feat!: simplify hack to a local-first core

.hack/docker-compose.yml

@@ -10,48 +10,6 @@ services:
     networks:
       - default
 
-  web:
-    image: imbios/bun-node:latest
-    working_dir: /app
-    volumes:
-      - ..:/app
-      - node_modules:/app/node_modules
-    depends_on:
-      deps:
-        condition: service_completed_successfully
-    command: bun run --cwd apps/web dev -- --hostname 0.0.0.0 --port 3000
-    environment:
-      CHOKIDAR_USEPOLLING: "true"
-      WATCHPACK_POLLING: "true"
-    labels:
-      caddy: "hack-cli.hack, hack-cli.hack.gy"
-      caddy.reverse_proxy: "{{upstreams 3000}}"
-      caddy.tls: internal
-    networks:
-      - hack-dev
-      - default
-
-  auth-broker:
-    image: imbios/bun-node:latest
-    working_dir: /app
-    volumes:
-      - ..:/app
-      - node_modules:/app/node_modules
-    depends_on:
-      deps:
-        condition: service_completed_successfully
-    command: bun run --cwd services/auth-broker start
-    environment:
-      PORT: "8080"
-      HOST: "0.0.0.0"
-    labels:
-      caddy: "auth.hack-cli.hack, auth.hack-cli.hack.gy"
-      caddy.reverse_proxy: "{{upstreams 8080}}"
-      caddy.tls: internal
-    networks:
-      - hack-dev
-      - default
-
 networks:
   hack-dev:
     external: true

.hack/hack.env.remote.yaml

@@ -2,14 +2,4 @@ version: 1
 environment: remote
 secretsprovider: project_key
 values:
-  web:
-    HACK_AUTH_BROKER_URL: https://auth.hack.broker
-    NEXT_PUBLIC_HACK_AUTH_BROKER_URL: https://auth.hack.broker
-  auth-broker:
-    AUTH_BROKER_PUBLIC_BASE_URL: https://auth.hack.broker
-    BETTER_AUTH_URL: https://auth.hack.broker
-    # Broker custom GitHub OAuth callback for Hack-owned flows.
-    # Better Auth browser social login uses:
-    #   ${BETTER_AUTH_URL}/api/auth/callback/github
-    GITHUB_REDIRECT_URI: https://auth.hack.broker/gh/callback
-    HACK_LINEAR_REDIRECT_URI: https://auth.hack.broker/linear/callback
+  global: {}

WORKFLOW.md

@@ -1,102 +1,62 @@
 # Hack CLI Workflow
 
-This repository is the source tree for the `hack` CLI and related services.
+This repository is the source tree for the Hack CLI and the local-first macOS companion.
 
 ## Core expectations
 
 - Use Bun, not npm, pnpm, or yarn.
-- Prefer targeted package or service commands before broad workspace runs.
-- Keep changes scoped to the ticket. Do not mix unrelated cleanup into the same branch.
-- Work inside the ticket worktree and ticket branch created by Symphony.
-- Commit useful checkpoints as you make progress. Do not wait until the very end to create the first commit if the change is substantial.
-- Before finishing, make sure the branch is in a state that can be pushed and reviewed cleanly.
+- Prefer targeted checks before broad workspace runs.
+- Keep changes scoped and reviewable.
+- Capture real verification for CLI/runtime/env changes.
 
 ## Project structure
 
-- `index.ts`, `src/**`: root CLI entrypoints and orchestration logic
+- `index.ts`, `src/**`: CLI and runtime orchestration
 - `packages/cli/**`: packaged CLI build/install scripts and macOS helper commands
-- `services/auth-broker/**`: auth broker service
-- `packages/db/**`: database package
+- `packages/db/**`: internal database package
 - `apps/macos/**`: native desktop app
-- `docs/**`, `README.md`: user/operator documentation
+- `docs/**`, `README.md`: current product docs
 
 ## Default validation
 
-Start with the narrowest checks that match the files you changed, then run broader checks before handoff.
-
-### Common commands
-
 ```bash
 bun run typecheck
 bun run test
 bun run check
 ```
 
-### Package and service focused commands
+Focused checks:
 
 ```bash
 bun run --cwd packages/cli test
 bun run --cwd packages/cli typecheck
-bun run --cwd packages/cli check
-
-bun run --cwd services/auth-broker test
-bun run --cwd services/auth-broker typecheck
-bun run --cwd services/auth-broker check
-
 bun run --cwd packages/db test
-bun run --cwd packages/db typecheck
-bun run --cwd packages/db check
+bun run macos:test
 ```
 
-### Local install / runtime smoke checks
-
-Use these when the ticket changes install, packaging, startup, or command behavior.
+## Local runtime smoke checks
 
 ```bash
 bun run install:status
-bun run install:dev
 hack --help
 ```
 
