feat(web): expand account shell and streamline install flows

.github/workflows/release.yml

@@ -150,3 +150,52 @@ jobs:
     with:
       tag: ${{ needs.create-release.outputs.tag }}
     secrets: inherit
+
+  update-homebrew-tap:
+    needs: [create-release, build]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Require tap push token
+        env:
+          TAP_TOKEN: ${{ secrets.RELEASE_PAT }}
+        run: |
+          if [ -z "$TAP_TOKEN" ]; then
+            echo "Missing secret RELEASE_PAT"
+            exit 1
+          fi
+      - name: Checkout hack
+        uses: actions/checkout@v4
+      - name: Checkout tap repo
+        uses: actions/checkout@v4
+        with:
+          repository: hack-dance/homebrew-tap
+          token: ${{ secrets.RELEASE_PAT }}
+          ref: main
+          path: homebrew-tap
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v1
+        with:
+          bun-version: "1.3.9"
+      - name: Render formula
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          bun run scripts/update-homebrew-tap.ts \
+            --tag="${{ needs.create-release.outputs.tag }}" \
+            --version="${{ needs.create-release.outputs.version }}" \
+            --tap-dir=homebrew-tap
+      - name: Commit and push tap update
+        working-directory: homebrew-tap
+        run: |
+          set -euo pipefail
+          git add Formula/hack.rb
+          if git diff --cached --quiet; then
+            echo "No Homebrew tap changes to push."
+            exit 0
+          fi
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git commit -m "build(hack): update formula to ${{ needs.create-release.outputs.tag }}"
+          git push origin HEAD:main

.gitignore

@@ -28,9 +28,16 @@ report.[0-9]_.[0-9]_.[0-9]_.[0-9]_.json
 *.app-key.pem
 *.p8
 hackdance.*.private-key.pem
+.hack/hack.env.default.yaml
 .hack.secret.key
+.hack/.env
+.hack/.env.state.json
 .hack-secrets-file.key
 .hack-secrets.enc.json
+.hack/linear
+.hack/_linear
+.hack/internal
+.hack/.env.state.json
 
 # caches
 .eslintcache

.gitleaksignore

@@ -1,3 +1,4 @@
 14f9809b6a474ac2c820a4268dcbfc67fe878639:services/auth-broker/Untitled:generic-api-key:2
 cbad51795170d25e1ab0926c1ac5a74d1e001ef9:.factory/validation/misc-admin-followups-1/user-testing/flows/management-token-email-verified.json:generic-api-key:8
 e069b8546c112e5b5c8ab0ec82fd24a4f19ef16b:.hack/tickets/events/events-2026-03.jsonl:generic-api-key:58
+939c2b2cb680744707b1d085db0bc0ce8fac32e4:tests/env.test.ts:private-key:7

.hack/docker-compose.yml

@@ -23,12 +23,6 @@ services:
     environment:
       CHOKIDAR_USEPOLLING: "true"
       WATCHPACK_POLLING: "true"
-      HACK_WEB_APP_BASE_URL: https://hack-cli.hack
-      HACK_AUTH_BROKER_URL: https://auth.hack-cli.hack
-      HACK_AUTH_BROKER_INTERNAL_URL: http://auth-broker:8080
-      NEXT_PUBLIC_HACK_WEB_APP_BASE_URL: https://hack-cli.hack
-      NEXT_PUBLIC_HACK_AUTH_BROKER_URL: https://auth.hack-cli.hack
-      BETTER_AUTH_TRUSTED_ORIGINS: https://hack-cli.hack,https://hack-cli.hack.gy
     labels:
       caddy: "hack-cli.hack, hack-cli.hack.gy"
       caddy.reverse_proxy: "{{upstreams 3000}}"
@@ -50,9 +44,6 @@ services:
     environment:
       PORT: "8080"
       HOST: "0.0.0.0"
-      AUTH_BROKER_PUBLIC_BASE_URL: https://auth.hack-cli.hack
-      HACK_WEB_APP_BASE_URL: https://hack-cli.hack
-      BETTER_AUTH_TRUSTED_ORIGINS: https://hack-cli.hack,https://hack-cli.hack.gy
     labels:
       caddy: "auth.hack-cli.hack, auth.hack-cli.hack.gy"
       caddy.reverse_proxy: "{{upstreams 8080}}"

.hack/hack.env.remote.yaml

@@ -0,0 +1,15 @@
+version: 1
+environment: remote
+secretsprovider: project_key
+values:
+  web:
+    HACK_AUTH_BROKER_URL: https://auth.hack.broker
+    NEXT_PUBLIC_HACK_AUTH_BROKER_URL: https://auth.hack.broker
+  auth-broker:
+    AUTH_BROKER_PUBLIC_BASE_URL: https://auth.hack.broker
+    BETTER_AUTH_URL: https://auth.hack.broker
+    # Broker custom GitHub OAuth callback for Hack-owned flows.
+    # Better Auth browser social login uses:
+    #   ${BETTER_AUTH_URL}/api/auth/callback/github
+    GITHUB_REDIRECT_URI: https://auth.hack.broker/gh/callback
+    HACK_LINEAR_REDIRECT_URI: https://auth.hack.broker/linear/callback