teamwork-os 2.0.4 → 2.1.0

package/packages/gateway/dist/index.js

@@ -917,6 +917,10 @@ var init_settings_defaults = __esm({
       channels: {
         directory: {},
         mcp: {}
+        // `mcpDefault` is deliberately ABSENT rather than set to a value. Absent
+        // is the default grant — strict, no servers — so an existing install that
+        // never heard of this key behaves exactly as before. Setting it is the
+        // opt-in that opens every unnamed channel at once.
       },
       slack: {
         enabled: true,
@@ -932,6 +936,10 @@ var init_settings_defaults = __esm({
         historyLimit: 20,
         allowUnmappedChannels: false,
         dmAllowlist: [],
+        // On by default: the cost of the block is one paragraph on one turn per
+        // channel, and the thing it explains (channels.directory) is the setting
+        // a new channel is most likely to be missing.
+        onboardNewChannels: true,
         // The deny universe for claude.ai account connectors — see
         // SlackSettings.knownConnectors. Deny mode can only subtract a name it
         // knows, so an unlisted connector is inherited by every deny-mode
@@ -1185,11 +1193,13 @@ function mergeSettings(parsed) {
         mcpMap[k] = "full";
         continue;
       }
-      const names = v.filter((n) => n.trim().length > 0).map((n) => n.trim());
-      if (names.length > 0)
-        mcpMap[k] = names;
+      mcpMap[k] = v.filter((n) => n.trim().length > 0).map((n) => n.trim());
     }
   }
+  let mcpDefault;
+  if (isChannelMcpGrant(channels.mcpDefault)) {
+    mcpDefault = channels.mcpDefault === "full" ? "full" : channels.mcpDefault.filter((n) => n.trim().length > 0).map((n) => n.trim());
+  }
   const allowedHosts = Array.isArray(server.allowedHosts) ? server.allowedHosts.filter((v) => typeof v === "string" && v.trim().length > 0).map((v) => v.trim()) : [...DEFAULT_SETTINGS.server.allowedHosts];
   return {
     server: {
@@ -1210,7 +1220,10 @@ function mergeSettings(parsed) {
     },
     channels: {
       directory: directoryMap,
-      mcp: mcpMap
+      mcp: mcpMap,
+      // Spread conditionally so an install that never set it has no key at
+      // all, rather than one holding `undefined`.
+      ...mcpDefault !== void 0 ? { mcpDefault } : {}
     },
     slack: {
       enabled: typeof slack.enabled === "boolean" ? slack.enabled : DEFAULT_SETTINGS.slack.enabled,
@@ -1229,6 +1242,7 @@ function mergeSettings(parsed) {
       // falls back to the shipped default, which is the safer posture: a
       // malformed file must not silently empty the deny universe.
       knownConnectors: Array.isArray(slack.knownConnectors) ? slack.knownConnectors.filter((v) => typeof v === "string" && v.trim().length > 0).map((v) => v.trim()).slice(0, SLACK_KNOWN_CONNECTORS_MAX) : [...DEFAULT_SETTINGS.slack.knownConnectors],
+      onboardNewChannels: typeof slack.onboardNewChannels === "boolean" ? slack.onboardNewChannels : DEFAULT_SETTINGS.slack.onboardNewChannels,
       // Free text, carried VERBATIM — no trim, no clamp. The persona reaches
       // argv byte-for-byte as the operator wrote it, which is what lets the
       // prompt-cache prefix survive across the turns of a session; normalizing
@@ -3237,6 +3251,7 @@ function applySchema(target) {
   target.exec(CREATE_MESSAGES);
   target.exec(CREATE_QUEUE_ITEMS);
   target.exec(CREATE_JOB_SPEND);
+  target.exec(CREATE_SLACK_CHANNELS);
   carryOverProfileSpend(target);
   for (const idx of INDEXES) {
     target.exec(idx);
@@ -3285,7 +3300,7 @@ function closeDb() {
   db = null;
   dbPath = null;
 }
-var db, dbPath, CREATE_SESSIONS, CREATE_MESSAGES, CREATE_QUEUE_ITEMS, CREATE_JOB_SPEND, INDEXES;
+var db, dbPath, CREATE_SESSIONS, CREATE_MESSAGES, CREATE_QUEUE_ITEMS, CREATE_JOB_SPEND, CREATE_SLACK_CHANNELS, INDEXES;
 var init_registry_schema = __esm({
   "packages/gateway/dist/sessions/registry-schema.js"() {
     "use strict";
@@ -3334,6 +3349,12 @@ CREATE TABLE IF NOT EXISTS job_spend (
   session_id TEXT,
   cost_usd REAL NOT NULL,
   created_at TEXT NOT NULL
+)`;
+    CREATE_SLACK_CHANNELS = `
+CREATE TABLE IF NOT EXISTS slack_channels (
+  channel_id TEXT PRIMARY KEY,
+  first_seen_at TEXT NOT NULL,
+  last_seen_at TEXT NOT NULL
 )`;
     INDEXES = [
       "CREATE INDEX IF NOT EXISTS idx_messages_session ON messages (session_id, created_at)",
@@ -8485,7 +8506,7 @@ var init_sessions = __esm({
 });
 
 // packages/gateway/dist/sessions/channel-mcp.js
-function lookupGrant(ref) {
+function lookupChannelEntry(ref) {
   const map = readSettings().channels.mcp;
   if (!map || Object.keys(map).length === 0)
     return void 0;
@@ -8504,6 +8525,26 @@ function lookupGrant(ref) {
   }
   return void 0;
 }
+function isChannelIdKey(key) {
+  return /^[A-Z][A-Z0-9]+$/.test(key);
+}
+function lookupGrant(ref) {
+  const entry = lookupChannelEntry(ref);
+  if (entry !== void 0)
+    return entry;
+  const settings = readSettings();
+  const fallback = settings.channels.mcpDefault;
+  if (fallback === void 0)
+    return void 0;
+  if (!ref.channelLabel) {
+    const unresolvable = Object.keys(settings.channels.mcp).filter((k) => !isChannelIdKey(k));
+    if (unresolvable.length > 0) {
+      log28.warn("channels.mcp holds label keys that cannot be matched against a channel id, so channels.mcpDefault is withheld; key these by channel id", { channel: ref.channelId, keys: unresolvable.join(", ") });
+      return void 0;
+    }
+  }
+  return fallback;
+}
 function resolveChannelMcpGrant(ref) {
   if (!ref || !ref.channelId && !ref.channelLabel)
     return void 0;
@@ -8950,6 +8991,44 @@ var init_ack_reaction = __esm({
   }
 });
 
+// packages/gateway/dist/connectors/slack/channel-record.js
+function hasSeenChannel(channelId) {
+  if (!channelId)
+    return true;
+  try {
+    const row = initDb().prepare("SELECT 1 as seen FROM slack_channels WHERE channel_id = ?").get(channelId);
+    return row !== void 0;
+  } catch (err) {
+    log32.warn("could not read the slack channel record; treating the channel as already seen", {
+      channel: channelId,
+      err: err instanceof Error ? err.message : String(err)
+    });
+    return true;
+  }
+}
+function recordChannelSeen(channelId) {
+  if (!channelId)
+    return;
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  try {
+    initDb().prepare("INSERT INTO slack_channels (channel_id, first_seen_at, last_seen_at) VALUES (?, ?, ?) ON CONFLICT(channel_id) DO UPDATE SET last_seen_at = excluded.last_seen_at").run(channelId, now, now);
+  } catch (err) {
+    log32.warn("could not record the slack channel; onboarding may repeat once in this channel", {
+      channel: channelId,
+      err: err instanceof Error ? err.message : String(err)
+    });
+  }
+}
+var log32;
+var init_channel_record = __esm({
+  "packages/gateway/dist/connectors/slack/channel-record.js"() {
+    "use strict";
+    init_logger();
+    init_registry_schema();
+    log32 = logger.child("slack:channels");
+  }
+});
+
 // packages/gateway/dist/connectors/slack/history.js
 function sanitize(raw) {
   return raw.replace(/[\[\]<>|`]/g, "").trim().slice(0, 64) || "unknown";
@@ -8987,7 +9066,7 @@ async function buildHistoryContext(opts) {
   }
   if (lines.length === 0)
     return "";
-  log32.debug("primed session with slack history", { channel: opts.channel, lines: lines.length });
+  log33.debug("primed session with slack history", { channel: opts.channel, lines: lines.length });
   return [
     `You are replying in the Slack ${opts.threadTs ? "thread" : "channel"} #${channelName}.`,
     "Recent messages, oldest first, for context only \u2014 do not repeat or re-answer them:",