-### Desktop / macOS work
-
-Only run these when the ticket touches `apps/macos` or macOS-specific packaging.
-
-```bash
-bun run macos:test
-bun run macos:build
-```
-
-## Development guidance
-
-- Prefer root `bun run` scripts for workspace-wide behavior.
-- Prefer package-local commands when you are changing a single area.
-- If you change CLI behavior, capture at least one realistic command path in tests or a documented smoke check.
-- If you change docs or workflow behavior, keep examples accurate with the current CLI surface.
-- If you touch build, install, release, or runtime image code, include a smoke check that proves the command still executes.
-
-## Git and PR workflow
-
-- The ticket worktree should already be on a dedicated ticket branch.
-- Commit incrementally with clear messages.
-- Keep the branch rebased or merge-ready.
-- When preparing for merge:
-  - make sure validation commands are recorded
-  - summarize any residual risk
-  - do not mark the work done if CI-critical checks are still unverified
+## Product boundary
 
-## What to avoid
+Supported:
 
-- Do not introduce Node-only workflows when Bun already covers the use case.
-- Do not hand-edit generated artifacts unless the ticket is specifically about generation outputs.
-- Do not run broad destructive cleanup across unrelated packages.
-- Do not assume macOS-only paths are safe to change without validation.
+- local runtime orchestration
+- env management
+- sessions
+- diagnostics
+- optional local tickets
+- slim macOS companion
 
-## Completion checklist
+Removed:
 
-Before handing work back for review:
+- hosted auth/account/org/team flows
+- built-in GitHub workflows
+- built-in Linear workflows
+- web dashboard
 
-1. Run targeted validation for the touched area.
-2. Run broader validation if the change affects shared runtime, install, orchestration, or release behavior.
-3. Make sure the working tree changes are intentional and reviewable.
-4. Leave a concise summary of what changed, how it was validated, and any remaining follow-up.
+Remote/gateway/node/dispatch stay unsupported experimental.

apps/macos/App/HackDesktopApp.swift

@@ -108,10 +108,9 @@ struct HackDesktopApp: App {
 
   @MainActor
   private func handleIncomingDeepLink(url: URL) {
-    let handledHackAuth = model.ingestHackAuthDeepLink(url: url)
-    let handledGitHub = model.ingestGitHubOAuthDeepLink(url: url)
-    let handledLinear = model.ingestLinearOAuthDeepLink(url: url)
-    guard handledHackAuth || handledGitHub || handledLinear else { return }
+    guard url.scheme != nil else { return }
+
+    model.statusMessage = "Hosted auth and integration callbacks are no longer supported in Hack Desktop v3."
 
 #if os(macOS)
     NSApp.activate(ignoringOtherApps: true)
@@ -120,7 +119,7 @@ struct HackDesktopApp: App {
       name: .hackSettingsRequested,
       object: nil,
       userInfo: [
-        "pane": handledHackAuth ? "account" : (handledLinear ? "linear" : "github"),
+        "pane": "runtime",
       ]
     )
   }

apps/macos/App/Info.plist

@@ -25,12 +25,6 @@
 			</array>
 		</dict>
 	</array>
-	<key>HackAuthCompletionURL</key>
-	<string>$(HACK_URL_SCHEME)://auth/complete</string>
-	<key>HackGitHubOAuthCallbackURL</key>
-	<string>$(HACK_URL_SCHEME)://auth/github/callback</string>
-	<key>HackLinearOAuthCallbackURL</key>
-	<string>$(HACK_URL_SCHEME)://auth/linear/callback</string>
 	<key>CFBundlePackageType</key>
 	<string>APPL</string>
 	<key>CFBundleShortVersionString</key>
@@ -44,6 +38,6 @@
 	<key>NSAppleEventsUsageDescription</key>
 	<string>Hack Desktop can open Terminal to run hack setup commands (some require sudo) so your local dev environment works.</string>
 	<key>NSLocalNetworkUsageDescription</key>
-	<string>Hack Desktop can access your local network to show LAN gateway status and open local development URLs.</string>
+	<string>Hack Desktop can access your local network to open local development URLs and inspect local runtime services on this machine.</string>
 </dict>
 </plist>

apps/macos/Package.swift

@@ -37,7 +37,10 @@ let package = Package(
         .product(name: "MarkdownUI", package: "swift-markdown-ui"),
         .product(name: "Highlightr", package: "Highlightr")
       ],
-      path: "Packages/Features/DashboardFeature/Sources/DashboardFeature"
+      path: "Packages/Features/DashboardFeature/Sources/DashboardFeature",
+      exclude: [
+        "TicketMarkdownCodeSyntaxHighlighter.swift",
+      ]
     ),
     .testTarget(
       name: "HackDesktopModelsTests",