildCatalogSnapshot as a, SESSION_STATUSES as b, renderHttpProblem as c, SPACE_IDS as d, conversationRefSchema as f, userIdSchema as g, messageRefSchema as h, sourceCursorSchema as i, ERRORS as j, parseRef as k, renderJsonError as l, interactionRefSchema as m, batchSchema as n, roleCanUseOperation as o, inboundEventSchema as p, entityRefSchema as r, OPERATIONS as s, AdapterError as t, renderMcpError as u, eventPayloadSchemas as v, ticketFactsSchema as w, prFactsSchema as x, SESSION_HEALTH_STATES as y, SLACK_BOT_SCOPES as z };
+export { taskKeySchema as A, SLACK_BOT_SCOPES as B, sessionFactsSchema as C, errorCodeOf as D, encodeActorId as E, DEFAULT_HTTP_PORT as F, DEFAULT_SLACK_APP_NAME as I, DEFAULT_SLACK_COMMAND as L, errorContextSchema as M, errorEnvelopeSchema as N, parseActorId as O, successEnvelopeSchema as P, configSchema as R, prRefSchema as S, actorIdSchema as T, EVENT_KINDS as _, buildCatalogSnapshot as a, SESSION_STATUSES as b, renderHttpProblem as c, SPACE_IDS as d, conversationRefSchema as f, userIdSchema as g, messageRefSchema as h, sourceCursorSchema as i, ERRORS as j, parseRef as k, renderJsonError as l, interactionRefSchema as m, batchSchema as n, roleCanUseOperation as o, inboundEventSchema as p, entityRefSchema as r, OPERATIONS as s, AdapterError as t, renderMcpError as u, eventPayloadSchemas as v, ticketFactsSchema as w, prFactsSchema as x, SESSION_HEALTH_STATES as y, requiredSecretKeys as z };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "spur-board",
-  "version": "0.5.0",
+  "version": "0.6.1",
   "license": "MIT",
   "engines": {
     "node": "^24.12.0 || ^26.0.0"