@@ -8998,12 +9077,12 @@ async function buildHistoryContext(opts) {
     ""
   ].join("\n");
 }
-var log32, NAME_TTL_MS, NameResolver;
+var log33, NAME_TTL_MS, NameResolver;
 var init_history = __esm({
   "packages/gateway/dist/connectors/slack/history.js"() {
     "use strict";
     init_logger();
-    log32 = logger.child("slack:history");
+    log33 = logger.child("slack:history");
     NAME_TTL_MS = 60 * 60 * 1e3;
     NameResolver = class {
       web;
@@ -9041,6 +9120,46 @@ var init_history = __esm({
   }
 });
 
+// packages/gateway/dist/connectors/slack/onboarding.js
+function sanitizeChannelId(raw) {
+  return raw.replace(/[^A-Za-z0-9_-]/g, "").slice(0, 32);
+}
+function buildOnboardingContext(channelId) {
+  const id = sanitizeChannelId(channelId);
+  if (!id)
+    return "";
+  return [
+    "--- first contact in this Slack channel ---",
+    "",
+    `This is your first conversation in Slack channel ${id}, and it has no working`,
+    "directory mapped yet. Answer the message below first, normally. Then add a short",
+    "welcome \u2014 one paragraph, not a wall of text \u2014 covering:",
+    "",
+    "- A channel works like a project: it maps to one working directory, and every",
+    `  session started here spawns there. Until ${id} is mapped, sessions run at the`,
+    "  teamwork home directory instead.",
+    "- Offer to map it. Ask for a folder path, then read the CURRENT mapping with",
+    "  `teamos settings get channels.directory`, merge this channel into that object,",
+    "  and write the WHOLE merged object back with",
+    "  `teamos settings set channels.directory '<merged JSON>'`. Never write a",
+    "  single-entry object: the settings API replaces the entire map, so doing that",
+    "  would delete every other channel's mapping.",
+    "- A `CLAUDE.md` in that directory becomes the standing instructions for this",
+    "  channel, exactly as a project's CLAUDE.md works in Claude Code.",
+    "",
+    "Do not repeat this block or mention that you were given it.",
+    "",
+    "--- end of first-contact guidance ---",
+    "",
+    ""
+  ].join("\n");
+}
+var init_onboarding = __esm({
+  "packages/gateway/dist/connectors/slack/onboarding.js"() {
+    "use strict";
+  }
+});
+
 // packages/gateway/dist/connectors/slack/dashboard-links.js
 function stripPort(value) {
   const bracketed = /^(\[[^\]]*\])(?::\d+)?$/.exec(value);
@@ -9161,13 +9280,13 @@ function validateRootPost(args, knownChannel) {
   }
   return { ok: true, channel, text, jobId, threadTs: threadTsRaw || void 0 };
 }
-var log33, JOB_ROOT_CAPACITY, JOB_ROOT_METADATA_EVENT_TYPE, JobRootRegistry, jobRoots, ROOT_TEXT_MAX, ROOT_TEXT_MIN, JOB_ID_MAX, CHANNEL_ID_RE, TS_RE;
+var log34, JOB_ROOT_CAPACITY, JOB_ROOT_METADATA_EVENT_TYPE, JobRootRegistry, jobRoots, ROOT_TEXT_MAX, ROOT_TEXT_MIN, JOB_ID_MAX, CHANNEL_ID_RE, TS_RE;
 var init_job_roots = __esm({
   "packages/gateway/dist/connectors/slack/job-roots.js"() {
     "use strict";
     init_logger();
     init_dashboard_links();
-    log33 = logger.child("slack:job-roots");
+    log34 = logger.child("slack:job-roots");
     JOB_ROOT_CAPACITY = 512;
     JOB_ROOT_METADATA_EVENT_TYPE = "teamwork_os_job_root";
     JobRootRegistry = class {
@@ -9187,7 +9306,7 @@ var init_job_roots = __esm({
             break;
           this.roots.delete(oldest);
         }
-        log33.info("registered slack job root", { jobId: root.jobId, channel: root.channel });
+        log34.info("registered slack job root", { jobId: root.jobId, channel: root.channel });
         return record;
       }
       get(channel, ts) {
@@ -9393,7 +9512,7 @@ function resolveSlackPersona() {
   try {
     persona = readSettings().slack.persona;
   } catch (err) {
-    log34.warn("could not read slack.persona; turn runs with no persona", {
+    log35.warn("could not read slack.persona; turn runs with no persona", {
       err: err instanceof Error ? err.message : String(err)
     });
     return void 0;
@@ -9403,11 +9522,11 @@ function resolveSlackPersona() {
   if (persona.length === 0)
     return void 0;
   if (persona.trim().length === 0) {
-    log34.warn("slack.persona is whitespace only; turn runs with no persona");
+    log35.warn("slack.persona is whitespace only; turn runs with no persona");
     return void 0;
   }
   if (persona.length > SLACK_PERSONA_MAX_LEN) {
-    log34.warn("slack.persona exceeds the maximum length; turn runs with no persona", {
+    log35.warn("slack.persona exceeds the maximum length; turn runs with no persona", {
       length: persona.length,
       max: SLACK_PERSONA_MAX_LEN
     });
@@ -9415,13 +9534,13 @@ function resolveSlackPersona() {
   }
   return persona;
 }
-var log34;
+var log35;
 var init_persona = __esm({
   "packages/gateway/dist/connectors/slack/persona.js"() {
     "use strict";
     init_logger();
     init_config();
-    log34 = logger.child("slack-persona");
+    log35 = logger.child("slack-persona");
   }
 });
 
@@ -9641,7 +9760,7 @@ async function uploadAnswerSnippet(opts) {
   try {
     const ticket = await opts.web.call("files.getUploadURLExternal", { filename, length });
     if (!ticket.upload_url || !ticket.file_id) {
-      log35.warn("upload ticket was missing a url or file id");
+      log36.warn("upload ticket was missing a url or file id");
       return { ok: false, reason: "failed" };
     }
     const uploaded = await opts.web.uploadFileBytes(ticket.upload_url, filename, opts.content);
@@ -9653,16 +9772,16 @@ async function uploadAnswerSnippet(opts) {
       ...opts.threadTs ? { thread_ts: opts.threadTs } : {}
     });
     filesUploadSupport = "yes";
-    log35.info("uploaded the full answer as a snippet", { channel: opts.channel, bytes: length });
+    log36.info("uploaded the full answer as a snippet", { channel: opts.channel, bytes: length });
     return { ok: true, permalink: done.files?.[0]?.permalink };
   } catch (err) {
     const code = err instanceof SlackApiError ? err.code : "unknown_error";
     if (UNSUPPORTED_UPLOAD_CODES.has(code)) {
       filesUploadSupport = "no";
-      log35.info("file uploads unavailable; long answers will continue as thread replies", { code });
+      log36.info("file uploads unavailable; long answers will continue as thread replies", { code });
       return { ok: false, reason: "unsupported" };
     }
-    log35.warn("snippet upload failed; falling back to chunked thread replies", { code });
+    log36.warn("snippet upload failed; falling back to chunked thread replies", { code });
     return { ok: false, reason: "failed" };
   }
 }
@@ -9673,13 +9792,13 @@ _That is the first part \u2014 the full answer is attached here: <${permalink}|$
 
 _That is the first part \u2014 the full answer is attached to this thread as \`${SNIPPET_FILENAME}\`._`;
 }
-var log35, SNIPPET_CHUNK_THRESHOLD, SNIPPET_FILENAME, SNIPPET_TITLE, UNSUPPORTED_UPLOAD_CODES, filesUploadSupport;
+var log36, SNIPPET_CHUNK_THRESHOLD, SNIPPET_FILENAME, SNIPPET_TITLE, UNSUPPORTED_UPLOAD_CODES, filesUploadSupport;
 var init_snippet = __esm({
   "packages/gateway/dist/connectors/slack/snippet.js"() {
     "use strict";
     init_logger();
     init_web_client();
-    log35 = logger.child("slack:snippet");
+    log36 = logger.child("slack:snippet");
     SNIPPET_CHUNK_THRESHOLD = 3;
     SNIPPET_FILENAME = "answer.md";
     SNIPPET_TITLE = "Full answer";
@@ -9693,7 +9812,7 @@ function chrome(text) {
   const converted = markdownToSlackMrkdwn(text).replace(/[\r\n]+/g, " ").replace(/`{3,}/g, "`").trim();
   return converted.length > CHROME_MAX ? `${converted.slice(0, CHROME_MAX - 1)}\u2026` : converted;
 }
-var log36, WORK_THRESHOLD_MS, WORK_THRESHOLD_TOOLS, CHECKLIST_MAX, PROGRESS_APPEND_BUDGET, SEAL_DELIVERY_ATTEMPTS, TRANSIENT_SEAL_CODES, AMBIGUOUS_SEAL_CODES, streamingSupport, UNSUPPORTED_CODES, OUTCOME_HEADER, ProgressCard, CHROME_MAX;
+var log37, WORK_THRESHOLD_MS, WORK_THRESHOLD_TOOLS, CHECKLIST_MAX, PROGRESS_APPEND_BUDGET, SEAL_DELIVERY_ATTEMPTS, TRANSIENT_SEAL_CODES, AMBIGUOUS_SEAL_CODES, streamingSupport, UNSUPPORTED_CODES, OUTCOME_HEADER, ProgressCard, CHROME_MAX;
 var init_progress_card = __esm({
   "packages/gateway/dist/connectors/slack/progress-card.js"() {
     "use strict";
@@ -9702,7 +9821,7 @@ var init_progress_card = __esm({
     init_phrases();
     init_snippet();
     init_web_client();
-    log36 = logger.child("slack:card");
+    log37 = logger.child("slack:card");
     WORK_THRESHOLD_MS = 4e3;
     WORK_THRESHOLD_TOOLS = 2;
     CHECKLIST_MAX = 8;
@@ -9892,7 +10011,7 @@ var init_progress_card = __esm({
           if (step.onlyForTransient && !TRANSIENT_SEAL_CODES.has(lastCode))
             continue;
           if (attempts >= SEAL_DELIVERY_ATTEMPTS) {
-            log36.error("seal delivery hit the attempt cap with the answer undelivered", {
+            log37.error("seal delivery hit the attempt cap with the answer undelivered", {
               attempts,
               lastCode,
               skipped: step.name
@@ -9905,14 +10024,14 @@ var init_progress_card = __esm({
             return true;
           } catch (err) {
             if (!(err instanceof SlackApiError)) {
-              log36.error("sealing the card failed at the transport layer; not retrying (double-post risk)", {
+              log37.error("sealing the card failed at the transport layer; not retrying (double-post risk)", {
                 step: step.name,
                 err: err instanceof Error ? err.message : String(err)
               });
               return false;
             }
             if (AMBIGUOUS_SEAL_CODES.has(err.code)) {
-              log36.error("sealing the card failed with an ambiguous outcome; not retrying (double-post risk)", {
+              log37.error("sealing the card failed with an ambiguous outcome; not retrying (double-post risk)", {
                 step: step.name,
                 attempt: attempts,
                 code: err.code
@@ -9920,10 +10039,10 @@ var init_progress_card = __esm({
               return false;
             }
             lastCode = err.code;
-            log36.error("seal delivery step failed", { step: step.name, attempt: attempts, code: err.code });
+            log37.error("seal delivery step failed", { step: step.name, attempt: attempts, code: err.code });
           }
         }
-        log36.error("the turn produced an answer that could not be delivered to Slack", { attempts, lastCode });
+        log37.error("the turn produced an answer that could not be delivered to Slack", { attempts, lastCode });
         return false;
       }
       /**
@@ -10046,9 +10165,9 @@ ${head}`
             const recipientMayBeAtFault = sentRecipient && code === "invalid_arguments";
             if (UNSUPPORTED_CODES.has(code) && !recipientMayBeAtFault) {
               streamingSupport = "no";
-              log36.info("streaming API unavailable; using batched progress messages", { code });
+              log37.info("streaming API unavailable; using batched progress messages", { code });
             } else {
-              log36.warn("chat.startStream failed; falling back to a batched card for this turn", { code });
+              log37.warn("chat.startStream failed; falling back to a batched card for this turn", { code });
             }
           }
         }
@@ -10184,12 +10303,12 @@ var init_routing = __esm({
 
 // packages/gateway/dist/connectors/slack/socket-client.js
 import { WebSocket as WebSocket2 } from "ws";
-var log37, BACKOFF_BASE_MS, BACKOFF_MAX_MS, SocketModeClient;
+var log38, BACKOFF_BASE_MS, BACKOFF_MAX_MS, SocketModeClient;
 var init_socket_client = __esm({
   "packages/gateway/dist/connectors/slack/socket-client.js"() {
     "use strict";
     init_logger();
-    log37 = logger.child("slack:socket");
+    log38 = logger.child("slack:socket");
     BACKOFF_BASE_MS = 1e3;
     BACKOFF_MAX_MS = 6e4;
     SocketModeClient = class {
@@ -10211,7 +10330,7 @@ var init_socket_client = __esm({
           return;
         this.stopped = false;
         this.connectLoop = this.run().catch((err) => {
-          log37.error("socket loop exited unexpectedly", { err: err instanceof Error ? err.message : String(err) });
+          log38.error("socket loop exited unexpectedly", { err: err instanceof Error ? err.message : String(err) });
         });
       }
       async stop() {
@@ -10237,7 +10356,7 @@ var init_socket_client = __esm({
           } catch (err) {
             this.attempt++;
             const wait2 = this.backoff();
-            log37.warn("apps.connections.open failed; retrying", {
+            log38.warn("apps.connections.open failed; retrying", {
               attempt: this.attempt,
               waitMs: wait2,
               err: err instanceof Error ? err.message : String(err)
@@ -10255,7 +10374,7 @@ var init_socket_client = __esm({
           }
           this.attempt++;
           const wait = this.backoff();
-          log37.warn("socket closed; reconnecting", { attempt: this.attempt, waitMs: wait, reason: closeReason });
+          log38.warn("socket closed; reconnecting", { attempt: this.attempt, waitMs: wait, reason: closeReason });
           await sleep(wait);
         }
       }
@@ -10283,18 +10402,18 @@ var init_socket_client = __esm({
             try {
               envelope = JSON.parse(String(raw));
             } catch {
-              log37.debug("unparseable socket frame dropped");
+              log38.debug("unparseable socket frame dropped");
               return;
             }
             if (envelope.type === "hello") {
               this.attempt = 0;
-              log37.info("socket mode connected");
+              log38.info("socket mode connected");
               this.opts.onConnectionChange?.(true, 0);
               return;
             }
             if (envelope.type === "disconnect") {
               disconnectReason = envelope.reason ?? "disconnect";
-              log37.info("socket disconnect requested by slack", { reason: disconnectReason });
+              log38.info("socket disconnect requested by slack", { reason: disconnectReason });
               try {
                 socket.close(1e3, "slack requested disconnect");
               } catch {
@@ -10306,17 +10425,17 @@ var init_socket_client = __esm({
               try {
                 socket.send(JSON.stringify({ envelope_id: envelope.envelope_id }));
               } catch (err) {
-                log37.warn("ack send failed", { err: err instanceof Error ? err.message : String(err) });
+                log38.warn("ack send failed", { err: err instanceof Error ? err.message : String(err) });
               }
             }
             try {
               this.opts.onEnvelope(envelope);
             } catch (err) {
-              log37.error("envelope handler threw", { err: err instanceof Error ? err.message : String(err) });
+              log38.error("envelope handler threw", { err: err instanceof Error ? err.message : String(err) });
             }
           });
           socket.on("error", (err) => {
-            log37.warn("socket error", { err: err.message });
+            log38.warn("socket error", { err: err.message });
           });
           socket.on("close", () => {
             settle(disconnectReason);
@@ -10353,12 +10472,12 @@ function startThreadStatus(opts) {
     } catch (err) {
       const code = err instanceof SlackApiError ? err.code : "unknown_error";
       if (TERMINAL.has(code)) {
-        log38.debug("thread status unavailable for this thread", { code });
+        log39.debug("thread status unavailable for this thread", { code });
         stopped = true;
         clear();
         return;
       }
-      log38.debug("setStatus failed", { code });
+      log39.debug("setStatus failed", { code });
     }
   };
   void send(phrase);
@@ -10389,13 +10508,13 @@ function startThreadStatus(opts) {
     }
   };
 }
-var log38, KEEPALIVE_MS, MAX_DURATION_MS, TERMINAL;
+var log39, KEEPALIVE_MS, MAX_DURATION_MS, TERMINAL;
 var init_thread_status = __esm({
   "packages/gateway/dist/connectors/slack/thread-status.js"() {
     "use strict";
     init_logger();
     init_web_client();
-    log38 = logger.child("slack:status");
+    log39 = logger.child("slack:status");
     KEEPALIVE_MS = 3e3;
     MAX_DURATION_MS = 6e5;
     TERMINAL = /* @__PURE__ */ new Set(["invalid_thread_ts", "not_allowed_token_type", "missing_scope", "unknown_method"]);
@@ -10513,7 +10632,7 @@ async function handleLinkShared(event, deps) {
     metadata ??= entityMetadata(target, card, link.url);
   }
   if (Object.keys(unfurls).length === 0) {
-    log39.debug("link_shared carried no renderable gateway links", { channel: event.channel });
+    log40.debug("link_shared carried no renderable gateway links", { channel: event.channel });
     return false;
   }
   try {
@@ -10526,7 +10645,7 @@ async function handleLinkShared(event, deps) {
       ...metadata ? { metadata } : {}
     });
     unfurlSupport = "yes";
-    log39.debug("unfurled gateway links", { channel: event.channel, links: Object.keys(unfurls).length });
+    log40.debug("unfurled gateway links", { channel: event.channel, links: Object.keys(unfurls).length });
     return true;
   } catch (err) {
     noteUnfurlFailure("chat.unfurl", err);
@@ -10540,12 +10659,12 @@ async function handleEntityDetails(event, deps) {
   const source = deps.source ?? liveStatusSource;
   const target = parseDashboardUrl(event.url, gatewayHosts(settings));
   if (!target) {
-    log39.debug("entity_details_requested for a url this gateway does not own");
+    log40.debug("entity_details_requested for a url this gateway does not own");
     return false;
   }
   const card = buildStatusCard(target, source);
   if (!card) {
-    log39.debug("entity_details_requested for an object that no longer exists", { kind: target.kind });
+    log40.debug("entity_details_requested for an object that no longer exists", { kind: target.kind });
     return false;
   }
   try {
@@ -10553,7 +10672,7 @@ async function handleEntityDetails(event, deps) {
       trigger_id: event.triggerId,
       metadata: entityMetadata(target, card, event.url)
     });
-    log39.debug("presented entity details", { kind: target.kind });
+    log40.debug("presented entity details", { kind: target.kind });
     return true;
   } catch (err) {
     noteUnfurlFailure("entity.presentDetails", err);
@@ -10564,12 +10683,12 @@ function noteUnfurlFailure(method, err) {
   const code = err instanceof SlackApiError ? err.code : "transport_error";
   if (UNSUPPORTED_UNFURL_CODES.has(code)) {
     unfurlSupport = "no";
-    log39.info("work-object previews unavailable; links will render as plain urls", { method, code });
+    log40.info("work-object previews unavailable; links will render as plain urls", { method, code });
     return;
   }
-  log39.debug("work-object preview failed", { method, code });
+  log40.debug("work-object preview failed", { method, code });
 }
-var log39, UNSUPPORTED_UNFURL_CODES, unfurlSupport, liveStatusSource;
+var log40, UNSUPPORTED_UNFURL_CODES, unfurlSupport, liveStatusSource;
 var init_work_objects = __esm({
   "packages/gateway/dist/connectors/slack/work-objects.js"() {
     "use strict";
@@ -10580,7 +10699,7 @@ var init_work_objects = __esm({
     init_registry();
     init_dashboard_links();
     init_web_client();
-    log39 = logger.child("slack:work-objects");
+    log40 = logger.child("slack:work-objects");
     UNSUPPORTED_UNFURL_CODES = /* @__PURE__ */ new Set([
       "missing_scope",
       "not_allowed_token_type",
@@ -10600,6 +10719,9 @@ var init_work_objects = __esm({
 
 // packages/gateway/dist/connectors/slack/connector.js
 import { randomBytes as randomBytes7 } from "node:crypto";
+function isDirectMessage(event) {
+  return event.channelType === "im" || event.channel.startsWith("D");
+}
 function lastAssistantText(sessionId) {
   const messages = getMessages(sessionId);
   for (let i = messages.length - 1; i >= 0; i--) {
@@ -10616,13 +10738,13 @@ async function startSlackConnector() {
     return;
   const settings = readSettings();
   if (!settings.slack.enabled) {
-    log40.info("slack connector disabled in settings");
+    log41.info("slack connector disabled in settings");
     return;
   }
   const botToken = process.env.SLACK_BOT_TOKEN?.trim();
   const appToken = process.env.SLACK_APP_TOKEN?.trim();
   if (!botToken || !appToken) {
-    log40.warn("slack connector not started: SLACK_BOT_TOKEN and SLACK_APP_TOKEN must both be set");
+    log41.warn("slack connector not started: SLACK_BOT_TOKEN and SLACK_APP_TOKEN must both be set");
     return;
   }
   const connector = new SlackConnector({ botToken, appToken });
@@ -10630,7 +10752,7 @@ async function startSlackConnector() {
     await connector.start();
     active = connector;
   } catch (err) {
-    log40.error("slack connector failed to start", { err: err instanceof Error ? err.message : String(err) });
+    log41.error("slack connector failed to start", { err: err instanceof Error ? err.message : String(err) });
   }
 }
 async function stopSlackConnector() {
@@ -10638,7 +10760,7 @@ async function stopSlackConnector() {
   active = null;
   await connector?.stop();
 }
-var log40, MISSING_SESSION_RE, CONVERSATION_CAPACITY, SlackConnector, active;
+var log41, MISSING_SESSION_RE, CONVERSATION_CAPACITY, SlackConnector, active;
 var init_connector = __esm({
   "packages/gateway/dist/connectors/slack/connector.js"() {
     "use strict";
@@ -10652,7 +10774,9 @@ var init_connector = __esm({
     init_claude_json();
     init_resolver();
     init_ack_reaction();
+    init_channel_record();
     init_history();
+    init_onboarding();
     init_job_roots();
     init_normalize2();
     init_persona();
@@ -10663,11 +10787,10 @@ var init_connector = __esm({
     init_thread_status();
     init_web_client();
     init_work_objects();
-    log40 = logger.child("slack");
+    log41 = logger.child("slack");
     MISSING_SESSION_RE = /^Session .+ not found$/;
     CONVERSATION_CAPACITY = 512;
     SlackConnector = class {
-      opts;
       web;
       appWeb;
       names;
@@ -10713,8 +10836,33 @@ var init_connector = __esm({
        * after an event survives the allowlist and every filter, so traffic the
        * connector refused never widens the bound. */
       seenChannels = /* @__PURE__ */ new Set();
+      /**
+       * Channels this process has already decided to onboard, claimed
+       * SYNCHRONOUSLY the moment the decision is made.
+       *
+       * The durable `slack_channels` row is what makes onboarding once-per-channel
+       * across restarts, but it is written after the turn is dispatched — and
+       * between the decision and that write sit an ack reaction and `route()`,
+       * both real round-trips. Two first messages in a new channel land on two
+       * DIFFERENT conversation keys, so the per-conversation gate does not
+       * serialize them: both would read "never seen" and both would carry the
+       * block. Reproduced with an 8ms ack: 2 of 2 prompts.
+       *
+       * Same shape as the memoized `ensureCard` promise (see this package's
+       * CLAUDE.md): a check against state that only becomes true after an await
+       * is not a guard. The claim is a synchronous Set write, so two dispatches
+       * cannot interleave between the check and the claim.
+       *
+       * A claim by a turn that is then refused is deliberately NOT released. The
+       * cost is that a channel whose only-ever turn failed onboards again after a
+       * restart — one extra block, the same direction a failed row write already
+       * degrades in, and better than the duplicate this prevents.
+       */
+      onboardedChannels = /* @__PURE__ */ new Set();
+      // A plain parameter, not a parameter property: nothing outside the
+      // constructor reads it, and a `private readonly opts` field would be dead
+      // state that reads as if the connector kept its tokens around.
       constructor(opts) {
-        this.opts = opts;
         const factory = opts.webFactory ?? ((token) => new SlackWebClient({ token }));
         this.web = factory(opts.botToken);
         this.appWeb = factory(opts.appToken);
@@ -10742,7 +10890,7 @@ var init_connector = __esm({
         this.botUserId = auth.user_id;
         this.botId = auth.bot_id;
         this.teamId = auth.team_id ?? "";
-        log40.info("slack auth ok", { botUserId: this.botUserId, team: auth.team, teamId: this.teamId });
+        log41.info("slack auth ok", { botUserId: this.botUserId, team: auth.team, teamId: this.teamId });
         this.socket = new SocketModeClient({
           appWeb: this.appWeb,
           onEnvelope: (envelope) => this.onEnvelope(envelope),
@@ -10778,7 +10926,7 @@ var init_connector = __esm({
         const event = normalizeEnvelope(envelope);
         if (!event)
           return;
-        log40.debug("slack event received", {
+        log41.debug("slack event received", {
           kind: event.kind,
           channel: event.channel,
           user: event.user || void 0,
@@ -10787,11 +10935,11 @@ var init_connector = __esm({
           retryAttempt: event.retryAttempt
         });
         if (!this.dedupe.admit(event.dedupeKey)) {
-          log40.info("duplicate slack event dropped", { dedupeKey: event.dedupeKey, retryAttempt: event.retryAttempt });
+          log41.info("duplicate slack event dropped", { dedupeKey: event.dedupeKey, retryAttempt: event.retryAttempt });
           return;
         }
         if (event.kind === "assistant_thread_started" || event.kind === "assistant_thread_context_changed") {
-          log40.info("assistant thread event", { kind: event.kind, channel: event.channel });
+          log41.info("assistant thread event", { kind: event.kind, channel: event.channel });
           return;
         }
         if (event.kind === "link_shared") {
@@ -10808,7 +10956,7 @@ var init_connector = __esm({
         if (refusal) {
           const selfAuthored = Boolean(event.botId) || this.botUserId.length > 0 && event.user === this.botUserId;
           const level = selfAuthored || event.subtype ? "debug" : "info";
-          log40[level]("slack event refused by allowlist", {
+          log41[level]("slack event refused by allowlist", {
             reason: refusal,
             channel: event.channel,
             kind: event.kind,
@@ -10826,12 +10974,12 @@ var init_connector = __esm({
           threadMapped: this.conversations.has(key) || Boolean(event.threadTs) && jobRoots.has(event.channel, event.threadTs)
         });
         if (drop) {
-          log40.debug("slack event filtered", { reason: drop, kind: event.kind, dedupeKey: event.dedupeKey });
+          log41.debug("slack event filtered", { reason: drop, kind: event.kind, dedupeKey: event.dedupeKey });
           return;
         }
         const identity = messageIdentityKey(event);
         if (identity && !this.messageIdentity.admit(identity)) {
-          log40.debug("slack event filtered", {
+          log41.debug("slack event filtered", {
             reason: "duplicate-message-identity",
             kind: event.kind,
             dedupeKey: event.dedupeKey,
@@ -10841,8 +10989,11 @@ var init_connector = __esm({
         }
         void this.dispatch(event).then((started) => {
           if (started) {
-            if (event.channel)
+            if (event.channel) {
               this.seenChannels.add(event.channel);
+              if (!isDirectMessage(event))
+                recordChannelSeen(event.channel);
+            }
             return;
           }
           if (identity)
@@ -10850,7 +11001,7 @@ var init_connector = __esm({
         }).catch((err) => {
           if (identity)
             this.messageIdentity.release(identity);
-          log40.error("slack dispatch failed", { err: err instanceof Error ? err.message : String(err) });
+          log41.error("slack dispatch failed", { err: err instanceof Error ? err.message : String(err) });
         });
       }
       /**
@@ -10868,7 +11019,7 @@ var init_connector = __esm({
         if (links.length === 0)
           return;
         if (!this.knowsChannel(event.channel)) {
-          log40.debug("link_shared ignored: channel is not one this gateway is configured for", { channel: event.channel });
+          log41.debug("link_shared ignored: channel is not one this gateway is configured for", { channel: event.channel });
           return;
         }
         try {
@@ -10880,7 +11031,7 @@ var init_connector = __esm({
             source: event.unfurlSource
           }, { web: this.web });
         } catch (err) {
-          log40.debug("link preview failed", { err: err instanceof Error ? err.message : String(err) });
+          log41.debug("link preview failed", { err: err instanceof Error ? err.message : String(err) });
         }
       }
       /**
@@ -10914,11 +11065,11 @@ var init_connector = __esm({
        */
       async presentEntityDetails(event) {
         if (!event.triggerId || !event.linkUrl) {
-          log40.debug("entity_details_requested without a trigger id or url");
+          log41.debug("entity_details_requested without a trigger id or url");
           return;
         }
         if (event.channel && !this.knowsChannel(event.channel)) {
-          log40.debug("entity_details_requested ignored: channel is not one this gateway is configured for", {
+          log41.debug("entity_details_requested ignored: channel is not one this gateway is configured for", {
             channel: event.channel
           });
           return;
@@ -10926,7 +11077,7 @@ var init_connector = __esm({
         try {
           await handleEntityDetails({ triggerId: event.triggerId, url: event.linkUrl, externalRefId: event.externalRefId }, { web: this.web });
         } catch (err) {
-          log40.debug("entity details failed", { err: err instanceof Error ? err.message : String(err) });
+          log41.debug("entity details failed", { err: err instanceof Error ? err.message : String(err) });
         }
       }
       /**
@@ -11021,7 +11172,7 @@ var init_connector = __esm({
           threadTs: target.thread,
           trigger: event.kind === "reaction_added" ? "reaction" : event.kind === "app_mention" ? "mention" : event.channelType === "im" ? "assistant" : "message"
         });
-        log40.info("slack turn dispatched", {
+        log41.info("slack turn dispatched", {
           sessionId,
           channel: target.channel,
           thread: target.thread,
@@ -11038,7 +11189,7 @@ var init_connector = __esm({
        */
       async resolveSession(event, target, key, jobId, settings) {
         const existingSessionId = this.conversations.get(key);
-        const prompt = await this.buildPrompt(event, target, Boolean(existingSessionId), settings.slack.historyLimit, jobId);
+        const prompt = await this.buildPrompt(event, target, Boolean(existingSessionId), settings, jobId);
         if (!prompt)
           return null;
         const ack = target.triggerTs ? await addAck(this.web, settings.slack.ackEmoji, target.channel, target.triggerTs) : null;
@@ -11050,12 +11201,12 @@ var init_connector = __esm({
         } catch (err) {
           const detail = err instanceof Error ? err.message : String(err);
           if (existingSessionId && MISSING_SESSION_RE.test(detail)) {
-            log40.info("slack conversation session no longer exists; rebuilding from thread history", {
+            log41.info("slack conversation session no longer exists; rebuilding from thread history", {
               key,
               sessionId: existingSessionId
             });
             this.conversations.delete(key);
-            const revived = await this.buildPrompt(event, target, false, settings.slack.historyLimit, jobId);
+            const revived = await this.buildPrompt(event, target, false, settings, jobId);
             try {
               sessionId = await this.routeTurn(revived || prompt, void 0, target, jobId);
               notice = SESSION_REVIVED_NOTICE;
@@ -11068,7 +11219,7 @@ var init_connector = __esm({
         }
         if (sessionId === null) {
           const detail = failure ?? "unknown error";
-          log40.error("slack route failed", { channel: target.channel, thread: target.thread, err: detail });
+          log41.error("slack route failed", { channel: target.channel, thread: target.thread, err: detail });
           await swapAck(this.web, ack, settings.slack.errorEmoji);
           await this.web.tryCall("chat.postMessage", {
             channel: target.channel,
@@ -11172,7 +11323,7 @@ var init_connector = __esm({
         const wantsGateway = named.includes(GATEWAY_MCP_NAME);
         const { servers, missing } = resolveNamedMcpServers(named.filter((n) => n !== GATEWAY_MCP_NAME));
         if (missing.length > 0) {
-          log40.warn("channels.mcp names servers absent from the claude config; skipping them", {
+          log41.warn("channels.mcp names servers absent from the claude config; skipping them", {
             channel,
             missing: missing.join(", ")
           });
@@ -11180,7 +11331,7 @@ var init_connector = __esm({
         const resolved = wantsGateway ? resolveMcpConfig(servers, { sessionId, jobId }).mcpServers : servers;
         const names = Object.keys(resolved);
         if (names.length === 0) {
-          log40.warn("channels.mcp grant resolved to no servers; turn runs with none", { channel });
+          log41.warn("channels.mcp grant resolved to no servers; turn runs with none", { channel });
           return noop;
         }
         const configKey = `slack-${randomBytes7(8).toString("hex")}`;
@@ -11188,14 +11339,14 @@ var init_connector = __esm({
         try {
           configPath = writeMcpConfigFile({ mcpServers: resolved }, configKey);
         } catch (err) {
-          log40.warn("could not write the channel MCP config; turn runs with no servers", {
+          log41.warn("could not write the channel MCP config; turn runs with no servers", {
             channel,
             err: err instanceof Error ? err.message : String(err)
           });
           cleanupMcpConfigFile(configKey);
           return noop;
         }
-        log40.info("channel MCP grant resolved", { channel, servers: names.join(", ") });
+        log41.info("channel MCP grant resolved", { channel, servers: names.join(", ") });
         return { inherit: false, configPath, cleanup: () => cleanupMcpConfigFile(configKey) };
       }
       /**
@@ -11214,11 +11365,11 @@ var init_connector = __esm({
         } };
         const grant = named.filter((n) => n !== GATEWAY_MCP_NAME);
         if (grant.length !== named.length) {
-          log40.warn('channels.mcp grants "gateway" alongside a claude.ai connector; the gateway MCP server is unavailable in deny mode', { channel });
+          log41.warn('channels.mcp grants "gateway" alongside a claude.ai connector; the gateway MCP server is unavailable in deny mode', { channel });
         }
         const ambient = readAmbientMcpServersResult();
         if (!ambient.ok) {
-          log40.warn("ambient MCP config unreadable; deny-mode turn runs with no servers rather than under-subtracting", {
+          log41.warn("ambient MCP config unreadable; deny-mode turn runs with no servers rather than under-subtracting", {
             channel,
             reason: ambient.reason ?? "unknown"
           });
@@ -11230,18 +11381,18 @@ var init_connector = __esm({
           knownConnectors: readSettings().slack.knownConnectors
         });
         if (unresolvedLocals.length > 0) {
-          log40.warn("channels.mcp names local servers absent from the claude config; they resolve to nothing", {
+          log41.warn("channels.mcp names local servers absent from the claude config; they resolve to nothing", {
             channel,
             names: unresolvedLocals.join(", ")
           });
         }
         if (unlistedConnectors.length > 0) {
-          log40.warn("channels.mcp grants connectors missing from slack.knownConnectors; other deny-mode channels cannot subtract them", {
+          log41.warn("channels.mcp grants connectors missing from slack.knownConnectors; other deny-mode channels cannot subtract them", {
             channel,
             names: unlistedConnectors.join(", ")
           });
         }
-        log40.info("channel MCP grant resolved (deny mode)", {
+        log41.info("channel MCP grant resolved (deny mode)", {
           channel,
           granted: grant.length > 0 ? grant.join(", ") : "(none)",
           denied: denies.length
@@ -11249,9 +11400,10 @@ var init_connector = __esm({
         return { inherit: true, disallowedTools: denies, cleanup: () => {
         } };
       }
-      /** Assemble the prompt: the user's text, plus the job-root and
-       * channel/thread history context on the first turn of a conversation only. */
-      async buildPrompt(event, target, isResume, historyLimit, jobId) {
+      /** Assemble the prompt: the user's text, plus the first-contact, job-root
+       * and channel/thread history context on the first turn of a conversation
+       * only. */
+      async buildPrompt(event, target, isResume, settings, jobId) {
         if (event.kind === "reaction_added") {
           const r = await this.web.tryCall("conversations.history", {
             channel: event.channel,
@@ -11262,13 +11414,13 @@ var init_connector = __esm({
           });
           const text2 = r?.messages?.[0]?.text?.trim() ?? "";
           if (!text2) {
-            log40.info("reaction trigger dropped: its message could not be read", {
+            log41.info("reaction trigger dropped: its message could not be read", {
               channel: event.channel,
               itemTs: event.itemTs
             });
             return "";
           }
-          return stripLeadingMention(text2, this.botUserId);
+          return `${this.onboardingContext(event, isResume, settings)}${stripLeadingMention(text2, this.botUserId)}`;
         }
         const text = stripLeadingMention(event.text, this.botUserId);
         if (isResume)
@@ -11279,11 +11431,53 @@ var init_connector = __esm({
           names: this.names,
           channel: target.channel,
           threadTs: threadRoot,
-          limit: historyLimit,
+          limit: settings.slack.historyLimit,
           excludeTs: event.ts
         });
         const job = jobId ? buildJobRootContext(jobId) : "";
-        return `${job}${history}${text}`;
+        return `${this.onboardingContext(event, isResume, settings)}${job}${history}${text}`;
+      }
+      /**
+       * The first-contact guidance block, or an empty string — which is what every
+       * turn but one per channel gets.
+       *
+       * Five conditions, all of which must hold:
+       *
+       *  - **not a resume.** A conversation already under way has had its first
+       *    turn; the block belongs to the channel's first turn, not to every new
+       *    thread in it. (Belt and braces next to the row check below, which a
+       *    resumed turn already fails — unless the row write itself failed.);
+       *  - **the setting is on** — `slack.onboardNewChannels`, default true;
+       *  - **not a DM.** A DM is reached through `slack.dmAllowlist`, which is a
+       *    deliberate per-user act by the operator; there is nobody there to
+       *    onboard. See `isDirectMessage` for why the `channel_type` test alone is
+       *    not enough on a reaction-triggered turn;
+       *  - **the channel has no `channels.directory` entry.** An operator who
+       *    mapped a channel already knows the mapping exists — explaining it back
+       *    to them is noise. Id-only lookup, matching `allowlistRefusal` and
+       *    `knowsChannel`: the connector holds channel ids and never resolves the
+       *    `#label` form those maps also accept;
+       *  - **no `slack_channels` row**, which is the "ever, not this boot" half
+       *    and the only one that survives a restart.
+       */
+      onboardingContext(event, isResume, settings) {
+        if (isResume)
+          return "";
+        if (!settings.slack.onboardNewChannels)
+          return "";
+        if (!event.channel)
+          return "";
+        if (isDirectMessage(event))
+          return "";
+        if (Object.prototype.hasOwnProperty.call(settings.channels.directory, event.channel))
+          return "";
+        if (this.onboardedChannels.has(event.channel))
+          return "";
+        if (hasSeenChannel(event.channel))
+          return "";
+        this.onboardedChannels.add(event.channel);
+        log41.info("priming first-contact guidance for a new slack channel", { channel: event.channel });
+        return buildOnboardingContext(event.channel);
       }
       // ── Session lifecycle → the card ────────────────────────────────────────
       onGatewayEvent(event, payload) {
@@ -11354,7 +11548,7 @@ ${answer}` : answer;
           outcome: effective,
           cardTs
         });
-        log40.info("slack turn sealed", { sessionId, outcome: effective, cardTs, delivered: turn.card.delivered });
+        log41.info("slack turn sealed", { sessionId, outcome: effective, cardTs, delivered: turn.card.delivered });
       }
     };
     active = null;
@@ -11404,7 +11598,7 @@ async function slackRoutes(req, res, p, method) {
       }
       const rootTs = validated.threadTs ?? ts;
       jobRoots.register({ channel: validated.channel, rootTs, jobId: validated.jobId, externalRefId });
-      log41.info("job root post delivered", { jobId: validated.jobId, channel: validated.channel });
+      log42.info("job root post delivered", { jobId: validated.jobId, channel: validated.channel });
       json(res, { ok: true, ts, rootTs, channel: validated.channel, externalRef: externalRefId }, 200, req);
     } catch (err) {
       json(res, { error: errMsg(err) }, 502, req);
@@ -11413,7 +11607,7 @@ async function slackRoutes(req, res, p, method) {
   }
   return false;
 }
-var log41;
+var log42;
 var init_slack = __esm({
   "packages/gateway/dist/routes/slack.js"() {
     "use strict";
@@ -11424,11 +11618,32 @@ var init_slack = __esm({
     init_job_roots();
     init_dashboard_links();
     init_logger();
-    log41 = logger.child("routes:slack");
+    log42 = logger.child("routes:slack");
   }
 });
 
 // packages/gateway/dist/routes/settings.js
+function validateMcpGrant(label, value) {
+  if (value === "full")
+    return { ok: true, grant: "full" };
+  if (!Array.isArray(value)) {
+    return { ok: false, error: `${label} must be "full" or an array of MCP server names` };
+  }
+  if (value.length > CHANNEL_MCP_NAMES_MAX) {
+    return { ok: false, error: `${label} must name at most ${CHANNEL_MCP_NAMES_MAX} servers` };
+  }
+  const names = [];
+  for (const raw of value) {
+    if (typeof raw !== "string" || raw.trim().length === 0 || raw.length > MCP_SERVER_NAME_MAX_LEN) {
+      return {
+        ok: false,
+        error: `${label} entries must be non-empty server names of at most ${MCP_SERVER_NAME_MAX_LEN} chars`
+      };
+    }
+    names.push(raw.trim());
+  }
+  return { ok: true, grant: names };
+}
 function applySettingsPatch(current, patch, ctx) {
   for (const key of Object.keys(patch)) {
     if (!KNOWN_TOP_LEVEL_KEYS.has(key)) {
@@ -11540,7 +11755,7 @@ function applySettingsPatch(current, patch, ctx) {
     }
     const c = patch.channels;
     for (const key of Object.keys(c)) {
-      if (key !== "directory" && key !== "mcp") {
+      if (key !== "directory" && key !== "mcp" && key !== "mcpDefault") {
         return { ok: false, error: `Unknown settings key: channels.${key.slice(0, 64)}` };
       }
     }
@@ -11580,36 +11795,24 @@ function applySettingsPatch(current, patch, ctx) {
         if (key.length === 0 || key.length > CHANNEL_KEY_MAX_LEN) {
           return { ok: false, error: `channels.mcp keys must be 1-${CHANNEL_KEY_MAX_LEN} chars` };
         }
-        if (value === "full") {
-          mcpMap[key] = "full";
-          continue;
-        }
-        if (!Array.isArray(value)) {
-          return {
-            ok: false,
-            error: `channels.mcp["${key.slice(0, 64)}"] must be "full" or an array of MCP server names`
-          };
-        }
-        if (value.length > CHANNEL_MCP_NAMES_MAX) {
-          return {
-            ok: false,
-            error: `channels.mcp["${key.slice(0, 64)}"] must name at most ${CHANNEL_MCP_NAMES_MAX} servers`
-          };
-        }
-        const names = [];
-        for (const raw of value) {
-          if (typeof raw !== "string" || raw.trim().length === 0 || raw.length > MCP_SERVER_NAME_MAX_LEN) {
-            return {
-              ok: false,
-              error: `channels.mcp["${key.slice(0, 64)}"] entries must be non-empty server names of at most ${MCP_SERVER_NAME_MAX_LEN} chars`
-            };
-          }
-          names.push(raw.trim());
-        }
-        mcpMap[key] = names;
+        const grant = validateMcpGrant(`channels.mcp["${key.slice(0, 64)}"]`, value);
+        if (!grant.ok)
+          return grant;
+        mcpMap[key] = grant.grant;
       }
       channels = { ...channels, mcp: mcpMap };
     }
+    if (c.mcpDefault !== void 0) {
+      if (c.mcpDefault === null) {
+        const { mcpDefault: _cleared, ...rest } = channels;
+        channels = rest;
+      } else {
+        const grant = validateMcpGrant("channels.mcpDefault", c.mcpDefault);
+        if (!grant.ok)
+          return grant;
+        channels = { ...channels, mcpDefault: grant.grant };
+      }
+    }
   }
   let scheduler = current.scheduler;
   if (patch.scheduler !== void 0) {
@@ -11638,7 +11841,7 @@ function applySettingsPatch(current, patch, ctx) {
       if (!SLACK_KNOWN_KEYS.has(key))
         return { ok: false, error: `Unknown settings key: slack.${key.slice(0, 64)}` };
     }
-    for (const key of ["enabled", "requireMention", "allowUnmappedChannels"]) {
+    for (const key of ["enabled", "requireMention", "allowUnmappedChannels", "onboardNewChannels"]) {
       if (sl[key] !== void 0) {
         if (typeof sl[key] !== "boolean")
           return { ok: false, error: `slack.${key} must be a boolean` };
@@ -11765,14 +11968,14 @@ async function settingsRoutes(req, res, p, method) {
       return true;
     }
     writeSettings(result2.settings);
-    log42.info("settings updated");
+    log43.info("settings updated");
     emit(SETTINGS_UPDATED, { settings: result2.settings });
     json(res, result2.settings, 200, req);
     return true;
   }
   return false;
 }
-var log42, RETENTION_DAYS_MIN2, RETENTION_DAYS_MAX2, BIND_HOST_MAX_LEN, KNOWN_TOP_LEVEL_KEYS, ALLOWED_HOSTS_MAX_ENTRIES, MAX_CONCURRENT_JOBS_MAX, MODEL_MAX_LEN2, TIMEOUT_MS_MAX, RETRIES_MAX, CHANNEL_KEY_MAX_LEN, CHANNEL_PATH_MAX_LEN, CHANNEL_MAP_MAX_ENTRIES, CHANNEL_MCP_NAMES_MAX, MCP_SERVER_NAME_MAX_LEN, SLACK_EMOJI_RE, SLACK_TRIGGERS_MAX, SLACK_USER_ID_RE, SLACK_KNOWN_KEYS, MCP_SERVER_NAME_RE;
+var log43, RETENTION_DAYS_MIN2, RETENTION_DAYS_MAX2, BIND_HOST_MAX_LEN, KNOWN_TOP_LEVEL_KEYS, ALLOWED_HOSTS_MAX_ENTRIES, MAX_CONCURRENT_JOBS_MAX, MODEL_MAX_LEN2, TIMEOUT_MS_MAX, RETRIES_MAX, CHANNEL_KEY_MAX_LEN, CHANNEL_PATH_MAX_LEN, CHANNEL_MAP_MAX_ENTRIES, CHANNEL_MCP_NAMES_MAX, MCP_SERVER_NAME_MAX_LEN, SLACK_EMOJI_RE, SLACK_TRIGGERS_MAX, SLACK_USER_ID_RE, SLACK_KNOWN_KEYS, MCP_SERVER_NAME_RE;
 var init_settings = __esm({
   "packages/gateway/dist/routes/settings.js"() {
     "use strict";
@@ -11784,7 +11987,7 @@ var init_settings = __esm({
     init_bind_host();
     init_websocket();
     init_logger();
-    log42 = logger.child("settings");
+    log43 = logger.child("settings");
     RETENTION_DAYS_MIN2 = 1;
     RETENTION_DAYS_MAX2 = 3650;
     BIND_HOST_MAX_LEN = 253;
@@ -11814,6 +12017,7 @@ var init_settings = __esm({
       "allowUnmappedChannels",
       "dmAllowlist",
       "knownConnectors",
+      "onboardNewChannels",
       "persona"
     ]);
     MCP_SERVER_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9_.-]*$/;
@@ -11992,17 +12196,17 @@ function serveStatic(req, res) {
   headers["Cache-Control"] = filePath.startsWith(assetsPrefix) ? "public, max-age=31536000, immutable" : "no-cache";
   res.writeHead(200, headers);
   fs25.createReadStream(filePath).on("error", (err) => {
-    log43.warn("static read failed", { err: err.message });
+    log44.warn("static read failed", { err: err.message });
     res.end();
   }).pipe(res);
 }
-var log43, MIME, SERVE_STATIC;
+var log44, MIME, SERVE_STATIC;
 var init_static = __esm({
   "packages/gateway/dist/static.js"() {
     "use strict";
     init_config();
     init_logger();
-    log43 = logger.child("static");
+    log44 = logger.child("static");
     MIME = {
       ".html": "text/html; charset=utf-8",
       ".js": "text/javascript; charset=utf-8",
@@ -12078,7 +12282,7 @@ function foldProfilesIntoJobs() {
       continue;
     if (!profile) {
       if (profileName !== DEFAULT_PROFILE_NAME) {
-        log44.warn("job references a profile that could not be resolved \u2014 leaving the job and its profile key alone", {
+        log45.warn("job references a profile that could not be resolved \u2014 leaving the job and its profile key alone", {
           jobId: id,
           profile: profileName
         });
@@ -12104,7 +12308,7 @@ function foldProfilesIntoJobs() {
     try {
       writeJsonAtomicPreservingMode(jobPath2, merged);
     } catch (err) {
-      log44.warn("failed to rewrite job while folding its profile \u2014 leaving it unchanged", {
+      log45.warn("failed to rewrite job while folding its profile \u2014 leaving it unchanged", {
         jobId: id,
         profile: profileName,
         err: err instanceof Error ? err.message : String(err)
@@ -12113,7 +12317,7 @@ function foldProfilesIntoJobs() {
       continue;
     }
     folded.push(id);
-    log44.info("folded profile into job", {
+    log45.info("folded profile into job", {
       jobId: id,
       profile: profileName,
       inherited: inherited.length > 0 ? inherited.join(",") : "none"
@@ -12122,16 +12326,16 @@ function foldProfilesIntoJobs() {
   const stillReferenced = collectReferencedProfiles();
   for (const name of [...consumed].sort()) {
     if (stillReferenced.has(name)) {
-      log44.info("keeping a folded profile file: another job still names it", { profile: name });
+      log45.info("keeping a folded profile file: another job still names it", { profile: name });
       continue;
     }
     const profilePath = path26.join(profilesDir(), `${name}.json`);
     try {
       fs26.unlinkSync(profilePath);
       deletedProfiles.push(name);
-      log44.info("deleted consumed profile file", { profile: name });
+      log45.info("deleted consumed profile file", { profile: name });
     } catch (err) {
-      log44.warn("failed to delete a consumed profile file", {
+      log45.warn("failed to delete a consumed profile file", {
         profile: name,
         err: err instanceof Error ? err.message : String(err)
       });
@@ -12139,13 +12343,13 @@ function foldProfilesIntoJobs() {
   }
   const leftovers = listUnconsumedProfiles(consumed);
   if (leftovers.length > 0) {
-    log44.info("profile files no job referenced were left in place for review", {
+    log45.info("profile files no job referenced were left in place for review", {
       profiles: leftovers.join(","),
       dir: profilesDir()
     });
   }
   if (folded.length > 0 || deletedProfiles.length > 0 || unresolved.length > 0) {
-    log44.info("profile fold complete", {
+    log45.info("profile fold complete", {
       folded: folded.length,
       deletedProfiles: deletedProfiles.length,
       unresolved: unresolved.length
@@ -12179,14 +12383,14 @@ function listUnconsumedProfiles(consumed) {
   }
   return files.filter((f) => f.endsWith(".json")).map((f) => f.slice(0, -5)).filter((name) => !consumed.has(name)).sort();
 }
-var log44, profilesDir, FOLDED_KEYS, PROFILE_NAME_RE, DEFAULT_PROFILE_NAME;
+var log45, profilesDir, FOLDED_KEYS, PROFILE_NAME_RE, DEFAULT_PROFILE_NAME;
 var init_profile_fold = __esm({
   "packages/gateway/dist/cron/profile-fold.js"() {
     "use strict";
     init_paths();
     init_logger();
     init_job_store();
-    log44 = logger.child("profile-fold");
+    log45 = logger.child("profile-fold");
     profilesDir = () => path26.join(teamworkHomeDir(), "profiles");
     FOLDED_KEYS = ["model", "persona", "pluginDirs", "mcpServers", "spendCapUsd"];
     PROFILE_NAME_RE = /^[a-z0-9][a-z0-9-]{0,63}$/;
@@ -12234,7 +12438,7 @@ function startGateway() {
         res.end("TeamworkOS gateway is running. Start the Vite dev server for the dashboard.");
       }
     } catch (e) {
-      log45.error("Unhandled request error", e);
+      log46.error("Unhandled request error", e);
       json(res, { error: "Internal server error" }, 500, req);
     }
   });
@@ -12245,22 +12449,22 @@ function startGateway() {
   startRetentionSweeper();
   void startSlackConnector();
   function gracefulShutdown(signal) {
-    log45.info(`Received ${signal}, shutting down gracefully...`);
+    log46.info(`Received ${signal}, shutting down gracefully...`);
     stopSweeper();
     stopScheduler();
     stopAuthProbe();
     stopRetentionSweeper();
-    void stopSlackConnector().catch((err) => log45.error("slack connector shutdown failed", err));
+    void stopSlackConnector().catch((err) => log46.error("slack connector shutdown failed", err));
     try {
       sessionManager.interruptAll();
     } catch (err) {
-      log45.error("interruptAll during shutdown failed", err);
+      log46.error("interruptAll during shutdown failed", err);
     }
     closeAllClients().catch(() => {
     });
     server.closeAllConnections?.();
     server.close(() => {
-      log45.info("Server closed");
+      log46.info("Server closed");
       try {
         closeDb();
       } catch {
@@ -12268,7 +12472,7 @@ function startGateway() {
       process.exit(0);
     });
     setTimeout(() => {
-      log45.error("Forced shutdown after timeout");
+      log46.error("Forced shutdown after timeout");
       process.exit(1);
     }, 1e4).unref();
   }
@@ -12276,7 +12480,7 @@ function startGateway() {
   process.on("SIGINT", () => gracefulShutdown("SIGINT"));
   const bind = resolveBindHost(settings.server.bindHost, currentAuthToken() !== null);
   if (bind.refused) {
-    log45.error(`Refusing configured server.bindHost ${JSON.stringify(bind.refused.configured)}: ${bind.refused.reason}. Binding ${bind.host} instead.`);
+    log46.error(`Refusing configured server.bindHost ${JSON.stringify(bind.refused.configured)}: ${bind.refused.reason}. Binding ${bind.host} instead.`);
   }
   server.listen(PORT, bind.host, () => {
     const homeDisplay = teamworkHomeDir().replace(process.env.HOME ?? "", "~");
@@ -12295,10 +12499,10 @@ function startGateway() {
     console.log("");
     const rawAddr = server.address();
     if (rawAddr === null || typeof rawAddr === "string") {
-      log45.warn(`unexpected server.address() shape; skipping boot signal: ${JSON.stringify(rawAddr)}`);
+      log46.warn(`unexpected server.address() shape; skipping boot signal: ${JSON.stringify(rawAddr)}`);
     } else {
       const addr = rawAddr;
-      log45.info("TeamworkOS ready", buildBootSignalFields({
+      log46.info("TeamworkOS ready", buildBootSignalFields({
         teamworkHome: teamworkHomeDir(),
         port: addr.port
       }));
@@ -12306,7 +12510,7 @@ function startGateway() {
   });
   return server;
 }
-var log45;
+var log46;
 var init_server = __esm({
   "packages/gateway/dist/server.js"() {
     "use strict";
@@ -12330,7 +12534,7 @@ var init_server = __esm({
     init_paths();
     init_helpers();
     init_logger();
-    log45 = logger.child("gateway");
+    log46 = logger.child("gateway");
   }
 });